wezard 2.6.1 → 2.6.3

package/dist/daemon/index.js

@@ -28,7 +28,7 @@ import { loadMirrorStore } from "./mirror-store.js";
 import { startMirror, installMirrorEventListener } from "./mirror-bridge.js";
 import { backendFor, runTmux, setTmuxTimeoutReporter, spawnTmuxClaude } from "./spawn-tmux.js";
 import { bindCardChannel, installApprovalEventListener, makeApproveHandler, requestConfirm } from "./approval.js";
-import { initDetailPersistence, makeDetailHandler, chatHandlers, configureRemoteForward, chatUrlFor, setWorldFactsProvider, currentHumanQueryOf, recordPost, recordCharter, backfillCharter } from "./detail.js";
+import { initDetailPersistence, makeDetailHandler, chatHandlers, configureRemoteForward, chatUrlFor, buildChatUrl, getDetail, setWorldFactsProvider, currentHumanQueryOf, recordPost, recordCharter, backfillCharter } from "./detail.js";
 import { EMPTY_FACTS } from "../shared/world.js";
 import { clearAutoWindow, initAutoWindowPersistence, setAutoWindow } from "./session-cache.js";
 import { makeMessageHandler } from "./outbound.js";
@@ -37,9 +37,11 @@ import { drainForReload, listPending } from "./pending.js";
 import { makeClaimStartHandler, makeClaimStatusHandler, makeClaimResetHandler, } from "./claim.js";
 import { makeWedocBridge } from "./wedoc.js";
 import { errText, installResponseTracker } from "./last-response.js";
+import { footerTarget, responseFormatPolicy } from "./message-format.js";
 import { scanClaudeSessions } from "./session-scan.js";
 import { startScheduler, migrateLegacySchedules, promptWantsFreshWizard, renderTask, sinceOf, TASK_POSTPONE_MS, TASK_QUIET_WAIT_MS, } from "./tasks.js";
 import { openTaskRegistry } from "./task-registry.js";
+import { deliverScheduled } from "./scheduled-delivery.js";
 import { describeTrigger, nextFire, parseTrigger, WHEN_HELP } from "../shared/trigger.js";
 import { isQuiet, slugify, uniqueId } from "../shared/task-file.js";
 import { baseOfKey, bindMultiBot, bindTagLinker, botOfKey, headed, ownHead, isInternalKey, keyOf, linkTags, normalizeTag, sameBot, speakerHead, tagFromCwd, tagHead, tagLink, tagOfKey, uniqueTag, withTagHeader } from "../shared/session-label.js";
@@ -56,7 +58,11 @@ import { cacheTouchMs, cacheTtlSec, clipMiddle, contextFiles, firstStamp, parseC
 import { keepalivePingSigs } from "../shared/keepalive.js";
 import { expandHome } from "../shared/paths.js";
 import { loadJsonMap } from "../shared/json-map-store.js";
-import { createReceipts, deadlineOf, kAttr, kOfAttr, newTurn } from "./receipts.js";
+import { answerRecoveryAction, answerSourceLost, answerTargetOccupied, answerTransferOrigin, createAnswerTransfers } from "./answer-transfer.js";
+import { createWorkflowNodes } from "./workflow-nodes.js";
+import { loadWorkflowPlans, createWorkflowPlanRunner } from "./workflow-plans.js";
+import { registerWorkflowPlanRoutes } from "./workflow-plan-http.js";
+import { createReceipts, canonicalTurn, deadlineOf, kAttr, kOfAttr, newTurn } from "./receipts.js";
 import { renderInFlight } from "../shared/turn-state.js";
 import { startIdleNudge } from "./idle-nudge.js";
 import { askerFromEnvelope, renderReminder } from "../shared/reminder.js";
@@ -84,6 +90,7 @@ const main = async () => {
     // 定时调度器的 `inject` 真正实现, 赋值在 mirror-mode 的大块里 (要用到那里面的
     // wizards / m / notifyChat), 但 startScheduler 在那块外面接线 —— 见文件尾。
     // 记忆整理者的执行体, 同样只有 mirror 模式给得出 —— 赋值见 scheduledTaskInject 旁边。
+    let stopReceipts = () => { };
     let stewardRun;
     let stewardWiring = {};
     let scheduledTaskInject;
@@ -149,7 +156,7 @@ const main = async () => {
     // last-response tracker enables inbound's `quote` dedup of bot self-replies,
     // and its chat-gate drops header-only pushes (empty messages) daemon-wide.
     // 微信出站不走企微长连接, 不必等它连上。
-    installResponseTracker(ws.client, log.child({ mod: "chat-gate" }), (c) => wx.owns(c));
+    installResponseTracker(ws.client, log.child({ mod: "chat-gate" }), (c) => wx.owns(c), (context) => responseFormatPolicy(cfg, context, (target) => chatUrlFor(cfg.daemon, target)));
     const mirrorStore = loadMirrorStore(cfg.wrc.mirror.attachmentsFile);
     // 定时任务表 —— 每条任务是 ~/.wezard/tasks/<id>.task.mjs 一份可注入代码的配置
     // (见 shared/task-file.ts)。目录是热加载的: wizard 改完文件不用 reload 守护进程。
@@ -170,6 +177,7 @@ const main = async () => {
     const known = (t) => bridge.chatTargets(t).includes(t);
     // 名册在下面的 mirror 块里才绑 (bindWizardStore) —— 这里全走 wizardStore() 惰性取。
     bindTagLinker({
+        targetOfUrl: (url) => footerTarget(url, new URL(".", buildChatUrl(cfg.daemon.detailPublicBase, cfg.daemon.host, cfg.daemon.port, "")).href, (id) => { const r = getDetail(id); return r && "target" in r ? r.target : undefined; }, known),
         urlOf: (t) => chatUrlFor(cfg.daemon, t),
         resolve: (name, from) => {
             const t = wizardStore()?.byName(name)?.target;
@@ -338,12 +346,22 @@ const main = async () => {
                 json(res, 400, { ok: false, reason: "target required (and cfg.defaultChat empty)" });
                 return;
             }
+            if (!planStore.allowExternal(target, wizards.get(target)?.name)) {
+                json(res, 409, { ok: false, reason: "workflow plan reserves this executor" });
+                return;
+            }
             const spawnLog = log.child({ mod: "mirror", sub: "spawn-init", target });
             const r = await spawnTmuxClaude({ cfg, log: spawnLog, windowName: target, systemPrompt: charterFor(target, { cli: backendFor(cfg).name }) });
             if (!r.ok) {
                 json(res, 500, { ok: false, reason: r.reason });
                 return;
             }
+            if (!planStore.allowExternal(target, wizards.get(target)?.name)) {
+                if (r.tmuxPane)
+                    await runTmux(["kill-pane", "-t", r.tmuxPane]);
+                json(res, 409, { ok: false, reason: "executor reserved during spawn; binding withheld" });
+                return;
+            }
             const att = m.attach({ sessionId: r.sessionId, jsonlPath: r.jsonlPath, target, tmuxPane: r.tmuxPane, tmuxSession: r.tmuxSession });
             json(res, att.ok ? 200 : 500, att.ok ? { ok: true, sessionId: r.sessionId, tmuxSession: r.tmuxSession, tmuxPane: r.tmuxPane, target } : { ok: false, reason: att.reason });
         });
@@ -394,6 +412,10 @@ const main = async () => {
                 json(res, 400, { ok: false, reason: "target required (and cfg.defaultChat empty)" });
                 return;
             }
+            if (!planStore.allowExternal(target, wizards.get(target)?.name)) {
+                json(res, 409, { ok: false, reason: "workflow plan reserves this executor" });
+                return;
+            }
             const sessions = await scanClaudeSessions();
             // 已绑在别的机器人聊天上的会话与不存在同形。
             const hit = sessions.find((s) => s.sessionId === sessionId && ((t) => !t || sameBot(target, t))(m.targetForSession(s.sessionId)));
@@ -401,6 +423,10 @@ const main = async () => {
                 json(res, 404, { ok: false, reason: `session ${sessionId} not found among live tmux sessions` });
                 return;
             }
+            if (!planStore.allowExternal(target, wizards.get(target)?.name) || !planStore.allowExternal(m.targetForSession(hit.sessionId))) {
+                json(res, 409, { ok: false, reason: "workflow plan reserves this executor" });
+                return;
+            }
             const att = m.attach({ sessionId: hit.sessionId, jsonlPath: hit.jsonlPath, target, tmuxPane: hit.tmuxPane, tmuxSession: hit.tmuxSession, cwd: hit.cwd });
             json(res, att.ok ? 200 : 500, att.ok
                 ? { ok: true, sessionId: hit.sessionId, label: hit.label, target, cwd: hit.cwd, tmuxSession: hit.tmuxSession }
@@ -458,6 +484,10 @@ const main = async () => {
                 return;
             }
             const { target, slot: tag } = slotR;
+            if (!planStore.allowExternal(target, wizards.get(target)?.name ?? tag)) {
+                json(res, 409, { ok: false, reason: "workflow plan reserves this executor" });
+                return;
+            }
             const existed = !!wizards.get(target);
             const name = wizards.rename(target, normalizeTag(String(body.name ?? body.tag ?? "")) || tag);
             const model = (body.model ?? "").toString().trim();
@@ -465,7 +495,7 @@ const main = async () => {
             const keepalive = typeof body.keepalive === "boolean" ? body.keepalive : cfg.wrc.mirror.keepalive.spawnDefault;
             log.child({ mod: "mirror", sub: "sessions-new", target }).info({ self, cwd, foreign, cli: body.cli, model, keepalive }, "spawning peer session");
             // silent: 新 wizard 就位不进群 (生命周期事件), 同群的 wizard 从名册增量里得知。
-            const r = await m.newSession(target, name, body.cli, { cwd, model, keepalive, silent: true });
+            const r = await m.newSession(target, name, body.cli, { cwd, model, keepalive, silent: true, guard: () => planStore.allowExternal(target, wizards.get(target)?.name ?? name) });
             if (!r.ok && !existed)
                 wizards.drop(target);
             if (r.ok)
@@ -503,7 +533,12 @@ const main = async () => {
                 json(res, 400, { ok: false, reason: "text required" });
                 return;
             }
-            const r = await m.injectText(target, text);
+            const guard = () => planStore.allowExternal(target, wizards.get(target)?.name);
+            if (!guard()) {
+                json(res, 409, { ok: false, reason: "workflow plan reserves this executor" });
+                return;
+            }
+            const r = await m.injectText(target, text, undefined, { guard });
             json(res, r.ok ? 200 : 500, r);
         });
         // One-shot project switch: bind the chat-wide cwd AND apply it right here
@@ -521,6 +556,10 @@ const main = async () => {
                 json(res, 400, { ok: false, reason: "target required (or pass sessionId of an attached chat)" });
                 return;
             }
+            if (!planStore.allowExternal(target, wizards.get(target)?.name)) {
+                json(res, 409, { ok: false, reason: "workflow plan fixes executor cwd" });
+                return;
+            }
             // keep = 人回答了「不用换, 就用现在这个」。只落一笔确认, 不碰 pane —— 把
             // 「保持现状」也走成 setPendingCwd + newSession 的话, 代价是白杀一个会话。
             if (body.keep === true) {
@@ -540,7 +579,7 @@ const main = async () => {
             // Same shape as inbound's /new: windowName = tag for tagged sessions,
             // principal for the default one. No explicit cwd — newSession reads the
             // pendingCwd just queued and clears it once applied.
-            const r = await m.newSession(target, tagOfKey(target) || target, undefined, {});
+            const r = await m.newSession(target, tagOfKey(target) || target, undefined, { guard: () => planStore.allowExternal(target, wizards.get(target)?.name) });
             json(res, r.ok ? 200 : 500, r.ok
                 ? { ok: true, target, sessionId: r.sessionId, cwd: r.cwd }
                 : { ok: false, reason: r.reason, target, runningCwd: set.runningCwd, pendingCwd: set.pendingCwd });
@@ -716,15 +755,74 @@ const main = async () => {
             return id.startsWith("human:") ? id.slice("human:".length) : "";
         };
         // 挂起事项表 (见 pending-items.ts): 派活时记一行, 回执落定时由下面的 onOutcome 记账。
-        const ledger = createLedger(loadJsonMap(cfg.wrc.mirror.pendingFile, pendingGc));
+        const ledger = createLedger(loadJsonMap(cfg.wrc.mirror.pendingFile, pendingGc, { strict: true }));
+        const workflow = createWorkflowNodes(`${cfg.wrc.mirror.receiptsFile}.nodes.json`);
+        const planStore = loadWorkflowPlans(`${cfg.wrc.mirror.receiptsFile}.plans.json`, workflow.prereq);
+        const pendingBirthJobs = new Map();
+        let advancePlans = () => { };
+        // Lifecycle continuations carry the same live attempt, never a new task.
+        // Human inbound remains an explicit intervention; agent handoff/receipts
+        // must not revive canceled or unconfirmed planned executions.
+        const answers = createAnswerTransfers(loadJsonMap(join(cfg.daemon.stateDir, "answer-transfers.json"), undefined, { strict: true }));
+        m.setAnswerSilencer(answers.source);
+        const answerSends = new Map();
+        const deliverTransferredAnswer = (id, out) => {
+            const pending = answerSends.get(id);
+            if (pending)
+                return pending;
+            const p = (async () => {
+                m.stopAnswerProgress(id);
+                const r = answers.outcome(id, out);
+                if (!r)
+                    return true;
+                if (!answers.delivering(id))
+                    return false;
+                try {
+                    await m.deliverAnswer(id, r.target, r.sourceTurn, r.channel, r.prefix, r.outcome.body, !["done", "need"].includes(r.outcome.status));
+                    answers.delivered(id);
+                    recordPost({ target: r.target, channel: r.channel, body: r.outcome.body, ...(r.tell.asker ? { asker: r.tell.asker } : {}) });
+                    return true;
+                }
+                catch (e) {
+                    answers.uncertain(id);
+                    log.error({ id, err: e.message }, "transferred answer delivery acknowledgement uncertain; automatic retry withheld to prevent duplicate answers");
+                    return false;
+                }
+            })().finally(() => answerSends.delete(id));
+            answerSends.set(id, p);
+            return p;
+        };
+        const planContinuationAllowed = (target) => {
+            const r = planStore.reservation(target, wizards.get(target)?.name);
+            if (!r)
+                return planStore.healthy();
+            const n = r.nodes.find((n) => n.to === target);
+            const a = n && workflow.byTurn(r.owner, n.turn);
+            return !!n && !!a && planStore.healthy() && r.state === "active" && n.phase === "observing"
+                && !a.canceled && a.acceptance !== "rejected" && jobs.get(r.plan.job)?.status === "open" && ["running", "needs-input", "errored"].includes(a.execution)
+                && (r.plan.nodes.find((x) => x.id === n.id)?.after ?? []).every((id) => workflow.prereq(r.owner, r.nodes.find((x) => x.id === id).turn)?.state === "done");
+        };
         const receipts = createReceipts({
+            deliverAnswer: deliverTransferredAnswer,
+            workflowPrereq: workflow.prereq,
             idleNow: m.idleNow,
-            onOutcome: (s, status, bodyText, bySender) => ledger.outcome(s.from, s.turn ?? "", status, parseClosing(bodyText).text || bodyText, bySender),
+            onOutcome: (s, status, bodyText, bySender) => {
+                // Pin transferred-answer terminal state synchronously with the receipt
+                // outcome; delivery may still be waiting for the target to become idle.
