wezard 2.6.3 → 2.6.4

package/dist/daemon/index.js

@@ -1,3 +1,4 @@
+import { wxMarkdown } from "../shared/wx-text.js";
 // Daemon entry. Resident process — exits only on signal or fatal WS auth failure.
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
@@ -12,7 +13,7 @@ import { patchJsonc } from "../shared/config-writer.js";
 import { EFFORTS, parseEffort } from "../shared/effort.js";
 import { bindCliBackends, projectDirsFor } from "../shared/cli-backends.js";
 import { bindCodexStateDir } from "../shared/codex.js";
-import { startMux } from "./bot-mux.js";
+import { startMux, pinFrameBot } from "./bot-mux.js";
 import { startWeixin } from "./weixin.js";
 import { installWeixinPort } from "./weixin-port.js";
 import { bindWxCommands, makeOnBound, makeWxCommands, routeSendMedia, wecomBindSink, weixinSendMedia, wxAdmins, wxRoutes } from "./weixin-cmd.js";
@@ -25,6 +26,7 @@ import { applyHot, cfgSeenBy, patchedTop, pinChatKeys, configGet, fromLegacy, le
 import { computeUsage, costOf, fmtCost, fmtTokens, sumTotal } from "./usage.js";
 import { installInboundRouter } from "./inbound.js";
 import { loadMirrorStore } from "./mirror-store.js";
+import { createMessageEvents, messageId, finalId } from "./message-events.js";
 import { startMirror, installMirrorEventListener } from "./mirror-bridge.js";
 import { backendFor, runTmux, setTmuxTimeoutReporter, spawnTmuxClaude } from "./spawn-tmux.js";
 import { bindCardChannel, installApprovalEventListener, makeApproveHandler, requestConfirm } from "./approval.js";
@@ -54,7 +56,7 @@ import { bindNoticeBox, createNoticeBox, createSeenRing, gcSeen, chatAudience, h
 import { createLedger, digest, pendingGc, renderDigest, renderTable, renderAwaiting, renderStalled, renderShelved, ago as agoMs, HEARD_EVERY_MS } from "./pending-items.js";
 import { checkDirection } from "./direction.js";
 import { loadJobStore, dutyLine, awaitingAccept, stalledRoots, shelvedRoots, nudgeDue, dayClamp, childrenOf as jobChildren, jobEpisode, rejectReason, ACCEPTS, JOB_MEMBER_MAX, JOB_DEPTH_MAX, depthOf, ancestorsOf as jobAncestors, treeOrder, jobStage } from "./jobs.js";
-import { cacheTouchMs, cacheTtlSec, clipMiddle, contextFiles, firstStamp, parseClosing, lastContextTokens, lastExchange, lastModel, openingTurn, replyClosedBefore, talkTurns, renderPeerEnvelope, renderReceiptEnvelope, renderTaskEnvelope } from "./peers.js";
+import { cacheTouchMs, cacheTtlSec, clipMiddle, contextFiles, firstStamp, parseClosing, lastContextTokens, lastExchange, lastModel, openingTurn, replyClosedBefore, talkTurns, turnsSince, renderPeerEnvelope, renderReceiptEnvelope, renderTaskEnvelope } from "./peers.js";
 import { keepalivePingSigs } from "../shared/keepalive.js";
 import { expandHome } from "../shared/paths.js";
 import { loadJsonMap } from "../shared/json-map-store.js";
@@ -156,7 +158,7 @@ const main = async () => {
     // last-response tracker enables inbound's `quote` dedup of bot self-replies,
     // and its chat-gate drops header-only pushes (empty messages) daemon-wide.
