wezard 2.3.0 → 2.4.0

package/dist/daemon/index.js

@@ -5,21 +5,24 @@ import { timingSafeEqual } from "node:crypto";
 import { loadOrCreateSvrToken } from "../shared/svr-token.js";
 import { DAEMON_TOKEN_FILE, DAEMON_TOKEN_HEADER } from "../shared/daemon-token.js";
 import { homedir } from "node:os";
-import { loadConfig } from "../shared/config.js";
+import { TIERS, loadConfig } from "../shared/config.js";
 import { makeLogger } from "../shared/log.js";
-import { clipLine, sleep } from "../shared/std.js";
+import { clipLine, sleep, truncate } from "../shared/std.js";
+import { patchJsonc } from "../shared/config-writer.js";
 import { EFFORTS, parseEffort } from "../shared/effort.js";
 import { bindCliBackends, projectDirsFor } from "../shared/cli-backends.js";
 import { startWs } from "./ws.js";
 import { startNetWatch } from "./net-watch.js";
 import { startHttp, json, readBody } from "./http.js";
-import { configGet, configSet } from "./config-api.js";
+import { parsePath } from "../shared/config-meta.js";
+import { applyHot, patchedTop, configGet, fromLegacy, legacyGet, pickTier, planSet, renderPlan, tierEvidence } from "./config-api.js";
+import { computeUsage, costOf, fmtCost, fmtTokens, sumTotal } from "./usage.js";
 import { installInboundRouter } from "./inbound.js";
 import { loadMirrorStore } from "./mirror-store.js";
 import { startMirror, installMirrorEventListener } from "./mirror-bridge.js";
 import { runTmux, setTmuxTimeoutReporter, spawnTmuxClaude } from "./spawn-tmux.js";
-import { installApprovalEventListener, makeApproveHandler } from "./approval.js";
-import { initDetailPersistence, makeDetailHandler, chatHandlers, configureRemoteForward, chatUrlFor, setWorldFactsProvider, recordPost, recordCharter, backfillCharter } from "./detail.js";
+import { installApprovalEventListener, makeApproveHandler, requestConfirm } from "./approval.js";
+import { initDetailPersistence, makeDetailHandler, chatHandlers, configureRemoteForward, chatUrlFor, setWorldFactsProvider, currentHumanQueryOf, recordPost, recordCharter, backfillCharter } from "./detail.js";
 import { EMPTY_FACTS } from "../shared/world.js";
 import { clearAutoWindow, initAutoWindowPersistence, setAutoWindow } from "./session-cache.js";
 import { makeMessageHandler } from "./outbound.js";
@@ -36,18 +39,21 @@ import { isQuiet, slugify, uniqueId } from "../shared/task-file.js";
 import { baseOfKey, bindTagLinker, isInternalKey, keyOf, linkTags, normalizeTag, tagFromCwd, tagHead, tagLink, tagOfKey, uniqueTag, withTagHeader } from "../shared/session-label.js";
 import { appendEpisode, clipForCharter, cwdOfMd, episodePath, inboxPath, mdsOf, proposedCwds, memoryPath, memoryRoot, proposeMemory, readMemory } from "./wizard-memory.js";
 import { retireStewardTask, startSteward, stewardEnvelope, STEWARD_ID, STEWARD_RUN_MS, STEWARD_TARGET } from "./memory-steward.js";
-import { applyChatNames, chatBaseOf, chatNameOf, clearChatName, listChatNames, normChatName, peerAddress, planChatNames, setChatName } from "./chat-name.js";
-import { bindWizardStore, loadWizardStore, wizardStore, settleName, settleAll, backfillBorn, sweepUnborn, BOOT_ID, evictStaleName, childrenOf, ancestorsOf, renderCharter, ROSTER_FRESH_MS, renderRoster, handoffAt, memoryNudgeAt, MEMORY_NUDGE_FLOOR, MEMORY_MAX, NOTE_MAX, } from "./wizard.js";
-import { bindNoticeBox, createNoticeBox, chatAudience } from "./notices.js";
-import { loadJobStore, jobEpisode, rejectReason, ACCEPTS, JOB_MEMBER_MAX } from "./jobs.js";
-import { cacheTtlSec, clipMiddle, contextFiles, firstStamp, parseClosing, lastContextTokens, lastExchange, lastModel, openingOf, replyClosedBefore, talkTurns, renderPeerEnvelope, renderReceiptEnvelope, renderTaskEnvelope } from "./peers.js";
+import { applyChatNames, chatBaseOf, chatNameOf, chatPolicyOf, clearChatName, listChatNames, normChatName, peerAddress, planChatNames, setChatName } from "./chat-name.js";
+import { bindWizardStore, loadWizardStore, wizardStore, settleName, settleAll, backfillBorn, sweepUnborn, BOOT_ID, evictStaleName, childrenOf, ancestorsOf, renderCharter, renderLead, renderLeadPlaybook, ROSTER_FRESH_MS, renderRoster, handoffAt, memoryNudgeAt, MEMORY_NUDGE_FLOOR, MEMORY_MAX, NOTE_MAX, } from "./wizard.js";
+import { bindNoticeBox, createNoticeBox, createSeenRing, gcSeen, chatAudience, hears } from "./notices.js";
+import { createLedger, digest, pendingGc, renderDigest, renderTable, renderAwaiting, renderStalled, renderShelved, ago as agoMs, HEARD_EVERY_MS } from "./pending-items.js";
+import { loadJobStore, dutyLine, awaitingAccept, stalledRoots, shelvedRoots, nudgeDue, dayClamp, childrenOf as jobChildren, jobEpisode, rejectReason, ACCEPTS, JOB_MEMBER_MAX, JOB_DEPTH_MAX, depthOf, ancestorsOf as jobAncestors, treeOrder, jobStage } from "./jobs.js";
+import { cacheTouchMs, cacheTtlSec, clipMiddle, contextFiles, firstStamp, parseClosing, lastContextTokens, lastExchange, lastModel, openingTurn, replyClosedBefore, talkTurns, renderPeerEnvelope, renderReceiptEnvelope, renderTaskEnvelope } from "./peers.js";
 import { keepalivePingSigs } from "../shared/keepalive.js";
 import { expandHome } from "../shared/paths.js";
 import { loadJsonMap } from "../shared/json-map-store.js";
-import { createReceipts, deadlineOf, kAttr, newTurn } from "./receipts.js";
+import { createReceipts, deadlineOf, kAttr, kOfAttr, newTurn } from "./receipts.js";
 import { renderInFlight } from "../shared/turn-state.js";
+import { startIdleNudge } from "./idle-nudge.js";
+import { renderReminder } from "../shared/reminder.js";
 import { createHandoffs, handedOff, handingOff } from "./handoff.js";
-import { rankCandidates, renderCandidates, wakeNoteOf } from "./route.js";
+import { coldGateOf, decide, rankCandidates, renderCandidates, tierFor, wakeNoteOf } from "./route.js";
 import { parseWhen, renderChatLog, UNKNOWN_HUMAN } from "./chat-log.js";
 import { audienceOf } from "../shared/role-view.js";
 import { startGraph, stopRun, getRun, listRuns, validateSpec, waitForIdle, waitForQuorum, } from "./graph.js";
@@ -150,9 +156,10 @@ const main = async () => {
             const t = bridge.targetForSession(sid);
             return t ? await bridge.interruptPane(t) : { ok: false, reason: "no mirror target for session" };
         },
+        // 告知那一句接着被取消的那一轮说: 频道照它的走 —— 不带频道就等于在 home 群里开口。
         tell: async (sid, text) => {
             const t = bridge.targetForSession(sid);
-            return t ? await bridge.injectText(t, text) : { ok: false, reason: "no mirror target for session" };
+            return t ? await bridge.injectText(t, text, undefined, { channel: bridge.currentChannel(t) }) : { ok: false, reason: "no mirror target for session" };
         },
     };
     const http = startHttp({ cfg, ws, log, sourcePath });
@@ -398,13 +405,8 @@ const main = async () => {
             const r = await m.newSession(target, name, body.cli, { cwd, model, keepalive, silent: true });
             if (!r.ok && !existed)
                 wizards.drop(target);
-            // r.model 是 spawnTmuxClaude 通过 /model 实测确认落地的那个 —— 可能跟调用方
-            // 传的原始字符串不一样 (口语化 → 目录里匹配到的关键词), 播报要报实情。
-            const modelNote = r.model
-                ? (r.modelWarning ? ` · 模型 ${r.model} (⚠️ ${r.modelWarning})` : ` · 模型 ${r.model}`)
-                : "";
             if (r.ok)
-                postRoster(base, [target, self], `新 wizard **.${name}** 就位${r.cwd ? ` · 工作区 ${r.cwd}` : ""}${modelNote}${keepalive ? "" : " · 已关闭 keepalive"} —— 空白起步, 由 ${displayName(self)} 造的`);
+                postRoster(base, [target, self], { op: "born", name: `.${name}`, by: displayName(self), cwd: r.cwd }, subjectOf(wizards.get(target)));
             json(res, r.ok ? 200 : 500, r.ok
                 ? {
                     ok: true,
@@ -633,8 +635,11 @@ const main = async () => {
             const id = audienceOf(channel, asker);
             return id === "human:" ? "" : id.slice("human:".length);
         };
+        // 挂起事项表 (见 pending-items.ts): 派活时记一行, 回执落定时由下面的 onOutcome 记账。
+        const ledger = createLedger(loadJsonMap(cfg.wrc.mirror.pendingFile, pendingGc));
         const receipts = createReceipts({
             idleNow: m.idleNow,
+            onOutcome: (s, status, bodyText, bySender) => ledger.outcome(s.from, s.turn ?? "", status, parseClosing(bodyText).text || bodyText, bySender),
             jobTally: (id) => jobs.tally(id),
             parkedNow: m.parkedNow,
             settleJob: (id, target, outcome, artifacts) => { jobs.settle(id, target, outcome, artifacts); },
@@ -658,7 +663,7 @@ const main = async () => {
                 // 只有 tell_peer 那条路登记 watcher, 这里是直接注入。
                 from: { kind: "peer", from: meta.from, receipt: true, status: meta.status, ...(meta.turn ? { turn: meta.turn } : {}), ...(meta.job ? { job: meta.job, done: meta.done, total: meta.total } : {}), ...(meta.asker ? { asker: meta.asker } : {}) },
                 channel: meta.channel,
-                envelope: renderReceiptEnvelope(displayName(meta.from), meta.channel ? chatNameOf(cfg, meta.channel) : undefined, meta.job ? { job: meta.job, done: meta.done, total: meta.total, closed: jobs.get(meta.job)?.status !== "open" } : undefined, meta.status, meta.turn || undefined, {
+                envelope: renderReceiptEnvelope(displayName(meta.from), meta.channel ? chatNameOf(cfg, meta.channel) : undefined, meta.job ? { job: meta.job, done: meta.done, total: meta.total, closed: jobs.get(meta.job)?.status !== "open", ...(jobs.get(meta.job)?.kind === "req" ? { req: true } : {}) } : undefined, meta.status, meta.turn || undefined, {
                     ...(meta.replyTo ? { replyTo: meta.replyTo.kind === "chat" ? chatNameOf(cfg, meta.replyTo.channel) : displayName(meta.replyTo.from) } : {}),
                     ...(meta.k ? { k: kAttr(meta.k) } : {}),
                     ...(meta.pending ? { pending: meta.pending } : {}),
@@ -678,15 +683,19 @@ const main = async () => {
             isBusy: m.isBusy,
             sessionId: (t) => m.sessionInfo(t)?.sessionId ?? "",
             restart: (t) => restartFresh(t),
-            // 欠着回执的发话方挂上它们的信封: 新会话那一轮就是在答它们, 回执照常按信封定位,
-            // 频道也接回原来那一句所在的地方 (私聊不进群)。
-            inject: (t, text, owe) => owe.length
-                ? m.injectText(t, text, undefined, {
-                    from: { kind: "peer", from: owe[0].from, ...(owe[0].turn ? { turn: owe[0].turn } : {}), ...(owe[0].asker ? { asker: owe[0].asker } : {}) },
-                    channel: owe[0].channel,
-                    envelope: owe.map((o) => envelopeFor(o.from, o.channel, o.turn ? { turn: o.turn } : undefined)).join(""),
-                })
-                : m.injectText(t, text),
+            // 欠着回执的发话方挂上它的信封: 新会话那一轮就是在答它, 回执照常按信封定位, 频道也接回
+            // 原来那一句所在的地方 (私聊不进群)。欠好几份时每份各开一轮 (见 carryRest): 并成一句,
+            // 那一轮就只有一个去向, 别的上游拿到的是答给第一份的话。
+            inject: async (t, text, owe, channel) => {
+                const [first, ...rest] = owe;
+                if (!first)
+                    return m.injectText(t, text, undefined, { channel });
+                const r = await m.injectText(t, text, undefined, carryOpts(first));
+                if (r.ok && rest.length)
+                    void carryRest(t, rest);
+                return r;
+            },
+            channelOf: m.currentChannel,
             lastText: m.lastText,
             answeredBefore: (to, from, since, until, turn) => {
                 const p = m.sessionInfo(to)?.jsonlPath;
@@ -707,6 +716,24 @@ const main = async () => {
