openclaw-lark-multi-agent 1.8.4 → 1.8.6

package/dist/feishu-bot.js

@@ -1,9 +1,10 @@
+import { createHash, randomUUID } from 'node:crypto';
 import { AsyncLocalStorage } from "node:async_hooks";
 import * as lark from "@larksuiteoapi/node-sdk";
 import { createRequire } from "module";
 import { persistBotModel } from "./config.js";
 import { getI18n, normalizeLocale } from "./i18n.js";
-import { InactiveRunObservation } from "./openclaw-client.js";
+import { InactiveRunObservation, AdmissionUnconfirmed } from "./openclaw-client.js";
 import { SessionWaitPaused, isWaitTimeout, normalizeSessionRuntimeStatus, formatSessionFooter, FOREGROUND_WAIT_MS } from "./session-status.js";
 import { SupersededObservation } from "./openclaw-client.js";
 import { LiveStatusController } from "./live-status.js";
@@ -16,6 +17,7 @@ import { basename, extname, join, resolve } from "path";
 import { getBridgeAttachmentsDir, getDataDir } from "./paths.js";
 import { buildFeishuCardElements } from "./markdown.js";
 import { discussionManager } from "./discussion-manager.js";
+const nonemptyReceipt = (value) => typeof value === 'string' && !!value.trim();
 const require = createRequire(import.meta.url);
 const LMA_VERSION = require("../package.json").version;
 const MAX_BOT_STREAK = 10;
@@ -130,6 +132,7 @@ export class FeishuBot {
     recentVerboseToolMessages = new Map();
     /** Per-chat processQueue lock to avoid duplicate concurrent chat.send runs */
     queueRuns = new Map();
+    queueOwners = new Map();
     /** Per-chat serial send queue to guarantee message order */
     sendQueue = new Map();
     /** Per-chat delayed runtime failure notifications, canceled if a real reply arrives. */
@@ -167,77 +170,116 @@ export class FeishuBot {
             { api: docx?.documentBlockDescendant, operations: ["create"], visible: false },
         ];
         for (const { api, operations, visible } of candidates) {
-            if (!api || this.goReceiptApis.has(api))
+            if (!api)
                 continue;
-            this.goReceiptApis.add(api);
             for (const operation of operations) {
-                const original = api[operation]?.bind(api);
-                if (!original)
+                const method = api[operation];
+                if (typeof method !== 'function' || this.goReceiptApis.has(method))
                     continue;
-                api[operation] = async (params) => {
-                    const context = this.goDeliveryReceipts.getStore();
-                    const ordinal = context?.ordinals.get(context.stage) ?? 0;
-                    context?.ordinals.set(context.stage, ordinal + 1);
-                    const key = `outbox:${context?.outboxId}:${context?.stage}:${ordinal}`;
-                    const previous = context?.goId ? this.store.getGoDeliveryOperation(context.goId, key) : null;
-                    if (previous?.state === "rejected") {
-                        const failure = JSON.parse(previous.response_json);
-                        throw Object.assign(new Error(failure.message), { code: failure.code, response: { data: { code: failure.code, msg: failure.message } } });
-                    }
-                    if (context?.blocked || (previous && previous.state !== "accepted")) {
-                        // Carry a durable unknown fence across *all* fallback operations after
-                        // restart too, not merely the original failed card/attachment ordinal.
-                        if (context)
-                            context.blocked = true;
-                        throw new Error("Go delivery outcome unknown; original operation cannot be replayed");
-                    }
-                    let result;
-                    if (previous?.state === "accepted")
-                        result = JSON.parse(previous.response_json).result;
-                    else {
-                        if (context?.goId)
-                            this.store.recordGoDeliveryOperation(context.goId, key, "attempted");
-                        try {
-                            result = await original(params);
+                const original = method.bind(api);
+                api[operation] = new Proxy(method, { apply: async (_target, _receiver, [params]) => {
+                        const context = this.goDeliveryReceipts.getStore();
+                        const ordinal = context?.ordinals.get(context.stage) ?? 0;
+                        context?.ordinals.set(context.stage, ordinal + 1);
+                        const key = `outbox:${context?.outboxId}:${context?.stage}:${ordinal}`;
+                        const previous = context ? this.store.getDeliveryOperation(context.outboxId, key) : null;
+                        const attemptRecord = { payload: params.data, operation, visible };
+                        const save = (state, record = {}) => {
+                            record = { ...attemptRecord, ...record };
+                            if (context)
+                                this.store.saveDeliveryOperation(context.outboxId, key, state, record);
+                            if (context?.goId)
+                                this.store.recordGoDeliveryOperation(context.goId, key, state, record);
+                        };
+                        if (previous?.state === 'rejected' && !previous.retryable) {
+                            throw Object.assign(new Error(previous.message), { code: previous.code, response: { data: { code: previous.code, msg: previous.message } } });
                         }
-                        catch (err) {
-                            if (context?.goId) {
-                                const error = err;
-                                const code = error?.response?.data?.code ?? error?.data?.code ?? error?.code;
-                                const status = error?.response?.status;
-                                // A documented API rejection is not a lost response. Cache it so
-                                // deterministic card/text fallback can proceed without repeating it.
-                                if (Number.isFinite(Number(code)) && Number(code) > 0 || Number.isInteger(status) && status >= 400 && status < 500) {
-                                    this.store.recordGoDeliveryOperation(context.goId, key, "rejected", { code, message: error?.response?.data?.msg ?? error?.message ?? "platform rejected" });
+                        if (previous?.state !== 'accepted' && (context?.blocked || context && this.store.hasUnknownDeliveryOperation(context.outboxId))) {
+                            if (context?.persistenceError)
+                                throw context.persistenceError;
+                            if (context)
+                                context.blocked = true;
+                            throw new Error('Platform outcome unknown; retained without blind resend or fallback');
+                        }
+                        let result;
+                        if (previous?.state === 'accepted') {
+                            result = previous.result;
+                            if (context) {
+                                try {
+                                    this.store.flushKnownDeliveryReceipts(context.outboxId);
+                                    save('accepted', { ...previous, state: undefined });
                                 }
-                                else {
-                                    this.store.recordGoDeliveryOperation(context.goId, key, "unknown");
+                                catch (error) {
                                     context.blocked = true;
+                                    context.persistenceError = error;
+                                    throw error;
                                 }
                             }
-                            throw err;
                         }
-                    }
-                    const id = result?.data?.message_id ?? result?.message_id;
-                    if (visible && context?.goId && !id) {
-                        this.store.recordGoDeliveryOperation(context.goId, key, "unknown");
-                        context.blocked = true;
-                        throw new Error("Missing actual Go platform message receipt");
-                    }
-                    if (context?.goId)
-                        this.store.recordGoDeliveryOperation(context.goId, key, "accepted", { result, payload: visible ? params.data : undefined, operation });
-                    if (visible && context && typeof id === "string" && id) {
-                        if (!context.receipts.some(r => r.messageId === id))
-                            context.receipts.push({ messageId: id, operation: previous?.state === "accepted" ? JSON.parse(previous.response_json).operation : operation, payload: previous?.state === "accepted" ? JSON.parse(previous.response_json).payload : params.data });
-                        context.onReceipt(); // Persist before the next chunk or attachment operation.
-                    }
-                    return result;
-                };
+                        else {
+                            context?.effectGuard?.();
+                            if (context)
+                                save('attempted');
+                            try {
+                                result = await original(params);
+                                const code = result?.code;
+                                if (code !== undefined && code !== 0)
+                                    throw Object.assign(new Error(result?.msg || 'Platform rejected'), { code, response: { data: result } });
+                                const id = result?.data?.message_id ?? result?.message_id;
+                                const target = result?.data?.chat_id;
+                                const sender = result?.data?.sender;
+                                if (visible && (code !== 0 || !nonemptyReceipt(id) || context?.chatId && target && target !== context.chatId ||
+                                    sender?.app_id && sender.app_id !== this.config.appId || sender?.sender_type === 'app' && sender?.id_type === 'app_id' && sender?.id && sender.id !== this.config.appId || sender?.id_type === 'open_id' && this.botOpenId && sender?.id && sender.id !== this.botOpenId)) {
+                                    if (context) {
+                                        save('unknown', { reason: 'Missing/invalid platform code, message_id or target identity' });
+                                        context.blocked = true;
+                                    }
+                                    throw new Error('Unconfirmed platform receipt; no replay');
+                                }
+                            }
+                            catch (error) {
+                                const err = error;
+                                const code = err?.response?.data?.code ?? err?.data?.code ?? err?.code;
+                                const status = err?.response?.status;
+                                if (context && !context.blocked) {
+                                    if (Number.isFinite(Number(code)) && Number(code) > 0 || Number.isInteger(status) && status >= 400 && status < 500) {
+                                        save('rejected', { code, retryable: Number(code) === 99991400 || status === 429, message: err?.response?.data?.msg ?? err?.message ?? 'Platform rejected' });
+                                    }
+                                    else {
+                                        save('unknown');
+                                        context.blocked = true;
+                                    }
+                                }
+                                throw error;
+                            }
+                            if (context) {
+                                const record = { result, ...attemptRecord };
+                                try {
+                                    this.store.rememberKnownDeliveryReceipt(context.outboxId, key, record);
+                                    save('accepted', record);
+                                }
+                                catch (error) {
+                                    context.blocked = true;
+                                    context.persistenceError = error;
+                                    throw error;
+                                }
+                            }
+                        }
+                        const id = result?.data?.message_id ?? result?.message_id;
+                        if (visible && context && nonemptyReceipt(id)) {
+                            if (!context.receipts.some(r => r.messageId === id))
+                                context.receipts.push({ messageId: id, operation, payload: previous?.state === 'accepted' ? previous.payload : params.data });
+                            context.onReceipt();
+                        }
+                        return result;
+                    } });
+                this.goReceiptApis.add(api[operation]);
             }
         }
     }
     goController = null;
     /** Per-chat durable outbox retry timer. */
+    localDeliveryRetryCustody = new Map();
     deliveryRetryTimers = new Map();
     /** Last time a real assistant-visible reply was successfully handed to the delivery pipeline. */
     lastRealDeliveryAt = new Map();
@@ -264,6 +306,7 @@ export class FeishuBot {
         this.config = config;
         this.openclawClient = openclawClient;
         this.store = store;
+        this.openclawClient.bindRecoveryStore?.(store);
         this.adminOpenId = adminOpenId || null;
         this.locale = normalizeLocale(config.locale);
         this.configPath = configPath;
@@ -457,7 +500,8 @@ export class FeishuBot {
                 const parsed = this.extractBridgeAttachments(text);
                 if (sourceType !== "verbose_transcript" && (parsed.text.trim() || parsed.attachments.length > 0))
                     this.cancelDelayedFailure(chatId);
-                const runTarget = meta?.runId ? this.deliveryTargetsByRun.get(this.deliveryRunTargetKey(chatId, meta.runId)) : undefined;
+                const persistedTarget = meta?.runId ? this.store.getDeliveryRunTarget(this.config.name, chatId, meta.runId) : null;
+                const runTarget = meta?.runId ? this.deliveryTargetsByRun.get(this.deliveryRunTargetKey(chatId, meta.runId)) || (persistedTarget ? { ...persistedTarget, token: Symbol(meta.runId) } : undefined) : undefined;
                 const candidateTarget = this.activeDeliveryTargets.get(chatId);
                 const activeTarget = runTarget || (candidateTarget && (!candidateTarget.runId || !meta?.runId || candidateTarget.runId === meta.runId)
                     ? candidateTarget
@@ -479,6 +523,14 @@ export class FeishuBot {
             catch (err) {
                 console.error(`[${this.config.name}] Failed to deliver proactive msg:`, err.message);
             }
+        }, async (meta) => {
+            if (!meta.runId || this.store.isStoppedObservation(`agent:main:${sessionKey.replace(/^agent:[^:]+:/, '')}`, meta.runId))
+                return;
+            this.store.settleRunReactionIntents(this.config.name, chatId, meta.runId);
+            void this.reconcileReactions(chatId).catch(() => { });
+            const target = this.deliveryTargetsByRun.get(this.deliveryRunTargetKey(chatId, meta.runId));
+            await target?.liveStatus?.complete().catch(() => { });
+            this.releaseRunDeliveryTargetAfter(chatId, meta.runId, 30_000);
         });
         // Subscribe to tool events for verbose mode
         this.openclawClient.onToolEvent(sessionKey, async (toolName, toolInput, toolOutput) => {
@@ -553,6 +605,7 @@ export class FeishuBot {
      */
     async drainOnStartup() {
         try {
+            this.store.recoverUnsentReservations(this.config.name);
             const restoredDeliveries = this.store.resetDeliveringOnStartup(this.config.name);
             if (restoredDeliveries > 0) {
                 console.warn(`[${this.config.name}] Startup delivery recovery: restored=${restoredDeliveries}`);
@@ -567,6 +620,8 @@ export class FeishuBot {
                 // Re-subscribe to existing sessions
                 await this.ensureSession(chat.chatId);
                 drainTasks.push(this.reconcileErrorNotices(chat.chatId));
+                drainTasks.push(this.reconcileInsertions(chat.chatId));
+                this.scheduleInsertionRecovery();
                 // Drain only messages that were explicitly marked as reply triggers.
