wezard 2.6.2 → 2.6.3

package/dist/daemon/mirror-bridge.js

@@ -24,6 +24,9 @@ import { newStewardSpec, resumedStewardSpec } from "./steward-model.js";
 import { expandHome, sanitizeId } from "../shared/paths.js";
 import { augmentedPath } from "../shared/exec-path.js";
 import { sleep, truncateWithCount, mapLimit } from "../shared/std.js";
+import { withImageClipboard, pasteVerifiedImage } from "./image-input.js";
+import { createKeyedScheduler } from "../shared/keyed-scheduler.js";
+import { withPaneInput } from "./pane-input.js";
 import { activeBackends, resolveCliBackend, backendForPath, projectDirFor, projectDirsFor, } from "../shared/cli-backends.js";
 import { isModalPane, isAskqSubmitPage, parseModalOptions, pickModalAnswer, pickAutoAllowAnswer, parseConfirmContext, modalFingerprint, looksLikePicker } from "../shared/modal-pane.js";
 import { hasMirrorAskq, runMirrorAskqFlow, hasMirrorPlan, mootMirrorPlan, runMirrorPlanFlow, hasMirrorPicker, mootMirrorPicker, runMirrorPickerFlow } from "./approval.js";
@@ -42,7 +45,6 @@ import { errText } from "./last-response.js";
 import { labelFor, tagOfKey, baseOfKey, keyOf, stripSigil, displayName, withTagHeader, withLinkedTagHeader, chatHead, headed, tagBadge, linkTags, parseTagHeader, MAX_BODY_LINKS, isInternalKey, sameBot } from "../shared/session-label.js";
 import { splitMarkdown } from "../shared/md-chunk.js";
 import { isWxFrame } from "../shared/wx-text.js";
-import { randomTip } from "./tips.js";
 import { chatBaseOf, chatNameOf, listChatNames, parsePeerRef, peerAddress } from "./chat-name.js";
 import { stripAnsi, paneIsBusy, summarizeTail, lastAssistantText, lastReply, replyToPeer as replyToPeerIn, unwrapPasted, lastContextTokens, lastModel, cacheTouchMs, cacheTtlSec, keepaliveStamps, openKeepalivePing, lastUserTurn, talkRounds, openToolUses, renderDialog } from "./peers.js";
 import { keepalivePingSigs, isKeepalivePingText } from "../shared/keepalive.js";
@@ -1159,10 +1161,10 @@ const detectModalPicker = async (target) => {
 const MODAL_PRESS_SETTLE_MS = 400;
 const MODAL_ARROW_SETTLE_MS = 150;
 const highlightedIndex = (screen) => parseModalOptions(screen).find((o) => o.selected)?.index;
-const pressModalIndex = async (pane, before, index) => {
+const pressModalIndex = async (pane, before, index, live = () => true) => {
     const fingerprint = modalFingerprint(before.screen);
     const current = await detectModalPicker(pane);
-    if (!current.modal || modalFingerprint(current.screen) !== fingerprint)
+    if (!live() || !current.modal || modalFingerprint(current.screen) !== fingerprint)
         return current;
     await runTmux(["send-keys", "-t", pane, String(index)]);
     await sleep(MODAL_PRESS_SETTLE_MS);
@@ -1171,6 +1173,8 @@ const pressModalIndex = async (pane, before, index) => {
         return after;
     // 数字键没关掉框: 把高亮挪到目标项。guard 上限盖过任何确认框的选项数。
     for (let guard = 0; guard < 8; guard++) {
+        if (!live())
+            return after;
         const cur = highlightedIndex(after.screen);
         if (cur === undefined || cur === index)
             break;
@@ -1180,7 +1184,7 @@ const pressModalIndex = async (pane, before, index) => {
         if (!after.modal || modalFingerprint(after.screen) !== fingerprint)
             return after;
     }
-    if (highlightedIndex(after.screen) !== index)
+    if (!live() || highlightedIndex(after.screen) !== index)
         return after; // 核不准, 绝不盲按
     await runTmux(["send-keys", "-t", pane, "Enter"]);
     await sleep(MODAL_PRESS_SETTLE_MS);
@@ -1301,7 +1305,7 @@ export const parseInputBox = (cap, styledLayout = cap) => {
         layout.pop();
     const footer = layout.length - 1;
     // Codex hides the shortcuts row while the composer contains text.
-    const shortcuts = /\? for shortcuts\s*$/u.test(layout[footer] ?? "");
+    const shortcuts = /(?:^|\s)\? for shortcuts(?:\s|$)/u.test(layout[footer] ?? "");
     if (shortcuts || (layout[footer] ?? "").includes("·")) {
         let status = shortcuts ? footer - 1 : footer;
         while (status >= 0 && !layout[status].trim())
@@ -1433,7 +1437,7 @@ const witnessFor = (target, homeDir, jsonlPath, live) => {
 // but the trailing Enter is eaten while the TUI is still initializing, so
 // the prompt sits typed-but-unsent. 校验策略见 injectViaTmuxText —— 以输入框
 // 整块为判据, 粘贴只在「确凿看见框仍是空的」时才重来。
-const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jsonlPath, bypassModalGuard = false) => {
+const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jsonlPath, bypassModalGuard = false, guard) => {
     const backendName = backend.name;
     log.info({ target, len: text.length, images: images.length, freshSpawn, backendName }, "mirror inject (tmux)");
     // 就绪门: pane 里得真有一个进入了交互态的 AI 会话, 才轮得到贴。先于 modal guard ——
@@ -1474,33 +1478,53 @@ const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jso
     // dispatch 已对 codebuddy 把 refs 合进 text (images 传空), 这里的
     // withImageRefs 是其它调用方直传 images 时的兜底 —— 幂等, 不会贴两份。
     if (backendName === "codebuddy") {
-        return injectViaTmuxText(target, withImageRefs(text, images), log, freshSpawn, witness);
+        return injectViaTmuxText(target, withImageRefs(text, images), log, freshSpawn, witness, guard);
     }
     // Pump images first via clipboard+C-v so each one is attached as a separate
     // image content block. Each C-v needs a brief settle for Claude Code's TUI
     // to read the clipboard before the next overwrite. Fresh spawn extends.
     const IMG_SETTLE_MS = freshSpawn ? 700 : 350;
-    for (const imgPath of images) {
-        const cb = await setMacClipboardImage(imgPath);
-        if (!cb.ok) {
-            log.warn({ imgPath, reason: cb.reason }, "mirror inject: clipboard set failed, skipping image");
-            continue;
+    const pumped = images.length ? await withImageClipboard(async () => {
+        for (const imgPath of images) {
+            const paste = async () => {
+                const cb = await setMacClipboardImage(imgPath);
+                if (!cb.ok)
+                    return cb;
+                if (guard && !guard("paste"))
+                    return { ok: false, reason: "image paste canceled by dispatch guard" };
+                const cv = await runTmux(["send-keys", "-t", target, "C-v"]);
+                return cv.ok ? { ok: true } : { ok: false, reason: `tmux send-keys C-v failed: ${cv.stderr.slice(-200)}` };
+            };
+            // Cold Codex can ignore C-v before its composer exists. Do not submit
+            // the text until the composer proves this attachment has landed.
+            const result = backendName === "codex"
+                ? await pasteVerifiedImage({ read: () => readInputBox(target), paste, valid: () => !guard || guard("paste") })
+                : await paste();
+            if (!result.ok) {
+                log.warn({ target, imgPath, reason: result.reason }, "mirror inject: image not confirmed, refusing text submission");
+                return result;
+            }
+            // Attachment rendering can precede the TUI finishing its paste handler.
+            // Preserve the key settle interval before another C-v or text paste.
+            await sleep(IMG_SETTLE_MS);
+            log.info({ target, imgPath, verified: backendName === "codex" }, "mirror inject: image attached");
         }
-        const cv = await runTmux(["send-keys", "-t", target, "C-v"]);
-        if (!cv.ok)
-            return { ok: false, reason: `tmux send-keys C-v failed: ${cv.stderr.slice(-200)}` };
-        await sleep(IMG_SETTLE_MS);
-    }
+        return { ok: true };
+    }) : { ok: true };
+    if (!pumped.ok)
+        return { ...pumped, uncertain: true };
     // Image-only message: TUI input box now holds the attached images; press
     // Enter and we're done. No fingerprint to verify (the input itself is binary
     // image refs, not text).
     if (!text) {
         if (images.length === 0)
             return { ok: true };
+        if (guard && !guard("submit"))
+            return { ok: false, reason: "submit canceled by dispatch guard" };
         const e = await runTmux(["send-keys", "-t", target, "Enter"]);
         return e.ok ? { ok: true } : { ok: false, reason: `tmux send-keys Enter failed: ${e.stderr.slice(-200)}` };
     }
-    return injectViaTmuxText(target, text, log, freshSpawn, witness);
+    return injectViaTmuxText(target, text, log, freshSpawn, witness, guard);
 };
 // 图片以 @<path> 文本提及的形式进会话 (codebuddy 的 tmux 路径、一切 spawn 路径)。
 // 提升为共享 helper: dispatch 侧的印章 / 回显去重 / turn 记录必须拿到与 inject
@@ -1522,7 +1546,7 @@ const withImageRefs = (text, images) => {
 // 证人不作声 (忙时排队、slash 命令、无注册表的后端) 才看框回没回到贴之前的样子。
 // 框认得出来时这条判据可信, 于是允许多补回车 (空框上的回车在 CLI 里是 no-op);
 // 每次补之前再问一遍证人, 已提交就不补。
-const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WITNESS) => {
+const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WITNESS, guard) => {
     // Warm pane: tight timings, low latency. Fresh spawn (claude --resume just
     // started, transcript still loading): extended timings — bracketed-paste
     // end can take 4-7s to be honored on a cold TUI. Only the fresh-spawn path
@@ -1559,7 +1583,7 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     const baseBody = alreadyTyped ? "" : preBox.body;
     /** 框里还是贴之前那样 (或彻底空了) = 我们的文本不在框里。 */
     const boxIntact = (b) => boxVerify && b.known && (b.body === "" || b.body === baseBody);
-    const loadAndPaste = () => pasteTmuxBuffer(target, text);
+    const loadAndPaste = () => pasteTmuxBuffer(target, text, guard ? () => guard("paste") : undefined);
     // 框认得出来 → 看它变没变; 认不出来 → 退回宽窗口找 headFp (长文本会换行,
     // 头部可能在框顶, 所以窗口要宽)。
     const sawLanded = async (timeoutMs) => {
@@ -1583,6 +1607,9 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     let pasteSeen = alreadyTyped;
     let pastedAt = Date.now();
     if (alreadyTyped) {
+        // Existing text is already exposed, even if permission was just withdrawn.
