openclaw-lark-multi-agent 1.8.15 → 1.8.16

package/dist/feishu-bot.d.ts

@@ -38,6 +38,9 @@ export declare class FeishuBot {
     /** Per-chat processQueue lock to avoid duplicate concurrent chat.send runs */
     private queueRuns;
     private queueOwners;
+    /** Monotone local batch epoch: an empty owner map must not hide an
+     * intervening admission/finish (ABA) from an asynchronous public lookup. */
+    private queueAdmissionEpoch;
     /** Per-chat serial send queue to guarantee message order */
     private sendQueue;
     /** Per-chat delayed runtime failure notifications, canceled if a real reply arrives. */
@@ -128,10 +131,23 @@ export declare class FeishuBot {
     static getByName(name: string): FeishuBot | undefined;
     static findByOpenId(openId: string): FeishuBot | undefined;
     private handleMessage;
+    /** Separate guarded-admission proof. Aggregate busy never becomes idle. */
+    private observedFollowupGuard;
+    /** A positive refusal must be durable AND explained to the sender. */
+    private retainChangedFollowup;
+    private explainUnconfirmedFollowup;
+    /** Keep each input's first observed leaf: a fresh arrival must not borrow
+     * an obsolete scheduler leaf from before it was received. */
+    private pinDispatchFollowupProof;
     /** With no local owner, the Gateway can still have externally admitted work.
      * Read public activity and pin its exact root before choosing insertion. Missing
      * identity is durable unbound custody, never a fabricated run or blind send. */
     private reconcileCurrentInputActivity;
+    /** An ingress reservation can outlive an ACK-window owner which finished
+     * before learning its runId. It is still never-attempted custody, not a
+     * licence to retarget/steer a successor. Require the same guarded proof and
+     * bounded observation with NO replacement local scheduler at every await. */
+    private reconcileRetainedFollowup;
     /** CAS includes the actual batch, not merely the queue Promise, and excludes
      * local admission/RPC windows even if the host briefly reports idle. */
     private reconcileDispatchCustody;
@@ -171,11 +187,10 @@ export declare class FeishuBot {
     private fireRunFailureObservers;
     private processQueue;
     /**
-     * Force-release a stuck queue owner after the gateway authoritatively
-     * reported the session idle (no active run). The zombie owner's deep waits
-     * can otherwise hold chat custody forever: completion events routed through
-     * the proactive path are invisible to them. Steer-fallback triggers are
-     * restored via the failure observers so their input drains normally.
+     * Retire only the local queue scheduler after positive idle, trusted yield,
+     * or bounded guarded-followup proof. Never stop Gateway execution or infer
+     * a terminal outcome. Exact result recovery/target custody remains durable;
+     * attempted-unknown and accepted insertion records never enter replay.
      */
     private forceExpireQueueOwner;
     private processQueueInner;

package/dist/feishu-bot.js

@@ -4,7 +4,7 @@ import * as lark from "@larksuiteoapi/node-sdk";
 import { createRequire } from "module";
 import { persistBotModel } from "./config.js";
 import { getI18n, normalizeLocale } from "./i18n.js";
-import { InactiveRunObservation, AdmissionUnconfirmed, CollectorStalledError } from "./openclaw-client.js";
+import { InactiveRunObservation, AdmissionUnconfirmed, CollectorStalledError, FollowupAdmissionRefused } from "./openclaw-client.js";
 import { SessionWaitPaused, isWaitTimeout, normalizeSessionRuntimeStatus, formatSessionFooter, FOREGROUND_WAIT_MS } from "./session-status.js";
 import { SupersededObservation } from "./openclaw-client.js";
 import { LiveStatusController, LiveStatusEffectRejectedError, LiveStatusEffectUnknownError } from "./live-status.js";
@@ -30,6 +30,7 @@ export class SendDeadlineError extends Error {
     }
 }
 const nonemptyReceipt = (value) => typeof value === 'string' && !!value.trim();
+const canonicalPhysicalSessionKey = (key) => /^agent:[^:]+:/.test(key) ? key : `agent:main:${key}`;
 const require = createRequire(import.meta.url);
 const LMA_VERSION = require("../package.json").version;
 const MAX_BOT_STREAK = 10;
@@ -148,6 +149,9 @@ export class FeishuBot {
     /** Per-chat processQueue lock to avoid duplicate concurrent chat.send runs */
     queueRuns = new Map();
     queueOwners = new Map();
+    /** Monotone local batch epoch: an empty owner map must not hide an
+     * intervening admission/finish (ABA) from an asynchronous public lookup. */
+    queueAdmissionEpoch = new Map();
     /** Per-chat serial send queue to guarantee message order */
     sendQueue = new Map();
     /** Per-chat delayed runtime failure notifications, canceled if a real reply arrives. */
@@ -1283,9 +1287,9 @@ export class FeishuBot {
             if (unhealthy) {
                 await this.warnUnhealthySessionAndContinue(chatId, messageId, unhealthy);
             }
-            // Inspect current public activity, not just the local promise. A yielded
-            // task (or a settled/uncached old root with authoritative idle history)
-            // keeps its result observer but cannot monopolize independent new input.
+            // Inspect public activity, not just the local promise. Trusted yield,
+            // positive idle, or bounded guarded-followup proof may hand off ONLY the
+            // local scheduler; the original exact result observer/target survives.
             const dispatchReleased = await this.reconcileDispatchCustody(chatId);
             if (this.stopGeneration(chatId) !== inputStopEpoch)
                 return;
@@ -1311,8 +1315,8 @@ export class FeishuBot {
                 return;
             }
             // --- Queue-based sending: if agent is busy, just accumulate ---
-            // The actual queue owner, not elapsed wall time, decides whether input
-            // should steer/queue. Long healthy runs must not lose their busy ownership.
+            // No task-lifetime cutoff: long healthy runs retain execution/result
+            // custody. Local scheduling handoff requires independent public proof.
             const isBusy = reservedAtIngress || this.queueRuns.has(chatId) || !!this.store.getDispatchCustody(this.config.name, chatId);
             if (isBusy) {
                 const owner = this.queueOwners.get(chatId) || this.store.getDispatchCustody(this.config.name, chatId);
@@ -1333,17 +1337,49 @@ export class FeishuBot {
             console.error(`[${this.config.name}] Error:`, safeErrorSummary(err));
         }
     }
+    /** Separate guarded-admission proof. Aggregate busy never becomes idle. */
+    observedFollowupGuard(chatId, status, activity, noEffectRunId) {
+        if (!activity.followupAdmissionEligible || activity.identityConflict || activity.activeRunId && !noEffectRunId || activity.archived || status.archived ||
+            !status.sessionId || status.sessionId !== activity.sessionId || !activity.expectedLeafEntryId)
+            return;
+        return { sessionKey: canonicalPhysicalSessionKey(this.getSessionKey(chatId)), sessionId: status.sessionId, expectedLeafEntryId: activity.expectedLeafEntryId,
+            ...(noEffectRunId ? { nonInjectableRunId: noEffectRunId } : {}) };
+    }
+    /** A positive refusal must be durable AND explained to the sender. */
+    retainChangedFollowup(chatId, item, reason) {
+        this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, 'target_changed', { ...item, reason });
+        const key = `followup:${item.insertionId}:refused`;
+        void this.enqueueAndDispatchDelivery(chatId, 'admission_status', key, 'ℹ️ 这条消息仍保留在本地，尚未确认 Gateway 接收：会话或准入保护条件已变化。不会迁移或自动重发；请检查会话后决定是否另发新消息。', [], item.messageId, key).catch(() => { });
+    }
+    explainUnconfirmedFollowup(chatId, item) {
+        const key = `followup:${item.insertionId}:guard-unavailable`;
+        void this.enqueueAndDispatchDelivery(chatId, 'admission_status', key, 'ℹ️ 这条消息仍在本地保管，尚未确认 Gateway 接收：目前缺少可核验的会话/分支准入证据，或插入能力不可确认。不会显示已接收，也不会盲目重发；证据恢复后继续核验。', [], item.messageId, key).catch(() => { });
+    }
+    /** Keep each input's first observed leaf: a fresh arrival must not borrow
+     * an obsolete scheduler leaf from before it was received. */
+    pinDispatchFollowupProof(chatId, saved, proof) {
+        for (const item of this.store.listInsertions(this.config.name, chatId)) {
+            if (item.state !== 'pending' || item.attempted || item.followupAdmissionGuard || item.ordinaryEligible === false ||
+                item.ownerId !== saved.id || item.batchId !== saved.batchId || item.stopEpoch !== saved.stopEpoch || item.sessionId !== proof.sessionId ||
+                !item.sessionKey || canonicalPhysicalSessionKey(item.sessionKey) !== proof.sessionKey)
+                continue;
+            const source = this.store.getMessageByMessageId(item.messageId);
+            if (source?.senderType !== 'human' || source.triggerKind !== 'normal')
+                continue;
+            this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, 'pending', { ...item, followupAdmissionGuard: proof, followupObservedAt: Date.now() }, item.nextCheckAt);
+        }
+    }
     /** With no local owner, the Gateway can still have externally admitted work.
