wezard 2.6.2 → 2.6.4

package/dist/daemon/mirror-bridge.js

@@ -1,3 +1,5 @@
+import { finalId } from "./message-events.js";
+import { parseEnvelope } from "../shared/reminder.js";
 import { codexSessions, codexSessionForPane } from "../shared/codex.js";
 import { codexHookLaunchArgs, codexHookCommand } from "../shared/codex-hooks.js";
 import { fileURLToPath } from "node:url";
@@ -24,6 +26,9 @@ import { newStewardSpec, resumedStewardSpec } from "./steward-model.js";
 import { expandHome, sanitizeId } from "../shared/paths.js";
 import { augmentedPath } from "../shared/exec-path.js";
 import { sleep, truncateWithCount, mapLimit } from "../shared/std.js";
+import { withImageClipboard, pasteVerifiedImage } from "./image-input.js";
+import { createKeyedScheduler } from "../shared/keyed-scheduler.js";
+import { withPaneInput } from "./pane-input.js";
 import { activeBackends, resolveCliBackend, backendForPath, projectDirFor, projectDirsFor, } from "../shared/cli-backends.js";
 import { isModalPane, isAskqSubmitPage, parseModalOptions, pickModalAnswer, pickAutoAllowAnswer, parseConfirmContext, modalFingerprint, looksLikePicker } from "../shared/modal-pane.js";
 import { hasMirrorAskq, runMirrorAskqFlow, hasMirrorPlan, mootMirrorPlan, runMirrorPlanFlow, hasMirrorPicker, mootMirrorPicker, runMirrorPickerFlow } from "./approval.js";
@@ -37,12 +42,11 @@ import { hasRegistry, liveSessionPids, markTranscript, probeOf, sessionOnPane, s
 import { waitForIdle } from "./graph.js";
 import { wizardStore } from "./wizard.js";
 import { startSubagentWatch } from "./subagent-tail.js";
-import { knowsToolUse, recordTool, recordToolResult, recordMark, recordTurnStart, recordTurnQuery, recordTurnInject, recordTurnItem, recordTurnUsage, recordTurnClose, recordCloseOpenTurns, lastChannelOf, openTurnsOf, buildDetailUrl, buildChatUrl, roleUniq } from "./detail.js";
+import { getDetail, knowsToolUse, recordTool, recordToolResult, recordMark, recordTurnStart, recordTurnQuery, recordTurnInject, recordTurnItem, recordTurnUsage, recordTurnClose, recordCloseOpenTurns, lastChannelOf, openTurnsOf, buildDetailUrl, buildChatUrl, roleUniq } from "./detail.js";
 import { errText } from "./last-response.js";
-import { labelFor, tagOfKey, baseOfKey, keyOf, stripSigil, displayName, withTagHeader, withLinkedTagHeader, chatHead, headed, tagBadge, linkTags, parseTagHeader, MAX_BODY_LINKS, isInternalKey, sameBot } from "../shared/session-label.js";
+import { labelFor, tagOfKey, baseOfKey, keyOf, stripSigil, displayName, withTagHeader, withLinkedTagHeader, chatHead, headed, tagBadge, parseTagHeader, MAX_BODY_LINKS, isInternalKey, sameBot } from "../shared/session-label.js";
 import { splitMarkdown } from "../shared/md-chunk.js";
 import { isWxFrame } from "../shared/wx-text.js";
-import { randomTip } from "./tips.js";
 import { chatBaseOf, chatNameOf, listChatNames, parsePeerRef, peerAddress } from "./chat-name.js";
 import { stripAnsi, paneIsBusy, summarizeTail, lastAssistantText, lastReply, replyToPeer as replyToPeerIn, unwrapPasted, lastContextTokens, lastModel, cacheTouchMs, cacheTtlSec, keepaliveStamps, openKeepalivePing, lastUserTurn, talkRounds, openToolUses, renderDialog } from "./peers.js";
 import { keepalivePingSigs, isKeepalivePingText } from "../shared/keepalive.js";
@@ -524,7 +528,7 @@ const renderLine = (raw, deps) => {
     if (line.type === "attachment" && line.attachment?.type === "queued_command" && typeof line.attachment.prompt === "string") {
         const said = cleanUserText(line.attachment.prompt);
         const ts = Date.parse(line.timestamp ?? "");
-        return said ? [{ kind: "user_inject", said, ts: Number.isNaN(ts) ? Date.now() : ts }] : [];
+        return said ? [{ kind: "user_inject", said, eventId: parseEnvelope(line.attachment.prompt)?.eventId, ts: Number.isNaN(ts) ? Date.now() : ts }] : [];
     }
     const out = [];
     if (line.type === "user") {
@@ -574,8 +578,9 @@ const renderLine = (raw, deps) => {
             if (deps.isKeepalivePing?.(text))
                 return [{ kind: "keepalive_start", body: text }];
             // 自己注入的那一行不回显, 但要报个到: 它的印章 (谁说的、回复去哪) 在这一刻认领。
-            if (deps.isOwnInject(text))
-                return [{ kind: "user_query", body: unwrapPasted(c).trim(), said: text, ts: lineTs(line) }];
+            const eventId = c.includes('wezard="message-event"') ? parseEnvelope(c)?.eventId : undefined;
+            if (eventId || deps.isOwnInject(text))
+                return [{ kind: "user_query", eventId, body: unwrapPasted(c).trim(), said: text, ts: lineTs(line) }];
             const quoted = text.split("\n").map((l) => `> ${l}`).join("\n");
             // includeUser 只决定"渲不渲染", 不决定"算不算边界" —— quiet 的这一条照样发出,
             // onItem 消费完边界语义后自己丢掉。
@@ -586,11 +591,11 @@ const renderLine = (raw, deps) => {
             // 回显去重对得上; 记进详情页的则是带占位符的原样文本, 图本身不画。
             const raw = c.filter((b) => b?.type === "text").map((b) => b.text ?? "").join("\n");
             const text = cleanUserText(raw.replace(IMAGE_REF_RE, ""));
-            if (text && !deps.isOwnInject(text)) {
+            if (text && !parseEnvelope(raw)?.eventId && !deps.isOwnInject(text)) {
                 out.push({ kind: "user_text", body: cleanUserText(raw).split("\n").map((l) => `> ${l}`).join("\n"), quiet: !deps.includeUser, ts: lineTs(line) });
             }
             else {
-                out.push({ kind: "user_query", body: unwrapPasted(raw).trim(), said: text, ts: lineTs(line) });
+                out.push({ kind: "user_query", eventId: parseEnvelope(raw)?.eventId, body: unwrapPasted(raw).trim(), said: text, ts: lineTs(line) });
             }
         }
         else if (Array.isArray(c)) {
@@ -1159,10 +1164,10 @@ const detectModalPicker = async (target) => {
 const MODAL_PRESS_SETTLE_MS = 400;
 const MODAL_ARROW_SETTLE_MS = 150;
 const highlightedIndex = (screen) => parseModalOptions(screen).find((o) => o.selected)?.index;
-const pressModalIndex = async (pane, before, index) => {
+const pressModalIndex = async (pane, before, index, live = () => true) => {
     const fingerprint = modalFingerprint(before.screen);
     const current = await detectModalPicker(pane);
-    if (!current.modal || modalFingerprint(current.screen) !== fingerprint)
+    if (!live() || !current.modal || modalFingerprint(current.screen) !== fingerprint)
         return current;
     await runTmux(["send-keys", "-t", pane, String(index)]);
     await sleep(MODAL_PRESS_SETTLE_MS);
@@ -1171,6 +1176,8 @@ const pressModalIndex = async (pane, before, index) => {
         return after;
     // 数字键没关掉框: 把高亮挪到目标项。guard 上限盖过任何确认框的选项数。
     for (let guard = 0; guard < 8; guard++) {
+        if (!live())
+            return after;
         const cur = highlightedIndex(after.screen);
         if (cur === undefined || cur === index)
             break;
@@ -1180,7 +1187,7 @@ const pressModalIndex = async (pane, before, index) => {
         if (!after.modal || modalFingerprint(after.screen) !== fingerprint)
             return after;
     }
-    if (highlightedIndex(after.screen) !== index)
+    if (!live() || highlightedIndex(after.screen) !== index)
         return after; // 核不准, 绝不盲按
     await runTmux(["send-keys", "-t", pane, "Enter"]);
     await sleep(MODAL_PRESS_SETTLE_MS);
@@ -1301,7 +1308,7 @@ export const parseInputBox = (cap, styledLayout = cap) => {
         layout.pop();
     const footer = layout.length - 1;
     // Codex hides the shortcuts row while the composer contains text.
-    const shortcuts = /\? for shortcuts\s*$/u.test(layout[footer] ?? "");
+    const shortcuts = /(?:^|\s)\? for shortcuts(?:\s|$)/u.test(layout[footer] ?? "");
     if (shortcuts || (layout[footer] ?? "").includes("·")) {
         let status = shortcuts ? footer - 1 : footer;
         while (status >= 0 && !layout[status].trim())
@@ -1433,7 +1440,7 @@ const witnessFor = (target, homeDir, jsonlPath, live) => {
 // but the trailing Enter is eaten while the TUI is still initializing, so
 // the prompt sits typed-but-unsent. 校验策略见 injectViaTmuxText —— 以输入框
 // 整块为判据, 粘贴只在「确凿看见框仍是空的」时才重来。
-const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jsonlPath, bypassModalGuard = false) => {
+const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jsonlPath, bypassModalGuard = false, guard) => {
     const backendName = backend.name;
     log.info({ target, len: text.length, images: images.length, freshSpawn, backendName }, "mirror inject (tmux)");
     // 就绪门: pane 里得真有一个进入了交互态的 AI 会话, 才轮得到贴。先于 modal guard ——
@@ -1474,33 +1481,53 @@ const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jso
     // dispatch 已对 codebuddy 把 refs 合进 text (images 传空), 这里的
     // withImageRefs 是其它调用方直传 images 时的兜底 —— 幂等, 不会贴两份。
     if (backendName === "codebuddy") {
-        return injectViaTmuxText(target, withImageRefs(text, images), log, freshSpawn, witness);
+        return injectViaTmuxText(target, withImageRefs(text, images), log, freshSpawn, witness, guard);
     }
     // Pump images first via clipboard+C-v so each one is attached as a separate
     // image content block. Each C-v needs a brief settle for Claude Code's TUI
     // to read the clipboard before the next overwrite. Fresh spawn extends.
     const IMG_SETTLE_MS = freshSpawn ? 700 : 350;
-    for (const imgPath of images) {
-        const cb = await setMacClipboardImage(imgPath);
-        if (!cb.ok) {
-            log.warn({ imgPath, reason: cb.reason }, "mirror inject: clipboard set failed, skipping image");
-            continue;
+    const pumped = images.length ? await withImageClipboard(async () => {
+        for (const imgPath of images) {
+            const paste = async () => {
+                const cb = await setMacClipboardImage(imgPath);
+                if (!cb.ok)
+                    return cb;
+                if (guard && !guard("paste"))
+                    return { ok: false, reason: "image paste canceled by dispatch guard" };
+                const cv = await runTmux(["send-keys", "-t", target, "C-v"]);
+                return cv.ok ? { ok: true } : { ok: false, reason: `tmux send-keys C-v failed: ${cv.stderr.slice(-200)}` };
+            };
+            // Cold Codex can ignore C-v before its composer exists. Do not submit
+            // the text until the composer proves this attachment has landed.
+            const result = backendName === "codex"
+                ? await pasteVerifiedImage({ read: () => readInputBox(target), paste, valid: () => !guard || guard("paste") })
+                : await paste();
+            if (!result.ok) {
+                log.warn({ target, imgPath, reason: result.reason }, "mirror inject: image not confirmed, refusing text submission");
+                return result;
+            }
+            // Attachment rendering can precede the TUI finishing its paste handler.
+            // Preserve the key settle interval before another C-v or text paste.
+            await sleep(IMG_SETTLE_MS);
+            log.info({ target, imgPath, verified: backendName === "codex" }, "mirror inject: image attached");
         }
-        const cv = await runTmux(["send-keys", "-t", target, "C-v"]);
-        if (!cv.ok)
-            return { ok: false, reason: `tmux send-keys C-v failed: ${cv.stderr.slice(-200)}` };
-        await sleep(IMG_SETTLE_MS);
-    }
+        return { ok: true };
+    }) : { ok: true };
+    if (!pumped.ok)
+        return { ...pumped, uncertain: true };
     // Image-only message: TUI input box now holds the attached images; press
     // Enter and we're done. No fingerprint to verify (the input itself is binary
     // image refs, not text).
     if (!text) {
         if (images.length === 0)
             return { ok: true };
+        if (guard && !guard("submit"))
+            return { ok: false, reason: "submit canceled by dispatch guard" };
         const e = await runTmux(["send-keys", "-t", target, "Enter"]);
         return e.ok ? { ok: true } : { ok: false, reason: `tmux send-keys Enter failed: ${e.stderr.slice(-200)}` };
     }
-    return injectViaTmuxText(target, text, log, freshSpawn, witness);
+    return injectViaTmuxText(target, text, log, freshSpawn, witness, guard);
 };
 // 图片以 @<path> 文本提及的形式进会话 (codebuddy 的 tmux 路径、一切 spawn 路径)。
 // 提升为共享 helper: dispatch 侧的印章 / 回显去重 / turn 记录必须拿到与 inject
@@ -1522,7 +1549,7 @@ const withImageRefs = (text, images) => {
 // 证人不作声 (忙时排队、slash 命令、无注册表的后端) 才看框回没回到贴之前的样子。
 // 框认得出来时这条判据可信, 于是允许多补回车 (空框上的回车在 CLI 里是 no-op);
 // 每次补之前再问一遍证人, 已提交就不补。
-const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WITNESS) => {
+const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WITNESS, guard) => {
     // Warm pane: tight timings, low latency. Fresh spawn (claude --resume just
     // started, transcript still loading): extended timings — bracketed-paste
     // end can take 4-7s to be honored on a cold TUI. Only the fresh-spawn path
@@ -1559,7 +1586,7 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     const baseBody = alreadyTyped ? "" : preBox.body;
     /** 框里还是贴之前那样 (或彻底空了) = 我们的文本不在框里。 */
     const boxIntact = (b) => boxVerify && b.known && (b.body === "" || b.body === baseBody);
-    const loadAndPaste = () => pasteTmuxBuffer(target, text);
+    const loadAndPaste = () => pasteTmuxBuffer(target, text, guard ? () => guard("paste") : undefined);
     // 框认得出来 → 看它变没变; 认不出来 → 退回宽窗口找 headFp (长文本会换行,
     // 头部可能在框顶, 所以窗口要宽)。
     const sawLanded = async (timeoutMs) => {
@@ -1583,6 +1610,9 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     let pasteSeen = alreadyTyped;
     let pastedAt = Date.now();
     if (alreadyTyped) {
+        // Existing text is already exposed, even if permission was just withdrawn.