     // 微信出站不走企微长连接, 不必等它连上。
-    installResponseTracker(ws.client, log.child({ mod: "chat-gate" }), (c) => wx.owns(c), (context) => responseFormatPolicy(cfg, context, (target) => chatUrlFor(cfg.daemon, target)));
+    const responseTracker = installResponseTracker(ws.client, log.child({ mod: "chat-gate" }), (c) => wx.owns(c), (context) => responseFormatPolicy(cfg, context, (target) => chatUrlFor(cfg.daemon, target)));
     const mirrorStore = loadMirrorStore(cfg.wrc.mirror.attachmentsFile);
     // 定时任务表 —— 每条任务是 ~/.wezard/tasks/<id>.task.mjs 一份可注入代码的配置
     // (见 shared/task-file.ts)。目录是热加载的: wizard 改完文件不用 reload 守护进程。
@@ -171,7 +173,81 @@ const main = async () => {
         log.warn({ err: e.message }, "memory steward task not retired");
     }
     const tasks = await openTaskRegistry(log.child({ mod: "tasks" }), (added, removed) => log.info({ added, removed }, "task files changed"));
-    const bridge = startMirror({ cfg, log: log.child({ mod: "mirror" }), client: ws.client, store: mirrorStore });
+    let peerEvents;
+    const events = createMessageEvents(join(cfg.daemon.stateDir, "message-events.json"), {
+        resource: (target) => bridge.sessionInfo(target)?.tmuxPane || target,
+        transcript: (target) => bridge.sessionInfo(target)?.jsonlPath,
+        valid: (e) => e.payload.peer ? !!peerEvents?.valid(e) : true,
+        accepted: (e) => { if (e.payload.peer)
+            peerEvents?.accepted(e); },
+        committed: (e) => { if (e.payload.peer)
+            peerEvents?.committed(e); },
+        canceled: (e) => {
+            if (e.payload.peer)
+                peerEvents?.canceled(e);
+            else if (e.payload.human && e.exposure === "none") {
+                const body = `这条消息未执行：${e.reason ?? "已取消"}。`;
+                events.result(e.id, body, finalId(e.id, e.channel, body));
+                // A canceled, unexposed input has a terminal response owned by its original channel.
+                events.delivery({ id: finalId(e.id, e.channel, body), eventId: e.id, target: e.target, turn: e.turn || e.id,
+                    channel: e.channel, revision: finalId(e.id, e.channel, body), body, chunks: bridge.formatFinal(e.target, e.turn || e.id, e.channel, body) });
+            }
+        },
+        ready: async (e) => !handingOff(e.target) && (e.payload.peer ? !!(await peerEvents?.ready(e)) : !bridge.hasMirrorTarget(e.target) || await bridge.idleNow(e.target) || !(await bridge.paneLive(e.target))),
+        inject: async (e, boundary) => {
+            if (e.payload.peer)
+                return peerEvents.inject(e, boundary);
+            if (!bridge.hasMirrorTarget(e.target)) {
+                const spawned = await bridge.newSession(e.target, wizardStore()?.get(e.target)?.name || e.target, undefined, { silent: true });
+                if (!spawned.ok)
+                    return { ok: false, retryable: true, reason: spawned.reason };
+            }
+            let outcome;
+            pinFrameBot(e.payload.human.frame, botOfKey(e.channel));
+            await bridge.dispatch({ ...e.payload.human, eventId: e.id,
+                text: e.payload.text + renderReminder({ wezard: "message-event", event: e.id }, []),
+                guard: boundary, onSubmitted: (r) => { outcome = r; } });
+            return outcome ?? { ok: false, retryable: events.get(e.id)?.exposure === "none", uncertain: events.get(e.id)?.exposure !== "none", reason: "dispatch ended without a submission acknowledgement" };
+        },
+        evidence: async (e) => {
+            if (e.canceled && await bridge.idleNow(e.target))
+                events.released(e.id);
+            const paths = [...new Set([bridge.sessionInfo(e.target)?.jsonlPath, e.transcript].filter((p) => !!p))];
+            for (const path of paths) {
+                const turns = turnsSince(expandHome(path), e.at - 60_000);
+                const start = turns.findIndex((t) => t.role === "user" && t.env?.eventId === e.id);
+                if (start < 0)
