sintbot 1.4.8 → 1.4.9

package/CHANGELOG.en.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "1.4.9",
+    "date": "2026-11-10",
+    "name": "Failure completion and reply card improvements",
+    "items": [
+      {
+        "t": "Fix: a reply card could remain in progress after a failed task",
+        "d": "After a confirmed executor error and exit, the existing card shows a failure and the group can handle the next message. Without an open card, one failure notice is sent. Uncertain delivery remains held without automatic retries."
+      },
+      {
+        "t": "Improve: reply cards show the actual model and reasoning effort",
+        "d": "The final card shows the selected model and effort. If an unsupported effort falls back to the model default, it no longer shows that rejected effort. Long durations use minutes or hours, and absent usage no longer appears as zero tokens."
+      },
+      {
+        "t": "Fix: answers stayed at the old card position after a busy-turn follow-up",
+        "d": "After Codex confirms a follow-up landed, the reply card moves beneath that message. An open card is copied to the new position before the old one is recalled."
+      }
+    ]
+  },
   {
     "version": "1.4.8",
     "date": "2026-11-10",

package/CHANGELOG.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "1.4.9",
+    "date": "2026-11-10",
+    "name": "故障收尾与回复卡片优化",
+    "items": [
+      {
+        "t": "修复：执行失败后回复卡仍停在处理中",
+        "d": "执行器明确报错并确认退出后，原卡片显示失败，群可继续处理下一条消息；没有卡片时只发一条失败提示。发送结果不明时仍保留现场，不自动重试。"
+      },
+      {
+        "t": "优化：回复卡片显示实际模型和推理强度",
+        "d": "完成时在卡片底部显示本轮选用的型号与强度；如果强度被拒后回退默认，不再显示被拒的强度。长任务耗时改用分和小时，未报告用量时不显示零 token。"
+      },
+      {
+        "t": "修复：忙时补话后答案还留在旧卡片位置",
+        "d": "Codex 确认收到补话后，回复卡会跟到那条消息下方；卡片已出现时先将内容追平到新卡，再撤回旧卡。"
+      }
+    ]
+  },
   {
     "version": "1.4.8",
     "date": "2026-11-10",

package/docs/AI-ASSISTED-INSTALL.md

@@ -1,4 +1,4 @@
-# Install SintBot 1.4.8 with an AI assistant
+# Install SintBot 1.4.9 with an AI assistant
 
 English · [简体中文](./zh-CN/AI-ASSISTED-INSTALL.md)
 
@@ -15,5 +15,5 @@ Use the terminal on the Mac that will run SintBot. A cloud shell cannot install
 ## Copyable request
 
 ```text
-Install SintBot 1.4.8 on this Mac using the one-line installation guide. Preserve existing services, configuration, state and Codex or Claude Code account data. Do not expose credentials. Verify the actual installed executable and binary core, configure the Feishu groups with their runners, and initialize only clean new state. Run the foreground preflight and an authorized read-only group test, check the result, then verify clean stop/restart. Stop temporary processes when finished, and distinguish package installation from successful group acceptance.
+Install SintBot 1.4.9 on this Mac using the one-line installation guide. Preserve existing services, configuration, state and Codex or Claude Code account data. Do not expose credentials. Verify the actual installed executable and binary core, configure the Feishu groups with their runners, and initialize only clean new state. Run the foreground preflight and an authorized read-only group test, check the result, then verify clean stop/restart. Stop temporary processes when finished, and distinguish package installation from successful group acceptance.
 ```

package/docs/install.md

@@ -1,4 +1,4 @@
-# Install SintBot 1.4.8
+# Install SintBot 1.4.9
 
 English · [简体中文](./zh-CN/install.md)
 
@@ -10,7 +10,7 @@ You need a Mac, Node.js 22 or newer, and projects stored on that Mac. Install an
 curl -fsSL https://sintbot.com/install.sh | bash
 ```
 
-The installer checks the environment, installs `sintbot@1.4.8` into `~/.local/share/sintbot`, and verifies the entry, built-in core and Feishu module. Continue when you see `Installed and verified SintBot 1.4.8`. No sudo is needed.
+The installer checks the environment, installs `sintbot@1.4.9` into `~/.local/share/sintbot`, and verifies the entry, built-in core and Feishu module. Continue when you see `Installed and verified SintBot 1.4.9`. No sudo is needed.
 
 To preview, append `-s -- --dry-run`. To choose another location, set `SINTBOT_INSTALL_DIR` and adjust the executable paths below.
 

package/docs/zh-CN/AI-ASSISTED-INSTALL.md

@@ -1,4 +1,4 @@
-# 用 AI 助手安装 SintBot 1.4.8
+# 用 AI 助手安装 SintBot 1.4.9
 
 [English](../AI-ASSISTED-INSTALL.md) · 简体中文
 
@@ -15,5 +15,5 @@
 ## 可复制的请求
 