                 // Context-only messages should not start an OpenClaw run after restart.
                 const pendingTriggerIds = this.store.getPendingTriggerIds(this.config.name, chat.chatId);
@@ -1163,206 +1218,271 @@ export class FeishuBot {
             // --- Should this bot respond? ---
             if (!this.shouldRespond(chatType, message, isBot, chatId, routing))
                 return;
+            let reservedAtIngress = false;
             if (!isBot && insertedId > 0) {
                 this.goController?.onHumanInput(chatId);
                 this.store.markPendingTrigger(this.config.name, chatId, insertedId);
+                // Reserve BEFORE the first health/reaction await. Otherwise an ending
+                // owner can ordinary-drain this row while its handler is still waiting,
+                // and the later steer would submit the same message a second time.
+                const ingressOwner = this.queueOwners.get(chatId);
+                if (this.queueRuns.has(chatId) && !ingressOwner?.triggerIds?.has(insertedId)) {
+                    this.store.saveInsertion(this.config.name, chatId, insertedId, JSON.stringify([this.config.appId, chatId, messageId]), 'pending', {
+                        messageId, text: cleanText, stopEpoch: this.stopGeneration(chatId), expectedRunId: ingressOwner?.runId || '',
+                        ownerId: ingressOwner?.id, batchId: ingressOwner?.batchId, sessionKey: this.getSessionKey(chatId)
+                    });
+                    reservedAtIngress = true;
+                }
+                // Received/queued is not accepted by Gateway. Keep Typing until an
+                // exact admission receipt, independently of reaction API availability.
+                const acks = this.pendingAckMessages.get(chatId) || [];
+                acks.push({ messageId, emoji: 'Typing', rowId: insertedId });
+                this.pendingAckMessages.set(chatId, acks);
+                void this.receiptReaction(chatId, insertedId, messageId, 'Typing').catch(() => { });
             }
             // Track this message for reaction status updates
             const pending = this.pendingAckMessages.get(chatId) || [];
+            const inputStopEpoch = this.stopGeneration(chatId);
             const unhealthy = await this.getUnhealthySessionStatus(chatId);
+            if (this.stopGeneration(chatId) !== inputStopEpoch)
+                return;
             if (unhealthy) {
                 await this.warnUnhealthySessionAndContinue(chatId, messageId, unhealthy);
             }
+            // Another ingress handler may already have selected/admitted this row
+            // as an ordinary batch while this handler awaited health. Do not re-steer
+            // a message that already belongs to that batch.
+            if (!isBot && insertedId > 0 && !reservedAtIngress &&
+                (this.queueOwners.get(chatId)?.triggerIds?.has(insertedId) ||
+                    !this.store.getPendingTriggerIds(this.config.name, chatId).has(insertedId)))
+                return;
             // Anti-loop
             const streak = this.store.getBotStreak(chatId, this.config.name);
-            if (streak >= MAX_BOT_STREAK) {
+            if (isBot && streak >= MAX_BOT_STREAK) {
                 console.log(`[${this.config.name}] Anti-loop: ${streak} consecutive bot msgs`);
                 return;
             }
             // --- Queue-based sending: if agent is busy, just accumulate ---
             // The actual queue owner, not elapsed wall time, decides whether input
             // should steer/queue. Long healthy runs must not lose their busy ownership.
-            const isBusy = this.queueRuns.has(chatId);
+            const isBusy = reservedAtIngress || this.queueRuns.has(chatId);
             if (isBusy) {
-                // The agent is mid-run. Instead of only queuing to wait for the current
-                // run to finish, try to STEER this message into the active run so it is
-                // seen at the next tool-call boundary (lets the user nudge/correct a long
-                // run in real time). The lma-steer plugin reports whether it landed.
-                const sessionKeyForSteer = this.getSessionKey(chatId);
-                // Wrap the message so the agent knows it is a NEW user message inserted
-                // mid-task. The live-status line and reactions still key off the original.
-                const steerWrapped = `${steerInjectionPrefix(this.isEn(chatId))}\n${cleanText}`;
-                // Register the consumption observer before submitting so a fast
-                // session.message cannot race past the Feishu reaction transition.
-                await this.addReaction(messageId, "Typing").catch(() => { });
-                pending.push({ messageId, emoji: "Typing", rowId: insertedId });
-                this.pendingAckMessages.set(chatId, pending);
-                const norm = cleanText.replace(/\s+/g, " ").trim();
-                let consumedBeforeAck = false;
-                const stopWatchingConsumption = this.openclawClient.onSteerConsumed(sessionKeyForSteer, steerWrapped, (consumedText) => {
-                    const cn = (consumedText || "").replace(/\s+/g, " ").trim();
-                    if (cn !== norm && !cn.includes(norm))
-                        return false;
-                    consumedBeforeAck = true;
-                    // Only transcript commitment/consumption transfers durable custody.
-                    // Until this point the local pending trigger remains the fallback for
-                    // detached dispatch rejection or an admission that never consumed.
-                    if (insertedId > 0) {
-                        this.store.clearPendingTrigger(this.config.name, chatId, insertedId);
-                        this.pendingSteerCleanups.delete(insertedId);
+                const owner = this.queueOwners.get(chatId);
+                const record = { messageId, text: cleanText, stopEpoch: this.stopGeneration(chatId),
+                    expectedRunId: owner?.runId || '', ownerId: owner?.id, batchId: owner?.batchId, sessionKey: this.getSessionKey(chatId) };
+                if (insertedId > 0 && !this.store.getInsertion(this.config.name, chatId, insertedId))
+                    this.store.saveInsertion(this.config.name, chatId, insertedId, JSON.stringify([this.config.appId, chatId, messageId]), 'pending', record);
+                // Reservation is durable BEFORE any RPC. Ordinary drain cannot race a
+                // late ACK and execute this same input a second time.
+                void this.reconcileInsertions(chatId).catch(err => console.warn('Insertion retained:', this.errorSummary(err)));
+                this.scheduleInsertionRecovery();
+                return;
+            }
+            // Not busy: admission callback, not local queueing, flips Typing -> Get.
+            await this.processQueue(chatId);
+        }
+        catch (err) {
+            console.error(`[${this.config.name}] Error:`, safeErrorSummary(err));
+        }
+    }
+    stopGeneration(chatId) {
+        return this.stopEpoch.get(chatId) ?? this.store.getStopGeneration(this.config.name, chatId);
+    }
+    reactionChecks = new Set();
+    async receiptReaction(chatId, rowId, messageId, desired, runId = '') {
+        const previous = this.store.getReactionIntent(this.config.name, chatId, rowId);
+        const record = { ...previous, messageId, desired, shown: previous?.shown || '', runId: runId || previous?.runId || '', stopEpoch: this.stopGeneration(chatId) };
+        this.store.setReactionIntent(this.config.name, chatId, rowId, record);
+        void this.reconcileReactions(chatId).catch(() => { }).finally(() => this.scheduleInsertionRecovery());
+        this.scheduleInsertionRecovery();
+    }
+    async reconcileReactions(chatId) {
+        if (this.reactionChecks.has(chatId))
+            return;
+        this.reactionChecks.add(chatId);
+        try {
+            for (const item of this.store.listReactionIntents(this.config.name, chatId)) {
+                if (item.stopEpoch !== this.stopGeneration(chatId))
+                    continue;
+                try {
+                    // Orphaned late successes retain their exact own receipt until deletion.