+        if (guard && !guard("paste"))
+            return { ok: false, uncertain: true, reason: "existing input submission canceled by dispatch guard" };
         log.warn({ target, headFp }, "mirror inject: 输入框里已有这段文本 (上次未提交) — 不重贴, 直接提交");
     }
     else {
@@ -1647,6 +1674,8 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
             await sleep(Math.max(0, POST_PASTE_SETTLE_FALLBACK_MS - (Date.now() - pastedAt)));
     }
     const sendEnter = async () => {
+        if (guard && !guard("submit"))
+            return { ok: false, reason: "submit canceled by dispatch guard" };
         const e = await runTmux(["send-keys", "-t", target, "Enter"]);
         return e.ok ? { ok: true } : { ok: false, reason: `tmux send-keys failed: ${e.stderr.slice(-200)}` };
     };
@@ -1749,6 +1778,8 @@ const injectViaSpawn = async (args) => {
         ...cfg.wrc.extraArgs,
     ];
     log.info({ sessionId, bin, len: text.length }, "mirror inject");
+    if (args.guard && !args.guard("submit"))
+        return { ok: false, reason: "spawn canceled by dispatch guard" };
     return new Promise((resolve) => {
         const proc = spawn(bin, cliArgs, {
             cwd,
@@ -1778,11 +1809,57 @@ const injectViaSpawn = async (args) => {
         });
     });
 };
-const inject = (args) => {
+const inject = async (args) => {
     const target = (args.tmuxTarget ?? "").trim();
-    if (!target)
-        return injectViaSpawn(args);
-    return injectViaTmux(target, args.text, args.images ?? [], args.log, args.freshSpawn ?? false, backendForPath(args.jsonlPath), args.jsonlPath, args.bypassModalGuard ?? false);
+    if (!target) {
+        if (args.requireIdle)
+            return { ok: false, retryable: true, reason: "idle delivery requires a live pane" };
+        try {
+            if (args.guard && !args.guard())
+                return { ok: false, retryable: true, reason: "spawn permission withdrawn" };
+            const text = args.prepareText?.() ?? args.text;
+            let activated = false;
+            const result = await injectViaSpawn({ ...args, text, guard: (phase) => {
+                    if (args.guard && !args.guard(phase))
+                        return false;
+                    if (phase && !activated) {
+                        activated = true;
+                        args.beforeInput?.();
+                    }
+                    return true;
+                } });
+            return result.ok ? result : { ...result, uncertain: true };
+        }
+        catch (error) {
+            return { ok: false, uncertain: true, reason: String(error) };
+        }
+    }
+    let exposed = false;
+    const classify = (result) => result.ok ? result
+        : result.uncertain || exposed ? { ...result, uncertain: true, retryable: false }
+            : { ...result, retryable: true };
+    try {
+        return classify(await withPaneInput(target, async (live) => {
+            // Busy and unknown are both a deferred delivery. Never hold the input
+            // lock while waiting for a model's whole turn to finish.
+            if (args.requireIdle && !args.requireIdle())
+                return { ok: false, reason: "target has no confirmed idle evidence" };
+            const text = args.prepareText?.() ?? args.text;
+            const guard = (phase) => {
+                if (!live() || (!exposed && args.requireIdle && !args.requireIdle()) || (args.guard && !args.guard(phase)))
+                    return false;
+                if (phase && !exposed) {
+                    exposed = true;
+                    args.beforeInput?.();
+                }
+                return true;
+            };
+            return injectViaTmux(target, text, args.images ?? [], args.log, args.freshSpawn ?? false, backendForPath(args.jsonlPath), args.jsonlPath, args.bypassModalGuard ?? false, guard);
+        }, { guard: args.guard }));
+    }
+    catch (error) {
+        return classify({ ok: false, reason: String(error) });
+    }
 };
 const queues = new Map();
 /** Ceiling for one whole inject job (respawn + paste + submit verification).
@@ -1989,7 +2066,11 @@ export const startMirror = (deps) => {
         const content = s.acc;
         s.lastSent = content;
         try {
-            await client.replyStream(s.frame, s.streamId, withLinkedTagHeader(s.target, content || "…", chatTurnUrl(s.target, s.turnId), undefined, undefined, s.dest), false);
+            await (s.pending = (s.pending ?? Promise.resolve()).catch(() => undefined).then(async () => {
+                if (s.closed || s.dead)
+                    return;
+                await client.replyStream(s.frame, s.streamId, withLinkedTagHeader(s.target, content || "…", chatTurnUrl(s.target, s.turnId), undefined, undefined, s.dest), false);
+            }));
             log.debug({ turnId: s.turnId, len: content.length }, "stream flush ok");
         }
         catch (e) {
@@ -2030,6 +2111,7 @@ export const startMirror = (deps) => {
         if (!s.dead && body.trim()) {
             const card = detailCardFor(s, a.target);
             try {
+                await s.pending?.catch(() => undefined);
                 if (card) {
                     s.cardSent = true;
                     await client.replyStreamWithCard(s.frame, s.streamId, withLinkedTag(a, body, undefined, s.turnId), true, { templateCard: card });
@@ -2079,7 +2161,7 @@ export const startMirror = (deps) => {
     // 头挂 chat 详情页的票据: 本轮那条 turn。没有活 turn 可挂 → undefined, 头退回裸
     // `emoji #tag` (withLinkedTagHeader 自己兜)。
     const chatTurnUrl = (target, turnId) => turnId
-        ? buildChatUrl(cfg.daemon.detailPublicBase, cfg.daemon.host, cfg.daemon.port, turnId, roleUniq(target))
+        ? buildChatUrl(cfg.daemon.detailPublicBase, cfg.daemon.host, cfg.daemon.port, turnId, roleUniq(target), target)
         : undefined;
     // `[mirror]` / `[wezard]` 系统提示不是答给谁的话, 不标方向。
     const withLinkedTag = (a, content, seq, turnId) => withLinkedTagHeader(a.target, content, chatTurnUrl(a.target, turnId ?? a.briefTurnId), seq, /^\[(mirror|wezard)\]/.test(content.trim()) ? undefined : a.replyTo, a.channel || undefined);
@@ -2094,15 +2176,21 @@ export const startMirror = (deps) => {
     const sendStandalone = (a, content) => {
         if (!hasVisibleBody(content))
             return;
+        if (answerSilent(a))
+            return;
         if (isPrivate(a) && !/^\[(mirror|wezard)\]/.test(content.trim()))
             return;
         const chatId = replyChatId(a);
-        const turnId = a.briefTurnId; // 推送是排队异步的, 到发出时 turn 早已收口
+        const turnId = a.briefTurnId ?? a.liveStream?.turnId; // 推送是排队异步的, 到发出时 turn 早已收口
         const pieces = splitMarkdown(content, Math.max(200, cfg.wrc.mirror.chunkBytes - TAG_HEADER_BUDGET));
         const chunks = pieces.map((p, i) => withLinkedTag(a, p, pieces.length > 1 ? `${i + 1}/${pieces.length}` : undefined));
         a.standalonePending = a.standalonePending
             .then(async () => {
+            if (silenceAnswer(a.target, turnId ?? ""))
+                return;
             for (const c of chunks) {
+                if (silenceAnswer(a.target, turnId ?? ""))
+                    return;
                 try {
                     const ack = await client.sendMessage(chatId, { msgtype: "markdown", markdown: { content: c } });
                     log.info({ sessionId: a.sessionId, turnId, chatId, len: c.length, ack: JSON.stringify(ack ?? null).slice(0, 300) }, "standalone pushed");
@@ -2119,9 +2207,11 @@ export const startMirror = (deps) => {
         if (!hasVisibleBody(content))
             return;
         const chatId = replyChatId(a);
-        const turnId = a.briefTurnId;
+        const turnId = a.briefTurnId ?? a.liveStream?.turnId;
         a.standalonePending = a.standalonePending
             .then(async () => {
+            if (silenceAnswer(a.target, turnId ?? ""))
+                return;
             try {
                 await client.sendMessage(chatId, { msgtype: "markdown", markdown: { content } });
                 log.info({ sessionId: a.sessionId, turnId, chatId, len: content.length }, "raw pushed");
@@ -2310,7 +2400,7 @@ export const startMirror = (deps) => {
             // sees the bubble; subsequent items grow it as today.
             void (async () => {
                 try {
-                    await client.replyStream(frame, streamId, withTagHeader(a.target, "…"), false);
+                    await (s.pending = client.replyStream(frame, streamId, withTagHeader(a.target, "…"), false));
                 }
                 catch (e) {
                     log.warn({ sessionId: a.sessionId, err: e.message }, "stream initial ack failed");
@@ -2415,11 +2505,15 @@ export const startMirror = (deps) => {
         const b = a.briefBubble;
         const turnId = a.briefTurnId;
         // 收口后这一路全部失效: 气泡要么已 done, 要么 turn 已经换人/清空。
-        if (!text || !b || b.done || !turnId || a.briefConcluded)
+        if (!text || !b || b.done || !turnId || a.briefConcluded || answerSilent(a))
             return;
         a.cotLastSent = text;
         try {
-            await client.replyStream(b.frame, b.streamId, briefLine(a, turnId, `\`${text}\``), false);
+            await (b.pending = (b.pending ?? Promise.resolve()).catch(() => undefined).then(async () => {
+                if (b.done || a.briefBubble !== b || a.briefTurnId !== turnId || answerSilent(a))
+                    return;
+                await client.replyStream(b.frame, b.streamId, briefLine(a, turnId, `\`${text}\``), false);
+            }));
         }
         catch (e) {
             log.debug({ sessionId: a.sessionId, turnId, err: e.message }, "brief: cot refresh failed");
@@ -2450,7 +2544,172 @@ export const startMirror = (deps) => {
     // `[mirror]` 系统提示 —— 它们都不走这道门。
     // 只在 brief 下生效: 抑制的前提是详情页兜得住内容, 而 turn store 只有 brief 在写。
     // 私聊轮 (wizard 之间, 非 public) 同理: 它的回复属于那场私聊, 只进双方的 rolepage。
-    const turnSilent = (a) => isPrivate(a) || (cfg.wrc.mirror.brief && cfg.wrc.mirror.chatOriginOnly && a.turnFromChat === false);
+    let silenceAnswer = () => false;
+    const answerSilent = (a) => silenceAnswer(a.target, a.briefTurnId ?? a.liveStream?.turnId ?? "");
+    const turnSilent = (a) => answerSilent(a) || isPrivate(a) || (cfg.wrc.mirror.brief && cfg.wrc.mirror.chatOriginOnly && a.turnFromChat === false);
+    const answerBubbles = new Map();
+    const answerLine = (held, text) => withLinkedTagHeader(held.receiver, text, chatTurnUrl(held.receiver, held.sourceTurn), undefined, undefined, held.channel);
+    // Serialise the old owner's in-flight refresh, reset, progress and final.