+                    continue;
+                const next = turns.findIndex((t, i) => i > start && t.role === "user" && !t.queued);
+                const replies = turns.slice(start + 1, next < 0 ? undefined : next).filter((t) => t.role === "assistant");
+                const last = replies.at(-1);
+                const ended = next >= 0 || await bridge.idleNow(e.target);
+                return { consumed: true, interjected: !!turns[start].queued, ...(ended && last && !last.mid && !last.apiError ? { body: last.text, revision: finalId(e.id, e.channel, last.text) } : {}) };
+            }
+            return { consumed: false };
+        },
+        recovered: (e) => bridge.recoverEventFinal(e),
+        format: (d) => ({ ...d, chunks: d.chunks.map((c) => responseTracker.freeze(d.channel.replace(/^(user|chat|group):/, ""), c)) }),
+        send: async (d, n) => {
+            await bridge.settleFinalProgress(d.id);
+            const chat = d.channel.replace(/^(user|chat|group):/, "");
+            if (wx.owns(chat)) {
+                const result = wx.sendFinal(chat, wxMarkdown(d.chunks[n]), `${d.id}:${n}`);
+                return { ack: result.ack, queued: result.state === "queued" || result.state === "sending",
+                    uncertain: result.state === "uncertain" ? result.reason ?? "Weixin send ACK unknown" : undefined,
+                    failed: result.state === "failed" ? result.reason ?? "Weixin final rejected" : undefined };
+            }
+            const stream = d.stream && n === 0 && d.chunks.length === 1 && Date.now() < d.stream.expires ? d.stream : undefined;
+            const ack = d.transfer
+                ? await bridge.deliverAnswer(d.transfer.id, d.target, d.turn, d.channel, "", d.chunks[n], d.transfer.standalone || n > 0 || d.chunks.length > 1, true)
+                : await responseTracker.sendFrozen(chat, d.chunks[n], stream, events.running);
+            return ack && typeof ack === "object" && "errcode" in ack && ack.errcode === 0 ? { ack: JSON.stringify(ack) }
+                : { ack: JSON.stringify(ack), uncertain: "final transport returned no explicit success ACK" };
+        },
+        deliveryEvidence: (d, n) => wx.finalStatus(`${d.id}:${n}`),
+        error: (e) => log.error({ err: errText(e) }, "message event scheduler"),
+    });
+    const bridge = startMirror({ cfg, log: log.child({ mod: "mirror" }), client: ws.client, store: mirrorStore, events, sendFrozen: (channel, content, stream) => responseTracker.sendFrozen(channel.replace(/^(user|chat|group):/, ""), content, stream, events.running) });
     // 群里每个 `.name` 都挂它的 rolepage (见 session-label 的 TagLinker)。正文提及
     // 只认真有其人的 —— 随手写的 `.gitignore` 不该变成一个开在空栏上的链接。
     const known = (t) => bridge.chatTargets(t).includes(t);
@@ -190,7 +266,18 @@ const main = async () => {
     // 重开的空档里 resume 回旧 sid。
     // 宪章守卫 (见「改配置会不会动到宪章」): 要等下面宪章渲染那一块立起来才有; 之前 (启动时那次自动补名) 只写不比对。
     let guardCharter = (write) => ({ r: write(), note: Promise.resolve("") });
-    installInboundRouter(ws.client, cfg, log, { ...bridge, dispatch: async (a) => (await handedOff(a.principal), bridge.dispatch(a)) }, sourcePath, (w, c) => guardCharter(w, c));
+    installInboundRouter(ws.client, cfg, log, { ...bridge, dispatch: async (a) => {
+            if (a.text.trimStart().startsWith("/")) {
+                await handedOff(a.principal);
+                await bridge.dispatch(a);
+                return;
+            }
+            const id = a.eventId ?? messageId(botOfKey(a.principal), a.channel, a.streamId);
+            events.accept({ id, identity: a.identity, originalAt: a.originalAt, target: a.principal, speaker: a.speaker, channel: a.channel,
+                asker: { who: a.speaker, chat: a.channel }, priority: "normal", deadline: Date.now() + 12 * 3600_000,
+                payload: { text: a.text, human: a } });
+            await ws.client.replyStream(a.frame, a.streamId, withTagHeader(a.principal, "已排队"), false).catch(() => undefined);
+        } }, sourcePath, (w, c) => guardCharter(w, c));