 ```text
-按一行安装指南，在这台 Mac 安装 SintBot 1.4.8。保留已有服务、配置、状态和 Codex 或 Claude Code 账号数据，不输出凭据。验证实际入口与二进制核心，配置飞书群及各群的执行器，只对全新状态初始化。运行前台预检和已授权的只读群测试，对照结果，再验证正常停止与重启。完成后停止临时进程，并区分程序包安装与群验收结果。
+按一行安装指南，在这台 Mac 安装 SintBot 1.4.9。保留已有服务、配置、状态和 Codex 或 Claude Code 账号数据，不输出凭据。验证实际入口与二进制核心，配置飞书群及各群的执行器，只对全新状态初始化。运行前台预检和已授权的只读群测试，对照结果，再验证正常停止与重启。完成后停止临时进程，并区分程序包安装与群验收结果。
 ```

package/docs/zh-CN/install.md

@@ -1,4 +1,4 @@
-# 安装 SintBot 1.4.8
+# 安装 SintBot 1.4.9
 
 [English](../install.md) · 简体中文
 
@@ -10,7 +10,7 @@
 curl -fsSL https://sintbot.com/install.sh | bash
 ```
 
-安装器会自动检查环境，把 `sintbot@1.4.8` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.8` 就可以继续。不需要 sudo。
+安装器会自动检查环境，把 `sintbot@1.4.9` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.9` 就可以继续。不需要 sudo。
 
 可选预览：在命令末尾加 `-s -- --dry-run`。要自定义安装位置，设置 `SINTBOT_INSTALL_DIR` 环境变量，并同步修改后面的可执行文件路径。
 

package/install.sh

@@ -2,7 +2,7 @@
 # The function is parsed in full before installation starts, including when piped.
 sintbot_install() (
   set -eu
-  version=1.4.8
+  version=1.4.9
   prefix="${SINTBOT_INSTALL_DIR:-$HOME/.local/share/sintbot}"
   fail() { printf 'SintBot: %s\n' "$*" >&2; exit 1; }
   case "${1:-}" in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sintbot",
-  "version": "1.4.8",
+  "version": "1.4.9",
   "private": false,
   "description": "Drive your Mac projects from Feishu groups with Codex or Claude Code, using a built-in agent core.",
   "bin": {

package/src/agent/privatecore.js

@@ -3,7 +3,7 @@ const fs = require('node:fs')
 const path = require('node:path')
 const { createHash } = require('node:crypto')
 
-const EXPECTED_SHA256 = '1ab99efd538588accb90756aff9843063337cf666a679b2897630477c912bdf0'
+const EXPECTED_SHA256 = '70bb1b33ba1d9f3249659a4721ed047350f866dd2b3601a67376df604a23b3fd'
 let bytes
 try {
   bytes = fs.readFileSync(path.join(__dirname, 'privatecore.wasm'))

package/src/core/c2cardterminalpath.js

@@ -9,6 +9,7 @@ const { prepareTerminalEffectBridge, terminalReplyText } = require('./c2terminal
 const { stripMilestones } = require('./turnprogress')
 