+    // A delayed ACK must never let an earlier writer overtake the new owner.
+    const writeAnswerProgress = (held, text) => {
+        held.pending = held.pending.catch(() => undefined).then(async () => {
+            if (!held.active || held.stopped || !held.bubble || held.bubble.done)
+                return;
+            await client.replyStream(held.bubble.frame, held.bubble.streamId, answerLine(held, text), false);
+        }).catch((e) => log.warn({ err: errText(e) }, "answer transfer progress refresh failed"));
+    };
+    const updateAnswerProgress = (a, item) => {
+        // Queued metadata is not authority: only the input boundary activates a task.
+        const held = a.activePeerTurn ? answerBubbles.get(a.activePeerTurn) : undefined;
+        if (!held || held.receiver !== a.target || held.stopped || held.bubble?.done)
+            return;
+        const raw = item.kind === "tool_use" ? cotToolLabel(item.calls)
+            : item.kind === "thinking" || (item.kind === "text" && item.final !== true) ? item.body : "";
+        const line = cotLine(raw);
+        if (!line)
+            return;
+        held.progress = line;
+        if (!held.active)
+            return;
+        if (held.timer)
+            return;
+        held.timer = setTimeout(() => {
+            held.timer = undefined;
+            if (held.progress)
+                writeAnswerProgress(held, `\`${held.progress}\``);
+        }, COT_FLUSH_MS);
+    };
+    const answerContext = (target) => {
+        const a = byTarget.get(target);
+        if (!a || a.briefConcluded || a.briefIsSlash || isPrivate(a) || a.turnFromChat === false)
+            return undefined;
+        const turn = a.briefTurnId ?? a.liveStream?.turnId;
+        return turn ? { turn, channel: a.channel ?? baseOfKey(target), prefix: "" } : undefined;
+    };
+    const prepareAnswer = (id, source, expectedTurn, receiver, channel) => {
+        const a = byTarget.get(source);
+        if (!a || (a.briefTurnId ?? a.liveStream?.turnId) !== expectedTurn || answerBubbles.has(id))
+            return false;
+        if ((!a.briefBubble || a.briefBubble.done) && (!a.liveStream || a.liveStream.closed || a.liveStream.dead))
+            return false;
+        answerBubbles.set(id, {
+            source, receiver, sourceTurn: expectedTurn, channel, active: false, stopped: false,
+            bubble: a.briefBubble, stream: a.liveStream, pending: Promise.resolve(),
+        });
+        return true;
+    };
+    const cancelAnswerPreparation = (id) => {
+        const held = answerBubbles.get(id);
+        if (held && !held.active)
+            answerBubbles.delete(id);
+    };
+    const stopAnswerProgress = (id) => {
+        const held = answerBubbles.get(id);
+        if (!held)
+            return;
+        held.stopped = true;
+        clearTimeout(held.timer);
+        held.timer = undefined;
+    };
+    const takeAnswer = async (id, target, expectedTurn, receiver, channel) => {
+        const a = byTarget.get(target);
+        const held = answerBubbles.get(id);
+        if (!held || held.active || held.source !== target || held.sourceTurn !== expectedTurn || held.receiver !== receiver || held.channel !== channel)
+            return { taken: false, cleared: false };
+        const sameTurn = a && (a.briefTurnId ?? a.liveStream?.turnId) === expectedTurn;
+        if (sameTurn) {
+            clearCot(a);
+            a.cotLastSent = undefined;
+            if (a.standaloneBuf) {
+                clearTimeout(a.standaloneBuf.timer);
+                a.standaloneBuf = undefined;
+            }
+            // Only this source turn becomes private; a concurrent new human turn is untouched.
+            a.channel = "";
+        }
+        const s = held.stream;
+        if (s && !s.closed && !s.dead) {
+            s.closed = true;
+            clearTimeout(s.flushTimer);
+            clearTimeout(s.idleTimer);
+            clearTimeout(s.hardTimer);
+            // Read the current chain, not prepare's snapshot: source may have flushed during injection.
+            held.bubble = { frame: s.frame, streamId: s.streamId, done: false, pending: s.pending };
+            if (a?.liveStream === s)
+                a.liveStream = undefined;
+        }
+        else if (s)
+            held.bubble = undefined;
+        const b = held.bubble;
+        held.active = true;
+        if (!b || b.done)
+            return { taken: true, cleared: false };
+        clearTimeout(b.hardTimer);
+        if (a?.briefBubble === b)
+            a.briefBubble = undefined;
+        let cleared = false;
+        held.pending = (b.pending ?? Promise.resolve()).catch(() => undefined).then(async () => {
+            if (b.done)
+                return;
+            await client.replyStream(b.frame, b.streamId, answerLine(held, "…"), false);
+            cleared = true;
+        });
+        try {
+            await held.pending;
+        }
+        catch (e) {
+            cleared = false;
+            log.warn({ id, err: errText(e) }, "answer transfer reset not acknowledged");
+        }
+        // Keep delivery possible after a reset error; reset never carries the final answer.
+        held.pending = held.pending.catch(() => undefined);
+        if (!held.stopped && held.progress)
+            writeAnswerProgress(held, `\`${held.progress}\``);
+        return { taken: true, cleared };
+    };
+    const deliverAnswer = async (id, target, turn, channel, _prefix, body, standalone) => {
+        const held = answerBubbles.get(id);
+        const text = body.trim();
+        const content = withLinkedTagHeader(target, text, chatTurnUrl(target, turn), undefined, undefined, channel);
+        stopAnswerProgress(id);
+        if (held?.bubble && !held.bubble.done) {
+            held.bubble.done = true;
+            clearTimeout(held.timer);
+            await held.pending;
+            try {
+                // Failure closes progress first; the terminal explanation is a standalone message.
+                const progress = withLinkedTagHeader(target, "回答已转交", chatTurnUrl(target, turn), undefined, undefined, channel);
+                await client.replyStream(held.bubble.frame, held.bubble.streamId, standalone ? progress : content, true);
+                if (!standalone) {
+                    answerBubbles.delete(id);
+                    return;
+                }
+            }
+            catch (e) {
+                const ack = e && typeof e === "object" ? e : undefined;
+                // Only a structured non-zero server ACK proves the stream frame was
+                // rejected. Timeout/disconnect errors are ambiguous: standalone retry
+                // could publish the same final answer twice, so let the caller persist
+                // `uncertain` and require a human resend instead.
+                const rejected = !!ack && typeof ack.headers === "object" && !!ack.headers && typeof ack.errcode === "number" && ack.errcode !== 0 && typeof ack.errmsg === "string";
+                if (!rejected && !standalone) {
+                    answerBubbles.delete(id);
+                    throw e;
+                }
+                if (!rejected) {
+                    log.warn({ id, err: errText(e) }, "answer transfer progress close acknowledgement uncertain; continuing with the one standalone terminal explanation");
+                    // In standalone mode this stream only closes progress; it never
+                    // carries the final body, so sending the terminal explanation once
+                    // remains necessary even when progress-close ACK is ambiguous.
+                }
+                else {
+                    log.warn({ id, err: errText(e), errcode: ack.errcode }, "answer transfer stream was explicitly rejected; standalone fallback");
+                }
+            }
+        }
+        await client.sendMessage(channel.replace(/^(user|chat|group):/, ""), { msgtype: "markdown", markdown: { content } });
+        answerBubbles.delete(id);
+    };
     // 收口一条 loading 气泡: finish=true 写入最终内容, 只生效一次。发送失败退回 standalone。
     // raw=true skips withTagHeader (used when content already contains the linked tag header).
     // WeCom 客户端收到 finish=true 后仍有打字机动画要播放, 如果紧接着就下发
@@ -2492,6 +2751,7 @@ export const startMirror = (deps) => {
         a.briefHadTool = false;
         a.briefConcluded = false;
         a.briefLastText = undefined;
+        a.cotLastSent = undefined;
         clearCot(a); // turn 级状态 —— 进度行跟着气泡走, 不能跨 turn 残留
         log.info({ sessionId: a.sessionId, turnId: q.turnId, isSlash: q.isSlash }, "brief: turn started");
     };
@@ -2636,6 +2896,7 @@ export const startMirror = (deps) => {
     const activateDispatch = (a, s, at = s.at) => {
         const q = s.turn;
         s.activated = true;
+        a.activePeerTurn = undefined;
         a.queryEpoch = (a.queryEpoch ?? 0) + 1; // WeCom 侧的新一轮同样是 query 边界
         a.turnFromChat = true; // 出处确凿: 这一轮有 frame, 群里就是它的主场
         a.pendingFromCli = false; // 人改从聊天里说话了, 之前那条 CLI 输入不再是出处
@@ -2681,12 +2942,18 @@ export const startMirror = (deps) => {
         if (a.briefTurnId)
             closeBriefTurn(a);
         const now = Date.now();
+        a.activePeerTurn = s.from?.kind === "peer" ? s.from.turn : undefined;
         a.pendingFrom = s.from ? { from: s.from, at: now } : undefined;
         a.pendingOrigin = s.origin ? { origin: s.origin, at: now } : undefined;
         // 没写频道的注入 (graph 步骤 / 手动 inject) 等同在 home 里开口: 印章就是全部出处, 不沿用上一轮的。
-        a.pendingChannel = { channel: s.channel ?? baseOfKey(a.target), at: now };
+        a.pendingChannel = { channel: s.channel ?? baseOfKey(a.target), speaker: s.speaker, at: now };
         a.pendingBriefQuery = s.query;
         a.pendingBriefAt = ts;
+        if (!cfg.wrc.mirror.brief) {
+            consumeChannel(a, false, consumeFrom(a));
+            if (a.liveStream && !a.liveStream.closed)
+                a.liveStream.dest = s.channel ?? baseOfKey(a.target);
+        }
         return s;
     };
     const startBriefTurn = async (a, frame, streamId, isSlash = false, userQuery = "", channel, speaker) => {
@@ -2725,7 +2992,7 @@ export const startMirror = (deps) => {
         // 也不必猜后端: codebuddy 那种几十秒后才落盘的轮, 入口从第一秒就在。
         // 尾随 `…` 表示"正文还没到", 正文到位时整条内容被 `链接 正文` 覆盖。
         try {
-            await client.replyStream(frame, streamId, briefLine(a, turnId, "…", channel), false);
+            await (bubble.pending = client.replyStream(frame, streamId, briefLine(a, turnId, "…", channel), false));
         }
         catch (e) {
             log.warn({ sessionId: a.sessionId, turnId, err: e.message }, "brief: turn ack failed");
@@ -2749,6 +3016,7 @@ export const startMirror = (deps) => {
         a.channel = r.channel === undefined || r.channel === baseOfKey(a.target) ? undefined : r.channel;
         a.speaker = r.speaker;
         a.convFrom = r.from;
+        a.activePeerTurn = r.from?.kind === "peer" ? r.from.turn : undefined;
         a.replyTo = publicPeer(r.from);
         a.turnFromChat = a.turnFromChat ?? true;
         a.briefTurnId = r.id;
@@ -2835,7 +3103,10 @@ export const startMirror = (deps) => {
         a.lastConcludedBody = body;
         a.lastConcludedEpoch = a.queryEpoch ?? 0;
         a.lastConcludedAt = Date.now();
-        if (a.briefBubble && !a.briefBubble.done) {
+        if (answerSilent(a)) {
+            log.info({ target: a.target, turnId }, "answer transferred; source conclusion suppressed");
+        }
+        else if (a.briefBubble && !a.briefBubble.done) {
             void finishBriefBubble(a, briefLine(a, turnId, linkTags(a.target, body)), true);
         }
         else if (turnSilent(a)) {
@@ -2975,6 +3246,9 @@ export const startMirror = (deps) => {
             : item.kind === "thinking" || item.kind === "text"
                 ? item.body
                 : "";
+        // A prompt (even an exact match) is not a child/parent-call identity. Late
+        // children can reuse prompts after history eviction, so their content must
+        // never enter a transferred answer bubble without a verifiable ID binding.