                     log.warn({ target: e.target, name }, "handoff episode not archived");
             },
         });
+        /** 交接续答一份欠账的那一句: 挂发话方的信封, 出处与频道都是它当初那一句的。 */
+        function carryOpts(o) {
+            return {
+                from: { kind: "peer", from: o.from, ...(o.turn ? { turn: o.turn } : {}), ...(o.channel ? { public: true } : {}), ...(o.asker ? { asker: o.asker } : {}) },
+                channel: o.channel,
+                envelope: envelopeFor(o.from, o.channel, o.turn ? { turn: o.turn } : undefined),
+            };
+        }
+        /** 简报那一轮之后, 余下的欠账一份一轮: 等它接住上一句 (至多 20s 动起来) 并答完, 再贴下一份。 */
+        async function carryRest(t, owe) {
+            for (const o of owe) {
+                for (const end = Date.now() + 20_000; Date.now() < end && (await m.idleNow(t));)
+                    await sleep(1000);
+                await m.untilIdle(t, 3600_000);
+                const r = await m.injectText(t, `（交接续答）接着上面的简报: 你交接前还欠 ${displayName(o.from)} 一个交代${o.turn ? ` (件 \`${o.turn}\`)` : ""} —— 现在只就这件收口。`, undefined, carryOpts(o));
+                log.info({ mod: "handoff", target: t, from: o.from, turn: o.turn, ok: r.ok, reason: r.reason }, "handoff: 欠账续答");
+            }
+        }
         /** `self` 此刻这一轮派出去的活, 结论该交给谁 (见 receipts.parentOf)。只读它自己
          *  transcript 里开这一轮的那句 user 行的信封: attachment 上的 channel 在注入时就被
          *  排队的下一句改写了, transcript 才记着「这一轮是谁发起的」, reload 后也读得到。 */
@@ -714,7 +741,7 @@ const main = async () => {
         /** `target` 手上这一轮若是某个 wizard 派来的活: 发话方的称呼 (`.x`) 与件号。人 / 定时 / 回执轮 = undefined。 */
         const openingAsk = (target) => {
             const p = m.sessionInfo(target)?.jsonlPath;
-            const env = p ? openingOf(talkTurns(expandHome(p), 80, pingSigs, false, true))?.env : undefined;
+            const env = p ? openingTurn(expandHome(p), pingSigs)?.env : undefined;
             return env?.kind === "peer" && !env.receipt ? { from: env.from, ...(env.turn ? { turn: env.turn } : {}) } : undefined;
         };
         const currentAsk = (target) => {
@@ -729,7 +756,7 @@ const main = async () => {
             if (await m.idleNow(target))
                 return undefined;
             const p = m.sessionInfo(target)?.jsonlPath;
-            const env = p ? openingOf(talkTurns(expandHome(p), 80, pingSigs, false, true))?.env : undefined;
+            const env = p ? openingTurn(expandHome(p), pingSigs)?.env : undefined;
             if (env?.receipt)
                 return undefined;
             if (env?.kind === "peer")
@@ -738,11 +765,12 @@ const main = async () => {
         };
         const openingOfSelf = (self) => {
             const p = m.sessionInfo(self)?.jsonlPath;
-            return p ? openingOf(talkTurns(expandHome(p), 80, pingSigs, false, true)) : undefined;
+            return p ? openingTurn(expandHome(p), pingSigs) : undefined;
         };
         const parentKOf = (self) => {
             const opening = openingOfSelf(self);
-            return receipts.parentOf(self, opening?.env, channelOf(self), String(opening?.ms ?? 0));
+            // 不用 channelOf: 它把私聊轮 ("") 回落成 home, 私聊轮派出的活就会续回 home 群。
+            return receipts.parentOf(self, opening?.env, m.currentChannel(self), String(opening?.ms ?? 0));
         };
         /** `self` 此刻这一轮的链头 (见 Asker), 同样认开头那句的信封: 人在群里说的 → 信封上的
          *  userid 与群; 与人的单聊里没挂信封 → 那个人; 同伴派的活 / 回执 → 登记那件活时记下的;
@@ -760,6 +788,29 @@ const main = async () => {
         };
         // 交接先续做: 它的闸要在回执续守之前立起来, 否则续守的 watcher 会读到换了一半的会话。
         void m.restored.then(() => { handoffs.resume(); receipts.resume(); });
+        // 闲置追问 (见 idle-nudge.ts): 对方持续闲着又没回执 → 代发话方同件号问一句进展, 答复照常回执。
+        // 注入照抄工单打回 (rebound) 那条: 私聊信封挂发话方的名义与件号, 父 k 等由 reask 沿用原件。
+        void m.restored.then(() => startIdleNudge({
+            inflight: () => receipts.states(),
+            idleNow: m.idleNow,
+            handingOff,
+            jobOpen: (id) => jobs.get(id)?.status === "open",
+            policy: () => ({ afterMs: cfg.wrc.mirror.idleNudge.afterMin * 60_000, max: cfg.wrc.mirror.idleNudge.max }),
+            ask: async ({ from, to, turn, text }) => {
+                const x = receipts.reask(from, to, turn);
+                if (!x)
+                    return false;
+                ledger.touch(from, turn);
+                return (await m.injectText(to, text, undefined, {
+                    from: { kind: "peer", from, turn, ...(x.asker ? { asker: x.asker } : {}) },
+                    channel: x.channel,
+                    envelope: envelopeFor(from, x.channel, { turn, legs: x.legs, re: true }),
+                })).ok;
+            },
+            nameOf: displayName,
+            store: loadJsonMap(join(cfg.daemon.stateDir, "idle-nudges.json")),
+            log: log.child({ mod: "idle-nudge" }),
+        }));
         /** 入参里的地址: 新字段 `name`, 老 MCP 进程 (正在跑的 wizard) 仍在传 `tag`。 */
         const addrOf = (b) => String(b.name ?? b.tag ?? "");
         /** 撞上的名字属于一个静默超过一天的 wizard → 顶掉它 (见 evictStaleName), 同群的
@@ -770,7 +821,7 @@ const main = async () => {
                 return false;
             const slot = !!tagOfKey(gone.target);
             log.child({ mod: "wizard" }).info({ target: gone.target, name: gone.name, slot }, "stale name evicted");
-            postRoster(baseOfKey(gone.target), [], `**.${gone.name}** 静默超过一天, ${slot ? "已被同名的新 wizard 顶掉并收工" : "名字让给了同名的新 wizard"}`);
+            postRoster(baseOfKey(gone.target), [], { op: "ended", name: `.${gone.name}`, why: slot ? "evicted (idle >1d, name reused)" : "name yielded (idle >1d)" }, subjectOf(gone));
             return true;
         };
         /** 给一个要出生的 wizard 挑槽位 (target key) 并落定名字。名字全局唯一:
@@ -846,6 +897,16 @@ const main = async () => {
                 return;
             }
             const dests = [...new Set(refs.length ? refs.map((r) => chatBaseOf(cfg, r)) : [channelOf(self)])];
+            // 顶层模式: 只有顶层 wizard 对人说话。拦的是「这一轮在为同伴干活」的: 同伴私聊派来的活, 或
+            // 回执轮但那件活是为上游同伴派的 (k 是 peer)。人说的、定时任务放的、旁支 (chain:false, 无 k)
+            // 的回执轮都不拦; 管家只在自己的群里豁免。
+            const env = openingOfSelf(self)?.env;
+            const belowTop = env?.kind === "peer" && (env.receipt ? kOfAttr(env.k ?? "")?.kind === "peer" : env.private);
+            const muted = dests.filter((d) => chatPolicyOf(cfg, d).topOnly && !(!tagOfKey(self) && baseOfKey(self) === d));
+            if (muted.length && belowTop) {
+                json(res, 409, { ok: false, topOnly: true, reason: `${muted.map((d) => chatNameOf(cfg, d) || d).join(", ")} 开着顶层模式: 你这一轮是同伴派来的活, 不对人说话 —— 要说的写进终句 (\`RESULT:\` / \`NEED:\`), 由派你的那个代你向人交代` });
+                return;
+            }
             const asker = askerOf(self);
             for (const dest of dests) {
                 notifyChat(dest, `${relayLabel(self)}\n\n${content}`);
@@ -971,16 +1032,23 @@ const main = async () => {
         // 等待」: 调用方注入完就返回, 对方干完那一轮的结论由守护进程自动送回来 (receipts)。
         // `/peers/send` 保留为同一个处理函数: 正在跑的 wizard 的 MCP 进程是旧代码, 换名字
         // 不能把它们的通路掐断。
-        const tellPeer = async (req, res) => {
-            const { self, body } = await readPeerBody(req);
-            if (!self) {
-                json(res, 400, { ok: false, reason: "cannot resolve caller session" });
-                return;
-            }
+        // 冷与否 = 缓存最近一次被碰 (最近一次真实请求的开始; 读不到退回 mtime) 距今多久 vs 它实际按多长 TTL 写的
+        // (与 route_candidates 同一口径)。
+        const touchOf = (p) => { try {
+            return cacheTouchMs(p) || statSync(p).mtimeMs;
+        }
+        catch {
+            return 0;
+        } };
+        const ttlOf = (p) => (cacheTtlSec(p) || cfg.wrc.mirror.keepalive.ttlSec) * 1000;
+        // 被冷门控退回过的 `self\0target` → 到期时刻: 老 MCP 进程原样重发即视为 force。
+        const coldRefused = new Map();
+        /** tell_peer 的本体: 以 `self` 的名义说一句 —— HTTP 路由与 dispatch 共用。`extra` = 挂在信封后面的
+         *  一段 (只进对方输入框, 不进 `text`: 公开时 text 会成群气泡)。 */
+        const tellPeerAs = async (self, body, extra = "") => {
             const text = (body.text ?? "").toString();
             if (!text.trim()) {
-                json(res, 400, { ok: false, reason: "text required" });
-                return;
+                return { status: 400, body: { ok: false, reason: "text required" } };
             }
             // 这句话要对方怎么接 (priority 管何时投, receipt 管要不要回执, 这个管它怎么接):
             // task 一件活 (默认) / ask 只答一问 / fyi 知会 —— fyi 不要回执、不进工单、不进群。
@@ -988,8 +1056,7 @@ const main = async () => {
             const kind = rawKind === "ask" || rawKind === "fyi" ? rawKind : "task";
             const r = resolvePeer(self, addrOf(body));
             if (!r.ok) {
-                json(res, r.status, { ok: false, reason: r.reason, candidates: r.candidates });
-                return;
+                return { status: r.status, body: { ok: false, reason: r.reason, candidates: r.candidates } };
             }
             const { target, foreign } = r;
             // 件号先于一切: `re` 续问沿用那件活的件号、工单与频道 (见 receipts.prepare)。
@@ -1001,12 +1068,16 @@ const main = async () => {
             const open = receipts.pending(self, target);
             const isOpen = (id) => (id && jobs.get(id)?.status === "open" ? id : "");
             const askedJob = (body.job ?? "").trim();
-            const jobId = kind === "fyi" ? "" : askedJob || isOpen(turn.job) || isOpen(open?.job);
+            // 挂起等子活的那份不算被顶掉: 它会按件号停放、自己计数, 新的一件不继承它的工单。
+            // 返工兜底: 回执槽 24h 过期 / 被顶掉后, 带了 re 却落空成新件, 不带 job 就和根单断了 ——
+            // 只在这种情形下, 发话方是某张开着的需求根单的 owner、目标恰是它的 lead 时才补上;
+            // 没带 re 的普通 task / ask / dispatch 一律不并进根单。
+            const leadJob = jobs.all().find((j) => j.kind === "req" && j.status === "open" && j.owner === self && j.members.some((x) => x.target === target && x.role === "lead"))?.id ?? "";
+            const jobId = kind === "fyi" ? "" : askedJob || isOpen(turn.job) || (open?.deferred ? "" : isOpen(open?.job)) || (re && turn.reUnknown ? leadJob : "");
             if (jobId) {
                 const jc = checkJob(jobId, target, !!open?.need && open.turn === turn.turn);
                 if (!jc.ok) {
-                    json(res, jc.status, { ok: false, reason: jc.reason });
-                    return;
+                    return { status: jc.status, body: { ok: false, reason: jc.reason } };
                 }
             }
             // 公开与否由发话方 (LLM) 判断: 公开 = 在它这一轮的公开频道里说, 气泡进群、对方
@@ -1015,13 +1086,16 @@ const main = async () => {
             // 掉的分身不是谁, 它们的往来进群只会留下一段人找不到主的对话 —— 降为私聊。
             // 工单里的派活一律私聊: 人看不懂 fan-out 的过程, 群里只留发起者自己的收口。
             // 知会不进群: 公开信封要对方「照对人说话的方式答」, 一句「收到」会被发给一群人。
-            const isPublic = !jobId && kind !== "fyi" && (turn.channel !== undefined ? !!turn.channel : body.public === true) && !!wizards.get(self) && !!wizards.get(target);
+            // 顶层模式 (chatPolicy.topOnly): 那个群里 wizard 之间不当着人说话 —— 公开与否不归模型判断,
+            // 续问沿用的公开频道也一样降为私聊; 人只从顶层 wizard 的收口里听到结论。
+            const wantPublic = !jobId && kind !== "fyi" && (turn.channel !== undefined ? !!turn.channel : body.public === true) && !!wizards.get(self) && !!wizards.get(target);
+            const topOnly = wantPublic && chatPolicyOf(cfg, turn.channel || channelOf(self)).topOnly;
+            const isPublic = wantPublic && !topOnly;
             const channel = isPublic ? turn.channel || channelOf(self) : "";
             // Injecting into your own pane would type into the box you're generating
             // from — Claude Code queues it and the caller deadlocks waiting for itself.