      * Read public activity and pin its exact root before choosing insertion. Missing
      * identity is durable unbound custody, never a fabricated run or blind send. */
     async reconcileCurrentInputActivity(chatId, rowId, messageId, text) {
         if (!this.openclawClient.getSessionRuntimeStatus || !this.openclawClient.getSessionDispatchStatus)
             return;
-        const epoch = this.stopGeneration(chatId);
+        const epoch = this.stopGeneration(chatId), admissionEpoch = this.queueAdmissionEpoch.get(chatId) || 0;
         // A different ingress handler can ordinary-admit AND finish this row while
         // a public lookup is in flight. Check message custody, not just an empty
         // owner map, at every boundary so a late lookup can never reinsert it.
-        const unsubmitted = () => this.stopGeneration(chatId) === epoch &&
+        const unsubmitted = () => this.stopGeneration(chatId) === epoch && (this.queueAdmissionEpoch.get(chatId) || 0) === admissionEpoch &&
             this.store.getPendingTriggerIds(this.config.name, chatId).has(rowId) &&
             !this.queueOwners.get(chatId)?.triggerIds?.has(rowId);
         if (!unsubmitted())
@@ -1377,6 +1413,8 @@ export class FeishuBot {
         const current = this.store.getInsertion(this.config.name, chatId, rowId);
         if (current && (!current.activityUnbound || current.attempted))
             return;
+        if (current && (current.stopEpoch !== epoch || !current.sessionKey || canonicalPhysicalSessionKey(current.sessionKey) !== canonicalPhysicalSessionKey(this.getSessionKey(chatId))))
+            return;
         const activity = await this.openclawClient.getSessionDispatchStatus(this.getSessionKey(chatId));
         if (!unsubmitted() || this.queueRuns.has(chatId) || this.store.getDispatchCustody(this.config.name, chatId))
             return;
@@ -1384,46 +1422,111 @@ export class FeishuBot {
         // dispatch while this one awaited history. Never restore its older
         // never-attempted snapshot over an attempted/unknown/accepted journal.
         const fresh = this.store.getInsertion(this.config.name, chatId, rowId);
-        if (current ? fresh?.insertionId !== current.insertionId || fresh.state !== 'pending' || fresh.attempted === true || !fresh.activityUnbound || !!fresh.expectedRunId : !!fresh)
+        if (current ? JSON.stringify(fresh) !== JSON.stringify(current) || fresh?.insertionId !== current.insertionId || fresh.state !== 'pending' || fresh.attempted === true || !fresh.activityUnbound || !!fresh.expectedRunId : !!fresh)
+            return;
+        const compatible = !!status.sessionId && status.sessionId === activity.sessionId && (!current?.sessionId || current.sessionId === status.sessionId);
+        const archived = !!status.archived || !!activity.archived;
+        const generationConflict = activity.identityConflict === true || !!activity.sessionId && !!status.sessionId && activity.sessionId !== status.sessionId ||
+            !!current?.sessionId && !!status.sessionId && current.sessionId !== status.sessionId;
+        const source = this.store.getMessageByMessageId(messageId);
+        const ordinaryHuman = source?.id === rowId && source.chatId === chatId && source.senderType === 'human' && source.triggerKind === 'normal';
+        const proof = ordinaryHuman && compatible && !current?.followupBlocked && !archived ? this.observedFollowupGuard(chatId, status, activity) : undefined;
+        const previous = current?.followupAdmissionGuard;
+        if (previous && (archived || generationConflict)) {
+            this.retainChangedFollowup(chatId, { ...current, rowId }, 'observed followup session/archive changed; input retained without migration');
             return;
-        const compatible = !activity.sessionId || !status.sessionId || activity.sessionId === status.sessionId;
-        const idle = compatible && !status.running && !status.archived && !activity.archived && !activity.busyConfirmed &&
-            activity.idleConfirmed === true && !!activity.sessionId;
-        if (idle) {
+        }
+        const idle = compatible && !status.running && !archived && !activity.busyConfirmed && activity.idleConfirmed === true;
+        if (idle && !previous && !current?.followupBlocked) {
             if (current)
                 this.store.saveInsertion(this.config.name, chatId, rowId, current.insertionId, 'ordinary', { ...current, activityUnbound: false });
             return;
         }
-        const identified = compatible && !!activity.activeRunId && !!activity.sessionId && !activity.archived && !status.archived;
-        // A4 (2026-10-17 protocol audit): positive blockers are gateway assertions,
-        // not unknown states. An archived session, an incompatible session
-        // generation, or confirmed busy-without-injectable-owner each positively
-        // forbids fresh ordinary admission, so the bounded fallback below must
-        // never hand such an input to the ordinary queue; it stays retained.
-        const archived = !!status.archived || !!activity.archived;
-        const generationConflict = !!activity.sessionId && !!status.sessionId && activity.sessionId !== status.sessionId;
-        const positivelyBusy = activity.busyConfirmed === true;
-        // Bounded retention (2026-10-17 deadlock): an input that has stayed
-        // activity-unbound for over 60s despite re-checks must not be held forever.
-        // Hand it to the ordinary queue — the gateway's own chat.send admission is
-        // the authoritative answer and admission custody already dedups. This
-        // rescue is reserved for GENUINELY unknown states; positive blockers are
-        // excluded above and keep the never-attempted input retained.
-        const unboundSince = current?.activityUnbound ? (current.unboundSince || 0) : 0;
-        if (!identified && !archived && !generationConflict && !positivelyBusy && unboundSince && Date.now() - unboundSince > 60_000) {
-            this.store.saveInsertion(this.config.name, chatId, rowId, current.insertionId, 'ordinary', { ...current, activityUnbound: false, reason: 'gateway state unconfirmable over 60s; ordinary admission is authoritative' });
+        const identified = compatible && !!activity.activeRunId && !archived;
+        // Explicit followup no longer inherits stored steer/interrupt. After two
+        // matching physical-session observations separated by 60s, busy-without-a-target may
+        // admit ONE guarded queued turn. Unknown/missing leaf is NOT a timeout CAS.
+        // Keep the EARLIEST genuinely observed leaf. The public RPC accepts an
+        // ancestor on the active path with sessionId, but rejects an off-path leaf.
+        // Ordinary transcript advancement is NOT a local generation conflict.
+        const observedAt = previous && proof ? current.followupObservedAt : Date.now();
+        if (!identified && proof && previous && Number.isFinite(observedAt) && Date.now() - observedAt >= 60_000) {
+            this.store.saveInsertion(this.config.name, chatId, rowId, current.insertionId, 'ordinary', { ...current, activityUnbound: false, followupAdmissionGuard: previous, reason: 'bounded matching public proof; explicit guarded followup admission only' });
             return;
         }
-        const blockerReason = archived ? 'retained: archived (gateway positively reported archived session; 60s ordinary fallback suppressed)'
-            : generationConflict ? 'retained: generation-conflict (activity session generation differs from runtime status; 60s ordinary fallback suppressed)'
-                : positivelyBusy ? 'retained: positively-busy (gateway confirmed busy without an injectable owner; 60s ordinary fallback suppressed)' : '';
+        // Preserve the deployed ordinary rescue for a fresh NEVER-ATTEMPTED input
+        // whose ACTIVITY observation is genuinely unknown. That is not an unknown
+        // submission receipt, nor an escape from this restricted/positive proof.