+                    for (const receipt of item.cleanupReceipts || []) {
+                        await this.removeReaction(item.messageId, receipt.emoji, receipt.id);
+                        const current = this.store.getReactionIntent(this.config.name, chatId, item.rowId);
+                        if (current)
+                            this.store.setReactionIntent(this.config.name, chatId, item.rowId, { ...current, cleanupReceipts: (current.cleanupReceipts || []).filter((r) => r.id !== receipt.id) });
                     }
-                    void this.removeReaction(messageId, "Typing").catch(() => { });
-                    void this.addReaction(messageId, "Get").catch(() => { });
-                    const acks = this.pendingAckMessages.get(chatId) || [];
-                    for (const a of acks)
-                        if (a.messageId === messageId)
-                            a.emoji = "Get";
-                    this.pendingAckMessages.set(chatId, acks);
-                    return true;
-                });
-                const steer = await this.openclawClient.steer(sessionKeyForSteer, steerWrapped, cleanText).catch(() => ({ status: "unavailable" }));
-                if (steer.status === "steered") {
-                    // OpenClaw 2026.9.9 no longer mirrors plugin-injected user messages as
-                    // session.message events, so the transcript-consumption observer may
-                    // never fire. Custody transfers to the active run at admission: clear
-                    // the durable trigger now (prevents the duplicate re-send after this
-                    // run ends) and arm an abnormal-end fallback that restores it.
-                    if (insertedId > 0) {
-                        // Consumption can land before admission returns (fast mirror) or
-                        // never (2026.9.9 removed mirrors); either way the message belongs
-                        // to this batch for the Get -> DONE flip.
-                        const steerAckList = this.admittedSteerAcks.get(chatId) || [];
-                        steerAckList.push({ messageId, insertedId, batch: this.queueRunTokens.get(chatId) });
-                        this.admittedSteerAcks.set(chatId, steerAckList);
+                    if (item.shown) {
+                        await this.removeReaction(item.messageId, item.shown, item.reactionId);
+                        const latest = this.store.getReactionIntent(this.config.name, chatId, item.rowId);
+                        if (latest && latest.shown === item.shown && latest.reactionId === item.reactionId)
+                            this.store.setReactionIntent(this.config.name, chatId, item.rowId, { ...latest, shown: '', reactionId: undefined });
                     }
-                    if (insertedId > 0 && !consumedBeforeAck) {
-                        const steerStopEpoch = this.stopEpoch.get(chatId) || 0;
-                        this.store.clearPendingTrigger(this.config.name, chatId, insertedId);
-                        this.pendingSteerCleanups.set(insertedId, () => {
-                            stopWatchingConsumption();
-                            if ("cancelPending" in steer)
-                                steer.cancelPending?.();
-                        });
-                        // The owning batch's failure restores the durable fallback. The
-                        // queue promise itself never rejects (processQueueInner isolates
-                        // errors), so failures are observed via runFailureObservers.
-                        const observers = this.runFailureObservers.get(chatId) || [];
-                        observers.push(() => {
-                            if (consumedBeforeAck)
-                                return;
-                            // A /stop during the run must not resurrect stopped input.
-                            if ((this.stopEpoch.get(chatId) || 0) !== steerStopEpoch)
-                                return;
-                            this.store.markPendingTrigger(this.config.name, chatId, insertedId);
-                            // The restored input takes the ordinary queue path: drop its
-                            // admitted-steer ack so only the new batch's DONE applies.
-                            this.admittedSteerAcks.set(chatId, (this.admittedSteerAcks.get(chatId) || []).filter((a) => a.insertedId !== insertedId));
-                            console.log(`[${this.config.name}] steer fallback restored after failed run for ${chatId.slice(-8)}: "${cleanText.substring(0, 40)}..."`);
-                            // Deferred: the current queue run is still active here; a fresh
-                            // drain must start after its finally releases the chat. A 0ms
-                            // timer is NOT enough — the owner's catch block still has
-                            // in-flight awaits (error delivery), so processQueue would join
-                            // the dying owner and return, stranding the restored trigger
-                            // until the next user message (2026-10-16 audit finding).
-                            const ownerNow = this.queueRuns.get(chatId);
-                            const drainRestored = () => { void this.processQueue(chatId).catch(() => { }); };
-                            if (ownerNow)
-                                void ownerNow.then(drainRestored, drainRestored).catch(() => { });
-                            else
-                                setTimeout(drainRestored, 0).unref?.();
-                        });
-                        this.runFailureObservers.set(chatId, observers);
-                        const owner = this.queueRuns.get(chatId);
-                        if (owner) {
-                            void owner.then(() => {
-                                // Queue ended without a batch failure: the steered input was
-                                // admitted into its batch; release the provisional correlation.
-                                stopWatchingConsumption();
-                                this.pendingSteerCleanups.delete(insertedId);
-                            }).catch(() => { });
-                        }
+                    const latest = this.store.getReactionIntent(this.config.name, chatId, item.rowId);
+                    if (!latest || latest.stopEpoch !== this.stopGeneration(chatId) || latest.desired !== item.desired)
+                        continue;
+                    const reactionId = item.desired ? await this.addReaction(item.messageId, item.desired) : undefined;
+                    const after = this.store.getReactionIntent(this.config.name, chatId, item.rowId);
+                    if (after && after.stopEpoch === item.stopEpoch && after.stopEpoch === this.stopGeneration(chatId) && after.desired === item.desired) {
+                        this.store.setReactionIntent(this.config.name, chatId, item.rowId, { ...after, shown: item.desired, reactionId });
+                    }
+                    else if (after && reactionId) {
+                        this.store.setReactionIntent(this.config.name, chatId, item.rowId, { ...after, cleanupReceipts: [...(after.cleanupReceipts || []), { id: reactionId, emoji: item.desired }] });
+                        await this.removeReaction(item.messageId, item.desired, reactionId);
+                        const current = this.store.getReactionIntent(this.config.name, chatId, item.rowId);
+                        if (current)
+                            this.store.setReactionIntent(this.config.name, chatId, item.rowId, { ...current, cleanupReceipts: (current.cleanupReceipts || []).filter((r) => r.id !== reactionId) });
                     }
-                    // Custody transferred: acknowledge on Feishu immediately.
-                    void this.removeReaction(messageId, "Typing").catch(() => { });
-                    void this.addReaction(messageId, "Get").catch(() => { });
-                    const acks = this.pendingAckMessages.get(chatId) || [];
-                    for (const a of acks)
-                        if (a.messageId === messageId)
-                            a.emoji = "Get";
-                    this.pendingAckMessages.set(chatId, acks);
-                    // The plugin confirmed queueing into the existing embedded run. Keep
-                    // that run's original delivery target.
-                    console.log(`[${this.config.name}] Agent busy for ${chatId.slice(-8)}, plugin steer accepted (custody transferred to active run): "${cleanText.substring(0, 50)}..."`);
-                    return;
                 }
-                // Plugin missing/no active run/rejected: keep the durable trigger for
-                // normal queue drain. Never claim that ambiguous native admission was an
-                // in-run insertion.
-                stopWatchingConsumption();
-                if ("cancelPending" in steer)
-                    steer.cancelPending?.();
-                // Zombie-owner detection (2026-10-15 guangzi incident): steer found no
-                // active run while our in-memory owner still holds the chat. Ask the
-                // gateway for the authoritative session status: if it is idle, the owner
-                // is a zombie (its completion event was routed through the proactive
-                // path and it will never settle). Force-expire it and process this input
-                // NOW instead of queueing behind a dead promise forever.
-                if (steer.status === "no_active_run" && this.queueRuns.has(chatId)) {
-                    const ownerAtCheck = this.queueRuns.get(chatId);
-                    const live = await this.openclawClient.getSessionRuntimeStatus(sessionKeyForSteer).catch(() => null);
-                    // B1 (2026-10-16 audit): require POSITIVE idle evidence. An RPC
-                    // failure normalizes to {status:"unknown", running:false} and must
-                    // never authorize expiring a legitimately running owner. The owner
-                    // identity is also CAS-checked across the status RPC: a newer batch
-                    // that took over meanwhile must not be expired by stale evidence.
-                    if (live && !live.running && live.status !== "unknown" && this.queueRuns.get(chatId) === ownerAtCheck) {
-                        console.warn(`[${this.config.name}] gateway reports session idle while queue owner exists for ${chatId.slice(-8)} — expiring zombie owner (status=${live.status})`);
-                        this.forceExpireQueueOwner(chatId, `gateway idle (steer=${steer.status}, session=${live.status})`);
-                        // Fall through to the normal send path below; the durable trigger
-                        // for this input is still set, so the fresh processQueue drains it.
+                catch { /* UI-only retry; never roll back business acceptance. */ }
+            }
+        }
+        finally {
+            this.reactionChecks.delete(chatId);
+            this.scheduleInsertionRecovery();
+        }
+    }
+    insertionTimer;
+    insertionChecks = new Set();
+    scheduleInsertionRecovery() {
+        if (this.insertionTimer || (!this.store.listInsertions(this.config.name).length && !this.store.listReactionIntents(this.config.name).length))
+            return;
+        this.insertionTimer = setTimeout(() => {
+            this.insertionTimer = undefined;
+            const chats = [...new Set([...this.store.listInsertions(this.config.name), ...this.store.listReactionIntents(this.config.name)].map(x => x.chatId))];
+            void Promise.allSettled(chats.map(async (chat) => { await this.reconcileReactions(chat); await this.reconcileInsertions(chat); })).finally(() => this.scheduleInsertionRecovery());
+        }, 5000);
+        this.insertionTimer.unref?.();
+    }
+    async reconcileInsertions(chatId) {
+        if (this.insertionChecks.has(chatId))
+            return;
+        this.insertionChecks.add(chatId);
+        try {
+            for (const item of this.store.listInsertions(this.config.name, chatId)) {
+                if (item.nextCheckAt > Date.now())
+                    continue;
+                const stillCurrent = () => this.stopGeneration(chatId) === item.stopEpoch && this.store.getInsertion(this.config.name, chatId, item.rowId)?.state !== 'stopped';
+                if (!stillCurrent()) {
+                    this.store.stopInsertions(this.config.name, chatId);
+                    continue;
+                }
+                const owner = this.queueOwners.get(chatId);
+                if (!item.expectedRunId && owner?.id === item.ownerId && owner?.batchId === item.batchId && owner?.runId)
+                    item.expectedRunId = owner.runId;
+                if (!item.expectedRunId) {
+                    const stillOriginal = owner?.id === item.ownerId && owner?.batchId === item.batchId;
+                    this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, stillOriginal ? 'pending' : 'target_changed', { ...item, reason: stillOriginal ? 'original admission not identified yet' : 'original admission target unavailable; no retargeting' }, Date.now() + 5000);
+                    continue;
+                }
+                // Pin the real session generation BEFORE the dispatching journal. A
+                // crash/lost response can then query using precisely the same identity.