+        if (guard && !guard("paste"))
+            return { ok: false, uncertain: true, reason: "existing input submission canceled by dispatch guard" };
         log.warn({ target, headFp }, "mirror inject: 输入框里已有这段文本 (上次未提交) — 不重贴, 直接提交");
     }
     else {
@@ -1647,6 +1677,8 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
             await sleep(Math.max(0, POST_PASTE_SETTLE_FALLBACK_MS - (Date.now() - pastedAt)));
     }
     const sendEnter = async () => {
+        if (guard && !guard("submit"))
+            return { ok: false, reason: "submit canceled by dispatch guard" };
         const e = await runTmux(["send-keys", "-t", target, "Enter"]);
         return e.ok ? { ok: true } : { ok: false, reason: `tmux send-keys failed: ${e.stderr.slice(-200)}` };
     };
@@ -1749,6 +1781,8 @@ const injectViaSpawn = async (args) => {
         ...cfg.wrc.extraArgs,
     ];
     log.info({ sessionId, bin, len: text.length }, "mirror inject");
+    if (args.guard && !args.guard("submit"))
+        return { ok: false, reason: "spawn canceled by dispatch guard" };
     return new Promise((resolve) => {
         const proc = spawn(bin, cliArgs, {
             cwd,
@@ -1778,11 +1812,58 @@ const injectViaSpawn = async (args) => {
         });
     });
 };
-const inject = (args) => {
+const inject = async (args) => {
     const target = (args.tmuxTarget ?? "").trim();
-    if (!target)
-        return injectViaSpawn(args);
-    return injectViaTmux(target, args.text, args.images ?? [], args.log, args.freshSpawn ?? false, backendForPath(args.jsonlPath), args.jsonlPath, args.bypassModalGuard ?? false);
+    if (!target) {
+        if (args.requireIdle)
+            return { ok: false, retryable: true, reason: "idle delivery requires a live pane" };
+        try {
+            if (args.guard && !args.guard())
+                return { ok: false, retryable: true, reason: "spawn permission withdrawn" };
+            const text = args.prepareText?.() ?? args.text;
+            let activated = false;
+            const result = await injectViaSpawn({ ...args, text, guard: (phase) => {
+                    if (args.guard && !args.guard(phase))
+                        return false;
+                    if (phase && !activated) {
+                        activated = true;
+                        args.beforeInput?.();
+                    }
+                    return true;
+                } });
+            return result.ok ? result : { ...result, uncertain: true };
+        }
+        catch (error) {
+            return { ok: false, uncertain: true, reason: String(error) };
+        }
+    }
+    let exposed = false;
+    const classify = (result) => result.ok ? result
+        : result.uncertain || exposed ? { ...result, uncertain: true, retryable: false }
+            : { ...result, retryable: true };
+    try {
+        return classify(await withPaneInput(target, async (live) => {
+            // Busy and unknown are both a deferred delivery. Never hold the input
+            // lock while waiting for a model's whole turn to finish.
+            const idleApproved = !args.requireIdle || await args.requireIdle();
+            if (!idleApproved)
+                return { ok: false, reason: "target has no confirmed idle evidence" };
+            const text = args.prepareText?.() ?? args.text;
+            const guard = (phase) => {
+                if (!live() || (!exposed && !idleApproved) || (args.guard && !args.guard(phase)))
+                    return false;
+                if (phase && !exposed) {
+                    exposed = true;
+                    args.beforeInput?.();
+                }
+                return true;
+            };
+            return injectViaTmux(target, text, args.images ?? [], args.log, args.freshSpawn ?? false, backendForPath(args.jsonlPath), args.jsonlPath, args.bypassModalGuard ?? false, guard);
+        }, { guard: args.guard }));
+    }
+    catch (error) {
+        return classify({ ok: false, reason: String(error) });
+    }
 };
 const queues = new Map();
 /** Ceiling for one whole inject job (respawn + paste + submit verification).
@@ -1967,6 +2048,7 @@ export const startMirror = (deps) => {
                 turnRegistry.delete(k);
     };
     const TOOL_DETAIL_PREFIX = "TOOL_DETAIL|";
+    let eventFinalGate = () => true;
     const newTurnId = () => `t${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
     const newMarkId = () => `m${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
     const detailCardFor = (s, target) => {
@@ -1989,7 +2071,11 @@ export const startMirror = (deps) => {
         const content = s.acc;
         s.lastSent = content;
         try {
-            await client.replyStream(s.frame, s.streamId, withLinkedTagHeader(s.target, content || "…", chatTurnUrl(s.target, s.turnId), undefined, undefined, s.dest), false);
+            await (s.pending = (s.pending ?? Promise.resolve()).catch(() => undefined).then(async () => {
+                if (s.closed || s.dead)
+                    return;
+                await client.replyStream(s.frame, s.streamId, withLinkedTagHeader(s.target, content || "…", chatTurnUrl(s.target, s.turnId), undefined, undefined, s.dest), false);
+            }));
             log.debug({ turnId: s.turnId, len: content.length }, "stream flush ok");
         }
         catch (e) {
@@ -2030,6 +2116,7 @@ export const startMirror = (deps) => {
         if (!s.dead && body.trim()) {
             const card = detailCardFor(s, a.target);
             try {
+                await s.pending?.catch(() => undefined);
                 if (card) {
                     s.cardSent = true;
                     await client.replyStreamWithCard(s.frame, s.streamId, withLinkedTag(a, body, undefined, s.turnId), true, { templateCard: card });
@@ -2079,7 +2166,7 @@ export const startMirror = (deps) => {
     // 头挂 chat 详情页的票据: 本轮那条 turn。没有活 turn 可挂 → undefined, 头退回裸
     // `emoji #tag` (withLinkedTagHeader 自己兜)。
     const chatTurnUrl = (target, turnId) => turnId
-        ? buildChatUrl(cfg.daemon.detailPublicBase, cfg.daemon.host, cfg.daemon.port, turnId, roleUniq(target))
+        ? buildChatUrl(cfg.daemon.detailPublicBase, cfg.daemon.host, cfg.daemon.port, turnId, roleUniq(target), target)
         : undefined;
     // `[mirror]` / `[wezard]` 系统提示不是答给谁的话, 不标方向。
     const withLinkedTag = (a, content, seq, turnId) => withLinkedTagHeader(a.target, content, chatTurnUrl(a.target, turnId ?? a.briefTurnId), seq, /^\[(mirror|wezard)\]/.test(content.trim()) ? undefined : a.replyTo, a.channel || undefined);
@@ -2094,15 +2181,21 @@ export const startMirror = (deps) => {
     const sendStandalone = (a, content) => {
         if (!hasVisibleBody(content))
             return;
+        if (answerSilent(a))
+            return;
         if (isPrivate(a) && !/^\[(mirror|wezard)\]/.test(content.trim()))
             return;
         const chatId = replyChatId(a);
-        const turnId = a.briefTurnId; // 推送是排队异步的, 到发出时 turn 早已收口
+        const turnId = a.briefTurnId ?? a.liveStream?.turnId; // 推送是排队异步的, 到发出时 turn 早已收口
         const pieces = splitMarkdown(content, Math.max(200, cfg.wrc.mirror.chunkBytes - TAG_HEADER_BUDGET));
         const chunks = pieces.map((p, i) => withLinkedTag(a, p, pieces.length > 1 ? `${i + 1}/${pieces.length}` : undefined));
         a.standalonePending = a.standalonePending
             .then(async () => {
+            if (silenceAnswer(a.target, turnId ?? ""))
+                return;
             for (const c of chunks) {
+                if (silenceAnswer(a.target, turnId ?? ""))
+                    return;
                 try {
                     const ack = await client.sendMessage(chatId, { msgtype: "markdown", markdown: { content: c } });
                     log.info({ sessionId: a.sessionId, turnId, chatId, len: c.length, ack: JSON.stringify(ack ?? null).slice(0, 300) }, "standalone pushed");
@@ -2119,9 +2212,11 @@ export const startMirror = (deps) => {
         if (!hasVisibleBody(content))
             return;
         const chatId = replyChatId(a);
-        const turnId = a.briefTurnId;
+        const turnId = a.briefTurnId ?? a.liveStream?.turnId;
         a.standalonePending = a.standalonePending
             .then(async () => {
+            if (silenceAnswer(a.target, turnId ?? ""))
+                return;
             try {
                 await client.sendMessage(chatId, { msgtype: "markdown", markdown: { content } });
                 log.info({ sessionId: a.sessionId, turnId, chatId, len: content.length }, "raw pushed");
@@ -2310,7 +2405,7 @@ export const startMirror = (deps) => {
             // sees the bubble; subsequent items grow it as today.
             void (async () => {
                 try {
-                    await client.replyStream(frame, streamId, withTagHeader(a.target, "…"), false);
+                    await (s.pending = client.replyStream(frame, streamId, withTagHeader(a.target, "…"), false));
                 }
                 catch (e) {
                     log.warn({ sessionId: a.sessionId, err: e.message }, "stream initial ack failed");
@@ -2415,11 +2510,15 @@ export const startMirror = (deps) => {
         const b = a.briefBubble;
         const turnId = a.briefTurnId;
         // 收口后这一路全部失效: 气泡要么已 done, 要么 turn 已经换人/清空。
-        if (!text || !b || b.done || !turnId || a.briefConcluded)
+        if (!text || !b || b.done || !turnId || a.briefConcluded || answerSilent(a))
             return;
         a.cotLastSent = text;
         try {
-            await client.replyStream(b.frame, b.streamId, briefLine(a, turnId, `\`${text}\``), false);
+            await (b.pending = (b.pending ?? Promise.resolve()).catch(() => undefined).then(async () => {
+                if (b.done || a.briefBubble !== b || a.briefTurnId !== turnId || answerSilent(a))
+                    return;
+                await client.replyStream(b.frame, b.streamId, briefLine(a, turnId, `\`${text}\``), false);
+            }));
         }
         catch (e) {
             log.debug({ sessionId: a.sessionId, turnId, err: e.message }, "brief: cot refresh failed");
@@ -2450,7 +2549,231 @@ export const startMirror = (deps) => {
     // `[mirror]` 系统提示 —— 它们都不走这道门。
     // 只在 brief 下生效: 抑制的前提是详情页兜得住内容, 而 turn store 只有 brief 在写。
     // 私聊轮 (wizard 之间, 非 public) 同理: 它的回复属于那场私聊, 只进双方的 rolepage。
-    const turnSilent = (a) => isPrivate(a) || (cfg.wrc.mirror.brief && cfg.wrc.mirror.chatOriginOnly && a.turnFromChat === false);
+    let silenceAnswer = () => false;
+    const answerSilent = (a) => silenceAnswer(a.target, a.briefTurnId ?? a.liveStream?.turnId ?? "");
+    const turnSilent = (a) => answerSilent(a) || isPrivate(a) || (cfg.wrc.mirror.brief && cfg.wrc.mirror.chatOriginOnly && a.turnFromChat === false);
+    const formatFinal = (target, turn, channel, body) => {
+        const pieces = splitMarkdown(body, Math.max(200, cfg.wrc.mirror.chunkBytes - TAG_HEADER_BUDGET));
+        return pieces.map((text, n) => withLinkedTagHeader(target, text, chatTurnUrl(target, turn), pieces.length > 1 ? `${n + 1}/${pieces.length}` : undefined, undefined, channel));
+    };
+    const finalProgress = new Map();
+    const settleFinalProgress = async (id) => {
+        await finalProgress.get(id)?.catch(() => undefined);
+        finalProgress.delete(id);
+    };
+    const queueFinal = (target, turn, channel, body, eventId, bubble) => {
+        if (!deps.events || !channel || !body.trim())
+            return undefined;
+        const revision = finalId(eventId || turn, channel, body);
+        const id = finalId(eventId || turn, channel, revision);
+        const chunks = formatFinal(target, turn, channel, body);
+        if (bubble?.pending)
+            finalProgress.set(id, bubble.pending);
+        deps.events.delivery({ id, eventId, target, turn, channel, body, revision, chunks,
+            ...(bubble && !bubble.done ? { stream: { frame: bubble.frame, id: bubble.streamId, expires: bubble.expires ?? Date.now() } } : {}) });
+        if (bubble) {
+            bubble.done = true;
+            clearTimeout(bubble.hardTimer);
+        }
+        return id;
+    };
+    const recoverEventFinal = (event, bubble) => {
+        if (!event.result || event.interjected || event.canceled)
+            return;
+        const turn = event.turn || event.id;
+        const record = getDetail(turn);
+        if (!record)
+            recordTurnStart({ id: turn, eventId: event.id, target: event.target,
+                userQuery: event.payload.text, createdAt: event.originalAt ?? event.at, channel: event.channel,
+                speaker: event.payload.human ? event.speaker : undefined, from: event.payload.peer?.from });
+        if (record?.kind !== "turn" || !record.items.some((x) => x.t === "text" && x.final && x.body === event.result.body))
+            recordTurnItem(turn, { t: "text", final: true, body: event.result.body, ts: event.result.at });
+        recordTurnClose(turn);
+        if (!event.turn)
+            deps.events?.bind(event.id, turn);
+        const parent = event.replyTo?.kind === "chat" ? deps.events?.get(event.replyTo.turn) : undefined;
+        if (parent && event.channel === parent.channel) {
+            const original = deps.events.continueResult(event.id);
+            if (!original)
+                return;
+            if (eventFinalGate({ ...original, awaitingContinuation: false }))
+                deps.events.defer(original.id, false);
+            const fresh = deps.events.get(original.id);
+            if (fresh.replyTo?.kind === "chat")
+                recoverEventFinal(fresh, bubble);
+            else if (eventFinalGate(fresh))
+                queueFinal(fresh.target, fresh.turn || fresh.id, fresh.channel, event.result.body, fresh.id, bubble);
+        }
+        else if (event.channel && eventFinalGate(event))
+            queueFinal(event.target, turn, event.channel, event.result.body, event.id, bubble);
+    };
+    const answerBubbles = new Map();
+    const answerLine = (held, text) => withLinkedTagHeader(held.receiver, text, chatTurnUrl(held.receiver, held.sourceTurn), undefined, undefined, held.channel);
+    // Serialise the old owner's in-flight refresh, reset, progress and final.