+                if (s.answerTransfer) {
+                    answers.outcome(s.answerTransfer, { status, body: bodyText });
+                    m.stopAnswerProgress(s.answerTransfer);
+                }
+                workflow.outcome(s.from, s.turn ?? "", status, bodyText);
+                advancePlans();
+                ledger.outcome(s.from, s.turn ?? "", status, parseClosing(bodyText).text || bodyText, bySender);
+            },
             jobTally: (id) => jobs.tally(id),
             parkedNow: m.parkedNow,
             settleJob: (id, target, outcome, artifacts) => { jobs.settle(id, target, outcome, artifacts); },
             accept: (id, body) => { const j = jobs.get(id); return j?.status === "open" ? rejectReason(j.accept ?? "result", parseClosing(body)) : undefined; },
-            rebound: async (x, why) => (await m.injectText(x.to, `（守护进程代 ${displayName(x.from)} 打回一次: 这件活是工单里的一份, 你的回复${why}。请按约定收口 —— 末尾一行 \`RESULT: <结论>\`, 交付了文件每个加一行 \`ARTIFACT: <路径> — 一句话\`; 真缺信息就 \`NEED: <问题>\`。）`, undefined, {
+            rebound: async (x, why) => workflow.byTurn(x.from, x.turn) || !planStore.allowExternal(x.to, wizards.get(x.to)?.name) ? false : (await m.injectText(x.to, `（守护进程代 ${displayName(x.from)} 打回一次: 这件活是工单里的一份, 你的回复${why}。请按约定收口 —— 末尾一行 \`RESULT: <结论>\`, 交付了文件每个加一行 \`ARTIFACT: <路径> — 一句话\`; 真缺信息就 \`NEED: <问题>\`。）`, undefined, {
+                guard: () => planStore.allowExternal(x.to, wizards.get(x.to)?.name),
                 from: { kind: "peer", from: x.from, turn: x.turn, ...(x.asker ? { asker: x.asker } : {}) },
                 channel: x.channel,
                 envelope: envelopeFor(x.from, x.channel, { turn: x.turn, legs: x.legs, re: true, asker: x.asker }),
@@ -733,18 +831,20 @@ const main = async () => {
             paneLive: m.paneLive,
             nameOf: displayName,
             log,
-            store: loadJsonMap(cfg.wrc.mirror.receiptsFile),
-            holdStore: loadJsonMap(cfg.wrc.mirror.holdsFile),
+            store: loadJsonMap(cfg.wrc.mirror.receiptsFile, undefined, { strict: true }),
+            holdStore: loadJsonMap(cfg.wrc.mirror.holdsFile, undefined, { strict: true }),
             // 放行停放着的 after 件: 走 tell_peer 同一条注入路径, 沿用停放时的件号 / 频道 / 父 k。
-            release: async (h, seen) => {
-                const r = await tellPeerAs(h.from, h.body, afterNote(h.after, seen), { turn: h.turn, channel: h.channel, ...(h.k ? { k: h.k } : {}), ...(h.asker ? { asker: h.asker } : {}) });
+            release: async (h, seen, alive) => {
+                const r = await tellPeerAs(h.from, h.body, afterNote(h.after, seen, h.from), { turn: h.turn, channel: h.channel, after: h.after, seen: h.seen, alive, ...(h.k ? { k: h.k } : {}), ...(h.asker ? { asker: h.asker } : {}) });
                 return r.status === 200 ? { ok: true } : { ok: false, reason: String(r.body.reason ?? `HTTP ${r.status}`) };
             },
             handingOff,
             handedOff,
             replyFor: (to, fromName, since, turn) => m.replyToPeer(to, fromName, since, turn),
             lastWords: m.lastReply,
-            deliver: (to, bodyText, meta) => m.injectText(to, clipMiddle(bodyText), undefined, {
+            deliver: (to, bodyText, meta, alive) => m.injectText(to, clipMiddle(bodyText), undefined, {
+                requireIdle: true,
+                guard: () => (!alive || alive()) && planContinuationAllowed(to),
                 // receipt:true 是「这一轮不该再生回执」的记录 —— 回环在结构上就不成立:
                 // 只有 tell_peer 那条路登记 watcher, 这里是直接注入。
                 from: { kind: "peer", from: meta.from, receipt: true, status: meta.status, ...(meta.turn ? { turn: meta.turn } : {}), ...(meta.job ? { job: meta.job, done: meta.done, total: meta.total } : {}), ...(meta.asker ? { asker: meta.asker } : {}) },
@@ -755,9 +855,10 @@ const main = async () => {
                     ...(meta.asker ? { asker: meta.asker } : {}),
                     ...(meta.pending ? { pending: meta.pending } : {}),
                     ...(audienceName(meta.channel, meta.asker) ? { audience: audienceName(meta.channel, meta.asker) } : {}),
-                }),
+                }) + (meta.eventId ? renderReminder({ wezard: "receipt-delivery", event: meta.eventId }, []) : ""),
             }),
         });
+        stopReceipts = receipts.stop;
         const turnsLine = (xs, target) => renderInFlight(xs, target, displayName);
         // reload 前在飞的回执: 等 mirror 把绑定都恢复了再续守 —— 早一步读 target 会拿不到
         // transcript, 退回按时刻取就可能把上一件事的结论当回执。
@@ -775,9 +876,13 @@ const main = async () => {
             // 那一轮就只有一个去向, 别的上游拿到的是答给第一份的话。
             inject: async (t, text, owe, channel) => {
                 const [first, ...rest] = owe;
+                if (!planContinuationAllowed(t))
+                    return { ok: false, reason: "workflow continuation withdrawn" };
+                if (!first && planStore.reservation(t, wizards.get(t)?.name))
+                    return { ok: false, reason: "workflow handoff requires the original attempt" };
                 if (!first)
-                    return m.injectText(t, text, undefined, { channel });
-                const r = await m.injectText(t, text, undefined, carryOpts(first));
+                    return m.injectText(t, text, undefined, { channel, guard: () => planContinuationAllowed(t) });
+                const r = await m.injectText(t, text, undefined, { ...carryOpts(first), guard: () => planContinuationAllowed(t) });
                 if (r.ok && rest.length)
                     void carryRest(t, rest);
                 return r;
@@ -817,7 +922,7 @@ const main = async () => {
                 for (const end = Date.now() + 20_000; Date.now() < end && (await m.idleNow(t));)
                     await sleep(1000);
                 await m.untilIdle(t, 3600_000);
-                const r = await m.injectText(t, `（交接续答）接着上面的简报: 你交接前还欠 ${displayName(o.from)} 一个交代${o.turn ? ` (件 \`${o.turn}\`)` : ""} —— 现在只就这件收口。`, undefined, carryOpts(o));
+                const r = await m.injectText(t, `（交接续答）接着上面的简报: 你交接前还欠 ${displayName(o.from)} 一个交代${o.turn ? ` (件 \`${o.turn}\`)` : ""} —— 现在只就这件收口。`, undefined, { ...carryOpts(o), guard: () => planContinuationAllowed(t) });
                 log.info({ mod: "handoff", target: t, from: o.from, turn: o.turn, ok: r.ok, reason: r.reason }, "handoff: 欠账续答");
             }
         }
@@ -854,6 +959,17 @@ const main = async () => {
             const p = m.sessionInfo(self)?.jsonlPath;
             return p ? openingTurn(expandHome(p), pingSigs) : undefined;
         };
+        const lostAnswer = (self) => {
+            return answerSourceLost(answers.all(), self, m.answerContext(self)?.turn, openingOfSelf(self)?.ms);
+        };
+        const terminalAnswerTurn = (self) => {
+            const turn = openingOfSelf(self)?.env?.turn;
+            return turn ? answers.terminalTarget(self, turn) : undefined;
+        };
+        const controlSnapshot = (self) => ({ opening: openingOfSelf(self)?.ms, turn: m.answerContext(self)?.turn });
+        const controlValid = (self, snapshot) => openingOfSelf(self)?.ms === snapshot.opening && m.answerContext(self)?.turn === snapshot.turn && !lostAnswer(self) && !terminalAnswerTurn(self);
+        const hasAnswerChildren = (self, k) => !!k && receipts.states().some((s) => s.from === self && !!s.k && kAttr(s.k) === kAttr(k));
+        m.setAnswerSilencer((target, turn) => answers.source(target, turn) || lostAnswer(target));
         const parentKOf = (self) => {
             const opening = openingOfSelf(self);
             // 不用 channelOf: 它把私聊轮 ("") 回落成 home, 私聊轮派出的活就会续回 home 群。
@@ -873,7 +989,34 @@ const main = async () => {
         // A private dispatch keeps its human origin even though its output channel is empty.
         bindCardChannel((key) => askerOf(key)?.chat || m.currentChannel(key));
         // 交接先续做: 它的闸要在回执续守之前立起来, 否则续守的 watcher 会读到换了一半的会话。
-        void m.restored.then(() => { handoffs.resume(); receipts.resume(); });
+        void m.restored.then(() => {
+            handoffs.resume();
+            answers.all().filter((r) => r.state !== "delivered").forEach((r) => {
+                const action = answerRecoveryAction(r);
+                if (action === "cancel-before-send") {
+                    answers.activate(r.id);
+                    void deliverTransferredAnswer(r.id, { status: "canceled", body: "daemon 重启时回答移交仍在投递，结果不确定；本轮已收止，请重新发送问题。" });
+                }
+                else if (action === "ambiguous") {
+                    answers.uncertain(r.id);
+                    log.error({ id: r.id }, "answer delivery may have reached the chat before restart; automatic retry withheld, user may resend if absent");
+                }
+                else if (action === "deliver-outcome" && r.outcome)
+                    void deliverTransferredAnswer(r.id, r.outcome);
+                else if (action === "watch" && !receipts.watching(r.tell))
+                    receipts.register(r.tell);
+            });
+            // Confirmed injections may outlive the legacy receipt-store write. Rebuild watching,
+            // using the original turn and intent; uncertain injections remain manual reconciliation.
+            workflow.all().filter((a) => a.tell && ["running", "needs-input", "errored"].includes(a.execution))
+                .forEach((a) => { try {
+                recoverWorkflow(a);
+            }
+            catch (e) {
+                log.error({ err: e.message, attemptId: a.id }, "workflow recovery accounting failed; watcher not restored");
+            } });
+            receipts.resume();
+        });
         // 闲置追问 (见 idle-nudge.ts): 对方持续闲着又没回执 → 代发话方同件号问一句进展, 答复照常回执。
         // 注入照抄工单打回 (rebound) 那条: 私聊信封挂发话方的名义与件号, 父 k 等由 reask 沿用原件。
         void m.restored.then(() => startIdleNudge({
@@ -883,11 +1026,14 @@ const main = async () => {
             jobOpen: (id) => jobs.get(id)?.status === "open",
             policy: () => ({ afterMs: cfg.wrc.mirror.idleNudge.afterMin * 60_000, max: cfg.wrc.mirror.idleNudge.max }),
             ask: async ({ from, to, turn, text }) => {
+                if (workflow.byTurn(from, turn) || !planStore.allowExternal(to, wizards.get(to)?.name))
+                    return false;
                 const x = receipts.reask(from, to, turn);
                 if (!x)
                     return false;
                 ledger.touch(from, turn);
                 return (await m.injectText(to, text, undefined, {
+                    guard: () => planStore.allowExternal(to, wizards.get(to)?.name),
                     from: { kind: "peer", from, turn, ...(x.asker ? { asker: x.asker } : {}) },
                     channel: x.channel,
                     envelope: envelopeFor(from, x.channel, { turn, legs: x.legs, re: true, asker: x.asker }),
@@ -902,7 +1048,13 @@ const main = async () => {
         /** 撞上的名字属于一个静默超过一天的 wizard → 顶掉它 (见 evictStaleName), 同群的
          *  wizard 收到一行名册变动; 返回是否腾出了名字。 */
         const displace = async (name, keep) => {
-            const gone = await evictStaleName(wizards, name, keep, { lastActivity: m.lastActivity, retire: m.killPane });
+            if (!planStore.allowExternal(undefined, name))
+                return false;
+            const gone = await evictStaleName(wizards, name, keep, { lastActivity: m.lastActivity, retire: async (target) => {
+                    if (!planStore.allowExternal(target, wizards.get(target)?.name))
+                        throw new Error("workflow plan reserves this identity; eviction withheld");
+                    return m.killPane(target);
+                } });
             if (!gone)
                 return false;
             const slot = !!tagOfKey(gone.target);
@@ -916,14 +1068,20 @@ const main = async () => {
          *  - 撞上的 wizard 静默超过一天 (不在 `keep` 里) → 顶掉它, 名字归新的;
          *  - 其余 (还新鲜的) → 409, 附上它的死活, 调用方据此换名或先收掉它。
          *  槽位 (key 里的 `#k`) 只是内部 id: 默认取名字本身, 被占了就加序号, 与名字无关。 */
-        const claimSlot = async (base, want, fallback, keep = []) => {
+        const claimSlot = async (base, want, fallback, keep = [], allowed = (target, name) => planStore.allowExternal(target, name) && planStore.allowExternal(target, target ? wizards.get(target)?.name : undefined)) => {
             const asked = normalizeTag(want);
+            const denied = { ok: false, status: 409, body: { ok: false, reason: "workflow plan reserves this executor" } };
+            const candidate = asked || normalizeTag(fallback) || "wizard";
+            if (!allowed(keyOf(base, candidate), candidate))
+                return denied;
             const clash = asked ? wizards.byName(asked) : undefined;
             // 名字全机唯一, 撞上别的机器人的 wizard 照样拒 —— 但不顶掉它、不复用它的槽, 也不报它的死活:
             // 那边的 wizard 在这个机器人眼里不存在, 只剩「名字被占了」这一个事实。
             if (clash && !sameBot(base, clash.target)) {
                 return { ok: false, status: 409, body: { ok: false, reason: `名字 '.${clash.name}' 已被占用 (名字全局唯一) —— 换个名字`, name: clash.name } };
             }
+            if (clash && !allowed(clash.target, clash.name))
+                return denied;
             const bound = !!clash && m.chatTargets(baseOfKey(clash.target)).includes(clash.target);
             if (clash && !bound && baseOfKey(clash.target) === base && tagOfKey(clash.target)) {
                 return { ok: true, target: clash.target, slot: tagOfKey(clash.target) };
@@ -952,12 +1110,15 @@ const main = async () => {
                     },
                 };
             }
+            if (!allowed(keyOf(base, candidate), candidate) || (clash && !allowed(clash.target, clash.name)))
+                return denied;
             const taken = new Set([
                 ...m.chatTargets(base).map(tagOfKey),
                 ...wizards.all().filter((w) => baseOfKey(w.target) === base).map((w) => tagOfKey(w.target)),
             ].filter(Boolean));
             const slot = uniqueTag(asked || normalizeTag(fallback) || "wizard", taken);
-            return { ok: true, target: keyOf(base, slot), slot };
+            const target = keyOf(base, slot);
+            return allowed(target, asked || slot) ? { ok: true, target, slot } : denied;
         };
         // ── 给人看的消息 ──────────────────────────────────────────────────
         // send_peer 把话塞进另一个 agent 的输入框 (驱动它干活); 这条把话贴进一个聊天
@@ -968,7 +1129,12 @@ const main = async () => {
         // 回执轮但那件活是为上游同伴派的 (k 是 peer)。人说的、定时任务放的、旁支 (chain:false, 无 k)
         // 的回执轮都不拦; 管家只在自己的群里豁免。notify 与 send_file 共用这一道闸。
         const topOnlyMuted = (self, dests) => {
+            if (lostAnswer(self))
+                return { ok: false, reason: "本轮回答权和控制权已移交；由目标 wizard 对人交付" };
             const env = openingOfSelf(self)?.env;
+            const transferred = env?.turn ? answers.target(self, env.turn) : undefined;
+            if (transferred)
+                return !transferred.outcome && transferred.state !== "delivered" ? undefined : { ok: false, reason: "本轮移交回答已经落定；迟到产出不能再次对人发送" };
             const belowTop = env?.kind === "peer" && (env.receipt ? kOfAttr(env.k ?? "")?.kind === "peer" : env.private);
             const muted = dests.filter((d) => chatPolicyOf(cfg, d).topOnly && !(!tagOfKey(self) && baseOfKey(self) === d));
             return muted.length && belowTop
@@ -998,7 +1164,8 @@ const main = async () => {
                 json(res, 400, { ok: false, reason: `认不出这些聊天: ${bad.join(", ")} (wizard_roster 每行有 home 聊天名, 人侧 /chats; 没起名的聊天寻址不到)` });
                 return;
             }
-            const dests = [...new Set(refs.length ? refs.map((r) => chatBaseOf(cfg, r)) : [channelOf(self)])];
+            const activeTransfer = (() => { const t = openingOfSelf(self)?.env?.turn; return t ? answers.target(self, t) : undefined; })();
+            const dests = [...new Set(refs.length ? refs.map((r) => chatBaseOf(cfg, r)) : [activeTransfer?.channel ?? channelOf(self)])];
             const muted = topOnlyMuted(self, dests);
             if (muted) {
                 json(res, 409, muted);
@@ -1036,7 +1203,9 @@ const main = async () => {
             }
             ensureChatNames(self);
             const ref = (b.to ?? "").trim();
-            const dest = ref ? chatBaseOf(cfg, ref) : channelOf(self);
+            const transferTurn = openingOfSelf(self)?.env?.turn;
+            const transfer = transferTurn ? answers.target(self, transferTurn) : undefined;
+            const dest = ref ? chatBaseOf(cfg, ref) : transfer?.channel ?? channelOf(self);
             if (!dest || !sameBot(self, dest)) {
                 json(res, 400, { ok: false, reason: `认不出聊天: ${ref} (wizard_roster 每行有 home 聊天名, 人侧 /chats; 没起名的聊天寻址不到)` });
                 return;
@@ -1200,23 +1369,65 @@ const main = async () => {
             return [...new Set((Array.isArray(raw) ? raw : []).map((x) => String(x).replace(/[`\s]/g, "")).filter(Boolean))];
         };
         /** 放行时挂在信封后面的前置结论: 谁交的、件号、RESULT 与 ARTIFACT 原样 (只进对方输入框)。 */
-        const afterNote = (turns, seen) => renderReminder({ wezard: "after" }, [
+        const afterNote = (turns, seen, owner) => renderReminder({ wezard: "after" }, [
             "这件活排在下面这些前置之后, 它们都已落定; 结论原样附上 (谁交的 · 件号):",
             ...turns.flatMap((t) => {
                 const x = seen[t];
                 if (!x)
                     return [];
                 const c = parseClosing(x.body, 1500);
+                const versions = workflow.list(owner).find((a) => a.turn === t && a.acceptance === "accepted")?.files ?? [];
                 const clean = (v) => v.replace(/<\/?system-reminder[^>]*>/g, "");
                 return [
                     `- ${displayName(x.to)} · ${t} · ${x.status}: ${c.kind === "result" ? `RESULT: ${clean(c.text)}` : clipLine(clean(x.body), 600) || "(没有正文)"}`,
-                    ...c.artifacts.map((a) => `  ARTIFACT: ${a.path}${a.note ? ` — ${a.note}` : ""}`),
+                    ...c.artifacts.map((a) => {
+                        const f = versions.find((f) => f.path === a.path);
+                        return f ? `  ARTIFACT: ${f.snapshot} — accepted version sha256 ${f.sha256}; original source ${f.path}` : `  ARTIFACT: ${a.path}${a.note ? ` — ${a.note}` : ""}`;
+                    }),
+                    ...versions.map((f) => `  VERIFIED ARTIFACT VERSION: ${f.snapshot} · sha256 ${f.sha256} · source ${f.path}; consume this readonly snapshot, not mutable source`),
                 ];
             }),
         ]);
+        // One durable key per tracked physical dispatch leg (held release reuses its reservation).