+                const info = await this.openclawClient.getSessionInfo(item.sessionKey).catch(() => null);
+                if (!stillCurrent())
+                    continue;
+                const sessionId = info?.session?.sessionId;
+                if (info?.session?.archived === true || (item.sessionId && sessionId && item.sessionId !== sessionId)) {
+                    this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, 'target_changed', { ...item, reason: 'session archived or generation changed; retained without migration' });
+                    continue;
+                }
+                if (!sessionId) {
+                    this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, item.state, item, Date.now() + 5000);
+                    continue;
+                }
+                item.sessionId = sessionId;
+                if (item.state === 'accepted') {
+                    this.store.clearPendingTrigger(this.config.name, chatId, item.rowId);
+                    const reaction = this.store.getReactionIntent(this.config.name, chatId, item.rowId);
+                    if (!reaction || reaction.desired === 'Typing')
+                        await this.receiptReaction(chatId, item.rowId, item.messageId, 'Get', item.expectedRunId);
+                    if (!stillCurrent())
+                        continue;
+                    const settled = await this.openclawClient.exactRunSettled?.(item.expectedRunId);
+                    if (!stillCurrent())
+                        continue;
+                    if (settled) {
+                        this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, 'committed', item);
+                        await this.receiptReaction(chatId, item.rowId, item.messageId, 'DONE', item.expectedRunId);
                     }
-                    else {
-                        console.log(`[${this.config.name}] Agent busy for ${chatId.slice(-8)} (steer=${steer.status}, session running=${live?.running}), queuing: "${cleanText.substring(0, 50)}..."`);
+                    else
+                        this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, 'accepted', item, Date.now() + 60_000);
+                    continue;
+                }
+                const batchAtCheck = owner?.batch, runAtCheck = owner?.runId;
+                const wrapped = `${steerInjectionPrefix(this.isEn(chatId))}\n${item.text}`;
+                const queryOnly = item.attempted === true || item.state === 'dispatching';
+                // Public exact terminal facts survive an absent plugin event map (e.g.
+                // plugin restart). Do not discover old-run end by queueing a successor.
+                const originalRunEnded = !queryOnly && await this.openclawClient.exactRunSettled?.(item.expectedRunId) === true;
+                if (!stillCurrent())
+                    continue;
+                // Bridge no-replay fence is durable before network mutation. Plugin
+                // owns the final synchronous attempt fence and asynchronous callback.
+                this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, item.state, item, item.nextCheckAt);
+                if (!queryOnly && !this.store.claimInsertionAttempt(this.config.name, chatId, item.rowId))
+                    continue;
+                const receipt = await this.openclawClient.steer(item.sessionKey, wrapped, item.text, { insertionId: item.insertionId,
+                    expectedRunId: item.expectedRunId, expectedSessionId: item.sessionId, stopEpoch: item.stopEpoch, queryOnly, originalRunEnded });
+                if (!stillCurrent())
+                    continue;
+                const valid = receipt.insertionId === item.insertionId && receipt.expectedRunId === item.expectedRunId && (!receipt.sessionId || receipt.sessionId === item.sessionId);
+                let state = valid ? receipt.status : 'unknown';
+                // Explicit no-effect means a real old-run terminal can hand this SAME
+                // input back to the ordinary queue once. Time elapsed never authorizes
+                // this handoff. An attempted unknown can never take this branch.
+                if (valid && receipt.attempted === false && receipt.ordinaryEligible !== false && ['pending', 'target_ended'].includes(state) &&
+                    ['target_not_ready', 'backend_rejected_no_effect', 'original run ended without an insertion attempt'].includes(receipt.reason || '')) {
+                    const status = await this.openclawClient.getSessionRuntimeStatus(item.sessionKey).catch(() => null);
+                    if (!stillCurrent())
+                        continue;
+                    const rootSettled = await this.openclawClient.exactRunSettled?.(item.expectedRunId);
+                    if (!stillCurrent())
+                        continue;
+                    const unchanged = this.queueOwners.get(chatId) === owner && owner?.batch === batchAtCheck && owner?.runId === runAtCheck;
+                    if (rootSettled === true && status?.idleConfirmed === true && unchanged) {
+                        state = 'ordinary';
+                        // Never expire a successor merely to schedule the old input.
+                        if (runAtCheck === item.expectedRunId)
+                            this.forceExpireQueueOwner(chatId, 'confirmed idle exact batch; insertion never accepted/unknown');
                     }
+                    else if (state === 'target_ended')
+                        state = 'pending';
                 }
-                else {
-                    console.log(`[${this.config.name}] Agent busy for ${chatId.slice(-8)} (steer=${steer.status}), queuing: "${cleanText.substring(0, 50)}..."`);
+                if (state === 'target_ended')
+                    state = 'rejected'; // prior explicit backend refusal; never silently move it to a successor
+                if (state === 'unavailable' || state === 'capability_blocked')
+                    state = 'pending';
+                const record = { ...item, attempted: valid ? (receipt.attempted ?? true) : true, sessionId: item.sessionId, reason: receipt.reason };
+                this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, state, record, Date.now() + (state === 'unknown' ? 15_000 : 5000));
+                if (state === 'ordinary') {
+                    void this.enqueueAndDispatchDelivery(chatId, 'insertion_status', `insertion:${item.insertionId}:ordinary`, 'ℹ️ 原 run 已明确结束，且这条消息确定未被插入；现已交回普通队列，只执行一次。', [], item.messageId, `insertion:${item.insertionId}:ordinary`).catch(() => { });
+                    void this.processQueue(chatId).catch(() => { });
                 }
-                if (!this.queueRuns.has(chatId)) {
-                    // Owner gone (force-expired or settled during the steer RPC): send now.
-                    await this.removeReaction(messageId, "Typing").catch(() => { });
-                    await this.addReaction(messageId, "Get").catch(() => { });
-                    const acksNow = this.pendingAckMessages.get(chatId) || [];
-                    for (const a of acksNow)
-                        if (a.messageId === messageId)
-                            a.emoji = "Get";
-                    this.pendingAckMessages.set(chatId, acksNow);
-                    await this.processQueue(chatId);
-                    return;
+                else if (state === 'accepted') {
+                    this.store.clearPendingTrigger(this.config.name, chatId, item.rowId);
+                    // Durable acceptance drives Get, including after bridge restart when
+                    // its ephemeral pendingAckMessages array no longer exists.
+                    await this.receiptReaction(chatId, item.rowId, item.messageId, 'Get', item.expectedRunId);
+                    if (!stillCurrent())
+                        continue;
+                    const ack = (this.pendingAckMessages.get(chatId) || []).find(a => a.rowId === item.rowId);
+                    if (ack)
+                        ack.emoji = 'Get';
+                    if (owner && owner.runId === item.expectedRunId && owner.batch) {
+                        const list = this.admittedSteerAcks.get(chatId) || [];
+                        if (!list.some(a => a.insertedId === item.rowId))
+                            list.push({ messageId: item.messageId, insertedId: item.rowId, batch: owner.batch });
+                        this.admittedSteerAcks.set(chatId, list);
+                    }
+                }
+                else if (state === 'unknown' || state === 'target_changed' || state === 'rejected') {
+                    if (item.state !== state)
+                        void this.enqueueAndDispatchDelivery(chatId, 'insertion_status', `insertion:${item.insertionId}:${state}`, `ℹ️ 这条插入消息的状态为 ${state}，仍保留本地记录，未确认接收前不会显示 Get，也不会自动重复执行。${receipt.reason || ''}`, [], item.messageId, `insertion:${item.insertionId}:${state}`).catch(() => { });
                 }
-                // Reconciliation may have finished the old owner during the steer RPC.
-                // Ensure this new, still-pending input is drained even when that owner
-                // exited through an error path. Already-consumed input is never replayed.
-                const owner = this.queueRuns.get(chatId);
-                const drainPending = () => {
-                    if (insertedId > 0 && this.store.getPendingTriggerIds(this.config.name, chatId).has(insertedId))
-                        return this.processQueue(chatId);
-                };
-                if (owner)
-                    void owner.then(drainPending, drainPending).catch(err => console.warn(`[${this.config.name}] pending drain failed:`, err.message));
-                else
-                    await drainPending();
-                return;
             }
-            // --- Not busy, send now (with any accumulated messages) ---
-            // Acknowledge receipt: sent to OpenClaw (GET/了解)
-            await this.addReaction(messageId, "Get").catch(() => { });
-            pending.push({ messageId, emoji: "Get", rowId: insertedId });
-            this.pendingAckMessages.set(chatId, pending);
-            await this.processQueue(chatId);
         }
-        catch (err) {
-            console.error(`[${this.config.name}] Error:`, safeErrorSummary(err));
+        finally {
+            this.insertionChecks.delete(chatId);
         }
     }
     shouldUseLiveStatus(chatId, isNativeCommandTrigger = false) {
@@ -1436,9 +1556,10 @@ export class FeishuBot {
     async withSessionHealthMonitor(chatId, messageId, insertedId, work) {
         let done = false;
         const monitoredWork = work.finally(() => { done = true; });
+        const monitorStartedAt = Date.now();
         const monitor = (async () => {
             while (!done) {
-                await new Promise((resolve) => setTimeout(resolve, SESSION_HEALTH_POLL_MS));
+                await new Promise((resolve) => setTimeout(resolve, Date.now() - monitorStartedAt < 60_000 ? SESSION_HEALTH_POLL_MS : 60_000));
                 if (done)
                     break;
                 const unhealthy = await this.getUnhealthySessionStatus(chatId);
@@ -1489,9 +1610,9 @@ export class FeishuBot {
             console.log(`[${this.config.name}] processQueue already running for ${chatId.slice(-8)}, joining existing run`);
             return existing;
         }
-        const batchToken = {};
-        this.queueRunTokens.set(chatId, batchToken);
-        const run = this.processQueueInner(chatId, batchToken).finally(() => {
+        const owner = { id: randomUUID(), token: {}, revoked: false, stopEpoch: this.stopGeneration(chatId) };
+        this.queueOwners.set(chatId, owner);
+        const run = this.processQueueInner(chatId, owner).finally(() => {
             // Ownership token guard: only the CURRENT owner may release the slot. A
             // zombie owner that settles after forceExpireQueueOwner must not delete
             // the replacement owner's entry (that would open a concurrent-run window).