 function prepareCardTerminalPath({ runtime, payloadHandles, platform, replyCtx,
+  cardAnchor = null, preferPlain = false,
   receiptId, chatId, turnToken, generation, verifyGeneration,
   applyLocalEffect, assertWriterLock, sendPlainReply = null, redactText = value => value,
   now = Date.now } = {}) {
@@ -20,7 +21,8 @@ function prepareCardTerminalPath({ runtime, payloadHandles, platform, replyCtx,
         typeof sendPlainReply !== 'function')) {
     throw new TypeError('C2 card terminal path needs one exact message target')
   }
-  if (sendPlainReply !== null && typeof sendPlainReply !== 'function') {
+  if (typeof preferPlain !== 'boolean' ||
+      sendPlainReply !== null && typeof sendPlainReply !== 'function') {
     throw new TypeError('C2 plain reply needs one strict sender')
   }
   if (typeof redactText !== 'function' ||
@@ -28,6 +30,27 @@ function prepareCardTerminalPath({ runtime, payloadHandles, platform, replyCtx,
     throw new TypeError('C2 card text redaction must be synchronous')
   }
   const targetCtx = Object.freeze({ ...replyCtx })
+  const landedAnchor = anchor => {
+    if (!anchor || !/^[0-9a-f]{32}$/.test(anchor.receiptId || '') ||
+        anchor.replyCtx?.chatId !== chatId ||
+        typeof anchor.replyCtx.messageId !== 'string' ||
+        !anchor.replyCtx.messageId) {
+      throw new TypeError('C2 card anchor needs one landed follow-up')
+    }
+    const snapshot = runtime.snapshot()
+    const steer = snapshot.state?.lanes?.steer?.[chatId]
+    const followup = snapshot.receipts?.pending?.find(item => item.id === anchor.receiptId)
+    if (steer?.parentReceiptId !== receiptId || steer.turnToken !== turnToken ||
+        steer.generation !== generation ||
+        !steer.entries?.some(item => item.receiptId === anchor.receiptId &&
+          item.status === 'landed') || followup?.chatId !== chatId ||
+        followup.source !== 'message' ||
+        followup.sourceId !== anchor.replyCtx.messageId) {
+      throw new Error('C2 card anchor differs from landed steer receipt')
+    }
+    return Object.freeze({ ...anchor.replyCtx })
+  }
+  let activeAnchorCtx = cardAnchor ? landedAnchor(cardAnchor) : targetCtx
   // Registration is durable before open() can expose any runner callback.
   const terminal = prepareTerminalEffectBridge({ runtime, payloadHandles,
     receiptId, chatId, turnToken, generation, verifyGeneration,
@@ -36,6 +59,7 @@ function prepareCardTerminalPath({ runtime, payloadHandles, platform, replyCtx,
     chatId, turnToken, generation, verifyGeneration })
   let phase = 'prepared'
   let card = null
+  let lastCardText = ''
   let suppressedCard = false
   const fail = error => { phase = 'closed'; runtime.close(); throw error }
   const canUsePlain = before => {
@@ -62,13 +86,13 @@ function prepareCardTerminalPath({ runtime, payloadHandles, platform, replyCtx,
       }
       phase = 'opening'
       const before = runtime.snapshot()
-      if (typeof platform.createStreamingCard !== 'function') {
+      if (preferPlain || typeof platform.createStreamingCard !== 'function') {
         if (!canUsePlain(before)) return fail(new Error('C2 plain reply lacks unopened card proof'))
         phase = 'plain'
         return false
       }
       try {
-        card = await platform.createStreamingCard(targetCtx,
+        card = await platform.createStreamingCard(activeAnchorCtx,
           { operationKey: receiptId, operationBoundary })
         if (!card && canUsePlain(before)) {
           phase = 'plain'
@@ -95,7 +119,37 @@ function prepareCardTerminalPath({ runtime, payloadHandles, platform, replyCtx,
       }
       if (suppressedCard) throw new Error('C2 suppressed card cannot stream an update')
       if (typeof text !== 'string') throw new TypeError('C2 card update needs process-local text')
-      if (card) card.update(redactText(text))
+      if (card) {
+        lastCardText = redactText(text)
+        card.update(lastCardText)
+      }
+    },
+    async relocate(anchor) {
+      const nextCtx = landedAnchor(anchor)
+      if (phase !== 'open' || !card) return false
+      if (activeAnchorCtx.messageId === nextCtx.messageId) return true
+      if (!lastCardText) throw new Error('C2 card move has no visible text to replay')
+      phase = 'relocating'
+      try {
+        if (await card.flush() !== true) throw new Error('C2 old card flush unconfirmed')
+        // A different operation key gives each card its own durable create,
+        // post, frame and delete identities under the same running turn.
+        const fresh = await platform.createStreamingCard(nextCtx, {
+          operationKey: `${receiptId}:followup:${anchor.receiptId}`,
+          operationBoundary,
+        })
+        if (!fresh || typeof fresh.update !== 'function' ||
+            typeof fresh.flush !== 'function' || typeof fresh.recall !== 'function') {
+          throw new Error('C2 moved card has no durable writer')
+        }
+        fresh.update(lastCardText)
+        if (await fresh.flush() !== true) throw new Error('C2 moved card text unconfirmed')
+        if (await card.recall() !== true) throw new Error('C2 old card delete unconfirmed')
+        card = fresh
+        activeAnchorCtx = nextCtx
+        phase = 'open'
+        return true
+      } catch (error) { return fail(error) }
     },
     async flushForTerminal() {
       if (phase !== 'open' || !card || await card.flush() !== true) {
@@ -131,7 +185,8 @@ function prepareCardTerminalPath({ runtime, payloadHandles, platform, replyCtx,
         return true
       } catch (error) { return fail(error) }
     },
-    async complete({ payload, replyText, paused = false, footer = '', milestones = [] } = {}) {
+    async complete({ payload, replyText, paused = false, footer = '',
+      footerDetail = '', milestones = [] } = {}) {
       if (phase !== 'open' && phase !== 'plain') {
         throw new Error('C2 card terminal path is not open')
       }
@@ -144,7 +199,8 @@ function prepareCardTerminalPath({ runtime, payloadHandles, platform, replyCtx,
             typeof terminalPayload.quiet !== 'boolean' || terminalPayload.quiet !== receipt.quiet ||
             typeof terminalPayload.resultText !== 'string' ||
             typeof terminalPayload.bufferText !== 'string' ||
-            typeof footer !== 'string' || !Array.isArray(milestones) ||
+            typeof footer !== 'string' || typeof footerDetail !== 'string' ||
+            !Array.isArray(milestones) ||
             !milestones.every(item => typeof item === 'string' && item.trim())) {
           throw new TypeError('C2 card terminal payload differs from running turn')
         }
@@ -190,7 +246,7 @@ function prepareCardTerminalPath({ runtime, payloadHandles, platform, replyCtx,
               // card's "process" fold; an answer that was only milestones shows
               // them as its body. The durable reply text stays exact.
               let shownText = visibleText
-              const finishOpts = { footer }
+              const finishOpts = { footer, footerDetail }
               if (milestones.length) {
                 const stripped = stripMilestones(visibleText)
                 if (stripped.trim()) {

package/src/core/c2durableruntime.js

@@ -1204,16 +1204,56 @@ class C2DurableRuntime {
   // Isolated v2 terminal boundary. The callback is registered before the
   // runner is exposed, and only this process can prove which pending receipt
   // was actually dispatched. No text or reply context enters the journal.
-  registerTerminalCallback({ receiptId, generation, registeredAt } = {}) {
+  registerTerminalCallback({ receiptId, generation, registeredAt, reuse = false } = {}) {
     this.#completionCapacity()
     const id = callbackRegistrationId({ receiptId, generation,
       domain: 'terminal', kind: 'finalizeEffectCommit' })
+    if (reuse) {
+      const prior = this.#journal.lookupRegistration(id)
+      if (prior) {
+        if (prior.receiptId !== receiptId || prior.generation !== generation ||
+            prior.domain !== 'terminal' || prior.kind !== 'finalizeEffectCommit' ||
+            prior.ordinal !== 0) throw new Error('C2 terminal registration identity differs')
+        return prior
+      }
+    }
     const result = this.#journal.registerCallback({ id, receiptId, generation,
       domain: 'terminal', kind: 'finalizeEffectCommit', ordinal: 0, registeredAt })
     if (this.#journal.byteLength >= this.#maxJournalBytes) this.#sealForCapacity()
     return result
   }
 