+        const accountWorkflow = (a, recovery = false) => {
+            if (!a.dispatches?.length)
+                throw new Error("historical tracked attempt lacks dispatch accounting evidence; reconcile stopped before retry (no blind budget import)");
+            for (const d of a.dispatches) {
+                jobs.account(a.job, d.key, { target: a.to, task: d.continuation ? "" : d.text, spawned: false, ...(d.role ? { role: d.role } : {}) }, d.kind, d.free, recovery, !!d.free && !!d.continuation);
+                const t = d.tell ?? a.tell;
+                ledger.dispatch(d.key, { turn: a.turn, owner: a.owner, to: a.to, text: d.text, at: d.at, job: a.job, ...(t?.k ? { for: t.k } : {}), ...(t?.asker ? { asker: t.asker } : {}) });
+            }
+        };
+        const recoverWorkflow = (a) => {
+            if (a.canceled || jobs.get(a.job)?.status !== "open")
+                return;
+            accountWorkflow(a, true);
+            if (a.tell && !receipts.watching(a.tell))
+                receipts.register(a.tell, true, a.status && a.body ? { status: a.status, body: a.body } : undefined);
+        };
+        const cancelPeerWork = (target, self, only = () => true) => {
+            const keys = new Set([
+                ...workflow.all().filter((a) => a.to === target && a.execution !== "terminal" && !a.canceled && only({ from: a.owner, turn: a.turn })).map((a) => `${a.owner}\0${a.turn}`),
+                ...receipts.states().filter((s) => s.to === target && only(s)).map((s) => `${s.from}\0${s.turn}`),
+            ]);
+            workflow.cancel(target, undefined, undefined, undefined, only);
+            receipts.cancel(target, self, only);
+            return keys.size;
+        };
         /** tell_peer 的本体: 以 `self` 的名义说一句 —— HTTP 路由与 dispatch 共用。`extra` = 挂在信封后面的
          *  一段 (只进对方输入框, 不进 `text`: 公开时 text 会成群气泡)。 */
-        const tellPeerAs = async (self, body, extra = "", held) => {
+        const peerDispatching = new Map();
+        const tellPeerAsInner = async (self, body, extra = "", held, planned, actor) => {
+            const authority = actor?.authority ?? (!held && !planned ? controlSnapshot(self) : undefined);
+            if (!held && !planned && lostAnswer(self))
+                return { status: 409, body: { ok: false, reason: "this turn transferred answer and control; stop dispatching and conclude silently" } };
+            if (!held && !planned && terminalAnswerTurn(self))
+                return { status: 409, body: { ok: false, reason: "transferred answer is terminal; late control actions refused" } };
+            const answer = body.answer;
+            if (answer !== undefined && answer !== "transfer")
+                return { status: 400, body: { ok: false, reason: "answer must be transfer when supplied" } };
+            if (held?.alive && !held.alive())
+                return { status: 409, body: { ok: false, reason: "held dispatch withdrawn" } };
             const text = (body.text ?? "").toString();
             if (!text.trim()) {
                 return { status: 400, body: { ok: false, reason: "text required" } };
@@ -1231,12 +1442,12 @@ const main = async () => {
             }
             const { target, foreign } = r;
             // 件号先于一切: `re` 续问沿用那件活的件号、工单与频道 (见 receipts.prepare)。
-            const re = (body.re ?? "").toString().trim();
+            const re = canonicalTurn((body.re ?? "").toString());
             // 放行一件停放着的 (after): 件号 / 频道 / 父 k / 链头都沿用停放那一刻定的 —— 依赖边不改 k。
-            const turn = held ? { turn: held.turn, legs: 1, channel: held.channel, asker: held.asker, k: held.k } : receipts.prepare(self, target, re || undefined);
+            const turn = planned ? { turn: planned.turn, legs: 1, channel: "", asker: planned.origin.asker, k: planned.origin.k } : held ? { turn: held.turn, legs: 1, channel: held.channel, asker: held.asker, k: held.k } : receipts.prepare(self, target, re || undefined);
             // Capture the origin before waiting for another pane; our own turn may change meanwhile.
-            const asker = held ? held.asker : turn.legs > 1 ? turn.asker : askerOf(self);
-            const k = held ? held.k : body.chain === false ? undefined : turn.legs > 1 ? turn.k : parentKOf(self);
+            const asker = planned ? planned.origin.asker : held ? held.asker : actor?.asker ?? (turn.legs > 1 ? turn.asker : askerOf(self));
+            const k = planned ? planned.origin.k : held ? held.k : actor?.k ?? (body.chain === false ? undefined : turn.legs > 1 ? turn.k : parentKOf(self));
             // 续问只在那个工单还开着时沿用它: 收了工的工单不再收成员, 续问照样能发。
             // 没带工单的一句顶掉一份还没落定的工单活, 也算在那张工单上 (receipts.register 同理
             // 继承): 不然换个不带 job 的 tell_peer 就绕开了预算。
@@ -1249,14 +1460,56 @@ const main = async () => {
             // 没带 re 的普通 task / ask / dispatch 一律不并进根单。
             const leadJob = jobs.all().find((j) => j.kind === "req" && j.status === "open" && j.owner === self && j.members.some((x) => x.target === target && x.role === "lead"))?.id ?? "";
             const jobId = kind === "fyi" ? "" : askedJob || isOpen(turn.job) || (open?.deferred ? "" : isOpen(open?.job)) || (re && turn.reUnknown ? leadJob : "");
+            const answerContext = answer === "transfer" ? actor?.answerContext ?? m.answerContext(self) : undefined;
+            const answerSourceOpening = answerContext ? actor?.authority.opening ?? openingOfSelf(self)?.ms ?? 0 : 0;
+            const actorStillValid = () => {
+                if (!authority)
+                    return true; // held/planned work carries its captured permit.
+                if (openingOfSelf(self)?.ms !== authority.opening || m.answerContext(self)?.turn !== authority.turn || terminalAnswerTurn(self))
+                    return false;
+                if (answer === "transfer")
+                    return !answers.all().some((r) => r.source === self && r.sourceTurn === authority.turn && r.id !== turn.turn);
+                return !lostAnswer(self);
+            };
+            if (answer === "transfer" && (!answerContext || !asker?.who.startsWith("user:") || k?.kind !== "chat" || !chatPolicyOf(cfg, k.channel).topOnly || kind === "fyi" || re || jobId || held || planned || body.node || body.after?.length || body.receipt === false || body.chain === false || hasAnswerChildren(self, k))) {
+                return { status: 409, body: { ok: false, reason: "answer transfer requires an active human topOnly turn with no child work, job, re, node, after, chain:false or receipt:false" } };
+            }
             if (jobId) {
                 const jc = checkJob(jobId, target, (!!open?.need && open.turn === turn.turn) || !!held);
                 if (!jc.ok) {
                     return { status: jc.status, body: { ok: false, reason: jc.reason } };
                 }
             }
+            const trackedRe = workflow.byTurn(self, turn.turn) ?? (re ? workflow.byTurn(self, re) : undefined);
+            if (trackedRe && !trackedRe.accountingVersion && trackedRe.execution !== "terminal")
+                return { status: 409, body: { ok: false, attemptId: trackedRe.id, reason: "historical tracked attempt lacks dispatch accounting evidence; reconcile stopped before retry" } };
+            const rawNode = body.node;
+            if (rawNode !== undefined && (typeof rawNode !== "string" || !rawNode.trim()))
+                return { status: 400, body: { ok: false, reason: "node must not be blank" } };
+            if (trackedRe && rawNode !== undefined && rawNode.trim() !== trackedRe.node)
+                return { status: 409, body: { ok: false, reason: "tracked turn cannot change node" } };
+            const node = rawNode?.trim() ?? trackedRe?.node ?? "";
+            const planAllowed = () => planStore.allowTell(self, jobId, node, target, re, planned, wizards.get(target)?.name);
+            if (!planAllowed())
+                return { status: 409, body: { ok: false, reason: "dedicated plan job/executor only allows runner dispatch or exact owner re" } };
+            if (node && jobId && workflow.list(self, jobId).some((a) => !a.accountingVersion))
+                return { status: 409, body: { ok: false, reason: "historical job has incomplete dispatch accounting evidence; reconcile stopped, close the old job, and open a new job (no guessed budget migration)" } };
+            if (node && (!jobId || jobs.get(jobId)?.owner !== self || kind !== "task" || body.receipt === false)) {
+                return { status: 400, body: { ok: false, reason: "node requires owner job, task, and receipt" } };
+            }
+            if (re && trackedRe && (turn.reUnknown || trackedRe.to !== target))
+                return { status: 409, body: { ok: false, reason: "tracked re cannot start a new attempt; use node after reconciliation" } };
+            // A released hold can survive a crash after confirmed injection but before dropHold.
+            // Recover the watcher from the durable intent; never paste that attempt again.