     // approval click → finalize 当前 liveStream, 后续 tool/text 落到 standalone。
     // 规则 2: 用户点击授权那一刻就是"上一段对话"的边界, 截断 stream 让授权后的
     // 工作单独成块, 比让 stream 一直长到下一个 inbound / hardTimer 更清晰。
@@ -333,6 +420,11 @@ const main = async () => {
     {
         const m = bridge;
         installMirrorEventListener(ws.client, m, log.child({ mod: "mirror" }));
+        http.register("GET /message-events/status", (_req, res) => json(res, 200, events.status()));
+        http.register("POST /message-events/reconcile", async (req, res) => {
+            const body = await readBody(req);
+            json(res, 200, await events.reconcile(String(body.id ?? "")) ?? { error: "unknown event" });
+        });
         http.register("GET /mirror/status", (_req, res) => json(res, 200, m.status()));
         // Manual auto-spawn trigger — used by `wezard init` to materialize a
         // tmux+claude pane immediately after claim, instead of waiting for the
@@ -778,7 +870,20 @@ const main = async () => {
                 if (!answers.delivering(id))
                     return false;
                 try {
-                    await m.deliverAnswer(id, r.target, r.sourceTurn, r.channel, r.prefix, r.outcome.body, !["done", "need"].includes(r.outcome.status));
+                    const eventId = `answer:${id}`;
+                    const revision = finalId(eventId, r.channel, r.outcome.body);
+                    const deliveryId = events.delivery({ id: finalId(eventId, r.channel, revision), eventId, target: r.target,
+                        turn: r.sourceTurn, channel: r.channel, revision, body: r.outcome.body,
+                        chunks: m.formatFinal(r.target, r.sourceTurn, r.channel, r.outcome.body),
+                        transfer: { id, standalone: !["done", "need"].includes(r.outcome.status) } });
+                    for (;;) {
+                        const states = events.deliveryStatus(deliveryId);
+                        if (states.every((s) => s === "delivered"))
+                            break;
+                        if (states.some((s) => s === "uncertain" || s === "failed"))
+                            throw new Error(`final delivery uncertain: ${deliveryId}`);
+                        await sleep(250);
+                    }
                     answers.delivered(id);
                     recordPost({ target: r.target, channel: r.channel, body: r.outcome.body, ...(r.tell.asker ? { asker: r.tell.asker } : {}) });
                     return true;
@@ -802,6 +907,18 @@ const main = async () => {
                 && !a.canceled && a.acceptance !== "rejected" && jobs.get(r.plan.job)?.status === "open" && ["running", "needs-input", "errored"].includes(a.execution)
                 && (r.plan.nodes.find((x) => x.id === n.id)?.after ?? []).every((id) => workflow.prereq(r.owner, r.nodes.find((x) => x.id === id).turn)?.state === "done");
         };
+        const acceptContinuation = (tell, text) => {
+            if (workflow.byTurn(tell.from, tell.turn) || !planStore.allowExternal(tell.to, wizards.get(tell.to)?.name))
+                return false;
+            const id = `p:${tell.from}:${tell.to}:${tell.turn}:${tell.legs}`;
+            events.accept({ id, target: tell.to, speaker: tell.from, channel: tell.channel, asker: tell.asker, k: tell.k,
+                priority: "normal", deadline: tell.deadlineAt ?? deadlineOf(tell.at ?? Date.now()), payload: { text, peer: {
+                        from: { kind: "peer", from: tell.from, turn: tell.turn, ...(tell.asker ? { asker: tell.asker } : {}) },
+                        envelope: envelopeFor(tell.from, tell.channel, { turn: tell.turn, legs: tell.legs, re: true, asker: tell.asker }),
+                        tell: { ...tell, dispatchKey: id }, job: tell.job ?? "", kind: "task", held: true,
+                    } } });
+            return true;
+        };
         const receipts = createReceipts({
             deliverAnswer: deliverTransferredAnswer,
             workflowPrereq: workflow.prereq,