+        const unboundSince = current?.activityUnbound ? current.unboundSince : undefined;
+        if (!identified && !archived && !generationConflict && activity.busyConfirmed !== true && !previous && !current?.followupBlocked && !current?.restrictedObservation &&
+            current?.state === 'pending' && !current.attempted && !current.admissionSubmissionId && current.ordinaryEligible !== false &&
+            unboundSince && Date.now() - unboundSince > 60_000) {
+            this.store.saveInsertion(this.config.name, chatId, rowId, current.insertionId, 'ordinary', { ...current, activityUnbound: false, reason: 'fresh never-attempted input; ordinary unknown-state bounded followup rescue' });
+            return;
+        }
+        const blockerReason = archived ? 'retained: archived'
+            : generationConflict ? 'retained: generation-conflict'
+                : activity.busyConfirmed ? 'retained: positively-busy; guarded followup proof absent or observation window pending'
+                    : 'retained: genuinely unknown activity; fresh ordinary rescue observation pending';
         this.store.saveInsertion(this.config.name, chatId, rowId, current?.insertionId || JSON.stringify([this.config.appId, chatId, messageId]), 'pending', {
-            messageId, text, stopEpoch: epoch, sessionKey: this.getSessionKey(chatId), sessionId: identified ? activity.sessionId : status.sessionId,
+            ...current, messageId, text, stopEpoch: epoch, sessionKey: this.getSessionKey(chatId), sessionId: current?.sessionId || activity.sessionId || status.sessionId,
             expectedRunId: identified ? activity.activeRunId : '', ownerId: identified ? `external:${activity.activeRunId}` : undefined,
             batchId: identified ? activity.activeRunId : undefined, activityUnbound: !identified, attempted: false,
-            ...(identified ? {} : { unboundSince: unboundSince || Date.now() }),
-            reason: identified ? 'current Gateway run observed; insertion custody only' : (blockerReason || 'current Gateway activity/run identity unavailable; retained without admission'),
+            ...(!identified ? { unboundSince: current?.unboundSince || Date.now() } : {}),
+            ...(proof ? { followupAdmissionGuard: previous || proof, followupObservedAt: observedAt } : {}),
+            ...(activity.busyConfirmed ? { restrictedObservation: true } : {}),
+            ...((archived || generationConflict) ? { followupBlocked: true } : {}),
+            reason: identified ? 'current Gateway run observed; insertion custody only' : blockerReason,
         }, Date.now() + (identified ? 0 : 5000));
+        if (!identified && !proof && current?.unboundSince && Date.now() - current.unboundSince >= 60_000 &&
+            (archived || generationConflict || activity.busyConfirmed || current.restrictedObservation))
+            this.explainUnconfirmedFollowup(chatId, { ...current, rowId, messageId });
+    }
+    /** An ingress reservation can outlive an ACK-window owner which finished
+     * before learning its runId. It is still never-attempted custody, not a
+     * licence to retarget/steer a successor. Require the same guarded proof and
+     * bounded observation with NO replacement local scheduler at every await. */
+    async reconcileRetainedFollowup(chatId, item) {
+        if (!this.openclawClient.getSessionRuntimeStatus || !this.openclawClient.getSessionDispatchStatus ||
+            this.queueOwners.has(chatId) || this.store.getDispatchCustody(this.config.name, chatId))
+            return false;
+        const source = this.store.getMessageByMessageId(item.messageId);
+        if (item.state !== 'pending' || item.attempted || item.ordinaryEligible === false || !item.sessionId ||
+            !source || source.id !== item.rowId || source.chatId !== chatId || source.senderType !== 'human' || source.triggerKind !== 'normal' ||
+            !item.sessionKey || canonicalPhysicalSessionKey(item.sessionKey) !== canonicalPhysicalSessionKey(this.getSessionKey(chatId)))
+            return false;
+        const admissionEpoch = this.queueAdmissionEpoch.get(chatId) || 0;
+        const snapshot = this.store.getInsertion(this.config.name, chatId, item.rowId);
+        const unchanged = () => {
+            const row = this.store.getInsertion(this.config.name, chatId, item.rowId);
+            return (this.queueAdmissionEpoch.get(chatId) || 0) === admissionEpoch && JSON.stringify(row) === JSON.stringify(snapshot) && this.stopGeneration(chatId) === item.stopEpoch && !this.queueOwners.has(chatId) && !this.store.getDispatchCustody(this.config.name, chatId) &&
+                row?.state === 'pending' && !row.attempted && row.insertionId === item.insertionId && row.ownerId === item.ownerId && row.batchId === item.batchId;
+        };
+        if (!unchanged())
+            return false;
+        const status = await this.openclawClient.getSessionRuntimeStatus(item.sessionKey).catch(() => null);
+        if (!unchanged())
+            return true;
+        const activity = await this.openclawClient.getSessionDispatchStatus?.(item.sessionKey).catch(() => null);
+        if (!unchanged())
+            return true;
+        if (status?.archived || activity?.archived || status?.sessionId && status.sessionId !== item.sessionId || activity?.sessionId && activity.sessionId !== item.sessionId) {
+            this.retainChangedFollowup(chatId, item, 'retained input session/archive changed; no migration');
+            return true;
+        }
+        const proof = status && activity ? this.observedFollowupGuard(chatId, status, activity, item.noEffectRunId) : undefined;
+        if (!proof)
+            return false;
+        if (item.followupAdmissionGuard && (item.followupAdmissionGuard.sessionKey !== proof.sessionKey || item.followupAdmissionGuard.sessionId !== proof.sessionId)) {
+            this.retainChangedFollowup(chatId, item, 'retained followup physical identity changed; no migration');
+            return true;
+        }
+        const since = item.followupAdmissionGuard ? item.followupObservedAt : Date.now();
+        const eligible = Number.isFinite(since) && Date.now() - since >= 60_000;
+        this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, eligible ? 'ordinary' : 'pending', { ...item, followupAdmissionGuard: item.followupAdmissionGuard || proof, followupObservedAt: since, reason: 'retained never-attempted input; bounded guarded followup observation' }, Date.now() + 5000);
+        if (eligible)
+            void this.processQueue(chatId, true).catch(() => { });
+        return true;
     }
     /** CAS includes the actual batch, not merely the queue Promise, and excludes
      * local admission/RPC windows even if the host briefly reports idle. */
@@ -1434,24 +1537,78 @@ export class FeishuBot {
             return false;
         if (local && (local.id !== saved.id || local.batchId !== saved.batchId || !local.admitted && !local.yielded || !local.collecting))
             return false;
-        const batch = local?.batch, runId = local?.runId, epoch = this.stopGeneration(chatId);
+        const batch = local?.batch, runId = local?.runId, epoch = this.stopGeneration(chatId), admissionEpoch = this.queueAdmissionEpoch.get(chatId) || 0;
         const unchanged = () => {
             const now = this.store.getDispatchCustody(this.config.name, chatId);
-            return this.stopGeneration(chatId) === epoch && now?.id === saved.id && now?.batchId === saved.batchId && now?.runId === saved.runId &&
+            return (this.queueAdmissionEpoch.get(chatId) || 0) === admissionEpoch && this.stopGeneration(chatId) === epoch && saved.stopEpoch === epoch && JSON.stringify(now) === JSON.stringify(saved) &&
                 this.queueOwners.get(chatId) === local && (!local || local.batch === batch && local.runId === runId && (local.admitted === true || local.yielded === true) && local.collecting === true);
         };
         const activity = await this.openclawClient.getSessionDispatchStatus?.(this.getSessionKey(chatId)).catch(() => null);
-        if (!unchanged() || !activity?.idleConfirmed || activity.busyConfirmed || activity.archived || activity.sessionId !== saved.sessionId)
+        if (!unchanged() || !activity || activity.archived || activity.sessionId !== saved.sessionId)
+            return false;
+        if (activity.activeRunId === saved.runId)
+            return false; // real foreground keeps SDK priority
+        if (!activity.idleConfirmed && !activity.followupAdmissionEligible)
             return false;
         const status = await this.openclawClient.getSessionRuntimeStatus(this.getSessionKey(chatId)).catch(() => null);
-        if (!unchanged() || !status?.idleConfirmed || status.archived || status.sessionId !== saved.sessionId)
+        if (!unchanged() || !status || status.archived || status.sessionId !== saved.sessionId)
             return false;
-        if (!this.store.releaseDispatchCustody(this.config.name, chatId, saved.id, saved.batchId))
+        if (activity.activeRunId && activity.activeRunId !== saved.runId) {
+            // An accepted local followup can itself be queued behind a different
+            // public foreground root. Do not steer a new input into that queued ID.
+            // Rebind ONLY same-generation never-attempted custody to the genuinely
+            // observed foreground for SDK priority; accepted/unknown inputs stay put.
+            for (const item of this.store.listInsertions(this.config.name, chatId)) {
+                if (item.state !== 'pending' || item.attempted || item.noEffectRunId || item.ordinaryEligible === false || item.ownerId !== saved.id || item.batchId !== saved.batchId ||
+                    item.stopEpoch !== epoch || item.sessionId !== saved.sessionId || !item.sessionKey ||
+                    canonicalPhysicalSessionKey(item.sessionKey) !== canonicalPhysicalSessionKey(this.getSessionKey(chatId)))
+                    continue;
+                const source = this.store.getMessageByMessageId(item.messageId);
+                if (source?.senderType !== 'human' || source.triggerKind !== 'normal')
+                    continue;
+                const earlier = item.followupAdmissionGuard;
+                this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, 'pending', {
+                    ...item, expectedRunId: activity.activeRunId, ownerId: `external:${activity.activeRunId}`, batchId: activity.activeRunId,
+                    noEffectRunId: undefined, followupAdmissionGuard: earlier ? {
+                        sessionKey: earlier.sessionKey, sessionId: earlier.sessionId, expectedLeafEntryId: earlier.expectedLeafEntryId,
+                    } : undefined,
+                    reason: 'public foreground observed; never-attempted input retains SDK priority; queued original result kept',
+                });
+            }
+            if (!this.store.clearDispatchCustody(this.config.name, chatId, saved.id, saved.batchId))
+                return false;
+            const target = this.store.getDeliveryRunTarget(this.config.name, chatId, saved.runId);
+            if (target)
+                this.store.bindDeliveryRun(this.config.name, chatId, saved.runId, { ...target, dispatchReleased: true });
+            if (local)
+                this.forceExpireQueueOwner(chatId, 'public foreground differs from locally queued original; exact result custody retained');
+            return true;
+        }
+        const idle = activity.idleConfirmed && !activity.busyConfirmed && status.idleConfirmed;
+        let followup;
+        if (!idle || saved.followupAdmissionGuard) {
+            const proof = this.observedFollowupGuard(chatId, status, activity);
+            if (!proof || !saved.sessionKey || canonicalPhysicalSessionKey(saved.sessionKey) !== proof.sessionKey)
+                return false;
+            const previous = saved.followupAdmissionGuard;
+            if (previous && (previous.sessionKey !== proof.sessionKey || previous.sessionId !== proof.sessionId))
+                return false;
+            this.pinDispatchFollowupProof(chatId, saved, proof);
+            followup = previous || proof; // host CAS distinguishes ancestor from off-path
+            if (!previous) {
+                if (unchanged())
+                    this.store.saveDispatchCustody(this.config.name, chatId, { ...saved, followupAdmissionGuard: followup, followupObservedAt: Date.now() });
+                return false;
+            }
+            if (!Number.isFinite(saved.followupObservedAt) || Date.now() - saved.followupObservedAt < 60_000)
+                return false;
+        }
+        if (!unchanged() || !this.store.releaseDispatchCustody(this.config.name, chatId, saved.id, saved.batchId, followup))
             return false;
         // The target was committed on admission and survives this local cleanup.