+            const heldAttempt = held && node ? workflow.byTurn(self, held.turn) : undefined;
+            if (heldAttempt?.tell && ["running", "needs-input", "errored"].includes(heldAttempt.execution)) {
+                recoverWorkflow(heldAttempt);
+                return { status: 200, body: { ok: true, recovered: true, attemptId: heldAttempt.id, turn: held.turn } };
+            }
+            if (heldAttempt?.execution === "terminal" && heldAttempt.status === "done")
+                return { status: 200, body: { ok: true, recovered: true, attemptId: heldAttempt.id } };
             // 派活方向闸 (见 direction.ts): 只拒不改投递路径, 不动回执 k。
-            const dr = held ? undefined : checkDirection({ self, target, kind, re: turn.legs > 1, jobId, jobs: jobs.all(), chain: receipts.ancestorsOf(self, parentKOf(self)), nameOf: displayName });
+            const dr = held ? undefined : checkDirection({ self, target, kind, re: turn.legs > 1, jobId, jobs: jobs.all(), chain: planned?.origin.chain ?? receipts.ancestorsOf(self, parentKOf(self)), nameOf: displayName });
             if (dr) {
                 return { status: 409, body: { ok: false, gated: "direction", reason: dr } };
             }
@@ -1283,7 +1536,7 @@ const main = async () => {
             const parkIt = prereqs.some((p) => p.state === "pending");
             // 前置都已落定: 不停放, 结论附在信封后面照常投。
             if (afters.length && !parkIt)
-                extra += afterNote(afters, Object.fromEntries(afters.map((t, i) => [t, prereqs[i].seen])));
+                extra += afterNote(afters, Object.fromEntries(afters.map((t, i) => [t, prereqs[i].seen])), self);
             // 公开与否由发话方 (LLM) 判断: 公开 = 在它这一轮的公开频道里说, 气泡进群、对方
             // 那一轮的回复也发进这个群; 私聊 (默认) = 只落双方的 rolepage, 回复靠 wait_peer 取。
             // 只有两端都是登记在册的 wizard 才能当着人说: 裸 target 冒充的发话方、forget
@@ -1303,7 +1556,11 @@ const main = async () => {
             }
             // 它正在交接: 这句话等它换完会话再进 —— 投进旧会话会被交接一并带走, 投进重开中的
             // 空 pane 会 resume 回旧 sid (见 handoff.ts)。发话时刻取在这之后。
+            if (answer === "transfer" && handingOff(target))
+                return { status: 409, body: { ok: false, reason: "answer target is handing off; source retains answer and control" } };
             await handedOff(target);
+            if (!actorStillValid())
+                return { status: 409, body: { ok: false, reason: "caller turn/control changed while waiting; dispatch refused" } };
             // 投递策略。对方闲着三者一样 —— 立刻投; 只在它正忙时分岔:
             //   normal (默认) 等它这一轮结束再投 —— 派新活的常态: 两个 wizard 同时找第三个时,
             //     两段文本会挤进同一个输入框、被当成一轮读掉, 这在协同网络里不是边角情况而是常态;
@@ -1337,23 +1594,53 @@ const main = async () => {
             }
             // 前置还没落定: 不注入, 登记一份停放 (见 receipts.Hold) —— 件号、频道、父 k、链头定在这一刻,
             // 放行时原样沿用; 工单成员与预算也现在就记, 「齐了吗」照常数。
+            let attemptId;
+            const beginNode = (queued) => {
+                if (!planAllowed() || (planned && !planned.alive()))
+                    throw new Error("plan dispatch canceled or job reserved");
+                return node ? workflow.begin(self, jobId, node, turn.turn, target, queued).id : undefined;
+            };
             if (parkIt) {
+                try {
+                    attemptId = beginNode(true);
+                }
+                catch (e) {
+                    return { status: 409, body: { ok: false, reason: e.message } };
+                }
                 const bp = body;
+                if (attemptId) {
+                    try {
+                        workflow.recordLeg(attemptId, { text, at: Date.now(), tell: { from: self, to: target, channel, job: jobId, turn: turn.turn, at: Date.now(), legs: 1, ...(k ? { k } : {}), ...(asker ? { asker } : {}) }, kind: "task", ...(roleParam(bp.role) ? { role: roleParam(bp.role) } : {}) });
+                        accountWorkflow(workflow.byTurn(self, turn.turn));
+                    }
+                    catch (e) {
+                        return { status: 409, body: { ok: false, attemptId, reason: e.message } };
+                    }
+                }
                 receipts.hold({
                     from: self, to: target, turn: turn.turn, at: Date.now(), after: afters, channel, job: jobId,
                     ...(k ? { k } : {}), ...(asker ? { asker } : {}),
                     // force: 冷门控上面已过一遍, 放行时缓存又凉了也不再退回。
-                    body: { name: peerAddress(cfg, self, target), text, kind, force: true, ...(jobId ? { job: jobId } : {}), ...(bp.role ? { role: bp.role } : {}), ...(bp.priority ? { priority: bp.priority } : {}), ...(bp.waitSec ? { waitSec: bp.waitSec } : {}), ...(bp.deadline !== undefined ? { deadline: bp.deadline } : {}), ...(bp.receipt === false ? { receipt: false } : {}) },
+                    body: { name: peerAddress(cfg, self, target), text, kind, force: true, ...(node ? { node } : {}), ...(jobId ? { job: jobId } : {}), ...(bp.role ? { role: bp.role } : {}), ...(bp.priority ? { priority: bp.priority } : {}), ...(bp.waitSec ? { waitSec: bp.waitSec } : {}), ...(bp.deadline !== undefined ? { deadline: bp.deadline } : {}), ...(bp.receipt === false ? { receipt: false } : {}) },
                 });
-                if (jobId) {
+                if (jobId && !attemptId) {
                     const role = roleParam(bp.role);
                     jobs.attach(jobId, { target, task: text, spawned: false, ...(role ? { role } : {}) }, kind === "ask" ? "ask" : "task");
                     jobs.spend(jobId);
                 }
-                return { status: 200, body: { ok: true, parked: true, after: afters, turn: turn.turn, name: peerAddress(cfg, self, target), ...(jobId ? { job: jobId } : {}), receipt: `排在 ${afters.join(" ")} 之后: 前置都 done 才投 (带上它们的结论), 任一失败这件不投、按 canceled 回给你; 不要挂在 wait_peer 上等, 接着干你自己的事` } };
+                return { status: 200, body: { ok: true, parked: true, after: afters, turn: turn.turn, ...(attemptId ? { node, attemptId } : {}), name: peerAddress(cfg, self, target), ...(jobId ? { job: jobId } : {}), receipt: `排在 ${afters.join(" ")} 之后: 前置满足放行条件才投（tracked 要 accepted，legacy 要 done；带上结论）, 任一失败这件不投、按 canceled 回给你; 不要挂在 wait_peer 上等, 接着干你自己的事` } };
+            }
+            try {
+                attemptId = beginNode(true);
             }
+            catch (e) {
+                return { status: 409, body: { ok: false, reason: e.message } };
+            }
+            const canceledBeforeDispatch = () => !planAllowed() || (!!planned && !planned.alive()) || (!!held?.alive && !held.alive()) || !!workflow.byTurn(self, turn.turn)?.canceled || (!!jobId && jobs.get(jobId)?.status !== "open");
             // 「忙」= 这一轮还没结束, 或停在审批上等人 —— 都不是能接新活的时候。
             const wasBusy = !(await m.idleNow(target));
+            if (answer === "transfer" && (wasBusy || receipts.states().some((s) => s.to === target)))
+                return { status: 409, body: { ok: false, wasBusy: true, reason: "answer target is busy or has pending work; source retains answer and control" } };
             // urgent 只打断你自己派的那一轮 (或它自己的回执轮): 手上若是别的 wizard / 人 / 定时任务的活,
             // 打断就误伤了那件 —— 降成 normal, 等它这一轮做完再投。
             const others = asked === "urgent" && wasBusy ? await othersTurn(target, self) : undefined;
@@ -1363,12 +1650,20 @@ const main = async () => {
             if (policy === "normal" && wasBusy) {
                 const t0 = Date.now();
                 // 它那一轮一结束就投: 注册表 status 翻 idle 是事件, 不抽样也不等稳定期。
-                const wr = await m.untilIdle(target, waitSec * 1000);
+                const wr = await m.untilIdle(target, waitSec * 1000, { aborted: canceledBeforeDispatch });
                 waitedMs = Date.now() - t0;
+                if (!actorStillValid())
+                    return { status: 409, body: { ok: false, attemptId, reason: "caller turn/control changed while waiting for idle" } };
                 if (!wr.idle) {
+                    if (canceledBeforeDispatch())
+                        return { status: 409, body: { ok: false, attemptId, reason: "dispatch canceled while waiting for idle" } };
                     return { status: 409, body: { ok: false, target, foreign, wasBusy, waitedMs, reason: `它一直在忙, ${waitSec}s 内没闲下来 —— peek_peer 看看它卡在哪; 真急就 priority:"urgent" 打断它` } };
                 }
             }
+            if (canceledBeforeDispatch())
+                return { status: 409, body: { ok: false, attemptId, reason: "dispatch canceled while waiting for idle" } };
+            if (!actorStillValid())
+                return { status: 409, body: { ok: false, attemptId, reason: "caller turn/control changed before target control" } };
             if (policy === "urgent" && wasBusy) {
                 // 只按 Esc, 不走 /stop 的 teardown: 那会清掉它的注入队列 (别人排着的话一起丢)
                 // 并暂停 keepalive —— 这里打断它是为了马上接着干, 不是让它安静。
@@ -1377,6 +1672,8 @@ const main = async () => {
                 // 等 Esc 生效、这一轮真收住再投; 收不住也照投 —— 落进输入框排在后面, 退化成 now。
                 interrupted = esc.ok && (await m.untilIdle(target, 15_000)).idle;
                 waitedMs = Date.now() - t0;
+                if (!actorStillValid())
+                    return { status: 409, body: { ok: false, attemptId, reason: "caller turn/control changed during interrupt wait" } };
             }
             // 时刻取在注入**之前**: 晚于那一句落盘的话, 回执定位的下界就偏了。
             const at = Date.now();
@@ -1390,7 +1687,64 @@ const main = async () => {
             // 是"放出去就不管了"的那种派活; fyi 一定不要。对方的信封据此改口, 不再让它收口。
             const wantReceipt = kind !== "fyi" && body.receipt !== false;
             const deadlineAt = deadlineOf(at, deadlineSec === undefined ? undefined : Number(deadlineSec));
+            const blocking = workflow.list(self).find((a) => a.to === target && a.turn !== turn.turn && !["queued", "terminal"].includes(a.execution));
+            if (blocking && kind !== "fyi")
+                return { status: 409, body: { ok: false, reason: `tracked attempt ${blocking.id} still in flight` } };
+            if (receipts.prereqs(self, held?.after ?? afters, held?.seen).some((p) => p.state !== "done"))
+                return { status: 409, body: { ok: false, reason: "prerequisite acceptance/version changed before injection" } };
+            let physicalExposure = false;
+            const dispatchGuard = (phase) => {
+                if (!actorStillValid())
+                    return false;
+                if (answers.all().some((r) => r.target === target && answerTargetOccupied(r) && r.id !== turn.turn))
+                    return false;
+                if (answerContext && m.answerContext(self)?.turn !== answerContext.turn)
+                    return false;
+                if (!planAllowed() || (planned && !planned.alive()) || (held?.alive && !held.alive()))
+                    return false;
+                if (jobId && jobs.get(jobId)?.status !== "open") {
+                    if (attemptId)
+                        workflow.cancel(target, self, jobId, turn.turn);
+                    return false;
+                }
+                const a = workflow.byTurn(self, turn.turn);
+                if (a?.canceled || a?.execution === "dispatch-unknown" || a?.execution === "terminal")
+                    return false;
+                if (receipts.prereqs(self, held?.after ?? afters, held?.seen).some((p) => p.state !== "done"))
+                    return false;
+                const allowed = !phase || !attemptId || workflow.boundary(attemptId);
+                if (allowed && phase)
+                    physicalExposure = true;
+                return allowed;
+            };
+            if (!dispatchGuard())
+                return { status: 409, body: { ok: false, attemptId, reason: "dispatch canceled or prerequisites invalidated" } };
+            const trackedTell = { from: self, to: target, channel, job: jobId, at, turn: turn.turn, legs: turn.legs, deadlineAt, ...(answer === "transfer" ? { answerTransfer: turn.turn } : {}), ...(k ? { k } : {}), ...(asker ? { asker } : {}) };
+            if (node) {
+                try {
+                    attemptId = beginNode(false);
+                    workflow.intent(attemptId, trackedTell);
+                    workflow.recordLeg(attemptId, { text, tell: trackedTell, continuation: turn.legs > 1, at, kind: "task", ...(roleParam(body.role) ? { role: roleParam(body.role) } : {}), free: !!open?.need && open.turn === turn.turn }, !!held);
+                    accountWorkflow(workflow.byTurn(self, turn.turn));
+                }
+                catch (e) {
+                    return { status: 409, body: { ok: false, reason: e.message } };
+                }
+            }
+            if (answerContext && k?.kind === "chat") {
+                try {
+                    answers.reserve({ id: turn.turn, source: self, target, sourceTurn: answerContext.turn, sourceOpening: answerSourceOpening, origin: answerTransferOrigin(self, answerContext.turn), channel: k.channel, prefix: answerContext.prefix, tell: trackedTell, state: "reserved" });
+                }
+                catch (e) {
+                    return { status: 409, body: { ok: false, reason: e.message } };
+                }
+                if (!m.prepareAnswer(turn.turn, self, answerContext.turn, target, answerContext.channel)) {
+                    answers.rollback(turn.turn);
+                    return { status: 409, body: { ok: false, reason: "answer stream is no longer writable; source retains answer and control" } };
+                }
+            }
             const inj = await m.injectText(target, text, undefined, {
+                guard: dispatchGuard,
                 from: { kind: "peer", from: self, turn: turn.turn, ...(jobId ? { job: jobId } : {}), ...(isPublic ? { public: true } : {}), ...(asker ? { asker } : {}) },
                 channel,
                 envelope: envelopeFor(self, channel, {
@@ -1402,15 +1756,39 @@ const main = async () => {
                     ...(deadlineSec !== undefined ? { deadline: deadlineAt } : {}),
                     ...(kind !== "task" ? { act: kind } : {}),
                     ...(wantReceipt ? {} : { quiet: true }),
-                }) + extra,
+                }) + extra + (answerContext ? renderReminder({ wezard: "answer-transfer" }, ["你已接手这轮人的回答权与控制权。判断为简单问题，直接答给人；原气泡内容会清空，只显示你的进度，终句覆盖气泡并由 daemon 唯一交付，不回给派活方。不要另行 notify 相同终稿；需要追问可直接以自然语言收口。派活方这轮后续产出不再对人发送。"]) : ""),
+            }).catch((e) => {
+                if (attemptId)
+                    workflow.dispatched(attemptId, false);
+                if (answerContext)
+                    return { ok: false, uncertain: true, reason: e.message };
+                throw e;
             });
+            if (answerContext) {
+                if (inj.ok || inj.uncertain || physicalExposure) {
+                    answers.activate(turn.turn);
+                    const bubble = await m.takeAnswer(turn.turn, self, answerContext.turn, target, answerContext.channel);
+                    receipts.register(trackedTell);
+                    if (!inj.ok)
+                        void deliverTransferredAnswer(turn.turn, { status: "canceled", body: "回答移交的投递结果不确定，本轮已收止；若未收到回答，请重新发送问题。" });
+                    if (!bubble.cleared)
+                        return { status: 202, body: { ...inj, ok: false, answer: "transfer", control: "transfer", ownershipTransferred: true, bubbleCleared: false, retryable: false, name: peerAddress(cfg, self, target), turn: turn.turn, reason: "回答权已转交，但原气泡清空未确认（已结束、不可用或 ACK 失败）；不能重试移交。目标仍负责最终答复，必要时另发终稿；本轮请停止派活与公开回答。" } };
+                    return { status: 200, body: { ...inj, ok: true, answer: "transfer", control: "transfer", name: peerAddress(cfg, self, target), turn: turn.turn, bubbleCleared: bubble.cleared, receipt: "回答权已转交；可用气泡只显示目标进度与终稿；本轮请停止派活与公开回答，静默收口" } };
+                }
+                m.cancelAnswerPreparation(turn.turn);
+                answers.rollback(turn.turn);
+            }
+            if (attemptId)
+                workflow.dispatched(attemptId, inj.ok && !inj.uncertain);
+            if (!dispatchGuard())
+                return { status: 409, body: { ok: false, attemptId, reason: `canceled/invalidated during transport; reconcile possible delivery${inj.reason ? ": " + inj.reason : ""}`, uncertain: !!inj.uncertain || physicalExposure || workflow.byTurn(self, turn.turn)?.execution === "dispatch-unknown" } };
             // 注入失败就不守 —— 没有问话, 也不会有回答。不要回执 (receipt:false / fyi) 就不登记:
             // 一份不守的槽会以同一对的 key 顶掉发话方还在等它答的那件活, 那件的回执就再也来不了。
             // 父 k: 默认这件活算发话方此刻在答的那件的子活 (链式续回); `chain:false` = 旁支,
             // 回执照常回来, 但不挂住它给上游的交代 —— 只有发话方知道这件活是不是为上游派的。
             if (inj.ok && wantReceipt)
-                receipts.register({ from: self, to: target, channel, job: jobId, at, turn: turn.turn, legs: turn.legs, deadlineAt, ...(k ? { k } : {}), ...(asker ? { asker } : {}) });
-            if (inj.ok && wantReceipt) {
+                receipts.register(attemptId ? workflow.byTurn(self, turn.turn).tell : trackedTell);
+            if (inj.ok && wantReceipt && !attemptId) {
                 if (turn.legs > 1)