@@ -819,14 +936,10 @@ const main = async () => {
             },
             jobTally: (id) => jobs.tally(id),
             parkedNow: m.parkedNow,
-            settleJob: (id, target, outcome, artifacts) => { jobs.settle(id, target, outcome, artifacts); },
+            settleJob: (id, target, outcome, artifacts, identity) => { jobs.settle(id, target, outcome, artifacts, identity); },
             accept: (id, body) => { const j = jobs.get(id); return j?.status === "open" ? rejectReason(j.accept ?? "result", parseClosing(body)) : undefined; },
-            rebound: async (x, why) => workflow.byTurn(x.from, x.turn) || !planStore.allowExternal(x.to, wizards.get(x.to)?.name) ? false : (await m.injectText(x.to, `（守护进程代 ${displayName(x.from)} 打回一次: 这件活是工单里的一份, 你的回复${why}。请按约定收口 —— 末尾一行 \`RESULT: <结论>\`, 交付了文件每个加一行 \`ARTIFACT: <路径> — 一句话\`; 真缺信息就 \`NEED: <问题>\`。）`, undefined, {
-                guard: () => planStore.allowExternal(x.to, wizards.get(x.to)?.name),
-                from: { kind: "peer", from: x.from, turn: x.turn, ...(x.asker ? { asker: x.asker } : {}) },
-                channel: x.channel,
-                envelope: envelopeFor(x.from, x.channel, { turn: x.turn, legs: x.legs, re: true, asker: x.asker }),
-            })).ok,
+            durableRebound: true,
+            rebound: async (x, why, tell) => !!tell && acceptContinuation(tell, `（守护进程代 ${displayName(x.from)} 打回一次: 这件活是工单里的一份, 你的回复${why}。请按约定收口：RESULT: <结论>；交付文件逐项 ARTIFACT: <路径> — 一句话；真缺信息用 NEED: <问题>。）`),
             untilIdle: m.untilIdle,
             paneLive: m.paneLive,
             nameOf: displayName,
@@ -835,28 +948,32 @@ const main = async () => {
             holdStore: loadJsonMap(cfg.wrc.mirror.holdsFile, undefined, { strict: true }),
             // 放行停放着的 after 件: 走 tell_peer 同一条注入路径, 沿用停放时的件号 / 频道 / 父 k。
             release: async (h, seen, alive) => {
-                const r = await tellPeerAs(h.from, h.body, afterNote(h.after, seen, h.from), { turn: h.turn, channel: h.channel, after: h.after, seen: h.seen, alive, ...(h.k ? { k: h.k } : {}), ...(h.asker ? { asker: h.asker } : {}) });
+                const r = await tellPeerAs(h.from, h.body, afterNote(h.after, seen, h.from), { at: h.at, turn: h.turn, channel: h.channel, after: h.after, seen: h.seen, alive, ...(h.k ? { k: h.k } : {}), ...(h.asker ? { asker: h.asker } : {}) });
                 return r.status === 200 ? { ok: true } : { ok: false, reason: String(r.body.reason ?? `HTTP ${r.status}`) };
             },
             handingOff,
             handedOff,
             replyFor: (to, fromName, since, turn) => m.replyToPeer(to, fromName, since, turn),
             lastWords: m.lastReply,
-            deliver: (to, bodyText, meta, alive) => m.injectText(to, clipMiddle(bodyText), undefined, {
-                requireIdle: true,
-                guard: () => (!alive || alive()) && planContinuationAllowed(to),
-                // receipt:true 是「这一轮不该再生回执」的记录 —— 回环在结构上就不成立:
-                // 只有 tell_peer 那条路登记 watcher, 这里是直接注入。
-                from: { kind: "peer", from: meta.from, receipt: true, status: meta.status, ...(meta.turn ? { turn: meta.turn } : {}), ...(meta.job ? { job: meta.job, done: meta.done, total: meta.total } : {}), ...(meta.asker ? { asker: meta.asker } : {}) },
-                channel: meta.channel,
-                envelope: renderReceiptEnvelope(displayName(meta.from), meta.channel ? chatNameOf(cfg, meta.channel) : undefined, meta.job ? { job: meta.job, done: meta.done, total: meta.total, closed: jobs.get(meta.job)?.status !== "open", ...(jobs.get(meta.job)?.kind === "req" ? { req: true } : {}) } : undefined, meta.status, meta.turn || undefined, {
-                    ...(meta.replyTo ? { replyTo: meta.replyTo.kind === "chat" ? chatNameOf(cfg, meta.replyTo.channel) : displayName(meta.replyTo.from) } : {}),
-                    ...(meta.k ? { k: kAttr(meta.k) } : {}),
-                    ...(meta.asker ? { asker: meta.asker } : {}),