+    // A delayed ACK must never let an earlier writer overtake the new owner.
+    const writeAnswerProgress = (held, text) => {
+        held.pending = held.pending.catch(() => undefined).then(async () => {
+            if (!held.active || held.stopped || !held.bubble || held.bubble.done)
+                return;
+            await client.replyStream(held.bubble.frame, held.bubble.streamId, answerLine(held, text), false);
+        }).catch((e) => log.warn({ err: errText(e) }, "answer transfer progress refresh failed"));
+    };
+    const updateAnswerProgress = (a, item) => {
+        // Queued metadata is not authority: only the input boundary activates a task.
+        const held = a.activePeerTurn ? answerBubbles.get(a.activePeerTurn) : undefined;
+        if (!held || held.receiver !== a.target || held.stopped || held.bubble?.done)
+            return;
+        const raw = item.kind === "tool_use" ? cotToolLabel(item.calls)
+            : item.kind === "thinking" || (item.kind === "text" && item.final !== true) ? item.body : "";
+        const line = cotLine(raw);
+        if (!line)
+            return;
+        held.progress = line;
+        if (!held.active)
+            return;
+        if (held.timer)
+            return;
+        held.timer = setTimeout(() => {
+            held.timer = undefined;
+            if (held.progress)
+                writeAnswerProgress(held, `\`${held.progress}\``);
+        }, COT_FLUSH_MS);
+    };
+    const answerContext = (target) => {
+        const a = byTarget.get(target);
+        if (!a || a.briefConcluded || a.briefIsSlash || isPrivate(a) || a.turnFromChat === false)
+            return undefined;
+        const turn = a.briefTurnId ?? a.liveStream?.turnId;
+        return turn ? { turn, channel: a.channel ?? baseOfKey(target), prefix: "" } : undefined;
+    };
+    const prepareAnswer = (id, source, expectedTurn, receiver, channel) => {
+        const a = byTarget.get(source);
+        if (!a || (a.briefTurnId ?? a.liveStream?.turnId) !== expectedTurn || answerBubbles.has(id))
+            return false;
+        if ((!a.briefBubble || a.briefBubble.done) && (!a.liveStream || a.liveStream.closed || a.liveStream.dead))
+            return false;
+        answerBubbles.set(id, {
+            source, receiver, sourceTurn: expectedTurn, channel, active: false, stopped: false,
+            bubble: a.briefBubble, stream: a.liveStream, pending: Promise.resolve(),
+        });
+        return true;
+    };
+    const cancelAnswerPreparation = (id) => {
+        const held = answerBubbles.get(id);
+        if (held && !held.active)
+            answerBubbles.delete(id);
+    };
+    const stopAnswerProgress = (id) => {
+        const held = answerBubbles.get(id);
+        if (!held)
+            return;
+        held.stopped = true;
+        clearTimeout(held.timer);
+        held.timer = undefined;
+    };
+    const takeAnswer = async (id, target, expectedTurn, receiver, channel) => {
+        const a = byTarget.get(target);
+        const held = answerBubbles.get(id);
+        if (!held || held.active || held.source !== target || held.sourceTurn !== expectedTurn || held.receiver !== receiver || held.channel !== channel)
+            return { taken: false, cleared: false };
+        const sameTurn = a && (a.briefTurnId ?? a.liveStream?.turnId) === expectedTurn;
+        if (sameTurn) {
+            clearCot(a);
+            a.cotLastSent = undefined;
+            if (a.standaloneBuf) {
+                clearTimeout(a.standaloneBuf.timer);
+                a.standaloneBuf = undefined;
+            }
+            // Only this source turn becomes private; a concurrent new human turn is untouched.
+            a.channel = "";
+        }
+        const s = held.stream;
+        if (s && !s.closed && !s.dead) {
+            s.closed = true;
+            clearTimeout(s.flushTimer);
+            clearTimeout(s.idleTimer);
+            clearTimeout(s.hardTimer);
+            // Read the current chain, not prepare's snapshot: source may have flushed during injection.
+            held.bubble = { frame: s.frame, streamId: s.streamId, done: false, pending: s.pending };
+            if (a?.liveStream === s)
+                a.liveStream = undefined;
+        }
+        else if (s)
+            held.bubble = undefined;
+        const b = held.bubble;
+        held.active = true;
+        if (!b || b.done)
+            return { taken: true, cleared: false };
+        clearTimeout(b.hardTimer);
+        if (a?.briefBubble === b)
+            a.briefBubble = undefined;
+        let cleared = false;
+        held.pending = (b.pending ?? Promise.resolve()).catch(() => undefined).then(async () => {
+            if (b.done)
+                return;
+            await client.replyStream(b.frame, b.streamId, answerLine(held, "…"), false);
+            cleared = true;
+        });
+        try {
+            await held.pending;
+        }
+        catch (e) {
+            cleared = false;
+            log.warn({ id, err: errText(e) }, "answer transfer reset not acknowledged");
+        }
+        // Keep delivery possible after a reset error; reset never carries the final answer.
+        held.pending = held.pending.catch(() => undefined);
+        if (!held.stopped && held.progress)
+            writeAnswerProgress(held, `\`${held.progress}\``);
+        return { taken: true, cleared };
+    };
+    const deliverAnswer = async (id, target, turn, channel, _prefix, body, standalone, frozen = false) => {
+        const held = answerBubbles.get(id);
+        const text = body.trim();
+        const content = frozen ? body : withLinkedTagHeader(target, text, chatTurnUrl(target, turn), undefined, undefined, channel);
+        stopAnswerProgress(id);
+        if (held?.bubble && !held.bubble.done) {
+            held.bubble.done = true;
+            clearTimeout(held.timer);
+            await held.pending;
+            try {
+                // Failure closes progress first; the terminal explanation is a standalone message.
+                const progress = withLinkedTagHeader(target, "回答已转交", chatTurnUrl(target, turn), undefined, undefined, channel);
+                const ack = frozen && !standalone
+                    ? await deps.sendFrozen(channel, content, { frame: held.bubble.frame, id: held.bubble.streamId })
+                    : await client.replyStream(held.bubble.frame, held.bubble.streamId, standalone ? progress : content, true);
+                if (!standalone) {
+                    answerBubbles.delete(id);
+                    return ack;
+                }
+            }
+            catch (e) {
+                const ack = e && typeof e === "object" ? e : undefined;
+                // Only a structured non-zero server ACK proves the stream frame was
+                // rejected. Timeout/disconnect errors are ambiguous: standalone retry
+                // could publish the same final answer twice, so let the caller persist
+                // `uncertain` and require a human resend instead.
+                const rejected = !!ack && typeof ack.headers === "object" && !!ack.headers && typeof ack.errcode === "number" && ack.errcode !== 0 && typeof ack.errmsg === "string";
+                if (!rejected && !standalone) {
+                    answerBubbles.delete(id);
+                    throw e;
+                }
+                if (!rejected) {
+                    log.warn({ id, err: errText(e) }, "answer transfer progress close acknowledgement uncertain; continuing with the one standalone terminal explanation");
+                    // In standalone mode this stream only closes progress; it never
+                    // carries the final body, so sending the terminal explanation once
+                    // remains necessary even when progress-close ACK is ambiguous.
+                }
+                else {
+                    log.warn({ id, err: errText(e), errcode: ack.errcode }, "answer transfer stream was explicitly rejected; standalone fallback");
+                }
+            }
+        }
+        const ack = frozen ? await deps.sendFrozen(channel, content)
+            : await client.sendMessage(channel.replace(/^(user|chat|group):/, ""), { msgtype: "markdown", markdown: { content } });
+        answerBubbles.delete(id);
+        return ack;
+    };
     // 收口一条 loading 气泡: finish=true 写入最终内容, 只生效一次。发送失败退回 standalone。
     // raw=true skips withTagHeader (used when content already contains the linked tag header).
     // WeCom 客户端收到 finish=true 后仍有打字机动画要播放, 如果紧接着就下发
@@ -2492,6 +2815,7 @@ export const startMirror = (deps) => {
         a.briefHadTool = false;
         a.briefConcluded = false;
         a.briefLastText = undefined;
+        a.cotLastSent = undefined;
         clearCot(a); // turn 级状态 —— 进度行跟着气泡走, 不能跨 turn 残留
         log.info({ sessionId: a.sessionId, turnId: q.turnId, isSlash: q.isSlash }, "brief: turn started");
     };
@@ -2525,6 +2849,7 @@ export const startMirror = (deps) => {
     const openingOf = (a) => {
         const t = a.jsonlPath ? lastUserTurn(a.jsonlPath) : undefined;
         const env = t?.env;
+        a.activeEventId = env?.eventId;
         if (!env)
             return undefined;
         const home = baseOfKey(a.target);
@@ -2586,7 +2911,7 @@ export const startMirror = (deps) => {
         return undefined;
     };
     /** 本轮落 turn 记录的频道字段。 */
-    const channelFields = (a) => ({ channel: a.channel ?? baseOfKey(a.target), speaker: a.speaker });
+    const channelFields = (a) => ({ channel: a.channel ?? baseOfKey(a.target), speaker: a.speaker, eventId: a.activeEventId });
     /** 私聊轮: 回复只落 turn 记录。 */
     const isPrivate = (a) => a.channel === "";
     /** 本轮回复该推去的 chatId。 */
@@ -2612,9 +2937,9 @@ export const startMirror = (deps) => {
     };
     /** 露面的这一行认领它的印章, 先注入的先认。CLI 把排队的几句并成一行时, 包含在里面的都算
      *  露过面, 出处取第一枚。认不出 = undefined。 */
-    const takeSeal = (a, said, pick = () => true) => {
+    const takeSeal = (a, said, pick = () => true, eventId) => {
         const t = said.trim();
-        const hit = (x) => pick(x) && x.keys.some((k) => k === t || (k.length >= 8 && t.includes(k)));
+        const hit = (x) => pick(x) && (eventId ? x.eventId === eventId : !x.eventId && x.keys.some((k) => k === t || (k.length >= 8 && t.includes(k))));
         const seals = a.seals ?? [];
         const hits = seals.filter(hit);
         // CLI 把排队的几句并成一行, 这一轮只能有一个去向: 里面有私聊的那句就是私聊 —— 它的答复不能
@@ -2635,7 +2960,11 @@ export const startMirror = (deps) => {
      *  `at` = 那一行落盘的时刻: 排队的那句从这一刻才开始被处理, 轮次的起点以它为准; 闲时当场接上就是投递那一刻。 */
     const activateDispatch = (a, s, at = s.at) => {
         const q = s.turn;
+        if (a.briefTurnId && a.briefTurnId !== q.turnId)
+            closeBriefTurn(a);
+        a.activeEventId = s.eventId;
         s.activated = true;
+        a.activePeerTurn = undefined;
         a.queryEpoch = (a.queryEpoch ?? 0) + 1; // WeCom 侧的新一轮同样是 query 边界
         a.turnFromChat = true; // 出处确凿: 这一轮有 frame, 群里就是它的主场
         a.pendingFromCli = false; // 人改从聊天里说话了, 之前那条 CLI 输入不再是出处
@@ -2645,9 +2974,7 @@ export const startMirror = (deps) => {
         a.pendingBriefQuery = undefined;
         a.pendingChannel = { channel: s.channel ?? baseOfKey(a.target), speaker: s.speaker, at: Date.now() };
         consumeChannel(a, true, undefined);
-        recordTurnStart({ id: q.turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), initialModel: a.model || undefined, initialEffort: a.effort || undefined, cwd: a.runningCwd || undefined, userQuery: s.query.trim() || undefined, createdAt: at, ...channelFields(a) });
-        if (a.briefTurnId)
-            closeBriefTurn(a);
+        recordTurnStart({ id: q.turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), initialModel: a.model || undefined, initialEffort: a.effort || undefined, cwd: a.runningCwd || undefined, userQuery: s.query.trim() || undefined, createdAt: (s.eventId ? deps.events?.get(s.eventId)?.originalAt : undefined) ?? at, ...channelFields(a) });
         openBriefTurn(a, q);
     };
     /** 一句插话记进它插进的那一轮: 出处、频道、发话人都取它自己的印章 (没写频道 = 在 home 里开口)。 */
@@ -2655,16 +2982,21 @@ export const startMirror = (deps) => {
     /** `attachment.queued_command` 露面: 那句被正在跑的这一轮中途吃进去了。认领它的印章记成插话。
      *  人从聊天里说的那句 (印章带预建的轮) 不在这里认: 它已有自己的轮次记录。认不出 (人在 CLI 里
      *  忙时敲的) 不记 —— 说不清是谁、在哪个频道说的。 */
-    const interject = (a, said, ts) => {
+    const interject = (a, said, ts, eventId) => {
         if (!a.briefTurnId)
             return;
-        const s = takeSeal(a, said, (x) => !x.turn);
+        const s = takeSeal(a, said, (x) => !x.turn, eventId);