         if (activity)
             updateBriefProgress(a, `🤖 ${run.label} · ${activity}`);
     };
@@ -3328,7 +3602,12 @@ export const startMirror = (deps) => {
             // 不决定详情页记不记 —— 聊天不再下发 CLI 轮之后, 详情页是唯一的落点。
             a.pendingBriefQuery = item.body;
             a.pendingBriefAt = item.ts;
+            a.activePeerTurn = undefined;
+            a.pendingFrom = undefined;
+            a.pendingChannel = undefined;
             a.pendingFromCli = true;
+            if (!cfg.wrc.mirror.brief)
+                consumeChannel(a, true, undefined);
         }
         if (item.kind === "user_inject") {
             interject(a, item.said, item.ts);
@@ -3413,6 +3692,7 @@ export const startMirror = (deps) => {
         // 的配置下, 人在 CLI 敲的那一行就这么原样回显进了群, 正好破了 chatOriginOnly。
         if (item.kind === "user_text" && (item.quiet || cfg.wrc.mirror.brief))
             return;
+        updateAnswerProgress(a, item);
         // thinking 唯一的出口是 brief 气泡的 CoT 进度行。必须在这里就吃掉 —— 漏到下面任何
         // 一条通道 (deferred buf → renderBuf / standalone / stream append) 都会把它写进正文,
         // 那就变回已下线的 thinkStyle 了。
@@ -3560,6 +3840,8 @@ export const startMirror = (deps) => {
                 }
             }
         }
+        if (!cfg.wrc.mirror.brief && isPrivate(a))
+            return;
         // /goal mode overrides everything below: the session-scoped Stop hook
         // self-drives the model with no terminal stop_reason, so turn_end never fires
         // and brief-mode would swallow the entire run into the turn store (silent
@@ -3864,7 +4146,9 @@ export const startMirror = (deps) => {
     };
     // `panes` = boot 快照; 给了就不再为每个 principal 单独问 tmux。lazy 调用方
     // 不传, 维持原来的逐个探活。
-    const restoreFromStore = async (principal, panes) => {
+    const restoreFromStore = async (principal, panes, permitted) => {
+        if (permitted && !permitted())
+            return undefined;
         const rec = deps.store.get(principal);
         if (!rec)
             return undefined;
@@ -3882,6 +4166,8 @@ export const startMirror = (deps) => {
         // unrelated newest-in-cwd file is exactly the cross-wire we must avoid.
         const storedPane = (rec.tmuxPane ?? "").trim();
         const livePane = storedPane && (panes ? panes.has(storedPane) : await tmuxPaneAlive(storedPane)) ? storedPane : "";
+        if (permitted && !permitted())
+            return undefined;
         if (!existsSync(jsonlAbs)) {
             // First: the SAME-sid transcript may have merely relocated to a sibling
             // project dir (Claude Code EnterWorktree/ExitWorktree moved it while the
@@ -3937,6 +4223,8 @@ export const startMirror = (deps) => {
             const paneCwd = panes
                 ? (panes.get(livePane) ?? "")
                 : (await runTmux(["display-message", "-p", "-t", livePane, "#{pane_current_path}"])).stdout.trim();
+            if (permitted && !permitted())
+                return undefined;
             if (paneCwd) {
                 // Encode under the backend that owns the bound transcript — comparing
                 // with the primary dialect would report a phantom drift for every
@@ -3956,6 +4244,8 @@ export const startMirror = (deps) => {
                 }
             }
         }
+        if (permitted && !permitted())
+            return undefined;
         const r = attach({
             sessionId: rec.sessionId,
             jsonlPath: jsonlAbs,
@@ -4542,10 +4832,10 @@ export const startMirror = (deps) => {
     // `header` folds the caller's ack ("created") into this same bubble — /new
     // must land as exactly ONE WeCom message, not card + separate reply.
     // 会话边界回执一律不携带 cwd 信息 (📂 项目行 / 下次切换), 需要时 `/pwd` 可查。
-    // slashAckFirstLine 进一步省去 💡 tip, 只剩首行 ack。
     const pushProjectInfo = (target, header) => {
-        const concise = cfg.wrc.mirror.slashAckFirstLine && !!header;
-        const md = header ? (concise ? header : `${header}\n\n${randomTip()}`) : randomTip();
+        if (!header)
+            return;
+        const md = header;
         const a = byTarget.get(target);
         if (a) {
             sendStandalone(a, md);
@@ -4606,12 +4896,13 @@ export const startMirror = (deps) => {
             return undefined;
         }
     };
-    /** 死 pane 重生 (`--resume` 同一个会话) 的模型: 绑定里记着的优先 —— set_model 换上的也记在那;
-     *  没记 (老绑定 / CLI 默认) 的管家补上管家档。 */
+    /** 死 pane 重生: 管家重新取 router 档位, 普通 wizard 沿用绑定模型。 */
     const respawnSpec = (a) => {
         return resumedStewardSpec(cfg, a.target, backendForPath(a.jsonlPath).name, a);
     };
     const newSession = async (target, windowName, cli, opts) => {
+        if (opts?.guard && !opts.guard())
+            return { ok: false, reason: "spawn guard withdrew permission" };
         const prev = byTarget.get(target);
         // Resolution precedence (all chat-scoped except the running-cwd fallback):
         //   base.pending > caller.pending > target.running > base.running > default
@@ -4637,8 +4928,8 @@ export const startMirror = (deps) => {
         const boundPath = prev?.jsonlPath ?? rec?.jsonlPath;
         const base = baseOfKey(target);
         const effCli = resolveCliBackend(cfg.wrc).name;
-        // 管家 (群的默认会话) 新起的会话按管家档起 (models.steward / chatPolicy), 档压过绑定里记下的
-        // effort —— `/new`、换目录、交接重开都是让改过的档位生效的那一下。点名了模型就整档让开。
+        // 管家 (群的默认会话) 固定按 models.router 起, 压过显式模型及绑定里记下的 effort;
+        // `/new`、换目录、交接重开都是让改过的档位生效的那一下。
         // 已在跑的管家不动 (换模型会让缓存整份重读); 死 pane 重生见 respawnSpec。
         const backendChanged = Boolean(boundPath && effCli && backendForPath(expandHome(boundPath)).name !== effCli);
         const { model: effModel, effort: effEffort } = newStewardSpec(cfg, target, effCli, opts, backendChanged ? undefined : prev?.effort ?? deps.store.get(target)?.effort);
@@ -4666,6 +4957,12 @@ export const startMirror = (deps) => {
             inFlightSids.delete(freshSid);
             return { ok: false, reason: r.reason };
         }
+        if (opts?.guard && !opts.guard()) {
+            inFlightSids.delete(freshSid);
+            if (r.tmuxPane)
+                await runTmux(["kill-pane", "-t", r.tmuxPane]);
+            return { ok: false, reason: "spawn completed after permission withdrawal; binding withheld" };
+        }
         const att = attach({
             sessionId: r.sessionId,
             jsonlPath: r.jsonlPath,
@@ -4783,14 +5080,16 @@ export const startMirror = (deps) => {
         return undefined;
     };
     const cloneSession = async (args) => {
-        const p = byTarget.get(args.parent) ?? (await restoreFromStore(args.parent));
+        if (args.guard && !args.guard("paste"))
+            return { ok: false, reason: "spawn guard withdrew permission", inherited: false };
+        const p = byTarget.get(args.parent) ?? (await restoreFromStore(args.parent, undefined, () => !args.guard || args.guard()));
         // 继承上下文要求父亲有一个活着的 transcript, 且分身必须待在同一个项目目录 ——
         // `--resume` 是按项目目录寻址 session 的。调用方点名换目录 = 明确放弃继承。
         const sameCwd = !args.cwd?.trim() || expandHome(args.cwd.trim()) === (p?.runningCwd ?? "");
         const canInherit = args.inherit !== false && !!p?.sessionId && !!p.jsonlPath && existsSync(p.jsonlPath) && sameCwd;
         if (!canInherit) {
             const r = await newSession(args.target, args.windowName, args.cli, {
-                model: args.model, effort: args.effort, cwd: args.cwd, systemPrompt: args.systemPrompt, silent: true, keepalive: args.keepalive,
+                model: args.model, effort: args.effort, cwd: args.cwd, systemPrompt: args.systemPrompt, silent: true, keepalive: args.keepalive, guard: args.guard ? () => args.guard("paste") : undefined,
             });
             return { ...r, inherited: false };
         }
@@ -4802,6 +5101,8 @@ export const startMirror = (deps) => {
         const parentCli = backendForPath(parent.jsonlPath).name;
         const model = args.model?.trim() || parent.model || lastModel(parent.jsonlPath);
         const effort = args.effort ?? parseEffort(parent.effort);
+        if (args.guard && !args.guard("paste"))
+            return { ok: false, reason: "spawn guard withdrew permission", inherited: false };
         const r = await spawnTmuxClaude({
             cfg,
             log: lg,
@@ -4825,7 +5126,7 @@ export const startMirror = (deps) => {
         const boot = await inject({
             text: hello, images: [], cfg, log: lg,
             sessionId: parentCli === "codex" ? r.sessionId : parent.sessionId, jsonlPath: parentCli === "codex" ? r.jsonlPath : parent.jsonlPath,
-            tmuxTarget: r.tmuxPane, freshSpawn: true,
+            tmuxTarget: r.tmuxPane, freshSpawn: true, guard: args.guard,
         });
         if (!boot.ok) {
             await runTmux(["kill-pane", "-t", r.tmuxPane ?? ""]);
@@ -4841,6 +5142,12 @@ export const startMirror = (deps) => {
             await runTmux(["kill-pane", "-t", r.tmuxPane ?? ""]);
             return { ok: false, reason: "分身没能在超时内分叉出自己的会话 (CLI 可能不支持 --fork-session)", inherited: false };
         }
+        if (args.guard && !args.guard("submit")) {
+            inFlightSids.delete(fork.sessionId);
+            // The bootstrap may already have executed; withhold binding, report the
+            // unconfirmed birth to its caller instead of claiming cancellation success.
