openclaw-lark-multi-agent 1.8.19 → 1.8.21

package/dist/feishu-bot.js

@@ -1,3 +1,4 @@
+import { INPUT_DISPLAY_LIMITS, LIVE_CARD_BYTES, displayClip, hintDetail, hintLabel, inertInputText, inputPreview, visibleInputPreview, selectInputHints } from "./input-status-display.js";
 import { createHash, randomUUID } from 'node:crypto';
 import { AsyncLocalStorage } from "node:async_hooks";
 import * as lark from "@larksuiteoapi/node-sdk";
@@ -7,11 +8,11 @@ import { getI18n, normalizeLocale } from "./i18n.js";
 import { InactiveRunObservation, AdmissionUnconfirmed, CollectorStalledError, FollowupAdmissionRefused } from "./openclaw-client.js";
 import { SessionWaitPaused, isWaitTimeout, normalizeSessionRuntimeStatus, formatSessionFooter, FOREGROUND_WAIT_MS } from "./session-status.js";
 import { SupersededObservation } from "./openclaw-client.js";
-import { LiveStatusController, LiveStatusEffectRejectedError, LiveStatusEffectUnknownError } from "./live-status.js";
+import { LiveStatusController, LiveStatusEffectRejectedError, LiveStatusEffectUnknownError, LiveStatusEffectSuppressedError } from "./live-status.js";
 import { QueuedPresentations } from "./queued-presentation.js";
 import { CompactProgressController } from "./compact-progress.js";
 import { GoController } from "./go-controller.js";
-import { errorIdentity } from "./terminal-errors.js";
+import { RunTerminalError, closedStopReason, errorNoticeIdentity, errorIdentity } from "./terminal-errors.js";
 import { formatProviderError, safeErrorSummary } from "./provider-errors.js";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
 import { basename, extname, join, resolve } from "path";
@@ -31,7 +32,21 @@ export class SendDeadlineError extends Error {
     }
 }
 const nonemptyReceipt = (value) => typeof value === 'string' && !!value.trim();
-const canonicalPhysicalSessionKey = (key) => /^agent:[^:]+:/.test(key) ? key : `agent:main:${key}`;
+/** Resolve the PHYSICAL session key for a logical LMA key.
+ *
+ * A bot may be bound to a specific OpenClaw profile. The profile selects the
+ * agent that owns the session, so the physical key carries it as an
+ * `agent:<profile>:` prefix. A key that already carries an explicit
+ * `agent:<id>:` prefix is left untouched.
+ *
+ * With the default profile this is byte-identical to the historical
+ * `agent:main:<key>`, so existing durable records keep matching. */
+const canonicalPhysicalSessionKey = (key, profile) => {
+    if (/^agent:[^:]+:/.test(key))
+        return key;
+    const agent = String(profile || "main").trim() || "main";
+    return `agent:${agent}:${key}`;
+};
 const require = createRequire(import.meta.url);
 const LMA_VERSION = require("../package.json").version;
 const MAX_BOT_STREAK = 10;
@@ -328,8 +343,6 @@ export class FeishuBot {
     deliveryRetryTimers = new Map();
     /** Last time a real assistant-visible reply was successfully handed to the delivery pipeline. */
     lastRealDeliveryAt = new Map();
-    /** Per-chat: whether we've already sent the high-context alert this cycle. */
-    contextAlerted = new Map();
     /** Active pre-admission target for the current chat operation. */
     activeDeliveryTargets = new Map();
     /** Stable targets for concurrent runs in one chat. A steer admission can
@@ -386,10 +399,11 @@ export class FeishuBot {
         // Go / Go-Checker supervision (design: lma-go-checker-design-20260917).
         this.goController = new GoController({
             botName: config.name,
-            fallbackModel: config.model,
+            fallbackModel: config.model || "",
+            profile: this.profile,
             store,
             client: openclawClient,
-            executorSessionKeyFor: (chatId) => this.getSessionKey(chatId),
+            executorSessionKeyFor: (chatId) => this.physicalSessionKey(chatId),
             notify: (chatId, text) => this.sendOrdered(chatId, () => this.sendMessage(chatId, text)),
             reply: (messageId, text) => this.replyMessage(messageId, text),
             deliverExecutorResult: (chatId, result, goId) => this.deliverGoExecutorResult(chatId, result, goId),
@@ -404,7 +418,7 @@ export class FeishuBot {
             if (typeof exactKey !== "string" || typeof sessionId !== "string" || typeof runId !== "string")
                 return;
             for (const job of this.store.listActiveGoJobs(this.config.name)) {
-                if (exactKey !== job.executorSessionKey && exactKey !== `agent:main:${job.executorSessionKey}`)
+                if (exactKey !== job.executorSessionKey && exactKey !== canonicalPhysicalSessionKey(job.executorSessionKey, this.profile))
                     continue;
                 if (sessionId !== job.executorSessionId)
                     continue;
@@ -444,6 +458,10 @@ export class FeishuBot {
         if (!rowId)
             return;
         this.store.clearPendingTrigger(this.config.name, chatId, rowId);
+        // Privacy invalidation starts before reaction SDK I/O: unrelated lookup
+        // latency must not retain a recalled preview on a frozen/terminal card.
+        void this.queuedPresentations.refreshRecalledInput(chatId, rowId, messageId)
+            .catch(err => console.warn(`[${this.config.name}] Recalled-input UI redaction unavailable:`, this.errorSummary(err)));
         const pendingAcks = this.pendingAckMessages.get(chatId) || [];
         const remainingAcks = [];
         for (const ack of pendingAcks) {
@@ -464,9 +482,27 @@ export class FeishuBot {
      * Get the session key for a specific chat.
      * Format: lma-<botname>-<chatId>
      */
+    /** OpenClaw profile that owns this bot's sessions.
+     *
+     * Defaults to "main" so a configuration written before profiles existed
+     * keeps its historical behaviour exactly. */
+    get profile() {
+        return String(this.config.profile || "main").trim() || "main";
+    }
     getSessionKey(chatId) {
         return `lma-${this.config.name.toLowerCase()}-${chatId}`;
     }
+    /** Physical session key for this bot: the logical key addressed under the
+     * bot's OpenClaw profile.
+     *
+     * The LOGICAL key (getSessionKey) stays profile-free so durable records keep
+     * their historical shape and never need a migration. Every key that is
+     * actually handed to the Gateway goes through this method, so a bot bound to
+     * a non-default profile owns its sessions under that profile (its own
+     * workspace, memory and identity) while the stored records stay compatible. */
+    physicalSessionKey(chatId) {
+        return canonicalPhysicalSessionKey(this.getSessionKey(chatId), this.profile);
+    }
     chatLocale(chatId) {
         return normalizeLocale(chatId ? this.store.getChatLocale(chatId) || this.locale : this.locale);
     }
@@ -490,7 +526,11 @@ export class FeishuBot {
      * Lazy: only creates on first message in that chat.
      */
     async ensureSession(chatId, setupFence) {
-        const sessionKey = this.getSessionKey(chatId);
+        // The cache is keyed by the LOGICAL key so it stays profile-free and
+        // consistent with the rest of the durable bookkeeping; the Gateway is
+        // always addressed with the PHYSICAL key (profile included).
+        const logicalKey = this.getSessionKey(chatId);
+        const sessionKey = this.physicalSessionKey(chatId);
         await this.assertIdentityEffect();
         const held = this.identityEffects?.getStore();
         const expectedSessionId = held?.item.target.sessionId || setupFence?.sessionId;
@@ -501,9 +541,12 @@ export class FeishuBot {
             if (info?.session?.sessionId !== setupFence.sessionId || info.session.archived)
                 throw new SupersededObservation('retained setup physical target changed');
         }
-        if (this.initializedSessions.has(sessionKey)) {
+        if (this.initializedSessions.has(logicalKey)) {
             // Already initialized this process lifetime, just ensure model
-            const corrected = (expectedSessionId ? await this.openclawClient.ensureModel(sessionKey, this.config.model, { sessionId: expectedSessionId, guard: setupGuard }) : await this.openclawClient.ensureModel(sessionKey, this.config.model));
+            // No configured model means the bot follows its profile's own model.
+            const corrected = this.config.model
+                ? (expectedSessionId ? await this.openclawClient.ensureModel(sessionKey, this.config.model, { sessionId: expectedSessionId, guard: setupGuard }) : await this.openclawClient.ensureModel(sessionKey, this.config.model))
+                : false;
             setupGuard();
             if (corrected) {
                 console.log(`[${this.config.name}] Model auto-corrected to ${this.config.model}`);
@@ -519,7 +562,9 @@ export class FeishuBot {
             if (existing?.session) {
                 // Session exists — preserve it, only ensure model is correct
                 console.log(`[${this.config.name}] Session exists: ${sessionKey} (tokens: ${existing.session.totalTokens || 0})`);
-                const corrected = (expectedSessionId ? await this.openclawClient.ensureModel(sessionKey, this.config.model, { sessionId: expectedSessionId, guard: setupGuard }) : await this.openclawClient.ensureModel(sessionKey, this.config.model));
+                const corrected = this.config.model
+                    ? (expectedSessionId ? await this.openclawClient.ensureModel(sessionKey, this.config.model, { sessionId: expectedSessionId, guard: setupGuard }) : await this.openclawClient.ensureModel(sessionKey, this.config.model))
+                    : false;
                 setupGuard();
                 if (corrected) {
                     console.log(`[${this.config.name}] Model auto-corrected to ${this.config.model}`);
@@ -529,11 +574,13 @@ export class FeishuBot {
                 // Session doesn't exist — create new
                 await this.openclawClient.createSession({
                     key: sessionKey,
-                    model: this.config.model,
+                    model: this.config.model || "",
                     label: `LMA: ${this.config.name} [${chatId.slice(-8)}]`,
                 });
-                // Always patch model after create to ensure it takes effect
-                await this.openclawClient.patchSession({ key: sessionKey, model: this.config.model });
+                // Only patch when a model is configured; otherwise the profile's own
+                // model must be left untouched.