-                    ...(meta.pending ? { pending: meta.pending } : {}),
-                    ...(audienceName(meta.channel, meta.asker) ? { audience: audienceName(meta.channel, meta.asker) } : {}),
-                }) + (meta.eventId ? renderReminder({ wezard: "receipt-delivery", event: meta.eventId }, []) : ""),
-            }),
+            deliver: async (to, bodyText, meta, alive) => {
+                if ((alive && !alive()) || !planContinuationAllowed(to))
+                    return { ok: false, retryable: true, reason: "receipt permission withdrawn" };
+                const id = meta.eventId;
+                const text = clipMiddle(bodyText);
+                events.accept({ id, identity: JSON.stringify([to, text, meta]), target: to, speaker: meta.from, channel: meta.channel,
+                    asker: meta.asker, k: meta.k, replyTo: meta.replyTo, priority: "normal", deadline: Date.now() + 12 * 3600_000,
+                    payload: { text, peer: { job: "", kind: "fyi",
+                            from: { kind: "peer", from: meta.from, receipt: true, status: meta.status, ...(meta.turn ? { turn: meta.turn } : {}), ...(meta.job ? { job: meta.job, done: meta.done, total: meta.total } : {}), ...(meta.asker ? { asker: meta.asker } : {}) },
+                            envelope: renderReceiptEnvelope(displayName(meta.from), meta.channel ? chatNameOf(cfg, meta.channel) : undefined, meta.job ? { job: meta.job, done: meta.done, total: meta.total, closed: jobs.get(meta.job)?.status !== "open", ...(jobs.get(meta.job)?.kind === "req" ? { req: true } : {}) } : undefined, meta.status, meta.turn || undefined, {
+                                ...(meta.replyTo ? { replyTo: meta.replyTo.kind === "chat" ? chatNameOf(cfg, meta.replyTo.channel) : displayName(meta.replyTo.from) } : {}),
+                                ...(meta.k ? { k: kAttr(meta.k) } : {}),
+                                ...(meta.asker ? { asker: meta.asker } : {}),
+                                ...(meta.pending ? { pending: meta.pending } : {}),
+                                ...(audienceName(meta.channel, meta.asker) ? { audience: audienceName(meta.channel, meta.asker) } : {}),
+                            }) + (meta.eventId ? renderReminder({ wezard: "receipt-delivery", event: meta.eventId }, []) : "")
+                        } } });
+                return events.submission(id);
+            },
         });
         stopReceipts = receipts.stop;
         const turnsLine = (xs, target) => renderInFlight(xs, target, displayName);
@@ -968,7 +1085,9 @@ const main = async () => {
         };
         const controlSnapshot = (self) => ({ opening: openingOfSelf(self)?.ms, turn: m.answerContext(self)?.turn });
         const controlValid = (self, snapshot) => openingOfSelf(self)?.ms === snapshot.opening && m.answerContext(self)?.turn === snapshot.turn && !lostAnswer(self) && !terminalAnswerTurn(self);
-        const hasAnswerChildren = (self, k) => !!k && receipts.states().some((s) => s.from === self && !!s.k && kAttr(s.k) === kAttr(k));
+        const hasAnswerChildren = (self, k) => !!k && (receipts.states().some((s) => s.from === self && !!s.k && kAttr(s.k) === kAttr(k))
+            || events.status().events.some((e) => e.speaker === self && e.k && kAttr(e.k) === kAttr(k) && e.payload.peer?.tell && !["complete", "canceled"].includes(e.execution))
+            || workflow.all().some((a) => a.owner === self && a.tell?.k && kAttr(a.tell.k) === kAttr(k) && !a.canceled && a.execution !== "terminal"));
         m.setAnswerSilencer((target, turn) => answers.source(target, turn) || lostAnswer(target));
         const parentKOf = (self) => {
             const opening = openingOfSelf(self);
@@ -992,6 +1111,11 @@ const main = async () => {
         void m.restored.then(() => {
             handoffs.resume();
             answers.all().filter((r) => r.state !== "delivered").forEach((r) => {
+                const savedFinal = events.status().deliveries.find((d) => d.transfer?.id === r.id);