+  assertClosedFailureReady({ receiptId, chatId, turnToken, generation,
+    verifyGeneration, assertWriterLock } = {}) {
+    const before = this.#completionCapacity()
+    const witness = this.#activeRuns.get(chatId)
+    const proof = this.#journal.lookupRunnerClosed(
+      `sbot-c2-runner-closed-v1:${receiptId}:${generation}`)
+    const receipt = before.receipts.pending.find(item => item.id === receiptId)
+    const dispatch = proof && this.#journal.effectDescriptor(proof.dispatchEffectId)
+    if (this.blocked || assertWriterLock?.() !== true ||
+        verifyGeneration?.({ receiptId, chatId, turnToken, generation }) !== true ||
+        receipt?.chatId !== chatId || witness?.receiptId !== receiptId ||
+        witness.turnToken !== turnToken || proof?.receiptId !== receiptId ||
+        proof.chatId !== chatId || proof.turnToken !== turnToken ||
+        proof.generation !== generation || dispatch?.type !== 'dispatch' ||
+        dispatch.scope !== chatId || dispatch.receiptId !== receiptId ||
+        dispatch.turnToken !== turnToken ||
+        this.#journal.effectStatus(proof.dispatchEffectId) !== 'acked' ||
+        !this.#journal.hasEvent(`sbot-c2-session-close-v1:${receiptId}:${generation}`) ||
+        before.state.lanes.session?.[chatId]?.closeSeen !== true ||
+        before.state.lanes.turn?.[chatId]?.active !== turnToken ||
+        before.state.lanes.handoff?.[chatId]?.phase !== 'running' ||
+        before.state.lanes.steer?.[chatId]?.entries?.some(item => item.status !== 'landed') ||
+        [...before.effects].some(([id, status]) =>
+          this.#journal.effectDescriptor(id)?.scope === chatId && status !== 'acked') ||
+        !isDeepStrictEqual(this.#coordinator.snapshot(), before.state)) {
+      this.close()
+      throw new Error('C2 failure terminal lacks settled durable proof')
+    }
+    return true
+  }
+
   commitTerminalEffect({ receiptId, generation, turnToken, payload } = {}) {
     this.#completionCapacity()
     if (!RECEIPT_ID.test(receiptId) || !GENERATION.test(generation) ||
@@ -2200,7 +2240,7 @@ class C2DurableRuntime {
   // this yet. It executes one externally visible reply only after a durable
   // attempt; a lost ACK leaves the receipt and effect ambiguous on restart.
   async executeTerminalEffect({ effectId, receiptId, chatId, turnToken, generation,
-    verifyGeneration, resolveTarget, perform, confirm } = {}) {
+    verifyGeneration, resolveTarget, perform, confirm, assertWriterLock = () => true } = {}) {
     const before = this.#completionCapacity()
     if (typeof effectId !== 'string' || !RECEIPT_ID.test(receiptId) ||
         typeof chatId !== 'string' || !chatId || !GENERATION.test(generation) ||
@@ -2242,7 +2282,8 @@ class C2DurableRuntime {
         descriptor.receiptId !== receiptId || descriptor.targetId !== null ||
         this.#journal.effectStatus(effectId) !== 'pending' ||
         registration?.generation !== generation || registration.receiptId !== receiptId ||
-        verifyGeneration({ chatId, receiptId, turnToken, generation }) !== true) {
+        verifyGeneration({ chatId, receiptId, turnToken, generation }) !== true ||
+        assertWriterLock() !== true) {
       throw new Error('C2 terminal effect lacks exact live authority')
     }
     if (expectedType === 'quietCompletion') {
@@ -2278,13 +2319,16 @@ class C2DurableRuntime {
         const reply = await perform({ effectId, target })
         confirmed = confirm(reply) === true &&
           this.#effectAuthorityReady &&
+          assertWriterLock() === true &&
           verifyGeneration({ chatId, receiptId, turnToken, generation }) === true
       } catch { /* External outcome is unknown after the durable attempt. */ }
       const now = this.#now()
       const resolvedAt = Number.isSafeInteger(now) && now > 0
         ? Math.max(attemptedAt, now) : attemptedAt
       if (!confirmed) {
-        this.#journal.recordEffectOutcome({ effectId, status: 'unknown', resolvedAt })
+        if (assertWriterLock() === true) {
+          this.#journal.recordEffectOutcome({ effectId, status: 'unknown', resolvedAt })
+        }
         this.close()
         throw new Error('C2 final reply outcome unknown; manual recovery required')
       }

package/src/core/c2localeffectexecutor.js

@@ -147,12 +147,11 @@ function createC2LocalEffectExecutor({ journal, store, resolveTurn,
     const chatId = descriptor.scope
     if (effect.type === 'verifyTurn' && effect.success === false) {
       const outcome = journal.snapshot().state.lanes.terminal?.[chatId]?.outcome
-      // A known quota failure says nothing about credential validity. The
+      // A failed task alone says nothing about credential validity. The
       // binary's failed verification intent is acknowledged without writing
       // a false success or altering the previous credential-health record.
-      if (outcome?.status !== 'error' || outcome.quotaError !== true ||
-          outcome.sideEffects !== false) {
-        throw new Error('C2 local effect payload differs: failed verification lacks a supported quota outcome')
+      if (outcome?.status !== 'error') {
+        throw new Error('C2 local effect payload differs: failed verification lacks a core error outcome')
       }
       return true
     }