                     ledger.touch(self, turn.turn);
                 else
@@ -1418,7 +1796,7 @@ const main = async () => {
             }
             // 工单成员照旧记账 (收工那一条会列出各自那段活); 公开的那一句在群里成气泡。
             // 续问 (re) 不是一段新活: 工单页与留档里该列的仍是当初派的那段。
-            if (inj.ok && jobId) {
+            if (inj.ok && jobId && !attemptId) {
                 const role = roleParam(body.role);
                 // G2: 需求根单的 owner 答了 lead 的 NEED —— 方案闸过了 (只记第一次)。
                 const rj = jobs.get(jobId);
@@ -1427,7 +1805,8 @@ const main = async () => {
                 jobs.attach(jobId, { target, task: turn.legs > 1 ? "" : text, spawned: false, ...(role ? { role } : {}) }, kind === "ask" ? "ask" : "task");
             }
             // 停放时已记过预算, 放行不再算一次。
-            const spent = inj.ok && jobId && !held ? jobs.spend(jobId) : undefined;
+            const trackedJob = inj.ok && attemptId ? jobs.get(jobId) : undefined;
+            const spent = trackedJob ? { turns: trackedJob.turns ?? 0, maxTurns: trackedJob.maxTurns } : inj.ok && jobId && !held ? jobs.spend(jobId) : undefined;
             if (inj.ok && isPublic)
                 relayPeer(self, target, text, channel);
             // `wasBusy` 是给调用方的判断依据: 立刻投给一个正在生成的会话, 这句话会排在
@@ -1446,6 +1825,7 @@ const main = async () => {
                     ...(waitedMs ? { waitedMs } : {}),
                     ...(jobId ? { job: jobId } : {}),
                     ...(inj.ok ? { turn: turn.turn } : {}),
+                    ...(attemptId ? { node, attemptId, acceptance: "pending" } : {}),
                     ...(spent?.maxTurns ? { budget: `${spent.turns}/${spent.maxTurns}${spent.turns >= spent.maxTurns ? " —— 用完了, 这是最后一次派活, 下一步收口" : ""}` } : {}),
                     ...(inj.ok && wake ? { wakeCost: wake } : {}),
                     ...(turn.reUnknown ? { reUnknown: true, reNote: `re "${re}" 不是你正在等 ${displayName(target)} 答的那件, 按新活发出` } : {}),
@@ -1458,6 +1838,24 @@ const main = async () => {
                         : {}),
                 } };
         };
+        const tellPeerAs = async (...args) => {
+            const [self, body] = args;
+            const transfer = body.answer === "transfer";
+            const current = peerDispatching.get(self);
+            if (current?.transfer || (transfer && current?.count))
+                return { status: 409, body: { ok: false, reason: "another dispatch is in flight for this caller; source retains its current answer ownership" } };
+            peerDispatching.set(self, { count: (current?.count ?? 0) + 1, transfer });
+            try {
+                return await tellPeerAsInner(...args);
+            }
+            finally {
+                const n = peerDispatching.get(self);
+                if (n && n.count > 1)
+                    peerDispatching.set(self, { count: n.count - 1, transfer: n.transfer });
+                else
+                    peerDispatching.delete(self);
+            }
+        };
         const tellPeer = async (req, res) => {
             const { self, body } = await readPeerBody(req);
             if (!self) {
@@ -1467,6 +1865,58 @@ const main = async () => {
             const r = await tellPeerAs(self, body);
             json(res, r.status, r.body);
         };
+        http.register("POST /peers/inbox", async (req, res) => {
+            const { self } = await readPeerBody(req);
+            if (!self) {
+                json(res, 400, { ok: false, reason: "cannot resolve caller" });
+                return;
+            }
+            json(res, 200, { ok: true, events: receipts.inbox(self) });
+        });
+        http.register("POST /workflow/nodes", async (req, res) => {
+            const { self, body } = await readPeerBody(req);
+            if (!self) {
+                json(res, 400, { ok: false, reason: "cannot resolve caller" });
+                return;
+            }
+            const attempts = workflow.list(self, body.job);
+            json(res, 200, { ok: true, nodes: attempts, tally: {
+                    attempts: attempts.length, nodes: new Set(attempts.map((a) => `${a.job}\0${a.node}`)).size,
+                    accepted: attempts.filter((a) => workflow.prereq(self, a.turn)?.state === "done").length,
+                    awaitingAcceptance: attempts.filter((a) => a.execution === "terminal" && a.status === "done" && a.acceptance === "pending").length,
+                } });
+        });
+        http.register("POST /workflow/verdict", async (req, res) => {
+            const { self, body } = await readPeerBody(req);
+            if (!self) {
+                json(res, 400, { ok: false, reason: "cannot resolve caller" });
+                return;
+            }
+            const b = body;
+            if (!["accepted", "rejected", "sent", "stopped"].includes(b.as ?? "")) {
+                json(res, 400, { ok: false, reason: "invalid verdict" });
+                return;
+            }
+            try {
+                const old = workflow.list(self).find((a) => a.id === b.attemptId);
+                if (!old)
+                    throw new Error("attempt not found for owner");
+                if (b.as !== "stopped" && (jobs.get(old.job)?.status !== "open" || jobs.get(old.job)?.owner !== self))
+                    throw new Error("owner job must be open for acceptance or sent watching");
+                if (b.as === "sent" && !old.dispatches?.length)
+                    throw new Error("historical tracked attempt lacks dispatch accounting evidence; reconcile stopped before retry");
+                const a = workflow.verdict(self, b.attemptId ?? "", b.as, b.digest, b.reason ?? "", b.files);
+                if (b.as === "sent" && a.tell)
+                    recoverWorkflow(a);
+                if (b.as === "stopped")
+                    receipts.cancel(a.to, self, (x) => x.from === self && x.turn === a.turn);
+                advancePlans();
+                json(res, 200, { ok: true, attempt: workflow.byTurn(self, a.turn) });
+            }
+            catch (e) {
+                json(res, 409, { ok: false, reason: e.message });
+            }
+        });
         http.register("POST /peers/tell", tellPeer);
         http.register("POST /peers/send", tellPeer); // 老 MCP 进程还在调这个名字
         // 等一个 wizard, 或者等一**组**。fan-out 之后 join 必须是并行的: 串行地等五个
@@ -1515,19 +1965,20 @@ const main = async () => {
                 // 取走就占位: 同一段话不会再作为回执 paste 进来一遍 (见 receipts.claim)。
                 const full = wr.idle ? m.lastReply(h.target, receipts.sentAt(self, h.target)) : "";
                 const already = full ? receipts.claim(self, h.target) : false;
-                const closing = parseClosing(full);
+                const closing = parseClosing(already === "uncertain" ? "" : full);
                 const result = closing.kind === "result" ? closing.text : "";
                 return {
                     name: h.address,
                     idle: wr.idle,
                     // 回执早一步到了: 这段话已经作为新的一轮进过你的会话, 别再处理第二遍。
-                    ...(already ? { delivered: true } : {}),
+                    ...(already === true ? { delivered: true } : {}),
+                    ...(already === "uncertain" ? { delivery: "uncertain", reason: "回执可能已递交，需按 receipt eventId 对账；没有自动重投或再次领取。" } : {}),
                     ...(wr.reason ? { reason: wr.reason } : {}),
                     ...(closing.kind === "need" ? { need: closing.text } : {}),
                     ...(closing.artifacts.length ? { artifacts: closing.artifacts } : {}),
                     ...(result
                         ? { result, ...(full.length > result.length + 200 ? { omitted: full.length - result.length } : {}) }
-                        : full
+                        : already === "uncertain" ? {} : full
                             ? { lastText: clipMiddle(full) }
                             : wr.idle
                                 ? { stale: true, reason: "它停下了, 但自你上次 send_peer 以来没有新回复 —— 多半停在一个等人点的弹窗上, 或那句话没被接住; peek_peer 看一眼" }
@@ -1544,12 +1995,14 @@ const main = async () => {
         // /clear 只换会话不换进程 —— MCP 子进程、charter 都还是旧的, 新工具拿不到; 镜像
         // 还得靠 sid 轮换探测才跟得上。CLI 使用 cfg 的默认 backend; cwd / keepalive 照旧沿用。
         // 同 backend 时模型也沿用, 管家除外 ——
-        // 它换上此刻的管家档 (newSession 里定), 改了 models.steward 后交接一次就是让它生效的那一下。
+        // 它换上此刻的 router 档 (newSession 里定), 改了 models.router 后交接一次就是让它生效的那一下。
         const restartFresh = (target) => {
             const info = m.sessionInfo(target);
             const cli = cfg.wrc.defaultCli ?? primary.name;
             const model = stewardTierOf(cfg, target) || info?.cli !== cli ? undefined : info?.model || undefined;
-            return m.newSession(target, displayName(target) || tagOfKey(target) || target, cli, { model, silent: true, warm: true });
+            if (!planContinuationAllowed(target))
+                return Promise.resolve({ ok: false, reason: "workflow continuation withdrawn" });
+            return m.newSession(target, displayName(target) || tagOfKey(target) || target, cli, { model, silent: true, warm: true, guard: () => planContinuationAllowed(target) });
         };
         // POST /handoff — 交接一个 pane 的会话给一个全新会话。先让目标会话把当前工作
         // 压成一份"零上下文也能接手"的交接简报,等它写完并抓取,再 restartFresh 换一个
@@ -1558,6 +2011,8 @@ const main = async () => {
         /** 交接自己: 简报由调用方给, 排在它这一轮说完之后 (见 handoff.ts)。/handoff 点名点到
          *  自己与老路由 /wizard/handoff-self 共用。 */
         const handoffSelf = (self, brief) => {
+            if (!planContinuationAllowed(self))
+                return { status: 409, body: { ok: false, reason: "workflow continuation withdrawn" } };
             if (brief.length < 40)
                 return { status: 400, body: { ok: false, reason: "brief 太短 —— 要写到零上下文也能接手: 目标 / 已完成 / 当前状态 / 下一步 / 关键文件与坑" } };
             const info = m.sessionInfo(self);
@@ -1608,6 +2063,10 @@ const main = async () => {
                 json(res, r.status, r.body);
                 return;
             }
+            if (!planStore.allowExternal(target, wizards.get(target)?.name)) {
+                json(res, 409, { ok: false, reason: "workflow executor may only hand off its own live attempt" });
+                return;
+            }
             const focus = (body.focus ?? "").toString().trim();
             const timeoutMs = Math.min(Math.max(Number(body.timeoutSec ?? 600) || 600, 30), 7200) * 1000;
             const r = await handoffs.other(target, focus, timeoutMs);
@@ -2196,6 +2655,10 @@ const main = async () => {
                 json(res, 400, { ok: false, reason: "名字只能是 1-32 位字母/数字/`_`/`-`" });
                 return;
             }
+            if (asked && (!planStore.allowExternal(self, wizards.get(self)?.name) || !planStore.allowExternal(undefined, asked))) {
+                json(res, 409, { ok: false, reason: "workflow plan reserves this identity" });
+                return;
+            }
             const before = settleName(wizards, chatNameOf(cfg, self), self);
             const name = asked ? wizards.rename(self, asked) : before;
             if (description)
@@ -2327,7 +2790,23 @@ const main = async () => {
                 json(res, 400, { ok: false, reason: "task is required" });
                 return;
             }
+            const dispatchOrigin = {
+                authority: controlSnapshot(self), answerContext: m.answerContext(self), asker: askerOf(self), k: parentKOf(self),
+            };
             const lead = b.lead === true;
+            if (b.answer !== undefined && b.answer !== "transfer") {
+                json(res, 400, { ok: false, reason: "answer must be transfer when supplied" });
+                return;
+            }
+            if (b.answer === "transfer" && lead) {
+                json(res, 409, { ok: false, reason: "answer transfer is for simple direct answers; lead dispatch cannot transfer" });
+                return;
+            }
+            const answerParent = dispatchOrigin?.k;
+            if (b.answer === "transfer" && (lostAnswer(self) || !dispatchOrigin?.answerContext || answerParent?.kind !== "chat" || !dispatchOrigin.asker?.who.startsWith("user:") || !chatPolicyOf(cfg, answerParent.channel).topOnly || hasAnswerChildren(self, answerParent) || peerDispatching.has(self))) {
+                json(res, 409, { ok: false, reason: "no exclusive active human topOnly answer available to transfer" });
+                return;
+            }
             const force = b.force === true;
             const to = (b.to ?? "").toString().trim();
             const now = Date.now();
@@ -2335,6 +2814,10 @@ const main = async () => {
             // 占用保护由 decide 统一判断, 留在候选表里说明为什么不能自动复用。
             // 显式 to 保留人为选定; force 只影响成本门, 不绕 lead/工单/连续性保护。
             const pool = to || b.spawn || lead ? [] : (await routeRowsOf(self)).filter((r) => r.alive && !!tagOfKey(r.target));
+            if (!controlValid(self, dispatchOrigin.authority)) {
+                json(res, 409, { ok: false, reason: "dispatch source turn/control changed while routing; original task remains with source" });
+                return;
+            }
             const tierArg = (b.tier ?? "").toString().trim();
             if (tierArg && !TIERS.includes(tierArg)) {
                 json(res, 400, { ok: false, reason: `unknown tier: ${tierArg}` });
@@ -2352,10 +2835,11 @@ const main = async () => {
             let rootId = "";
             const tell = (name, text, extra = "") => tellPeerAs(self, {
                 name, text, public: b.public !== false, force,
+                ...(b.answer ? { answer: b.answer } : {}),
                 // lead 的活远超默认的 1h: 不给 deadline 就按 12h (回执的上限)。
                 ...(b.deadline !== undefined ? { deadline: b.deadline } : lead ? { deadline: 43200 } : {}),
                 ...(rootId ? { job: rootId } : {}),
-            }, extra);
+            }, extra, undefined, undefined, dispatchOrigin);
             const shown = cands.slice(0, 3).map((e) => `.${e.row.address || e.row.name}${e.row.busy ? " 忙" : ""}`);
             if (b.dryRun) {
                 json(res, 200, { ok: true, dryRun: true, decision: d.kind, reason: d.why, ...(d.kind === "existing" ? { name: to || (d.kind === "existing" && d.row ? d.row.address || d.row.name : "") } : { tier: taskTier }), ...(shown.length ? { candidates: shown } : {}) });
@@ -2405,12 +2889,17 @@ const main = async () => {
                 return;
             }
             const tier = taskTier;
-            const born = await bearAs(self, { inherit: false, name, description, tier, ...(lead ? { lead: true } : {}) });
+            const born = await bearAs(self, { inherit: false, name, description, tier, ...(lead ? { lead: true } : {}) }, undefined, dispatchOrigin?.authority);
             if (born.status !== 200) {
                 settleRoot(false);
                 json(res, born.status, { ...born.body, decision: "spawn", reason: d.why });
                 return;
             }
+            if (!controlValid(self, dispatchOrigin.authority)) {
+                settleRoot(false);
+                json(res, 409, { ok: false, decision: "spawn", reason: "dispatch source turn changed during spawn; task remains with original source turn" });
+                return;
+            }
             // 宪章里只有层级规矩, 打法随信封带 (宪章每轮都在上下文里, 打法只这一件活用得上)。
             const t = await tell(String(born.body.name), task, lead ? renderReminder({ wezard: "lead" }, renderLeadPlaybook()) : "");
             settleRoot(t.status === 200);
@@ -2492,193 +2981,249 @@ const main = async () => {
         // 生分身。默认 fork 调用方此刻的上下文 —— 这是"先把公共材料读进来, 再分出 N
         // 个干活的"之所以省事的原因: 材料只读一遍, 却进了 N 份上下文。
         /** spawn_wizard / clone_wizard 的本体 —— HTTP 路由与 dispatch 共用。 */
-        const bearAs = async (self, body) => {
-            const b = body;
-            const asker = b.task?.trim() ? askerOf(self) : undefined;
-            const k = body.chain === false ? undefined : parentKOf(self);
-            const askedEffort = parseEffort(b.effort);
-            if (b.effort !== undefined && !askedEffort) {
-                return { status: 400, body: { ok: false, reason: `effort 只有这几档: ${EFFORTS.join(" / ")}` } };
-            }
-            // 工单先验: 生完分身才发现工单号打错了, 那个分身就成了没人认领的孤儿。
-            const jobId = (b.job ?? "").trim();
-            if (jobId) {
-                const jc = checkJob(jobId, undefined, !(b.task ?? "").toString().trim());
-                if (!jc.ok) {
-                    return { status: jc.status, body: { ok: false, reason: jc.reason } };
+        const bearAs = async (self, body, planned, capturedAuthority) => {
+            const authority = planned ? undefined : capturedAuthority ?? controlSnapshot(self);
+            if (authority && !controlValid(self, authority))
+                return { status: 409, body: { ok: false, reason: "this turn no longer owns control; cannot spawn more work" } };
+            // Legacy bootstrap can dispatch before attaching its member. An empty job
+            // is not available for plan ownership while that birth is still in flight.