         if (s)
             injectInto(a.briefTurnId, a, s, ts);
     };
     /** 一行注入露面了: 把它的印章落成下一轮的出处 / 频道。返回认领到的印章。`ts` = 那一行落盘的时刻。 */
-    const bindLine = (a, said, ts) => {
-        const s = takeSeal(a, said);
+    const bindLine = (a, said, ts, eventId) => {
+        const recovered = eventId ? deps.events?.get(eventId) : undefined;
+        const s = takeSeal(a, said, undefined, eventId) ?? (recovered?.target === a.target ? {
+            eventId, keys: [], at: recovered.at, query: recovered.payload.text, channel: recovered.channel,
+            speaker: recovered.payload.human ? recovered.speaker : undefined, from: recovered.payload.peer?.from,
+            fresh: recovered.priority === "normal" || idleVerdict(a.target) === true,
+        } : undefined);
         if (!s)
             return undefined;
         if (s.turn) {
@@ -2680,19 +3012,28 @@ export const startMirror = (deps) => {
         }
         if (a.briefTurnId)
             closeBriefTurn(a);
+        a.activeEventId = s.eventId;
         const now = Date.now();
+        a.activePeerTurn = s.from?.kind === "peer" ? s.from.turn : undefined;
         a.pendingFrom = s.from ? { from: s.from, at: now } : undefined;
         a.pendingOrigin = s.origin ? { origin: s.origin, at: now } : undefined;
         // 没写频道的注入 (graph 步骤 / 手动 inject) 等同在 home 里开口: 印章就是全部出处, 不沿用上一轮的。
-        a.pendingChannel = { channel: s.channel ?? baseOfKey(a.target), at: now };
+        a.pendingChannel = { channel: s.channel ?? baseOfKey(a.target), speaker: s.speaker, at: now };
         a.pendingBriefQuery = s.query;
         a.pendingBriefAt = ts;
+        if (!cfg.wrc.mirror.brief) {
+            consumeChannel(a, false, consumeFrom(a));
+            if (a.liveStream && !a.liveStream.closed)
+                a.liveStream.dest = s.channel ?? baseOfKey(a.target);
+        }
         return s;
     };
-    const startBriefTurn = async (a, frame, streamId, isSlash = false, userQuery = "", channel, speaker) => {
+    const startBriefTurn = async (a, frame, streamId, isSlash = false, userQuery = "", channel, speaker, eventId) => {
         const turnId = newTurnId();
         // hardTimer 兜底: turn 若无终句 / turn_end 收口 (卡死/漏收), 到点仍收气泡。
-        const bubble = { frame, streamId, done: false };
+        const bubble = { frame, streamId, done: false, expires: (eventId ? deps.events?.get(eventId)?.at ?? Date.now() : Date.now()) + HARD_TIMEOUT_MS };
+        if (eventId)
+            deps.events?.bind(eventId, turnId);
         const q = { turnId, bubble, isSlash };
         // 微信帧不挂: 没有 stream 窗口要赶, 气泡等终句来了再一次发出 (见 openStream 同一条)。
         if (!isWxFrame(frame))
@@ -2703,29 +3044,23 @@ export const startMirror = (deps) => {
                 const live = a.briefBubble === bubble && !a.briefConcluded;
                 void finishBubble(a, bubble, briefLine(a, turnId, live ? STILL_WORKING : "", channel), true);
             }, HARD_TIMEOUT_MS);
-        const seal = { keys: sealKeys(userQuery), at: Date.now(), query: userQuery, channel, speaker, fresh: true, turn: q };
+        const seal = { eventId, keys: sealKeys(userQuery), at: Date.now(), query: userQuery, channel, speaker, fresh: true, turn: q };
         // 对方闲着 → 这一句就是下一轮, 当场接上。正忙 (在跑别人的回执 / 派活 / 上一句) 就先排着:
         // 那一轮的回复不能流进这一句的气泡, 等它在 transcript 里露面再接 (bindLine)。turn 记录
         // 先建好, ack 里的链接点得开。斜杠命令的行未必露面, 当场接。
         const queued = !isSlash && idleVerdict(a.target) === false;
         pushSeal(a, seal);
         if (queued)
-            recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), initialModel: a.model || undefined, initialEffort: a.effort || undefined, cwd: a.runningCwd || undefined, userQuery: userQuery.trim() || undefined, channel: channel ?? baseOfKey(a.target), speaker });
+            recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), initialModel: a.model || undefined, initialEffort: a.effort || undefined, cwd: a.runningCwd || undefined, userQuery: userQuery.trim() || undefined, eventId, createdAt: eventId ? deps.events?.get(eventId)?.originalAt : undefined, channel: channel ?? baseOfKey(a.target), speaker });
         else
             activateDispatch(a, seal);
-        // 新消息 = 对话边界: 立刻收掉上一 turn, 新 turn 直接激活、不排队。收口语义见
-        // closeBriefTurn: 有正文收入旧气泡, 没正文不写一个字 (绝不因边界结束凭空新发/
-        // 覆盖消息)。旧 turn 在 CLI 侧的剩余产出自然流入新气泡 —— "新回复走最新气泡"
-        // 正是这个语义。代价是旧 turn 页提前标完、尾部 item 记到新 turn 名下, 但远小于
-        // 排队的代价: 排队 turn 的 frame 在前一个长 turn 期间 (可达数分钟) 过期, 激活后
-        // replyStream 全被 WeCom 拒收 (#stream 事故的静默根因)。所以只在前面真有别人的行排着时
-        // 才排 (见上): 接上时气泡若已过期, 正文走 standalone (concludeBriefTurn)。
+        // Durable normal inputs arrive only after the preceding full turn; expired bubbles use the final outbox standalone path.
         // ack 即详情链接。URL 的三个入参 (turnId / target / host) 在收消息这一刻全部已知 ——
         // turnId 是本地生成的, 详情页记录也已在 recordTurnStart 建好, 所以不必等 CLI 产出,
         // 也不必猜后端: codebuddy 那种几十秒后才落盘的轮, 入口从第一秒就在。
         // 尾随 `…` 表示"正文还没到", 正文到位时整条内容被 `链接 正文` 覆盖。
         try {
-            await client.replyStream(frame, streamId, briefLine(a, turnId, "…", channel), false);
+            await (bubble.pending = client.replyStream(frame, streamId, briefLine(a, turnId, "…", channel), false));
         }
         catch (e) {
             log.warn({ sessionId: a.sessionId, turnId, err: e.message }, "brief: turn ack failed");
@@ -2738,8 +3073,11 @@ export const startMirror = (deps) => {
         if (a.channelSeeded)
             return false;
         const head = (t) => (t ?? "").replace(/\s+/g, " ").trim().slice(0, 60);
-        const said = head(a.jsonlPath ? lastUserTurn(a.jsonlPath)?.text : undefined);
-        const r = said ? openTurnsOf(a.target, a.sessionId).find((t) => head(t.userQuery) === said) : undefined;
+        const opening = a.jsonlPath ? lastUserTurn(a.jsonlPath) : undefined;
+        const said = head(opening?.text);
+        const eventId = opening?.env?.eventId;
+        const r = openTurnsOf(a.target, a.sessionId).find((t) => eventId ? t.eventId === eventId : !!said && head(t.userQuery) === said);
+        a.activeEventId = eventId;
         if (!r)
             return false;
         a.channelSeeded = true;
@@ -2749,6 +3087,7 @@ export const startMirror = (deps) => {
         a.channel = r.channel === undefined || r.channel === baseOfKey(a.target) ? undefined : r.channel;
         a.speaker = r.speaker;
         a.convFrom = r.from;
+        a.activePeerTurn = r.from?.kind === "peer" ? r.from.turn : undefined;
         a.replyTo = publicPeer(r.from);
         a.turnFromChat = a.turnFromChat ?? true;
         a.briefTurnId = r.id;
@@ -2784,6 +3123,8 @@ export const startMirror = (deps) => {
         const from = fresh ?? a.convFrom;
         recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), initialModel: a.model || undefined, initialEffort: a.effort || undefined, cwd: a.runningCwd || undefined, userQuery: query || opened || undefined, origin: consumeOrigin(a), from, ...channelFields(a), ...(query && at ? { createdAt: at } : {}) });
         a.briefTurnId = turnId;
+        if (a.activeEventId)
+            deps.events?.bind(a.activeEventId, turnId);
         a.briefBubble = undefined;
         a.briefIsSlash = false;
         a.briefHadTool = false;
@@ -2826,25 +3167,26 @@ export const startMirror = (deps) => {
             return;
         if (!body.trim())
             return;
-        if (isDuplicateConclusion(a, body)) {
+        if (!a.activeEventId && isDuplicateConclusion(a, body)) {
             a.briefConcluded = true; // 本轮已"定稿", 只是不投递
             log.info({ sessionId: a.sessionId, turnId, epoch: a.queryEpoch ?? 0 }, "brief: duplicate conclusion suppressed");
             return;
         }
+        const event = a.activeEventId ? deps.events?.get(a.activeEventId) : undefined;
+        if (event)
+            deps.events.result(event.id, body, finalId(event.id, event.channel, body), turnId);
+        if (!answerSilent(a) && !turnSilent(a) && (!event || eventFinalGate(event))) {
+            if (event)
+                recoverEventFinal(deps.events.get(event.id), a.briefBubble);
+            else
+                queueFinal(a.target, turnId, a.channel ?? baseOfKey(a.target), body, undefined, a.briefBubble);
+        }
+        // The durable result/outbox must exist before this in-memory dedup bit advances.
         a.briefConcluded = true;
         a.lastConcludedBody = body;
         a.lastConcludedEpoch = a.queryEpoch ?? 0;
         a.lastConcludedAt = Date.now();
-        if (a.briefBubble && !a.briefBubble.done) {
-            void finishBriefBubble(a, briefLine(a, turnId, linkTags(a.target, body)), true);
-        }
-        else if (turnSilent(a)) {
-            // CLI 手敲的一轮: 终稿只留在 turn store, 详情页照常实时可见。
-            log.info({ sessionId: a.sessionId, turnId }, "brief: CLI-origin conclusion kept out of chat");
-        }
-        else {
-            sendStandalone(a, body); // 详情链接由 withLinkedTag 统一前缀, 不在这里拼
-        }
+        clearCot(a);
         // 只保留当前 turn: 其余仍开着的 turn 记录是漏收的 close, 一并扫掉。
         recordCloseOpenTurns({ target: a.target, sessionId: a.sessionId, exceptIds: [turnId] });
     };
@@ -2975,6 +3317,9 @@ export const startMirror = (deps) => {
             : item.kind === "thinking" || item.kind === "text"
                 ? item.body
                 : "";
+        // A prompt (even an exact match) is not a child/parent-call identity. Late
+        // children can reuse prompts after history eviction, so their content must
+        // never enter a transferred answer bubble without a verifiable ID binding.
         if (activity)
             updateBriefProgress(a, `🤖 ${run.label} · ${activity}`);
     };
@@ -3108,6 +3453,8 @@ export const startMirror = (deps) => {
             return;
         }
         if (item.kind === "turn_end") {
+            if (a.activeEventId && !item.soft)
+                deps.events?.finished(a.activeEventId);
             closeBriefTurn(a);
             return;
         }
@@ -3316,7 +3663,7 @@ export const startMirror = (deps) => {
         if (item.kind === "user_text") {
             // 回显去重只认 60s 内的注入: 排在长轮后面的那一行露面时已经过期, 会被当成人在 CLI 里敲的。
             // 印章认得出就仍是那次注入 —— 不回显, 也不算 CLI 轮。
-            if (bindLine(a, item.body.replace(/^> ?/gm, ""), item.ts))
+            if (bindLine(a, item.body.replace(/^> ?/gm, ""), item.ts, item.eventId))
                 return;
             endKeepaliveSwallow(a);
             // 对话边界 = 旧 turn 清算。上一 turn 派发而未返回的前台 Agent/Task 到此作废,
@@ -3328,17 +3675,23 @@ export const startMirror = (deps) => {
             // 不决定详情页记不记 —— 聊天不再下发 CLI 轮之后, 详情页是唯一的落点。
             a.pendingBriefQuery = item.body;
             a.pendingBriefAt = item.ts;
+            a.activePeerTurn = undefined;
+            a.pendingFrom = undefined;
+            a.pendingChannel = undefined;
+            a.activeEventId = item.eventId;
             a.pendingFromCli = true;
+            if (!cfg.wrc.mirror.brief)
+                consumeChannel(a, true, undefined);
         }
         if (item.kind === "user_inject") {
-            interject(a, item.said, item.ts);
+            interject(a, item.said, item.ts, item.eventId);
             return;
         }
         // 还有一轮等着懒建 (peer / graph 注入先记了 pendingBriefQuery) 就换掉它; 否则这句话
         // 就是已开好的那一轮 (IM 侧说的, startBriefTurn 在注入前建好)。
         if (item.kind === "user_query") {
             // 同伴 / 定时 / graph 注入的那一行: 问话就是印章里的原话 (不带信封)。
-            const sealed = bindLine(a, item.said, item.ts);
+            const sealed = bindLine(a, item.said, item.ts, item.eventId);
             if (sealed && !sealed.turn)
                 return;
             if (a.pendingBriefQuery !== undefined || !a.briefTurnId) {
@@ -3413,6 +3766,7 @@ export const startMirror = (deps) => {
         // 的配置下, 人在 CLI 敲的那一行就这么原样回显进了群, 正好破了 chatOriginOnly。
         if (item.kind === "user_text" && (item.quiet || cfg.wrc.mirror.brief))
             return;
+        updateAnswerProgress(a, item);
         // thinking 唯一的出口是 brief 气泡的 CoT 进度行。必须在这里就吃掉 —— 漏到下面任何
         // 一条通道 (deferred buf → renderBuf / standalone / stream append) 都会把它写进正文,
         // 那就变回已下线的 thinkStyle 了。
@@ -3560,6 +3914,21 @@ export const startMirror = (deps) => {
                 }
             }
         }
+        if (!cfg.wrc.mirror.brief && item.kind === "text" && item.final !== false && a.activeEventId && deps.events) {
+            const e = deps.events.get(a.activeEventId);
+            if (e) {
+                // Soft final text waits for transcript/idle evidence; it must not escape through the legacy stream.