         // Only this exact old owner can be revoked; never a replacement batch.
         if (local)
-            this.forceExpireQueueOwner(chatId, 'current session confirmed schedulable; exact result observation retained');
+            this.forceExpireQueueOwner(chatId, followup ? 'guarded followup schedulable (NOT idle); exact result observation retained' : 'current session confirmed schedulable; exact result observation retained');
         return true;
     }
     presentation(work) {
@@ -1545,6 +1702,11 @@ export class FeishuBot {
             for (const item of this.store.listInsertions(this.config.name, chatId)) {
                 if (item.nextCheckAt > Date.now())
                     continue;
+                // This is an ordinary chat.send identity, NOT an SDK insertion. The
+                // client's exact-run recovery queries its original ID; never steer or
+                // resend it with an insertion/new submission identity on restart.
+                if (item.admissionSubmissionId)
+                    continue;
                 const stillCurrent = () => this.stopGeneration(chatId) === item.stopEpoch && !['stopped', 'ordinary', 'committed'].includes(this.store.getInsertion(this.config.name, chatId, item.rowId)?.state);
                 if (!stillCurrent()) {
                     if (this.stopGeneration(chatId) !== item.stopEpoch)
@@ -1563,6 +1725,8 @@ export class FeishuBot {
                         continue;
                     Object.assign(item, refreshed);
                 }
+                if (await this.reconcileRetainedFollowup(chatId, item))
+                    continue;
                 const owner = this.queueOwners.get(chatId);
                 if (!item.expectedRunId && owner?.id === item.ownerId && owner?.batchId === item.batchId && owner?.runId)
                     item.expectedRunId = owner.runId;
@@ -1628,6 +1792,8 @@ export class FeishuBot {
                 // Time elapsed and attempted-unknown receipts never authorize replay.
                 if (valid && receipt.attempted === false && receipt.ordinaryEligible !== false && ['pending', 'target_ended'].includes(state) &&
                     ['target_not_ready', 'backend_rejected_no_effect', 'original run ended without an insertion attempt'].includes(receipt.reason || '')) {
+                    item.noEffectRunId = item.expectedRunId;
+                    item.noEffectSince = item.noEffectSince || Date.now();
                     const status = await this.openclawClient.getSessionRuntimeStatus(item.sessionKey).catch(() => null);
                     if (!stillCurrent())
                         continue;
@@ -1642,22 +1808,38 @@ export class FeishuBot {
                         if (runAtCheck === item.expectedRunId)
                             this.forceExpireQueueOwner(chatId, 'confirmed idle exact batch; insertion never accepted/unknown');
                     }
-                    else if (state === 'target_ended')
-                        state = 'pending';
-                    else if (state === 'pending') {
-                        // Safe recovery for a NON-INSERTABLE target (audit P1 #2
-                        // 2026-10-17): this branch only runs for EXPLICIT no-effect
-                        // receipts (attempted===false, definitively not inserted — the
-                        // outer guard). If the exact target run has settled, or the
-                        // target has refused insertion for over 60s (e.g. a long-lived
-                        // maintenance run), hand the input to the ordinary queue: the
-                        // gateway queues it behind whatever currently holds the session
-                        // instead of parking it in bridge-side limbo forever. Unknown
-                        // receipts never enter this branch and are never replayed.
-                        const boundSince = Number.isFinite(item.boundSince) ? item.boundSince : Date.now();
-                        item.boundSince = boundSince;
-                        if (originalRunEnded || Date.now() - boundSince > 60_000)
-                            state = 'ordinary';
+                    else {
+                        // A definitive SDK no-effect receipt is replay authority ONLY with
+                        // fresh matching public followup proof + local owner/batch CAS.
+                        // Root end or elapsed time alone does not prove safe admission.
+                        const live = activity || await this.openclawClient.getSessionDispatchStatus?.(item.sessionKey).catch(() => null);
+                        if (!stillCurrent())
+                            continue;
+                        const source = this.store.getMessageByMessageId(item.messageId);
+                        const proof = live && status && source && source.id === item.rowId && source.chatId === chatId && source.senderType === 'human' && source.triggerKind === 'normal'
+                            ? this.observedFollowupGuard(chatId, status, live, item.noEffectRunId) : undefined;
+                        const sameOwner = this.queueOwners.get(chatId) === owner && owner?.batch === batchAtCheck && owner?.runId === runAtCheck;
+                        if (proof && proof.sessionId === item.sessionId && sameOwner) {
+                            const previous = item.followupAdmissionGuard;
+                            if (previous && (previous.sessionKey !== proof.sessionKey || previous.sessionId !== proof.sessionId))
+                                state = 'target_changed';
+                            else {
+                                item.followupAdmissionGuard = previous ? { ...previous, nonInjectableRunId: item.noEffectRunId } : proof;
+                                item.followupObservedAt = previous ? item.followupObservedAt : Date.now();
+                                if (previous && Number.isFinite(item.followupObservedAt) && Date.now() - item.followupObservedAt >= 60_000) {
+                                    state = 'ordinary';
+                                    if (owner?.runId === item.expectedRunId)
+                                        this.forceExpireQueueOwner(chatId, 'definitive no-effect input; guarded queued followup, result custody retained');
+                                }
+                                else
+                                    state = 'pending';
+                            }
+                        }
+                        else {
+                            state = 'pending';
+                            if (Date.now() - item.noEffectSince >= 60_000)
+                                this.explainUnconfirmedFollowup(chatId, item);
+                        }
                     }
                 }
                 if (state === 'target_ended')
@@ -1669,9 +1851,12 @@ export class FeishuBot {
                 // every insertion spams the chat. Use real elapsed time from the first
                 // unknown observation, not query count, and commit one reminder intent.
                 const unknownChecks = state === 'unknown' ? (Number(item.unknownChecks) || 0) + 1 : 0;
-                const record = { ...item, attempted: valid ? (receipt.attempted ?? true) : true, sessionId: item.sessionId, reason: receipt.reason, unknownChecks,
+                const record = { ...item, pendingSince: state === 'pending' ? (item.pendingSince || Date.now()) : undefined,
+                    ordinaryEligible: receipt.ordinaryEligible, attempted: valid ? (receipt.attempted ?? true) : true, sessionId: item.sessionId, reason: receipt.reason, unknownChecks,
                     unknownSince: state === 'unknown' ? (item.state === 'unknown' && Number.isFinite(item.unknownSince) ? item.unknownSince : Date.now()) : undefined };
                 this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, state, record, Date.now() + (state === 'unknown' ? 15_000 : 5000));
+                if (state === 'pending' && !record.attempted && Date.now() - (record.pendingSince || Date.now()) >= 60_000)
+                    this.explainUnconfirmedFollowup(chatId, record);
                 if (state === 'ordinary') {
                     this.store.deletePendingInsertionNotices(this.config.name, chatId, item.insertionId);
                     void this.enqueueAndDispatchDelivery(chatId, 'insertion_status', `insertion:${item.insertionId}:ordinary`, 'ℹ️ 当前会话已确认可接收新轮次，且这条消息确定未被插入；现已交回普通队列，只执行一次。', [], item.messageId, `insertion:${item.insertionId}:ordinary`).catch(() => { });
@@ -1888,17 +2073,18 @@ export class FeishuBot {
                 this.queueRunTokens.delete(chatId);
                 if (this.queueOwners.get(chatId) === owner)
                     this.queueOwners.delete(chatId);
+                if (owner.continuePending)
+                    void this.processQueue(chatId, true).catch(() => { });
             }
         });
         this.queueRuns.set(chatId, run);
         return run;
     }
     /**
-     * Force-release a stuck queue owner after the gateway authoritatively
-     * reported the session idle (no active run). The zombie owner's deep waits
-     * can otherwise hold chat custody forever: completion events routed through
-     * the proactive path are invisible to them. Steer-fallback triggers are
-     * restored via the failure observers so their input drains normally.
+     * Retire only the local queue scheduler after positive idle, trusted yield,
+     * or bounded guarded-followup proof. Never stop Gateway execution or infer
+     * a terminal outcome. Exact result recovery/target custody remains durable;
+     * attempted-unknown and accepted insertion records never enter replay.