+            const birthJob = (body.job ?? "").trim();
+            if (birthJob)
+                pendingBirthJobs.set(birthJob, (pendingBirthJobs.get(birthJob) ?? 0) + 1);
+            try {
+                const b = body;
+                const asker = b.task?.trim() ? askerOf(self) : undefined;
+                const k = body.chain === false ? undefined : parentKOf(self);
+                const askedEffort = parseEffort(b.effort);
+                if (b.effort !== undefined && !askedEffort) {
+                    return { status: 400, body: { ok: false, reason: `effort 只有这几档: ${EFFORTS.join(" / ")}` } };
                 }
-            }
-            // 带 task 派下去 = 派活: 同样过方向闸, 不论带不带 job (新生的目标还不在任何单里, 实际只有 1 / 链深两条会拦)。
-            const dr = (b.task ?? "").toString().trim() ? checkDirection({ self, target: "", kind: "task", re: false, jobId, jobs: jobs.all(), chain: receipts.ancestorsOf(self, parentKOf(self)), nameOf: displayName }) : undefined;
-            if (dr) {
-                return { status: 409, body: { ok: false, gated: "direction", reason: dr } };
-            }
-            // `inherit` 没有默认值 —— 继承与否是两种完全不同的分身 (一种开局就带着你
-            // 读过的一切, 另一种白纸一张), 猜错了要么白烧一份上下文, 要么让它从零重读。
-            // 逼调用方每次自己说。
-            if (typeof b.inherit !== "boolean") {
-                return { status: 400, body: { ok: false, reason: "inherit 必填: true = fork 你此刻的上下文 (它开局就有你读过的材料, 必须留在同一个 cwd); false = 空白分身, 只继承身份" } };
-            }
-            const inherit = b.inherit;
-            // detached = 独立长住 (原 new_claude_session / 人在群里 `/new .x`): 不挂家谱、不占
-            // 调用方的分身名额、不随工单回收。它和「fork 我的上下文」「归某张工单」都互斥。
-            const detached = b.detached === true;
-            if (detached && (inherit || (b.job ?? "").trim())) {
-                return { status: 400, body: { ok: false, reason: "detached 只用于白板 (inherit:false) 且不带 job —— 独立长住的 wizard 不归你管, 也不随工单回收" } };
-            }
-            // 克隆的源头: 默认是调用方自己; `from` 点名就 fork 那个 wizard 此刻的上下文。
-            // 分身仍归调用方管 (parent = self: 占它的预算、随它的工单回收), 只有上下文来自别处。
-            // 空串不能交给 resolvePeer —— 那是「本聊天的默认 wizard」, 不是「我自己」。
-            const fromAddr = (b.from ?? "").toString().trim();
-            if (fromAddr && !inherit) {
-                return { status: 400, body: { ok: false, reason: "from 只对克隆有意义 —— 白板生出来的 wizard 不带任何人的上下文" } };
-            }
-            const fromR = fromAddr ? resolvePeer(self, fromAddr) : { ok: true, target: self };
-            if (!fromR.ok) {
-                return { status: fromR.status, body: { ok: false, reason: fromR.reason, ...(fromR.candidates ? { candidates: fromR.candidates } : {}) } };
-            }
-            const source = fromR.target;
-            const sourceInfo = m.sessionInfo(source);
-            const forkBackend = inherit && sourceInfo && existsSync(sourceInfo.jsonlPath)
-                && (!b.cwd?.trim() || expandHome(b.cwd.trim()) === sourceInfo.cwd) ? sourceInfo.cli : undefined;
-            const pick = pickTier(cfg, b.tier, { cli: b.cli, model: b.model, effort: askedEffort }, inherit, forkBackend);
-            if (!pick.ok)
-                return { status: 400, body: pick };
-            const effort = pick.effort;
-            // 别人的会话 fork 不出来就是失败, 不能像克隆自己那样悄悄退化成白板 —— 调用方
-            // 要的恰恰是它的上下文, 给一张白纸等于答非所问。
-            if (source !== self && !sourceInfo?.sessionId) {
-                return { status: 409, body: { ok: false, reason: `${displayName(source)} 没有可 fork 的会话 (还没说过话, 或绑定已失效)` } };
-            }
-            const alivePeers = detached ? [] : await m.peers(self);
-            // 预算。撞到上限由守护进程腾位, 不叫调用方去收: 最久没动的闲分身只关 pane、绑定留着
-            // (同 maxPanes 的 reap), 再找它 `--resume` 带全上下文复活。忙的、停在审批上的、手上
-            // 还有没落定的活的不动; 全都动不了才拒。只数**本聊天里**活着的 ——
-            // 生到别的聊天去的归那边管, 为了数它们再探一遍 tmux 不值当。
-            const aliveKids = alivePeers.filter((pp) => pp.paneAlive && childrenOf(wizards.all(), self).some((k) => k.target === pp.target));
-            const over = detached ? 0 : aliveKids.length - cfg.wrc.mirror.cloneMax + 1;
-            if (over > 0) {
-                const parked = new Set(listPending().map((p) => p.meta.sessionId).filter(Boolean));
-                const owing = new Set(receipts.states().map((x) => x.to));
-                const idle = aliveKids
-                    .filter((pp) => !pp.busy && !owing.has(pp.target) && !parked.has(m.sessionInfo(pp.target)?.sessionId ?? ""))
-                    .sort((x, y) => x.lastActivity - y.lastActivity)
-                    .slice(0, over);
-                const slept = (await Promise.all(idle.map((pp) => m.sleepPane(pp.target)))).filter((r) => r.ok).length;
-                if (slept < over) {
-                    return { status: 429, body: {
+                // 工单先验: 生完分身才发现工单号打错了, 那个分身就成了没人认领的孤儿。
+                const jobId = (b.job ?? "").trim();
+                if (jobId) {
+                    const jc = checkJob(jobId, undefined, !(b.task ?? "").toString().trim());
+                    if (!jc.ok) {
+                        return { status: jc.status, body: { ok: false, reason: jc.reason } };
+                    }
+                }
+                const planBirthAllowed = (target, name = normalizeTag(b.name ?? b.tag) || (b.detached && b.cwd ? tagFromCwd(b.cwd) : "") || normalizeTag(b.description?.split(/\s+/)[0]) || "clone") => planStore.allowSpawn(self, jobId, planned, name, target) && (!planned || planned.alive());
+                if (!planBirthAllowed() || (planned && !!b.task))
+                    return { status: 409, body: { ok: false, reason: "dedicated plan job only permits taskless runner spawn" } };
+                // 带 task 派下去 = 派活: 同样过方向闸, 不论带不带 job (新生的目标还不在任何单里, 实际只有 1 / 链深两条会拦)。
+                const dr = planned || (b.task ?? "").toString().trim() ? checkDirection({ self, target: "", kind: "task", re: false, jobId, jobs: jobs.all(), chain: planned?.origin.chain ?? receipts.ancestorsOf(self, parentKOf(self)), nameOf: displayName }) : undefined;
+                if (dr) {
+                    return { status: 409, body: { ok: false, gated: "direction", reason: dr } };
+                }
+                // `inherit` 没有默认值 —— 继承与否是两种完全不同的分身 (一种开局就带着你
+                // 读过的一切, 另一种白纸一张), 猜错了要么白烧一份上下文, 要么让它从零重读。
+                // 逼调用方每次自己说。
+                if (typeof b.inherit !== "boolean") {
+                    return { status: 400, body: { ok: false, reason: "inherit 必填: true = fork 你此刻的上下文 (它开局就有你读过的材料, 必须留在同一个 cwd); false = 空白分身, 只继承身份" } };
+                }
+                const inherit = b.inherit;
+                // detached = 独立长住 (原 new_claude_session / 人在群里 `/new .x`): 不挂家谱、不占
+                // 调用方的分身名额、不随工单回收。它和「fork 我的上下文」「归某张工单」都互斥。
+                const detached = b.detached === true;
+                if (detached && (inherit || (b.job ?? "").trim())) {
+                    return { status: 400, body: { ok: false, reason: "detached 只用于白板 (inherit:false) 且不带 job —— 独立长住的 wizard 不归你管, 也不随工单回收" } };
+                }
+                // 克隆的源头: 默认是调用方自己; `from` 点名就 fork 那个 wizard 此刻的上下文。
+                // 分身仍归调用方管 (parent = self: 占它的预算、随它的工单回收), 只有上下文来自别处。
+                // 空串不能交给 resolvePeer —— 那是「本聊天的默认 wizard」, 不是「我自己」。
+                const fromAddr = (b.from ?? "").toString().trim();
+                if (fromAddr && !inherit) {
+                    return { status: 400, body: { ok: false, reason: "from 只对克隆有意义 —— 白板生出来的 wizard 不带任何人的上下文" } };
+                }
+                const fromR = fromAddr ? resolvePeer(self, fromAddr) : { ok: true, target: self };
+                if (!fromR.ok) {
+                    return { status: fromR.status, body: { ok: false, reason: fromR.reason, ...(fromR.candidates ? { candidates: fromR.candidates } : {}) } };
+                }
+                const source = fromR.target;
+                const sourceInfo = m.sessionInfo(source);
+                const forkBackend = inherit && sourceInfo && existsSync(sourceInfo.jsonlPath)
+                    && (!b.cwd?.trim() || expandHome(b.cwd.trim()) === sourceInfo.cwd) ? sourceInfo.cli : undefined;
+                const pick = pickTier(cfg, b.tier, { cli: b.cli, model: b.model, effort: askedEffort }, inherit, forkBackend);
+                if (!pick.ok)
+                    return { status: 400, body: pick };
+                const effort = pick.effort;
+                // 别人的会话 fork 不出来就是失败, 不能像克隆自己那样悄悄退化成白板 —— 调用方
+                // 要的恰恰是它的上下文, 给一张白纸等于答非所问。
+                if (source !== self && !sourceInfo?.sessionId) {
+                    return { status: 409, body: { ok: false, reason: `${displayName(source)} 没有可 fork 的会话 (还没说过话, 或绑定已失效)` } };
+                }
+                const alivePeers = detached ? [] : await m.peers(self);
+                if (authority && !controlValid(self, authority))
+                    return { status: 409, body: { ok: false, reason: "caller turn/control changed while preparing spawn" } };
+                // 预算。撞到上限由守护进程腾位, 不叫调用方去收: 最久没动的闲分身只关 pane、绑定留着
+                // (同 maxPanes 的 reap), 再找它 `--resume` 带全上下文复活。忙的、停在审批上的、手上
+                // 还有没落定的活的不动; 全都动不了才拒。只数**本聊天里**活着的 ——
+                // 生到别的聊天去的归那边管, 为了数它们再探一遍 tmux 不值当。
+                const aliveKids = alivePeers.filter((pp) => pp.paneAlive && childrenOf(wizards.all(), self).some((k) => k.target === pp.target));
+                const over = detached ? 0 : aliveKids.length - cfg.wrc.mirror.cloneMax + 1;
+                if (over > 0) {
+                    const parked = new Set(listPending().map((p) => p.meta.sessionId).filter(Boolean));
+                    const owing = new Set(receipts.states().map((x) => x.to));
+                    const idle = aliveKids
+                        .filter((pp) => planStore.allowExternal(pp.target, wizards.get(pp.target)?.name) && !pp.busy && !owing.has(pp.target) && !parked.has(m.sessionInfo(pp.target)?.sessionId ?? ""))
+                        .sort((x, y) => x.lastActivity - y.lastActivity)
+                        .slice(0, over);
+                    const slept = (await Promise.all(idle.map((pp) => m.sleepPane(pp.target)))).filter((r) => r.ok).length;
+                    if (slept < over) {
+                        return { status: 429, body: {
+                                ok: false,
+                                reason: `你名下 ${aliveKids.length} 个活着的分身 (上限 ${cfg.wrc.mirror.cloneMax}) 都在干活, 腾不出位置 —— 等其中一个交回结论再分`,
+                                clones: aliveKids.map((k) => peerAddress(cfg, self, k.target)),
+                            } };
+                    }
+                    log.info({ self, slept: idle.map((pp) => pp.target) }, "clone cap: idle clones put to sleep");
+                }
+                const wantChat = (b.chat ?? "").toString().trim();
+                const base = ((b) => (b && sameBot(self, b) ? b : ""))(wantChat ? chatBaseOf(cfg, wantChat) : baseOfKey(self));
+                if (!base) {
+                    return { status: 404, body: {
                             ok: false,
-                            reason: `你名下 ${aliveKids.length} 个活着的分身 (上限 ${cfg.wrc.mirror.cloneMax}) 都在干活, 腾不出位置 —— 等其中一个交回结论再分`,
-                            clones: aliveKids.map((k) => peerAddress(cfg, self, k.target)),
+                            reason: `unknown chat '${wantChat}' — 只有起过名字的聊天能被指名; 让那边先 /name`,
+                            candidates: chatNamesFor(self),
                         } };
                 }
-                log.info({ self, slept: idle.map((pp) => pp.target) }, "clone cap: idle clones put to sleep");
-            }
-            const wantChat = (b.chat ?? "").toString().trim();
-            const base = ((b) => (b && sameBot(self, b) ? b : ""))(wantChat ? chatBaseOf(cfg, wantChat) : baseOfKey(self));
-            if (!base) {
-                return { status: 404, body: {
-                        ok: false,
-                        reason: `unknown chat '${wantChat}' — 只有起过名字的聊天能被指名; 让那边先 /name`,
-                        candidates: chatNamesFor(self),
-                    } };
-            }
-            const askedName = String(b.name ?? b.tag ?? "");
-            // 没起名: 独立长住的按目录名 (同 /new 与 new_claude_session), 分身按职责的首词。
-            const fallback = (detached && b.cwd ? tagFromCwd(b.cwd) : "") || normalizeTag(b.description?.split(/\s+/)[0]) || "clone";
-            const slotR = await claimSlot(base, askedName, fallback, [self, source]);
-            if (!slotR.ok) {
-                return { status: slotR.status, body: slotR.body };
+                const askedName = String(b.name ?? b.tag ?? "");
+                // 没起名: 独立长住的按目录名 (同 /new 与 new_claude_session), 分身按职责的首词。
+                const fallback = (detached && b.cwd ? tagFromCwd(b.cwd) : "") || normalizeTag(b.description?.split(/\s+/)[0]) || "clone";
+                const slotR = await claimSlot(base, askedName, fallback, [self, source], (target, name) => planBirthAllowed(target, name) && (!target || planBirthAllowed(target, wizards.get(target)?.name ?? name)));
+                if (!slotR.ok) {
+                    return { status: slotR.status, body: slotR.body };
+                }
+                const { target, slot: tag } = slotR;
+                // claimSlot 会复用同名的冷记录 (detached 正是「叫回一个老名字」的场景): 生不出来时
+                // 只回滚这一次的新记录, 不能把那个老 wizard 的记忆和家谱一起删掉。
+                const existed = !!wizards.get(target);
+                const forkOf = inherit && source !== self ? source : undefined;
+                // 先落身份再 spawn: 宪章是从注册表渲染出来的, 记录不在就渲染出一个无名分身。
+                if (!planBirthAllowed(target, normalizeTag(askedName) || tag) || (jobId && jobs.get(jobId)?.status !== "open"))
+                    return { status: 409, body: { ok: false, reason: "plan canceled/job reserved during spawn preparation" } };
+                wizards.upsert(target, {
+                    description: (b.description ?? "").toString().trim(),
+                    // 显式写 undefined: upsert 是合并写, 复用的冷记录里旧的 parent 会留下来。
+                    parent: detached ? undefined : self,
+                    bornAt: Date.now(),
+                    clonedFrom: inherit ? sourceInfo?.sessionId ?? "" : "",
+                    ...(forkOf ? { forkOf } : {}),
+                    // fork 了上下文就一并继承 self 记忆: 系统提示不随 fork 走 (分身拿的是自己的宪章),
+                    // 不拷的话它开局就没有, /clear 或交接重开后更是彻底没了。标上来源; 已经是继承来的不再套一层。
+                    ...(inherit ? { memory: (wizards.get(source)?.memory ?? []).map((x) => x.startsWith("(继承自 ") ? x : `(继承自 ${displayName(source)}) ${x}`) } : {}),
+                    tier: pick.tier,
+                    // 显式写 undefined: 复用的冷记录可能当过 lead。
+                    lead: b.lead === true ? true : undefined,
+                    // 生完才清; 这个进程中途没了, 下次开机由 sweepUnborn 认出并收掉。
+                    spawning: BOOT_ID,
+                });
+                const name = wizards.rename(target, normalizeTag(askedName) || tag);
+                const charter = charterFor(target, { ...(detached ? {} : { parent: self }), forkOf, inherited: inherit, cli: pick.cli });
+                const task = (b.task ?? "").toString().trim();
+                // 没点名就按配置的 keepalive.spawnDefault 来 —— 调用方明说的永远优先。
+                const keepalive = typeof b.keepalive === "boolean" ? b.keepalive : cfg.wrc.mirror.keepalive.spawnDefault;
+                // 先盖章再生: 分叉出来的 transcript 里躺着被克隆者的旧回复, 时刻早于这一枚章,
+                // wait_peer 才不会把它们当成分身对这件活的答复。
+                const taskAt = Date.now();
+                const taskTurn = newTurn();
+                const birthGuard = () => (!authority || controlValid(self, authority)) && planBirthAllowed(target, wizards.get(target)?.name ?? name) && (!jobId || jobs.get(jobId)?.status === "open");
+                if (!birthGuard())
+                    return { status: 409, body: { ok: false, reason: "executor reservation changed before spawn" } };
+                const r = await m.cloneSession({
+                    guard: birthGuard,
+                    parent: source,
+                    target,
+                    windowName: name,
+                    cli: pick.cli,
+                    model: pick.model,
+                    effort,
+                    cwd: b.cwd,
+                    systemPrompt: charter,
+                    inherit,
+                    // 继承路径上第一句话是分叉的触发器, 所以直接把活当开场白 —— 少一次往返,
+                    // 也少一次"就位了但没事干"的空转。
+                    // 子 lead 的宪章只有层级规矩, 打法跟第一句的信封走 (同 dispatch 对已有 wizard 的做法)。
+                    bootstrap: task ? task + envelopeFor(self, "", { turn: taskTurn, asker }) + (b.lead === true ? renderReminder({ wezard: "lead" }, renderLeadPlaybook()) : "") : undefined,
+                    ...(task ? { bootstrapFrom: { from: { kind: "peer", from: self, turn: taskTurn, ...(jobId ? { job: jobId } : {}), ...(asker ? { asker } : {}) }, query: task } } : {}),
+                    keepalive,
+                }).catch((e) => ({ ok: false, reason: `spawn threw: ${String(e)}`, inherited: false }));
+                // 生不出来就回滚身份 —— 否则名字被一个永远没有会话的记录占住。
+                if (!r.ok) {
+                    if (existed)
+                        wizards.upsert(target, { spawning: undefined });
+                    else
+                        wizards.drop(target);
+                    return { status: 500, body: { ok: false, reason: r.reason } };
+                }
+                wizards.upsert(target, { spawning: undefined, clonedFrom: r.inherited ? sourceInfo?.sessionId ?? "" : "", ...(r.inherited ? {} : { forkOf: undefined }) });
+                const kid = briefOf(self, target);
+                // 出生不再发群气泡 (人要看的是结论, 不是谁生了谁 —— 过程在 rolepage 里);
+                // 同群的 wizard 仍要知道群里多了一个成员。工单里的临时工连这条也省掉。
+                if (!jobId) {