             if (target === self) {
-                json(res, 400, { ok: false, reason: "refusing to inject into the calling session itself" });
-                return;
+                return { status: 400, body: { ok: false, reason: "refusing to inject into the calling session itself" } };
             }
             // 它正在交接: 这句话等它换完会话再进 —— 投进旧会话会被交接一并带走, 投进重开中的
             // 空 pane 会 resume 回旧 sid (见 handoff.ts)。发话时刻取在这之后。
@@ -1040,6 +1114,23 @@ const main = async () => {
                         : bp.when === "idle" ? "normal"
                             : re ? "now" : "normal";
             const waitSec = Math.min(Math.max(Number(body.waitSec ?? 600) || 600, 10), 3600);
+            // 冷门控: 派新活 (task、不是续问、不是插话) 给一个冷且大的 wizard, 先退回一行让派活的
+            // 算账 —— 唤醒它要整段重写缓存, 点名或职责对口只说明相关, 不说明划算。`force:true`
+            // 是「真依赖它那段上下文」的明说。老 MCP 进程的 schema 里没有 force (请求里压根没这个键,
+            // 新的一律显式带上): 同一对 10 分钟内原样再发一次就算 force, 不然它们被拦下就没有出路。
+            const force = body.force;
+            if (kind === "task" && !re && asked !== "now" && force !== true) {
+                const gk = `${self}\0${target}`;
+                const retried = force === undefined && (coldRefused.get(gk) ?? 0) > Date.now();
+                coldRefused.delete(gk);
+                const gi = retried ? undefined : m.sessionInfo(target);
+                const gate = gi ? coldGateOf(`.${displayName(target).replace(/^\./, "")}`, gi.contextTokens, touchOf(gi.jsonlPath), Date.now(), ttlOf(gi.jsonlPath)) : "";
+                if (gate) {
+                    if (force === undefined)
+                        coldRefused.set(gk, Date.now() + 10 * 60_000);
+                    return { status: 409, body: { ok: false, gated: "cold", reason: gate + (force === undefined ? " (你的 MCP 是旧版、没有 force 参数: 10 分钟内原样再发一次即视为 force)" : "") } };
+                }
+            }
             // 「忙」= 这一轮还没结束, 或停在审批上等人 —— 都不是能接新活的时候。
             const wasBusy = !(await m.idleNow(target));
             // urgent 只打断你自己派的那一轮 (或它自己的回执轮): 手上若是别的 wizard / 人 / 定时任务的活,
@@ -1054,8 +1145,7 @@ const main = async () => {
                 const wr = await m.untilIdle(target, waitSec * 1000);
                 waitedMs = Date.now() - t0;
                 if (!wr.idle) {
-                    json(res, 409, { ok: false, target, foreign, wasBusy, waitedMs, reason: `它一直在忙, ${waitSec}s 内没闲下来 —— peek_peer 看看它卡在哪; 真急就 priority:"urgent" 打断它` });
-                    return;
+                    return { status: 409, body: { ok: false, target, foreign, wasBusy, waitedMs, reason: `它一直在忙, ${waitSec}s 内没闲下来 —— peek_peer 看看它卡在哪; 真急就 priority:"urgent" 打断它` } };
                 }
             }
             if (policy === "urgent" && wasBusy) {
@@ -1072,12 +1162,7 @@ const main = async () => {
             // 唤醒代价同样要在注入之前量: 投进去 transcript 一动, 就看不出它冷了多久。
             const info = m.sessionInfo(target);
             const wake = info?.jsonlPath
-                ? wakeNoteOf(info.contextTokens, (() => { try {
-                    return statSync(info.jsonlPath).mtimeMs;
-                }
-                catch {
-                    return 0;
-                } })(), at, (cacheTtlSec(info.jsonlPath) || cfg.wrc.mirror.keepalive.ttlSec) * 1000)
+                ? wakeNoteOf(info.contextTokens, touchOf(info.jsonlPath), at, ttlOf(info.jsonlPath))
                 : "";
             const deadlineSec = body.deadline;
             // 回执: 对方干完那一轮, 守护进程把它的结论自动送回来 (默认开)。`receipt:false`
@@ -1096,7 +1181,7 @@ const main = async () => {
                     ...(deadlineSec !== undefined ? { deadline: deadlineAt } : {}),
                     ...(kind !== "task" ? { act: kind } : {}),
                     ...(wantReceipt ? {} : { quiet: true }),
-                }),
+                }) + extra,
             });
             // 注入失败就不守 —— 没有问话, 也不会有回答。不要回执 (receipt:false / fyi) 就不登记:
             // 一份不守的槽会以同一对的 key 顶掉发话方还在等它答的那件活, 那件的回执就再也来不了。
@@ -1105,39 +1190,61 @@ const main = async () => {
             const k = body.chain === false ? undefined : parentKOf(self);
             if (inj.ok && wantReceipt)
                 receipts.register({ from: self, to: target, channel, job: jobId, at, turn: turn.turn, legs: turn.legs, deadlineAt, ...(k ? { k } : {}), ...(asker ? { asker } : {}) });
+            if (inj.ok && wantReceipt) {
+                if (turn.legs > 1)
+                    ledger.touch(self, turn.turn);
+                else
+                    ledger.open({ turn: turn.turn, owner: self, to: target, text, at, ...(jobId ? { job: jobId } : {}), ...(k ? { for: k } : {}), ...(asker ? { asker } : {}) });
+            }
             // 工单成员照旧记账 (收工那一条会列出各自那段活); 公开的那一句在群里成气泡。
             // 续问 (re) 不是一段新活: 工单页与留档里该列的仍是当初派的那段。
-            if (inj.ok && jobId)
-                jobs.attach(jobId, { target, task: turn.legs > 1 ? "" : text, spawned: false });
+            if (inj.ok && jobId) {
+                const role = roleParam(body.role);
+                // G2: 需求根单的 owner 答了 lead 的 NEED —— 方案闸过了 (只记第一次)。
+                const rj = jobs.get(jobId);
+                if (rj?.kind === "req" && self === rj.owner && !rj.gate?.g2 && !!open?.need && open.turn === turn.turn && rj.members.some((x) => x.target === target && x.role === "lead"))
+                    jobs.mark(jobId, { gate: { g2: Date.now() } });
+                jobs.attach(jobId, { target, task: turn.legs > 1 ? "" : text, spawned: false, ...(role ? { role } : {}) }, kind === "ask" ? "ask" : "task");
+            }
             const spent = inj.ok && jobId ? jobs.spend(jobId) : undefined;
             if (inj.ok && isPublic)
                 relayPeer(self, target, text, channel);
             // `wasBusy` 是给调用方的判断依据: 立刻投给一个正在生成的会话, 这句话会排在
             // 它这一轮后面, 而不是马上被读到。
-            json(res, inj.ok ? 200 : 502, {
-                ...inj,
-                name: peerAddress(cfg, self, target),
-                public: isPublic,
-                priority: policy,
-                ...(kind !== "task" ? { kind } : {}),
-                ...(kind === "fyi" && askedJob ? { jobIgnored: true } : {}),
-                ...(others ? { urgentDowngraded: `它此刻在做 ${others.from} 派的活, 没打断它 —— 按 normal 等它这一轮做完再投` } : {}),
-                wasBusy,
-                ...(interrupted !== undefined ? { interrupted } : {}),
-                ...(waitedMs ? { waitedMs } : {}),
-                ...(jobId ? { job: jobId } : {}),
-                ...(inj.ok ? { turn: turn.turn } : {}),
-                ...(spent?.maxTurns ? { budget: `${spent.turns}/${spent.maxTurns}${spent.turns >= spent.maxTurns ? " —— 用完了, 这是最后一次派活, 下一步收口" : ""}` } : {}),
-                ...(inj.ok && wake ? { wakeCost: wake } : {}),
-                ...(turn.reUnknown ? { reUnknown: true, reNote: `re "${re}" 不是你正在等 ${displayName(target)} 答的那件, 按新活发出` } : {}),
-                // 回执怎么回来 —— 写在回包里, 调用方 (模型) 不必从工具描述里回忆。
-                ...(inj.ok && wantReceipt
-                    ? { receipt: "它干完那一轮, 结论会作为新的一轮自动进到你这里 —— 不要挂在 wait_peer 上等, 接着干你自己的事" }
-                    : {}),
-                ...(inj.ok && wantReceipt && k?.kind === "peer"
-                    ? { chained: `这件活算在你答 ${displayName(k.from)} 的那件 (${k.turn}) 名下: 它回来之前, 你这一轮的终句不会先交给 ${displayName(k.from)}; 与那件活无关就带 chain:false 发` }
-                    : {}),
-            });
+            return { status: inj.ok ? 200 : 502, body: {
+                    ...inj,
+                    name: peerAddress(cfg, self, target),
+                    public: isPublic,
+                    ...(topOnly ? { topOnly: "这个群开着顶层模式: wizard 之间一律私聊, 已按私聊投出; 结论回到你这儿, 由你 (或你的上游) 对人收口" } : {}),
+                    priority: policy,
+                    ...(kind !== "task" ? { kind } : {}),
+                    ...(kind === "fyi" && askedJob ? { jobIgnored: true } : {}),
+                    ...(others ? { urgentDowngraded: `它此刻在做 ${others.from} 派的活, 没打断它 —— 按 normal 等它这一轮做完再投` } : {}),
+                    wasBusy,
+                    ...(interrupted !== undefined ? { interrupted } : {}),
+                    ...(waitedMs ? { waitedMs } : {}),
+                    ...(jobId ? { job: jobId } : {}),
+                    ...(inj.ok ? { turn: turn.turn } : {}),
+                    ...(spent?.maxTurns ? { budget: `${spent.turns}/${spent.maxTurns}${spent.turns >= spent.maxTurns ? " —— 用完了, 这是最后一次派活, 下一步收口" : ""}` } : {}),
+                    ...(inj.ok && wake ? { wakeCost: wake } : {}),
+                    ...(turn.reUnknown ? { reUnknown: true, reNote: `re "${re}" 不是你正在等 ${displayName(target)} 答的那件, 按新活发出` } : {}),
+                    // 回执怎么回来 —— 写在回包里, 调用方 (模型) 不必从工具描述里回忆。
+                    ...(inj.ok && wantReceipt
+                        ? { receipt: "它干完那一轮, 结论会作为新的一轮自动进到你这里 —— 不要挂在 wait_peer 上等, 接着干你自己的事" }
+                        : {}),
+                    ...(inj.ok && wantReceipt && k?.kind === "peer"
+                        ? { chained: `这件活算在你答 ${displayName(k.from)} 的那件 (${k.turn}) 名下: 它回来之前, 你这一轮的终句不会先交给 ${displayName(k.from)}; 与那件活无关就带 chain:false 发` }
+                        : {}),
+                } };
+        };
+        const tellPeer = async (req, res) => {
+            const { self, body } = await readPeerBody(req);
+            if (!self) {
+                json(res, 400, { ok: false, reason: "cannot resolve caller session" });
+                return;
+            }
+            const r = await tellPeerAs(self, body);
+            json(res, r.status, r.body);
         };
         http.register("POST /peers/tell", tellPeer);
         http.register("POST /peers/send", tellPeer); // 老 MCP 进程还在调这个名字
@@ -1306,8 +1413,113 @@ const main = async () => {
             nudged.add(i.sessionId);
             return [`你的上下文已到 ${Math.round(i.contextTokens / 1000)}k, 快到自动压缩了: 这段里学到的、值得跨会话活下来的东西, 先 \`wizard_remember\` 记下 (自己的选 self, 属于群 / 仓库的选 chat / workspace), 再考虑 \`handoff\``];
         };
-        const notices = bindNoticeBox(createNoticeBox(12, memoryNudge));
-        const postRoster = (base, except, line) => notices.post(chatAudience(m.chatTargets(base), base, except), line);
+        // 越过交接判断线 (handoffAt) 也只提一次: 交接不是压缩, 不该等快满。同样每段会话一次 ——
+        // 交接后换了 sid, 新会话再越线会再提。
+        const handoffNudged = new Set();
+        const handoffNudge = (t) => {
+            const i = m.sessionInfo(t);
+            if (!i?.sessionId || handoffNudged.has(i.sessionId) || i.contextTokens < handoffAt(lastModel(i.jsonlPath) || i.model))
+                return [];
+            handoffNudged.add(i.sessionId);
+            return [`你的上下文已到 ${Math.round(i.contextTokens / 1000)}k: 该判断要不要 \`handoff\` 了 —— 手上这摊活告一段落、或往后的活不再依赖前面的大段材料, 就交接 (值得跨会话留下的先 \`wizard_remember\`); 还在一件离不开它们的活中间, 做完这一段再交`];
+        };
+        // 挂起事项的提醒 (见 pending-items.digest): 只给管家 —— 各群的默认会话, 同时挂着多件活、
+        // 又被人随时打断的就是它。上次全表时的样子纯内存: reload 后头一次见到只立基线。
+        const pendingMarks = new Map();
+        /** 上次注入之后被 /clear 或压缩截断过的 (onContextCut 记, 下一次注入取走)。 */
+        const pendingCuts = new Map();
+        const liveOfTurns = () => {
+            let byTurn;
+            return (turn) => (byTurn ??= new Map(receipts.states().map((x) => [x.turn, x]))).get(turn);
+        };
+        /** 管家等人验收的根单行 (需求已交付、单还开着)。 */
+        const stalledRows = (owner) => stalledRoots(jobs.all(), owner, jobLive()).map(({ job, status }) => renderStalled(job.title, job.id, status));
+        const awaitingRows = (owner, now) => awaitingAccept(jobs.all(), owner, jobLive()).map(({ job, at }) => renderAwaiting(job.title, job.id, at, now));
+        const shelvedRows = (owner, now) => shelvedRoots(jobs.all(), owner).map((j) => renderShelved(j.title, j.id, j.hold ?? j.openedAt, now));
+        const pendingNames = { nameOf: displayName, chatOf: (b) => chatNameOf(cfg, b) || b };
+        /** 人在某个群最近一次开口 (内存; reload 丢了就当没说过): 重试冒泡避开人在场的时候。 */
+        const humanAt = new Map();
+        /** 「人这句可能在验收某张」同一张至多隔 HEARD_EVERY_MS 提一次。 */
+        const acceptHeard = new Map();
+        const pendingDigest = (t, via) => (seen) => {
+            const cut = pendingCuts.get(t);
+            pendingCuts.delete(t);
+            const now = Date.now();
+            if (via.human)
+                humanAt.set(via.human.channel, now);
+            if (tagOfKey(t))
+                return { text: "", keys: [] };
+            // 人在等验收那件需求的群里开了口: 这句可能就是验收 (是不是由管家判断)。与 digest 的 heard 同一个节流。
+            const acceptLines = (via.human ? awaitingAccept(jobs.all(), t, jobLive()) : [])
+                .filter(({ job }) => job.origin?.chat === via.human?.channel && now - (acceptHeard.get(job.id) ?? 0) >= HEARD_EVERY_MS)
+                .map(({ job, at }) => {
+                acceptHeard.set(job.id, now);
+                return `heard? accept ${job.id} "${job.title}" delivered ${agoMs(now - at)} ago, awaiting the human's verdict: if this line is the verdict → close_job (ok) / tell_peer re to lead (not ok); else ignore`;
+            });
+            const rule = !seen("rule:pending");
+            const items = ledger.openOf(t);
+            // 没挂着的事: 不读会话, 也不留基线 —— 有了第一件再从那一刻立。
+            if (!items.length) {
+                pendingMarks.delete(t);
+                const text = acceptLines.length ? renderDigest({ full: "", lines: acceptLines, touched: [], mark: { sid: "", ctx: 0, ctxAtFull: 0, drains: 0 } }, "", rule) : "";