+                if (this.config.model)
+                    await this.openclawClient.patchSession({ key: sessionKey, model: this.config.model });
                 await this.injectBridgePolicy(sessionKey);
                 console.log(`[${this.config.name}] Session created: ${sessionKey} (model: ${this.config.model})`);
             }
@@ -545,7 +592,7 @@ export class FeishuBot {
             throw err;
         }
         setupGuard();
-        this.initializedSessions.add(sessionKey);
+        this.initializedSessions.add(logicalKey);
         // Subscribe to session events (proactive messages + tool calls)
         this.openclawClient.setVerboseTranscriptDelivery(sessionKey, this.store.getBotVerbose(this.config.name, chatId));
         await this.openclawClient.subscribeSession(sessionKey, async (text, meta) => {
@@ -561,7 +608,7 @@ export class FeishuBot {
                 }
                 if (meta?.sourceType === "run_error" || provenance) {
                     if (provenance) {
-                        this.store.observeRunError(this.config.name, chatId, provenance);
+                        this.store.observeRunError(this.config.name, chatId, this.scopeRunError(chatId, provenance));
                         await this.reconcileErrorNotices(chatId);
                     }
                     else
@@ -599,7 +646,7 @@ export class FeishuBot {
                 console.error(`[${this.config.name}] Failed to deliver proactive msg:`, err.message);
             }
         }, async (meta) => {
-            if (!meta.runId || this.store.isStoppedObservation(`agent:main:${sessionKey.replace(/^agent:[^:]+:/, '')}`, meta.runId))
+            if (!meta.runId || this.store.isStoppedObservation(canonicalPhysicalSessionKey(sessionKey.replace(/^agent:[^:]+:/, ''), this.profile), meta.runId))
                 return;
             if (this.store.hasUnconfirmedRunDelivery(this.config.name, chatId, meta.runId))
                 return;
@@ -655,7 +702,7 @@ export class FeishuBot {
         await this.wsClient.start({ eventDispatcher: this.eventDispatcher });
         if (this.identityClosed)
             return;
-        console.log(`[${this.config.name}] Bot started (model: ${this.config.model}, open_id: ${this.botOpenId || "unknown"})`);
+        console.log(`[${this.config.name}] Bot started (model: ${this.config.model || `profile ${this.profile}`}, open_id: ${this.botOpenId || "unknown"})`);
         // Drain any unsynced messages left from previous run
         this.drainOnStartup();
         void this.drainIdentityIngress().catch(err => console.warn(`[${this.config.name}] Identity ingress recovery failed:`, err.message));
@@ -688,14 +735,14 @@ export class FeishuBot {
         });
     }
     captureIdentityTarget(messageId, chatId) {
-        const key = this.getSessionKey(chatId);
+        const key = this.physicalSessionKey(chatId);
         const work = (async () => {
             const info = await this.identitySessionInfo(key);
             if (this.identityClosed)
                 return;
             const session = info?.session;
             const target = typeof session?.sessionId === 'string' && session.sessionId.trim() && session.sessionId.length <= 256 && session.archived !== true
-                && (!session.key || typeof session.key === 'string' && canonicalPhysicalSessionKey(session.key) === canonicalPhysicalSessionKey(key))
+                && (!session.key || typeof session.key === 'string' && canonicalPhysicalSessionKey(session.key, this.profile) === canonicalPhysicalSessionKey(key, this.profile))
                 ? { state: 'bound', sessionKey: key, sessionId: session.sessionId } : { state: 'unbound', sessionKey: key };
             if (target.state === 'unbound')
                 console.warn(`[${this.config.name}] Identity input ${messageId} has no proven original physical session; retained without retargeting`);
@@ -875,7 +922,12 @@ export class FeishuBot {
                 if (this.identityTargetRepairs.has(item.messageId))
                     return;
                 item.target = this.store.getIdentityTarget(this.config.name, this.config.appId, item.messageId);
-                if (item.target.state !== 'bound' || !item.target.sessionId || item.target.sessionKey !== this.getSessionKey(item.chatId))
+                // An identity target may hold the physical key (current records) or the
+                // logical key (records written before profiles existed). Both denote the
+                // SAME session, so both are accepted here; comparing against only one
+                // form silently skips identity recovery and the message is never sent.
+                if (item.target.state !== 'bound' || !item.target.sessionId ||
+                    (item.target.sessionKey !== this.physicalSessionKey(item.chatId) && item.target.sessionKey !== this.getSessionKey(item.chatId)))
                     continue;
                 const info = await this.identitySessionInfo(item.target.sessionKey);
                 if (this.identityClosed)
@@ -915,7 +967,7 @@ export class FeishuBot {
             const drainTasks = [];
             for (const chat of chats) {
                 // Skip p2p chats that belong to other bots
-                if (chat.chatType === "p2p" && chat.ownerBot && chat.ownerBot !== this.config.name) {
+                if (chat.chatType === "p2p" && !this.store.claimP2pOwner(chat.chatId, this.config.name, this.config.appId)) {
                     continue;
                 }
                 // Re-subscribe to existing sessions
@@ -973,7 +1025,9 @@ export class FeishuBot {
             if ((message.mentions || []).some((mention) => mention?.id && Object.hasOwn(mention.id, 'open_id') &&
                 (typeof mention.id.open_id !== 'string' || !mention.id.open_id.trim())))
                 return;
-            if (this.store.hasBotProcessed(this.config.name, message.message_id))
+            // Private duplicates must reach the stable app/chat fence so an old
+            // name-scoped tombstone cannot disappear across a later bot rename.
+            if (message.chat_type !== "p2p" && this.store.hasBotProcessed(this.config.name, message.message_id))
                 return;
             // A duplicate must honor the original journal owner, even if its envelope
             // differs or identity has resolved since the first receipt.
@@ -1031,7 +1085,9 @@ export class FeishuBot {
             // OpenClaw twice.
             if (this.identityClosed)
                 return;
-            if (!identityItem && !this.store.tryMarkBotProcessed(this.config.name, messageId))
+            if (!identityItem && !(chatType === "p2p"
+                ? this.store.tryMarkP2pProcessed(this.config.appId, chatId, this.config.name, messageId)
+                : this.store.tryMarkBotProcessed(this.config.name, messageId)))
                 return;
             const identityCurrent = () => {
                 if (this.identityClosed)
@@ -1051,11 +1107,8 @@ export class FeishuBot {
             if (!identityCurrent())
                 return;
             // --- P2P isolation: only the owning bot processes p2p messages ---
-            if (chatType === "p2p") {
-                const chatInfo = this.store.getChatInfo(chatId);
-                if (chatInfo?.ownerBot && chatInfo.ownerBot !== this.config.name) {
-                    return; // This p2p chat belongs to another bot
-                }
+            if (chatType === "p2p" && !this.store.claimP2pOwner(chatId, this.config.name, this.config.appId)) {
+                return; // A display-name match cannot override a conflicting app pin.
             }
             let content;
             try {
@@ -1065,6 +1118,14 @@ export class FeishuBot {
                 console.warn(`[${this.config.name}] Failed to parse message content, skipping`);
                 return;
             }
+            // Original visible input for UI only; never use hydrated media paths,
+            // synthetic routing prompts or model/history text as its body.
+            const inputCaption = [content.text, content.caption].find(value => typeof value === 'string') || '';
+            const inputDisplayText = messageType === 'text' ? (typeof content.text === 'string' ? content.text.replace(/@_user_\d+/g, (key) => { const mention = (message.mentions || []).find((item) => item.key === key); return typeof mention?.name === 'string' ? `@${mention.name}` : key; }) : '') :
+                messageType === 'file' ? `[${this.isEn(chatId) ? 'File' : '文件'}: ${(typeof content.file_name === 'string' ? content.file_name : 'file').split(/[\\/]/).at(-1)}] ${inputCaption}` :
+                    messageType === 'image' ? `[${this.isEn(chatId) ? 'Image' : '图片'}] ${inputCaption}` : messageType === 'audio' ? `[${this.isEn(chatId) ? 'Audio' : '语音'}] ${inputCaption}` : messageType === 'sticker' ? (this.isEn(chatId) ? '[Sticker]' : '[贴纸]') :
+                        messageType === 'post' ? this.visiblePostInput(content, chatId) :
+                            [content.title, content.name, content.text, content.url].find(value => typeof value === 'string') || '';
             // --- Extract text content based on message type ---
             let cleanText = "";
             let rawText = "";
@@ -1448,7 +1509,7 @@ export class FeishuBot {
                     const isOn = this.store.getBotVerbose(this.config.name, chatId);
                     const nextVerbose = !isOn;
                     this.store.setBotVerbose(this.config.name, chatId, nextVerbose);
-                    this.openclawClient.setVerboseTranscriptDelivery(this.getSessionKey(chatId), nextVerbose);
+                    this.openclawClient.setVerboseTranscriptDelivery(this.physicalSessionKey(chatId), nextVerbose);
                     if (isOn) {
                         await this.replyMessage(messageId, `🔇 ${this.config.name} Verbose 已关闭\n只影响当前 Bot 在当前会话的 Tool call 和中间文本显示`);
                     }
@@ -1622,7 +1683,7 @@ export class FeishuBot {
                 // No health/setup/model/history await precedes this honest local receipt.
                 // UI custody cannot reserve dispatch or claim Gateway/model acceptance.
                 const presentationRoot = this.queueOwners.get(chatId)?.runId || this.store.getDispatchCustody(this.config.name, chatId)?.runId;
-                this.presentation(() => this.queuedPresentations.receive(chatId, insertedId, messageId, isNativeOpenClawCommand, presentationRoot));
+                this.presentation(() => this.queuedPresentations.receive(chatId, insertedId, messageId, isNativeOpenClawCommand, presentationRoot, { source: 'visible', text: inputDisplayText }));
                 // Reserve BEFORE the first health/reaction await. Otherwise an ending
                 // owner can ordinary-drain this row while its handler is still waiting,
                 // and the later steer would submit the same message a second time.
@@ -1716,9 +1777,23 @@ export class FeishuBot {
         if (!activity.followupAdmissionEligible || activity.identityConflict || activity.activeRunId && !noEffectRunId || activity.archived || status.archived ||
             !status.sessionId || status.sessionId !== activity.sessionId || !activity.expectedLeafEntryId)
             return;
-        return { sessionKey: canonicalPhysicalSessionKey(this.getSessionKey(chatId)), sessionId: status.sessionId, expectedLeafEntryId: activity.expectedLeafEntryId,
+        return { sessionKey: canonicalPhysicalSessionKey(this.getSessionKey(chatId), this.profile), sessionId: status.sessionId, expectedLeafEntryId: activity.expectedLeafEntryId,
             ...(noEffectRunId ? { nonInjectableRunId: noEffectRunId } : {}) };
     }
+    /** How long an unconfirmed input may stay silent before the user is told.