      */
     forceExpireQueueOwner(chatId, reason, preserveDispatch = false) {
         const owner = this.queueRuns.get(chatId);
@@ -1910,7 +2096,7 @@ export class FeishuBot {
         if (context)
             context.revoked = true;
         this.busyChats.set(chatId, 0);
-        console.warn(`[${this.config.name}] force-expiring zombie queue owner for ${chatId.slice(-8)}: ${reason}`);
+        console.warn(`[${this.config.name}] retiring local queue scheduler for ${chatId.slice(-8)}: ${reason}`);
         // Fence the stale batch's local observation BEFORE releasing custody: an
         // alive old poller would keep destructively consuming the replacement
         // batch's frames from the shared session bucket (2026-10-16 regression).
@@ -1934,7 +2120,10 @@ export class FeishuBot {
         while (current()) {
             const batchToken = {};
             owner.batch = batchToken;
+            const admissionEpoch = (this.queueAdmissionEpoch.get(chatId) || 0) + 1;
+            this.queueAdmissionEpoch.set(chatId, admissionEpoch);
             owner.batchId = randomUUID();
+            const batchId = owner.batchId;
             owner.triggerIds = undefined;
             owner.runId = undefined;
             owner.admitted = false;
@@ -1968,6 +2157,7 @@ export class FeishuBot {
             // pass-through requests that must not receive catch-up context.
             const firstPending = pendingHumanTriggers[0];
             const firstIsNative = firstPending.triggerKind === "native_command";
+            const batchProof = this.store.getInsertion(this.config.name, chatId, firstPending.id)?.followupAdmissionGuard;
             let mergedTriggers;
             if (firstIsNative) {
                 // One native command at a time.
@@ -1979,9 +2169,27 @@ export class FeishuBot {
                 for (const m of pendingHumanTriggers) {
                     if (m.triggerKind === "native_command")
                         break;
+                    const proof = this.store.getInsertion(this.config.name, chatId, m.id)?.followupAdmissionGuard;
+                    if (JSON.stringify(proof) !== JSON.stringify(batchProof))
+                        break;
                     mergedTriggers.push(m);
                 }
             }
+            if (!firstIsNative && batchProof) {
+                // Guarded, not-yet-submitted inputs must not be dropped to meet a
+                // payload budget. Submit a bounded prefix and leave the remainder in
+                // durable pending custody for the next batch (with its own proof).
+                const selected = [];
+                let bytes = 0;
+                for (const message of mergedTriggers) {
+                    const addBytes = Buffer.byteLength((selected.length ? "\n" : "") + message.content, "utf8");
+                    if (selected.length > 0 && (selected.length >= MAX_MERGED_TRIGGER_MESSAGES || bytes + addBytes > MAX_MERGED_TRIGGER_BYTES))
+                        break;
+                    selected.push(message);
+                    bytes += addBytes;
+                }
+                mergedTriggers = selected;
+            }
             // Bound the merged current message payload. When a bot is stuck, many
             // human triggers can accumulate; sending all of them can exceed OpenClaw's
             // single-message/payload limit. Keep the most recent messages and drop the
@@ -1989,7 +2197,7 @@ export class FeishuBot {
             // not clog the queue forever).
             const originalMergedTriggers = mergedTriggers;
             const droppedMergedTriggers = [];
-            if (!firstIsNative) {
+            if (!firstIsNative && !batchProof) {
                 const selected = [];
                 let bytes = 0;
                 for (let i = originalMergedTriggers.length - 1; i >= 0; i--) {
@@ -2112,6 +2320,14 @@ export class FeishuBot {
                 if (!current())
                     break;
                 await liveStatus?.pauseForUnconfirmedResult(this.isEn(chatId) ? "Session setup failed before admission" : "会话准备失败，尚未提交 Gateway", this.isEn(chatId) ? `${this.config.name} setup unavailable` : `${this.config.name} 会话准备未完成`).catch(() => { });
+                if (batchProof) {
+                    for (const id of mergedTriggerIds) {
+                        const item = this.store.getInsertion(this.config.name, chatId, id);
+                        if (item?.state === 'ordinary' && !item.attempted)
+                            this.store.saveInsertion(this.config.name, chatId, id, item.insertionId, 'target_changed', { ...item, reason: 'guarded followup session setup failed before effect; input retained' });
+                    }
+                    break;
+                }
                 // Model policy/capability failures happen before chat.send. Clear the
                 // busy marker, report the actionable error, and retire only this batch
                 // so the chat cannot remain wedged indefinitely.
@@ -2135,6 +2351,7 @@ export class FeishuBot {
             let initialPresentationRunId;
             const foregroundSessionId = this.store.getActiveGoJob(this.config.name, chatId)?.executorSessionId;
             let runAcceptedByOpenClaw = false;
+            let guardedSubmissionId;
             try {
                 const releaseActiveDeliveryTarget = lastHuman.messageId ? this.setActiveDeliveryTarget(chatId, triggerId, lastHuman.messageId) : () => { };
                 let reply;
@@ -2175,6 +2392,22 @@ export class FeishuBot {
                         timeoutMs: FOREGROUND_WAIT_MS,
                         includeContext: !isNativeCommandTrigger,
                         includeBridgeAttachmentHint: !isNativeCommandTrigger,
+                        followupAdmissionGuard: batchProof,
+                        admissionGuard: () => {
+                            guard();
+                            if (owner.batch !== batchToken || owner.batchId !== batchId || this.queueAdmissionEpoch.get(chatId) !== admissionEpoch)
+                                throw new SupersededObservation('batch admission epoch changed');
+                            if (!batchProof)
+                                return;
+                            for (const id of mergedTriggerIds) {
+                                const row = this.store.getInsertion(this.config.name, chatId, id);
+                                if (!row || row.ordinaryEligible === false || row.stopEpoch !== owner.stopEpoch || JSON.stringify(row.followupAdmissionGuard) !== JSON.stringify(batchProof) ||
+                                    !['ordinary', 'unknown'].includes(row.state) ||
+                                    batchProof.nonInjectableRunId && row.noEffectRunId !== batchProof.nonInjectableRunId ||
+                                    (guardedSubmissionId ? row.admissionSubmissionId !== guardedSubmissionId : row.attempted === true))
+                                    throw new SupersededObservation('followup batch/admission CAS changed');
+                            }
+                        },
                         onSendAttempt: (submissionId) => {
                             guard();
                             this.presentation(() => this.queuedPresentations.attempted(liveStatus, submissionId, owner.id, owner.batchId));
@@ -2187,7 +2420,15 @@ export class FeishuBot {
                             // At-most-once: as soon as we begin issuing chat.send, do not let
                             // this batch auto-replay. If the RPC response is lost after
                             // OpenClaw accepts it, retrying would duplicate the same message.
-                            markSubmittedBatch("send-attempt");
+                            if (batchProof) {
+                                guardedSubmissionId = submissionId;
+                                for (const id of mergedTriggerIds) {
+                                    const row = this.store.getInsertion(this.config.name, chatId, id);
+                                    this.store.saveInsertion(this.config.name, chatId, id, row.insertionId, 'unknown', { ...row, attempted: true, admissionSubmissionId: submissionId, reason: 'original guarded followup submission only; no new-ID replay' });
+                                }
+                            }
+                            else
+                                markSubmittedBatch("send-attempt");
                         },
                         onRunIdentified: (runId, identity) => { guard(); owner.runId = runId; owner.sessionId = identity?.sessionId || owner.sessionId; foregroundRunId = runId; },
                         onSubmitted: async (runId) => {
@@ -2218,6 +2459,10 @@ export class FeishuBot {
                             // Refine state for logs/idempotent sync rows when OpenClaw returns
                             // a runId. markSubmittedBatch is idempotent due to local flags and
                             // INSERT OR IGNORE in message_sync.
+                            if (batchProof)
+                                this.store.acceptGuardedFollowup(this.config.name, chatId, mergedTriggerIds, guardedSubmissionId, runId, `${this.config.name}:${chatId}:${triggerId}:guarded-accepted:${runId}`);
+                            // The guarded inputs must already be ordinary before this helper's
+                            // ordinary-only sync filter runs, or a later batch replays them as context.
                             markSubmittedBatch(`submitted:${runId}`);
                         },
                         onProgress: (event) => current() && runAcceptedByOpenClaw && !!initialPresentationRunId && owner.runId === initialPresentationRunId ? liveStatus?.progress(event) : undefined,
@@ -2471,6 +2716,20 @@ export class FeishuBot {
                     console.log(`[${this.config.name}] batch observation superseded for ${chatId.slice(-8)}; ending quietly`);
                     break;
                 }
+                if (err instanceof FollowupAdmissionRefused && batchProof) {
+                    // onSendAttempt is only an uncertainty fence, not acceptance/sync.
+                    // Named pre-effect refusal parks ONLY this new batch, visibly. Never
+                    // restore accepted originals, and never migrate to a different leaf.