+                return { text, keys: text && rule ? ["rule:pending"] : [] };
+            }
+            const i = m.sessionInfo(t);
+            const o = digest({ items, mark: pendingMarks.get(t), ...(cut ? { cut } : {}), session: i ? { sid: i.sessionId, ctx: i.contextTokens } : undefined, ...(via.human ? { human: via.human } : {}), now, nameOf: displayName });
+            pendingMarks.set(t, o.mark);
+            o.touched.forEach(ledger.put);
+            const text = renderDigest({ ...o, lines: [...o.lines, ...acceptLines] }, o.full ? renderTable(items, liveOfTurns(), pendingNames, now, awaitingRows(t, now), stalledRows(t), shelvedRows(t, now)) : "", rule);
+            return { text, keys: text && rule ? ["rule:pending"] : [] };
+        };
+        const notices = bindNoticeBox(createNoticeBox({
+            probe: (t) => [...handoffNudge(t), ...memoryNudge(t)],
+            digest: pendingDigest,
+            seen: createSeenRing(loadJsonMap(cfg.wrc.mirror.noticeSeenFile, gcSeen), (t) => m.sessionInfo(t)?.sessionId ?? ""),
+            cwdOf: (t) => ((c) => c.runningCwd || c.defaultCwd)(m.getCwd(t)),
+        }));
+        // 重试冒泡 (设计文档 §3.3.1): 做完了没人验收的需求, 守护进程以管家的名义往原群提醒一句, 不占管家一轮、
+        // 不带单号 (人只认标题); 同时往管家的信箱挂一行带单号的, 人下一句进来时它知道可能在答哪张。
+        // 节奏由根单上的 nudge {n, lastAt} 现算 (见 jobs.nextNudgeAt), 只在白天, 人刚说过话的群顺延 —— reload 不丢、不重发。
+        const NUDGE_TICK_MS = 5 * 60_000;
+        const HUMAN_QUIET_MS = 30 * 60_000;
+        const agoZh = (ms) => ms < 3_600_000 ? `${Math.max(1, Math.round(ms / 60_000))} 分钟前` : ms < 86_400_000 ? `${Math.round(ms / 3_600_000)} 小时前` : `${Math.round(ms / 86_400_000)} 天前`;
+        const nudgeTick = (now = Date.now()) => {
+            if (dayClamp(now) !== now)
+                return 0;
+            const owners = [...new Set(jobs.all().filter((j) => j.kind === "req" && j.status === "open").map((j) => j.owner))];
+            // 只冒群默认管家 (无 tag) 自己的根单: lead 自己 dispatch 出来的子需求不该推给人; 与 pendingDigest 只服务默认会话一致。
+            // owner 须是已登记的 wizard: 伪造的 owner/群 (调试、回归) 不得往 turn store 落 post, 否则 rolepage 凭空长出一个群和一个「人」。
+            const due = owners
+                .filter((o) => !tagOfKey(o) && !!wizards.get(o))
+                .flatMap((o) => awaitingAccept(jobs.all(), o, jobLive()))
+                .filter(({ job, at }) => !!job.origin?.chat && baseOfKey(job.owner) === job.origin.chat && nudgeDue(at, job.nudge, now) && now - (humanAt.get(job.origin.chat) ?? 0) >= HUMAN_QUIET_MS);
+            // 按 (群, owner) 分组: 署名与信箱都跟着 owner。
+            const byChat = due.reduce((acc, x) => { const k = `${x.job.origin.chat}\0${x.job.owner}`; return acc.set(k, [...(acc.get(k) ?? []), x]); }, new Map());
+            byChat.forEach((xs) => {
+                const owner = xs[0].job.owner;
+                const chat = xs[0].job.origin.chat;
+                const one = xs.length === 1;
+                const mark = (i) => (one ? "" : "①②③④⑤⑥⑦⑧⑨⑩"[i] ?? `${i + 1}.`);
+                const text = `有 ${xs.length} 件做完了等你看: ${xs.map(({ job, at }, i) => `${mark(i)}「${job.title}」(${agoZh(now - at)}交付)`).join(" ")} —— 回一句「好」就收, 或者说哪里不对。`;
+                notifyChat(chat, `${relayLabel(owner)}\n\n${text}`);
+                recordPost({ target: owner, channel: chat, body: text });
+                xs.forEach(({ job }) => jobs.mark(job.id, { nudge: { n: (job.nudge?.n ?? 0) + 1, lastAt: now } }));
+                notices.post([owner], `nudged the human (daemon, in your name) about finished requests; their next line may be the verdict on one: ${xs.map(({ job }) => `${job.id} "${job.title}"`).join(" · ")}`);
+            });
+            return due.length;
+        };
+        setInterval(() => { try {
+            nudgeTick();
+        }
+        catch (e) {
+            log.warn({ err: e.message }, "accept nudge failed");
+        } }, NUDGE_TICK_MS).unref();
+        /** `who` = 这次变动的当事人 (见 hears): 不给 = 聊天自己的事 (改名), 全群都听。 */
+        const postRoster = (base, except, n, who) => notices.post(chatAudience(m.chatTargets(base), base, except).filter(who ? hears(who) : () => true), n);
+        /** 注册表里的当事人。要在 forget 抹掉记录之前取; 没有记录 = 谁也不告诉。 */
+        const subjectOf = (w) => (w
+            ? { parent: w.parent, description: w.description, owners: jobs.all().filter((j) => j.status === "open" && j.members.some((x) => x.target === w.target)).map((j) => j.owner) }
+            : {});
         /** 一个聊天的工作区: 它名下各会话跑在哪个目录, 取最多的那个。聊天与工作区是
          *  一对多, 但绝大多数聊天只围着一个项目转。 */
         const chatCwd = (targets) => {
@@ -1341,7 +1553,7 @@ const main = async () => {
                 log.info({ base, name }, "chat: auto-named from workspace");
                 // 群里不发气泡 (一次补名会命中十几个群, 那是刷屏), 但住在里面的 wizard
                 // 得知道自己的地址变了 —— 它的 charter 里写的还是「(未命名)」。
-                postRoster(base, [], `这个聊天现在叫 **${name}** (按工作区自动起的) —— notify / spawn_wizard 的 \`chat\` 可以用这个名字指到这里。`);
+                postRoster(base, [], { op: "chat", name });
             }
             return named;
         };
@@ -1364,6 +1576,13 @@ const main = async () => {
                 log.child({ mod: "wizard" }).info({ killed }, "unborn windows killed"); })
                 .catch((e) => log.warn({ err: e.message }, "unborn window reap failed"));
         }
+        /** 成员角色参数: 只认 exec / reviewer / expert (lead 只由 dispatch 在派成之后记, 免得谁都能自封 lead); 不认识的 = 不给。 */
+        const roleParam = (v) => ["exec", "reviewer", "expert"].find((x) => x === v);
+        /** 成员此刻的态: 定论 > 在飞的实时态。每次取一份回执快照。 */
+        const jobLive = () => {
+            const inflight = receipts.states();
+            return (j, mm) => mm.outcome ?? inflight.find((x) => x.to === mm.target && x.job === j.id)?.state;
+        };
         /** 派活前先验工单: 生完分身才发现工单号打错了, 那个分身就成了没人认领的孤儿。 */
         /** `free` = 这次不花预算 (不带 task 的 spawn; 答一份停在 NEED 上的反问 —— 拒了它就只能干等到超时)。 */
         const checkJob = (id, target, free = false) => {
@@ -1374,7 +1593,7 @@ const main = async () => {
                 return { ok: false, status: 409, reason: `工单 '${id}' 已经收工了` };
             // 已在册的成员 (续问 / 再派一句) 不占新名额。
             if (j.members.length >= JOB_MEMBER_MAX && !j.members.some((x) => x.target === target))
-                return { ok: false, status: 409, reason: `工单 '${id}' 的成员已经满了 (${JOB_MEMBER_MAX} 个) —— 分身是有成本的, 拆成两个工单, 或者先收工回收掉一批` };
+                return { ok: false, status: 409, reason: `工单 '${id}' 的成员已经满了 (${JOB_MEMBER_MAX} 个直接成员) —— 管辖幅度有限: 把一块子活交给现有成员 (它自己开子单、长一层子 lead), 或者先收工回收掉一批` };
             // 预算是硬的: 与单件活的 legs 不同, 这里拒了也无路可绕 —— 换个人派照样记在这张工单上。
             if (!free && j.maxTurns && (j.turns ?? 0) >= j.maxTurns)
                 return { ok: false, status: 409, reason: `工单 '${id}' 的派活预算用完了 (${j.turns}/${j.maxTurns} 次) —— 拿手上已有的结论 close_job 收口, 缺的如实写; 真要接着干就 open_job 开一张新的` };
@@ -1451,11 +1670,13 @@ const main = async () => {
             const nowDate = new Date();
             return {
                 wizards: [...live, ...cold],
-                jobs: jobs.all().map((j) => ({
+                jobs: ((all, live) => all.map((j) => ({
                     id: j.id, base: j.base, owner: j.owner, title: j.title, status: j.status,
                     openedAt: j.openedAt, closedAt: j.closedAt, summary: j.summary, ...(j.expect ? { expect: j.expect } : {}), ...(j.plan ? { plan: j.plan } : {}),
-                    members: j.members.map((mm) => ({ target: mm.target, task: mm.task, spawned: mm.spawned, ...(mm.outcome ? { outcome: mm.outcome } : {}), ...(mm.artifacts?.length ? { artifacts: mm.artifacts } : {}) })),
-                })),
+                    ...(j.parent ? { parent: j.parent } : {}), ...(j.kind ? { kind: j.kind } : {}), ...(j.criteria ? { criteria: j.criteria } : {}), ...(j.origin ? { origin: j.origin } : {}), ...(j.end ? { end: j.end } : {}),
+                    stage: jobStage(j, all, live),
+                    members: j.members.map((mm) => ({ target: mm.target, task: mm.task, spawned: mm.spawned, ...(mm.outcome ? { outcome: mm.outcome } : {}), ...(mm.artifacts?.length ? { artifacts: mm.artifacts } : {}), ...(mm.role ? { role: mm.role } : {}), ...(mm.forkOf ? { forkOf: mm.forkOf } : {}) })),
+                })))(jobs.all(), jobLive()),
                 // rolepage 的待办托盘: 与名册 / peek 的「在等 / 欠着」同一份 (receipts.states)。
                 inflight: receipts.states().map(({ ageMs, ...x }) => ({ ...x, at: Date.now() - ageMs })),
                 schedules: tasks.list().filter((x) => x.enabled).map((x) => {
@@ -1522,39 +1743,53 @@ const main = async () => {
         // 新记的那些就只活在被抹掉的对话里 —— onContextCut 据这份快照补发差集。纯内存: reload
         // 之后没有快照, 只指路不补发。
         const chartered = new Map();
+        const charterOptsOf = (target, cwd) => {
+            const rec = wizards.get(target);
+            return { parent: rec?.parent, forkOf: rec?.forkOf, inherited: !!rec?.clonedFrom, cwd };
+        };
+        /** 宪章正文, 只读 —— 只由 cfg 与此刻的注册表 / 附着表算出, config_set 据此比对前后。`forDiff` 去掉
+         *  宪章里自认是出生快照的配置 (档位那一行, 真相在 config_get): 改档位不该叫全员 handoff。 */
+        const charterText = (target, o, forDiff = false) => renderCharter({
+            // o.cwd = 正在启动的那个 pane 的目录; 没给才退回"现在记着的那个"。
+            self: { ...briefOf(target, target), address: selfAddress(target), ...(o.cwd ? { cwd: o.cwd } : {}) },
+            chat: chatNameOf(cfg, target),
+            principal: baseOfKey(target),
+            parent: o.parent ? briefOf(target, o.parent) : undefined,
+            inherited: !!o.inherited,
+            forkOf: o.forkOf ? briefOf(target, o.forkOf) : undefined,
+            cwdUnconfirmed: m.cwdUnconfirmed(target, o.cwd),
+            // 最近动过的排前面: 名册只点名前几个, 截掉的该是早就停了的那些。
+            // 没有 transcript 的冷记录按 bornAt 算, 刚生下还没开口的照样在。
+            siblings: m.chatTargets(baseOfKey(target))
+                .filter((t) => t !== target)
+                .map((t) => [t, Math.max(lastTouched(t), wizards.get(t)?.bornAt ?? 0)])
+                .filter(([, at]) => Date.now() - at <= ROSTER_FRESH_MS)
+                .sort((x, y) => y[1] - x[1])
+                .map(([t]) => briefOf(target, t)),
+            memory: wizards.get(target)?.memory ?? [],
+            tiers: forDiff ? [] : TIERS.map((n) => { const s = cfg.models.tiers[n]; return `${n}=${s.model || "默认"}${s.effort ? `·${s.effort}` : ""}`; }),
+            chatMemory: sharedMemory("chat", baseOfKey(target)),
+            workspaceMemory: (() => {
+                const cwd = o.cwd || m.getCwd(target).runningCwd || m.getCwd(target).defaultCwd;
+                return cwd ? sharedMemory("workspace", cwd) : "";
+            })(),
+            steward: !tagOfKey(target),
+            stewardBudget: chatPolicyOf(cfg, target).stewardBudget,
+            lead: !!wizards.get(target)?.lead,
+            topOnly: chatPolicyOf(cfg, target).topOnly,
+        });
         /** 开局宪章。出生时的兄弟只是快照 —— 名册随时可查, 写进系统提示的那份只为了
          *  让它一睁眼就知道自己不是一个人在跑。 */
         const charterFor = (target, o) => {
             chartered.set(target, wizards.get(target)?.memory ?? []);
-            const text = renderCharter({
-                // o.cwd = 正在启动的那个 pane 的目录; 没给才退回"现在记着的那个"。
-                self: { ...briefOf(target, target), address: selfAddress(target), ...(o.cwd ? { cwd: o.cwd } : {}) },
-                chat: chatNameOf(cfg, target),
-                principal: baseOfKey(target),
-                parent: o.parent ? briefOf(target, o.parent) : undefined,
-                inherited: !!o.inherited,
-                forkOf: o.forkOf ? briefOf(target, o.forkOf) : undefined,
-                cwdUnconfirmed: m.cwdUnconfirmed(target, o.cwd),
-                // 最近动过的排前面: 名册只点名前几个, 截掉的该是早就停了的那些。
-                // 没有 transcript 的冷记录按 bornAt 算, 刚生下还没开口的照样在。
-                siblings: m.chatTargets(baseOfKey(target))
-                    .filter((t) => t !== target)
-                    .map((t) => [t, Math.max(lastTouched(t), wizards.get(t)?.bornAt ?? 0)])
-                    .filter(([, at]) => Date.now() - at <= ROSTER_FRESH_MS)
-                    .sort((x, y) => y[1] - x[1])
-                    .map(([t]) => briefOf(target, t)),
-                memory: wizards.get(target)?.memory ?? [],
-                chatMemory: sharedMemory("chat", baseOfKey(target)),
-                workspaceMemory: (() => {
-                    const cwd = o.cwd || m.getCwd(target).runningCwd || m.getCwd(target).defaultCwd;
-                    return cwd ? sharedMemory("workspace", cwd) : "";
-                })(),
-                steward: !tagOfKey(target),
-            });
-            recordCharter(target, text);
+            const text = charterText(target, o);
+            recordCharter(target, text, o.parent ? { parent: o.parent, kind: o.inherited ? "clone" : "spawn", ...(o.forkOf ? { forkOf: o.forkOf } : {}) } : undefined);
             return text;
         };
         m.onContextCut((t, cut) => {
+            pendingCuts.set(t, cut);
+            // 之前挂过的提示随对话一起没了: 去重窗口清零, 下一次该给的规矩照给。
+            notices.forget(t);
             const now = wizards.get(t)?.memory ?? [];
             const seen = chartered.get(t);
             // 没有快照 (reload 之后) 就不猜差集, 只指路 —— 整份塞进一行能有几万字。
@@ -1580,8 +1815,8 @@ const main = async () => {