+            return { ok: false, reason: "fork executed after permission withdrawal; reconcile pane manually", inherited: false };
+        }
         const att = attach({
             sessionId: fork.sessionId,
             jsonlPath: fork.jsonlPath,
@@ -5340,7 +5647,9 @@ export const startMirror = (deps) => {
         catch { /* unreadable tail */ }
         return { lastMs, lastRealMs, seenMtime: mtime, pinging: false, pingMtime: 0, round, settledAt: 0, ttlSec: cacheTtlSec(jsonlPath), cacheAt: cacheTouchMs(jsonlPath) };
     };
-    const fireKeepalive = async (a) => {
+    const fireKeepalive = async (a, guard) => {
+        if (!guard())
+            return;
         const kc = cfg.wrc.mirror.keepalive;
         // The SAME full instruction every round: a bare "ping" used to be sent from round 2 on
         // (the instruction was already in context), but the model reads a bare "ping"
@@ -5354,16 +5663,23 @@ export const startMirror = (deps) => {
         // ping turn (reply included). The 60s fail-safe clears the quiet window if
         // the turn somehow never emits turn_end, so a later real turn is never muted;
         // it also closes the detail turn so it can't hang open in the chat timeline.
-        rememberInject(text);
-        a.keepaliveQuiet = setTimeout(() => {
-            a.keepaliveQuiet = undefined;
-            if (a.keepaliveTurnId) {
-                recordTurnClose(a.keepaliveTurnId);
-                a.keepaliveTurnId = undefined;
-            }
-        }, 60_000);
         const r = await inject({
             text, images: [], cfg,
+            guard,
+            requireIdle: () => idleVerdict(a.target) === true,
+            beforeInput: () => {
+                // A queued heartbeat must not mute the peer turn that won the lane.
+                // Drain its tail first, then open swallow only at permitted physical input.
+                a.tail.drain();
+                rememberInject(text);
+                a.keepaliveQuiet = setTimeout(() => {
+                    a.keepaliveQuiet = undefined;
+                    if (a.keepaliveTurnId) {
+                        recordTurnClose(a.keepaliveTurnId);
+                        a.keepaliveTurnId = undefined;
+                    }
+                }, 60_000);
+            },
             log: log.child({ target: a.target, sessionId: a.sessionId, sub: "keepalive" }),
             sessionId: a.sessionId, jsonlPath: a.jsonlPath, tmuxTarget: a.tmuxPane,
         });
@@ -5374,6 +5690,8 @@ export const startMirror = (deps) => {
             log.warn({ target: a.target, reason: r.reason }, "keepalive: inject failed");
             return;
         }
+        if (!guard())
+            return;
         const tokens = lastContextTokens(a.jsonlPath);
         const round = a.keepalive ? (a.keepalive.round += 1) : 1;
         log.info({ target: a.target, tokens, round, totalRounds: Math.max(1, kc.rounds) }, "keepalive: ping injected");
@@ -5389,116 +5707,132 @@ export const startMirror = (deps) => {
             recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), initialModel: a.model || undefined, initialEffort: a.effort || undefined, userQuery: text });
         }
     };
-    let keepaliveTicking = false;
-    const keepaliveTick = async () => {
-        const kc = cfg.wrc.mirror.keepalive;
-        if (!kc.enabled || keepaliveTicking)
+    // One pool for both maintenance paths: slow panes do not stall other panes,
+    // and a keepalive never overlaps a picker scan/automatic press on the same pane.
+    const maintenance = createKeyedScheduler(4);
+    const maintenanceValid = (a, pane, sid, gen, signal) => !signal.aborted && byTarget.get(a.target) === a && a.tmuxPane === pane && a.sessionId === sid
+        && (a.injectGen ?? 0) === gen && !a.migrationWatcher;
+    const keepaliveOne = async (a, pane, sid, gen, signal) => {
+        const valid = () => maintenanceValid(a, pane, sid, gen, signal) && cfg.wrc.mirror.keepalive.enabled;
+        if (!valid())
             return;
-        keepaliveTicking = true;
+        const kc = cfg.wrc.mirror.keepalive;
+        const pingSigs = [normAssistant(kc.ping).slice(0, 40)].filter((s) => s.length > 0);
+        const now = Date.now();
+        if (a.keepaliveDisabled)
+            return; // sticky spawn-time opt-out — never pings
+        if (!a.tmuxPane)
+            return; // spawn-mode: no live pane to warm
+        if (a.migrationWatcher)
+            return; // session rotating — skip
+        if (a.liveStream && !a.liveStream.closed)
+            return; // mid typewriter — don't inject
+        if (!(await tmuxPaneAlive(pane)) || !valid())
+            return; // dead pane — nothing to keep alive
+        let mtime = 0;
         try {
-            const pingSigs = [normAssistant(kc.ping).slice(0, 40)].filter((s) => s.length > 0);
-            const now = Date.now();
-            for (const a of byTarget.values()) {
-                if (a.keepaliveDisabled)
-                    continue; // sticky spawn-time opt-out — never pings
-                if (!a.tmuxPane)
-                    continue; // spawn-mode: no live pane to warm
-                if (a.migrationWatcher)
-                    continue; // session rotating — skip
-                if (a.liveStream && !a.liveStream.closed)
-                    continue; // mid typewriter — don't inject
-                if (!(await tmuxPaneAlive(a.tmuxPane)))
-                    continue; // dead pane — nothing to keep alive
-                let mtime = 0;
-                try {
-                    mtime = statSync(a.jsonlPath).mtimeMs;
-                }
-                catch {
-                    continue;
-                }
-                if (!mtime)
-                    continue;
-                const k = (a.keepalive ??= initKeepalive(a.jsonlPath, mtime, pingSigs));
-                // File mtime is only a cheap "did anything change → re-read the tail" gate.
-                // The clocks themselves come from message turns, so metadata churn (which
-                // bumps mtime but is not a turn) can never move them. `grewSinceLast` now
-                // means a NEW message turn appeared — not that the file grew.
-                const prevRealMs = k.lastRealMs;
-                if (mtime > k.seenMtime + 1000) {
-                    const s = keepaliveStamps(a.jsonlPath, pingSigs);
-                    if (s.stamped) {
-                        k.lastMs = s.lastMs;
-                        k.lastRealMs = s.lastRealMs;
-                    }
-                    else {
-                        k.lastMs = mtime;
-                        k.lastRealMs = mtime;
-                    } // backend without timestamps → fall back to mtime
-                    k.ttlSec = cacheTtlSec(a.jsonlPath) || k.ttlSec;
-                    k.cacheAt = cacheTouchMs(a.jsonlPath) || k.cacheAt;
-                }
-                k.seenMtime = mtime;
-                // Round reset / real-activity re-anchor keys off REAL turns only — a
-                // keepalive ping+pong advances lastMs but NOT lastRealMs, so the heartbeat
-                // no longer reads as activity to itself (which was pinning round at 1/N).
-                const grewSinceLast = k.lastRealMs > prevRealMs + 1000;
-                const paneTail = await capturePaneTail(a.tmuxPane, 16);
-                const busy = paneIsBusy(paneTail);
-                if (k.pinging) {
-                    // Waiting for our own ping to land and settle: until a NEWER message turn
-                    // (the ping's own user line) appears and the pane goes idle, keep waiting.
-                    if (busy || k.lastMs <= k.pingMtime)
-                        continue;
-                    k.pinging = false;
-                    k.settledAt = now;
-                    continue;
-                }
-                // A new real message turn (or a busy pane) re-anchors: reset the round
-                // counter, and past the /stop grace lift a busy-resume. grewSinceLast is
-                // message-based now, so `/stop`'s Esc settling writes (metadata, no new
-                // turn) can no longer self-resume the pause — only a busy pane past grace,
-                // or a WeCom inbound in dispatch, does.
-                // Suppress the grewSinceLast reset for 30s after pinging settles — the
-                // pong's tail flush can lag a tick and would otherwise fake real activity.
-                const justSettled = k.settledAt > 0 && now - k.settledAt < 30_000;
-                if (busy || (grewSinceLast && !justSettled)) {
-                    k.round = 0;
-                    k.settledAt = 0;
-                    if (a.keepaliveOff && busy && now - (a.keepaliveOffAt ?? 0) > RESUME_GRACE_MS) {
-                        a.keepaliveOff = false;
-                        persistPause(a);
-                    }
-                    if (busy)
-                        continue;
-                }
-                if (a.keepaliveOff)
-                    continue; // paused by /stop until real activity returns
-                // Cache clock = start of the newest answered request (TTL runs from there),
-                // not the last turn's write time; no request on record → the turn clock.
-                const sinceCache = now - (k.cacheAt || k.lastMs || mtime);
-                // The TTL the session's cache entries were actually written with (1h on a
-                // Claude Code subscription), not a guess: pinging at the 5min cadence
-                // against a 1h entry re-reads the whole context ~14x per hour for nothing.