+                    for (const id of mergedTriggerIds) {
+                        const row = this.store.getInsertion(this.config.name, chatId, id);
+                        if (row && !row.admittedRunId)
+                            this.store.saveInsertion(this.config.name, chatId, id, row.insertionId, 'target_changed', { ...row, attempted: false, reason: err.message });
+                    }
+                    await this.enqueueAndDispatchDelivery(chatId, 'admission_status', `admission:${err.submissionId}:refused`, err.message, [], lastHuman.messageId, `admission:${err.submissionId}:refused`).catch(() => { });
+                    await liveStatus?.pauseForUnconfirmedResult(err.message).catch(() => { });
+                    owner.continuePending = true; // independently proved newer cohorts may still be sent
+                    break;
+                }
                 if (err instanceof AdmissionUnconfirmed) {
                     await this.enqueueAndDispatchDelivery(chatId, 'admission_status', `admission:${err.submissionId}:unknown`, err.message, [], lastHuman.messageId, `admission:${err.submissionId}:unknown`).catch(() => { });
                     await liveStatus?.pauseForUnconfirmedResult(err.message).catch(() => { });
@@ -2536,6 +2795,15 @@ export class FeishuBot {
                     console.warn(`[${this.config.name}] processQueue stopped because session became unhealthy: ${err.status}`);
                     break;
                 }
+                if (batchProof && !runAcceptedByOpenClaw) {
+                    for (const id of mergedTriggerIds) {
+                        const row = this.store.getInsertion(this.config.name, chatId, id);
+                        if (row && !row.admissionSubmissionId && !row.admittedRunId)
+                            this.store.saveInsertion(this.config.name, chatId, id, row.insertionId, 'target_changed', { ...row, attempted: false, reason: 'guarded pre-admission failure; input retained without sync or new-ID retry' });
+                    }
+                    await liveStatus?.pauseForUnconfirmedResult('Guarded admission unavailable; input custody retained without replay').catch(() => { });
+                    break;
+                }
                 console.error(`[${this.config.name}] processQueue error:`, safeErrorSummary(err));
                 this.fireRunFailureObservers(chatId);
                 const errorText = this.formatUserVisibleError(err, chatId);

package/dist/message-store.d.ts

@@ -126,9 +126,16 @@ export declare class MessageStore {
     saveDispatchCustody(bot: string, chat: string, record: object): void;
     getDispatchCustody(bot: string, chat: string): any;
     clearDispatchCustody(bot: string, chat: string, ownerId: string, batchId: string): boolean;
+    /** A Gateway-accepted guarded ordinary batch becomes ordinary/synced in one
+     * transaction. Until then its unknown input custody remains non-replayable. */
+    acceptGuardedFollowup(bot: string, chat: string, rows: number[], submissionId: string, runId: string, syncBatchId: string): void;
     /** Atomic release of proven never-attempted reservations only. Unknown and
      * accepted inputs retain their exact target and never enter ordinary drain. */
-    releaseDispatchCustody(bot: string, chat: string, ownerId: string, batchId: string): boolean;
+    releaseDispatchCustody(bot: string, chat: string, ownerId: string, batchId: string, followup?: {
+        sessionKey: string;
+        sessionId: string;
+        expectedLeafEntryId: string;
+    }): boolean;
     /** Reserved is persisted before the send-attempt callback; dispatching is
      * persisted before the RPC. Only reserved + unchanged stop generation proves
      * no business effect and may be restored on startup. Unknown never replays. */

package/dist/message-store.js

@@ -111,9 +111,28 @@ export class MessageStore {
         return this.db.prepare(`DELETE FROM dispatch_custody WHERE bot_name=? AND chat_id=?
       AND json_extract(record_json,'$.id')=? AND json_extract(record_json,'$.batchId')=?`).run(bot, chat, ownerId, batchId).changes === 1;
     }
+    /** A Gateway-accepted guarded ordinary batch becomes ordinary/synced in one
+     * transaction. Until then its unknown input custody remains non-replayable. */
+    acceptGuardedFollowup(bot, chat, rows, submissionId, runId, syncBatchId) {
+        if (!submissionId || !runId || rows.length === 0)
+            throw new Error('Missing guarded followup acceptance identity');
+        this.db.transaction(() => {
+            for (const id of rows) {
+                const item = this.getInsertion(bot, chat, id);
+                if (!item || item.admissionSubmissionId !== submissionId || item.attempted !== true ||
+                    !['unknown', 'ordinary'].includes(item.state) || item.stopEpoch !== this.getStopGeneration(bot, chat)) {
+                    throw new Error('Guarded followup acceptance custody changed');
+                }
+                this.saveInsertion(bot, chat, id, item.insertionId, 'ordinary', { ...item, attempted: true, admittedRunId: runId });
+            }
+            this.markMessagesSynced(bot, chat, rows, syncBatchId);
+            for (const id of rows)
+                this.clearPendingTrigger(bot, chat, id);
+        })();
+    }
     /** Atomic release of proven never-attempted reservations only. Unknown and
      * accepted inputs retain their exact target and never enter ordinary drain. */
-    releaseDispatchCustody(bot, chat, ownerId, batchId) {
+    releaseDispatchCustody(bot, chat, ownerId, batchId, followup) {
         return this.db.transaction(() => {
             const custody = this.getDispatchCustody(bot, chat);
             if (!custody || !this.clearDispatchCustody(bot, chat, ownerId, batchId))
@@ -122,11 +141,17 @@ export class MessageStore {
         '$.dispatchOwnerId',?,'$.dispatchBatchId',?,'$.sessionId',?) WHERE bot_name=? AND chat_id=? AND run_id=?`)
                 .run(ownerId, batchId, custody.sessionId, bot, chat, custody.runId);
             this.db.prepare(`UPDATE insertion_custody SET state='ordinary',next_check_at=0,
-        record_json=json_set(record_json,'$.reason','current session confirmed schedulable; no backend attempt')
+        record_json=json_set(record_json,'$.reason','current session confirmed schedulable; no backend attempt'
+          ${followup ? ", '$.followupAdmissionGuard',json(COALESCE(json_extract(record_json,'$.followupAdmissionGuard'),?))" : ''})
         WHERE bot_name=? AND chat_id=? AND state='pending'
         AND COALESCE(json_extract(record_json,'$.attempted'),0)=0
         AND json_extract(record_json,'$.ownerId')=? AND json_extract(record_json,'$.batchId')=?
-        AND json_extract(record_json,'$.stopEpoch')=?`).run(bot, chat, ownerId, batchId, this.getStopGeneration(bot, chat));
+        AND json_extract(record_json,'$.stopEpoch')=?
+        ${followup ? `AND json_extract(record_json,'$.sessionId')=?
+          AND COALESCE(json_extract(record_json,'$.ordinaryEligible'),1)!=0
+          AND json_extract(record_json,'$.sessionKey') IN (?,?)
+          AND message_row_id IN (SELECT id FROM messages WHERE sender_type='human' AND trigger_kind='normal')` : ''}`)
+                .run(...(followup ? [JSON.stringify(followup)] : []), bot, chat, ownerId, batchId, this.getStopGeneration(bot, chat), ...(followup ? [followup.sessionId, followup.sessionKey, followup.sessionKey.replace(/^agent:[^:]+:/, '')] : []));
             return true;
         })();
     }
@@ -276,10 +301,10 @@ export class MessageStore {
     }
     stopInsertionAtEpoch(bot, chat, row, epoch) {
         this.db.prepare(`UPDATE insertion_custody SET state='stopped' WHERE bot_name=? AND chat_id=? AND message_row_id=?