             ensureChatNames(target);
             // 信箱里装的是相对上一份宪章的变化; 新宪章一渲染就都过期了 (名册、记忆都已在里面)。
             notices.drain(target);
-            const rec = wizards.get(target);
-            return charterFor(target, { parent: rec?.parent, forkOf: rec?.forkOf, inherited: !!rec?.clonedFrom, cwd: ctx?.cwd });
+            notices.forget(target);
+            return charterFor(target, charterOptsOf(target, ctx?.cwd));
         });
         // 宪章记录是后来才有的: 已经在跑的 wizard 拿 spawn 落盘的那份 (state/charters/<sid>.md) 补上,
         // 否则要等它下次重生, rolepage 的「宪章」入口才出现。与自动命名同一个延迟: 等附着表恢复完。
@@ -1716,7 +1951,9 @@ const main = async () => {
             // 职责是别人决定"该不该找你"的依据, 改了就得让同群的知道 —— 否则他们照着
             // 出生快照里那句旧的 (或者空的) 职责派活。
             if (asked || description)
-                postRoster(baseOfKey(self), [self], `${before && before !== name ? `**.${before}** 改名为 **.${name}**` : `**.${name}** 改了身份`}${description ? ` · 职责: ${description}` : ""}`);
+                postRoster(baseOfKey(self), [self], before && before !== name
+                    ? { op: "renamed", name: `.${name}`, was: `.${before}`, ...(description ? { job: description } : {}) }
+                    : { op: "job", name: `.${name}`, job: description }, subjectOf(wizards.get(self)));
             json(res, 200, {
                 ok: true,
                 ...me,
@@ -1757,6 +1994,7 @@ const main = async () => {
             const shown = ranked.slice(0, limit).map((r) => ({
                 ...r,
                 turns: turnsLine(inflight, r.target),
+                duty: dutyLine(jobs.all(), r.target),
                 model: r.model || (r.jsonlPath ? lastModel(r.jsonlPath) : ""),
                 summary: r.jsonlPath ? lastExchange(r.jsonlPath, 80, warm) : "",
                 contextTokens: r.jsonlPath ? lastContextTokens(r.jsonlPath) : 0,
@@ -1777,21 +2015,11 @@ const main = async () => {
         });
         // 管家分派前的候选表: 事实在这里算 (交集、读过的文件、ctx), 权衡留给管家。
         // 只为活着的读 transcript —— 冷的没有 jsonl 可读, 靠职责命中进表。
-        http.register("POST /wizard/route", async (req, res) => {
-            const { self, body } = await readPeerBody(req);
-            if (!self) {
-                json(res, 400, { ok: false, reason: "cannot resolve caller session" });
-                return;
-            }
-            const b = body;
-            const task = (b.task ?? "").trim();
-            if (!task) {
-                json(res, 400, { ok: false, reason: "task is required" });
-                return;
-            }
+        /** 候选的原料: 除自己之外每个 wizard 的上下文事实 (文件集 / 最近的话 / ctx / 缓存 TTL)。 */
+        const routeRowsOf = async (self) => {
             ensureChatNames(self);
             const warm = keepalivePingSigs(cfg.wrc.mirror.keepalive.ping);
-            const rows = (await rosterOf(self))
+            return (await rosterOf(self))
                 .filter((r) => !r.self)
                 .map((r) => {
                 const live = r.jsonlPath ? r.jsonlPath : "";
@@ -1800,15 +2028,139 @@ const main = async () => {
                     ...r,
                     contextTokens: live ? lastContextTokens(live) : 0,
                     ...(ttl ? { cacheTtlMs: ttl * 1000 } : {}),
+                    ...(live ? { cacheAt: cacheTouchMs(live) } : {}),
                     files: live ? contextFiles(live) : [],
                     asks: live ? talkTurns(live, 12, warm).filter((t) => t.role === "user").map((t) => t.text) : [],
                     summary: live ? lastExchange(live, 80, warm) : "",
                 };
             });
+        };
+        http.register("POST /wizard/route", async (req, res) => {
+            const { self, body } = await readPeerBody(req);
+            if (!self) {
+                json(res, 400, { ok: false, reason: "cannot resolve caller session" });
+                return;
+            }
+            const b = body;
+            const task = (b.task ?? "").trim();
+            if (!task) {
+                json(res, 400, { ok: false, reason: "task is required" });
+                return;
+            }
             const limit = Math.min(Math.max(Number(b.limit ?? 5) || 5, 1), 20);
-            const cands = rankCandidates(task, (b.cwd ?? "").trim() || m.getCwd(self).runningCwd, rows).slice(0, limit);
+            const cands = rankCandidates(task, (b.cwd ?? "").trim() || m.getCwd(self).runningCwd, await routeRowsOf(self)).slice(0, limit);
             json(res, 200, { ok: true, text: renderCandidates(task, cands, Date.now(), cfg.wrc.mirror.keepalive.ttlSec * 1000, homedir()) });
         });
+        // 派活收成一步 (见 route.decide): 查候选 → 过成本门控 → 转给已有的或按档白板 spawn →
+        // tell_peer 投出去, 回决定与理由。默认决定由守护进程算; 管家不同意就 `to` 点名、
+        // `force` 越过冷门控、`spawn:true` 硬要新的 —— 推翻要显式说。
+        http.register("POST /dispatch", async (req, res) => {
+            const { self, body } = await readPeerBody(req);
+            if (!self) {
+                json(res, 400, { ok: false, reason: "cannot resolve caller session" });
+                return;
+            }
+            const b = body;
+            const task = (b.task ?? "").toString().trim();
+            if (!task) {
+                json(res, 400, { ok: false, reason: "task is required" });
+                return;
+            }
+            const lead = b.lead === true;
+            const force = b.force === true;
+            const to = (b.to ?? "").toString().trim();
+            const now = Date.now();
+            const ttlMs = cfg.wrc.mirror.keepalive.ttlSec * 1000;
+            // 自动选只在这些里选: 在线的 (没 pane 的 ctx 量不出, 成本门会盲过)、不是哪个群的管家、
+            // 不是别人开着的工单里的队员 —— 点名 (`to`) 不受此限。
+            const inOthersJob = (t) => jobs.openOf(baseOfKey(t)).some((j) => j.owner !== self && j.members.some((mm) => mm.target === t));
+            const pool = to || b.spawn || lead ? [] : (await routeRowsOf(self)).filter((r) => r.alive && !!tagOfKey(r.target) && !inOthersJob(r.target));
+            const cands = rankCandidates(task, m.getCwd(self).runningCwd, pool).slice(0, 5);
+            let d = to ? { kind: "existing", why: `你点名了 ${to}` }
+                : b.spawn ? { kind: "spawn", why: "你要了新的" }
+                    : lead ? { kind: "spawn", why: "复杂活: 白板起一个 hard 档的 lead, 由它组队" }
+                        : decide(task, cands, now, ttlMs, force);
+            // 复杂活 (lead:true) 是一件「需求」: 先开需求根单 (账本, 不占 pane), 这一句带它派下去, lead 记成根单成员。
+            // 小活不开单。dryRun 不落账, 所以放在它后面开 (见下)。
+            const criteria = (b.criteria ?? "").toString().trim();
+            let rootId = "";
+            const tell = (name, text, extra = "") => tellPeerAs(self, {
+                name, text, public: b.public !== false, force,
+                // lead 的活远超默认的 1h: 不给 deadline 就按 12h (回执的上限)。
+                ...(b.deadline !== undefined ? { deadline: b.deadline } : lead ? { deadline: 43200 } : {}),
+                ...(rootId ? { job: rootId } : {}),
+            }, extra);
+            const shown = cands.slice(0, 3).map((e) => `.${e.row.address || e.row.name}${e.row.busy ? " 忙" : ""}`);
+            if (b.dryRun) {
+                json(res, 200, { ok: true, dryRun: true, decision: d.kind, reason: d.why, ...(d.kind === "existing" ? { name: to || (d.kind === "existing" && d.row ? d.row.address || d.row.name : "") } : { tier: (b.tier ?? "").toString().trim() || tierFor(task, lead) }), ...(shown.length ? { candidates: shown } : {}) });
+                return;
+            }
+            if (lead) {
+                const head = (b.description ?? "").toString().trim() || task.split("\n")[0].trim();
+                rootId = jobs.open(baseOfKey(self), self, truncate(head, 60), {
+                    kind: "req", ...(criteria ? { criteria, gate: { g1: now } } : {}),
+                    origin: { text: (currentHumanQueryOf(self) || task).trim(), chat: channelOf(self) },
+                }).id;
+            }
+            // 没投成的根单当场收掉: 留着只是一张没人干的空单。
+            const settleRoot = (ok) => { if (rootId && !ok)
+                jobs.close(rootId, "派活没投成"); };
+            const withRoot = (body) => rootId
+                ? { ...body, job: rootId, hint: "需求根单已开, 对人**别提单号**。lead 交付后根单仍开着, 等人验收: 人认可 → close_job(job) 归档并回收 lead; 人说不对 → tell_peer({name, re, job}) 给 lead 返工 (同一张单, 不开新单); 人说不要了 → close_job({job, as:\"cancel\"}); 先放着 → close_job({job, as:\"shelve\"}) (停提醒, 不关单)。" }
+                : body;
+            if (d.kind === "existing") {
+                const name = to || (d.kind === "existing" && d.row ? d.row.address || d.row.name : "");
+                const r = resolvePeer(self, name);
+                if (!r.ok) {
+                    settleRoot(false);
+                    json(res, r.status, { ok: false, reason: r.reason, candidates: r.candidates });
+                    return;
+                }
+                // 已有 wizard 当 lead: 宪章是出生时定的 (里面没有 lead 一节), 规矩加打法挂在信封后面带过去;
+                // 已是 lead 的宪章里已有层级规矩, 只带打法。投成了才记 lead, 它下次重生宪章里就有。
+                const t = await tell(name, task, lead ? renderReminder({ wezard: "lead" }, wizards.get(r.target)?.lead ? renderLeadPlaybook() : renderLead()) : "");
+                if (lead && t.status === 200)
+                    wizards.upsert(r.target, { lead: true });
+                if (rootId && t.status === 200)
+                    jobs.attach(rootId, { target: r.target, task: "", spawned: false, role: "lead" });
+                // 自动选中的被冷门控退回 (decide 用名册的活动时刻, 门控用 transcript 的, 口径差一点): 改走 spawn。
+                if (!(t.body.gated === "cold" && !to)) {
+                    settleRoot(t.status === 200);
+                    json(res, t.status, withRoot({ ...t.body, decision: "existing", reason: d.why, ...(shown.length ? { candidates: shown } : {}) }));
+                    return;
+                }
+                d = { kind: "spawn", why: `${d.why}; 但它被冷门控退回 (${String(t.body.reason)}) —— 改为白板 spawn` };
+            }
+            const name = (b.name ?? "").toString().trim();
+            const description = (b.description ?? "").toString().trim();
+            if (!name || !description) {
+                settleRoot(false);
+                json(res, 400, { ok: false, decision: "spawn", reason: `${d.why} —— 要新生一个, 带上 name (这件事的短名) 与 description (它的职责) 重发`, ...(shown.length ? { candidates: shown } : {}) });
+                return;
+            }
+            const tier = (b.tier ?? "").toString().trim() || tierFor(task, lead);
+            const born = await bearAs(self, { inherit: false, name, description, tier, ...(lead ? { lead: true } : {}) });
+            if (born.status !== 200) {
+                settleRoot(false);
+                json(res, born.status, { ...born.body, decision: "spawn", reason: d.why });
+                return;
+            }
+            // 宪章里只有层级规矩, 打法随信封带 (宪章每轮都在上下文里, 打法只这一件活用得上)。
+            const t = await tell(String(born.body.name), task, lead ? renderReminder({ wezard: "lead" }, renderLeadPlaybook()) : "");
+            settleRoot(t.status === 200);
+            // 为这张根单生出来的: 归档 close_job 时要回收它 (tell 记的是 spawned:false, 再 attach 一次补上; lead 角色也在这里记)。
+            if (rootId && t.status === 200)
+                jobs.attach(rootId, { target: String(born.body.target), task: "", spawned: true, role: "lead" });
+            json(res, t.status, withRoot({
+                ...t.body,
+                decision: "spawn",
+                reason: d.why,
+                tier,
+                ...(born.body.model ? { model: born.body.model } : {}),
+                ...(born.body.effort ? { effort: born.body.effort } : {}),
+                ...(shown.length ? { candidates: shown } : {}),
+            }));
+        });
         // 记忆三种作用域: self 跟着自己 (wizards.json), 直写; chat / workspace 是共享的 md,
         // 每个在那个群 / 那个目录出生的 wizard 都会读到 —— 它们只收提议, 由整理者合并
         // (见 wizard-memory.ts / memory-steward.ts)。
@@ -1871,62 +2223,56 @@ const main = async () => {
         });
         // 生分身。默认 fork 调用方此刻的上下文 —— 这是"先把公共材料读进来, 再分出 N
         // 个干活的"之所以省事的原因: 材料只读一遍, 却进了 N 份上下文。
-        http.register("POST /wizard/clone", async (req, res) => {
-            const { self, body } = await readPeerBody(req);
-            if (!self) {
-                json(res, 400, { ok: false, reason: "cannot resolve caller session" });
-                return;
-            }
+        /** spawn_wizard / clone_wizard 的本体 —— HTTP 路由与 dispatch 共用。 */
+        const bearAs = async (self, body) => {
             const b = body;
-            const effort = parseEffort(b.effort);
-            if (b.effort !== undefined && !effort) {
-                json(res, 400, { ok: false, reason: `effort 只有这几档: ${EFFORTS.join(" / ")}` });
-                return;
+            const askedEffort = parseEffort(b.effort);
+            if (b.effort !== undefined && !askedEffort) {
+                return { status: 400, body: { ok: false, reason: `effort 只有这几档: ${EFFORTS.join(" / ")}` } };
+            }
+            const pick = pickTier(cfg.models, b.tier, { cli: b.cli, model: b.model, effort: askedEffort }, b.inherit === true);
+            if (!pick.ok) {
+                return { status: 400, body: pick };
             }
+            const effort = pick.effort;
             // 工单先验: 生完分身才发现工单号打错了, 那个分身就成了没人认领的孤儿。