-                const ttlMs = (k.ttlSec || kc.ttlSec) * 1000;
-                const idleTriggerMs = Math.max(30_000, ttlMs - kc.marginSec * 1000);
-                if (sinceCache < idleTriggerMs)
-                    continue; // cache still comfortably warm
-                if (sinceCache >= ttlMs)
-                    continue; // cache already cold — a ping would cold-rewrite for nothing
-                if (sinceCache > KEEPALIVE_MAX_IDLE_MS)
-                    continue; // idle past 10min (a long-TTL entry) — not worth warming
-                if (k.round >= kc.rounds)
-                    continue; // budget spent — let it go cold
-                k.pinging = true;
-                k.pingMtime = k.lastMs; // settles when a newer turn (the ping's own) appears
-                await fireKeepalive(a);
+            mtime = statSync(a.jsonlPath).mtimeMs;
+        }
+        catch {
+            return;
+        }
+        if (!mtime)
+            return;
+        const k = (a.keepalive ??= initKeepalive(a.jsonlPath, mtime, pingSigs));
+        // File mtime is only a cheap "did anything change → re-read the tail" gate.
+        // The clocks themselves come from message turns, so metadata churn (which
+        // bumps mtime but is not a turn) can never move them. `grewSinceLast` now
+        // means a NEW message turn appeared — not that the file grew.
+        const prevRealMs = k.lastRealMs;
+        if (mtime > k.seenMtime + 1000) {
+            const s = keepaliveStamps(a.jsonlPath, pingSigs);
+            if (s.stamped) {
+                k.lastMs = s.lastMs;
+                k.lastRealMs = s.lastRealMs;
             }
+            else {
+                k.lastMs = mtime;
+                k.lastRealMs = mtime;
+            } // backend without timestamps → fall back to mtime
+            k.ttlSec = cacheTtlSec(a.jsonlPath) || k.ttlSec;
+            k.cacheAt = cacheTouchMs(a.jsonlPath) || k.cacheAt;
+        }
+        k.seenMtime = mtime;
+        // Round reset / real-activity re-anchor keys off REAL turns only — a
+        // keepalive ping+pong advances lastMs but NOT lastRealMs, so the heartbeat
+        // no longer reads as activity to itself (which was pinning round at 1/N).
+        const grewSinceLast = k.lastRealMs > prevRealMs + 1000;
+        const paneTail = await capturePaneTail(pane, 16);
+        if (!valid())
+            return;
+        const busy = paneIsBusy(paneTail);
+        if (k.pinging) {
+            // Waiting for our own ping to land and settle: until a NEWER message turn
+            // (the ping's own user line) appears and the pane goes idle, keep waiting.
+            if (busy || k.lastMs <= k.pingMtime)
+                return;
+            k.pinging = false;
+            k.settledAt = now;
+            return;
         }
-        catch (e) {
-            log.warn({ err: e.message }, "keepalive tick failed");
+        // A new real message turn (or a busy pane) re-anchors: reset the round
+        // counter, and past the /stop grace lift a busy-resume. grewSinceLast is
+        // message-based now, so `/stop`'s Esc settling writes (metadata, no new
+        // turn) can no longer self-resume the pause — only a busy pane past grace,
+        // or a WeCom inbound in dispatch, does.
+        // Suppress the grewSinceLast reset for 30s after pinging settles — the
+        // pong's tail flush can lag a tick and would otherwise fake real activity.
+        const justSettled = k.settledAt > 0 && now - k.settledAt < 30_000;
+        if (busy || (grewSinceLast && !justSettled)) {
+            k.round = 0;
+            k.settledAt = 0;
+            if (a.keepaliveOff && busy && now - (a.keepaliveOffAt ?? 0) > RESUME_GRACE_MS) {
+                a.keepaliveOff = false;
+                persistPause(a);
+            }
+            if (busy)
+                return;
         }
-        finally {
-            keepaliveTicking = false;
+        if (a.keepaliveOff)
+            return; // paused by /stop until real activity returns
+        // Cache clock = start of the newest answered request (TTL runs from there),
+        // not the last turn's write time; no request on record → the turn clock.
+        const sinceCache = now - (k.cacheAt || k.lastMs || mtime);
+        // The TTL the session's cache entries were actually written with (1h on a
+        // Claude Code subscription), not a guess: pinging at the 5min cadence
+        // against a 1h entry re-reads the whole context ~14x per hour for nothing.
+        const ttlMs = (k.ttlSec || kc.ttlSec) * 1000;
+        const idleTriggerMs = Math.max(30_000, ttlMs - kc.marginSec * 1000);
+        if (sinceCache < idleTriggerMs)
+            return; // cache still comfortably warm
+        if (sinceCache >= ttlMs)
+            return; // cache already cold — a ping would cold-rewrite for nothing
+        if (sinceCache > KEEPALIVE_MAX_IDLE_MS)
+            return; // idle past 10min (a long-TTL entry) — not worth warming
+        if (k.round >= kc.rounds)
+            return; // budget spent — let it go cold
+        if (idleVerdict(a.target) !== true)
+            return; // no confirmed idle → no heartbeat input
+        k.pinging = true;
+        k.pingMtime = k.lastMs; // settles when a newer turn (the ping's own) appears
+        await fireKeepalive(a, () => valid() && !a.keepaliveOff);
+    };
+    const keepaliveTick = () => {
+        if (!cfg.wrc.mirror.keepalive.enabled)
+            return;
+        for (const a of byTarget.values()) {
+            if (!a.tmuxPane || a.keepaliveDisabled)
+                continue;
+            const pane = a.tmuxPane, sid = a.sessionId, gen = a.injectGen ?? 0;
+            void maintenance.schedule(`keepalive:${a.target}`, pane, (signal) => keepaliveOne(a, pane, sid, gen, signal))
+                ?.catch((e) => {
+                if (maintenanceValid(a, pane, sid, gen, maintenance.signal)) {
+                    if (a.keepalive)
+                        a.keepalive.pinging = false;
+                    endKeepaliveSwallow(a);
+                }
+                log.warn({ target: a.target, err: e.message }, "keepalive tick failed");
+            });
         }
     };
     const keepaliveTimer = setInterval(() => void keepaliveTick(), 15_000);
@@ -5513,118 +5847,143 @@ export const startMirror = (deps) => {
     //   - 其它 → 把框转成标准审批卡发到本 chat (runMirrorPickerFlow), 点击后代按
     //     对应选项; 本地先按掉则 moot 作废卡。代按/发卡都发 chat 回执留痕。
     // WEZARD_PICKER_SENTINEL=0 整体关闭。
-    let pickerTicking = false;
-    const pickerTick = async () => {
-        if (pickerTicking || process.env.WEZARD_PICKER_SENTINEL === "0")
-            return;
-        if (!cfg.approval.enabled)
+    const pickerOne = async (a, pane, sid, gen, signal) => {
+        const guard = () => maintenanceValid(a, pane, sid, gen, signal) && cfg.approval.enabled
+            && process.env.WEZARD_PICKER_SENTINEL !== "0";
+        if (!guard())
             return;
-        pickerTicking = true;
-        try {
-            for (const a of byTarget.values()) {
-                if (!a.tmuxPane || a.migrationWatcher)
-                    continue;
-                // Codex PermissionRequest has its own independent native gate. Screen
-                // options, tool windows and skipAll never authorize its sandbox.
-                if (cliOf(a) === "codex")
-                    continue;
-                if (!(await tmuxPaneAlive(a.tmuxPane)))
-                    continue;
-                const v = await detectModalPicker(a.tmuxPane);
-                if (!v.modal) {
-                    // 审批卡在途而框已消失 = 本地先按掉了 → 作废卡等待 (无卡则 no-op)。
-                    mootMirrorPicker(a.sessionId);
-                    // 诊断: 屏上有高亮编号行却没判成 modal = 布局盲区候选 (askq/plan 面板
-                    // 也长这样, 属正常)。每屏记一次日志, 供远端排查"哨兵为何没反应"。
-                    if (looksLikePicker(v.screen)) {
-                        if (a.pickerSentinelFp !== v.screen) {
-                            a.pickerSentinelFp = v.screen;
-                            log.info({ target: a.target, tail: v.screen.split("\n").slice(-8).join("\\n").slice(-600) }, "picker sentinel: numbered picker shape on pane but not judged modal");
-                        }
-                    }
-                    else {
-                        a.pickerSentinelFp = undefined;
+        await withPaneInput(pane, async (live) => {
+            const valid = () => guard() && live();
+            if (!a.tmuxPane || a.migrationWatcher)
+                return;
+            // Codex PermissionRequest has its own independent native gate. Screen
+            // options, tool windows and skipAll never authorize its sandbox.