@@ -1500,6 +1621,8 @@ export class FeishuBot {
                 this.runFailureObservers.delete(chatId);
                 this.admittedSteerAcks.delete(chatId);
                 this.queueRunTokens.delete(chatId);
+                if (this.queueOwners.get(chatId) === owner)
+                    this.queueOwners.delete(chatId);
             }
         });
         this.queueRuns.set(chatId, run);
@@ -1516,6 +1639,9 @@ export class FeishuBot {
         const owner = this.queueRuns.get(chatId);
         if (!owner)
             return false;
+        const context = this.queueOwners.get(chatId);
+        if (context)
+            context.revoked = true;
         console.warn(`[${this.config.name}] force-expiring zombie queue owner for ${chatId.slice(-8)}: ${reason}`);
         // Fence the stale batch's local observation BEFORE releasing custody: an
         // alive old poller would keep destructively consuming the replacement
@@ -1525,14 +1651,25 @@ export class FeishuBot {
         }
         catch { /* isolated */ }
         this.queueRuns.delete(chatId);
+        if (this.queueOwners.get(chatId) === context)
+            this.queueOwners.delete(chatId);
         this.fireRunFailureObservers(chatId);
         this.runFailureObservers.delete(chatId);
         this.admittedSteerAcks.delete(chatId);
         this.queueRunTokens.delete(chatId);
         return true;
     }
-    async processQueueInner(chatId, batchToken) {
-        while (true) {
+    async processQueueInner(chatId, owner) {
+        const current = () => !owner.revoked && this.queueOwners.get(chatId) === owner && this.stopGeneration(chatId) === owner.stopEpoch;
+        const guard = () => { if (!current())
+            throw new SupersededObservation('queue owner revoked'); };
+        while (current()) {
+            const batchToken = {};
+            owner.batch = batchToken;
+            owner.batchId = randomUUID();
+            owner.triggerIds = undefined;
+            owner.runId = undefined;
+            this.queueRunTokens.set(chatId, batchToken);
             // A fresh batch starts: steered inputs admitted into the PREVIOUS batch
             // completed with it (consumed or not); their failure observers are stale.
             this.runFailureObservers.delete(chatId);
@@ -1541,7 +1678,7 @@ export class FeishuBot {
             const pendingTriggerIds = this.store.getPendingTriggerIds(this.config.name, chatId);
             // Only proceed if there are pending human messages that should actively trigger this bot.
             const pendingHumanTriggers = pendingMessages
-                .filter((m) => m.senderType === "human" && m.id && pendingTriggerIds.has(m.id))
+                .filter((m) => m.senderType === "human" && m.id && pendingTriggerIds.has(m.id) && !this.store.isInsertionReserved(this.config.name, chatId, m.id))
                 .sort((a, b) => a.timestamp - b.timestamp);
             if (pendingHumanTriggers.length === 0) {
                 break;
@@ -1623,9 +1760,10 @@ export class FeishuBot {
             // we snapshotted inside auto-retry instead, a /stop that landed during the
             // main run would already be baked into the baseline and go undetected —
             // that was the "stop then auto-retry anyway" bug.
-            const runStartStopEpoch = this.stopEpoch.get(chatId) || 0;
+            const runStartStopEpoch = this.stopGeneration(chatId);
             const mergedContent = mergedTriggers.map((m) => m.content).join("\n");
             const mergedTriggerIds = mergedTriggers.map((m) => m.id || 0).filter(Boolean);
+            owner.triggerIds = new Set(mergedTriggerIds);
             // These rows are now taking the ordinary queue path. Remove any stale
             // provisional native-steer correlation before chat.send so a later
             // identical steer cannot acknowledge the wrong Feishu message.
@@ -1687,8 +1825,11 @@ export class FeishuBot {
             let sessionKey;
             try {
                 sessionKey = await this.ensureSession(chatId);
+                guard();
             }
             catch (err) {
+                if (!current())
+                    break;
                 // Model policy/capability failures happen before chat.send. Clear the
                 // busy marker, report the actionable error, and retire only this batch
                 // so the chat cannot remain wedged indefinitely.
@@ -1703,19 +1844,11 @@ export class FeishuBot {
                 if (mergedTriggerIds.length > 0)
                     this.store.markSynced(this.config.name, chatId, Math.max(...mergedTriggerIds));
                 const pendingAcks = this.pendingAckMessages.get(chatId) || [];
+                guard();
                 this.pendingAckMessages.set(chatId, pendingAcks.filter((ack) => !completedTriggerIdSet.has(ack.rowId)));
                 break;
             }
             console.log(`[${this.config.name}] Sending ${mergedTriggers.length} trigger(s) as 1 run to OpenClaw for ${chatId.slice(-8)} (context=${contextMsgs.length}, dropped=${droppedTriggerIds.length})`);
-            // Update reactions: queued messages → sent (GET/了解)
-            const pendingAcks = this.pendingAckMessages.get(chatId) || [];
-            for (const ack of pendingAcks) {
-                if (ack.emoji !== "Get") {
-                    await this.removeReaction(ack.messageId, ack.emoji).catch(() => { });
-                    await this.addReaction(ack.messageId, "Get").catch(() => { });
-                    ack.emoji = "Get";
-                }
-            }
             let foregroundRunId;
             const foregroundSessionId = this.store.getActiveGoJob(this.config.name, chatId)?.executorSessionId;
             let runAcceptedByOpenClaw = false;
@@ -1750,6 +1883,7 @@ export class FeishuBot {
                         locale: this.isEn(chatId) ? "en" : "zh",
                     })
                     : undefined;
+                guard();
                 liveStatus?.start(this.isEn(chatId) ? "waiting for OpenClaw" : "等待 OpenClaw 回复");
                 const activeTargetForStatus = this.activeDeliveryTargets.get(chatId);
                 if (activeTargetForStatus?.triggerId === triggerId && liveStatus)
@@ -1766,13 +1900,32 @@ export class FeishuBot {
                         timeoutMs: FOREGROUND_WAIT_MS,
                         includeContext: !isNativeCommandTrigger,
                         includeBridgeAttachmentHint: !isNativeCommandTrigger,
-                        onSendAttempt: () => {
+                        onSendAttempt: (submissionId) => {
+                            guard();
+                            if (submissionId && lastHuman.messageId) {
+                                this.store.bindDeliveryRun(this.config.name, chatId, submissionId, { triggerId, triggerIds: mergedTriggerIds, messageId: lastHuman.messageId, runId: submissionId, stopGeneration: this.stopGeneration(chatId) });
+                                for (const ack of this.pendingAckMessages.get(chatId) || [])
+                                    if (mergedTriggerIdSet.has(ack.rowId))
+                                        void this.receiptReaction(chatId, ack.rowId, ack.messageId, 'Typing', submissionId).catch(() => { });
+                            }
                             // At-most-once: as soon as we begin issuing chat.send, do not let
                             // this batch auto-replay. If the RPC response is lost after
                             // OpenClaw accepts it, retrying would duplicate the same message.
                             markSubmittedBatch("send-attempt");
                         },
-                        onSubmitted: (runId) => {
+                        onRunIdentified: (runId) => { guard(); owner.runId = runId; foregroundRunId = runId; },
+                        onSubmitted: async (runId) => {
+                            guard();
+                            owner.runId = runId;
+                            void this.reconcileInsertions(chatId).catch(() => { });
+                            for (const ack of this.pendingAckMessages.get(chatId) || []) {
+                                if (!mergedTriggerIdSet.has(ack.rowId))
+                                    continue;
+                                guard();
+                                await this.receiptReaction(chatId, ack.rowId, ack.messageId, 'Get', runId);
+                                guard();
+                                ack.emoji = 'Get';
+                            }
                             foregroundRunId = runId;
                             runAcceptedByOpenClaw = true;
                             const target = this.activeDeliveryTargets.get(chatId);
@@ -1786,9 +1939,11 @@ export class FeishuBot {
                             // INSERT OR IGNORE in message_sync.
                             markSubmittedBatch(`submitted:${runId}`);
                         },
-                        onProgress: (event) => liveStatus?.progress(event),
+                        onProgress: (event) => current() ? liveStatus?.progress(event) : undefined,
                         onWaitPaused: async (notice) => {
+                            guard();
                             await liveStatus?.showWaitingForResult(notice.message);
+                            guard();
                             // Yield is a confirmed handoff, not the timeout heuristic. A
                             // recent unrelated reply must not suppress this turn's notice.
                             if (notice.reason === "yield" ? !this.store.hasDeliveredReply(this.config.name, chatId, triggerId)
@@ -1808,6 +1963,7 @@ export class FeishuBot {
                     // and chat-final paths share the same delivery key.
                     releaseActiveDeliveryTarget();
                 }
+                guard();
                 console.log(`[${this.config.name}] OpenClaw reply collected for ${chatId.slice(-8)} in ${Date.now() - queueStartedAt}ms`);
                 // Auto-retry: if the reply looks truncated/incomplete, confirm with the
                 // session and loop until it reports done (or the budget is spent). This
@@ -1822,7 +1978,14 @@ export class FeishuBot {
                     initialReply: reply,
                     liveStatus,
                     runStartStopEpoch,
+                    guard,
+                    onSendAttempt: submissionId => {
+                        guard();
+                        this.store.bindDeliveryRun(this.config.name, chatId, submissionId, { triggerId, messageId: lastHuman.messageId || '', runId: submissionId, stopGeneration: this.stopGeneration(chatId), sessionKey: `agent:main:${sessionKey.replace(/^agent:[^:]+:/, '')}` });
+                    },
+                    onSubmitted: async (runId) => { guard(); owner.runId = runId; foregroundRunId = runId; this.bindRunDeliveryTarget(chatId, runId, { triggerId, messageId: lastHuman.messageId || "", liveStatus }); },
                 });
+                guard();
                 const parsedReply = this.extractBridgeAttachments(reply);
                 const visibleReply = parsedReply.text;
                 const trimmedReply = visibleReply.trim();
@@ -1853,13 +2016,13 @@ export class FeishuBot {
                     const remainingAcks = [];
                     for (const ack of pendingAcks) {
                         if (completedTriggerIdSet.has(ack.rowId)) {
-                            await this.removeReaction(ack.messageId, ack.emoji).catch(() => { });
-                            await this.addReaction(ack.messageId, "DONE").catch(() => { });
+                            await this.receiptReaction(chatId, ack.rowId, ack.messageId, 'DONE', foregroundRunId || owner.runId);
                         }
                         else {
                             remainingAcks.push(ack);
                         }
                     }
+                    guard();
                     this.pendingAckMessages.set(chatId, remainingAcks);
                     break;
                 }
@@ -1882,37 +2045,14 @@ export class FeishuBot {
                     this.store.clearPendingTrigger(this.config.name, chatId, id);
                 const shouldReply = trimmedReply.length > 0 && !explicitNoReply;
                 const isRuntimeFailure = shouldReply && this.isRuntimeFailureText(trimmedReply);
-                // Record bot reply only if it is user-visible/context-worthy.