+     *
+     * A fixed 60s window misfired on every slow session: measured reply latency
+     * in a busy group was p50 3.8min / p90 20.2min / max 135min, so 85% of real
+     * replies exceeded the old threshold and every one of them produced a false
+     * "not confirmed" notice. Scale the window with the session's own observed
+     * latency so a healthy slow run is never reported as stuck. */
+    unconfirmedGraceMs(chatId) {
+        const observed = this.store.observedReplyLatencyMs(this.config.name, chatId);
+        const floor = 60_000;
+        if (!observed || !Number.isFinite(observed) || observed <= 0)
+            return floor;
+        return Math.min(Math.max(floor, Math.ceil(observed * 1.5)), 30 * 60_000);
+    }
     /** A positive refusal must be durable AND explained to the sender. */
     retainChangedFollowup(chatId, item, reason) {
         this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, 'target_changed', { ...item, reason });
@@ -1735,7 +1810,7 @@ export class FeishuBot {
         for (const item of this.store.listInsertions(this.config.name, chatId)) {
             if (item.state !== 'pending' || item.attempted || item.followupAdmissionGuard || item.ordinaryEligible === false ||
                 item.ownerId !== saved.id || item.batchId !== saved.batchId || item.stopEpoch !== saved.stopEpoch || item.sessionId !== proof.sessionId ||
-                !item.sessionKey || canonicalPhysicalSessionKey(item.sessionKey) !== proof.sessionKey)
+                !item.sessionKey || canonicalPhysicalSessionKey(item.sessionKey, this.profile) !== proof.sessionKey)
                 continue;
             const source = this.store.getMessageByMessageId(item.messageId);
             if (source?.senderType !== 'human' || source.triggerKind !== 'normal')
@@ -1759,7 +1834,7 @@ export class FeishuBot {
             !this.queueOwners.get(chatId)?.triggerIds?.has(rowId);
         if (!unsubmitted())
             return;
-        await this.openclawClient.waitForSessionStop?.(this.getSessionKey(chatId));
+        await this.openclawClient.waitForSessionStop?.(this.physicalSessionKey(chatId));
         if (!unsubmitted())
             return;
         // Session creation/model setup is not agent admission. Initialize a truly
@@ -1785,15 +1860,15 @@ export class FeishuBot {
         }
         if (!unsubmitted() || this.queueRuns.has(chatId) || this.store.getDispatchCustody(this.config.name, chatId))
             return;
-        const status = await this.openclawClient.getSessionRuntimeStatus(this.getSessionKey(chatId));
+        const status = await this.openclawClient.getSessionRuntimeStatus(this.physicalSessionKey(chatId));
         if (!unsubmitted() || this.queueRuns.has(chatId) || this.store.getDispatchCustody(this.config.name, chatId))
             return;
         const current = this.store.getInsertion(this.config.name, chatId, rowId);
         if (current && (!current.activityUnbound || current.attempted))
             return;
-        if (current && (current.stopEpoch !== epoch || !current.sessionKey || canonicalPhysicalSessionKey(current.sessionKey) !== canonicalPhysicalSessionKey(this.getSessionKey(chatId))))
+        if (current && (current.stopEpoch !== epoch || !current.sessionKey || canonicalPhysicalSessionKey(current.sessionKey, this.profile) !== canonicalPhysicalSessionKey(this.getSessionKey(chatId), this.profile)))
             return;
-        const activity = await this.openclawClient.getSessionDispatchStatus(this.getSessionKey(chatId));
+        const activity = await this.openclawClient.getSessionDispatchStatus(this.physicalSessionKey(chatId));
         if (!unsubmitted() || this.queueRuns.has(chatId) || this.store.getDispatchCustody(this.config.name, chatId))
             return;
         // Another recovery/ingress lookup may have identified the root and begun
@@ -1809,6 +1884,13 @@ export class FeishuBot {
             !!current?.sessionId && !!status.sessionId && current.sessionId !== status.sessionId;
         const source = this.store.getMessageByMessageId(messageId);
         const ordinaryHuman = source?.id === rowId && source.chatId === chatId && source.senderType === 'human' && source.triggerKind === 'normal';
+        if (current?.followupBlocked && !archived && !generationConflict) {
+            this.store.saveInsertion(this.config.name, chatId, rowId, current.insertionId || JSON.stringify([this.config.appId, chatId, messageId]), 'pending', {
+                ...current, followupBlocked: false, followupAdmissionGuard: undefined, followupObservedAt: undefined,
+                reason: 'followup block cleared; awaiting admission re-observation',
+            }, Date.now() + 5000);
+            return;
+        }
         const proof = ordinaryHuman && compatible && !current?.followupBlocked && !archived ? this.observedFollowupGuard(chatId, status, activity) : undefined;
         const previous = current?.followupAdmissionGuard;
         if (previous && (archived || generationConflict)) {
@@ -1857,7 +1939,7 @@ export class FeishuBot {
             ...((archived || generationConflict) ? { followupBlocked: true } : {}),
             reason: identified ? 'current Gateway run observed; insertion custody only' : blockerReason,
         }, Date.now() + (identified ? 0 : 5000));
-        if (!identified && !proof && current?.unboundSince && Date.now() - current.unboundSince >= 60_000 &&
+        if (!identified && !proof && current?.unboundSince && Date.now() - current.unboundSince >= this.unconfirmedGraceMs(chatId) &&
             (archived || generationConflict || activity.busyConfirmed || current.restrictedObservation))
             this.explainUnconfirmedFollowup(chatId, { ...current, rowId, messageId });
     }
@@ -1872,7 +1954,7 @@ export class FeishuBot {
         const source = this.store.getMessageByMessageId(item.messageId);
         if (item.state !== 'pending' || item.attempted || item.ordinaryEligible === false || !item.sessionId ||
             !source || source.id !== item.rowId || source.chatId !== chatId || source.senderType !== 'human' || source.triggerKind !== 'normal' ||
-            !item.sessionKey || canonicalPhysicalSessionKey(item.sessionKey) !== canonicalPhysicalSessionKey(this.getSessionKey(chatId)))
+            !item.sessionKey || canonicalPhysicalSessionKey(item.sessionKey, this.profile) !== canonicalPhysicalSessionKey(this.getSessionKey(chatId), this.profile))
             return false;
         const admissionEpoch = this.queueAdmissionEpoch.get(chatId) || 0;
         const snapshot = this.store.getInsertion(this.config.name, chatId, item.rowId);
@@ -1922,14 +2004,14 @@ export class FeishuBot {
             return (this.queueAdmissionEpoch.get(chatId) || 0) === admissionEpoch && this.stopGeneration(chatId) === epoch && saved.stopEpoch === epoch && JSON.stringify(now) === JSON.stringify(saved) &&
                 this.queueOwners.get(chatId) === local && (!local || local.batch === batch && local.runId === runId && (local.admitted === true || local.yielded === true) && local.collecting === true);
         };
-        const activity = await this.openclawClient.getSessionDispatchStatus?.(this.getSessionKey(chatId)).catch(() => null);
+        const activity = await this.openclawClient.getSessionDispatchStatus?.(this.physicalSessionKey(chatId)).catch(() => null);
         if (!unchanged() || !activity || activity.archived || activity.sessionId !== saved.sessionId)
             return false;
         if (activity.activeRunId === saved.runId)
             return false; // real foreground keeps SDK priority
         if (!activity.idleConfirmed && !activity.followupAdmissionEligible)
             return false;
-        const status = await this.openclawClient.getSessionRuntimeStatus(this.getSessionKey(chatId)).catch(() => null);
+        const status = await this.openclawClient.getSessionRuntimeStatus(this.physicalSessionKey(chatId)).catch(() => null);
         if (!unchanged() || !status || status.archived || status.sessionId !== saved.sessionId)
             return false;
         if (activity.activeRunId && activity.activeRunId !== saved.runId) {
@@ -1940,7 +2022,7 @@ export class FeishuBot {
             for (const item of this.store.listInsertions(this.config.name, chatId)) {
                 if (item.state !== 'pending' || item.attempted || item.noEffectRunId || item.ordinaryEligible === false || item.ownerId !== saved.id || item.batchId !== saved.batchId ||
                     item.stopEpoch !== epoch || item.sessionId !== saved.sessionId || !item.sessionKey ||
-                    canonicalPhysicalSessionKey(item.sessionKey) !== canonicalPhysicalSessionKey(this.getSessionKey(chatId)))
+                    canonicalPhysicalSessionKey(item.sessionKey, this.profile) !== canonicalPhysicalSessionKey(this.getSessionKey(chatId), this.profile))
                     continue;
                 const source = this.store.getMessageByMessageId(item.messageId);
                 if (source?.senderType !== 'human' || source.triggerKind !== 'normal')
@@ -1967,7 +2049,7 @@ export class FeishuBot {
         let followup;
         if (!idle || saved.followupAdmissionGuard) {
             const proof = this.observedFollowupGuard(chatId, status, activity);
-            if (!proof || !saved.sessionKey || canonicalPhysicalSessionKey(saved.sessionKey) !== proof.sessionKey)
+            if (!proof || !saved.sessionKey || canonicalPhysicalSessionKey(saved.sessionKey, this.profile) !== proof.sessionKey)
                 return false;
             const previous = saved.followupAdmissionGuard;
             if (previous && (previous.sessionKey !== proof.sessionKey || previous.sessionId !== proof.sessionId))
@@ -2000,7 +2082,12 @@ export class FeishuBot {
         }
     }
     stopGeneration(chatId) {
-        return this.stopEpoch.get(chatId) ?? this.store.getStopGeneration(this.config.name, chatId);
+        // A peer bot's group-scoped /stop bumps this bot's durable epoch. The
+        // in-memory value can then be stale and would mask the newer durable one,
+        // so take the greater of the two instead of trusting the cache blindly.