+                if (savedFinal?.parts.every((p) => p.state === "delivered")) {
+                    answers.delivered(r.id);
+                    return;
+                }
                 const action = answerRecoveryAction(r);
                 if (action === "cancel-before-send") {
                     answers.activate(r.id);
@@ -1028,16 +1152,8 @@ const main = async () => {
             ask: async ({ from, to, turn, text }) => {
                 if (workflow.byTurn(from, turn) || !planStore.allowExternal(to, wizards.get(to)?.name))
                     return false;
-                const x = receipts.reask(from, to, turn);
-                if (!x)
-                    return false;
-                ledger.touch(from, turn);
-                return (await m.injectText(to, text, undefined, {
-                    guard: () => planStore.allowExternal(to, wizards.get(to)?.name),
-                    from: { kind: "peer", from, turn, ...(x.asker ? { asker: x.asker } : {}) },
-                    channel: x.channel,
-                    envelope: envelopeFor(from, x.channel, { turn, legs: x.legs, re: true, asker: x.asker }),
-                })).ok;
+                const tell = receipts.continuation(from, to, turn);
+                return !!tell && acceptContinuation(tell, text);
             },
             nameOf: displayName,
             store: loadJsonMap(join(cfg.daemon.stateDir, "idle-nudges.json")),
@@ -1393,7 +1509,7 @@ const main = async () => {
             if (!a.dispatches?.length)
                 throw new Error("historical tracked attempt lacks dispatch accounting evidence; reconcile stopped before retry (no blind budget import)");
             for (const d of a.dispatches) {
-                jobs.account(a.job, d.key, { target: a.to, task: d.continuation ? "" : d.text, spawned: false, ...(d.role ? { role: d.role } : {}) }, d.kind, d.free, recovery, !!d.free && !!d.continuation);
+                jobs.account(a.job, d.key, { target: a.to, task: d.continuation ? "" : d.text, spawned: false, turn: (d.tell ?? a.tell)?.turn, ...(d.role ? { role: d.role } : {}) }, d.kind, d.free, recovery, !!d.free && !!d.continuation);
                 const t = d.tell ?? a.tell;
                 ledger.dispatch(d.key, { turn: a.turn, owner: a.owner, to: a.to, text: d.text, at: d.at, job: a.job, ...(t?.k ? { for: t.k } : {}), ...(t?.asker ? { asker: t.asker } : {}) });
             }
@@ -1410,10 +1526,86 @@ const main = async () => {
                 ...workflow.all().filter((a) => a.to === target && a.execution !== "terminal" && !a.canceled && only({ from: a.owner, turn: a.turn })).map((a) => `${a.owner}\0${a.turn}`),
                 ...receipts.states().filter((s) => s.to === target && only(s)).map((s) => `${s.from}\0${s.turn}`),
             ]);
+            events.cancel((e) => e.target === target && !!e.payload.peer && only({ from: e.speaker, turn: e.payload.peer.from.turn ?? "" }));
             workflow.cancel(target, undefined, undefined, undefined, only);
             receipts.cancel(target, self, only);
             return keys.size;
         };
+        peerEvents = {
+            valid: (e) => {
+                const p = e.payload.peer;
+                const attempt = p.attemptId ? workflow.byTurn(e.speaker, p.from.turn ?? "") : undefined;
+                return planStore.healthy() && !e.canceled && (!p.controlTransfer || !answers.get(p.controlTransfer)?.outcome) && (!p.from.receipt || planContinuationAllowed(e.target)) && (!p.job || jobs.get(p.job)?.status === "open") && !attempt?.canceled
+                    && (!p.after?.length || receipts.prereqs(e.speaker, p.after, p.afterSeen).every((r) => r.state === "done" || r.state === "pending"))
+                    && !answers.all().some((r) => r.target === e.target && answerTargetOccupied(r));
+            },
+            accepted: (e) => {
+                if (e.execution !== "queued")
+                    return;
+                const p = e.payload.peer;
+                if (p.tell && e.k?.kind === "chat")