+            if (cliOf(a) === "codex")
+                return;
+            if (!(await tmuxPaneAlive(pane)) || !valid())
+                return;
+            const v = await detectModalPicker(pane);
+            if (!valid())
+                return;
+            if (!v.modal) {
+                // 审批卡在途而框已消失 = 本地先按掉了 → 作废卡等待 (无卡则 no-op)。
+                mootMirrorPicker(a.sessionId);
+                // 诊断: 屏上有高亮编号行却没判成 modal = 布局盲区候选 (askq/plan 面板
+                // 也长这样, 属正常)。每屏记一次日志, 供远端排查"哨兵为何没反应"。
+                if (looksLikePicker(v.screen)) {
+                    if (a.pickerSentinelFp !== v.screen) {
+                        a.pickerSentinelFp = v.screen;
+                        log.info({ target: a.target, tail: v.screen.split("\n").slice(-8).join("\\n").slice(-600) }, "picker sentinel: numbered picker shape on pane but not judged modal");
                     }
-                    continue;
                 }
-                if (hasMirrorPicker(a.sessionId))
-                    continue; // 审批卡在途, 等点击 / moot
-                if (a.pickerSentinelFp === v.screen)
-                    continue; // 同一屏已处理过, 等它变化
-                a.pickerSentinelFp = v.screen;
-                const pick = pickAutoAllowAnswer(parseModalOptions(v.screen));
-                if (!pick) {
-                    log.info({ target: a.target, title: v.title }, "picker sentinel: modal on pane but not a trustworthy permission picker — leaving it");
-                    continue;
-                }
-                const ctx = parseConfirmContext(v.screen);
-                const policy = pickerPolicy(cfg, cliOf(a), ctx, isAutoWindowActive(a.target));
-                if (policy.decision === "leave") {
-                    log.info({ target: a.target, reason: policy.reason }, "picker sentinel: independent approval left on CLI");
+                else {
+                    a.pickerSentinelFp = undefined;
                 }
-                await dispatchPickerPolicy(policy, {
-                    deny: async () => {
-                        const result = await pressNativePicker(a, modalFingerprint(v.screen), "no");
-                        log.info({ target: a.target, reason: policy.reason, result }, "picker sentinel: deny rule");
-                        sendStandalone(a, `[mirror] 🚫 ${policy.reason}，${result.ok ? "已拒绝 CLI 确认" : "确认框已变更，请回 CLI 处理"}`);
-                    },
-                    allow: async () => {
-                        const after = await pressModalIndex(a.tmuxPane, v, pick.index);
-                        if (after.modal) {
-                            // 没按掉: 指纹换成当前屏 — pane 静止就不再重试, 免得往一个不认识的框里刷数字键。
-                            a.pickerSentinelFp = after.screen;
-                            log.warn({ target: a.target, title: after.title, pressed: pick.index }, "picker sentinel: modal still on pane after press");
-                            return;
-                        }
-                        a.pickerSentinelFp = undefined;
-                        log.info({ target: a.target, title: v.title, via: policy.reason, pressed: `${pick.index}. ${pick.label}` }, "picker sentinel: native permission picker auto-allowed");
-                        sendStandalone(a, `[mirror] 🔓 ${policy.reason} 代按了 CLI 原生权限确认${v.title ? `「${v.title}」` : ""} → ${pick.index}. ${pick.label}`);
-                    },
-                    manual: () => {
-                        // 卡片路径: fire-and-forget — 长轮询在 flow 里, 哨兵循环不能被一张卡挂住;
-                        // 防重靠 hasMirrorPicker 槽位 (含代按窗口期, 见 flow 内 finally)。
-                        log.info({ target: a.target, toolName: ctx.toolName, agent: ctx.agent, reason: policy.reason }, "picker sentinel: forwarding native picker as approval card");
-                        runMirrorPickerFlow({
-                            log: log.child({ target: a.target, sessionId: a.sessionId, sub: "picker-card" }),
-                            client,
-                            cfg,
-                            sessionId: a.sessionId,
-                            chatKey: a.target,
-                            cwd: a.runningCwd,
-                            jsonlPath: a.jsonlPath,
-                            toolName: ctx.toolName,
-                            toolInput: ctx.toolInput,
-                            agent: ctx.agent,
-                            danger: policy.forceSingle,
-                            voteTimeoutMs: cfg.approval.longPollSec * 1000,
-                            press: (what) => pressNativePicker(a, modalFingerprint(v.screen), what),
-                        }).then((sent) => {
-                            // 卡没发出去 (WS 断/发送失败): 清指纹, 让下一 tick 对同屏重试发卡,
-                            // 否则这只框会被指纹永久静默。
-                            if (!sent)
-                                a.pickerSentinelFp = undefined;
-                        }).catch((e) => log.warn({ err: e.message, target: a.target }, "mirror picker flow failed"));
-                    },
-                });
+                return;
             }
-        }
-        catch (e) {
-            log.warn({ err: e.message }, "picker sentinel tick failed");
-        }
-        finally {
-            pickerTicking = false;
+            if (hasMirrorPicker(a.sessionId))
+                return; // 审批卡在途, 等点击 / moot
+            if (a.pickerSentinelFp === v.screen)
+                return; // 同一屏已处理过, 等它变化
+            a.pickerSentinelFp = v.screen;
+            const pick = pickAutoAllowAnswer(parseModalOptions(v.screen));
+            if (!pick) {
+                log.info({ target: a.target, title: v.title }, "picker sentinel: modal on pane but not a trustworthy permission picker — leaving it");
+                return;
+            }
+            const ctx = parseConfirmContext(v.screen);
+            const policy = pickerPolicy(cfg, cliOf(a), ctx, isAutoWindowActive(a.target));
+            if (policy.decision === "leave") {
+                log.info({ target: a.target, reason: policy.reason }, "picker sentinel: independent approval left on CLI");
+            }
+            await dispatchPickerPolicy(policy, {
+                deny: async () => {
+                    if (!valid())
+                        return;
+                    const result = await pressNativePickerUnlocked(a, modalFingerprint(v.screen), "no", valid);
+                    if (!valid())
+                        return;
+                    log.info({ target: a.target, reason: policy.reason, result }, "picker sentinel: deny rule");
+                    sendStandalone(a, `[mirror] 🚫 ${policy.reason}，${result.ok ? "已拒绝 CLI 确认" : "确认框已变更，请回 CLI 处理"}`);
+                },
+                allow: async () => {
+                    if (!valid())
+                        return;
+                    const after = await pressModalIndex(pane, v, pick.index, valid);
+                    if (!valid())
+                        return;
+                    if (after.modal) {
+                        // 没按掉: 指纹换成当前屏 — pane 静止就不再重试, 免得往一个不认识的框里刷数字键。
+                        a.pickerSentinelFp = after.screen;
+                        log.warn({ target: a.target, title: after.title, pressed: pick.index }, "picker sentinel: modal still on pane after press");
+                        return;
+                    }
+                    a.pickerSentinelFp = undefined;
+                    log.info({ target: a.target, title: v.title, via: policy.reason, pressed: `${pick.index}. ${pick.label}` }, "picker sentinel: native permission picker auto-allowed");
+                    sendStandalone(a, `[mirror] 🔓 ${policy.reason} 代按了 CLI 原生权限确认${v.title ? `「${v.title}」` : ""} → ${pick.index}. ${pick.label}`);
+                },
+                manual: () => {
+                    if (!valid())
+                        return;
+                    // 卡片路径: fire-and-forget — 长轮询在 flow 里, 哨兵循环不能被一张卡挂住;
+                    // 防重靠 hasMirrorPicker 槽位 (含代按窗口期, 见 flow 内 finally)。
+                    log.info({ target: a.target, toolName: ctx.toolName, agent: ctx.agent, reason: policy.reason }, "picker sentinel: forwarding native picker as approval card");
+                    runMirrorPickerFlow({
+                        log: log.child({ target: a.target, sessionId: a.sessionId, sub: "picker-card" }),
+                        client,
+                        cfg,
+                        sessionId: a.sessionId,
+                        chatKey: a.target,
+                        cwd: a.runningCwd,
+                        jsonlPath: a.jsonlPath,
+                        toolName: ctx.toolName,
+                        toolInput: ctx.toolInput,
+                        agent: ctx.agent,
+                        danger: policy.forceSingle,
+                        voteTimeoutMs: cfg.approval.longPollSec * 1000,
+                        // Human waiting is outside the lock; the eventual press obtains a new transaction.
+                        press: (what) => pressNativePicker(a, modalFingerprint(v.screen), what, guard),
+                    }).then((sent) => {
+                        // 卡没发出去 (WS 断/发送失败): 清指纹, 让下一 tick 对同屏重试发卡,
+                        // 否则这只框会被指纹永久静默。
+                        if (!sent && guard())
+                            a.pickerSentinelFp = undefined;
+                    }).catch((e) => {
+                        if (guard())
+                            a.pickerSentinelFp = undefined;
+                        log.warn({ err: e.message, target: a.target }, "mirror picker flow failed");
+                    });
+                },
+            });
+        }, { guard });
+    };
+    const pickerTick = () => {
+        if (!cfg.approval.enabled || process.env.WEZARD_PICKER_SENTINEL === "0")
+            return;
+        for (const a of byTarget.values()) {
+            if (!a.tmuxPane || cliOf(a) === "codex")
+                continue;
+            const pane = a.tmuxPane, sid = a.sessionId, gen = a.injectGen ?? 0;
+            void maintenance.schedule(`picker:${a.target}`, pane, (signal) => pickerOne(a, pane, sid, gen, signal))
+                ?.catch((e) => {
+                if (maintenanceValid(a, pane, sid, gen, maintenance.signal))
+                    a.pickerSentinelFp = undefined;
+                log.warn({ target: a.target, err: e.message }, "picker sentinel tick failed");
+            });
         }
     };
     const pickerTimer = setInterval(() => void pickerTick(), 5_000);
     // 审批卡点击后的代按回调。点击与本地按键之间隔着人的反应时间, 必须重读屏并
     // 校验仍是**同一个调用**的确认框 —— 期间本地按掉旧框又弹了新框的话, 盲按就是
     // 替用户批准了他没看过的东西。
-    const pressNativePicker = async (a, expectFingerprint, what) => {
-        if (!a.tmuxPane || !(await tmuxPaneAlive(a.tmuxPane)))
+    const pressNativePickerUnlocked = async (a, expectFingerprint, what, live) => {
+        if (!live() || !a.tmuxPane || !(await tmuxPaneAlive(a.tmuxPane)))
             return { ok: false, reason: "pane 已不在" };
         if (cliOf(a) === "codex")
             return { ok: false, reason: "Codex 原生沙箱审批必须单独处理" };
         const v = await detectModalPicker(a.tmuxPane);
+        if (!live())
+            return { ok: false, reason: "pane 事务已撤回" };
         if (!v.modal)
             return { ok: false, reason: "确认框已不在（可能已在本地处理）" };
         if (pickerPolicy(cfg, cliOf(a), parseConfirmContext(v.screen), false).decision === "leave") {
@@ -5645,11 +6004,12 @@ export const startMirror = (deps) => {
         const pick = sess ?? bare;
         if (!pick)
             return { ok: false, reason: "确认框上找不到可按的 Yes 选项" };
-        const after = await pressModalIndex(a.tmuxPane, v, pick.index);
+        const after = await pressModalIndex(a.tmuxPane, v, pick.index, live);
         return after.modal
             ? { ok: false, reason: `按下 ${pick.index} 后确认框仍在` }
             : { ok: true, label: `${pick.index}. ${pick.label}` };
     };
+    const pressNativePicker = async (a, fingerprint, what, guard) => withPaneInput(a.tmuxPane, (live) => pressNativePickerUnlocked(a, fingerprint, what, live), { guard });
     return {
         attach,
         chatTargets,
@@ -5873,35 +6233,24 @@ export const startMirror = (deps) => {
             // to in this process lifetime (or any session after a reload) has an empty
             // in-memory slot but a perfectly good persisted binding. Without this, an
             // agent driving a cold sibling gets "not attached" for a live pane.