-      AND json_extract(record_json,'$.stopEpoch')=? AND state NOT IN ('committed','ordinary')`).run(bot, chat, row, epoch);
+      AND json_extract(record_json,'$.stopEpoch')=? AND (state NOT IN ('committed','ordinary') OR state='ordinary' AND json_type(record_json,'$.followupAdmissionGuard')='object')`).run(bot, chat, row, epoch);
     }
     stopInsertions(bot, chat) {
-        this.db.prepare("UPDATE insertion_custody SET state='stopped' WHERE bot_name=? AND chat_id=? AND state NOT IN ('committed','ordinary')").run(bot, chat);
+        this.db.prepare("UPDATE insertion_custody SET state='stopped' WHERE bot_name=? AND chat_id=? AND (state NOT IN ('committed','ordinary') OR state='ordinary' AND json_type(record_json,'$.followupAdmissionGuard')='object')").run(bot, chat);
     }
     hasUnknownDeliveryOperation(outbox) {
         return !!this.db.prepare(`SELECT 1 FROM delivery_operations o WHERE outbox_id=? AND state IN ('attempted','unknown')

package/dist/openclaw-client.d.ts

@@ -39,6 +39,31 @@ export declare class AdmissionUnconfirmed extends Error {
     readonly submissionId: string;
     constructor(submissionId: string, cause?: unknown);
 }
+/** A genuinely observed physical session + nonempty transcript leaf. The
+ * public non-steer chat.send branch CAS uses BOTH; sessionId alone is not CAS. */
+export type FollowupAdmissionGuard = {
+    sessionKey: string;
+    sessionId: string;
+    expectedLeafEntryId: string; /** Prior verified SDK no-effect target, NOT a current receiver identity. */
+    nonInjectableRunId?: string;
+};
+export declare class FollowupAdmissionRefused extends Error {
+    readonly reason: string;
+    readonly submissionId: string;
+    constructor(reason: string, submissionId: string);
+}
+export type SessionDispatchStatus = {
+    idleConfirmed: boolean;
+    sessionId?: string;
+    archived?: boolean;
+    activeRunId?: string;
+    busyConfirmed?: boolean;
+    /** Explicit incompatible identity is not a genuinely unknown observation. */
+    identityConflict?: boolean;
+    /** Independent admission proof, NOT an assertion that aggregate work ended. */
+    followupAdmissionEligible?: boolean;
+    expectedLeafEntryId?: string;
+};
 export type ChatAttachment = {
     type?: string;
     mimeType?: string;
@@ -292,15 +317,10 @@ export declare class OpenClawClient {
     revokeSessionCollectors(sessionKey: string, reason: string): number;
     waitForSessionStop(sessionKey: string): Promise<void>;
     getSessionRuntimeStatus(sessionKey: string): Promise<SessionRuntimeStatus>;
-    /** Strong public current-session activity, independent of expired root
-     * terminal caches. Unknown/missing fields never authorize scheduling. */
-    getSessionDispatchStatus(sessionKey: string): Promise<{
-        idleConfirmed: boolean;
-        sessionId?: string;
-        archived?: boolean;
-        activeRunId?: string;
-        busyConfirmed?: boolean;
-    }>;
+    /** Execution-idle proof remains a complete pending scan. Independently,
+     * receiving a serialized followup does not require idle or empty pending
+     * work. A positive admission proof never turns an incomplete scan idle. */
+    getSessionDispatchStatus(sessionKey: string): Promise<SessionDispatchStatus>;
     private classifyWaitTimeout;
     getSessionInfo(sessionKey: string, timeoutMs?: number): Promise<any>;
     /**
@@ -464,6 +484,10 @@ export declare class OpenClawClient {
         /** Consecutive effective-activity silence after admission/collector start; default 10 minutes, not total run time. */
         timeoutMs?: number;
         emptyFinalAsNoReply?: boolean;
+        /** Restricted busy/no-target admission. No archive restore or unguarded retry. */
+        followupAdmissionGuard?: FollowupAdmissionGuard;
+        /** Local stop/owner/batch/admission CAS, checked around every async boundary. */
+        admissionGuard?: () => void;
         /** Called immediately before issuing chat.send RPC; use for at-most-once bookkeeping. */
         onSendAttempt?: (submissionId: string) => void | Promise<void>;
         /** Called after chat.send RPC succeeds and OpenClaw has accepted the user message. */
@@ -506,6 +530,10 @@ export declare class OpenClawClient {
         includeContext?: boolean;
         /** Disable bridge attachment hints for native commands and other exact pass-through messages. */
         includeBridgeAttachmentHint?: boolean;
+        /** Restricted busy/no-target admission. No archive restore or unguarded retry. */
+        followupAdmissionGuard?: FollowupAdmissionGuard;
+        /** Local stop/owner/batch/admission CAS, checked around every async boundary. */
+        admissionGuard?: () => void;
         /** Called immediately before issuing chat.send RPC; use for at-most-once bookkeeping. */
         onSendAttempt?: (submissionId: string) => void | Promise<void>;
         /** Called after chat.send RPC succeeds and OpenClaw has accepted the combined message. */

package/dist/openclaw-client.js

@@ -37,6 +37,16 @@ export class AdmissionUnconfirmed extends Error {
         this.name = 'AdmissionUnconfirmed';
     }
 }
+export class FollowupAdmissionRefused extends Error {
+    reason;
+    submissionId;
+    constructor(reason, submissionId) {
+        super(`Followup admission refused before effect; input retained: ${reason}`);
+        this.reason = reason;
+        this.submissionId = submissionId;
+        this.name = 'FollowupAdmissionRefused';
+    }
+}
 export const GATEWAY_PROTOCOL_MIN = 4;
 export const GATEWAY_PROTOCOL_MAX = 4;
 const REQUIRED_GATEWAY_METHODS = [
@@ -2259,11 +2269,19 @@ export class OpenClawClient {
                 clearTimeout(timer);
         }
     }
-    /** Strong public current-session activity, independent of expired root
-     * terminal caches. Unknown/missing fields never authorize scheduling. */
+    /** Execution-idle proof remains a complete pending scan. Independently,
+     * receiving a serialized followup does not require idle or empty pending
+     * work. A positive admission proof never turns an incomplete scan idle. */
     async getSessionDispatchStatus(sessionKey) {
         let timer;
         const key = this.canonicalSessionKey(sessionKey), deadline = Date.now() + 8000;
+        let admissionProof = {};
+        const admissionFrom = (history) => {
+            const info = history?.sessionInfo, run = history?.inFlightRun;
+            const knownTarget = run === undefined || run === null || typeof run?.runId === 'string' && !!run.runId.trim();
+            return info?.archived === false && knownTarget && typeof info?.activeLeafEntryId === 'string' && !!info.activeLeafEntryId.trim()
+                ? { followupAdmissionEligible: true, expectedLeafEntryId: info.activeLeafEntryId } : {};
+        };
         // One budget covers the entire public pending scan, not 1500ms per page.
         // Retained interrupted/cancelled inputs are recovery records, NOT runnable
         // queue entries. Never delete, mutate or replay them to prove schedulability.
@@ -2274,11 +2292,16 @@ export class OpenClawClient {
             const unknown = () => ({ idleConfirmed: false, sessionId });
             const validId = (value) => value === undefined || typeof value === 'string' && !!value.trim();
             for (let page = 0; page < 32; page++) {
+                admissionProof = {};
                 const history = await this.rpc('chat.history', { sessionKey: key, limit: 20, ...(before ? { pendingBefore: before } : {}) }, 1500);
                 if (Date.now() >= deadline)
                     return unknown();
                 const info = history?.sessionInfo;
                 const id = info?.sessionId || history?.sessionId;
+                if (typeof history?.sessionKey === 'string' && !!history.sessionKey && history.sessionKey !== key ||
+                    typeof info?.sessionId === 'string' && !!info.sessionId && typeof history?.sessionId === 'string' && !!history.sessionId && info.sessionId !== history.sessionId ||
+                    sessionId && typeof id === 'string' && !!id && sessionId !== id)
+                    return { ...unknown(), identityConflict: true };
                 if (!validId(info?.sessionId) || !validId(history?.sessionId) || history?.sessionKey !== key || typeof id !== 'string' || !id.trim() ||
                     info?.sessionId && history?.sessionId && info.sessionId !== history.sessionId || sessionId && sessionId !== id)
                     return unknown();
@@ -2286,10 +2309,13 @@ export class OpenClawClient {
                 const base = { sessionId, archived: info?.archived === true };
                 if (base.archived)
                     return { ...base, idleConfirmed: false };
+                admissionProof = admissionFrom(history);
+                const pending = history?.pendingInputs;
+                // Existing queued/interrupted/hidden inputs are not a receiving veto.
+                // Core owns FIFO/cap/drop. Below, idle still requires complete evidence.
                 if (info?.hasActiveRun === true || history?.inFlightRun)
                     return { ...base, idleConfirmed: false, busyConfirmed: true,
                         activeRunId: typeof history?.inFlightRun?.runId === 'string' ? history.inFlightRun.runId : undefined };
-                const pending = history?.pendingInputs;
                 if (!Number.isSafeInteger(pending?.total) || pending.total < 0 || total !== undefined && total !== pending.total)
                     return unknown();
                 total = pending.total;
@@ -2331,6 +2357,7 @@ export class OpenClawClient {
                 if (page > 0) {
                     // Pagination is not an atomic snapshot. Re-read the current head and
                     // identity/activity before returning positive evidence to local CAS.
+                    admissionProof = {};
                     const head = await this.rpc('chat.history', { sessionKey: key, limit: 20 }, 1500);
                     if (Date.now() >= deadline)
                         return unknown();
@@ -2339,6 +2366,7 @@ export class OpenClawClient {
                         return unknown();
                     if (hi?.archived === true)
                         return { ...base, archived: true, idleConfirmed: false };
+                    admissionProof = admissionFrom(head);
                     if (hi?.hasActiveRun === true || head?.inFlightRun || Number.isSafeInteger(hp?.queuedCount) && hp.queuedCount > 0)
                         return { ...base, idleConfirmed: false, busyConfirmed: true, activeRunId: typeof head?.inFlightRun?.runId === 'string' ? head.inFlightRun.runId : undefined };
                     if (hi?.hasActiveRun !== false)
@@ -2358,9 +2386,10 @@ export class OpenClawClient {
             // The outer race must honor the SAME total budget as the scan itself
             // (audit P1 2026-10-17: an 8000ms scan raced against a 1500ms timer was
             // still killed at 1500ms — three real 650ms pages never got to finish).