+                    // 模型 / keepalive 不报: 那是生它的那位的事, 旁人要时 wizard_roster 有。
+                    postRoster(base, [target, self], {
+                        op: "born", name: `.${name}`, by: displayName(self), clone: !detached,
+                        ...(r.inherited ? { ctx: forkOf ? displayName(forkOf) : displayName(self) } : {}),
+                        ...(kid.description ? { job: kid.description } : {}), cwd: r.cwd,
+                    }, subjectOf(wizards.get(target)));
+                }
+                // 继承路径上活已经随开场白进去了, 空白分身才需要在这里补一次注入 (私聊)。
+                let dispatched = r.inherited && !!task;
+                if (task && !r.inherited && birthGuard()) {
+                    const inj = await m.injectText(target, task, undefined, { from: { kind: "peer", from: self, turn: taskTurn, ...(jobId ? { job: jobId } : {}), ...(asker ? { asker } : {}) }, channel: "", envelope: envelopeFor(self, "", { turn: taskTurn, asker }), guard: birthGuard });
+                    dispatched = inj.ok;
+                }
+                if (jobId && birthGuard()) {
+                    const role = roleParam(body.role);
+                    const from = inherit ? source : undefined;
+                    jobs.attach(jobId, { target, task, spawned: true, ...(role ? { role } : {}), ...(from ? { forkOf: from } : {}) });
+                }
+                if (jobId && dispatched)
+                    jobs.spend(jobId);
+                // 分身的第一件活也守回执: fan-out 最常见的形状就是 clone_wizard({task}) × N,
+                // 让它们干完自己把结论送回来, 发起方不必挂在 wait_peer 上。
+                if (dispatched)
+                    receipts.register({ from: self, to: target, channel: "", job: jobId, at: taskAt, turn: taskTurn, ...(k ? { k } : {}), ...(asker ? { asker } : {}) });
+                if (dispatched)
+                    ledger.open({ turn: taskTurn, owner: self, to: target, text: task, at: taskAt, ...(jobId ? { job: jobId } : {}), ...(k ? { for: k } : {}), ...(asker ? { asker } : {}) });
+                return { status: 200, body: { ok: true, target, name, address: name, inherited: r.inherited, sessionId: r.sessionId, cwd: r.cwd, dispatched, ...(dispatched ? { turn: taskTurn } : {}), keepalive, ...(r.model ? { model: r.model } : {}), ...(r.modelWarning ? { modelWarning: r.modelWarning } : {}), ...(r.effort ? { effort: r.effort } : {}), ...(pick.tier ? { tier: pick.tier } : {}), via: pick.via, ...(pick.note ? { tierNote: pick.note } : {}), ...(jobId ? { job: jobId } : {}), ...(detached ? { detached: true } : {}) } };
             }
-            const { target, slot: tag } = slotR;
-            // claimSlot 会复用同名的冷记录 (detached 正是「叫回一个老名字」的场景): 生不出来时
-            // 只回滚这一次的新记录, 不能把那个老 wizard 的记忆和家谱一起删掉。
-            const existed = !!wizards.get(target);
-            const forkOf = inherit && source !== self ? source : undefined;
-            // 先落身份再 spawn: 宪章是从注册表渲染出来的, 记录不在就渲染出一个无名分身。
-            wizards.upsert(target, {
-                description: (b.description ?? "").toString().trim(),
-                // 显式写 undefined: upsert 是合并写, 复用的冷记录里旧的 parent 会留下来。
-                parent: detached ? undefined : self,
-                bornAt: Date.now(),
-                clonedFrom: inherit ? sourceInfo?.sessionId ?? "" : "",
-                ...(forkOf ? { forkOf } : {}),
-                // fork 了上下文就一并继承 self 记忆: 系统提示不随 fork 走 (分身拿的是自己的宪章),
-                // 不拷的话它开局就没有, /clear 或交接重开后更是彻底没了。标上来源; 已经是继承来的不再套一层。
-                ...(inherit ? { memory: (wizards.get(source)?.memory ?? []).map((x) => x.startsWith("(继承自 ") ? x : `(继承自 ${displayName(source)}) ${x}`) } : {}),
-                tier: pick.tier,
-                // 显式写 undefined: 复用的冷记录可能当过 lead。
-                lead: b.lead === true ? true : undefined,
-                // 生完才清; 这个进程中途没了, 下次开机由 sweepUnborn 认出并收掉。
-                spawning: BOOT_ID,
-            });
-            const name = wizards.rename(target, normalizeTag(askedName) || tag);
-            const charter = charterFor(target, { ...(detached ? {} : { parent: self }), forkOf, inherited: inherit, cli: pick.cli });
-            const task = (b.task ?? "").toString().trim();
-            // 没点名就按配置的 keepalive.spawnDefault 来 —— 调用方明说的永远优先。
-            const keepalive = typeof b.keepalive === "boolean" ? b.keepalive : cfg.wrc.mirror.keepalive.spawnDefault;
-            // 先盖章再生: 分叉出来的 transcript 里躺着被克隆者的旧回复, 时刻早于这一枚章,
-            // wait_peer 才不会把它们当成分身对这件活的答复。
-            const taskAt = Date.now();
-            const taskTurn = newTurn();
-            const r = await m.cloneSession({
-                parent: source,
-                target,
-                windowName: name,
-                cli: pick.cli,
-                model: pick.model,
-                effort,
-                cwd: b.cwd,
-                systemPrompt: charter,
-                inherit,
-                // 继承路径上第一句话是分叉的触发器, 所以直接把活当开场白 —— 少一次往返,
-                // 也少一次"就位了但没事干"的空转。
-                // 子 lead 的宪章只有层级规矩, 打法跟第一句的信封走 (同 dispatch 对已有 wizard 的做法)。
-                bootstrap: task ? task + envelopeFor(self, "", { turn: taskTurn, asker }) + (b.lead === true ? renderReminder({ wezard: "lead" }, renderLeadPlaybook()) : "") : undefined,
-                ...(task ? { bootstrapFrom: { from: { kind: "peer", from: self, turn: taskTurn, ...(jobId ? { job: jobId } : {}), ...(asker ? { asker } : {}) }, query: task } } : {}),
-                keepalive,
-            }).catch((e) => ({ ok: false, reason: `spawn threw: ${String(e)}`, inherited: false }));
-            // 生不出来就回滚身份 —— 否则名字被一个永远没有会话的记录占住。
-            if (!r.ok) {
-                if (existed)
-                    wizards.upsert(target, { spawning: undefined });
-                else
-                    wizards.drop(target);
-                return { status: 500, body: { ok: false, reason: r.reason } };
-            }
-            wizards.upsert(target, { spawning: undefined, clonedFrom: r.inherited ? sourceInfo?.sessionId ?? "" : "", ...(r.inherited ? {} : { forkOf: undefined }) });
-            const kid = briefOf(self, target);
-            // 出生不再发群气泡 (人要看的是结论, 不是谁生了谁 —— 过程在 rolepage 里);
-            // 同群的 wizard 仍要知道群里多了一个成员。工单里的临时工连这条也省掉。
-            if (!jobId) {
-                // 模型 / keepalive 不报: 那是生它的那位的事, 旁人要时 wizard_roster 有。
-                postRoster(base, [target, self], {
-                    op: "born", name: `.${name}`, by: displayName(self), clone: !detached,
-                    ...(r.inherited ? { ctx: forkOf ? displayName(forkOf) : displayName(self) } : {}),
-                    ...(kid.description ? { job: kid.description } : {}), cwd: r.cwd,
-                }, subjectOf(wizards.get(target)));
-            }
-            // 继承路径上活已经随开场白进去了, 空白分身才需要在这里补一次注入 (私聊)。
-            let dispatched = r.inherited && !!task;
-            if (task && !r.inherited) {
-                const inj = await m.injectText(target, task, undefined, { from: { kind: "peer", from: self, turn: taskTurn, ...(jobId ? { job: jobId } : {}), ...(asker ? { asker } : {}) }, channel: "", envelope: envelopeFor(self, "", { turn: taskTurn, asker }) });
-                dispatched = inj.ok;
+            finally {
+                if (birthJob) {
+                    const remaining = (pendingBirthJobs.get(birthJob) ?? 1) - 1;
+                    if (remaining)
+                        pendingBirthJobs.set(birthJob, remaining);
+                    else
+                        pendingBirthJobs.delete(birthJob);
+                }
             }
-            if (jobId) {
-                const role = roleParam(body.role);
-                const from = inherit ? source : undefined;
-                jobs.attach(jobId, { target, task, spawned: true, ...(role ? { role } : {}), ...(from ? { forkOf: from } : {}) });
-            }
-            if (jobId && dispatched)
-                jobs.spend(jobId);
-            // 分身的第一件活也守回执: fan-out 最常见的形状就是 clone_wizard({task}) × N,
-            // 让它们干完自己把结论送回来, 发起方不必挂在 wait_peer 上。
-            if (dispatched)
-                receipts.register({ from: self, to: target, channel: "", job: jobId, at: taskAt, turn: taskTurn, ...(k ? { k } : {}), ...(asker ? { asker } : {}) });
-            if (dispatched)
-                ledger.open({ turn: taskTurn, owner: self, to: target, text: task, at: taskAt, ...(jobId ? { job: jobId } : {}), ...(k ? { for: k } : {}), ...(asker ? { asker } : {}) });
-            return { status: 200, body: { ok: true, target, name, address: name, inherited: r.inherited, sessionId: r.sessionId, cwd: r.cwd, dispatched, ...(dispatched ? { turn: taskTurn } : {}), keepalive, ...(r.model ? { model: r.model } : {}), ...(r.modelWarning ? { modelWarning: r.modelWarning } : {}), ...(r.effort ? { effort: r.effort } : {}), ...(pick.tier ? { tier: pick.tier } : {}), via: pick.via, ...(pick.note ? { tierNote: pick.note } : {}), ...(jobId ? { job: jobId } : {}), ...(detached ? { detached: true } : {}) } };
         };
+        const planRunner = createWorkflowPlanRunner(planStore, {
+            job: jobs.get, attempt: workflow.byTurn, prereq: workflow.prereq,
+            spawn: (run, node, state, permit) => bearAs(run.owner, {
+                inherit: false, name: state.name, description: node.criteria || `workflow node ${node.id}`,
+                tier: node.tier, cwd: run.plan.cwd, job: run.plan.job, keepalive: false,
+            }, permit),
+            tell: (run, node, state, after, permit) => tellPeerAs(run.owner, {
+                name: state.name, text: node.task + (node.criteria ? `\n\n验收标准: ${node.criteria}` : ""),
+                node: node.id, job: run.plan.job, ...(after.length ? { after } : {}),
+            }, "", undefined, permit),
+            cancel: (run) => {
+                workflow.cancel(undefined, run.owner, run.plan.job);
+                run.nodes.filter((n) => n.to).forEach((n) => receipts.cancel(n.to, run.owner, (x) => x.from === run.owner && x.turn === n.turn));
+                receipts.cancelHeld(run.plan.job, run.owner);
+            },
+            error: (e) => log.error({ err: errText(e) }, "workflow plan advancement paused"),
+        });
+        advancePlans = planRunner.kick;
+        registerWorkflowPlanRoutes(http, {
+            read: readPeerBody, store: planStore, runner: planRunner,
+            job: jobs.get, attempts: workflow.list,
+            occupied: (self, job) => pendingBirthJobs.has(job) || receipts.states().some((s) => s.from === self && s.job === job),
+            origin: (self) => { const k = parentKOf(self); return { ...(k ? { k } : {}), ...(askerOf(self) ? { asker: askerOf(self) } : {}), chain: receipts.ancestorsOf(self, k) }; },
+            direction: (self, jobId, origin) => checkDirection({ self, target: "", kind: "task", re: false, jobId, jobs: jobs.all(), chain: origin.chain, nameOf: displayName }),
+        });
+        void m.restored.then(planRunner.start);
         http.register("POST /wizard/clone", async (req, res) => {
             const { self, body } = await readPeerBody(req);
             if (!self) {
@@ -2702,6 +3247,11 @@ const main = async () => {
                 json(res, 400, { ok: false, reason: "cannot resolve caller session" });
                 return;
             }
+            const authority = controlSnapshot(self);
+            if (!controlValid(self, authority)) {
+                json(res, 409, { ok: false, reason: "本轮回答权和控制权已移交或失效；不能打断或结束目标 wizard" });
+                return;
+            }
             const b = body;
             const r = resolvePeer(self, addrOf(b));
             // 有身份没会话 (冷记录 / 生到一半的僵尸): resolvePeer 够不着它, 但收它不需要
@@ -2709,6 +3259,11 @@ const main = async () => {
             const found = r.ok || r.candidates?.length ? undefined : ((w) => (w && sameBot(self, w.target) ? w : undefined))(wizards.byName(addrOf(b)));
             const cold = found && !m.chatTargets(baseOfKey(found.target)).includes(found.target) ? found : undefined;
             if (cold && (b.mode ?? "end") === "end") {
+                if (!controlValid(self, authority)) {
+                    json(res, 409, { ok: false, reason: "本轮控制权已变化；拒绝结束目标 wizard" });
+                    return;
+                }
+                workflow.cancel(cold.target);
                 const detached = b.forget ? forgetWizard(cold.target) : [];
                 json(res, 200, { ok: true, target: cold.target, name: cold.name, mode: "end", forgotten: !!b.forget, note: "它本来就没有会话在跑", ...(detached.length ? { canceledIn: detached } : {}) });
                 return;
@@ -2731,19 +3286,27 @@ const main = async () => {
             const turn = (b.turn ?? "").replace(/[`\s]/g, "");
             if (!end && turn) {
                 const mine = receipts.pending(self, target);
-                if (mine?.turn !== turn) {
+                if (mine?.turn !== turn && workflow.byTurn(self, turn)?.to !== target && !receipts.states().some((s) => s.from === self && s.to === target && s.turn === turn && s.state === "queued")) {
                     json(res, 404, { ok: false, reason: `你没有在等 ${victim.name ? `.${victim.name}` : target} 答 '${turn}' 这件 (已落定、件号写错, 或不是你派的)` });
                     return;
                 }
                 // 先落 canceled 再按 Esc: 被打断那一轮的半截话不该被 watcher 当成答案投回来。
                 const busy = !(await m.idleNow(target));
-                const canceled = receipts.cancel(target, self, (x) => x.from === self && x.turn === turn);
+                if (!controlValid(self, authority)) {
+                    json(res, 409, { ok: false, reason: "等待期间本轮控制权已变化；未撤回或打断目标" });
+                    return;
+                }
+                const canceled = cancelPeerWork(target, self, (x) => x.from === self && x.turn === turn);
                 // 按 Esc 之前再认一次手上这一轮: 上面那次 await 期间它可能已经做完这件、接了别人的下一件。
                 const current = busy && openingAsk(target)?.turn === turn;
                 // 还没轮到 / 排在后面: 捎一句给它, 轮到那句话时别再做了 (notices 挂在下一条注入的尾巴上)。
                 if (!current)
                     notices.post([target], `${displayName(self)} 撤回了它派给你的 ${turn} —— 那件活不用做了; 读到它时直接略过, 不必回复。`);
                 // 只按 Esc, 不 teardown: teardown 会清掉它的注入队列, 别人排着的话一起丢。
+                if (current && !controlValid(self, authority)) {
+                    json(res, 409, { ok: false, reason: "物理操作前本轮控制权已变化；已登记撤回但未发送 Esc" });
+                    return;
+                }
                 const esc = current ? await m.interruptPane(target) : undefined;
                 // Esc 没按成也不回滚撤回: 这件已经不等了, 只是它手上那一轮还在跑 —— 如实说。
                 json(res, 200, {
@@ -2755,13 +3318,26 @@ const main = async () => {
             }
             // 不带件号的打断会停掉它手上整轮: 那一轮若是别的 wizard 派的, 先拒 —— 误伤的是别人的活。
             const others = !end && !b.force ? await othersTurn(target, self) : undefined;
+            if (!controlValid(self, authority)) {
+                json(res, 409, { ok: false, reason: "等待期间本轮控制权已变化；未取消或打断目标" });
+                return;
+            }
             if (others) {
                 json(res, 409, { ok: false, target, reason: `它此刻在做 ${others.from} 派的活${others.turn ? ` (${others.turn})` : ""}, 打断会连那件一起停掉 —— 只想撤回你自己派的那件, 传 turn (件号); 确要打断它这一轮, 加 force:true` });
                 return;
             }
             // 先落 canceled 再动 pane: pane 一死, 守着的 watcher 会把同一份报成 dead。
             // 打断只停它手上这一轮: 只掐这一轮开头那句派来的活 (人 / 定时 / 回执轮不掐任何一份)。
-            const canceled = receipts.cancel(target, self, end ? undefined : currentAsk(target));
+            const only = end ? undefined : currentAsk(target);
+            if (!controlValid(self, authority)) {
+                json(res, 409, { ok: false, reason: "物理操作前本轮控制权已变化；未取消或打断目标" });
+                return;
+            }
+            const canceled = cancelPeerWork(target, self, only);
+            if (!controlValid(self, authority)) {
+                json(res, 409, { ok: false, reason: "物理操作前本轮控制权已变化；未打断或结束目标" });
+                return;
+            }
             const done = end ? await m.killPane(target) : await m.interruptPane(target, { teardown: true });
             if (!done.ok) {
                 json(res, 502, { ok: false, target, reason: done.reason });
@@ -2933,6 +3509,8 @@ const main = async () => {
             const closeOne = async (j, summary, mark) => {
                 const sids = new Map([j.owner, ...j.members.map((mm) => mm.target)].map((t) => [t, m.sessionInfo(t)?.sessionId ?? ""]));
                 // 取消: 还没落定的成员手上这张单派的活记成 canceled, 发起者不会再收到一串回执。
+                planRunner.cancelJob(j.owner, j.id);
+                workflow.cancel(undefined, j.owner, j.id);
                 if (how === "cancel")
                     j.members.filter((mm) => !mm.outcome).forEach((mm) => receipts.cancel(mm.target, j.owner, (x) => x.from === j.owner));
                 // 这张单名下还排着没投的 (after 停放) 也不投了。
@@ -3390,6 +3968,11 @@ const main = async () => {
                 json(res, 400, { ok: false, reason: `node.tag \`${xnode.tag}\` 不是一个合法的 tag` });
                 return;
             }
+            const allowed = (target, name) => planStore.allowExternal(target, name) && planStore.allowExternal(target, wizards.get(target)?.name);
+            if (spec.nodes.some((n) => !allowed(keyOf(spec.base, n.tag), n.tag))) {
+                json(res, 409, { ok: false, reason: "workflow plan reserves a graph executor" });
+                return;
+            }
             const graphLog = log.child({ mod: "graph", base: spec.base });
             // 每一步、每条进度都在发起这次 run 的那一轮的频道里: 人在群里叫它发起的才进群,
             // 私聊轮里发起的整场只进 rolepage —— 步骤不带频道就等于在节点的 home 群里开口。
@@ -3399,16 +3982,27 @@ const main = async () => {
                 // (or its pane died). Re-spawning a healthy node would throw away the
                 // context that makes a multi-round loop worth running.