-                if (shouldReply || hasAttachments) {
-                    const storedContent = [visibleReply, ...parsedReply.attachments.map((a) => `[Attachment: ${a.type || "file"} ${a.path}]`)]
-                        .filter(Boolean)
-                        .join("\n");
-                    const replyId = this.store.insert({
-                        chatId,
-                        messageId: `self-${this.config.name}-${Date.now()}`,
-                        senderType: "bot",
-                        senderName: this.config.name,
-                        content: storedContent,
-                        timestamp: Date.now(),
-                    });
-                    if (replyId > 0) {
-                        const remainingPending = this.store.getPendingTriggerIds(this.config.name, chatId);
-                        const hasEarlierPending = Array.from(remainingPending).some((id) => id <= replyId);
-                        // Do not advance sync past a human message that arrived while this
-                        // run was busy. Otherwise the pending trigger remains in the table
-                        // but getUnsyncedMessages() can no longer see it.
-                        if (!hasEarlierPending) {
-                            this.store.markMessagesSynced(this.config.name, chatId, [replyId], `${this.config.name}:${chatId}:reply:${replyId}`);
-                            this.store.markSynced(this.config.name, chatId, replyId);
-                        }
-                    }
-                }
+                // Receipt-aware dispatcher owns all shared assistant context rows.
                 // Wait for all pending tool event messages to be delivered first
                 const toolSends = this.pendingToolSends.get(chatId) || [];
                 if (toolSends.length > 0) {
                     await Promise.allSettled(toolSends);
                     this.pendingToolSends.set(chatId, []);
                 }
+                guard();
                 // Reply to the last human message on Feishu (ordered after tool msgs)
                 // Skip empty replies and explicit NO_REPLY responses
                 if ((shouldReply || hasAttachments) && lastHuman.messageId && !isRuntimeFailure) {
@@ -1925,7 +2065,7 @@ export class FeishuBot {
                             // Keep live status and final answer as separate messages. The final
                             // answer is created at completion time so it remains at the bottom
                             // even when the user inserted more messages during the run.
-                            await this.enqueueAndDispatchDelivery(chatId, "assistant_visible", this.deliverySourceId("visible", `${triggerId}|${(shouldReply ? visibleReply : "").trim()}|${JSON.stringify(parsedReply.attachments)}`), shouldReply ? visibleReply : "", parsedReply.attachments, lastHuman.messageId, `trigger:${triggerId}`, this.config.model, foregroundRunId && foregroundSessionId ? { runId: foregroundRunId, sessionKey, sessionId: foregroundSessionId, final: true } : undefined);
+                            await this.enqueueAndDispatchDelivery(chatId, "assistant_visible", this.deliverySourceId("visible", `${triggerId}|${(shouldReply ? visibleReply : "").trim()}|${JSON.stringify(parsedReply.attachments)}`), shouldReply ? visibleReply : "", parsedReply.attachments, lastHuman.messageId, `trigger:${triggerId}`, this.config.model, foregroundRunId ? { runId: foregroundRunId, sessionKey, ...(foregroundSessionId ? { sessionId: foregroundSessionId } : {}), final: true } : undefined);
                             await liveStatus?.complete();
                             // Mark every merged trigger as delivered so retries/restarts do
                             // not re-process any of them.
@@ -1996,6 +2136,7 @@ export class FeishuBot {
                     this.goController?.notifyRunOutcome(chatId, "no_reply", `trigger:${triggerId}`, "(本轮无用户可见回复 NO_REPLY)");
                 }
                 console.log(`[${this.config.name}] [${new Date().toISOString()}] ${shouldReply || hasAttachments ? 'Replied' : 'Skipped (empty/NO_REPLY)'} (${reply.length} chars, attachments=${parsedReply.attachments.length})`);
+                guard();
                 // Replace ack reactions with DONE only for trigger messages actually
                 // processed in this run. Queued messages that arrived mid-run keep their
                 // Typing/Get reaction and will be acknowledged by the next loop.
@@ -2003,13 +2144,14 @@ export class FeishuBot {
                 const remainingAcks = [];
                 for (const ack of pendingAcks) {
                     if (completedTriggerIdSet.has(ack.rowId)) {
-                        await this.removeReaction(ack.messageId, ack.emoji).catch(() => { });
-                        await this.addReaction(ack.messageId, "DONE").catch(() => { });
+                        guard();
+                        await this.receiptReaction(chatId, ack.rowId, ack.messageId, 'DONE', foregroundRunId || owner.runId);
                     }
                     else {
                         remainingAcks.push(ack);
                     }
                 }
+                guard();
                 this.pendingAckMessages.set(chatId, remainingAcks);
                 // Steered messages admitted into THIS batch were consumed with it:
                 // flip their Get → DONE alongside the batch's own triggers.
@@ -2023,15 +2165,20 @@ export class FeishuBot {
                 }
                 if (admittedSteers.length > 0) {
                     for (const s of admittedSteers) {
-                        await this.removeReaction(s.messageId, "Get").catch(() => { });
-                        await this.addReaction(s.messageId, "DONE").catch(() => { });
+                        guard();
+                        const custody = this.store.getInsertion(this.config.name, chatId, s.insertedId);
+                        if (custody?.state !== 'accepted' || custody.expectedRunId !== owner.runId)
+                            continue;
+                        this.store.saveInsertion(this.config.name, chatId, s.insertedId, custody.insertionId, 'committed', custody);
+                        await this.receiptReaction(chatId, s.insertedId, s.messageId, 'DONE', owner.runId);
                     }
                     const acksAfter = this.pendingAckMessages.get(chatId) || [];
+                    guard();
                     this.pendingAckMessages.set(chatId, acksAfter.filter((a) => !admittedSteers.some((s) => a.messageId === s.messageId)));
                 }
             }
             catch (err) {
-                if (err instanceof SupersededObservation) {
+                if (!current() || err instanceof SupersededObservation) {
                     // This batch's local observation was fenced by a newer batch (or a
                     // custody revocation). The new owner handles delivery from here; end
                     // quietly — no error notice, no replay, no Gateway abort. The old
@@ -2039,6 +2186,11 @@ export class FeishuBot {
                     console.log(`[${this.config.name}] batch observation superseded for ${chatId.slice(-8)}; ending quietly`);
                     break;
                 }
+                if (err instanceof AdmissionUnconfirmed) {
+                    await this.enqueueAndDispatchDelivery(chatId, 'admission_status', `admission:${err.submissionId}:unknown`, err.message, [], lastHuman.messageId, `admission:${err.submissionId}:unknown`).catch(() => { });
+                    await liveStatus?.pauseForUnconfirmedResult(err.message).catch(() => { });
+                    break;
+                }
                 let pause = err instanceof SessionWaitPaused ? err : undefined;
                 if (!pause && isWaitTimeout(err instanceof Error ? err.message : String(err))) {
                     const state = await this.readSessionStatus(chatId);
@@ -2060,6 +2212,7 @@ export class FeishuBot {
                     for (const ack of acks)
                         if (completedTriggerIdSet.has(ack.rowId))
                             await this.removeReaction(ack.messageId, ack.emoji).catch(() => { });
+                    guard();
                     this.pendingAckMessages.set(chatId, acks.filter(ack => !completedTriggerIdSet.has(ack.rowId)));
                     break;
                 }
@@ -2072,6 +2225,7 @@ export class FeishuBot {
                     for (const ack of acks)
                         if (completedTriggerIdSet.has(ack.rowId))
                             await this.removeReaction(ack.messageId, ack.emoji).catch(() => { });
+                    guard();
                     this.pendingAckMessages.set(chatId, acks.filter(ack => !completedTriggerIdSet.has(ack.rowId)));
                     // No DONE/delivered mark and no replay of the old input. The new
                     // pending trigger resumes after this queue owner's finally releases.
@@ -2094,7 +2248,7 @@ export class FeishuBot {
                     // is a separate message that we mark interrupted afterwards.
                     await this.enqueueAndDispatchDelivery(chatId, "provider_error", `trigger:${triggerId}:provider-error`, errorText, [], lastHuman.messageId, `trigger:${triggerId}:provider-error`)
                         .then(() => {
-                        if (triggerId)
+                        if (current() && triggerId)
                             this.store.markDeliveredReply(this.config.name, chatId, triggerId, lastHuman.messageId);
                     })
                         .catch(() => { });
@@ -2103,6 +2257,8 @@ export class FeishuBot {
                 else {
                     await liveStatus?.fail().catch(() => { });
                 }
+                if (!current())
+                    break;
                 if (triggerId) {
                     // At-most-once: if anything after send attempt failed, this batch has
                     // already been marked/cleared by onSendAttempt. If failure happened
@@ -2116,19 +2272,21 @@ export class FeishuBot {
                 const pendingAcks = this.pendingAckMessages.get(chatId) || [];
                 const remainingAcks = [];
                 for (const ack of pendingAcks) {
-                    if (completedTriggerIdSet.has(ack.rowId)) {
-                        await this.removeReaction(ack.messageId, ack.emoji).catch(() => { });
-                        await this.addReaction(ack.messageId, "DONE").catch(() => { });
+                    if (completedTriggerIdSet.has(ack.rowId) && runAcceptedByOpenClaw) {
+                        guard();
+                        await this.receiptReaction(chatId, ack.rowId, ack.messageId, 'DONE', foregroundRunId || owner.runId);
                     }
                     else {
                         remainingAcks.push(ack);
                     }
                 }
+                guard();
                 this.pendingAckMessages.set(chatId, remainingAcks);
                 break;
             }
             finally {
-                this.busyChats.set(chatId, 0);
+                if (current())
+                    this.busyChats.set(chatId, 0);
             }
             // Check if more messages arrived while we were busy
             // Small delay to let any in-flight messages settle
@@ -2518,10 +2676,11 @@ export class FeishuBot {
         // seen here; fall back to the current epoch only if the caller did not pass
         // one. If the user hit /stop at any point from the main run onward, the
         // epoch is now past the baseline and we must not auto-retry at all.
-        const startStopEpoch = params.runStartStopEpoch ?? (this.stopEpoch.get(chatId) || 0);
-        const wasStopped = () => (this.stopEpoch.get(chatId) || 0) !== startStopEpoch;
+        const startStopEpoch = params.runStartStopEpoch ?? this.stopGeneration(chatId);
+        const wasStopped = () => this.stopGeneration(chatId) !== startStopEpoch;
         for (let attempt = 1; attempt <= maxRetry; attempt++) {
             // /stop while we were looping: abandon retries and deliver what we have.
+            params.guard?.();
             if (wasStopped()) {
                 console.log(`[${this.config.name}] auto-retry: aborted by /stop for ${chatId.slice(-8)}`);
                 return reply;
@@ -2543,6 +2702,9 @@ export class FeishuBot {
             await liveStatus?.progress(en
                 ? `⚠️ Reply looks incomplete — auto-checking (${attempt}/${maxRetry})…`
                 : `⚠️ 疑似任务未完成，正在自动重试（${attempt}/${maxRetry}）…`).catch(() => { });
+            params.guard?.();
+            if (wasStopped())
+                return reply;
             // One short line, in the user's own voice (we intentionally do not change
             // senderName). Each locale uses its own done-phrase so the English probe
             // stays fully English; detection accepts both phrases.