+        const cached = this.stopEpoch.get(chatId);
+        const stored = this.store.getStopGeneration(this.config.name, chatId);
+        return cached === undefined ? stored : Math.max(cached, stored);
     }
     reactionChecks = new Set();
     async receiptReaction(chatId, rowId, messageId, desired, runId = '') {
@@ -2235,7 +2322,7 @@ export class FeishuBot {
                         }
                         else {
                             state = 'pending';
-                            if (Date.now() - item.noEffectSince >= 60_000)
+                            if (Date.now() - item.noEffectSince >= this.unconfirmedGraceMs(chatId))
                                 this.explainUnconfirmedFollowup(chatId, item);
                         }
                     }
@@ -2253,7 +2340,7 @@ export class FeishuBot {
                     ordinaryEligible: receipt.ordinaryEligible, attempted: valid ? (receipt.attempted ?? true) : true, sessionId: item.sessionId, reason: receipt.reason, unknownChecks,
                     unknownSince: state === 'unknown' ? (item.state === 'unknown' && Number.isFinite(item.unknownSince) ? item.unknownSince : Date.now()) : undefined };
                 this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, state, record, Date.now() + (state === 'unknown' ? 15_000 : 5000));
-                if (state === 'pending' && !record.attempted && Date.now() - (record.pendingSince || Date.now()) >= 60_000)
+                if (state === 'pending' && !record.attempted && Date.now() - (record.pendingSince || Date.now()) >= this.unconfirmedGraceMs(chatId))
                     this.explainUnconfirmedFollowup(chatId, record);
                 if (state === 'ordinary') {
                     this.store.deletePendingInsertionNotices(this.config.name, chatId, item.insertionId);
@@ -2309,7 +2396,7 @@ export class FeishuBot {
         return process.env.OPENCLAW_LARK_MULTI_AGENT_LIVE_STATUS !== "0";
     }
     async getUnhealthySessionStatus(chatId) {
-        const sessionKey = this.getSessionKey(chatId);
+        const sessionKey = this.physicalSessionKey(chatId);
         try {
             const resp = await this.openclawClient.getSessionInfo(sessionKey);
             const status = String(resp?.session?.status || "").toLowerCase();
@@ -2491,11 +2578,20 @@ export class FeishuBot {
      */
     forceExpireQueueOwner(chatId, reason, preserveDispatch = false) {
         const owner = this.queueRuns.get(chatId);
-        if (!owner)
+        if (!owner) {
+            // No local owner left, but a persisted dispatch_custody row may still
+            // exist for this chat (it is written before the owner is retired). The
+            // old early return stranded that row forever: it never became visible
+            // again, yet it also was never deleted. Clear it explicitly.
+            if (!preserveDispatch && this.store.clearDispatchCustodyForChat(this.config.name, chatId))
+                console.warn(`[${this.config.name}] cleared orphaned dispatch custody for ${chatId.slice(-8)}: ${reason}`);
             return false;
+        }
         const context = this.queueOwners.get(chatId);
         if (context?.batchId && !preserveDispatch)
             this.store.clearDispatchCustody(this.config.name, chatId, context.id, context.batchId);
+        else if (!preserveDispatch && !context)
+            this.store.clearDispatchCustodyForChat(this.config.name, chatId);
         if (context)
             context.revoked = true;
         this.busyChats.set(chatId, 0);
@@ -2717,7 +2813,11 @@ export class FeishuBot {
             const expectedIdentitySessionId = identityTargets[0]?.target.sessionId;
             try {
                 if (identityTargets.some(({ target }) => target.state !== 'bound' || !target.sessionId || target.sessionId !== expectedIdentitySessionId ||
-                    target.sessionKey !== this.getSessionKey(chatId) || (target.expiresAt ?? 0) <= Date.now()))
+                    // An identity target may hold the physical key (current records) or the
+                    // logical key (records written before profiles existed). Both denote
+                    // the SAME session, so both are accepted; comparing against only one
+                    // form would silently drop the message.
+                    (target.sessionKey !== this.physicalSessionKey(chatId) && target.sessionKey !== this.getSessionKey(chatId)) || (target.expiresAt ?? 0) <= Date.now()))
                     throw new SupersededObservation('retained original target unavailable');
                 sessionKey = await (expectedIdentitySessionId ? this.ensureSession(chatId, { sessionId: expectedIdentitySessionId, guard }) : this.ensureSession(chatId));
                 guard();
@@ -2739,7 +2839,7 @@ export class FeishuBot {
                     owner.continuePending = mergedTriggers.some(message => !identityTargets.some(entry => entry.message === message));
                     break;
                 }
-                await liveStatus?.pauseForUnconfirmedResult(this.isEn(chatId) ? "Session setup failed before admission" : "会话准备失败，尚未提交 Gateway", this.isEn(chatId) ? `${this.config.name} setup unavailable` : `${this.config.name} 会话准备未完成`).catch(() => { });
+                await liveStatus?.pauseForUnconfirmedResult(this.isEn(chatId) ? "Session setup failed before admission" : "会话准备失败，尚未提交 Gateway", this.isEn(chatId) ? `${this.config.name} setup unavailable` : `${this.config.name} 会话准备未完成`, "blocked").catch(() => { });
                 if (batchProof) {
                     for (const id of mergedTriggerIds) {
                         const item = this.store.getInsertion(this.config.name, chatId, id);
@@ -2879,7 +2979,10 @@ export class FeishuBot {
                             if (target?.triggerId === triggerId) {
                                 target.runId = runId;
                                 this.bindRunDeliveryTarget(chatId, runId, target);
-                                this.releaseRunDeliveryTargetAfter(chatId, runId, 30 * 60_000);
+                                // Result custody must outlive the real run. Observed GPT latency in a heavy
+                                // group reached ~59m40s, so a 30-minute release dropped a computed answer
+                                // that had no receiver left. Two hours covers the observed tail.
+                                this.releaseRunDeliveryTargetAfter(chatId, runId, 2 * 60 * 60_000);
                             }
                             // Refine state for logs/idempotent sync rows when OpenClaw returns
                             // a runId. markSubmittedBatch is idempotent due to local flags and
@@ -2947,7 +3050,7 @@ export class FeishuBot {
                     guard,
                     onSendAttempt: submissionId => {
                         guard();
-                        this.store.bindDeliveryRun(this.config.name, chatId, submissionId, { triggerId, messageId: lastHuman.messageId || '', runId: submissionId, stopGeneration: this.stopGeneration(chatId), sessionKey: `agent:main:${sessionKey.replace(/^agent:[^:]+:/, '')}` });
+                        this.store.bindDeliveryRun(this.config.name, chatId, submissionId, { triggerId, messageId: lastHuman.messageId || '', runId: submissionId, stopGeneration: this.stopGeneration(chatId), sessionKey: canonicalPhysicalSessionKey(sessionKey.replace(/^agent:[^:]+:/, ''), this.profile) });
                     },
                     onSubmitted: async (runId) => { guard(); const previousRoot = owner.runId; owner.runId = runId; foregroundRunId = runId; void this.queuedPresentations.advance(liveStatus, previousRoot, runId, owner.id, owner.batchId).catch(() => { }); this.bindRunDeliveryTarget(chatId, runId, { triggerId, messageId: lastHuman.messageId || "", liveStatus }); },
                 });
@@ -3029,14 +3132,13 @@ export class FeishuBot {
                             const outcome = await this.enqueueAndDispatchDelivery(chatId, "assistant_visible", this.deliverySourceId("visible", `${triggerId}|${(shouldReply ? visibleReply : "").trim()}|${JSON.stringify(parsedReply.attachments)}`), shouldReply ? visibleReply : "", parsedReply.attachments, lastHuman.messageId, `trigger:${triggerId}`, this.config.model, foregroundRunId ? { runId: foregroundRunId, sessionKey, ...(foregroundSessionId ? { sessionId: foregroundSessionId } : {}), final: true } : undefined, undefined, mergedTriggerIds);
                             visibleOutcomeConfirmed = outcome.state === 'delivered';
                             if (!visibleOutcomeConfirmed) {
-                                await liveStatus?.pauseForUnconfirmedResult("飞书投递回执尚未确认；保留原投递保管，不重复发送").catch(() => { });
+                                await liveStatus?.pauseForUnconfirmedResult("飞书投递回执尚未确认；保留原投递保管，不重复发送", undefined, "delivery_pending").catch(() => { });
                             }
                             else {
                                 await liveStatus?.complete();
                                 // Mark every merged trigger only after receipt confirmation.
                                 for (const id of mergedTriggerIds)
                                     this.store.markDeliveredReply(this.config.name, chatId, id, lastHuman.messageId);
-                                void this.maybeAlertHighContext(chatId);
                             }
                             // Go supervision: record the delivered final reply as evidence and
                             // arm a debounced checker round (busy gates apply inside).
@@ -3101,6 +3203,10 @@ export class FeishuBot {
                     this.goController?.notifyRunOutcome(chatId, "no_reply", `trigger:${triggerId}`, "(本轮无用户可见回复 NO_REPLY)");
                 }
                 console.log(`[${this.config.name}] [${new Date().toISOString()}] ${shouldReply || hasAttachments ? 'Replied' : 'Skipped (empty/NO_REPLY)'} (${reply.length} chars, attachments=${parsedReply.attachments.length})`);
+                // Context usage is re-checked after EVERY completed message (delivered
+                // reply, NO_REPLY turn or runtime failure) and re-notifies each time while
+                // usage stays above the threshold.
+                await this.maybeAlertHighContext(chatId);
                 guard();
                 // Replace ack reactions with DONE only for trigger messages actually
                 // processed in this run. Queued messages that arrived mid-run keep their
@@ -3151,17 +3257,17 @@ export class FeishuBot {
                             this.store.saveInsertion(this.config.name, chatId, id, row.insertionId, 'target_changed', { ...row, attempted: false, reason: err.message });
                     }
                     await this.enqueueAndDispatchDelivery(chatId, 'admission_status', `admission:${err.submissionId}:refused`, err.message, [], lastHuman.messageId, `admission:${err.submissionId}:refused`).catch(() => { });
-                    await liveStatus?.pauseForUnconfirmedResult(err.message).catch(() => { });
+                    await liveStatus?.pauseForUnconfirmedResult(err.message, undefined, "blocked").catch(() => { });
                     owner.continuePending = true; // independently proved newer cohorts may still be sent
                     break;
                 }
                 if (err instanceof AdmissionUnconfirmed) {
                     await this.enqueueAndDispatchDelivery(chatId, 'admission_status', `admission:${err.submissionId}:unknown`, err.message, [], lastHuman.messageId, `admission:${err.submissionId}:unknown`).catch(() => { });
-                    await liveStatus?.pauseForUnconfirmedResult(err.message).catch(() => { });
+                    await liveStatus?.pauseForUnconfirmedResult(err.message, undefined, "submitting").catch(() => { });
                     break;
                 }
                 let pause = err instanceof SessionWaitPaused ? err : undefined;
-                if (!pause && isWaitTimeout(err instanceof Error ? err.message : String(err))) {
+                if (!pause && !(err instanceof RunTerminalError) && isWaitTimeout(err instanceof Error ? err.message : String(err))) {
                     const state = await this.readSessionStatus(chatId);
                     if (state.running)
                         pause = new SessionWaitPaused(state, true);
@@ -3170,7 +3276,7 @@ export class FeishuBot {
                     const target = this.activeDeliveryTargets.get(chatId);
                     if (target?.triggerId === triggerId && target.runId)
                         this.openclawClient.releasePausedWait?.(target.runId);
-                    await liveStatus?.pauseForUnconfirmedResult(pause.message, `${this.config.name} 等待暂停 · ${pause.snapshot.status}`).catch(() => { });
+                    await liveStatus?.pauseForUnconfirmedResult(pause.message, `${this.config.name} 等待暂停 · ${pause.snapshot.status}`, "paused").catch(() => { });
                     await this.sendWaitPaused(chatId, triggerId, lastHuman.messageId, pause).catch(() => { });
                     // A wait notice is not the final answer and must never claim its key.