package/src/core/c2terminaleffectbridge.js

@@ -6,6 +6,9 @@
 // receive only the v2 decision and stable effect/receipt identities.
 const { C2DurableRuntime } = require('./c2durableruntime')
 const { C2PayloadHandles } = require('./c2payloadhandles')
+const { engineTerminalStep } = require('../agent/privatecore')
+
+const FAILURE_NOTICE = '本次任务执行失败。若已执行过工具，请先核对实际结果，再决定是否重试。'
 
 const RECEIPT_ID = /^[0-9a-f]{32}$/
 const GENERATION = /^[0-9a-f]{32}$/
@@ -23,6 +26,14 @@ function terminalReplyText(payload) {
       typeof payload.answerText !== 'string') {
     throw new TypeError('C2 terminal reply text fields invalid')
   }
+  // The core classifies the result; the host supplies a fixed display string.
+  // Neither a provider error nor unfinished assistant text is a final answer.
+  if (payload.source === 'result' && payload.isError === true) {
+    const event = { ...payload, type: 'finalize' }
+    delete event.receiptId; delete event.turnToken; delete event.quiet
+    if (engineTerminalStep({ finalized: false, outcome: null }, event)
+      .state.outcome.status === 'error') return FAILURE_NOTICE
+  }
   return (payload.answerText.trim() ? payload.answerText : payload.bufferText) ||
     payload.resultText
 }
@@ -106,7 +117,7 @@ function prepareTerminalEffectBridge({ runtime, payloadHandles, receiptId, chatI
           }
         }
         const effect = { effectId: final.effectId, receiptId, chatId,
-          turnToken, generation, verifyGeneration }
+          turnToken, generation, verifyGeneration, assertWriterLock }
         if (final.type === 'quietCompletion') {
           if (replyText !== undefined || resolveTarget !== undefined ||
               sendReply !== undefined || confirmReply !== undefined) {

package/src/core/v2engine.js

@@ -39,6 +39,31 @@ function humanDuration(ms) {
   if (minutes < 60) return `${minutes} 分 ${seconds % 60} 秒`
   return `${Math.floor(minutes / 60)} 小时 ${minutes % 60} 分`
 }
+// The final card is an accounting line: keep seconds for short turns and
+// switch to minutes/hours before a long turn becomes an unreadable number.
+function cardDuration(ms) {
+  const seconds = Math.max(0, Math.round(ms / 1000))
+  if (seconds < 60) return `${seconds} 秒`
+  const minutes = Math.floor(seconds / 60)
+  if (minutes < 60) return seconds % 60 ? `${minutes} 分 ${seconds % 60} 秒` : `${minutes} 分钟`
+  const hours = Math.floor(minutes / 60)
+  return minutes % 60 ? `${hours} 小时 ${minutes % 60} 分` : `${hours} 小时`
+}
+function cardModelInfo(group, provider) {
+  if (!provider) return { model: '', effort: '' }
+  const model = group?.model || provider.model ||
+    (provider.runner === 'codex' ? '' : provider.env?.ANTHROPIC_MODEL) || ''
+  const effort = provider.runner === 'codex'
+    ? provider.reasoningEffort : provider.env?.CLAUDE_CODE_EFFORT_LEVEL
+  const clean = value => String(value || '').replace(/\s+/g, ' ').trim()
+  return { model: clean(model), effort: clean(effort) }
+}
+function cardModelDetail(info, result) {
+  // A rejected configured effort may have been retried at the model default.
+  const fellBack = result?.effortFellBack || result?.result?.effortFellBack
+  return [info?.model, fellBack ? '' : info?.effort]
+    .filter(Boolean).join(' ')
+}
 // Group texts name the project by its folder only, never by a machine path.
 function projectName(group) {
   return String(group?.workdir || '').split(/[\\/]/).filter(Boolean).pop() || '（未设）'
@@ -104,9 +129,11 @@ const T = {
   skipPending: '正在跳过当前任务，这条消息没有处理，请稍后重发。',
   quotaFailure: 'Codex 订阅额度已用完，本次任务未完成。请恢复额度后重新发送；本次请求不会自动重试。',
   cardFooter: ({ ms, tokens }) => {
-    const parts = [`耗时 ${Math.max(0, Math.round(ms / 1000))} 秒`]
+    const parts = [`耗时 ${cardDuration(ms)}`]
     const tokenLabel = n => n >= 1000 ? (n / 1000).toFixed(1) + 'k' : String(n)
-    if (tokens) parts.push(`tokens ↑${tokenLabel((tokens.in || 0) + (tokens.cr || 0) + (tokens.cw || 0))} ↓${tokenLabel(tokens.out || 0)}`)
+    if (tokens && ((tokens.in || 0) + (tokens.cr || 0) + (tokens.cw || 0) + (tokens.out || 0)) > 0) {
+      parts.push(`tokens ↑${tokenLabel((tokens.in || 0) + (tokens.cr || 0) + (tokens.cw || 0))} ↓${tokenLabel(tokens.out || 0)}`)
+    }
     return parts.join(' · ')
   },
 }
@@ -136,6 +163,20 @@ function supportedV2QuotaFailure(payload, runnerResult) {
     outcome.sideEffects === false
 }
 