             const jobId = (b.job ?? "").trim();
             if (jobId) {
                 const jc = checkJob(jobId, undefined, !(b.task ?? "").toString().trim());
                 if (!jc.ok) {
-                    json(res, jc.status, { ok: false, reason: jc.reason });
-                    return;
+                    return { status: jc.status, body: { ok: false, reason: jc.reason } };
                 }
             }
             // `inherit` 没有默认值 —— 继承与否是两种完全不同的分身 (一种开局就带着你
             // 读过的一切, 另一种白纸一张), 猜错了要么白烧一份上下文, 要么让它从零重读。
             // 逼调用方每次自己说。
             if (typeof b.inherit !== "boolean") {
-                json(res, 400, { ok: false, reason: "inherit 必填: true = fork 你此刻的上下文 (它开局就有你读过的材料, 必须留在同一个 cwd); false = 空白分身, 只继承身份" });
-                return;
+                return { status: 400, body: { ok: false, reason: "inherit 必填: true = fork 你此刻的上下文 (它开局就有你读过的材料, 必须留在同一个 cwd); false = 空白分身, 只继承身份" } };
             }
             const inherit = b.inherit;
             // detached = 独立长住 (原 new_claude_session / 人在群里 `/new .x`): 不挂家谱、不占
             // 调用方的分身名额、不随工单回收。它和「fork 我的上下文」「归某张工单」都互斥。
             const detached = b.detached === true;
             if (detached && (inherit || (b.job ?? "").trim())) {
-                json(res, 400, { ok: false, reason: "detached 只用于白板 (inherit:false) 且不带 job —— 独立长住的 wizard 不归你管, 也不随工单回收" });
-                return;
+                return { status: 400, body: { ok: false, reason: "detached 只用于白板 (inherit:false) 且不带 job —— 独立长住的 wizard 不归你管, 也不随工单回收" } };
             }
             // 克隆的源头: 默认是调用方自己; `from` 点名就 fork 那个 wizard 此刻的上下文。
             // 分身仍归调用方管 (parent = self: 占它的预算、随它的工单回收), 只有上下文来自别处。
             // 空串不能交给 resolvePeer —— 那是「本聊天的默认 wizard」, 不是「我自己」。
             const fromAddr = (b.from ?? "").toString().trim();
             if (fromAddr && !inherit) {
-                json(res, 400, { ok: false, reason: "from 只对克隆有意义 —— 白板生出来的 wizard 不带任何人的上下文" });
-                return;
+                return { status: 400, body: { ok: false, reason: "from 只对克隆有意义 —— 白板生出来的 wizard 不带任何人的上下文" } };
             }
             const fromR = fromAddr ? resolvePeer(self, fromAddr) : { ok: true, target: self };
             if (!fromR.ok) {
-                json(res, fromR.status, { ok: false, reason: fromR.reason, ...(fromR.candidates ? { candidates: fromR.candidates } : {}) });
-                return;
+                return { status: fromR.status, body: { ok: false, reason: fromR.reason, ...(fromR.candidates ? { candidates: fromR.candidates } : {}) } };
             }
             const source = fromR.target;
             const sourceInfo = m.sessionInfo(source);
             // 别人的会话 fork 不出来就是失败, 不能像克隆自己那样悄悄退化成白板 —— 调用方
             // 要的恰恰是它的上下文, 给一张白纸等于答非所问。
             if (source !== self && !sourceInfo?.sessionId) {
-                json(res, 409, { ok: false, reason: `${displayName(source)} 没有可 fork 的会话 (还没说过话, 或绑定已失效)` });
-                return;
+                return { status: 409, body: { ok: false, reason: `${displayName(source)} 没有可 fork 的会话 (还没说过话, 或绑定已失效)` } };
             }
             const alivePeers = detached ? [] : await m.peers(self);
             // 预算。撞到上限不是"不许再分", 是"先把干完活的收掉": stop_wizard 收单个,
@@ -1934,30 +2280,27 @@ const main = async () => {
             // 生到别的聊天去的归那边管, 为了数它们再探一遍 tmux 不值当。
             const aliveKids = childrenOf(wizards.all(), self).filter((k) => alivePeers.some((pp) => pp.target === k.target && pp.paneAlive));
             if (!detached && aliveKids.length >= cfg.wrc.mirror.cloneMax) {
-                json(res, 429, {
-                    ok: false,
-                    reason: `你名下已经有 ${aliveKids.length} 个活着的分身 (上限 ${cfg.wrc.mirror.cloneMax}) —— 先 stop_wizard 收掉干完活的那些, 或者 close_job 整批回收一个工单`,
-                    clones: aliveKids.map((k) => peerAddress(cfg, self, k.target)),
-                });
-                return;
+                return { status: 429, body: {
+                        ok: false,
+                        reason: `你名下已经有 ${aliveKids.length} 个活着的分身 (上限 ${cfg.wrc.mirror.cloneMax}) —— 先 stop_wizard 收掉干完活的那些, 或者 close_job 整批回收一个工单`,
+                        clones: aliveKids.map((k) => peerAddress(cfg, self, k.target)),
+                    } };
             }
             const wantChat = (b.chat ?? "").toString().trim();
             const base = wantChat ? chatBaseOf(cfg, wantChat) : baseOfKey(self);
             if (!base) {
-                json(res, 404, {
-                    ok: false,
-                    reason: `unknown chat '${wantChat}' — 只有起过名字的聊天能被指名; 让那边先 /name`,
-                    candidates: listChatNames(cfg).map((c) => c.name),
-                });
-                return;
+                return { status: 404, body: {
+                        ok: false,
+                        reason: `unknown chat '${wantChat}' — 只有起过名字的聊天能被指名; 让那边先 /name`,
+                        candidates: listChatNames(cfg).map((c) => c.name),
+                    } };
             }
             const askedName = String(b.name ?? b.tag ?? "");
             // 没起名: 独立长住的按目录名 (同 /new 与 new_claude_session), 分身按职责的首词。
             const fallback = (detached && b.cwd ? tagFromCwd(b.cwd) : "") || normalizeTag(b.description?.split(/\s+/)[0]) || "clone";
             const slotR = await claimSlot(base, askedName, fallback, [self, source]);
             if (!slotR.ok) {
-                json(res, slotR.status, slotR.body);
-                return;
+                return { status: slotR.status, body: slotR.body };
             }
             const { target, slot: tag } = slotR;
             // claimSlot 会复用同名的冷记录 (detached 正是「叫回一个老名字」的场景): 生不出来时
@@ -1975,6 +2318,9 @@ const main = async () => {
                 // fork 了上下文就一并继承 self 记忆: 系统提示不随 fork 走 (分身拿的是自己的宪章),
                 // 不拷的话它开局就没有, /clear 或交接重开后更是彻底没了。标上来源; 已经是继承来的不再套一层。
                 ...(inherit ? { memory: (wizards.get(source)?.memory ?? []).map((x) => x.startsWith("(继承自 ") ? x : `(继承自 ${displayName(source)}) ${x}`) } : {}),
+                tier: pick.tier,
+                // 显式写 undefined: 复用的冷记录可能当过 lead。
+                lead: b.lead === true ? true : undefined,
                 // 生完才清; 这个进程中途没了, 下次开机由 sweepUnborn 认出并收掉。
                 spawning: BOOT_ID,
             });
@@ -1992,15 +2338,16 @@ const main = async () => {
                 parent: source,
                 target,
                 windowName: name,
-                cli: b.cli,
-                model: b.model,
+                cli: pick.cli,
+                model: pick.model,
                 effort,
                 cwd: b.cwd,
                 systemPrompt: charter,
                 inherit,
                 // 继承路径上第一句话是分叉的触发器, 所以直接把活当开场白 —— 少一次往返,
                 // 也少一次"就位了但没事干"的空转。
-                bootstrap: task ? task + envelopeFor(self, "", { turn: taskTurn }) : undefined,
+                // 子 lead 的宪章只有层级规矩, 打法跟第一句的信封走 (同 dispatch 对已有 wizard 的做法)。
+                bootstrap: task ? task + envelopeFor(self, "", { turn: taskTurn }) + (b.lead === true ? renderReminder({ wezard: "lead" }, renderLeadPlaybook()) : "") : undefined,
                 ...(task ? { bootstrapFrom: { from: { kind: "peer", from: self, turn: taskTurn, ...(jobId ? { job: jobId } : {}), ...(asker ? { asker } : {}) }, query: task } } : {}),
                 keepalive,
             }).catch((e) => ({ ok: false, reason: `spawn threw: ${String(e)}`, inherited: false }));
@@ -2010,20 +2357,19 @@ const main = async () => {
                     wizards.upsert(target, { spawning: undefined });
                 else
                     wizards.drop(target);
-                json(res, 500, { ok: false, reason: r.reason });
-                return;
+                return { status: 500, body: { ok: false, reason: r.reason } };
             }
             wizards.upsert(target, { spawning: undefined, clonedFrom: r.inherited ? sourceInfo?.sessionId ?? "" : "", ...(r.inherited ? {} : { forkOf: undefined }) });
             const kid = briefOf(self, target);
-            // r.model 是 spawnTmuxClaude 通过 /model 实测确认落地的那个 —— 可能跟调用方
-            // 传的原始字符串不一样 (口语化 → 目录里匹配到的关键词), 播报要报实情。
-            const modelNote = (r.model
-                ? (r.modelWarning ? ` · 模型 ${r.model} (⚠️ ${r.modelWarning})` : ` · 模型 ${r.model}`)
-                : "") + (r.effort ? ` · effort ${r.effort}` : "");
             // 出生不再发群气泡 (人要看的是结论, 不是谁生了谁 —— 过程在 rolepage 里);
             // 同群的 wizard 仍要知道群里多了一个成员。工单里的临时工连这条也省掉。
             if (!jobId) {
-                postRoster(base, [target, self], `新 wizard **.${name}** 就位${kid.description ? ` · ${kid.description}` : ""}${r.cwd ? ` · 工作区 ${r.cwd}` : ""}${modelNote}${keepalive ? "" : " · 已关闭 keepalive"} —— ${detached ? `空白起步, 由 ${displayName(self)} 造的` : `${displayName(self)} 的分身`}${r.inherited ? ` (继承了${forkOf ? ` ${displayName(forkOf)} ` : "它"}的上下文)` : ""}`);
+                // 模型 / keepalive 不报: 那是生它的那位的事, 旁人要时 wizard_roster 有。
+                postRoster(base, [target, self], {
+                    op: "born", name: `.${name}`, by: displayName(self), clone: !detached,
+                    ...(r.inherited ? { ctx: forkOf ? displayName(forkOf) : displayName(self) } : {}),
+                    ...(kid.description ? { job: kid.description } : {}), cwd: r.cwd,
+                }, subjectOf(wizards.get(target)));
             }
             // 继承路径上活已经随开场白进去了, 空白分身才需要在这里补一次注入 (私聊)。
             let dispatched = r.inherited && !!task;
@@ -2031,8 +2377,11 @@ const main = async () => {
                 const inj = await m.injectText(target, task, undefined, { from: { kind: "peer", from: self, turn: taskTurn, ...(jobId ? { job: jobId } : {}), ...(asker ? { asker } : {}) }, channel: "", envelope: envelopeFor(self, "", { turn: taskTurn }) });
                 dispatched = inj.ok;
             }
-            if (jobId)
-                jobs.attach(jobId, { target, task, spawned: true });
+            if (jobId) {
+                const role = roleParam(body.role);
+                const from = inherit ? source : undefined;
+                jobs.attach(jobId, { target, task, spawned: true, ...(role ? { role } : {}), ...(from ? { forkOf: from } : {}) });
+            }
             if (jobId && dispatched)
                 jobs.spend(jobId);
             // 分身的第一件活也守回执: fan-out 最常见的形状就是 clone_wizard({task}) × N,
@@ -2040,7 +2389,18 @@ const main = async () => {
             const k = body.chain === false ? undefined : parentKOf(self);
             if (dispatched)
                 receipts.register({ from: self, to: target, channel: "", job: jobId, at: taskAt, turn: taskTurn, ...(k ? { k } : {}), ...(asker ? { asker } : {}) });
-            json(res, 200, { ok: true, target, name, address: name, inherited: r.inherited, sessionId: r.sessionId, cwd: r.cwd, dispatched, keepalive, ...(r.model ? { model: r.model } : {}), ...(r.modelWarning ? { modelWarning: r.modelWarning } : {}), ...(r.effort ? { effort: r.effort } : {}), ...(jobId ? { job: jobId } : {}), ...(detached ? { detached: true } : {}) });
+            if (dispatched)
+                ledger.open({ turn: taskTurn, owner: self, to: target, text: task, at: taskAt, ...(jobId ? { job: jobId } : {}), ...(k ? { for: k } : {}), ...(asker ? { asker } : {}) });
+            return { status: 200, body: { ok: true, target, name, address: name, inherited: r.inherited, sessionId: r.sessionId, cwd: r.cwd, dispatched, ...(dispatched ? { turn: taskTurn } : {}), keepalive, ...(r.model ? { model: r.model } : {}), ...(r.modelWarning ? { modelWarning: r.modelWarning } : {}), ...(r.effort ? { effort: r.effort } : {}), ...(pick.tier ? { tier: pick.tier } : {}), via: pick.via, ...(pick.note ? { tierNote: pick.note } : {}), ...(jobId ? { job: jobId } : {}), ...(detached ? { detached: true } : {}) } };
+        };
+        http.register("POST /wizard/clone", async (req, res) => {
+            const { self, body } = await readPeerBody(req);
+            if (!self) {
+                json(res, 400, { ok: false, reason: "cannot resolve caller session" });
+                return;
+            }
+            const r = await bearAs(self, body);
+            json(res, r.status, r.body);
         });
         // 收掉一个 wizard。interrupt = 打断它这一轮 (Esc); end = 结束它并回收 pane。
         // 自己终结自己是合法的 (分身干完活自我了结), 代价是这次工具调用不会返回 ——
@@ -2073,6 +2433,8 @@ const main = async () => {
             }
             const { target } = r;
             const victim = briefOf(self, target);
+            // 当事人要在 forget 抹掉记录之前取 (见 subjectOf)。
+            const victimRec = wizards.get(target);
             const end = (b.mode ?? "end") === "end";
             if (!end && target === self) {
                 json(res, 400, { ok: false, reason: "打断自己没有意义 —— 你就是正在生成的那一个" });
@@ -2122,7 +2484,7 @@ const main = async () => {
             const detached = end && b.forget ? forgetWizard(target) : [];
             // 打断只是停了它这一轮, 它还在; 只有结束才是名册变了。
             if (end)
-                postRoster(baseOfKey(target), [target, self], `**${victim.name || target}** 已收工 · 由 ${displayName(self)} 结束${b.forget ? " (记录一并抹掉)" : ""}`);