                     // Do not mark DONE, retry this input, or abort the running session.
@@ -3226,7 +3332,7 @@ export class FeishuBot {
                         if (row && !row.admissionSubmissionId && !row.admittedRunId)
                             this.store.saveInsertion(this.config.name, chatId, id, row.insertionId, 'target_changed', { ...row, attempted: false, reason: 'guarded pre-admission failure; input retained without sync or new-ID retry' });
                     }
-                    await liveStatus?.pauseForUnconfirmedResult('Guarded admission unavailable; input custody retained without replay').catch(() => { });
+                    await liveStatus?.pauseForUnconfirmedResult('Guarded admission unavailable; input custody retained without replay', undefined, 'blocked').catch(() => { });
                     break;
                 }
                 console.error(`[${this.config.name}] processQueue error:`, safeErrorSummary(err));
@@ -3236,13 +3342,30 @@ export class FeishuBot {
                 if (lastHuman.messageId) {
                     // Error message goes through the normal delivery path; the live status
                     // is a separate message that we mark interrupted afterwards.
-                    await this.enqueueAndDispatchDelivery(chatId, "provider_error", `trigger:${triggerId}:provider-error`, errorText, [], lastHuman.messageId, `trigger:${triggerId}:provider-error`)
-                        .then(outcome => {
-                        errorOutcomeConfirmed = outcome.state === 'delivered';
-                        if (errorOutcomeConfirmed && current() && triggerId)
-                            this.store.markDeliveredReply(this.config.name, chatId, triggerId, lastHuman.messageId);
-                    })
-                        .catch(() => { });
+                    if (err instanceof RunTerminalError) {
+                        const p = this.scopeRunError(chatId, err.provenance);
+                        this.store.observeRunError(this.config.name, chatId, p);
+                        await this.reconcileErrorNotices(chatId);
+                        errorOutcomeConfirmed = this.store.findRunErrorOwner(this.config.name, chatId, p)?.status === 'delivered';
+                    }
+                    else if (this.store.hasDeliveredReply(this.config.name, chatId, triggerId)) {
+                        // This trigger already received its visible reply. A later terminal
+                        // error for the same run must NOT contradict a delivered answer:
+                        // the user would see "did not complete" under their own answer.
+                        errorOutcomeConfirmed = true;
+                        console.warn(`[${this.config.name}] provider_error suppressed for ${chatId.slice(-8)} trigger=${triggerId}: reply already delivered`);
+                    }
+                    else
+                        await this.enqueueAndDispatchDelivery(chatId, "provider_error", `trigger:${triggerId}:provider-error`, errorText, [], lastHuman.messageId, `trigger:${triggerId}:provider-error`, undefined, foregroundRunId ? (() => {
+                            const p = this.scopeRunError(chatId, { sessionKey: canonicalPhysicalSessionKey(this.getSessionKey(chatId), this.profile), sessionId: owner.sessionId, runId: foregroundRunId, source: 'chat', state: 'error', detail: err instanceof Error ? err.message : undefined });
+                            return { sessionKey: p.sessionKey, sessionId: p.sessionId, runId: p.runId, error: p };
+                        })() : undefined)
+                            .then(outcome => {
+                            errorOutcomeConfirmed = outcome.state === 'delivered';
+                            if (errorOutcomeConfirmed && current() && triggerId)
+                                this.store.markDeliveredReply(this.config.name, chatId, triggerId, lastHuman.messageId);
+                        })
+                            .catch(() => { });
                     await liveStatus?.fail().catch(() => { });
                 }
                 else {
@@ -3485,13 +3608,14 @@ export class FeishuBot {
             thinkingLevel: meta.thinkingLevel,
             toolCalls: meta.toolCalls,
             noReply: Boolean(meta.noReply),
+            inputStatus: meta.inputStatus ? { ...meta.inputStatus, items: meta.inputStatus.items.map(item => item.kind === 'delivery_pending' ? { ...item, kind: 'completed' } : item) } : { items: [{ kind: meta.noReply ? "no_reply" : "completed", at: 0 }] },
             state: "done",
         };
         await this.patchLiveStatusCard(messageId, view, chatId);
     }
     async readSessionStatus(chatId) {
         try {
-            return await this.openclawClient.getSessionRuntimeStatus(this.getSessionKey(chatId));
+            return await this.openclawClient.getSessionRuntimeStatus(this.physicalSessionKey(chatId));
         }
         catch {
             return normalizeSessionRuntimeStatus(undefined);
@@ -3504,7 +3628,7 @@ export class FeishuBot {
     formatUserVisibleError(err, chatId) {
         if (err instanceof SessionWaitPaused)
             return err.message;
-        return formatProviderError(err, this.config.name, this.config.model, this.chatLocale(chatId));
+        return formatProviderError(err, this.config.name, this.config.model || "", this.chatLocale(chatId));
     }
     isBridgeControlReply(text) {
         const t = text.trim();
@@ -3589,36 +3713,34 @@ export class FeishuBot {
         }
     }
     /**
-     * After a reply is delivered, alert the user once if context usage crossed the
-     * threshold (default 80%), so they can compact before a session bloats into the
-     * timeout/lock/overflow failure modes. We only alert on a fresh crossing: once
-     * alerted we stay quiet until usage drops back below the threshold (e.g. after
-     * a compact), then re-arm.
+     * After a message completes, alert the user when context usage is at or above
+     * the threshold (default 80%), so they can compact before the session bloats
+     * into the timeout/lock/overflow failure modes.
+     *
+     * The check runs after EVERY completed message and re-notifies on every message
+     * while usage stays above the threshold. There is deliberately no per-chat
+     * "already warned" latch: with one, a single failed send (or a stale latch) would
+     * silently suppress every later warning, and the user would stop being told to
+     * compact while their context keeps growing.
      */
     async maybeAlertHighContext(chatId) {
         const threshold = contextAlertPct();
         if (threshold <= 0)
             return;
         try {
-            const sessionKey = this.getSessionKey(chatId);
+            const sessionKey = this.physicalSessionKey(chatId);
             const pct = await this.getContextUsagePercent(sessionKey);
-            if (pct <= 0)
+            if (pct <= 0 || pct < threshold)
                 return;
-            const alerted = this.contextAlerted.get(chatId) || false;
-            if (pct >= threshold) {
-                if (alerted)
-                    return; // already warned this cycle
-                this.contextAlerted.set(chatId, true);
-                const en = this.isEn(chatId);
-                const text = en
-                    ? `\u26a0\ufe0f Context is at ${pct}% (\u2265${threshold}%). Consider /compact soon to avoid timeouts/overflow.`
-                    : `\u26a0\ufe0f \u4e0a\u4e0b\u6587\u5df2\u8fbe ${pct}%\uff08\u2265${threshold}%\uff09\uff0c\u5efa\u8bae\u5c3d\u5feb /compact \u538b\u7f29\uff0c\u907f\u514d\u8d85\u65f6/\u7206\u4e0a\u4e0b\u6587\u3002`;
-                await this.sendMessage(chatId, text).catch(() => { });
-            }
-            else if (pct < threshold - 5) {
-                // Re-arm once usage clearly dropped (hysteresis to avoid flapping).
-                this.contextAlerted.set(chatId, false);
-            }
+            const en = this.isEn(chatId);
+            const text = en
+                ? `\u26a0\ufe0f Context is at ${pct}% (\u2265${threshold}%). Consider /compact soon to avoid timeouts/overflow.`
+                : `\u26a0\ufe0f \u4e0a\u4e0b\u6587\u5df2\u8fbe ${pct}%\uff08\u2265${threshold}%\uff09\uff0c\u5efa\u8bae\u5c3d\u5feb /compact \u538b\u7f29\uff0c\u907f\u514d\u8d85\u65f6/\u7206\u4e0a\u4e0b\u6587\u3002`;
+            // Best-effort: a failed alert must not block delivery, but it is logged so
+            // a persistently undelivered warning stays visible instead of silent.
+            await this.sendMessage(chatId, text).catch((err) => {
+                console.warn(`[${this.config.name}] high-context alert send failed for ${chatId.slice(-8)}: ${this.errorSummary(err)}`);
+            });
         }
         catch {
             // best-effort; never block delivery
@@ -3779,7 +3901,12 @@ export class FeishuBot {
         const previous = this.deliveryTargetsByRun.get(key);
         if (previous?.timer)
             clearTimeout(previous.timer);
-        this.store.bindDeliveryRun(this.config.name, chatId, runId, { ...this.store.getDeliveryRunTarget(this.config.name, chatId, runId), triggerId: target.triggerId, messageId: target.messageId, runId, stopGeneration: this.stopGeneration(chatId), sessionKey: `agent:main:${this.getSessionKey(chatId).replace(/^agent:[^:]+:/, '')}` });
+        const persisted = this.store.getDeliveryRunTarget(this.config.name, chatId, runId);
+        const owner = this.queueOwners.get(chatId);
+        this.store.bindDeliveryRun(this.config.name, chatId, runId, { ...persisted, triggerId: target.triggerId, messageId: target.messageId, runId,
+            sessionId: persisted?.sessionId || (owner?.runId === runId ? owner.sessionId : undefined),
+            botIdentity: persisted?.botIdentity || this.config.appId, stopGeneration: persisted?.stopGeneration ?? this.stopGeneration(chatId),
+            sessionKey: persisted?.sessionKey || canonicalPhysicalSessionKey(this.getSessionKey(chatId), this.profile) });
         this.deliveryTargetsByRun.set(key, {
             triggerId: target.triggerId,
             messageId: target.messageId,
@@ -3847,7 +3974,7 @@ export class FeishuBot {
         this.delayedFailureTimers.set(chatId, timer);
     }
     deliverySessionKey(chatId) {
-        return this.getSessionKey(chatId);
+        return this.physicalSessionKey(chatId);
     }
     stableHash(text) {
         let hash = 2166136261;
@@ -3866,7 +3993,7 @@ export class FeishuBot {
     }
     async enqueueAndDispatchDelivery(chatId, sourceType, sourceId, text, attachments = [], replyToMessageId, deliveryKey, finalReplyModel, provenance, errorNoticeId, completionTriggerIds) {
         if (provenance?.sessionKey && !/^agent:/.test(provenance.sessionKey))
-            provenance = { ...provenance, sessionKey: `agent:main:${provenance.sessionKey}` };
+            provenance = { ...provenance, sessionKey: canonicalPhysicalSessionKey(provenance.sessionKey, this.profile) };
         if (provenance?.sessionKey && provenance.runId && this.store.isStoppedObservation(provenance.sessionKey, provenance.runId))
             return { state: "suppressed", outboxIds: [] };
         if (text.trim().toUpperCase() === 'NO_REPLY')
@@ -3878,9 +4005,9 @@ export class FeishuBot {
         const contentHash = this.stableHash(normalizedPayload);
         const finalDeliveryKey = deliveryKey || sourceId;
         const deliveryMetaJson = JSON.stringify({
-            botIdentity: this.config.appId,
+            botIdentity: provenance?.error?.botIdentity || this.config.appId,
             ...(completionTriggerIds?.length ? { completionTriggerIds } : {}),
-            deliveryStopEpoch: this.stopGeneration(chatId),
+            deliveryStopEpoch: provenance?.error?.stopEpoch ?? this.stopGeneration(chatId),
             ...(finalReplyModel?.trim() ? { model: finalReplyModel.trim() } : {}),
             ...(provenance ? { provenance } : {}), ...(errorNoticeId ? { errorNoticeId } : {}),
         });
@@ -4035,13 +4162,52 @@ export class FeishuBot {
         }
         return this.store.getDeliveryDispatchOutcome(this.config.name, chatId, finalDeliveryKey);
     }
+    scopeRunError(chatId, p) {
+        const key = canonicalPhysicalSessionKey(p.sessionKey, this.profile);
+        const target = this.store.getDeliveryRunTarget(this.config.name, chatId, p.runId);
+        const observation = this.store.getRunObservation(key, p.runId);
+        // Pre-upgrade targets may lack app/physical fields. A known exact legacy
+        // outbox owner is original route evidence, never permission for the current
+        // replacement app to take over its notice.