+// Admit only an observed, closed result on this release's no-retry route.
+// Error classification remains in the core; close/session/effect authority is
+// checked by the terminal path before any delivery can be attempted.
+function supportedV2ClosedFailure(payload, runnerResult) {
+  if (!payload || payload.source !== 'result' || payload.aborted ||
+      payload.sessionMissing || payload.transientNetwork || payload.hasQuota ||
+      payload.freshRetried || payload.resumedSessionCurrent ||
+      runnerResult?.aborted !== false) return false
+  const terminal = { ...payload, type: 'finalize' }
+  delete terminal.receiptId; delete terminal.turnToken; delete terminal.quiet
+  return engineTerminalStep({ finalized: false, outcome: null }, terminal)
+    .state.outcome.status === 'error'
+}
+
 function ordinaryV2Cohort(snapshot, jobs, binding, chatId, receiptId) {
   if (!Array.isArray(jobs) || !jobs.length ||
       jobs.some(job => !job || job.msg?.batch || job.msg?.synthetic ||
@@ -781,7 +822,9 @@ async _runDurableV2Steer(rt, receiptId) {
         invoke: () => control.steerDurable({ msgId: job.msg.msgId, text }) })
       entry.accepted = accepted
       if (accepted) {
-        if (entry.landed) authority.commitSteerObservation({ ...identity, type: 'landed' })
+        if (entry.landed) {
+          authority.commitSteerObservation({ ...identity, type: 'landed' })
+        }
         return { receiptId, steered: true, accepted: true, landed: entry.landed, staged: true }
       }
       if (entry.landed) throw new Error('C2 rejected steer also landed; outcome inconsistent')
@@ -803,9 +846,20 @@ async _runDurableV2Steer(rt, receiptId) {
       return { receiptId, queued: true, staged: true, accepted: false }
     })()
     rt.v2QueueNoticePromise = work
-    try { return await work }
+    let outcome
+    try { outcome = await work }
     catch (error) { authority.close(); rt.v2Controller?.abort(); this.durableV2SealCapacity?.(error); throw error }
     finally { if (rt.v2QueueNoticePromise === work) rt.v2QueueNoticePromise = null }
+    try {
+      if (outcome.accepted && entry.landed) {
+        await rt.v2SteerLandedChain
+        await rt.v2MoveCard?.(entry)
+      }
+      return outcome
+    } catch (error) {
+      authority.close(); rt.v2Controller?.abort(); this.durableV2SealCapacity?.(error)
+      throw error
+    }
   }
 