+                postRoster(baseOfKey(target), [target, self], { op: "ended", name: victim.name ? `.${victim.name}` : target, by: displayName(self), ...(b.forget ? { why: "forgotten" } : {}) }, subjectOf(victimRec));
             json(res, 200, { ok: true, target, name: victim.name, mode: end ? "end" : "interrupt", forgotten: !!(end && b.forget), ...(canceled ? { canceled } : {}), ...(detached.length ? { canceledIn: detached } : {}) });
         });
         // 换模型 / effort: 省略名字 = 换自己 (选择器盖在正在跑的这一轮上面照样能开), 点名 =
@@ -2203,13 +2565,38 @@ const main = async () => {
             const base = baseOfKey(self);
             const maxTurns = Math.min(200, Math.max(0, Math.floor(Number(b.maxTurns) || 0)));
             const plan = (b.plan ?? "").toString().trim();
+            const criteria = (b.criteria ?? "").toString().trim();
+            // 上级工单: 显式传的要求自己是它的成员或开单者; 不传 = 自己作为未落定成员所在的、最近开的那张
+            // (lead 在需求根单里领了活, 开的第一张子单自然挂在根单下, 不用自己记号)。
+            const all = jobs.all();
+            const mineIn = (j) => j.owner === self || j.members.some((x) => x.target === self);
+            const askedParent = (b.parent ?? "").toString().trim();
+            // 推断: 同一个群里、我作为未落定成员的开着的单, 取我**最近一次领活** (mm.at) 的那张; 它已在最深一层就不挂了 (退成根单, 不 409)。
+            const inferred = all
+                .filter((j) => j.base === base && j.status === "open")
+                .flatMap((j) => j.members.filter((x) => x.target === self && !x.outcome).map((x) => ({ j, at: x.at })))
+                .sort((x, y) => y.at - x.at)[0]?.j;
+            const parentJob = askedParent ? jobs.get(askedParent) : inferred && depthOf(jobs.get, inferred) < JOB_DEPTH_MAX ? inferred : undefined;
+            if (askedParent && !parentJob) {
+                json(res, 404, { ok: false, reason: `没有上级工单 '${askedParent}'` });
+                return;
+            }
+            if (askedParent && parentJob && (parentJob.status !== "open" || !mineIn(parentJob))) {
+                json(res, 409, { ok: false, reason: `上级工单 '${askedParent}' 已收工, 或你既不是它的成员也不是它的开单者` });
+                return;
+            }
+            if (parentJob && depthOf(jobs.get, parentJob) + 1 > JOB_DEPTH_MAX) {
+                json(res, 409, { ok: false, reason: `工单树最深 ${JOB_DEPTH_MAX} 层, 你这张 (挂在 ${parentJob.id} 下) 会是第 ${depthOf(jobs.get, parentJob) + 1} 层 —— 子活交给现有成员, 别再往下长` });
+                return;
+            }
             // 不出群气泡: 工单是私下的过程, 人看到的只有发起者那一轮的最终回复。
             const accept = ACCEPTS.find((x) => x === b.accept);
-            const job = jobs.open(base, self, title, { ...(plan ? { plan } : {}), ...(accept ? { accept } : {}), ...(expect ? { expect } : {}), ...(maxTurns ? { maxTurns } : {}) });
+            const job = jobs.open(base, self, title, { ...(plan ? { plan } : {}), ...(accept ? { accept } : {}), ...(expect ? { expect } : {}), ...(maxTurns ? { maxTurns } : {}), ...(parentJob ? { parent: parentJob.id } : {}), ...(criteria ? { criteria } : {}) });
             json(res, 200, {
                 ok: true,
                 job: job.id,
                 title,
+                ...(parentJob ? { parent: parentJob.id } : {}),
                 memberMax: JOB_MEMBER_MAX,
                 hint: "把这个 id 传给 spawn_wizard / clone_wizard / tell_peer 的 `job` 参数, 它们就归到这个工单名下 (一律私聊, 不进群); 活干完调 close_job 留档并回收临时分身, 给人的结论写在你自己这一轮的最终回复里。",
             });
@@ -2231,23 +2618,97 @@ const main = async () => {
                 json(res, 409, { ok: false, reason: `工单 '${id}' 已经收工了`, closedAt: job.closedAt });
                 return;
             }
-            // 回收只针对**为这个工单生出来的**分身: 被拉来帮忙的长期 wizard 不该因为一次
-            // 活结束就被杀掉。调用方自己也不收 —— 那会在这次工具调用里把自己干掉。
+            // 只有这张单或它某个祖先单的 owner 能关 (成员、同群的旁人不行)。
+            if (![job, ...jobAncestors(jobs.get, job)].some((j) => j.owner === self)) {
+                json(res, 403, { ok: false, reason: `工单 '${id}' 不是你开的, 也不是你开的某张上级单的后代 —— 只有开单者 (或上级单的开单者) 能收工` });
+                return;
+            }
+            // 四种收法 (只 accept / cancel 真关单): shelve / resume 只动需求根单的搁置标记, 单照旧开着。
+            const how = ["accept", "cancel", "shelve", "resume"].find((x) => x === (b.as ?? "accept"));
+            if (!how) {
+                json(res, 400, { ok: false, reason: `as 只认 accept / cancel / shelve / resume, 收到 '${b.as}'` });
+                return;
+            }
+            if ((how === "shelve" || how === "resume") && job.kind !== "req") {
+                json(res, 400, { ok: false, reason: `只有需求根单能搁置 / 恢复, '${id}' 不是 (它不是 dispatch({lead:true}) 开的根单)` });
+                return;
+            }
+            if (how === "shelve" || how === "resume") {
+                // 恢复不是「又交付了」: 保留 n, lastAt 记成此刻, 下一次冒泡从现在起算, 不一恢复就立刻冒。
+                jobs.mark(id, how === "shelve" ? { hold: Date.now() } : { hold: undefined, nudge: { n: job.nudge?.n ?? 0, lastAt: Date.now() } });
+                json(res, 200, { ok: true, job: id, [how === "shelve" ? "shelved" : "resumed"]: true });
+                return;
+            }
+            // 关一张单连它还开着的后代单一起关 (深的先关): 否则子 lead 的分身留在原地、账本上挂着没人收的单。
+            // 回收只针对**为这个工单生出来的**分身: 被拉来帮忙的长期 wizard 不该因为一次活结束就被杀掉。
+            // 调用方自己也不收 —— 那会在这次工具调用里把自己干掉。
             const recycle = b.stop !== false;
-            const victims = recycle ? job.members.filter((mm) => mm.spawned && mm.target !== self) : [];
-            // 收掉之前把它们手上没落定的活记成 canceled: 不然发起者收工之后还会收到一串 dead 回执。
-            victims.forEach((mm) => receipts.cancel(mm.target, self));
-            // 留档要的 sessionId 得在回收之前取: killPane 连绑定一起删。
-            const sids = new Map([job.owner, ...job.members.map((mm) => mm.target)].map((t) => [t, m.sessionInfo(t)?.sessionId ?? ""]));
-            const killed = await victims.reduce(async (acc, mm) => (await acc) + ((await m.killPane(mm.target)).ok ? 1 : 0), Promise.resolve(0));
-            const closed = jobs.close(id, (b.summary ?? "").toString());
-            // 收工结论留档到开单者名下 (与交接简报同一份 jsonl); 空工单 (没人、没结论) 不记。
-            if (closed.members.length || closed.summary?.trim()) {
-                const ep = jobEpisode(closed, { nameOf: episodeName, sidOf: (t) => sids.get(t) ?? "", chat: chatNameOf(cfg, job.base) || job.base });
-                if (!appendEpisode(episodePath(cfg.daemon.stateDir, ep.name), ep))
-                    log.warn({ job: id, name: ep.name }, "job episode not archived");
-            }
-            json(res, 200, { ok: true, job: id, members: closed.members.length, recycled: killed, kept: victims.length - killed });
+            const openKids = (j) => jobChildren(jobs.all(), j.id).filter((c) => c.status === "open").flatMap((c) => [...openKids(c), c]);
+            const cascade = openKids(job);
+            const closeOne = async (j, summary, mark) => {
+                const victims = recycle ? j.members.filter((mm) => mm.spawned && mm.target !== self) : [];
+                // 收掉之前把它们手上没落定的活记成 canceled: 不然发起者收工之后还会收到一串 dead 回执。
+                victims.forEach((mm) => receipts.cancel(mm.target, j.owner));
+                // 留档要的 sessionId 得在回收之前取: killPane 连绑定一起删。
+                const sids = new Map([j.owner, ...j.members.map((mm) => mm.target)].map((t) => [t, m.sessionInfo(t)?.sessionId ?? ""]));
+                const killed = await victims.reduce(async (acc, mm) => (await acc) + ((await m.killPane(mm.target)).ok ? 1 : 0), Promise.resolve(0));
+                // 取消: 还没落定、又不是为这张单生的成员 (长住 wizard) 不杀, 但它们名下这张单派的活记成 canceled, 发起者不会再收到一串回执。
+                if (how === "cancel")
+                    j.members.filter((mm) => !mm.outcome && !victims.includes(mm)).forEach((mm) => receipts.cancel(mm.target, j.owner, (x) => x.from === j.owner));
+                const closed = jobs.close(j.id, summary, mark);
+                ledger.closeJob(j.id);
+                // 收工结论留档到开单者名下 (与交接简报同一份 jsonl); 空工单 (没人、没结论) 不记。
+                if (closed.members.length || closed.summary?.trim()) {
+                    const ep = jobEpisode(closed, { nameOf: episodeName, sidOf: (t) => sids.get(t) ?? "", chat: chatNameOf(cfg, j.base) || j.base });
+                    if (!appendEpisode(episodePath(cfg.daemon.stateDir, ep.name), ep))
+                        log.warn({ job: j.id, name: ep.name }, "job episode not archived");
+                }
+                return { members: closed.members.length, killed, kept: victims.length - killed };
+            };
+            const rs = await [...cascade.map((c) => [c, `随上级单 ${id} 收工`]), [job, how === "cancel" ? `取消: ${(b.summary ?? "").toString()}` : (b.summary ?? "").toString()]]
+                // 根单收工: accept = G3 验收过闸 (人认可), cancel = 取消; 非根单没有闸。
+                .reduce(async (acc, [j, sum]) => [...(await acc), await closeOne(j, sum, j !== job ? undefined : how === "cancel" ? { end: "cancel" } : job.kind === "req" ? { gate: { g3: Date.now() }, end: "accept" } : undefined)], Promise.resolve([]));
+            const sum = (f) => rs.reduce((n, r) => n + f(r), 0);
+            json(res, 200, { ok: true, job: id, members: rs[rs.length - 1].members, recycled: sum((r) => r.killed), kept: sum((r) => r.kept), ...(cascade.length ? { cascaded: cascade.map((c) => c.id) } : {}) });
+        });
+        // 挂起事项全表 (见 pending-items.ts): 你派出去、还没了结的事。`drop` 显式消项;
+        // `name` 看别人的 (只读)。读过全表就算刚给过一次: 自动的全表提醒从此刻重新计。
+        http.register("POST /pending", async (req, res) => {
+            const { self, body } = await readPeerBody(req);
+            if (!self) {
+                json(res, 400, { ok: false, reason: "cannot resolve caller session" });
+                return;
+            }
+            const b = body;
+            const who = (b.name ?? "").toString().trim();
+            const r = who ? resolvePeer(self, who) : undefined;
+            if (r && !r.ok) {
+                json(res, r.status, { ok: false, reason: r.reason, candidates: r.candidates });
+                return;
+            }
+            const owner = r?.ok ? r.target : self;
+            const drop = Array.isArray(b.drop) ? b.drop.map(String) : typeof b.drop === "string" ? [b.drop] : [];
+            if (drop.length && owner !== self) {
+                json(res, 403, { ok: false, reason: "只能消自己派出去的" });
+                return;
+            }
+            const dropped = drop.length ? ledger.drop(self, drop, (b.why ?? "").toString().trim()) : [];
+            const now = Date.now();
+            const items = ledger.openOf(owner);
+            if (owner === self) {
+                const i = m.sessionInfo(self);
+                if (i)
+                    pendingMarks.set(self, { sid: i.sessionId, ctx: i.contextTokens, ctxAtFull: i.contextTokens, drains: 0 });
+            }
+            const missed = drop.filter((t) => !dropped.some((x) => x.turn === t.replace(/[`\s]/g, "")));
+            json(res, 200, {
+                ok: true,
+                text: [
+                    ...(dropped.length ? [`已消掉: ${dropped.map((x) => `\`${x.turn}\``).join(" ")}`] : []),
+                    ...(missed.length ? [`没找到 (不是你开着的): ${missed.join(" ")}`] : []),
+                    renderTable(items, liveOfTurns(), pendingNames, now, awaitingRows(owner, now), stalledRows(owner), shelvedRows(owner, now)),
+                ].join("\n"),
+            });
         });
         http.register("POST /jobs/list", async (req, res) => {
             const { self } = await readPeerBody(req);
@@ -2256,11 +2717,21 @@ const main = async () => {
                 return;
             }
             const inflight = receipts.states();
+            const live = jobLive();
+            const everything = jobs.all();
+            // 本群还开着的, 外加它们名下已收工的子单 (账本留着, 面包屑 / 树才不断)。
+            const shown = everything.filter((j) => j.base === baseOfKey(self) && (j.status === "open" || jobAncestors(jobs.get, j).some((a) => a.status === "open")));
             json(res, 200, {
                 ok: true,
-                jobs: jobs.openOf(baseOfKey(self)).map((j) => ({
+                jobs: treeOrder(shown).map(([j, depth]) => ({
                     job: j.id,
                     title: j.title,
+                    depth,
+                    ...(j.parent ? { parent: j.parent } : {}),
+                    ...(j.kind ? { kind: j.kind } : {}),
+                    stage: jobStage(j, everything, live),
+                    ...(j.criteria ? { criteria: j.criteria } : {}),
+                    status: j.status,
                     owner: displayName(j.owner),
                     mine: j.owner === self,
                     openedAt: j.openedAt,
@@ -2268,9 +2739,11 @@ const main = async () => {
                     ...(j.maxTurns ? { budget: `${j.turns ?? 0}/${j.maxTurns}` } : {}),
                     members: j.members.map((mm) => ({
                         address: peerAddress(cfg, self, mm.target),
+                        role: mm.role ?? "exec",
                         task: mm.task.split("\n")[0] ?? "",
                         spawned: mm.spawned,
                         state: mm.outcome ?? inflight.find((x) => x.to === mm.target && x.job === j.id)?.state ?? "unknown",
+                        ...(mm.forkOf ? { forkOf: peerAddress(cfg, self, mm.forkOf) } : {}),
                         ...(mm.artifacts?.length ? { artifacts: mm.artifacts } : {}),
                     })),
                 })),