-            return await Promise.race([scan(), new Promise((_, reject) => {
+            const result = await Promise.race([scan(), new Promise((_, reject) => {
                     timer = setTimeout(() => reject(new Error('activity lookup timeout')), 8000);
                 })]);
+            return { ...result, ...admissionProof };
         }
         catch {
             return { idleConfirmed: false };
@@ -3037,7 +3066,7 @@ export class OpenClawClient {
         const stopGeneration = this.stopGenerations.get(fullSessionKey) || 0;
         const isCurrent = () => this.observationEpoch.get(fullSessionKey) === generation && (this.stopGenerations.get(fullSessionKey) || 0) === stopGeneration;
         const assertCurrent = () => { if (!isCurrent())
-            throw new SupersededObservation('admission generation revoked'); };
+            throw new SupersededObservation('admission generation revoked'); params.admissionGuard?.(); };
         const submissionId = randomUUID();
         let ownedRunId = "";
         let eventReservationRunId = '';
@@ -3062,7 +3091,21 @@ export class OpenClawClient {
             const sendStartedAt = Date.now();
             try {
                 assertCurrent();
-                this.recoveryStore?.saveAdmission(fullSessionKey, submissionId, 'reserved', { generation, stopGeneration });
+                const restricted = params.followupAdmissionGuard;
+                if (restricted) {
+                    const refuse = (reason) => { throw new FollowupAdmissionRefused(reason, submissionId); };
+                    if (restricted.sessionKey !== fullSessionKey || !restricted.sessionId?.trim() || !restricted.expectedLeafEntryId?.trim())
+                        refuse('missing or incompatible observed generation/leaf');
+                    const activity = await this.getSessionDispatchStatus(fullSessionKey);
+                    assertCurrent();
+                    const runtime = await this.getSessionRuntimeStatus(fullSessionKey);
+                    assertCurrent();
+                    if (!activity.followupAdmissionEligible || activity.identityConflict || activity.archived || runtime.archived ||
+                        activity.activeRunId && !restricted.nonInjectableRunId ||
+                        activity.sessionId !== restricted.sessionId || runtime.sessionId !== restricted.sessionId)
+                        refuse('current session/leaf/archive/admission evidence changed');
+                }
+                this.recoveryStore?.saveAdmission(fullSessionKey, submissionId, 'reserved', { generation, stopGeneration, ...(restricted ? { followupAdmissionGuard: restricted } : {}) });
                 await params.onSendAttempt?.(submissionId);
                 assertCurrent();
                 const idempotencyKey = submissionId;
@@ -3087,6 +3130,7 @@ export class OpenClawClient {
                         // Ordinary admission is a separate serialized turn, not a request to
                         // inherit stored interrupt/steer policy or its commit-wait finalizer.
                         queueMode: "followup",
+                        ...(restricted ? { sessionId: restricted.sessionId, expectedLeafEntryId: restricted.expectedLeafEntryId, suppressCommandInterpretation: true } : {}),
                         deliver: params.deliver ?? false,
                         idempotencyKey,
                     });
@@ -3095,6 +3139,25 @@ export class OpenClawClient {
                     result = await sendChat();
                 }
                 catch (err) {
+                    if (restricted) {
+                        // Only named public pre-effect guard refusals prove zero effect.
+                        // Other RPC errors/transport failures retain the ORIGINAL identity;
+                        // an error string alone must never authorize a new-ID replay.
+                        let detail;
+                        if (err instanceof Error && err.message.startsWith('RPC error:')) {
+                            try {
+                                detail = JSON.parse(err.message.slice('RPC error:'.length));
+                            }
+                            catch { /* unknown */ }
+                        }
+                        const noEffect = detail?.code === 'INVALID_REQUEST' && ['active-leaf-changed', 'session-changed'].includes(detail?.details?.reason);
+                        this.recoveryStore?.saveAdmission(fullSessionKey, idempotencyKey, noEffect ? 'rejected' : 'unknown', { generation, stopGeneration, followupAdmissionGuard: restricted });
+                        if (noEffect) {
+                            this.recoveryStore?.finishRunObservation(fullSessionKey, submissionId, 'rejected');
+                            throw new FollowupAdmissionRefused(detail.details.reason, submissionId);
+                        }
+                        throw new AdmissionUnconfirmed(idempotencyKey, err);
+                    }
                     // The Gateway auto-archives sessions past the active-session cap; an
                     // archived session refuses new work. Restore it once and retry — the
                     // user should never have to fix this by hand.
@@ -3254,6 +3317,8 @@ export class OpenClawClient {
                 deliver: params.deliver,
                 timeoutMs: params.timeoutMs,
                 emptyFinalAsNoReply: params.emptyFinalAsNoReply,
+                followupAdmissionGuard: params.followupAdmissionGuard,
+                admissionGuard: params.admissionGuard,
                 onSendAttempt: params.onSendAttempt,
                 onSubmitted: params.onSubmitted,
                 onRunIdentified: params.onRunIdentified,
@@ -3294,6 +3359,8 @@ export class OpenClawClient {
             deliver: params.deliver,
             timeoutMs: params.timeoutMs,
             emptyFinalAsNoReply: params.emptyFinalAsNoReply,
+            followupAdmissionGuard: params.followupAdmissionGuard,
+            admissionGuard: params.admissionGuard,
             onSendAttempt: params.onSendAttempt,
             onSubmitted: params.onSubmitted,
             onRunIdentified: params.onRunIdentified,

package/docs/releases/1.8.16.md

@@ -0,0 +1,26 @@
+# 1.8.16 — accept new input independently of background activity
+
+## User-facing repair
+
+Receiving input is different from starting execution. Ordinary sends already explicitly select noninterrupting `followup`; this release adds an independent guarded admission path rather than requiring the entire session to become globally idle.
+
+- Aggregate activity, retained/queued/hidden pending records and maintenance work no longer act as a blanket receiving veto when the bridge can establish matching physical-session, observed-leaf and nonarchive evidence.
+- Genuine injectable foreground targets retain SDK priority. A verified zero-effect/not-ready input can take one guarded followup path even when an observed foreground ID remains. Accepted/unknown/stopped or explicitly ineligible/target-changed input is never blindly replayed.
+- Preserve the earliest genuinely observed leaf and let the public host CAS accept exact/ancestor progress or refuse an off-path branch. Normal background transcript advance is not treated as permanent session-generation failure.
+- Preserve the existing bounded ordinary rescue for a fresh, never-attempted input whose activity state is genuinely unknown. An unknown submission receipt remains a different no-replay state.
+- Guard refusal retains the latest input and gives a visible explanation. Restricted sends never auto-unarchive and retry. Stop, owner, actual batch, admission epoch, identity and source checks fence late reads/ACKs and concurrent handlers.
+- Local scheduler retirement retains the original exact-run recovery, delivery target and honest Get state; it does not abort a business tool, invent a terminal outcome or infer input consumption.
+
+## Parent final-review corrections
+
+- Guarded same-proof backlogs respect configured message-count and byte bounds. Unselected inputs stay durably queued for subsequent bounded batches instead of being dropped or packed into an oversized request. One individually oversized input is not silently discarded.
+- Gateway-accepted guarded inputs transition to ordinary, synchronize and clear their pending trigger in one SQLite transaction. This prevents an accepted input reappearing in later group catch-up context and preserves unknown custody if the local checkpoint fails.
+
+## Verification and operational boundaries
+
+- Parent exact-source full offline suite: **65 files / 1763 tests passed**. Includes 51 new candidate admission cases plus parent backlog byte/count and atomic checkpoint rollback controls, all prior collector/privacy/presentation tests, and the original six A4 tests with unchanged assertions.
+- Bridge/all bundled-plugin builds and public SDK type contract passed. Package contents inspected; runtime dependencies and coordinated lma-core protocol/package remain unchanged (protocol 2 / 0.2.0).
+- Static parent verification of the actual Windows OpenClaw **2026.9.6** public leaf helper confirmed the same requested-session exact-or-ancestor semantics as Linux **2026.9.9**. No private helper was imported/executed and no Core/config file was changed.
+- Gateway acceptance is not immediate execution, per-input consumption or a platform receipt. Native FIFO, capacity/overflow, permissions, disconnect and stop behavior remain host constraints. Missing physical/leaf/nonarchive proof gets honest local custody, not a fabricated successful admission.
+- Update bridge runtime only, with a coherent bridge-state backup and verified rollback. No session reset/history deletion, queue clearing, automatic revival of stopped work or Gateway restart is required.
+- Original-group post-activation human input -> Gateway admission -> platform-accepted reply remains a separate live acceptance gate. Green offline tests, a version string and service readiness do not prove that gate.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-lark-multi-agent",
-  "version": "1.8.15",
+  "version": "1.8.16",
   "description": "Multi-bot Lark/Feishu bridge for OpenClaw, with per-bot model routing and isolated sessions",
   "type": "module",
   "scripts": {
@@ -76,7 +76,8 @@
     "docs/releases/1.8.5.md",
     "docs/releases/1.8.10.md",
     "docs/releases/1.8.11.md",
-    "docs/releases/1.8.15.md"
+    "docs/releases/1.8.15.md",
+    "docs/releases/1.8.16.md"
   ],
   "engines": {
     "node": ">=22"