-            const a = byTarget.get(target) ?? (await restoreFromStore(target));
-            if (!a)
-                return { ok: false, reason: "no mirror attached for target" };
+            const permission = () => !opts?.guard || opts.guard();
+            const denied = { ok: false, retryable: true, reason: "inject permission withdrawn before respawn/binding" };
             if (!text.trim())
-                return { ok: false, reason: "empty text" };
-            // 出处改写要早于 inject: tail 可能在 promise resolve 之前就开出 turn。
-            // 守护进程注入的一轮 (回执 / peer / 定时任务 / graph) 不是人在 CLI 手敲的: 可见性
-            // 只由频道定 ("" 私聊才静默)。pendingFromCli 必须一并清 —— 它是粘性的, 不开轮的
-            // CLI 行 (spawn 时 model-select 按下的 `/model`) 会把它一直挂到下一轮, 让紧跟着的
-            // 注入轮被认成 CLI 发起, 公开频道里的回复因此被出处门吞掉。
-            a.pendingFromCli = false;
-            a.turnFromChat = true;
-            // 名册增量搭这趟车进去 —— 同伴派活 / 定时任务 / graph 步骤都走这里, 所以
-            // 一个从不被人直接说话的分身也能知道群里多了谁、少了谁。人说的话那一条
-            // 路径在 inbound.send 上挂 (dispatch 有自己的 inject)。
-            // 信封 (谁说的、私聊还是公开、回执怎么交) 同理挂在尾巴上; slash 命令按行解析,
-            // 多挂一段就不再是命令, 跳过。`pendingBriefQuery` 记的仍是不带信封的原话。
-            const envelope = text.trimStart().startsWith("/") ? "" : opts?.envelope ?? "";
-            const full = text + envelope + noticeSuffixFor(target, text);
-            // Pre-record so the tail's user-line emission is suppressed by the
-            // recentInjects dedupe (otherwise the user sees their own demo prompt
-            // echoed back as a quoted bubble).
-            rememberInject(full);
-            // 印章要早于 inject 落地 —— tail 是独立轮询的, 它可能在 inject 的 promise
-            // resolve 之前就看到 user 行并开出 turn, 那时归因必须已经在位。
-            // 印章随这一行走 (见 Seal): 行露面时才落成那一轮的出处 / 频道 / 问话。
-            pushSeal(a, { keys: sealKeys(full), at: Date.now(), query: text, from: opts?.from, channel: opts?.channel, origin, fresh: idleVerdict(target) === true });
+                return { ok: false, retryable: true, reason: "empty text" };
+            if (!permission())
+                return denied;
+            const a = byTarget.get(target) ?? (await restoreFromStore(target, undefined, permission));
+            if (!permission())
+                return denied;
+            if (!a)
+                return { ok: false, retryable: true, reason: "no mirror attached for target" };
             const sid = a.sessionId;
+            const generation = a.injectGen ?? 0;
+            const permitted = () => permission() && byTarget.get(target) === a && a.sessionId === sid && (a.injectGen ?? 0) === generation;
+            const probedPane = a.tmuxPane;
             const paneAlive = a.tmuxPane ? await paneUsable(a.tmuxPane, a.jsonlPath) : false;
+            if (!permitted() || a.tmuxPane !== probedPane)
+                return denied;
             // 同 dispatch: 只有刚生 / 刚重生的 pane 才要冷启动的宽限 —— 对一个热着、正忙的 pane 贴 `now`
             // 也按冷启动等 idle 至多 15s, 「不等不打断」就成了「晚 15–20s 才进」(handoff-owe 的竞态即此)。
             let fresh = a.justSpawned === true;
@@ -5912,7 +6261,16 @@ export const startMirror = (deps) => {
                 const resumeBaseline = listJsonls(dirname(a.jsonlPath));
                 const r = await spawnTmuxClaude({ cfg, log: log.child({ sub: "respawn-init", sessionId: sid }), resumeSessionId: sid, windowName: displayName(target) || target, cwdOverride: a.runningCwd, cli: backendForPath(a.jsonlPath).name, ...respawnSpec(a), systemPrompt: charterFor(target, { cwd: a.runningCwd, cli: backendForPath(a.jsonlPath).name }) });
                 if (!r.ok || !r.tmuxPane)
-                    return { ok: false, reason: `respawn failed: ${r.reason ?? "unknown"}` };
+                    return { ok: false, retryable: true, reason: `respawn failed: ${r.reason ?? "unknown"}` };
+                if (!permitted() || a.tmuxPane !== probedPane) {
+                    // This pane was born for an unsubmitted injection. Never kill the old
+                    // executor or bind the withdrawn birth. A failed cleanup is explicitly
+                    // uncertain and must be reconciled; it is not proof execution stopped.
+                    const cleanup = await runTmux(["kill-pane", "-t", r.tmuxPane]).catch(() => undefined);
+                    return { ...denied, ...(cleanup?.ok ? {} : { uncertain: true, retryable: false }), reason: cleanup?.ok
+                            ? "respawn permission withdrawn; new pane removed before injection, binding withheld"
+                            : `respawn permission withdrawn; binding withheld, reconcile new pane ${r.tmuxPane}` };
+                }
                 a.tmuxPane = r.tmuxPane;
                 a.tmuxSession = r.tmuxSession ?? a.tmuxSession;
                 if (r.cwd)
@@ -5925,18 +6283,34 @@ export const startMirror = (deps) => {
                 startMigrationWatcher(a, resumeBaseline, forkOf(a.jsonlPath));
                 fresh = true;
             }
-            // 同 dispatch: 在 inject 之前解除静默, 防止验证循环中 LLM 回复被永久吞掉。
-            a.muteUntilInject = false;
-            a.justSpawned = false;
+            if (!permitted())
+                return denied;
+            // Busy/queued retries must not consume notices or stamp a future turn.
+            // Render only after the pane lane grants delivery, then stamp exactly at
+            // the first permitted input. activePeerTurn still changes in bindLine.
+            const envelope = text.trimStart().startsWith("/") ? "" : opts?.envelope ?? "";
+            let full = text + envelope;
+            const beforeInput = () => {
+                a.pendingFromCli = false;
+                a.turnFromChat = true;
+                rememberInject(full);
+                pushSeal(a, { keys: sealKeys(full), at: Date.now(), query: text, from: opts?.from, channel: opts?.channel, origin, fresh: idleVerdict(target) === true });
+                a.muteUntilInject = false;
+                a.justSpawned = false;
+            };
             // 同 dispatch 的 /clear 与静默分叉跟随: self-handoff / 同伴 / 定时任务也走这里注入,
             // 漏了它 tail 就钉在旧 jsonl 上, 直到下一条人话经 dispatch 才把它拽回来。
             const clearing = isClearCommand(text);
             const preClearBaseline = clearing ? listJsonls(dirname(a.jsonlPath)) : undefined;
+            const injectPane = a.tmuxPane;
             const r = await inject({
-                text: full, images: [], cfg, log: log.child({ principal: target, sessionId: sid, sub: "init-demo" }),
+                text: full, images: [], cfg, guard: (phase) => permitted() && a.tmuxPane === injectPane && (!opts?.guard || opts.guard(phase)), log: log.child({ principal: target, sessionId: sid, sub: "init-demo" }),
                 sessionId: sid, jsonlPath: a.jsonlPath, tmuxTarget: a.tmuxPane, freshSpawn: fresh,
+                requireIdle: opts?.requireIdle ? () => idleVerdict(target) === true : undefined,
+                prepareText: () => (full = text + envelope + noticeSuffixFor(target, text)),
+                beforeInput,
             });
-            if (r.ok && a.tmuxPane) {
+            if (r.ok && a.tmuxPane && permitted()) {
                 if (preClearBaseline) {
                     a.clearRebind = { baseline: preClearBaseline };
                     startMigrationWatcher(a, preClearBaseline, jsonlIsPostClearChild, 0, true);
@@ -6252,6 +6626,7 @@ export const startMirror = (deps) => {
             clearInterval(paneDriftTimer);
             clearInterval(keepaliveTimer);
             clearInterval(pickerTimer);
+            maintenance.stop();
             for (const a of bySessionId.values()) {
                 if (a.outbound?.kind === "deferred")
                     clearTimeout(a.outbound.timer);
@@ -6269,6 +6644,8 @@ export const startMirror = (deps) => {
                 return a.convFrom.asker;
             return a?.speaker ? { who: a.speaker, chat: a.channel ?? baseOfKey(target) } : undefined;
         },
+        answerContext, prepareAnswer, takeAnswer, cancelAnswerPreparation, stopAnswerProgress, deliverAnswer,
+        setAnswerSilencer: (fn) => { silenceAnswer = fn; },
         currentChannel: (target) => {
             const a = byTarget.get(target);
             return a?.channel ?? baseOfKey(target);
@@ -6406,7 +6783,7 @@ export const startMirror = (deps) => {
             if (s) {
                 a.liveStream = s;
                 try {
-                    await client.replyStream(frame, streamId, withTagHeader(a.target, "…"), false);
+                    await (s.pending = client.replyStream(frame, streamId, withTagHeader(a.target, "…"), false));
                 }
                 catch (e) {
                     log.warn({ sessionId: a.sessionId, err: e.message }, "stream initial ack failed");
@@ -6503,6 +6880,8 @@ export const startMirror = (deps) => {
                     log.warn({ target: a.target, sessionId: sid, myGen, gen: a.injectGen }, "inject aborted — superseded by /stop or watchdog");
                     return;
                 }
+                if (!brief)
+                    pushSeal(a, { keys: sealKeys(effText), at: Date.now(), query: effText, channel: channel ?? baseOfKey(principal), speaker, fresh: true });
                 rememberInject(effText);
                 // 解除静默必须在 inject 之前: inject 内部的 freshSpawn 验证循环可达 10+s
                 // (paste-verify + settle + waitForCleared + retry), 而 LLM 的回复可能在 Enter
@@ -6511,9 +6890,11 @@ export const startMirror = (deps) => {
                 // 安全性: newSession 的 fresh pane 在 inject 前只写过 system/init (→ 无 item),
                 // 用户行有 isOwnInject 过滤 —— 提前解除不会泄漏脏数据。
                 a.muteUntilInject = false;
+                const injectPane = a.tmuxPane;
                 const r = await inject({
                     text: effText, images: effImages, cfg, log: log.child({ principal, sessionId: sid }),
                     sessionId: sid, jsonlPath: a.jsonlPath, tmuxTarget: a.tmuxPane, freshSpawn,
+                    guard: () => byTarget.get(a.target) === a && a.tmuxPane === injectPane && (a.injectGen ?? 0) === myGen,
                 });
                 if (!r.ok) {
                     if (s) {
@@ -6577,10 +6958,7 @@ export const startMirror = (deps) => {
                 // and surface a standalone "cleared" so the user gets explicit
                 // feedback (the skip-stream path otherwise leaves WeCom silent).
                 if (armMigration) {
-                    // cwd 不随回执下发 (/pwd 可查); slashAckFirstLine 连 tip 也省去 (与 /new 一致)。
-                    sendStandalone(a, cfg.wrc.mirror.slashAckFirstLine
-                        ? "cleared"
-                        : `cleared\n\n${randomTip()}`);
+                    sendStandalone(a, "cleared");
                     a.clearRebind = { baseline: preClearBaseline };
                     startMigrationWatcher(a, preClearBaseline, jsonlIsPostClearChild, 0, true);
                 }