+                if (item.final !== true)
+                    return;
+                const turn = a.liveStream?.turnId ?? e.id;
+                deps.events.result(e.id, item.body, finalId(e.id, e.channel, item.body), turn);
+                if (eventFinalGate(e))
+                    recoverEventFinal(deps.events.get(e.id));
+                return;
+            }
+        }
+        if (!cfg.wrc.mirror.brief && isPrivate(a))
+            return;
         // /goal mode overrides everything below: the session-scoped Stop hook
         // self-drives the model with no terminal stop_reason, so turn_end never fires
         // and brief-mode would swallow the entire run into the turn store (silent
@@ -3864,7 +4233,9 @@ export const startMirror = (deps) => {
     };
     // `panes` = boot 快照; 给了就不再为每个 principal 单独问 tmux。lazy 调用方
     // 不传, 维持原来的逐个探活。
-    const restoreFromStore = async (principal, panes) => {
+    const restoreFromStore = async (principal, panes, permitted) => {
+        if (permitted && !permitted())
+            return undefined;
         const rec = deps.store.get(principal);
         if (!rec)
             return undefined;
@@ -3882,6 +4253,8 @@ export const startMirror = (deps) => {
         // unrelated newest-in-cwd file is exactly the cross-wire we must avoid.
         const storedPane = (rec.tmuxPane ?? "").trim();
         const livePane = storedPane && (panes ? panes.has(storedPane) : await tmuxPaneAlive(storedPane)) ? storedPane : "";
+        if (permitted && !permitted())
+            return undefined;
         if (!existsSync(jsonlAbs)) {
             // First: the SAME-sid transcript may have merely relocated to a sibling
             // project dir (Claude Code EnterWorktree/ExitWorktree moved it while the
@@ -3937,6 +4310,8 @@ export const startMirror = (deps) => {
             const paneCwd = panes
                 ? (panes.get(livePane) ?? "")
                 : (await runTmux(["display-message", "-p", "-t", livePane, "#{pane_current_path}"])).stdout.trim();
+            if (permitted && !permitted())
+                return undefined;
             if (paneCwd) {
                 // Encode under the backend that owns the bound transcript — comparing
                 // with the primary dialect would report a phantom drift for every
@@ -3956,6 +4331,8 @@ export const startMirror = (deps) => {
                 }
             }
         }
+        if (permitted && !permitted())
+            return undefined;
         const r = attach({
             sessionId: rec.sessionId,
             jsonlPath: jsonlAbs,
@@ -4542,10 +4919,10 @@ export const startMirror = (deps) => {
     // `header` folds the caller's ack ("created") into this same bubble — /new
     // must land as exactly ONE WeCom message, not card + separate reply.
     // 会话边界回执一律不携带 cwd 信息 (📂 项目行 / 下次切换), 需要时 `/pwd` 可查。
-    // slashAckFirstLine 进一步省去 💡 tip, 只剩首行 ack。
     const pushProjectInfo = (target, header) => {
-        const concise = cfg.wrc.mirror.slashAckFirstLine && !!header;
-        const md = header ? (concise ? header : `${header}\n\n${randomTip()}`) : randomTip();
+        if (!header)
+            return;
+        const md = header;
         const a = byTarget.get(target);
         if (a) {
             sendStandalone(a, md);
@@ -4606,12 +4983,13 @@ export const startMirror = (deps) => {
             return undefined;
         }
     };
-    /** 死 pane 重生 (`--resume` 同一个会话) 的模型: 绑定里记着的优先 —— set_model 换上的也记在那;
-     *  没记 (老绑定 / CLI 默认) 的管家补上管家档。 */
+    /** 死 pane 重生: 管家重新取 router 档位, 普通 wizard 沿用绑定模型。 */
     const respawnSpec = (a) => {
         return resumedStewardSpec(cfg, a.target, backendForPath(a.jsonlPath).name, a);
     };
     const newSession = async (target, windowName, cli, opts) => {
+        if (opts?.guard && !opts.guard())
+            return { ok: false, reason: "spawn guard withdrew permission" };
         const prev = byTarget.get(target);
         // Resolution precedence (all chat-scoped except the running-cwd fallback):
         //   base.pending > caller.pending > target.running > base.running > default
@@ -4637,8 +5015,8 @@ export const startMirror = (deps) => {
         const boundPath = prev?.jsonlPath ?? rec?.jsonlPath;
         const base = baseOfKey(target);
         const effCli = resolveCliBackend(cfg.wrc).name;
-        // 管家 (群的默认会话) 新起的会话按管家档起 (models.steward / chatPolicy), 档压过绑定里记下的
-        // effort —— `/new`、换目录、交接重开都是让改过的档位生效的那一下。点名了模型就整档让开。
+        // 管家 (群的默认会话) 固定按 models.router 起, 压过显式模型及绑定里记下的 effort;
+        // `/new`、换目录、交接重开都是让改过的档位生效的那一下。
         // 已在跑的管家不动 (换模型会让缓存整份重读); 死 pane 重生见 respawnSpec。
         const backendChanged = Boolean(boundPath && effCli && backendForPath(expandHome(boundPath)).name !== effCli);
         const { model: effModel, effort: effEffort } = newStewardSpec(cfg, target, effCli, opts, backendChanged ? undefined : prev?.effort ?? deps.store.get(target)?.effort);
@@ -4666,6 +5044,12 @@ export const startMirror = (deps) => {
             inFlightSids.delete(freshSid);
             return { ok: false, reason: r.reason };
         }
+        if (opts?.guard && !opts.guard()) {
+            inFlightSids.delete(freshSid);
+            if (r.tmuxPane)
+                await runTmux(["kill-pane", "-t", r.tmuxPane]);
+            return { ok: false, reason: "spawn completed after permission withdrawal; binding withheld" };
+        }
         const att = attach({
             sessionId: r.sessionId,
             jsonlPath: r.jsonlPath,
@@ -4783,14 +5167,16 @@ export const startMirror = (deps) => {
         return undefined;
     };
     const cloneSession = async (args) => {
-        const p = byTarget.get(args.parent) ?? (await restoreFromStore(args.parent));
+        if (args.guard && !args.guard("paste"))
+            return { ok: false, reason: "spawn guard withdrew permission", inherited: false };
+        const p = byTarget.get(args.parent) ?? (await restoreFromStore(args.parent, undefined, () => !args.guard || args.guard()));
         // 继承上下文要求父亲有一个活着的 transcript, 且分身必须待在同一个项目目录 ——
         // `--resume` 是按项目目录寻址 session 的。调用方点名换目录 = 明确放弃继承。
         const sameCwd = !args.cwd?.trim() || expandHome(args.cwd.trim()) === (p?.runningCwd ?? "");
         const canInherit = args.inherit !== false && !!p?.sessionId && !!p.jsonlPath && existsSync(p.jsonlPath) && sameCwd;
         if (!canInherit) {
             const r = await newSession(args.target, args.windowName, args.cli, {
-                model: args.model, effort: args.effort, cwd: args.cwd, systemPrompt: args.systemPrompt, silent: true, keepalive: args.keepalive,
+                model: args.model, effort: args.effort, cwd: args.cwd, systemPrompt: args.systemPrompt, silent: true, keepalive: args.keepalive, guard: args.guard ? () => args.guard("paste") : undefined,
             });
             return { ...r, inherited: false };
         }
@@ -4802,6 +5188,8 @@ export const startMirror = (deps) => {
         const parentCli = backendForPath(parent.jsonlPath).name;
         const model = args.model?.trim() || parent.model || lastModel(parent.jsonlPath);
         const effort = args.effort ?? parseEffort(parent.effort);
+        if (args.guard && !args.guard("paste"))
+            return { ok: false, reason: "spawn guard withdrew permission", inherited: false };
         const r = await spawnTmuxClaude({
             cfg,
             log: lg,
@@ -4825,7 +5213,7 @@ export const startMirror = (deps) => {
         const boot = await inject({
             text: hello, images: [], cfg, log: lg,
             sessionId: parentCli === "codex" ? r.sessionId : parent.sessionId, jsonlPath: parentCli === "codex" ? r.jsonlPath : parent.jsonlPath,
-            tmuxTarget: r.tmuxPane, freshSpawn: true,
+            tmuxTarget: r.tmuxPane, freshSpawn: true, guard: args.guard,
         });
         if (!boot.ok) {
             await runTmux(["kill-pane", "-t", r.tmuxPane ?? ""]);
@@ -4841,6 +5229,12 @@ export const startMirror = (deps) => {
             await runTmux(["kill-pane", "-t", r.tmuxPane ?? ""]);
             return { ok: false, reason: "分身没能在超时内分叉出自己的会话 (CLI 可能不支持 --fork-session)", inherited: false };
         }
+        if (args.guard && !args.guard("submit")) {
+            inFlightSids.delete(fork.sessionId);
+            // The bootstrap may already have executed; withhold binding, report the
+            // unconfirmed birth to its caller instead of claiming cancellation success.
+            return { ok: false, reason: "fork executed after permission withdrawal; reconcile pane manually", inherited: false };
+        }
         const att = attach({
             sessionId: fork.sessionId,
             jsonlPath: fork.jsonlPath,
@@ -5128,7 +5522,16 @@ export const startMirror = (deps) => {
         const live = pane ? activeBackends().map((b) => sessionOnPane(b.homeDir, pane)).find(Boolean) : undefined;
         return live?.status === "idle" && hanging(target, live.sessionId);
     };
-    const idleNow = async (target) => idleVerdict(target) ?? !(await isBusy(target));
+    const idleNow = async (target) => {
+        const registry = idleVerdict(target);
+        if (registry !== undefined)
+            return registry;
+        const pane = paneOf(target);
+        if (!pane || !(await tmuxPaneAlive(pane)))
+            return false;
+        const { cap, box } = await readPaneInput(pane);
+        return !!cap.trim() && box.known && !paneIsBusy(cap) && !isModalPane(cap).modal;
+    };
     // 等到它闲下来, 事件驱动: 注册表目录一有写入就重判, 翻成 idle 的那一刻即返回。
     // 兜底轮询只防 watch 漏事件 (以及悬着的审批被点掉后 status 没再动的边角)。
     const IDLE_SAFETY_POLL_MS = 1000;
@@ -5340,7 +5743,9 @@ export const startMirror = (deps) => {
         catch { /* unreadable tail */ }
         return { lastMs, lastRealMs, seenMtime: mtime, pinging: false, pingMtime: 0, round, settledAt: 0, ttlSec: cacheTtlSec(jsonlPath), cacheAt: cacheTouchMs(jsonlPath) };
     };
-    const fireKeepalive = async (a) => {
+    const fireKeepalive = async (a, guard) => {
+        if (!guard())
+            return;
         const kc = cfg.wrc.mirror.keepalive;
         // The SAME full instruction every round: a bare "ping" used to be sent from round 2 on
         // (the instruction was already in context), but the model reads a bare "ping"
@@ -5354,16 +5759,23 @@ export const startMirror = (deps) => {
         // ping turn (reply included). The 60s fail-safe clears the quiet window if
         // the turn somehow never emits turn_end, so a later real turn is never muted;
         // it also closes the detail turn so it can't hang open in the chat timeline.
-        rememberInject(text);
-        a.keepaliveQuiet = setTimeout(() => {
-            a.keepaliveQuiet = undefined;
-            if (a.keepaliveTurnId) {
-                recordTurnClose(a.keepaliveTurnId);
-                a.keepaliveTurnId = undefined;
-            }
-        }, 60_000);
         const r = await inject({
             text, images: [], cfg,
+            guard,
+            requireIdle: () => idleVerdict(a.target) === true,
+            beforeInput: () => {
+                // A queued heartbeat must not mute the peer turn that won the lane.
+                // Drain its tail first, then open swallow only at permitted physical input.
+                a.tail.drain();
+                rememberInject(text);
+                a.keepaliveQuiet = setTimeout(() => {
+                    a.keepaliveQuiet = undefined;
+                    if (a.keepaliveTurnId) {
+                        recordTurnClose(a.keepaliveTurnId);
+                        a.keepaliveTurnId = undefined;
+                    }
+                }, 60_000);
+            },
             log: log.child({ target: a.target, sessionId: a.sessionId, sub: "keepalive" }),
             sessionId: a.sessionId, jsonlPath: a.jsonlPath, tmuxTarget: a.tmuxPane,
         });
@@ -5374,6 +5786,8 @@ export const startMirror = (deps) => {
             log.warn({ target: a.target, reason: r.reason }, "keepalive: inject failed");
             return;
         }
+        if (!guard())
+            return;
         const tokens = lastContextTokens(a.jsonlPath);
         const round = a.keepalive ? (a.keepalive.round += 1) : 1;
         log.info({ target: a.target, tokens, round, totalRounds: Math.max(1, kc.rounds) }, "keepalive: ping injected");
@@ -5389,116 +5803,132 @@ export const startMirror = (deps) => {
             recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cli: cliOf(a), initialModel: a.model || undefined, initialEffort: a.effort || undefined, userQuery: text });
         }
     };
-    let keepaliveTicking = false;
-    const keepaliveTick = async () => {
-        const kc = cfg.wrc.mirror.keepalive;
-        if (!kc.enabled || keepaliveTicking)
+    // One pool for both maintenance paths: slow panes do not stall other panes,
+    // and a keepalive never overlaps a picker scan/automatic press on the same pane.