@@ -2375,18 +2848,199 @@ const main = async () => {
             }
             json(res, 200, { ok: true, removed: renderTask(gone, state) });
         });
-        // POST /config/set — modify daemon config from MCP. 口令门见 `guarded`; 模型还得先过
-        // config_set 的审批卡 (danger.ts) 才走得到这里。
-        http.register("POST /config/set", guarded(async (req, res) => {
-            const body = (await readBody(req));
-            const r = configSet(cfg, sourcePath, body.key, body.value, body.action);
-            json(res, r.ok ? 200 : 400, r);
-        }));
+        // 确认卡在请求里最多等 4 分钟 (留出 fetch 5 分钟收头的余量), 卡本身半小时有效。
+        const CONFIRM_INLINE_MS = 240_000;
+        const CONFIRM_TIMEOUT_MS = 30 * 60_000;
+        // computeUsage 要扫一周的 transcript, 一分钟内的连问共用一份。
+        let usageMemo;
+        const tierUsage = () => {
+            if (usageMemo && Date.now() - usageMemo.at < 60_000)
+                return usageMemo.u;
+            const r = computeUsage();
+            const fold = (m) => new Map([...m].map(([id, x]) => [id, { tokens: sumTotal(x), cost: costOf(id, x) }]));
+            usageMemo = { at: Date.now(), u: { today: fold(r.today), week: fold(r.week) } };
+            return usageMemo.u;
+        };
+        const configEvidence = (p) => tierEvidence(cfg.models, p, tierUsage, (tier) => wizards.all().filter((w) => w.tier === tier).length, { tokens: fmtTokens, cost: fmtCost });
+        // ── 改配置会不会动到宪章 ─────────────────────────────────────────
+        // 宪章是 --append-system-prompt 压进去的, 随进程终身: 改了进宪章的配置, 已在跑的 wizard
+        // 看不见, 要 handoff 重开 (重新渲染宪章) 才换上。不按字段清单判 —— 宪章读哪些配置随代码变,
+        // 清单迟早漏; 改前改后各渲染一遍有会话的 wizard 的宪章, 变了的就是受影响的。
+        const charterSections = (text) => new Map(text.split(/^(?=## )/m).map((sec) => [sec.split("\n", 1)[0].replace(/^## /, ""), sec]));
+        const changedSections = (a, b) => {
+            const x = charterSections(a), y = charterSections(b);
+            return [...new Set([...x.keys(), ...y.keys()])].filter((k) => x.get(k) !== y.get(k));
+        };
+        /** pane 活着的 wizard —— 宪章在效的只有它们; 冷的醒来时宪章重渲染, 自然是新的。一次 list-panes 答完。 */
+        const liveWizards = async () => {
+            const snap = await runTmux(["list-panes", "-a", "-F", "#{pane_id}"]);
+            const live = new Set(snap.ok ? snap.stdout.split("\n").map((l) => l.trim()).filter(Boolean) : []);
+            return wizards.all().map((w) => w.target).filter((t) => live.has(m.sessionInfo(t)?.tmuxPane ?? ""));
+        };
+        /** 这些 wizard 此刻的宪章正文。 */
+        const charterSnapshot = (targets) => new Map(targets.map((t) => [t, charterText(t, charterOptsOf(t, m.getCwd(t).runningCwd || undefined), true)]));
+        /** 把 `next` 那一节换进活的 cfg 渲染一遍再换回 —— 同步完成, 中间没有 await, 别的模块看不见这一瞬。
+         *  reload 项落盘后活值不变, 只有这样才算得出它 reload 之后的宪章。 */
+        const charterUnder = (pl, targets) => {
+            const live = cfg;
+            const key = pl.path[0];
+            const saved = live[key];
+            live[key] = patchedTop(cfg, pl);
+            try {
+                return charterSnapshot(targets);
+            }
+            finally {
+                live[key] = saved;
+            }
+        };
+        const charterImpact = (before, pl) => {
+            const after = charterUnder(pl, [...before.keys()]);
+            return [...before].flatMap(([t, a]) => { const secs = changedSections(a, after.get(t) ?? a); return secs.length ? [{ target: t, sections: secs }] : []; });
+        };
+        /** 受影响的 wizard 各挂一条提醒 (随它下一条消息到); 给调用方的那段话。调用方自己受影响就直说要它 handoff。 */
+        const announceCharterImpact = (pl, hits, self) => {
+            if (!hits.length)
+                return "";
+            const when = pl.apply === "reload" ? "等守护进程 reload 之后再" : "";
+            const ask = `${when}调 \`handoff({brief})\` 原地重开 (手上这件告一段落就交; 宪章在 handoff 时重新生成)`;
+            const others = hits.filter((h) => h.target !== self);
+            others.forEach((h) => notices.post([h.target], `\`config_set ${pl.path.join(".")}\` 改动了你的宪章 (系统提示, 变了的段: ${h.sections.join(" / ")}); 已在跑的你看不见新规矩 —— ${ask}`));
+            const mine = hits.find((h) => h.target === self);
+            return [
+                "",
+                `⚠ 这次改动进了宪章 (系统提示): 已在跑的 wizard 看不见, 要 handoff 才换上。受影响 ${hits.length} 个: ${hits.map((h) => displayName(h.target)).join(" ")}`,
+                ...(others.length ? [`已给其余 ${others.length} 个各挂一条提醒 (随它们下一条消息到), 让它们${ask}`] : []),
+                ...(mine ? [`**你自己也在其中** (变了的段: ${mine.sections.join(" / ")}): 这一轮收尾后${ask}`] : []),
+            ].join("\n");
+        };
+        // POST /config/get —— 新 MCP 带 `path` (可空) 拿渲染好的文本; 老 MCP 带 `key` 拿 {key, value}。
         http.register("POST /config/get", async (req, res) => {
             const body = (await readBody(req));
-            const r = configGet(cfg, body.key);
+            if (typeof body.key === "string") {
+                const r = legacyGet(cfg, body.key);
+                json(res, r.ok ? 200 : 400, r);
+                return;
+            }
+            const r = configGet(cfg, sourcePath, body.path, configEvidence);
             json(res, r.ok ? 200 : 400, r);
         });
+        // chatPolicy 的键一律落成 base principal: 聊天名会改, 拿它当键一改名策略就悄悄失效。写名字照收,
+        // 换成它此刻指向的 principal; 认不出的拒写 (写错的键静默无效, 比报错难查)。unset 一个盘上原样存在的
+        // 键不换 —— 留给清理老写法 / 失效的键。
+        const pinChatKeys = (req) => {
+            const p = parsePath(req.path);
+            if (p[0] !== "chatPolicy")
+                return req;
+            const bad = (k) => ({ ok: false, reason: `认不出聊天 \`${k}\`: 键写 base principal (\`chat:wr…\` / \`user:…\`) 或聊天名 (/chats)` });
+            if (p.length === 1) {
+                if (req.value === undefined || typeof req.value !== "object" || Array.isArray(req.value))
+                    return req;
+                const pairs = Object.entries(req.value).map(([k, v]) => [k, chatBaseOf(cfg, k), v]);
+                const miss = pairs.find(([, b]) => !b);
+                return miss ? bad(miss[0]) : { ...req, value: Object.fromEntries(pairs.map(([, b, v]) => [b, v])) };
+            }
+            const key = p[1];
+            if (req.op === "unset" && p.length === 2 && key in cfg.chatPolicy)
+                return req;
+            const base = chatBaseOf(cfg, key);
+            return base ? { ...req, path: ["chatPolicy", base, ...p.slice(2)].join(".") } : bad(key);
+        };
+        // POST /config/set —— 口令门见 `guarded`。分级在这里而不在 hook: `card` 项由守护进程
+        // 自己推确认卡, 所以 danger.skipAll / ⏱窗口 都放不掉它。卡等 CONFIRM_INLINE_MS 还没人点
+        // 就先回 pending (fetch 默认 5 分钟收不到头就断), 卡仍有效, 迟到的确认照常落盘并捎一句给调用方。
+        http.register("POST /config/set", guarded(async (req, res) => {
+            const body = (await readBody(req));
+            const legacy = typeof body.key === "string";
+            const asked = legacy ? fromLegacy(body.key, body.value, body.action) : body;
+            if ("ok" in asked) {
+                json(res, 400, asked);
+                return;
+            }
+            const ask = pinChatKeys(asked);
+            if ("ok" in ask) {
+                json(res, 400, ask);
+                return;
+            }
+            const reply = (pl, text, extra = {}) => json(res, 200, legacy
+                ? { ok: true, key: body.key, before: pl.before, after: pl.after, ...extra }
+                : { ok: true, text, ...extra });
+            const pl = planSet(cfg, sourcePath, ask);
+            if (!pl.ok) {
+                json(res, 400, pl);
+                return;
+            }
+            if (ask.dryRun || !pl.changed) {
+                reply(pl, `${ask.dryRun ? "dryRun, 没写:\n" : ""}${renderPlan(pl)}`);
+                return;
+            }
+            // 落盘时重算一遍: 等卡期间文件可能被别人改过, 按那一刻的文件打补丁、再校验。
+            // 宪章快照取在落盘之前: hot 项一 applyHot, 活的 cfg 就已经是新的了。
+            // 不用 resolveSelf: 它最后回落到 defaultChat, 会把认不出的调用方当成那个群的管家。
+            const caller = (body.sessionId?.trim() && m.targetForSession(body.sessionId.trim())) || (body.tmuxPane?.trim() && m.targetForPane(body.tmuxPane.trim())) || undefined;
+            const commit = async () => {
+                const targets = await liveWizards();
+                // 从这里到 applyHot 之间不能有 await: 快照与落盘之间别人的 config_set 插进来, 前后就对不上了。
+                const now = planSet(cfg, sourcePath, ask);
+                if (!now.ok)
+                    return now;
+                const before = charterSnapshot(targets);
+                patchJsonc(sourcePath, [{ path: now.jsonPath, value: now.value }]);
+                applyHot(cfg, now);
+                // 已经落盘了: 比对失败只少一句提醒, 不能让调用方以为没写而重发。
+                try {
+                    return { ...now, charter: announceCharterImpact(now, charterImpact(before, now), caller) };
+                }
+                catch (e) {
+                    log.warn({ err: errText(e), path: now.path.join(".") }, "config_set: 宪章影响比对失败");
+                    return { ...now, charter: `\n(宪章影响没比对出来: ${errText(e)} —— 改的若是进宪章的配置, 受影响的 wizard 要 handoff 才换上)` };
+                }
+            };
+            const done = (now) => `已写入${now.apply === "hot" ? ", 已生效" : "; 需 reload (`./cli/wezard.sh reload`) 才生效"}:\n${renderPlan(now)}${now.charter}`;
+            if (pl.gate !== "card") {
+                const now = await commit();
+                if (!now.ok) {
+                    json(res, 400, now);
+                    return;
+                }
+                reply(now, done(now));
+                return;
+            }
+            const self = resolveSelf(body);
+            if (!self) {
+                json(res, 400, { ok: false, reason: "cannot resolve caller session; 这一项要发确认卡给人点" });
+                return;
+            }
+            let decided;
+            try {
+                ({ decided } = await requestConfirm({
+                    client: ws.client, principal: self, who: displayName(self),
+                    title: `配置变更待确认 · ${pl.path.join(".")}`,
+                    body: `${displayName(self)} 要改配置:\n${renderPlan(pl)}`,
+                    timeoutMs: CONFIRM_TIMEOUT_MS,
+                }));
+            }
+            catch (e) {
+                json(res, 503, { ok: false, reason: `确认卡发不出去 (${errText(e)}), 没写` });
+                return;
+            }
+            const settle = async (yes) => {
+                if (!yes)
+                    return `人没确认 (拒绝或超时), \`${pl.path.join(".")}\` 没写`;
+                const now = await commit();
+                return now.ok ? done(now) : `人确认了, 但落盘前重算没过, 没写: ${now.reason}`;
+            };
+            const inline = await Promise.race([decided, sleep(CONFIRM_INLINE_MS).then(() => undefined)]);
+            if (inline !== undefined) {
+                const text = await settle(inline);
+                json(res, 200, legacy ? { ok: inline, key: body.key, before: pl.before, after: inline ? pl.after : pl.before, note: text } : { ok: true, text, confirmed: inline });
+                return;
+            }
+            void decided.then(async (yes) => notices.post([self], `config_set 的确认卡有结果了: ${await settle(yes)}`))
+                .catch((e) => log.warn({ err: errText(e) }, "config_set: 迟到的确认落盘失败"));
+            json(res, 200, legacy
+                ? { ok: false, reason: "确认卡已发到群里, 还没人点; 点了之后自动落盘" }
+                : { ok: true, pending: true, text: `确认卡已发到群里, 还没人点 (卡 ${CONFIRM_TIMEOUT_MS / 60_000} 分钟内有效)。点了之后守护进程自动落盘, 结果会捎在你下一条收到的消息上 —— 不用重发。\n${renderPlan(pl)}` });
+        }));
         // POST /graph/run — declare a loop graph over this chat's tagged sessions
         // and start walking it. Fire-and-forget: returns a runId immediately, then
         // narrates progress into the chat while it advances.
@@ -2411,6 +3065,9 @@ const main = async () => {
                 return;
             }
             const graphLog = log.child({ mod: "graph", base: spec.base });
+            // 每一步、每条进度都在发起这次 run 的那一轮的频道里: 人在群里叫它发起的才进群,
+            // 私聊轮里发起的整场只进 rolepage —— 步骤不带频道就等于在节点的 home 群里开口。
+            const channel = m.currentChannel(self);
             const run = startGraph(spec, {
                 // Reuse a live tagged pane; only spawn when the node doesn't exist yet
                 // (or its pane died). Re-spawning a healthy node would throw away the
@@ -2425,10 +3082,11 @@ const main = async () => {
                     const r = await m.newSession(target, node.tag, node.cli, { model: node.model, cwd: node.cwd, silent: true });
                     return { ok: r.ok, reason: r.reason };
                 },
-                send: async (target, text, origin) => (await handedOff(target), m.injectText(target, text, origin)),
+                send: async (target, text, origin) => (await handedOff(target), m.injectText(target, text, origin, { channel })),
                 isBusy: m.isBusy,
                 lastText: async (target) => m.lastText(target),
-                notify: notifyChat,
+                notify: (_base, markdown) => { if (channel)
+                    notifyChat(channel, markdown); },
                 log: graphLog,
             });
             json(res, 200, { ok: true, runId: run.runId, base: run.base, nodes: spec.nodes.length, steps: spec.steps.length, rounds: spec.rounds ?? 1 });