+        const legacy = !target?.botIdentity ? this.store.findRunErrorOwner(this.config.name, chatId, { ...p, sessionKey: key }) : undefined;
+        let meta;
+        try {
+            meta = JSON.parse(legacy?.deliveryMetaJson || '{}');
+        }
+        catch {
+            meta = {};
+        }
+        return { ...p, sessionKey: key, sessionId: p.sessionId || target?.sessionId || observation?.sessionId || meta.provenance?.sessionId,
+            botIdentity: p.botIdentity || target?.botIdentity || meta.botIdentity || this.config.appId,
+            stopEpoch: p.stopEpoch ?? target?.stopGeneration ?? meta.deliveryStopEpoch ?? this.stopGeneration(chatId) };
+    }
+    /** Shared original-error authorization for journaled terminals AND ordinary
+     * admitted provider errors. Current outbox/config metadata is not authority
+     * to replace the retained admission route or physical target. */
+    errorRouteRevocation(chatId, p) {
+        const original = this.store.getDeliveryRunTarget(this.config.name, chatId, p.runId);
+        if (original?.messageId && this.store.isMessageRecalled(original.messageId) ||
+            original?.sessionId && p.sessionId && original.sessionId !== p.sessionId ||
+            original?.sessionKey && canonicalPhysicalSessionKey(original.sessionKey, this.profile) !== canonicalPhysicalSessionKey(p.sessionKey, this.profile))
+            return 'original_error_target_revoked';
+        const epoch = this.stopGeneration(chatId);
+        if (p.botIdentity && p.botIdentity !== this.config.appId || original?.botIdentity && original.botIdentity !== this.config.appId ||
+            p.stopEpoch !== undefined && p.stopEpoch !== epoch || original?.stopGeneration !== undefined && original.stopGeneration !== epoch)
+            return 'original_error_route_revoked';
+    }
     async inspectErrorNotice(record) {
+        const revoked = this.errorRouteRevocation(record.chatId, record.provenance);
+        if (revoked)
+            return { state: 'stopped', reason: revoked };
         if (this.store.hasRunFinalDelivery(this.config.name, record.chatId, record.provenance, true)) {
             return { state: "suppressed", reason: "exact_run_final_platform_delivery_confirmed" };
         }
         if (this.store.hasRunFinalDelivery(this.config.name, record.chatId, record.provenance, false)) {
             return { state: "pending", reason: "exact_run_final_delivery_pending" };
         }
+        const existing = this.store.findRunErrorOwner(this.config.name, record.chatId, record.provenance);
+        if (!record.provenance.runId.startsWith('announce:') && existing && existing.deliveryKey !== `run-error:${errorNoticeIdentity(record.provenance)}`)
+            return { state: 'suppressed', reason: 'existing_exact_run_error_owner' };
         let verdict;
         try {
             verdict = await this.openclawClient.inspectRunError(record.provenance);
@@ -4051,8 +4217,13 @@ export class FeishuBot {
         }
         // Presentation only: leave exact-run finality, stop suppression and durable
         // outbox keys owned by the existing verdict; no retry/model fallback here.
-        if (verdict.state === "terminal" && verdict.reason === "ordinary_gateway_error") {
-            verdict = { ...verdict, text: this.formatUserVisibleError(record.provenance.detail, record.chatId) };
+        if (verdict.state === "terminal" && ['ordinary_gateway_error', 'closed_gateway_terminal', 'exact_run_terminal_error'].includes(verdict.reason)) {
+            const reason = closedStopReason(record.provenance.stopReason) || verdict.stopReason;
+            const en = this.isEn(record.chatId);
+            verdict = { ...verdict, text: reason === 'timeout' ? this.formatUserVisibleError({ code: 'execution_timeout' }, record.chatId)
+                    : reason === 'superseded' ? (en ? '⚠️ This run ended after being superseded by a newer session writer; no user stop is inferred.' : '⚠️ 本次运行已被新的会话写入者取代而终止；不据此认定用户停止。')
+                        : reason === 'restart' ? (en ? '⚠️ This run ended for a Gateway restart; no user stop is inferred.' : '⚠️ 本次运行因 Gateway 重启而终止；不据此认定用户停止。')
+                            : this.formatUserVisibleError(record.provenance.detail, record.chatId) };
         }
         // A stop or final may have arrived during the read-only lookup.
         const latest = this.store.getErrorNotice(this.config.name, record.chatId, record.noticeId);
@@ -4071,6 +4242,8 @@ export class FeishuBot {
         if (this.store.hasRunFinalDelivery(this.config.name, record.chatId, record.provenance, false)) {
             return { state: "pending", reason: "exact_run_final_delivery_pending" };
         }
+        if (verdict.state === 'terminal' && verdict.stopReason && !record.provenance.stopReason)
+            record.provenance = { ...record.provenance, stopReason: verdict.stopReason };
         return verdict;
     }
     deferErrorNotice(record, verdict) {
@@ -4153,7 +4326,7 @@ export class FeishuBot {
                 this.store.saveErrorNotice(record);
                 if (verdict.state === "terminal" && verdict.terminalKey && verdict.text) {
                     // Independent identity: never take the result's trigger/final key.
-                    await this.enqueueAndDispatchDelivery(chatId, "run_error", verdict.terminalKey, verdict.text, [], undefined, verdict.terminalKey, undefined, { sourceType: "run_error", sessionKey: record.provenance.sessionKey, runId: record.provenance.runId, error: record.provenance, terminalEvidence: verdict }, record.noticeId);
+                    await this.enqueueAndDispatchDelivery(chatId, "run_error", verdict.terminalKey, verdict.text, [], undefined, verdict.terminalKey, undefined, { sourceType: "run_error", sessionKey: record.provenance.sessionKey, sessionId: record.provenance.sessionId, runId: record.provenance.runId, error: record.provenance, terminalEvidence: verdict }, record.noticeId);
                     // The send-time recheck may have parked or suppressed the observation.