 async runDurableV2Stop(msg, platform) {
@@ -1203,7 +1257,8 @@ async _drainDurableV2NormalChain(initial) {
       const outcome = engineTerminalStep({ finalized: false, outcome: null },
         terminal).state.outcome
       const quotaFailure = supportedV2QuotaFailure(payload, rt.v2RunnerResult)
-      if (['error', 'empty', 'stopped'].includes(outcome.status) && !quotaFailure) {
+      const closedFailure = supportedV2ClosedFailure(payload, rt.v2RunnerResult)
+      if (['error', 'empty', 'stopped'].includes(outcome.status) && !quotaFailure && !closedFailure) {
         const classified = this.classifyDurableV2UnresolvedTurn({ ...identity,
           payload })
         const error = new Error('C2 v2 ordinary result requires fault recovery')
@@ -1214,7 +1269,7 @@ async _drainDurableV2NormalChain(initial) {
       if (payload.source !== 'result' || payload.sessionMissing ||
           (payload.hasQuota && !quotaFailure) || payload.transientNetwork || payload.freshRetried ||
           payload.resumedSessionCurrent ||
-          (!['ok', 'no-reply'].includes(outcome.status) && !quotaFailure)) {
+          (!['ok', 'no-reply'].includes(outcome.status) && !quotaFailure && !closedFailure)) {
         authority.close()
         const error = new Error('C2 v2 ordinary result needs a retry or notice decision')
         error.code = 'C2_V2_UNRESOLVED_TURN'
@@ -1232,7 +1287,7 @@ async _drainDurableV2NormalChain(initial) {
       for (const settledReceiptId of completed.settledReceiptIds ||
         [identity.receiptId]) {
         settled.push({ receiptId: settledReceiptId,
-          status: quotaFailure ? 'error' : silent ? 'silent' : 'answered',
+          status: quotaFailure || closedFailure ? 'error' : silent ? 'silent' : 'answered',
           terminalEffectId: completed.terminalEffectId })
       }
       if (authority.blocked) {
@@ -1436,7 +1491,12 @@ async startDurableV2Runner({ chatId, receiptId, turnToken, effectId } = {}) {
     rt.v2Doing = []
     rt.v2AutoMilestones = []
     rt.v2CardQuotaFailure = false
+    rt.v2CardModelInfo = null
     rt.v2CardBinding = null
+    rt.v2CardAnchor = null
+    rt.v2CardJoinedNames = []
+    rt.v2LastCardText = ''
+    rt.v2MoveCard = null
     rt.v2StreamRequested = false
     rt.v2StreamQuiescing = false
     rt.v2StreamChain = Promise.resolve()
@@ -1472,6 +1532,7 @@ async startDurableV2Runner({ chatId, receiptId, turnToken, effectId } = {}) {
       if (!provider || (provider.baseUrl && !provider.apiKey)) {
         throw new Error('C2 v2 runner provider unavailable')
       }
+      rt.v2CardModelInfo = cardModelInfo(job.group, provider)
       rt.v2SteerControl = null
       rt.v2SteerEntries = new Map()
       rt.v2SteerClosing = false
@@ -1516,6 +1577,7 @@ async startDurableV2Runner({ chatId, receiptId, turnToken, effectId } = {}) {
           if (rt.v2CardBinding?.opened) await rt.v2CardBinding.path.flushForTerminal()
           if (rt.v2RunnerGeneration !== generation) return
           authority.commitSteerObservation({ ...steerIdentity, receiptId: entry.identity.receiptId, type: 'landed' })
+          await rt.v2MoveCard?.(entry)
         })
         rt.v2SteerLandedChain = observation
         observation.catch(() => { authority.close(); controller?.abort() })
@@ -1531,6 +1593,8 @@ async startDurableV2Runner({ chatId, receiptId, turnToken, effectId } = {}) {
       rt.v2RunnerNotStarted = false
       let streamChain = Promise.resolve()
       let streamFailure = null
+      const joinedLine = () => rt.v2CardJoinedNames.length
+        ? `\n\n↪ 已加入 ${rt.v2CardJoinedNames.join('、')} 的补充` : ''
       // Card progress (same mechanism and wording as the legacy engine): deterministic
       // milestones and "recently doing" from tool calls, an early "received" card
       // and a pulse line. All of it is process-local card text; the card itself is
@@ -1547,6 +1611,7 @@ async startDurableV2Runner({ chatId, receiptId, turnToken, effectId } = {}) {
         rt.v2TerminalStarted || controller.signal.aborted || rt.v2CancelControl ||
         rt.v2StreamQuiescing || !!authority.scopeState('stopIntent', chatId)
       const enqueueCardText = text => {
+        rt.v2LastCardText = text
         rt.v2StreamRequested = true
         streamChain = streamChain.then(async () => {
           if (rt.v2QueueNoticePromise) await rt.v2QueueNoticePromise
@@ -1558,7 +1623,8 @@ async startDurableV2Runner({ chatId, receiptId, turnToken, effectId } = {}) {
           if (!rt.v2CardBinding) {
             const path = prepareCardTerminalPath({ runtime: authority,
               payloadHandles: this.durableV2Payloads, platform: job.platform,
-              replyCtx: job.msg.replyCtx, receiptId, chatId, turnToken,
+              replyCtx: job.msg.replyCtx, cardAnchor: rt.v2CardAnchor,
+              receiptId, chatId, turnToken,
               generation, verifyGeneration,
               applyLocalEffect: this.durableV2ApplyLocalEffect,
               assertWriterLock: this.durableV2AssertWriterLock,
@@ -1573,7 +1639,7 @@ async startDurableV2Runner({ chatId, receiptId, turnToken, effectId } = {}) {
             rt.v2CardBinding = { path, receiptId, turnToken,
               generation, opened }
           }
-          if (rt.v2CardBinding.opened) rt.v2CardBinding.path.update(text)
+          if (rt.v2CardBinding.opened) rt.v2CardBinding.path.update(text + joinedLine())
         })
         rt.v2StreamChain = streamChain
         streamChain.catch(error => {
@@ -1581,6 +1647,33 @@ async startDurableV2Runner({ chatId, receiptId, turnToken, effectId } = {}) {
           try { controller.abort() } catch {}
         })
       }
+      rt.v2MoveCard = entry => {
+        if (entry.movePromise) return entry.movePromise
+        const move = streamChain.then(async () => {
+          if (progressClosed() || job.platform.features?.cardPinned !== true) return false
+          const anchor = { receiptId: entry.identity.receiptId,
+            replyCtx: entry.job.msg.replyCtx }
+          const who = entry.job.msg.senderName || entry.job.msg.userId || 'user'
+          if (!rt.v2CardJoinedNames.includes(who)) rt.v2CardJoinedNames.push(who)
+          if (!rt.v2CardBinding) {
+            rt.v2CardAnchor = anchor
+            return true
+          }
+          if (!rt.v2CardBinding.opened) return false
+          rt.v2CardBinding.path.update((rt.v2LastCardText || progress.T.ackWorking) + joinedLine())
+          const moved = await rt.v2CardBinding.path.relocate(anchor)