+    const maintenance = createKeyedScheduler(4);
+    const maintenanceValid = (a, pane, sid, gen, signal) => !signal.aborted && byTarget.get(a.target) === a && a.tmuxPane === pane && a.sessionId === sid
+        && (a.injectGen ?? 0) === gen && !a.migrationWatcher;
+    const keepaliveOne = async (a, pane, sid, gen, signal) => {
+        const valid = () => maintenanceValid(a, pane, sid, gen, signal) && cfg.wrc.mirror.keepalive.enabled;
+        if (!valid())
             return;
-        keepaliveTicking = true;
+        const kc = cfg.wrc.mirror.keepalive;
+        const pingSigs = [normAssistant(kc.ping).slice(0, 40)].filter((s) => s.length > 0);
+        const now = Date.now();
+        if (a.keepaliveDisabled)
+            return; // sticky spawn-time opt-out — never pings
+        if (!a.tmuxPane)
+            return; // spawn-mode: no live pane to warm
+        if (a.migrationWatcher)
+            return; // session rotating — skip
+        if (a.liveStream && !a.liveStream.closed)
+            return; // mid typewriter — don't inject
+        if (!(await tmuxPaneAlive(pane)) || !valid())
+            return; // dead pane — nothing to keep alive
+        let mtime = 0;
         try {
-            const pingSigs = [normAssistant(kc.ping).slice(0, 40)].filter((s) => s.length > 0);
-            const now = Date.now();
-            for (const a of byTarget.values()) {
-                if (a.keepaliveDisabled)
-                    continue; // sticky spawn-time opt-out — never pings
-                if (!a.tmuxPane)
-                    continue; // spawn-mode: no live pane to warm
-                if (a.migrationWatcher)
-                    continue; // session rotating — skip
-                if (a.liveStream && !a.liveStream.closed)
-                    continue; // mid typewriter — don't inject
-                if (!(await tmuxPaneAlive(a.tmuxPane)))
-                    continue; // dead pane — nothing to keep alive
-                let mtime = 0;
-                try {
-                    mtime = statSync(a.jsonlPath).mtimeMs;
-                }
-                catch {
-                    continue;
-                }
-                if (!mtime)
-                    continue;
-                const k = (a.keepalive ??= initKeepalive(a.jsonlPath, mtime, pingSigs));
-                // File mtime is only a cheap "did anything change → re-read the tail" gate.
-                // The clocks themselves come from message turns, so metadata churn (which
-                // bumps mtime but is not a turn) can never move them. `grewSinceLast` now
-                // means a NEW message turn appeared — not that the file grew.
-                const prevRealMs = k.lastRealMs;
-                if (mtime > k.seenMtime + 1000) {
-                    const s = keepaliveStamps(a.jsonlPath, pingSigs);
-                    if (s.stamped) {
-                        k.lastMs = s.lastMs;
-                        k.lastRealMs = s.lastRealMs;
-                    }
-                    else {
-                        k.lastMs = mtime;
-                        k.lastRealMs = mtime;
-                    } // backend without timestamps → fall back to mtime
-                    k.ttlSec = cacheTtlSec(a.jsonlPath) || k.ttlSec;
-                    k.cacheAt = cacheTouchMs(a.jsonlPath) || k.cacheAt;
-                }
-                k.seenMtime = mtime;
-                // Round reset / real-activity re-anchor keys off REAL turns only — a
-                // keepalive ping+pong advances lastMs but NOT lastRealMs, so the heartbeat
-                // no longer reads as activity to itself (which was pinning round at 1/N).
-                const grewSinceLast = k.lastRealMs > prevRealMs + 1000;
-                const paneTail = await capturePaneTail(a.tmuxPane, 16);
-                const busy = paneIsBusy(paneTail);
-                if (k.pinging) {
-                    // Waiting for our own ping to land and settle: until a NEWER message turn
-                    // (the ping's own user line) appears and the pane goes idle, keep waiting.
-                    if (busy || k.lastMs <= k.pingMtime)
-                        continue;
-                    k.pinging = false;
-                    k.settledAt = now;
-                    continue;
-                }
-                // A new real message turn (or a busy pane) re-anchors: reset the round
-                // counter, and past the /stop grace lift a busy-resume. grewSinceLast is
-                // message-based now, so `/stop`'s Esc settling writes (metadata, no new
-                // turn) can no longer self-resume the pause — only a busy pane past grace,
-                // or a WeCom inbound in dispatch, does.
-                // Suppress the grewSinceLast reset for 30s after pinging settles — the
-                // pong's tail flush can lag a tick and would otherwise fake real activity.
-                const justSettled = k.settledAt > 0 && now - k.settledAt < 30_000;
-                if (busy || (grewSinceLast && !justSettled)) {
-                    k.round = 0;
-                    k.settledAt = 0;
-                    if (a.keepaliveOff && busy && now - (a.keepaliveOffAt ?? 0) > RESUME_GRACE_MS) {
-                        a.keepaliveOff = false;
-                        persistPause(a);
-                    }
-                    if (busy)
-                        continue;
-                }
-                if (a.keepaliveOff)
-                    continue; // paused by /stop until real activity returns
-                // Cache clock = start of the newest answered request (TTL runs from there),
-                // not the last turn's write time; no request on record → the turn clock.
-                const sinceCache = now - (k.cacheAt || k.lastMs || mtime);
-                // The TTL the session's cache entries were actually written with (1h on a
-                // Claude Code subscription), not a guess: pinging at the 5min cadence
-                // against a 1h entry re-reads the whole context ~14x per hour for nothing.
-                const ttlMs = (k.ttlSec || kc.ttlSec) * 1000;
-                const idleTriggerMs = Math.max(30_000, ttlMs - kc.marginSec * 1000);
-                if (sinceCache < idleTriggerMs)
-                    continue; // cache still comfortably warm
-                if (sinceCache >= ttlMs)
-                    continue; // cache already cold — a ping would cold-rewrite for nothing
-                if (sinceCache > KEEPALIVE_MAX_IDLE_MS)
-                    continue; // idle past 10min (a long-TTL entry) — not worth warming
-                if (k.round >= kc.rounds)
-                    continue; // budget spent — let it go cold
-                k.pinging = true;
-                k.pingMtime = k.lastMs; // settles when a newer turn (the ping's own) appears
-                await fireKeepalive(a);
+            mtime = statSync(a.jsonlPath).mtimeMs;
+        }
+        catch {
+            return;
+        }
+        if (!mtime)
+            return;
+        const k = (a.keepalive ??= initKeepalive(a.jsonlPath, mtime, pingSigs));
+        // File mtime is only a cheap "did anything change → re-read the tail" gate.
+        // The clocks themselves come from message turns, so metadata churn (which
+        // bumps mtime but is not a turn) can never move them. `grewSinceLast` now
+        // means a NEW message turn appeared — not that the file grew.
+        const prevRealMs = k.lastRealMs;
+        if (mtime > k.seenMtime + 1000) {
+            const s = keepaliveStamps(a.jsonlPath, pingSigs);
+            if (s.stamped) {
+                k.lastMs = s.lastMs;
+                k.lastRealMs = s.lastRealMs;
             }
+            else {
+                k.lastMs = mtime;
+                k.lastRealMs = mtime;
+            } // backend without timestamps → fall back to mtime
+            k.ttlSec = cacheTtlSec(a.jsonlPath) || k.ttlSec;
+            k.cacheAt = cacheTouchMs(a.jsonlPath) || k.cacheAt;
+        }
+        k.seenMtime = mtime;
+        // Round reset / real-activity re-anchor keys off REAL turns only — a
+        // keepalive ping+pong advances lastMs but NOT lastRealMs, so the heartbeat
+        // no longer reads as activity to itself (which was pinning round at 1/N).
+        const grewSinceLast = k.lastRealMs > prevRealMs + 1000;
+        const paneTail = await capturePaneTail(pane, 16);
+        if (!valid())
+            return;
+        const busy = paneIsBusy(paneTail);
+        if (k.pinging) {
+            // Waiting for our own ping to land and settle: until a NEWER message turn
+            // (the ping's own user line) appears and the pane goes idle, keep waiting.
+            if (busy || k.lastMs <= k.pingMtime)
+                return;
+            k.pinging = false;
+            k.settledAt = now;
+            return;
         }
-        catch (e) {
-            log.warn({ err: e.message }, "keepalive tick failed");
+        // A new real message turn (or a busy pane) re-anchors: reset the round
+        // counter, and past the /stop grace lift a busy-resume. grewSinceLast is
+        // message-based now, so `/stop`'s Esc settling writes (metadata, no new
+        // turn) can no longer self-resume the pause — only a busy pane past grace,
+        // or a WeCom inbound in dispatch, does.
+        // Suppress the grewSinceLast reset for 30s after pinging settles — the
+        // pong's tail flush can lag a tick and would otherwise fake real activity.
+        const justSettled = k.settledAt > 0 && now - k.settledAt < 30_000;
+        if (busy || (grewSinceLast && !justSettled)) {
+            k.round = 0;
+            k.settledAt = 0;
+            if (a.keepaliveOff && busy && now - (a.keepaliveOffAt ?? 0) > RESUME_GRACE_MS) {
+                a.keepaliveOff = false;
+                persistPause(a);
+            }
+            if (busy)
+                return;
         }
-        finally {
-            keepaliveTicking = false;
+        if (a.keepaliveOff)
+            return; // paused by /stop until real activity returns
+        // Cache clock = start of the newest answered request (TTL runs from there),
+        // not the last turn's write time; no request on record → the turn clock.
+        const sinceCache = now - (k.cacheAt || k.lastMs || mtime);
+        // The TTL the session's cache entries were actually written with (1h on a
+        // Claude Code subscription), not a guess: pinging at the 5min cadence
+        // against a 1h entry re-reads the whole context ~14x per hour for nothing.
+        const ttlMs = (k.ttlSec || kc.ttlSec) * 1000;
+        const idleTriggerMs = Math.max(30_000, ttlMs - kc.marginSec * 1000);
+        if (sinceCache < idleTriggerMs)
+            return; // cache still comfortably warm
+        if (sinceCache >= ttlMs)
+            return; // cache already cold — a ping would cold-rewrite for nothing
+        if (sinceCache > KEEPALIVE_MAX_IDLE_MS)
+            return; // idle past 10min (a long-TTL entry) — not worth warming
+        if (k.round >= kc.rounds)
+            return; // budget spent — let it go cold
+        if (idleVerdict(a.target) !== true)
+            return; // no confirmed idle → no heartbeat input
+        k.pinging = true;
+        k.pingMtime = k.lastMs; // settles when a newer turn (the ping's own) appears
+        await fireKeepalive(a, () => valid() && !a.keepaliveOff);
+    };
+    const keepaliveTick = () => {
+        if (!cfg.wrc.mirror.keepalive.enabled)
+            return;
+        for (const a of byTarget.values()) {
+            if (!a.tmuxPane || a.keepaliveDisabled)
+                continue;
+            const pane = a.tmuxPane, sid = a.sessionId, gen = a.injectGen ?? 0;
+            void maintenance.schedule(`keepalive:${a.target}`, pane, (signal) => keepaliveOne(a, pane, sid, gen, signal))
+                ?.catch((e) => {
+                if (maintenanceValid(a, pane, sid, gen, maintenance.signal)) {
+                    if (a.keepalive)
+                        a.keepalive.pinging = false;
+                    endKeepaliveSwallow(a);
+                }
+                log.warn({ target: a.target, err: e.message }, "keepalive tick failed");
+            });
         }
     };
     const keepaliveTimer = setInterval(() => void keepaliveTick(), 15_000);
@@ -5513,118 +5943,143 @@ export const startMirror = (deps) => {
     //   - 其它 → 把框转成标准审批卡发到本 chat (runMirrorPickerFlow), 点击后代按
     //     对应选项; 本地先按掉则 moot 作废卡。代按/发卡都发 chat 回执留痕。
     // WEZARD_PICKER_SENTINEL=0 整体关闭。
-    let pickerTicking = false;
-    const pickerTick = async () => {
-        if (pickerTicking || process.env.WEZARD_PICKER_SENTINEL === "0")
-            return;
-        if (!cfg.approval.enabled)
+    const pickerOne = async (a, pane, sid, gen, signal) => {
+        const guard = () => maintenanceValid(a, pane, sid, gen, signal) && cfg.approval.enabled
+            && process.env.WEZARD_PICKER_SENTINEL !== "0";
+        if (!guard())
             return;
-        pickerTicking = true;
-        try {
-            for (const a of byTarget.values()) {
-                if (!a.tmuxPane || a.migrationWatcher)
-                    continue;
-                // Codex PermissionRequest has its own independent native gate. Screen
-                // options, tool windows and skipAll never authorize its sandbox.
-                if (cliOf(a) === "codex")
-                    continue;
-                if (!(await tmuxPaneAlive(a.tmuxPane)))
-                    continue;
-                const v = await detectModalPicker(a.tmuxPane);
-                if (!v.modal) {
-                    // 审批卡在途而框已消失 = 本地先按掉了 → 作废卡等待 (无卡则 no-op)。
-                    mootMirrorPicker(a.sessionId);
-                    // 诊断: 屏上有高亮编号行却没判成 modal = 布局盲区候选 (askq/plan 面板
-                    // 也长这样, 属正常)。每屏记一次日志, 供远端排查"哨兵为何没反应"。
-                    if (looksLikePicker(v.screen)) {
-                        if (a.pickerSentinelFp !== v.screen) {
-                            a.pickerSentinelFp = v.screen;
-                            log.info({ target: a.target, tail: v.screen.split("\n").slice(-8).join("\\n").slice(-600) }, "picker sentinel: numbered picker shape on pane but not judged modal");
-                        }
-                    }
-                    else {
-                        a.pickerSentinelFp = undefined;
+        await withPaneInput(pane, async (live) => {
+            const valid = () => guard() && live();
+            if (!a.tmuxPane || a.migrationWatcher)
+                return;
+            // Codex PermissionRequest has its own independent native gate. Screen
+            // options, tool windows and skipAll never authorize its sandbox.