@@ -2560,14 +2722,21 @@ export class FeishuBot {
                     timeoutMs: FOREGROUND_WAIT_MS,
                     includeContext: false,
                     includeBridgeAttachmentHint: false,
-                    onProgress: (event) => liveStatus?.progress(event),
+                    onSendAttempt: submissionId => { params.guard?.(); params.onSendAttempt?.(submissionId); params.guard?.(); if (wasStopped())
+                        throw new SupersededObservation("stopped probe"); },
+                    onSubmitted: async (runId) => { params.guard?.(); await params.onSubmitted?.(runId); params.guard?.(); },
+                    onProgress: (event) => { params.guard?.(); return liveStatus?.progress(event); },
                     onWaitPaused: async (notice) => {
+                        params.guard?.();
                         await liveStatus?.showWaitingForResult(notice.message);
+                        params.guard?.();
                         await this.sendWaitPaused(chatId, triggerId, lastHumanMessageId, notice);
+                        params.guard?.();
                     },
                 }));
             }
             catch (err) {
+                params.guard?.();
                 if (err instanceof SessionWaitPaused)
                     throw err;
                 // The confirmation round itself failed (timeout/unhealthy). Do not spin:
@@ -2575,9 +2744,11 @@ export class FeishuBot {
                 console.warn(`[${this.config.name}] auto-retry probe failed for ${chatId.slice(-8)}:`, this.errorSummary(err));
                 return reply;
             }
+            params.guard?.();
             const probeText = this.extractBridgeAttachments(probeReply).text.trim();
             // /stop landed while the probe was in flight: stop here rather than loop
             // again. Deliver the latest meaningful output we have.
+            params.guard?.();
             if (wasStopped()) {
                 console.log(`[${this.config.name}] auto-retry: aborted by /stop mid-probe for ${chatId.slice(-8)}`);
                 return probeText && probeText.toUpperCase() !== "NO_REPLY" ? probeReply : reply;
@@ -2612,6 +2783,7 @@ export class FeishuBot {
         const previous = this.deliveryTargetsByRun.get(key);
         if (previous?.timer)
             clearTimeout(previous.timer);
+        this.store.bindDeliveryRun(this.config.name, chatId, runId, { triggerId: target.triggerId, messageId: target.messageId, runId, sessionKey: `agent:main:${this.getSessionKey(chatId).replace(/^agent:[^:]+:/, '')}` });
         this.deliveryTargetsByRun.set(key, {
             triggerId: target.triggerId,
             messageId: target.messageId,
@@ -2690,13 +2862,19 @@ export class FeishuBot {
         return (hash >>> 0).toString(36);
     }
     deliverySourceId(kind, text) {
-        return `${kind}:${this.stableHash(text)}`;
+        return `${kind}:${createHash('sha256').update(text).digest('hex')}`;
     }
     async sendSystemDelivery(chatId, text) {
         const sourceId = `discussion-system:${Date.now()}:${Math.random().toString(36).slice(2)}`;
         await this.enqueueAndDispatchDelivery(chatId, "discussion_system", sourceId, text);
     }
     async enqueueAndDispatchDelivery(chatId, sourceType, sourceId, text, attachments = [], replyToMessageId, deliveryKey, finalReplyModel, provenance, errorNoticeId) {
+        if (provenance?.sessionKey && !/^agent:/.test(provenance.sessionKey))
+            provenance = { ...provenance, sessionKey: `agent:main:${provenance.sessionKey}` };
+        if (provenance?.sessionKey && provenance.runId && this.store.isStoppedObservation(provenance.sessionKey, provenance.runId))
+            return;
+        if (text.trim().toUpperCase() === 'NO_REPLY')
+            text = '';
         if (!text.trim() && attachments.length === 0)
             return;
         const attachmentsJson = JSON.stringify(attachments);
@@ -2704,6 +2882,8 @@ export class FeishuBot {
         const contentHash = this.stableHash(normalizedPayload);
         const finalDeliveryKey = deliveryKey || sourceId;
         const deliveryMetaJson = JSON.stringify({
+            botIdentity: this.config.appId,
+            deliveryStopEpoch: this.stopGeneration(chatId),
             ...(finalReplyModel?.trim() ? { model: finalReplyModel.trim() } : {}),
             ...(provenance ? { provenance } : {}), ...(errorNoticeId ? { errorNoticeId } : {}),
         });
@@ -2722,12 +2902,6 @@ export class FeishuBot {
             if (this.store.hasRecentOverlappingDelivery(this.config.name, chatId, text, attachmentsJson, 60_000, 8, ["verbose_transcript"]))
                 return;
         }
-        else if (!deliveryKey && !correlatedFinal) {
-            if (this.store.hasRecentSimilarDelivery(this.config.name, chatId, contentHash, 60_000, [sourceType]))
-                return;
-            if (this.store.hasRecentOverlappingDelivery(this.config.name, chatId, text, attachmentsJson, 60_000, 8, [sourceType]))
-                return;
-        }
         const deliveryId = this.store.enqueueDelivery({
             sessionKey: this.deliverySessionKey(chatId),
             chatId,
@@ -2983,10 +3157,10 @@ export class FeishuBot {
         this.errorNoticeChecks.set(chatId, promise);
         return promise;
     }
-    scheduleDeliveryRetry(chatId, attempt) {
+    scheduleDeliveryRetry(chatId, attempt, local = false) {
         if (this.deliveryRetryTimers.has(chatId))
             return;
-        const delay = Math.min(30_000, DELIVERY_RETRY_BASE_MS * Math.max(1, 2 ** Math.max(0, attempt - 1)));
+        const delay = Math.min(local ? 300_000 : 30_000, DELIVERY_RETRY_BASE_MS * Math.max(1, 2 ** Math.min(16, Math.max(0, attempt - 1))));
         const timer = setTimeout(() => {
             this.deliveryRetryTimers.delete(chatId);
             void this.dispatchPendingDeliveries(chatId).catch((err) => {
@@ -3020,6 +3194,16 @@ export class FeishuBot {
     }
     async dispatchPendingDeliveries(chatId, replyToMessageId) {
         this.installGoReceiptCapture();
+        for (const id of this.localDeliveryRetryCustody.get(chatId) || []) {
+            try {
+                this.store.deferLocalDelivery(id, 'local_store_unavailable');
+                this.localDeliveryRetryCustody.get(chatId)?.delete(id);
+            }
+            catch {
+                this.scheduleDeliveryRetry(chatId, 10, true);
+                return;
+            }
+        }
         let retryScheduled = false;
         while (true) {
             const pending = this.store.getPendingDeliveries(chatId, this.config.name, 50);
@@ -3029,9 +3213,17 @@ export class FeishuBot {
                 const ownerId = JSON.parse(item.deliveryMetaJson || "{}").provenance?.goJobId;
                 const deliveryJob = ownerId ? this.store.getGoJobById(ownerId) : this.store.getActiveGoJob(this.config.name, chatId);
                 const receipts = [
+                    ...this.store.listDeliveryReceipts(item.id),
                     ...(deliveryJob ? this.store.listGoVisibleEvidence(deliveryJob.id).find(e => e.sourceKey === `outbox:${item.id}`)?.receipt?.messages ?? [] : []),
                 ];
-                await this.sendOrdered(chatId, () => this.goDeliveryReceipts.run({ receipts, goId: deliveryJob?.id, outboxId: item.id, stage: "body", ordinals: new Map(), onReceipt: () => {
+                await this.sendOrdered(chatId, () => this.goDeliveryReceipts.run({ receipts, goId: deliveryJob?.id, outboxId: item.id, chatId, stage: "body", ordinals: new Map(), effectGuard: () => {
+                        const meta = JSON.parse(item.deliveryMetaJson || '{}'), p = meta.provenance;
+                        if ((p?.final || item.sourceType === 'run_error') &&
+                            (typeof meta.deliveryStopEpoch === 'number' && meta.deliveryStopEpoch !== this.stopGeneration(chatId) ||
+                                p?.sessionKey && p.runId && this.store.isStoppedObservation(p.sessionKey, p.runId))) {
+                            throw Object.assign(new Error('Delivery revoked by explicit stop before platform attempt'), { deliveryStopped: true });
+                        }
+                    }, onReceipt: () => {
                         if (deliveryJob)
                             this.store.recordGoDeliveryReceipt(deliveryJob.id, `outbox:${item.id}`, { messages: receipts, partial: true });
                     } }, async () => {
@@ -3039,6 +3231,8 @@ export class FeishuBot {
                         return;
                     let failureStage = "text";
                     try {
+                        this.store.flushKnownDeliveryReceipts(item.id);
+                        this.store.registerPartialAttachmentContext(item.id);
                         const job = deliveryJob;
                         const provenance = JSON.parse(item.deliveryMetaJson || "{}").provenance;
                         const goSource = `outbox:${item.id}`;
@@ -3103,31 +3297,20 @@ export class FeishuBot {
                             else {
                                 await this.sendFinalMessage(chatId, item.content, finalModel, finalStatus);
                             }
-                            // Rows created by v1.4.3 may still target a live-status card. Preserve
-                            // restart compatibility: send their text as a new message, then
-                            // collapse the old status card in the cleanup stage below.
-                            if (item.deliveryMode === "patch_live_status" && item.targetMessageId) {
-                                this.store.markDeliveryTextDeliveredWithCleanup(item.id);
-                            }
-                            else {
-                                this.store.markDeliveryTextDelivered(item.id);
-                            }
-                            // Proactive deliveries have no trigger-reply recording path, so
-                            // without this row other bots' context sync never sees them
-                            // (2026-10-16 blind spot: an audit reply delivered to Feishu but
-                            // invisible to every other group member). The deterministic id
-                            // keyed by deliveryKey keeps crash-retries idempotent; the unique
-                            // constraint turns a replay into a no-op.
-                            if (String(item.deliveryKey || "").startsWith("proactive:")) {
-                                this.store.insert({
-                                    chatId,
-                                    messageId: `self-${this.config.name}-proactive-${item.deliveryKey}`,
-                                    senderType: "bot",
-                                    senderName: this.config.name,
-                                    content: item.content,
-                                    timestamp: Date.now(),
-                                });
-                            }
+                            const bodyReceipts = this.store.listDeliveryReceipts(item.id).filter(r => r.stage === 'body');
+                            if (!bodyReceipts.length)
+                                throw new Error('No confirmed body receipt');
+                            this.store.registerPartialBodyContext(item.id, true);
+                            this.store.confirmDeliveryStage(item.id, 'body', item.content, bodyReceipts, 'text');
+                            if (item.deliveryMode === 'patch_live_status' && item.targetMessageId)
+                                this.store.markDeliveryCleanupPending(item.id, true);
+                        }
+                        // Repair a checkpoint/context gap without resending. Legacy rows
+                        // lacking actual receipts are exposed through the explicit audit API.