+          if (moved) rt.v2CardAnchor = anchor
+          return moved
+        })
+        streamChain = move
+        rt.v2StreamChain = move
+        entry.movePromise = move
+        move.catch(error => {
+          streamFailure = error
+          try { controller.abort() } catch {}
+        })
+        return move
+      }
       const enqueueFrame = event => {
         if (event.type !== 'assistant') return
         // /status and the pulse read these; a late event from an older
@@ -1650,10 +1743,8 @@ async startDurableV2Runner({ chatId, receiptId, turnToken, effectId } = {}) {
           const sofar = buffer.trim()
           const body = autoBlock() + (sofar && !NO_REPLY.startsWith(sofar)
             ? progress.renderMilestones(buffer) + '\n\n' : '')
-          try {
-            binding.path.update(body + progress.T.pulse(
-              progress.humanDur(Date.now() - pulseFrom), rt.v2Doing, stale))
-          } catch { /* a closed card never affects the turn */ }
+          enqueueCardText(body + progress.T.pulse(
+            progress.humanDur(Date.now() - pulseFrom), rt.v2Doing, stale))
         }, PULSE_MS)
         if (pulseTimer.unref) pulseTimer.unref()
       }
@@ -1872,6 +1963,7 @@ async completeDurableV2CardTurn({ chatId, receiptId, turnToken, effectId,
     const projected = rt?.v2TerminalProjection
     const resultText = projected?.payload?.resultText
     const quotaFailure = supportedV2QuotaFailure(payload, rt?.v2RunnerResult)
+    const closedFailure = supportedV2ClosedFailure(payload, rt?.v2RunnerResult)
     if (!/^[0-9a-f]{32}$/.test(receiptId || '') ||
         !Number.isSafeInteger(turnToken) || turnToken <= 0 ||
         typeof effectId !== 'string' || !effectId ||
@@ -1903,10 +1995,9 @@ async completeDurableV2CardTurn({ chatId, receiptId, turnToken, effectId,
           (!isDeepStrictEqual(payload.batchReceiptIds, cohort.receiptIds) ||
             payload.replyTargetReceiptId !== receiptId)) ||
         !isDeepStrictEqual(payload, projected.payload) ||
-        // Only successful answers and binary-classified, side-effect-free
-        // quota failures use this no-retry terminal bridge. Unknown failures
-        // and lost-session outcomes still need a separate recovery decision.
-        payload.source !== 'result' || payload.aborted || (payload.isError && !quotaFailure) ||
+        // A deterministic failure is delivered once, after the same durable
+        // close checks as success. Retry and unknown outcomes stay sealed.
+        payload.source !== 'result' || payload.aborted || (payload.isError && !quotaFailure && !closedFailure) ||
         payload.sessionMissing || (payload.hasQuota && !quotaFailure) || payload.transientNetwork ||
         payload.freshRetried || payload.resumedSessionCurrent ||
         (replyText !== undefined && replyText !== terminalReplyText(projected.payload)) ||
@@ -1920,6 +2011,9 @@ async completeDurableV2CardTurn({ chatId, receiptId, turnToken, effectId,
       value.generation === generation && rt.v2RunnerGeneration === generation
     try {
       const preopened = rt.v2CardBinding
+      if (closedFailure) authority.assertClosedFailureReady({ receiptId, chatId,
+        turnToken, generation, verifyGeneration,
+        assertWriterLock: this.durableV2AssertWriterLock })
       if (preopened && (preopened.receiptId !== receiptId ||
           preopened.turnToken !== turnToken ||
           preopened.generation !== generation)) {
@@ -1927,7 +2021,8 @@ async completeDurableV2CardTurn({ chatId, receiptId, turnToken, effectId,
       }
       const path = preopened?.path || prepareCardTerminalPath({ runtime: authority,
         payloadHandles: handles, platform: job.platform,
-        replyCtx: job.msg.replyCtx, receiptId, chatId, turnToken, generation,
+        replyCtx: job.msg.replyCtx, cardAnchor: rt.v2CardAnchor, preferPlain: closedFailure,
+        receiptId, chatId, turnToken, generation,
         verifyGeneration, applyLocalEffect: this.durableV2ApplyLocalEffect,
         assertWriterLock: this.durableV2AssertWriterLock,
         redactText: text => redact(quotaFailure
@@ -1942,6 +2037,8 @@ async completeDurableV2CardTurn({ chatId, receiptId, turnToken, effectId,
       for (const text of updates) path.update(text)
       const footer = T.cardFooter({ ms: Math.max(0, Date.now() - rt.v2StartedAt),
         tokens: rt.v2UsageDecision?.tokens || null })
+      const footerDetail = job.platform.features?.cardQuota === true
+        ? cardModelDetail(rt.v2CardModelInfo, rt.v2RunnerResult) : ''
       // Milestones from tool calls first, then the model's own `>> ` lines;
       // the card shows them in its "process" fold (display only).
       rt.v2CardQuotaFailure = !!quotaFailure
@@ -1950,7 +2047,8 @@ async completeDurableV2CardTurn({ chatId, receiptId, turnToken, effectId,
         ...progress.milestonesOf(payload.bufferText)]
         .filter((m, i, a) => a.indexOf(m) === i).map(redactMilestone)
         .filter(m => typeof m === 'string' && m.trim())
-      const completed = await path.complete({ payload, replyText, paused, footer, milestones })
+      const completed = await path.complete({ payload, replyText, paused,
+        footer, footerDetail, milestones })
       const after = authority.snapshot()
       const queue = after.state?.lanes?.queue?.[chatId]?.queue
       let successor = null
@@ -2064,7 +2162,7 @@ classifyDurableV2UnresolvedTurn({ chatId, receiptId, turnToken, effectId,
       }
       rt.v2TerminalStarted = true
       authority.registerTerminalCallback({ receiptId, generation,
-        registeredAt: Date.now() })
+        registeredAt: Date.now(), reuse: true })
       return authority.commitUnresolvedClassification({ receiptId, generation,
         turnToken, status, payload,
         verifyGeneration: value => value.chatId === chatId &&

package/src/platform/feishu.js

@@ -605,7 +605,7 @@ function createFeishuPlatform({ appId, appSecret, botOpenId = null, onlyWhenMent
   }
 
   return {
-    features: { cardQuota: true, noticeCard: true }, // 飞书支持通知卡;企微/Slack 退回文本
+    features: { cardQuota: true, noticeCard: true, cardPinned: true }, // 回复卡钉在触发消息下;补话落地后可搬到新消息下
     async start(onMessage, hooks = {}) {
       if (!botOpenId && !onlyWhenMentioned) log('warning: feishu.botOpenId not set — cannot tell @bot from @others; all group messages will be handled')
       if (hooks.onFatal !== undefined && typeof hooks.onFatal !== 'function') {