+            if (cliOf(a) === "codex")
+                return;
+            if (!(await tmuxPaneAlive(pane)) || !valid())
+                return;
+            const v = await detectModalPicker(pane);
+            if (!valid())
+                return;
+            if (!v.modal) {
+                // 审批卡在途而框已消失 = 本地先按掉了 → 作废卡等待 (无卡则 no-op)。
+                mootMirrorPicker(a.sessionId);
+                // 诊断: 屏上有高亮编号行却没判成 modal = 布局盲区候选 (askq/plan 面板
+                // 也长这样, 属正常)。每屏记一次日志, 供远端排查"哨兵为何没反应"。
+                if (looksLikePicker(v.screen)) {
+                    if (a.pickerSentinelFp !== v.screen) {
+                        a.pickerSentinelFp = v.screen;
+                        log.info({ target: a.target, tail: v.screen.split("\n").slice(-8).join("\\n").slice(-600) }, "picker sentinel: numbered picker shape on pane but not judged modal");
                     }
-                    continue;
                 }
-                if (hasMirrorPicker(a.sessionId))
-                    continue; // 审批卡在途, 等点击 / moot
-                if (a.pickerSentinelFp === v.screen)
-                    continue; // 同一屏已处理过, 等它变化
-                a.pickerSentinelFp = v.screen;
-                const pick = pickAutoAllowAnswer(parseModalOptions(v.screen));
-                if (!pick) {
-                    log.info({ target: a.target, title: v.title }, "picker sentinel: modal on pane but not a trustworthy permission picker — leaving it");
-                    continue;
-                }
-                const ctx = parseConfirmContext(v.screen);
-                const policy = pickerPolicy(cfg, cliOf(a), ctx, isAutoWindowActive(a.target));
-                if (policy.decision === "leave") {
-                    log.info({ target: a.target, reason: policy.reason }, "picker sentinel: independent approval left on CLI");
+                else {
+                    a.pickerSentinelFp = undefined;
                 }
-                await dispatchPickerPolicy(policy, {
-                    deny: async () => {
-                        const result = await pressNativePicker(a, modalFingerprint(v.screen), "no");
-                        log.info({ target: a.target, reason: policy.reason, result }, "picker sentinel: deny rule");
-                        sendStandalone(a, `[mirror] 🚫 ${policy.reason}，${result.ok ? "已拒绝 CLI 确认" : "确认框已变更，请回 CLI 处理"}`);
-                    },
-                    allow: async () => {
-                        const after = await pressModalIndex(a.tmuxPane, v, pick.index);
-                        if (after.modal) {
-                            // 没按掉: 指纹换成当前屏 — pane 静止就不再重试, 免得往一个不认识的框里刷数字键。
-                            a.pickerSentinelFp = after.screen;
-                            log.warn({ target: a.target, title: after.title, pressed: pick.index }, "picker sentinel: modal still on pane after press");
-                            return;
-                        }
-                        a.pickerSentinelFp = undefined;
-                        log.info({ target: a.target, title: v.title, via: policy.reason, pressed: `${pick.index}. ${pick.label}` }, "picker sentinel: native permission picker auto-allowed");
-                        sendStandalone(a, `[mirror] 🔓 ${policy.reason} 代按了 CLI 原生权限确认${v.title ? `「${v.title}」` : ""} → ${pick.index}. ${pick.label}`);
-                    },
-                    manual: () => {
-                        // 卡片路径: fire-and-forget — 长轮询在 flow 里, 哨兵循环不能被一张卡挂住;
-                        // 防重靠 hasMirrorPicker 槽位 (含代按窗口期, 见 flow 内 finally)。
-                        log.info({ target: a.target, toolName: ctx.toolName, agent: ctx.agent, reason: policy.reason }, "picker sentinel: forwarding native picker as approval card");
-                        runMirrorPickerFlow({
-                            log: log.child({ target: a.target, sessionId: a.sessionId, sub: "picker-card" }),
-                            client,
-                            cfg,
-                            sessionId: a.sessionId,
-                            chatKey: a.target,
-                            cwd: a.runningCwd,
-                            jsonlPath: a.jsonlPath,
-                            toolName: ctx.toolName,
-                            toolInput: ctx.toolInput,
-                            agent: ctx.agent,
-                            danger: policy.forceSingle,
-                            voteTimeoutMs: cfg.approval.longPollSec * 1000,
-                            press: (what) => pressNativePicker(a, modalFingerprint(v.screen), what),
-                        }).then((sent) => {
-                            // 卡没发出去 (WS 断/发送失败): 清指纹, 让下一 tick 对同屏重试发卡,
-                            // 否则这只框会被指纹永久静默。
-                            if (!sent)
-                                a.pickerSentinelFp = undefined;
-                        }).catch((e) => log.warn({ err: e.message, target: a.target }, "mirror picker flow failed"));
-                    },
-                });
+                return;
             }
-        }
-        catch (e) {
-            log.warn({ err: e.message }, "picker sentinel tick failed");
-        }
-        finally {
-            pickerTicking = false;
+            if (hasMirrorPicker(a.sessionId))
+                return; // 审批卡在途, 等点击 / moot
+            if (a.pickerSentinelFp === v.screen)
+                return; // 同一屏已处理过, 等它变化
+            a.pickerSentinelFp = v.screen;
+            const pick = pickAutoAllowAnswer(parseModalOptions(v.screen));
+            if (!pick) {
+                log.info({ target: a.target, title: v.title }, "picker sentinel: modal on pane but not a trustworthy permission picker — leaving it");
+                return;
+            }
+            const ctx = parseConfirmContext(v.screen);
+            const policy = pickerPolicy(cfg, cliOf(a), ctx, isAutoWindowActive(a.target));
+            if (policy.decision === "leave") {
+                log.info({ target: a.target, reason: policy.reason }, "picker sentinel: independent approval left on CLI");
+            }
+            await dispatchPickerPolicy(policy, {
+                deny: async () => {
+                    if (!valid())
+                        return;
+                    const result = await pressNativePickerUnlocked(a, modalFingerprint(v.screen), "no", valid);
+                    if (!valid())
+                        return;
+                    log.info({ target: a.target, reason: policy.reason, result }, "picker sentinel: deny rule");
+                    sendStandalone(a, `[mirror] 🚫 ${policy.reason}，${result.ok ? "已拒绝 CLI 确认" : "确认框已变更，请回 CLI 处理"}`);
+                },
+                allow: async () => {
+                    if (!valid())
+                        return;
+                    const after = await pressModalIndex(pane, v, pick.index, valid);
+                    if (!valid())
+                        return;
+                    if (after.modal) {
+                        // 没按掉: 指纹换成当前屏 — pane 静止就不再重试, 免得往一个不认识的框里刷数字键。
+                        a.pickerSentinelFp = after.screen;
+                        log.warn({ target: a.target, title: after.title, pressed: pick.index }, "picker sentinel: modal still on pane after press");
+                        return;
+                    }
+                    a.pickerSentinelFp = undefined;
+                    log.info({ target: a.target, title: v.title, via: policy.reason, pressed: `${pick.index}. ${pick.label}` }, "picker sentinel: native permission picker auto-allowed");
+                    sendStandalone(a, `[mirror] 🔓 ${policy.reason} 代按了 CLI 原生权限确认${v.title ? `「${v.title}」` : ""} → ${pick.index}. ${pick.label}`);
+                },
+                manual: () => {
+                    if (!valid())
+                        return;
+                    // 卡片路径: fire-and-forget — 长轮询在 flow 里, 哨兵循环不能被一张卡挂住;
+                    // 防重靠 hasMirrorPicker 槽位 (含代按窗口期, 见 flow 内 finally)。
+                    log.info({ target: a.target, toolName: ctx.toolName, agent: ctx.agent, reason: policy.reason }, "picker sentinel: forwarding native picker as approval card");
+                    runMirrorPickerFlow({
+                        log: log.child({ target: a.target, sessionId: a.sessionId, sub: "picker-card" }),
+                        client,
+                        cfg,
+                        sessionId: a.sessionId,
+                        chatKey: a.target,
+                        cwd: a.runningCwd,
+                        jsonlPath: a.jsonlPath,
+                        toolName: ctx.toolName,
+                        toolInput: ctx.toolInput,
+                        agent: ctx.agent,
+                        danger: policy.forceSingle,
+                        voteTimeoutMs: cfg.approval.longPollSec * 1000,
+                        // Human waiting is outside the lock; the eventual press obtains a new transaction.
+                        press: (what) => pressNativePicker(a, modalFingerprint(v.screen), what, guard),
+                    }).then((sent) => {
+                        // 卡没发出去 (WS 断/发送失败): 清指纹, 让下一 tick 对同屏重试发卡,
+                        // 否则这只框会被指纹永久静默。
+                        if (!sent && guard())
+                            a.pickerSentinelFp = undefined;
+                    }).catch((e) => {
+                        if (guard())
+                            a.pickerSentinelFp = undefined;
+                        log.warn({ err: e.message, target: a.target }, "mirror picker flow failed");
+                    });
+                },
+            });
+        }, { guard });
+    };
+    const pickerTick = () => {
+        if (!cfg.approval.enabled || process.env.WEZARD_PICKER_SENTINEL === "0")
+            return;
+        for (const a of byTarget.values()) {
+            if (!a.tmuxPane || cliOf(a) === "codex")
+                continue;
+            const pane = a.tmuxPane, sid = a.sessionId, gen = a.injectGen ?? 0;
+            void maintenance.schedule(`picker:${a.target}`, pane, (signal) => pickerOne(a, pane, sid, gen, signal))
+                ?.catch((e) => {
+                if (maintenanceValid(a, pane, sid, gen, maintenance.signal))
+                    a.pickerSentinelFp = undefined;
+                log.warn({ target: a.target, err: e.message }, "picker sentinel tick failed");
+            });
         }
     };
     const pickerTimer = setInterval(() => void pickerTick(), 5_000);
     // 审批卡点击后的代按回调。点击与本地按键之间隔着人的反应时间, 必须重读屏并
     // 校验仍是**同一个调用**的确认框 —— 期间本地按掉旧框又弹了新框的话, 盲按就是
     // 替用户批准了他没看过的东西。
-    const pressNativePicker = async (a, expectFingerprint, what) => {
-        if (!a.tmuxPane || !(await tmuxPaneAlive(a.tmuxPane)))
+    const pressNativePickerUnlocked = async (a, expectFingerprint, what, live) => {
+        if (!live() || !a.tmuxPane || !(await tmuxPaneAlive(a.tmuxPane)))
             return { ok: false, reason: "pane 已不在" };
         if (cliOf(a) === "codex")
             return { ok: false, reason: "Codex 原生沙箱审批必须单独处理" };
         const v = await detectModalPicker(a.tmuxPane);
+        if (!live())
+            return { ok: false, reason: "pane 事务已撤回" };
         if (!v.modal)
             return { ok: false, reason: "确认框已不在（可能已在本地处理）" };
         if (pickerPolicy(cfg, cliOf(a), parseConfirmContext(v.screen), false).decision === "leave") {
@@ -5645,11 +6100,12 @@ export const startMirror = (deps) => {
         const pick = sess ?? bare;
         if (!pick)
             return { ok: false, reason: "确认框上找不到可按的 Yes 选项" };
-        const after = await pressModalIndex(a.tmuxPane, v, pick.index);
+        const after = await pressModalIndex(a.tmuxPane, v, pick.index, live);
         return after.modal
             ? { ok: false, reason: `按下 ${pick.index} 后确认框仍在` }
             : { ok: true, label: `${pick.index}. ${pick.label}` };
     };
+    const pressNativePicker = async (a, fingerprint, what, guard) => withPaneInput(a.tmuxPane, (live) => pressNativePickerUnlocked(a, fingerprint, what, live), { guard });
     return {
         attach,
         chatTargets,
@@ -5873,35 +6329,24 @@ export const startMirror = (deps) => {
             // to in this process lifetime (or any session after a reload) has an empty
             // in-memory slot but a perfectly good persisted binding. Without this, an
             // agent driving a cold sibling gets "not attached" for a live pane.
-            const a = byTarget.get(target) ?? (await restoreFromStore(target));
-            if (!a)
-                return { ok: false, reason: "no mirror attached for target" };
+            const permission = () => !opts?.guard || opts.guard();
+            const denied = { ok: false, retryable: true, reason: "inject permission withdrawn before respawn/binding" };
             if (!text.trim())
-                return { ok: false, reason: "empty text" };
-            // 出处改写要早于 inject: tail 可能在 promise resolve 之前就开出 turn。
-            // 守护进程注入的一轮 (回执 / peer / 定时任务 / graph) 不是人在 CLI 手敲的: 可见性
-            // 只由频道定 ("" 私聊才静默)。pendingFromCli 必须一并清 —— 它是粘性的, 不开轮的
-            // CLI 行 (spawn 时 model-select 按下的 `/model`) 会把它一直挂到下一轮, 让紧跟着的
-            // 注入轮被认成 CLI 发起, 公开频道里的回复因此被出处门吞掉。
-            a.pendingFromCli = false;
-            a.turnFromChat = true;
-            // 名册增量搭这趟车进去 —— 同伴派活 / 定时任务 / graph 步骤都走这里, 所以
-            // 一个从不被人直接说话的分身也能知道群里多了谁、少了谁。人说的话那一条
-            // 路径在 inbound.send 上挂 (dispatch 有自己的 inject)。
-            // 信封 (谁说的、私聊还是公开、回执怎么交) 同理挂在尾巴上; slash 命令按行解析,
-            // 多挂一段就不再是命令, 跳过。`pendingBriefQuery` 记的仍是不带信封的原话。
-            const envelope = text.trimStart().startsWith("/") ? "" : opts?.envelope ?? "";
-            const full = text + envelope + noticeSuffixFor(target, text);
-            // Pre-record so the tail's user-line emission is suppressed by the
-            // recentInjects dedupe (otherwise the user sees their own demo prompt
-            // echoed back as a quoted bubble).