+                        if (item.textDelivered) {
+                            const bodyReceipts = this.store.listDeliveryReceipts(item.id).filter(r => r.stage === 'body');
+                            if (bodyReceipts.length)
+                                this.store.confirmDeliveryStage(item.id, 'body', item.content, bodyReceipts, 'text');
                         }
                         // Attachments are independent from status-card cleanup. An unpatchable
                         // or deleted status card must never block otherwise-sendable files.
@@ -3138,7 +3321,21 @@ export class FeishuBot {
                             if (context)
                                 context.stage = `attachment:${i}`;
                             await this.sendBridgeAttachment(chatId, attachments[i]);
-                            this.store.markDeliveryAttachmentCursor(item.id, i + 1);
+                            const stage = `attachment:${i}`;
+                            const attachmentReceipts = this.store.listDeliveryReceipts(item.id).filter(r => r.stage === stage);
+                            if (!attachmentReceipts.length)
+                                throw new Error('No confirmed attachment receipt');
+                            const visiblePayload = attachmentReceipts.map(r => {
+                                try {
+                                    const payload = JSON.parse(r.payload?.content || '{}');
+                                    return payload.text || JSON.stringify(payload);
+                                }
+                                catch {
+                                    return '';
+                                }
+                            }).filter(Boolean).join('\n');
+                            const description = `[Attachment: ${attachments[i].type || 'file'} ${attachments[i].path}]${attachments[i].caption ? ' ' + attachments[i].caption : ''}\n${visiblePayload}`;
+                            this.store.confirmDeliveryStage(item.id, stage, description, attachmentReceipts, i + 1);
                         }
                         // Cleanup last, after all payload is visible. Cleanup-only rows and
                         // attachment-only finals enter here as a separately retryable stage.
@@ -3163,13 +3360,49 @@ export class FeishuBot {
                             }
                         }
                         this.store.markDeliveryDelivered(item.id);
+                        if (provenance?.final && provenance.runId) {
+                            this.store.settleRunReactionIntents(this.config.name, chatId, provenance.runId);
+                            void this.reconcileReactions(chatId).catch(() => { });
+                        }
                     }
                     catch (err) {
+                        if (failureStage === 'text') {
+                            try {
+                                this.store.registerPartialBodyContext(item.id);
+                            }
+                            catch { /* Durable operation receipts retain recoverable context custody. */ }
+                        }
+                        try {
+                            this.store.registerPartialAttachmentContext(item.id);
+                        }
+                        catch { /* Confirmed payload remains in receipt custody. */ }
                         const activeJob = deliveryJob;
                         if (activeJob && receipts.length)
                             this.store.recordGoDeliveryReceipt(activeJob.id, `outbox:${item.id}`, { messages: receipts, partial: true });
                         if (this.isOutOfChatError(err))
                             this.markCurrentBotUnavailable(chatId, err);
+                        if (err?.deliveryStopped) {
+                            this.store.markDeliveryFailed(item.id);
+                            return;
+                        }
+                        const localFailure = String(err?.code || '').startsWith('SQLITE_');
+                        if (localFailure || this.store.hasUnknownDeliveryOperation(item.id)) {
+                            let custody = this.localDeliveryRetryCustody.get(chatId);
+                            if (!custody) {
+                                custody = new Set();
+                                this.localDeliveryRetryCustody.set(chatId, custody);
+                            }
+                            custody.add(item.id);
+                            let failures = 10;
+                            try {
+                                failures = this.store.deferLocalDelivery(item.id, localFailure ? 'local_checkpoint' : 'unknown_requires_audit');
+                                custody.delete(item.id);
+                            }
+                            catch { /* Retry custody remains live even if SQLite cannot record it yet. */ }
+                            retryScheduled = true;
+                            this.scheduleDeliveryRetry(chatId, failures, true);
+                            return;
+                        }
                         const willRetry = this.store.retryDelivery(item.id, DELIVERY_MAX_ATTEMPTS);
                         if (willRetry) {
                             retryScheduled = true;
@@ -3374,14 +3607,6 @@ export class FeishuBot {
             const storedContent = [displayReply, ...parsedReply.attachments.map((a) => `[Attachment: ${a.type || "file"} ${a.path}]`)]
                 .filter(Boolean)
                 .join("\n");
-            this.store.insert({
-                chatId,
-                messageId: `self-${this.config.name}-discuss-${Date.now()}-${Math.random().toString(36).slice(2)}`,
-                senderType: "bot",
-                senderName: this.config.name,
-                content: storedContent,
-                timestamp: Date.now(),
-            });
             try {
                 await this.enqueueAndDispatchDelivery(chatId, "discussion", `discussion:${Date.now()}:${Math.random().toString(36).slice(2)}`, isVisible ? displayReply : "", parsedReply.attachments, undefined, undefined, this.config.model);
             }
@@ -4174,31 +4399,47 @@ export class FeishuBot {
                 reaction_type: { emoji_type: emojiType },
             },
         });
-        return resp.data?.reaction_id;
+        const id = resp.data?.reaction_id;
+        if (resp.code !== 0 || !id)
+            throw new Error('Reaction add receipt not confirmed');
+        return id;
     }
     /**
      * Remove a reaction by emoji type from a message.
      * Finds the bot's own reaction of that type and deletes it.
      */
-    async removeReaction(messageId, emojiType) {
-        try {
-            const resp = await this.client.im.messageReaction.list({
-                path: { message_id: messageId },
-                params: { reaction_type: emojiType },
-            });
-            const items = resp.data?.items || [];
-            for (const item of items) {
-                if (item.reaction_id) {
-                    await this.client.im.messageReaction.delete({
-                        path: { message_id: messageId, reaction_id: item.reaction_id },
-                    });
-                    break;
-                }
-            }
-        }
-        catch {
-            // ignore
+    async removeReaction(messageId, emojiType, reactionId) {
+        const remove = async (id) => {
+            const deleted = await this.client.im.messageReaction.delete({ path: { message_id: messageId, reaction_id: id } });
+            if (deleted.code !== 0)
+                throw new Error('Reaction removal not confirmed');
+        };
+        if (reactionId) {
+            await remove(reactionId);
+            return;
         }
+        // Migration of pre-receipt records: never guess ownership from list order
+        // or operator_type alone. Feishu operator_id is the bot's open identity.
+        if (!this.botOpenId)
+            throw new Error('Own reaction operator identity unavailable');
+        let page;
+        const seen = new Set();
+        do {
+            const response = await this.client.im.messageReaction.list({ path: { message_id: messageId }, params: { reaction_type: emojiType, page_token: page, page_size: 100 } });
+            if (response.code !== 0)
+                throw new Error('Reaction lookup not confirmed');
+            const data = response.data;
+            for (const item of data?.items || []) {
+                if (item.reaction_id && item.operator?.operator_type === 'app' && item.operator.operator_id === this.botOpenId &&
+                    (!item.reaction_type?.emoji_type || item.reaction_type.emoji_type === emojiType))
+                    await remove(item.reaction_id);
+            }
+            page = data?.has_more ? data.page_token : undefined;
+            if (data?.has_more && (!page || seen.has(page)))
+                throw new Error('Incomplete reaction ownership pagination');
+            if (page)
+                seen.add(page);
+        } while (page);
     }
     async handleLocaleCommand(chatId, chatType, messageId, text) {
         if (chatType === "p2p") {
@@ -4622,6 +4863,10 @@ export class FeishuBot {
             // Go supervision: a reset replaces the executor session generation; pause
             // supervision instead of letting the checker judge a wiped transcript.
             void this.goController?.onExecutorSessionChanged(chatId, "执行会话被 /reset");
+            this.stopEpoch.set(chatId, this.store.bumpStopGeneration(this.config.name, chatId));
+            this.store.stopInsertions(this.config.name, chatId);
+            this.store.cancelReactionIntents(this.config.name, chatId, this.stopGeneration(chatId));
+            void this.openclawClient.cancelSteerSession?.(sessionKey, this.stopGeneration(chatId)).catch(() => { });
             // Fire reset (no response expected)
             this.openclawClient.resetSession(sessionKey).catch(() => { });
             // Wait a moment for it to take effect
@@ -4648,19 +4893,22 @@ export class FeishuBot {
         try {
             // Bump the stop generation FIRST so any in-flight auto-retry loop sees the
             // cancellation on its next iteration and stops retrying immediately.
-            this.stopEpoch.set(chatId, (this.stopEpoch.get(chatId) || 0) + 1);
-            // Abort all active runs for this session (chat.abort with no runId).
-            await this.openclawClient.abortChat(sessionKey).catch(() => { });
-            // Force-unlock the busy gate so queued messages can be processed.
-            this.busyChats.set(chatId, 0);
-            // Drop every pending trigger for this bot/chat so the stuck run is not retried.
+            this.stopEpoch.set(chatId, this.store.bumpStopGeneration(this.config.name, chatId));
+            this.store.cancelReactionIntents(this.config.name, chatId, this.stopGeneration(chatId));
+            void this.reconcileReactions(chatId).catch(() => { });
+            this.store.stopInsertions(this.config.name, chatId);
+            void this.openclawClient.cancelSteerSession?.(sessionKey, this.stopGeneration(chatId)).catch(() => { });
+            this.forceExpireQueueOwner(chatId, 'explicit user stop');
+            // Capture/retire only pre-stop custody synchronously. A later user
+            // input must survive the abort RPC await and keep its own reaction list.
             const cleared = this.store.clearAllPendingTriggers(this.config.name, chatId);
-            // Clear stuck Typing/Get reactions on queued messages.
             const acks = this.pendingAckMessages.get(chatId) || [];
-            for (const ack of acks) {
-                await this.removeReaction(ack.messageId, ack.emoji).catch(() => { });
-            }
             this.pendingAckMessages.set(chatId, []);
+            for (const ack of acks)
+                void this.receiptReaction(chatId, ack.rowId, ack.messageId, '').catch(() => { });
+            await this.openclawClient.abortChat(sessionKey).catch(() => { });
+            if (!this.queueRuns.has(chatId))
+                this.busyChats.set(chatId, 0);
             const locale = this.chatLocale(chatId);
             await this.replyMessage(messageId, locale === "en"
                 ? `⏹️ Stopped. Aborted the active run, unlocked the queue, and cleared ${cleared} pending message(s). You can send a new message now.`