                     const refreshed = this.store.getErrorNotice(this.config.name, chatId, record.noticeId);
                     if (refreshed?.verdict && ["pending", "suppressed", "stopped"].includes(refreshed.verdict.state))
@@ -4301,7 +4474,7 @@ export class FeishuBot {
                 }
                 const notice = JSON.parse(item.deliveryMetaJson || '{}').insertionNotice;
                 if (notice) {
-                    const info = await this.openclawClient.getSessionInfo(this.getSessionKey(chatId), 1500).catch(() => null);
+                    const info = await this.openclawClient.getSessionInfo(this.physicalSessionKey(chatId), 1500).catch(() => null);
                     if (!this.insertionNoticeCurrent(chatId, notice) || info?.session?.archived === true ||
                         info?.session?.sessionId && info.session.sessionId !== notice.sessionId) {
                         this.store.markDeliveryFailed(item.id);
@@ -4326,8 +4499,13 @@ export class FeishuBot {
                                 const meta = JSON.parse(item.deliveryMetaJson || '{}'), p = meta.provenance;
                                 if (!this.insertionNoticeCurrent(chatId, meta.insertionNotice))
                                     throw Object.assign(new Error('Insertion notice no longer current'), { deliveryStopped: true });
-                                if ((p?.final || item.sourceType === 'run_error') &&
-                                    (typeof meta.deliveryStopEpoch === 'number' && meta.deliveryStopEpoch !== this.stopGeneration(chatId) ||
+                                if (p?.error) {
+                                    const revoked = this.errorRouteRevocation(chatId, p.error);
+                                    if (revoked)
+                                        throw Object.assign(new Error(`Original error delivery revoked: ${revoked}`), { deliveryStopped: true });
+                                }
+                                if ((p?.final || p?.error || item.sourceType === 'run_error') &&
+                                    (meta.botIdentity && meta.botIdentity !== this.config.appId || typeof meta.deliveryStopEpoch === 'number' && meta.deliveryStopEpoch !== this.stopGeneration(chatId) ||
                                         p?.sessionKey && p.runId && this.store.isStoppedObservation(p.sessionKey, p.runId))) {
                                     throw Object.assign(new Error('Delivery revoked by explicit stop before platform attempt'), { deliveryStopped: true });
                                 }
@@ -4699,7 +4877,7 @@ export class FeishuBot {
             }
             if (pause) {
                 discussionWaitPaused = true;
-                await liveStatus?.pauseForUnconfirmedResult(pause.message, `${this.config.name} 等待暂停 · ${pause.snapshot.status}`).catch(() => { });
+                await liveStatus?.pauseForUnconfirmedResult(pause.message, `${this.config.name} 等待暂停 · ${pause.snapshot.status}`, "paused").catch(() => { });
                 await this.sendWaitPaused(chatId, 0, undefined, pause).catch(() => { });
             }
             else
@@ -4735,7 +4913,7 @@ export class FeishuBot {
                 const outcome = await this.enqueueAndDispatchDelivery(chatId, "discussion", `discussion:${Date.now()}:${Math.random().toString(36).slice(2)}`, isVisible ? displayReply : "", parsedReply.attachments, undefined, undefined, this.config.model);
                 discussionDeliveryConfirmed = outcome.state === 'delivered';
                 if (!discussionDeliveryConfirmed)
-                    await liveStatus?.pauseForUnconfirmedResult("飞书投递回执尚未确认；原投递仍受保管").catch(() => { });
+                    await liveStatus?.pauseForUnconfirmedResult("飞书投递回执尚未确认；原投递仍受保管", undefined, "delivery_pending").catch(() => { });
             }
             catch (err) {
                 await liveStatus?.fail().catch(() => { });
@@ -4755,13 +4933,46 @@ export class FeishuBot {
         }
         return { botName: this.config.name, text: cleanVisibleReply, visible: isVisible && discussionDeliveryConfirmed };
     }
-    buildLiveStatusCard(view, chatId) {
+    liveInputElements(view, chatId, limits) {
+        const context = view.inputStatus;
+        if (!context)
+            return [];
+        const en = this.isEn(chatId);
+        const scoped = !!chatId && context.chatId === chatId && context.botName === this.config.name && context.appId === this.config.appId &&
+            context.stopEpoch === this.stopGeneration(chatId);
+        const preview = (hint) => {
+            const source = scoped && hint.rowId ? this.store.getMessageByRowId(hint.rowId) : undefined;
+            if (!source || source.chatId !== chatId || source.senderType !== 'human' || !hint.messageId || source.messageId !== hint.messageId)
+                return en ? '[Message body unavailable]' : '[消息正文暂不可用]';
+            if (this.store.isMessageRecalled(source.messageId))
+                return en ? '[Message recalled]' : '[消息已撤回]';
+            return hint.previewSource === 'visible' ? visibleInputPreview(hint.preview ?? '', limits.preview, en) : inputPreview(hint.preview ?? source.content, limits.preview, en);
+        };
+        const selected = selectInputHints(context.items, limits.members);
+        const stamp = (at) => { const sec = Number.isFinite(at) ? Math.max(0, Math.floor(at)) : 0; return `${Math.floor(sec / 60)}:${String(sec % 60).padStart(2, '0')}`; };
+        const lines = selected.map(hint => `${stamp(hint.at)} ${hintLabel(hint.kind, en)} ${inertInputText(preview(hint))}${hintDetail(hint.kind, en) ? '\n  ↳ ' + inertInputText(hintDetail(hint.kind, en)) : ''}`);
+        if (context.items.length > selected.length)
+            lines.splice(Math.min(1, lines.length), 0, en ? `… ${context.items.length - selected.length} other inputs omitted; newest inputs retained` : `… 另有 ${context.items.length - selected.length} 条输入未展开，保留最新输入`);
+        if (context.note)
+            lines.push(`${stamp(context.note.at)} ${hintLabel(context.note.kind, en)} ${selected.map(hint => inertInputText(preview(hint))).join(' · ')}\n  ↳ ${inertInputText(hintDetail(context.note.kind, en))}`);
+        return lines.length ? [{ tag: 'markdown', content: lines.join('\n') }] : [];
+    }
+    liveStatusRequest(view, chatId, request) {
+        for (const limits of INPUT_DISPLAY_LIMITS) {
+            const value = request(this.buildLiveStatusCard(view, chatId, limits));
+            if (Buffer.byteLength(JSON.stringify(value), 'utf8') <= LIVE_CARD_BYTES - 512)
+                return value; // reserve SDK envelope overhead
+        }
+        throw new LiveStatusEffectSuppressedError('Live status request exceeds local outer JSON byte budget; no SDK call');
+    }
+    buildLiveStatusCard(view, chatId, limits = INPUT_DISPLAY_LIMITS[0]) {
         const en = this.isEn(chatId);
+        const inputElements = this.liveInputElements(view, chatId, limits);
         if (view.state === "replied") {
             // Neutral UI-only closure, not a green business/input-completion claim.
             const summary = en ? `💬 Linked run replied · ⏱ ${view.elapsed}` : `💬 关联轮次已回复 · ⏱ 耗时${view.elapsed}`;
             return { schema: "2.0", config: { update_multi: true, width_mode: "fill" },
-                body: { elements: [{ tag: "markdown", content: `<font color='grey'>${summary}</font>` }] } };
+                body: { elements: [...inputElements, { tag: "markdown", content: `<font color='grey'>${summary}</font>` }] } };
         }
         // Clean finish (done / NO_REPLY): keep it minimal — no header, no footer, just
         // one compact grey line (status emoji + tool-call count + total elapsed) so
@@ -4770,18 +4981,18 @@ export class FeishuBot {
             const statusEmoji = view.noReply ? "💤" : "✅";
             const summary = this.completionSummary({
                 toolCalls: view.toolCalls,
-                elapsed: view.elapsed,
-                model: view.model,
-                thinkingLevel: view.thinkingLevel,
+                elapsed: displayClip(view.elapsed, 32),
+                model: view.model ? displayClip(view.model, 160) : undefined,
+                thinkingLevel: view.thinkingLevel ? displayClip(view.thinkingLevel, 80) : undefined,
                 locale: en ? "en" : "zh",
             }, statusEmoji);
             return {
                 schema: "2.0",
                 config: { update_multi: true, width_mode: "fill" },
-                body: { elements: [{ tag: "markdown", content: `<font color='grey'>${summary}</font>` }] },
+                body: { elements: [...inputElements, { tag: "markdown", content: `<font color='grey'>${summary}</font>` }] },
             };
         }
-        const elements = [];
+        const elements = [...inputElements];
         // Running OR failed: show the recent activity window (each line prefixed with
         // the relative time mm:ss). On failure we deliberately KEEP the last lines so
         // the steps leading up to the error/kill/timeout are visible for debugging.
@@ -4794,24 +5005,26 @@ export class FeishuBot {
                                 : "•";
             const fmtAt = (sec) => `${Math.floor(sec / 60)}:${String(sec % 60).padStart(2, "0")}`;
             const content = view.lines
+                .filter(l => !l.inputHint && !(view.inputStatus?.botName && l.kind === 'lifecycle'))
                 .map((l) => {
                 const stamp = l.kind === "summary" ? "" : `\`${fmtAt(l.at)}\` `;
-                return `${stamp}${iconFor(l.kind)} ${this.escapeCardText(l.text)}`;
+                return `${stamp}${iconFor(l.kind)} ${this.escapeCardText(displayClip(l.text, limits.activity))}`;
             })
                 .join("\n");
-            elements.push({ tag: "markdown", content });
+            if (content)
+                elements.push({ tag: "markdown", content });
         }
-        else {
+        else if (!inputElements.length) {
             elements.push({ tag: "markdown", content: view.state === "queued" ? (en ? "_Received locally; waiting for admission_" : "_本地已收件，等待提交确认_") : view.state === "admitted" ? (en ? "_Accepted; waiting for activity_" : "_已接收，等待活动_") : (en ? "_working…_" : "_正在启动…_") });
         }
         elements.push({ tag: "hr" });
         // Keep the active model visible while the run is in progress or failed.
         // The final reply also keeps model attribution so it remains self-contained.
-        const footerBits = [en ? `⏱ ${view.elapsed}` : `⏱ 已用 ${view.elapsed}`];
+        const footerBits = [en ? `⏱ ${displayClip(view.elapsed, 32)}` : `⏱ 已用 ${displayClip(view.elapsed, 32)}`];
         if (view.model?.trim()) {
             const modelBit = view.thinkingLevel?.trim()
-                ? `🧠 ${this.escapeCardText(view.model.trim())} · ${this.escapeCardText(view.thinkingLevel.trim())}`
-                : `🧠 ${this.escapeCardText(view.model.trim())}`;
+                ? `🧠 ${this.escapeCardText(displayClip(view.model.trim(), 160))} · ${this.escapeCardText(displayClip(view.thinkingLevel.trim(), 80))}`
+                : `🧠 ${this.escapeCardText(displayClip(view.model.trim(), 160))}`;
             footerBits.push(modelBit);
         }
         elements.push({ tag: "markdown", content: `<font color='grey'>${footerBits.join("  ·  ")}</font>` });
@@ -4822,7 +5035,7 @@ export class FeishuBot {
             // rejects patches on cards that did not declare it before and after.
             config: { update_multi: true, width_mode: "fill" },
             header: {
-                title: { tag: "plain_text", content: view.title },
+                title: { tag: "plain_text", content: displayClip(view.title, 160) },
                 template,
             },
             body: { elements },
@@ -4859,14 +5072,8 @@ export class FeishuBot {
     }
     async sendLiveStatusCard(chatId, view) {
         try {
-            const res = await this.client.im.message.create({
-                params: { receive_id_type: "chat_id" },
-                data: {
-                    receive_id: chatId,
-                    content: JSON.stringify(this.buildLiveStatusCard(view, chatId)),
-                    msg_type: "interactive",
-                },
-            });
+            const request = this.liveStatusRequest(view, chatId, card => ({ params: { receive_id_type: "chat_id" }, data: { receive_id: chatId, content: JSON.stringify(card), msg_type: "interactive" } }));
+            const res = await this.client.im.message.create(request);
             if (typeof res.code === "number" && res.code !== 0)
                 throw new LiveStatusEffectRejectedError(`Feishu rejected card: ${res.code}`);
             if (res.code !== 0)
@@ -4881,13 +5088,8 @@ export class FeishuBot {
         }
     }
     async replyLiveStatusCard(messageId, view, chatId) {
-        const res = await this.client.im.message.reply({
-            path: { message_id: messageId },
-            data: {
-                content: JSON.stringify(this.buildLiveStatusCard(view, chatId)),
-                msg_type: "interactive",
-            },
-        });
+        const request = this.liveStatusRequest(view, chatId, card => ({ path: { message_id: messageId }, data: { content: JSON.stringify(card), msg_type: "interactive" } }));
+        const res = await this.client.im.message.reply(request);
         if (typeof res.code === "number" && res.code !== 0)
             throw new LiveStatusEffectRejectedError(`Feishu rejected card: ${res.code}`);
         if (res.code !== 0)
@@ -4895,10 +5097,8 @@ export class FeishuBot {
         return res?.data?.message_id || res?.message_id;
     }
     async patchLiveStatusCard(messageId, view, chatId) {
-        const res = await this.client.im.message.patch({
-            path: { message_id: messageId },
-            data: { content: JSON.stringify(this.buildLiveStatusCard(view, chatId)) },
-        });
+        const request = this.liveStatusRequest(view, chatId, card => ({ path: { message_id: messageId }, data: { content: JSON.stringify(card) } }));
+        const res = await this.client.im.message.patch(request);
         if (typeof res.code === "number" && res.code !== 0)
             throw new LiveStatusEffectRejectedError(`Feishu rejected card: ${res.code}`);
         if (res.code !== 0)
@@ -5798,7 +5998,7 @@ export class FeishuBot {
             return;
         }
         if (nextModel === this.config.model) {
-            await this.replyMessage(messageId, `🤖 ${this.config.name} 已经在使用：${this.config.model}`);
+            await this.replyMessage(messageId, `🤖 ${this.config.name} 已经在使用：${this.config.model || `profile ${this.profile}`}`);
             return;
         }
         if (!this.configPath) {
@@ -5829,7 +6029,7 @@ export class FeishuBot {
      * Handle /status command: show current session info.