-            rememberInject(full);
-            // 印章要早于 inject 落地 —— tail 是独立轮询的, 它可能在 inject 的 promise
-            // resolve 之前就看到 user 行并开出 turn, 那时归因必须已经在位。
-            // 印章随这一行走 (见 Seal): 行露面时才落成那一轮的出处 / 频道 / 问话。
-            pushSeal(a, { keys: sealKeys(full), at: Date.now(), query: text, from: opts?.from, channel: opts?.channel, origin, fresh: idleVerdict(target) === true });
+                return { ok: false, retryable: true, reason: "empty text" };
+            if (!permission())
+                return denied;
+            const a = byTarget.get(target) ?? (await restoreFromStore(target, undefined, permission));
+            if (!permission())
+                return denied;
+            if (!a)
+                return { ok: false, retryable: true, reason: "no mirror attached for target" };
             const sid = a.sessionId;
+            const generation = a.injectGen ?? 0;
+            const permitted = () => permission() && byTarget.get(target) === a && a.sessionId === sid && (a.injectGen ?? 0) === generation;
+            const probedPane = a.tmuxPane;
             const paneAlive = a.tmuxPane ? await paneUsable(a.tmuxPane, a.jsonlPath) : false;
+            if (!permitted() || a.tmuxPane !== probedPane)
+                return denied;
             // 同 dispatch: 只有刚生 / 刚重生的 pane 才要冷启动的宽限 —— 对一个热着、正忙的 pane 贴 `now`
             // 也按冷启动等 idle 至多 15s, 「不等不打断」就成了「晚 15–20s 才进」(handoff-owe 的竞态即此)。
             let fresh = a.justSpawned === true;
@@ -5912,7 +6357,16 @@ export const startMirror = (deps) => {
                 const resumeBaseline = listJsonls(dirname(a.jsonlPath));
                 const r = await spawnTmuxClaude({ cfg, log: log.child({ sub: "respawn-init", sessionId: sid }), resumeSessionId: sid, windowName: displayName(target) || target, cwdOverride: a.runningCwd, cli: backendForPath(a.jsonlPath).name, ...respawnSpec(a), systemPrompt: charterFor(target, { cwd: a.runningCwd, cli: backendForPath(a.jsonlPath).name }) });
                 if (!r.ok || !r.tmuxPane)
-                    return { ok: false, reason: `respawn failed: ${r.reason ?? "unknown"}` };
+                    return { ok: false, retryable: true, reason: `respawn failed: ${r.reason ?? "unknown"}` };
+                if (!permitted() || a.tmuxPane !== probedPane) {
+                    // This pane was born for an unsubmitted injection. Never kill the old
+                    // executor or bind the withdrawn birth. A failed cleanup is explicitly
+                    // uncertain and must be reconciled; it is not proof execution stopped.
+                    const cleanup = await runTmux(["kill-pane", "-t", r.tmuxPane]).catch(() => undefined);
+                    return { ...denied, ...(cleanup?.ok ? {} : { uncertain: true, retryable: false }), reason: cleanup?.ok
+                            ? "respawn permission withdrawn; new pane removed before injection, binding withheld"
+                            : `respawn permission withdrawn; binding withheld, reconcile new pane ${r.tmuxPane}` };
+                }
                 a.tmuxPane = r.tmuxPane;
                 a.tmuxSession = r.tmuxSession ?? a.tmuxSession;
                 if (r.cwd)
@@ -5925,18 +6379,34 @@ export const startMirror = (deps) => {
                 startMigrationWatcher(a, resumeBaseline, forkOf(a.jsonlPath));
                 fresh = true;
             }
-            // 同 dispatch: 在 inject 之前解除静默, 防止验证循环中 LLM 回复被永久吞掉。
-            a.muteUntilInject = false;
-            a.justSpawned = false;
+            if (!permitted())
+                return denied;
+            // Busy/queued retries must not consume notices or stamp a future turn.
+            // Render only after the pane lane grants delivery, then stamp exactly at
+            // the first permitted input. activePeerTurn still changes in bindLine.
+            const envelope = text.trimStart().startsWith("/") ? "" : opts?.envelope ?? "";
+            let full = text + envelope;
+            const beforeInput = () => {
+                a.pendingFromCli = false;
+                a.turnFromChat = true;
+                rememberInject(full);
+                pushSeal(a, { eventId: parseEnvelope(full)?.eventId, keys: sealKeys(full), at: Date.now(), query: text, from: opts?.from, channel: opts?.channel, origin, fresh: idleVerdict(target) === true });
+                a.muteUntilInject = false;
+                a.justSpawned = false;
+            };
             // 同 dispatch 的 /clear 与静默分叉跟随: self-handoff / 同伴 / 定时任务也走这里注入,
             // 漏了它 tail 就钉在旧 jsonl 上, 直到下一条人话经 dispatch 才把它拽回来。
             const clearing = isClearCommand(text);
             const preClearBaseline = clearing ? listJsonls(dirname(a.jsonlPath)) : undefined;
+            const injectPane = a.tmuxPane;
             const r = await inject({
-                text: full, images: [], cfg, log: log.child({ principal: target, sessionId: sid, sub: "init-demo" }),
+                text: full, images: [], cfg, guard: (phase) => permitted() && a.tmuxPane === injectPane && (!opts?.guard || opts.guard(phase)), log: log.child({ principal: target, sessionId: sid, sub: "init-demo" }),
                 sessionId: sid, jsonlPath: a.jsonlPath, tmuxTarget: a.tmuxPane, freshSpawn: fresh,
+                requireIdle: opts?.requireIdle ? () => idleNow(target) : undefined,
+                prepareText: () => (full = text + envelope + noticeSuffixFor(target, text)),
+                beforeInput,
             });
-            if (r.ok && a.tmuxPane) {
+            if (r.ok && a.tmuxPane && permitted()) {
                 if (preClearBaseline) {
                     a.clearRebind = { baseline: preClearBaseline };
                     startMigrationWatcher(a, preClearBaseline, jsonlIsPostClearChild, 0, true);
@@ -5947,9 +6417,15 @@ export const startMirror = (deps) => {
             return r;
         },
         interruptPane: async (target, opts) => {
+            if (opts?.guard && !opts.guard())
+                return { ok: false, reason: "interrupt authority changed" };
             const a = byTarget.get(target);
             if (!a)
                 return { ok: false, reason: "no mirror attached for target" };
+            const interruptedEvent = a.activeEventId;
+            const interruptedPane = a.tmuxPane;
+            if (opts?.teardown && interruptedEvent)
+                deps.events?.cancel((e) => e.id === interruptedEvent);
             // `/stop` (teardown: true) must work when tmux itself is the problem, so
             // the order is: local state first, pane second. The old implementation
             // probed the pane FIRST and returned early on failure — meaning a wedged
@@ -5986,7 +6462,13 @@ export const startMirror = (deps) => {
                 escReason = "tmux pane no longer alive";
             }
             else {
-                const r = await runTmux(["send-keys", "-t", a.tmuxPane, "Escape"]);
+                if (byTarget.get(target) !== a || a.tmuxPane !== interruptedPane || a.activeEventId !== interruptedEvent || (opts?.guard && !opts.guard()))
+                    return { ok: false, reason: "turn changed during interrupt probe; Escape withheld" };
+                const r = await withPaneInput(interruptedPane, async (live) => {
+                    if (!live() || a.activeEventId !== interruptedEvent || a.tmuxPane !== interruptedPane || (opts?.guard && !opts.guard()))
+                        return { ok: false, stderr: "turn changed before Escape", stdout: "", code: 1 };
+                    return runTmux(["send-keys", "-t", interruptedPane, "Escape"]);
+                });
                 escOk = r.ok;
                 if (!r.ok)
                     escReason = `send-keys Escape failed: ${(r.stderr || r.stdout).slice(-200) || r.code}`;
@@ -6001,7 +6483,13 @@ export const startMirror = (deps) => {
                 return { ok: false, reason: escReason };
             return { ok: true, torndown, escOk, escReason: escReason || undefined };
         },
-        killPane: (target) => downPane(target, true),
+        killPane: async (target) => {
+            deps.events?.cancel((e) => e.target === target);
+            const r = await downPane(target, true);
+            if (r.ok)
+                deps.events?.stopped(target, "pane kill acknowledged; queued input revoked");
+            return r;
+        },
         sleepPane: (target) => downPane(target, false),
         lastActivity: (target) => {
             const jsonl = jsonlOf(target);
@@ -6252,6 +6740,7 @@ export const startMirror = (deps) => {
             clearInterval(paneDriftTimer);
             clearInterval(keepaliveTimer);
             clearInterval(pickerTimer);
+            maintenance.stop();
             for (const a of bySessionId.values()) {
                 if (a.outbound?.kind === "deferred")
                     clearTimeout(a.outbound.timer);
@@ -6269,11 +6758,17 @@ export const startMirror = (deps) => {
                 return a.convFrom.asker;
             return a?.speaker ? { who: a.speaker, chat: a.channel ?? baseOfKey(target) } : undefined;
         },
+        answerContext, prepareAnswer, takeAnswer, cancelAnswerPreparation, stopAnswerProgress, deliverAnswer,
+        setAnswerSilencer: (fn) => { silenceAnswer = fn; },
         currentChannel: (target) => {
             const a = byTarget.get(target);
             return a?.channel ?? baseOfKey(target);
         },
-        dispatch: async ({ principal, text, images, frame, streamId, channel, speaker }) => {
+        formatFinal,
+        recoverEventFinal,
+        setEventFinalGate: (gate) => { eventFinalGate = gate; },
+        settleFinalProgress,
+        dispatch: async ({ principal, text, images, frame, streamId, channel, speaker, eventId, guard, onSubmitted }) => {
             // Route by inbound principal — the WeCom chat the user just messaged us
             // from is the same string we registered as `target` on attach. After a
             // daemon reload the in-memory map is empty; restore from the persisted
@@ -6291,6 +6786,10 @@ export const startMirror = (deps) => {
                 }
                 return;
             }
+            if (eventId && a.tmuxPane && await tmuxPaneAlive(a.tmuxPane) && !(await idleNow(principal))) {
+                onSubmitted?.({ ok: false, retryable: true, reason: "target became busy before opening the human turn" });
+                return;
+            }
             // `/clear` resets to an empty session — nothing in the cache to keep warm,
             // so pause keepalive like `/stop` instead of lifting it. Every other inbound
             // is real work: lift any prior pause and re-anchor both clocks to now.
@@ -6406,17 +6905,19 @@ export const startMirror = (deps) => {
             if (s) {
                 a.liveStream = s;
                 try {
-                    await client.replyStream(frame, streamId, withTagHeader(a.target, "…"), false);
+                    await (s.pending = client.replyStream(frame, streamId, withTagHeader(a.target, "…"), false));
                 }
                 catch (e) {
                     log.warn({ sessionId: a.sessionId, err: e.message }, "stream initial ack failed");
                 }
             }
+            if (!brief)
+                a.activeEventId = eventId;
             if (brief) {
                 // 挂 loading 气泡并起新 turn —— 上一 turn 若还在跑, startBriefTurn 内部
                 // 会立刻把它收掉 (对话边界策略), 本轮直接成为活跃 turn。
                 // 后续 onItem 走 handleBriefItem, 不再走 stream / defer 路径。
-                await startBriefTurn(a, frame, streamId, isSlash, effText, channel ?? baseOfKey(principal), speaker);
+                await startBriefTurn(a, frame, streamId, isSlash, effText, channel ?? baseOfKey(principal), speaker, eventId);
             }
             else if (!armMigration && !eagerOpen) {
                 enterDeferred(a, frame, streamId);
@@ -6503,6 +7004,8 @@ export const startMirror = (deps) => {
                     log.warn({ target: a.target, sessionId: sid, myGen, gen: a.injectGen }, "inject aborted — superseded by /stop or watchdog");
                     return;
                 }
+                if (!brief)
+                    pushSeal(a, { eventId: a.activeEventId, keys: sealKeys(effText), at: Date.now(), query: effText, channel: channel ?? baseOfKey(principal), speaker, fresh: true });
                 rememberInject(effText);
                 // 解除静默必须在 inject 之前: inject 内部的 freshSpawn 验证循环可达 10+s
                 // (paste-verify + settle + waitForCleared + retry), 而 LLM 的回复可能在 Enter
@@ -6511,10 +7014,14 @@ export const startMirror = (deps) => {
                 // 安全性: newSession 的 fresh pane 在 inject 前只写过 system/init (→ 无 item),
                 // 用户行有 isOwnInject 过滤 —— 提前解除不会泄漏脏数据。
                 a.muteUntilInject = false;
+                const injectPane = a.tmuxPane;
                 const r = await inject({
                     text: effText, images: effImages, cfg, log: log.child({ principal, sessionId: sid }),
                     sessionId: sid, jsonlPath: a.jsonlPath, tmuxTarget: a.tmuxPane, freshSpawn,
+                    requireIdle: eventId ? () => idleNow(a.target) : undefined,
+                    guard: (phase) => byTarget.get(a.target) === a && a.tmuxPane === injectPane && (a.injectGen ?? 0) === myGen && (!guard || guard(phase)),
                 });
+                onSubmitted?.(r);
                 if (!r.ok) {
                     if (s) {
                         s.acc = s.acc ? `${s.acc}\n\n[mirror] ✗ ${r.reason ?? "failed"}` : `[mirror] ✗ ${r.reason ?? "failed"}`;
@@ -6577,10 +7084,7 @@ export const startMirror = (deps) => {
                 // and surface a standalone "cleared" so the user gets explicit
                 // feedback (the skip-stream path otherwise leaves WeCom silent).
                 if (armMigration) {
-                    // cwd 不随回执下发 (/pwd 可查); slashAckFirstLine 连 tip 也省去 (与 /new 一致)。
-                    sendStandalone(a, cfg.wrc.mirror.slashAckFirstLine
-                        ? "cleared"
-                        : `cleared\n\n${randomTip()}`);
+                    sendStandalone(a, "cleared");
                     a.clearRebind = { baseline: preClearBaseline };
                     startMigrationWatcher(a, preClearBaseline, jsonlIsPostClearChild, 0, true);
                 }