                 ensureNode: async (target, node) => {
+                    if (!allowed(target, node.tag))
+                        return { ok: false, reason: "workflow plan reserves this executor" };
                     const existing = (await m.peers(target)).find((p) => p.target === target);
+                    if (!allowed(target, node.tag))
+                        return { ok: false, reason: "workflow plan reserves this executor" };
                     if (existing?.paneAlive)
                         return { ok: true };
                     // No broadcast plumbing needed: a `base#tag` target strips down to the
                     // same WeCom chatid as `base`, so the node's own pushes already land
                     // in this chat — mirroring them again was pure duplication.
-                    const r = await m.newSession(target, node.tag, node.cli, { model: node.model, cwd: node.cwd, silent: true });
+                    const r = await m.newSession(target, node.tag, node.cli, { model: node.model, cwd: node.cwd, silent: true, guard: () => allowed(target, node.tag) });
                     return { ok: r.ok, reason: r.reason };
                 },
-                send: async (target, text, origin) => (await handedOff(target), m.injectText(target, text, origin, { channel })),
+                send: async (target, text, origin) => {
+                    if (!allowed(target))
+                        return { ok: false, reason: "workflow plan reserves this executor" };
+                    await handedOff(target);
+                    if (!allowed(target))
+                        return { ok: false, reason: "workflow plan reserves this executor" };
+                    return m.injectText(target, text, origin, { channel, guard: () => allowed(target) });
+                },
                 isBusy: m.isBusy,
                 lastText: async (target) => m.lastText(target),
                 notify: (_base, markdown) => { if (channel)
@@ -3473,50 +4067,37 @@ const main = async () => {
         // 还要连触发时间点一起被它那一轮拖走。所以到点起一个白板 wizard 单独执行,
         // 跑完自动收掉。只有排班时点名了某个 wizard (fresh=false) 且它此刻闲着,
         // 才把这句话直接投进它那一轮 —— 「在已有会话里继续」是要求出来的, 不是默认。
-        scheduledTaskInject = async (target, text, { taskId, fresh, quiet }) => {
-            // 日程文件是可手改的源码: target 与排班者不同机器人就不放枪 (schedule_task 那头已拦, 这里拦手改的)。
+        scheduledTaskInject = async (target, text, opts) => {
+            const { taskId, fresh, quiet } = opts;
             const owner = ((r) => (r ? ownerOf(r) : target))(tasks.get(taskId));
             if (!sameBot(owner, target))
                 return { ok: false, reason: `日程 ${taskId} 的目标与排班者归不同的企微机器人, 不跨机器人放枪` };
-            // 安静任务私下跑 (channel ""): 镜像不推它的任何一句, 终句由 relayUnlessQuiet 判断要不要进群。
-            const inNamed = async () => {
-                const at = Date.now();
-                const turn = newTurn();
-                const inj = await m.injectText(target, text, undefined, quiet
-                    ? { from: { kind: "task", taskId }, channel: "", envelope: renderTaskEnvelope(taskId, { turn }) }
-                    : { fromChat: true, from: { kind: "task", taskId }, envelope: renderTaskEnvelope(taskId) });
-                if (inj.ok && quiet)
-                    void relayUnlessQuiet(target, at, turn, baseOfKey(target));
-                return inj;
-            };
-            if (!fresh)
-                await handedOff(target); // 交接中途 pane 是空的, 别当成闲着投进去
-            const busy = fresh ? false : await m.isBusy(target);
-            if (!fresh && !busy)
-                return inNamed();
-            // 点名的目标正忙: 顺延到它这一轮结束再投 (与 tell_peer 默认的 normal 同一口径) ——
-            // 「在它那儿继续」是排班时要求的, 不该因为撞上它在干活就换成白板。后台等, 别拖住
-            // 调度器的其它任务; 等满 30 分钟仍忙才退回起白板。
-            const inRunner = (wasBusy) => runTaskInRunner(target, text, taskId, quiet, wasBusy);
-            if (!fresh && busy) {
-                // 同一条任务已有一枪在等这个目标: 这一枪并进去 —— 等它闲下来时几枪一起投, 会挤进同一个输入框。
-                if (postponed.has(taskId))
-                    return { ok: true, reason: "上一枪还在等它闲下来, 这一枪并入" };
-                postponed.add(taskId);
-                void (async () => {
-                    const wr = await m.untilIdle(target, TASK_POSTPONE_MS);
-                    postponed.delete(taskId);
-                    const r = wr.idle ? await inNamed() : await inRunner(true);
-                    log.info({ taskId, target, postponed: true, idle: wr.idle, ok: r.ok, reason: r.reason }, "scheduled task: 目标正忙, 顺延");
-                    if (!r.ok)
-                        notifyChat(baseOfKey(target), withTagHeader(target, `⏰ 定时任务 \`${taskId}\` 顺延后注入失败: ${r.reason ?? "unknown"}`));
-                })();
-                return { ok: true, reason: "目标正忙, 顺延到它闲下来" };
-            }
-            return inRunner(busy);
-        };
-        /** 顺延中的任务 (内存即可: reload 丢了只是少放一枪, 下一次到点照常)。 */
-        const postponed = new Set();
+            const allowed = () => opts.guard() && planStore.allowExternal(target, wizards.get(target)?.name);
+            return deliverScheduled({ ...opts, guard: () => opts.guard() && (fresh || allowed()) }, {
+                postponeMs: TASK_POSTPONE_MS,
+                handedOff: () => handedOff(target),
+                idleNow: () => m.idleNow(target),
+                untilIdle: (timeoutMs, aborted) => m.untilIdle(target, timeoutMs, { aborted }),
+                named: async (live) => {
+                    const guard = () => live() && allowed();
+                    if (!guard())
+                        return { ok: false, reason: "scheduled target permission withdrawn" };
+                    const at = Date.now();
+                    const turn = newTurn();
+                    // Confirm idle inside the physical pane transaction; a race is unsent
+                    // and returns to the target consumer, without releasing task dedup.
+                    const inj = await m.injectText(target, text, undefined, quiet
+                        ? { guard, requireIdle: true, from: { kind: "task", taskId }, channel: "", envelope: renderTaskEnvelope(taskId, { turn }) }
+                        : { guard, requireIdle: true, fromChat: true, from: { kind: "task", taskId }, envelope: renderTaskEnvelope(taskId) });
+                    if (inj.ok && quiet)
+                        void relayUnlessQuiet(target, at, turn, baseOfKey(target));
+                    return inj;
+                },
+                runner: (busy, live) => !fresh && !allowed()
+                    ? Promise.resolve({ ok: false, reason: "scheduled target permission withdrawn" })
+                    : runTaskInRunner(target, text, taskId, quiet, busy, live),
+            });
+        };
         /** 安静任务那一轮的终句: 它私下跑, 镜像不推; 等它这一轮跑完, 终句不是 `QUIET` 就替它
          *  发进群 (头写它的名字, 人知道是谁说的)。按信封件号定位答句 (同回执): 按时刻取会把紧随
          *  其后的私聊 / 人话那一轮的答案当成它的, 把私下内容发进群。 */
@@ -3544,7 +4125,9 @@ const main = async () => {
         const quietRelays = loadJsonMap(join(cfg.daemon.stateDir, "quiet-relays.json"), (rows) => Object.fromEntries(Object.entries(rows).filter(([, r]) => Date.now() - r.at < TASK_QUIET_WAIT_MS)));
         void m.restored.then(() => Object.entries(quietRelays.all()).forEach(([turn, r]) => void relayUnlessQuiet(r.target, r.at, turn, r.base)));
         /** 到点起一个白板 wizard 执行这一枪, 跑完自动收掉。 */
-        const runTaskInRunner = async (target, text, taskId, quiet, busy) => {
+        const runTaskInRunner = async (target, text, taskId, quiet, busy, guard) => {
+            if (!guard())
+                return { ok: false, reason: "scheduled runner withdrawn" };
             // 执行体挂在日程的主人名下: 名字 `<主人>-task-xxxx`, parent = 主人 —— 它的
             // rolepage 里看得见这一枪是谁的日程放的。落在执行目标的群/目录里。
             const base = baseOfKey(target);
@@ -3552,9 +4135,14 @@ const main = async () => {
             const owner = rec ? ownerOf(rec) : target;
             const ownerName = settleName(wizards, chatNameOf(cfg, owner), owner) || "task";
             const slotR = await claimSlot(base, "", `${ownerName}-task-${taskId.slice(0, 4)}`);
+            if (!guard())
+                return { ok: false, reason: "scheduled runner withdrawn during slot selection" };
             if (!slotR.ok)
                 return { ok: false, reason: "起白板 wizard 失败: 挑不出槽位" };
             const runner = slotR.target;
+            const allowed = () => guard() && planStore.allowExternal(runner, wizards.get(runner)?.name);
+            if (!allowed())
+                return { ok: false, reason: "workflow plan reserves task runner" };
             const info = m.sessionInfo(target);
             const why = busy ? ` (起因: ${displayName(target)} 当时正忙)` : "";
             wizards.upsert(runner, {
@@ -3564,11 +4152,18 @@ const main = async () => {
                 bornAt: Date.now(),
             });
             const runnerName = wizards.rename(runner, `${ownerName}-task-${taskId.slice(0, 4)}`);
-            const spawned = await m.newSession(runner, runnerName, info?.cli, { cwd: info?.cwd, model: info?.model, silent: true });
+            const spawned = await m.newSession(runner, runnerName, info?.cli, { cwd: info?.cwd, model: info?.model, silent: true, guard: allowed });
             if (!spawned.ok) {
                 wizards.drop(runner);
                 return { ok: false, reason: `起白板 wizard 失败: ${spawned.reason ?? "unknown"}` };
             }
+            if (!allowed()) {
+                if (m.sessionInfo(runner)?.sessionId === spawned.sessionId) {
+                    await m.killPane(runner);
+                    wizards.drop(runner);
+                }
+                return { ok: false, reason: "scheduled runner withdrawn after spawn" };
+            }
             if (!quiet) {
                 notifyChat(base, withTagHeader(target, busy
                     ? `⏰ 定时任务到点时正忙, 已起白板 wizard .${runnerName} 单独执行, 完成后自动收掉`
@@ -3577,8 +4172,8 @@ const main = async () => {
             const at = Date.now();
             const turn = newTurn();
             const inj = await m.injectText(runner, text, undefined, quiet
-                ? { from: { kind: "task", taskId }, channel: "", envelope: renderTaskEnvelope(taskId, { turn }) }
-                : { fromChat: true, from: { kind: "task", taskId }, envelope: renderTaskEnvelope(taskId) });
+                ? { guard: allowed, from: { kind: "task", taskId }, channel: "", envelope: renderTaskEnvelope(taskId, { turn }) }
+                : { guard: allowed, fromChat: true, from: { kind: "task", taskId }, envelope: renderTaskEnvelope(taskId) });
             if (!inj.ok) {
                 wizards.drop(runner);
                 return inj;
@@ -3687,7 +4282,7 @@ const main = async () => {
         const sweep = async () => {
             const taskOwners = new Set(tasks.list()
                 .filter((t) => t.enabled)
-                .map((t) => wizardStore()?.byName(t.owner)?.target)
+                .map((t) => wizardStore()?.get(t.owner)?.target ?? wizardStore()?.byName(t.owner)?.target)
                 .filter((t) => !!t));
             const pendingSids = new Set(listPending().map((p) => p.meta.sessionId).filter((s) => !!s));
             const r = await bridge.reapOverflow(max, (target, sid) => taskOwners.has(target) ? "owns scheduled task"
@@ -3709,6 +4304,7 @@ const main = async () => {
     }
     const shutdown = async (signal) => {
         log.info({ signal }, "shutdown signal");
+        stopReceipts();
         scheduler.stop();
         steward?.stop();
         tasks.stop();
@@ -3724,6 +4320,10 @@ const main = async () => {
         await Promise.allSettled([ws.shutdown(), http.close()]);
         process.exit(0);
     };
+    http.register("POST /shutdown", (_req, res) => {
+        json(res, 200, { ok: true });
+        return shutdown("HTTP");
+    });
     process.on("SIGINT", () => void shutdown("SIGINT"));
     process.on("SIGTERM", () => void shutdown("SIGTERM"));
     try {