      */
     async handleStatusCommand(chatId, chatType, messageId) {
-        const sessionKey = this.getSessionKey(chatId);
+        const sessionKey = this.physicalSessionKey(chatId);
         const chatInfo = this.store.getChatInfo(chatId);
         const msgCount = this.store.getMessageCount(chatId);
         let session = null;
@@ -5976,7 +6176,7 @@ export class FeishuBot {
         }
     }
     async handleCompactCommand(chatId, messageId, args = "") {
-        const sessionKey = this.getSessionKey(chatId);
+        const sessionKey = this.physicalSessionKey(chatId);
         const en = this.isEn(chatId);
         // Argument parsing — modes are strictly separated:
         //   /compact                 → transcript tail trim (default, model-free)
@@ -6077,7 +6277,7 @@ export class FeishuBot {
      * then verify via describe.
      */
     async handleResetCommand(chatId, messageId) {
-        const sessionKey = this.getSessionKey(chatId);
+        const sessionKey = this.physicalSessionKey(chatId);
         try {
             await this.assertIdentityEffect();
             // Go supervision: a reset replaces the executor session generation; pause
@@ -6100,7 +6300,7 @@ export class FeishuBot {
             await new Promise((r) => setTimeout(r, 2000));
             this.assertIdentityCurrent();
             // A held reset must not initialize an unobserved successor generation.
-            this.initializedSessions.delete(sessionKey);
+            this.initializedSessions.delete(this.getSessionKey(chatId));
             if (!held)
                 await this.ensureSession(chatId);
             await this.replyMessage(messageId, `✅ Session 已重置\n模型: ${this.config.model}`);
@@ -6114,8 +6314,42 @@ export class FeishuBot {
      * runs for the session, clears the busy lock and every pending trigger, and
      * resets stuck reactions so new messages are processed normally again.
      */
+    /** Release every peer bot's in-memory scheduling state for one chat.
+     * Each bot instance keeps its own queueRuns / queueOwners / busyChats /
+     * pendingAckMessages maps; a durable row cleanup cannot reach those. A
+     * group-scoped /stop must retire them too, otherwise the peer's queue owner
+     * survives and its next message is treated as "busy" forever. */
+    releasePeerBotsForChat(chatId) {
+        let released = 0;
+        for (const peer of Array.from(FeishuBot.allBots.values())) {
+            if (peer === this || peer.store !== this.store)
+                continue;
+            // Durable stop epoch was already bumped for this peer by the store-level
+            // group cleanup; mirror it into the peer's in-memory cache.
+            peer.stopEpoch.set(chatId, peer.store.getStopGeneration(peer.config.name, chatId));
+            peer.forceExpireQueueOwner(chatId, 'group-scoped stop by peer bot');
+            peer.busyChats.set(chatId, 0);
+            peer.admittedSteerAcks.delete(chatId);
+            peer.runFailureObservers.delete(chatId);
+            peer.queueRunTokens.delete(chatId);
+            const acks = peer.pendingAckMessages.get(chatId) || [];
+            peer.pendingAckMessages.set(chatId, []);
+            for (const ack of acks)
+                void peer.receiptReaction(chatId, ack.rowId, ack.messageId, '').catch(() => { });
+            // Fence the peer's stale collector so it cannot keep destructively
+            // consuming the replacement batch's frames from the shared session bucket.
+            try {
+                this.openclawClient.revokeSessionCollectors(peer.getSessionKey(chatId), 'group-scoped stop');
+            }
+            catch { /* isolated */ }
+            void peer.openclawClient.cancelSteerSession?.(peer.getSessionKey(chatId), peer.stopGeneration(chatId)).catch(() => { });
+            void peer.openclawClient.abortChat(peer.getSessionKey(chatId)).catch(() => { });
+            released++;
+        }
+        return released;
+    }
     async handleStopCommand(chatId, messageId) {
-        const sessionKey = this.getSessionKey(chatId);
+        const sessionKey = this.physicalSessionKey(chatId);
         // Go supervision: a user stop must also pause related Go, so the checker
         // cannot wake the just-stopped task back up with a follow-up.
         void this.goController?.pauseSilently(chatId, "用户执行了 /stop");
@@ -6140,14 +6374,29 @@ export class FeishuBot {
             this.pendingAckMessages.set(chatId, []);
             for (const ack of acks)
                 void this.receiptReaction(chatId, ack.rowId, ack.messageId, '').catch(() => { });
+            // Group scope: a bare /stop in a multi-bot group is executed by ONE bot,
+            // but every bot keeps its own pending_triggers / insertion_custody /
+            // dispatch_custody / reaction rows AND its own in-memory queue owner for
+            // this same chat. Stopping only the executing bot left the others
+            // believing the chat was busy, so their next message was queued and
+            // never dispatched. Release the whole chat for every peer bot.
+            //
+            // This MUST run BEFORE the abort RPC await: a user message that arrives
+            // while the abort is in flight has to survive the stop cutoff, exactly
+            // like the executing bot's own late input above.
+            const group = this.store.stopChatForAllBots(chatId, this.config.name);
+            const peers = this.releasePeerBotsForChat(chatId);
             await this.openclawClient.abortChat(sessionKey).catch(() => { });
             if (!this.queueRuns.has(chatId))
                 this.busyChats.set(chatId, 0);
             const locale = this.chatLocale(chatId);
+            const scopeNote = peers > 0
+                ? (locale === "en" ? ` Also released ${peers} peer bot(s) in this chat.` : ` 同时释放了本群其余 ${peers} 个 bot 的队列。`)
+                : "";
             await this.replyMessage(messageId, locale === "en"
-                ? `⏹️ Stopped. Aborted the active run, unlocked the queue, and cleared ${cleared} pending message(s). You can send a new message now.`
-                : `⏹️ 已停止。已中止当前 run、解锁队列，并清掉 ${cleared} 条待处理消息。现在可以重新发消息了。`);
-            console.log(`[${this.config.name}] /stop force-cleared ${chatId.slice(-8)}: aborted run, cleared ${cleared} pending`);
+                ? `⏹️ Stopped. Aborted the active run, unlocked the queue, and cleared ${cleared} pending message(s). You can send a new message now.${scopeNote}`
+                : `⏹️ 已停止。已中止当前 run、解锁队列，并清掉 ${cleared} 条待处理消息。现在可以重新发消息了。${scopeNote}`);
+            console.log(`[${this.config.name}] /stop force-cleared ${chatId.slice(-8)}: aborted run, cleared ${cleared} pending, group: insertions=${group.stoppedInsertions} triggers=${group.clearedTriggers} custody=${group.clearedCustody} peers=${peers}`);
         }
         catch (err) {
             await this.replyMessage(messageId, `❌ stop 失败: ${err.message}`);
@@ -6158,28 +6407,17 @@ export class FeishuBot {
      * Called once per chat on first message.
      */
     async fetchAndCacheChatInfo(chatId, chatType) {
+        if (chatType === "p2p") {
+            // Private ownership is not hourly metadata. Check/pin the stable SDK app
+            // identity even on a fresh cache; never replace an unknown legacy owner.
+            this.store.claimP2pOwner(chatId, this.config.name, this.config.appId);
+            return;
+        }
         const existing = this.store.getChatInfo(chatId);
         // Refresh at most once per hour
         if (existing && Date.now() - existing.updatedAt < 3600_000)
             return;
         try {
-            if (chatType === "p2p") {
-                // For p2p, we don't have a group name or member list from chat API
-                this.store.upsertChatInfo({
-                    chatId,
-                    chatType: "p2p",
-                    chatName: "私聊",
-                    members: "",
-                    memberNames: "",
-                    ownerBot: existing?.ownerBot || this.config.name,
-                    freeDiscussion: this.store.getChatInfo(chatId)?.freeDiscussion || false,
-                    verbose: this.store.getChatInfo(chatId)?.verbose || false,
-                    discuss: this.store.getChatInfo(chatId)?.discuss || false,
-                    discussMaxRounds: this.store.getChatInfo(chatId)?.discussMaxRounds || 10,
-                    updatedAt: Date.now(),
-                });
-                return;
-            }
             // Fetch group info
             const chatResp = await this.client.im.chat.get({
                 path: { chat_id: chatId },
@@ -6428,6 +6666,28 @@ export class FeishuBot {
     /**
      * Extract text content from a rich text (post) message.
      */
+    /** Visible rich-post fragments only. Text nodes remain literal; only actual
+     * media nodes become type markers, never a regex over the user's prose. */
+    visiblePostInput(content, chatId) {
+        const parts = [];
+        if (typeof content.title === 'string')
+            parts.push(content.title);
+        for (const paragraph of Array.isArray(content.content) ? content.content : []) {
+            if (!Array.isArray(paragraph))
+                continue;
+            for (const node of paragraph) {
+                if (node?.tag === 'text' && typeof node.text === 'string')
+                    parts.push(node.text);
+                else if (node?.tag === 'a' && typeof node.text === 'string')
+                    parts.push(`${node.text}${typeof node.href === 'string' ? `(${node.href})` : ''}`);
+                else if (node?.tag === 'at' && typeof node.user_name === 'string')
+                    parts.push(`@${node.user_name}`);
+                else if (node?.tag === 'img')
+                    parts.push(this.isEn(chatId) ? '[Image]' : '[图片]');
+            }
+        }
+        return parts.join(' ');
+    }
     extractPostText(content) {
         const parts = [];
         const title = content.title;