+                    events.defer(e.k.turn, true);
+                if (p.attemptId)
+                    accountWorkflow(workflow.byTurn(e.speaker, p.from.turn ?? ""));
+                else if (p.job && !p.held)
+                    jobs.account(p.job, e.id, { target: e.target, turn: p.from.turn, task: (p.tell?.legs ?? 1) > 1 ? "" : e.payload.text, spawned: !!p.spawned, ...(p.role ? { role: p.role } : {}) }, p.kind === "ask" ? "ask" : "task", !!p.free || !!p.held, false, !!p.free);
+                if (p.tell) {
+                    if (!p.attemptId)
+                        ledger.dispatch(e.id, { turn: p.tell.turn, owner: e.speaker, to: e.target, text: e.payload.text, at: e.at, ...(p.job ? { job: p.job } : {}), ...(e.k ? { for: e.k } : {}), ...(e.asker ? { asker: e.asker } : {}) });
+                    if (!receipts.watching(p.tell))
+                        receipts.register({ ...p.tell, queued: true });
+                }
+            },
+            committed: (e) => {
+                const p = e.payload.peer;
+                if (p.attemptId) {
+                    const a = workflow.byTurn(e.speaker, p.from.turn ?? "");
+                    if (a?.execution === "dispatch-unknown" && !a.canceled && !a.status && e.exposure === "consumed")
+                        workflow.verdict(e.speaker, p.attemptId, "sent", undefined, `transcript confirms message event ${e.id}`);
+                    else
+                        workflow.dispatched(p.attemptId, true);
+                }
+                if (p.tell)
+                    receipts.commit(p.tell);
+                if (p.from.receipt)
+                    receipts.confirmDelivery(e.id);
+            },
+            canceled: (e) => {
+                const p = e.payload.peer;
+                if (p.attemptId)
+                    workflow.cancel(e.target, e.speaker, p.job, p.from.turn);
+                if (p.tell)
+                    receipts.cancel(e.target, "scheduler", (s) => s.from === e.speaker && s.turn === p.tell.turn);
+            },
+            ready: async (e) => receipts.prereqs(e.speaker, e.payload.peer.after ?? [], e.payload.peer.afterSeen).every((r) => r.state === "done")
+                && (e.priority === "now" || await m.idleNow(e.target) || !(await m.paneLive(e.target)) || (e.priority === "urgent" && !(await othersTurn(e.target, e.speaker)))),
+            inject: async (e, boundary) => {
+                const p = e.payload.peer;
+                if (e.priority === "urgent" && !(await m.idleNow(e.target))) {
+                    if (await othersTurn(e.target, e.speaker))
+                        return { ok: false, retryable: true, reason: "urgent target now belongs to another actor" };
+                    const path = m.sessionInfo(e.target)?.jsonlPath;
+                    const opening = path ? openingTurn(expandHome(path), pingSigs)?.ms : undefined;
+                    const r = await m.interruptPane(e.target, { guard: () => peerEvents.valid(e)
+                            && m.sessionInfo(e.target)?.jsonlPath === path && (!path || openingTurn(expandHome(path), pingSigs)?.ms === opening) });
+                    if (!r.ok)
+                        return { ok: false, retryable: true, reason: r.reason };
+                }
+                if (p.attemptId && p.tell)
+                    workflow.intent(p.attemptId, p.tell);
+                const raw = await m.injectText(e.target, e.payload.text, undefined, {
+                    from: p.from, channel: e.channel, requireIdle: e.priority === "normal",
+                    envelope: p.envelope + (p.after?.length ? afterNote(p.after, Object.fromEntries(p.after.map((t, n) => [t, receipts.prereqs(e.speaker, p.after, p.afterSeen)[n].seen])), e.speaker) : "") + renderReminder({ wezard: "message-event", event: e.id }, []),
+                    guard: (phase) => peerEvents.valid(e) && receipts.prereqs(e.speaker, p.after ?? [], p.afterSeen).every((r) => r.state === "done") && (!phase || ((!p.attemptId || workflow.boundary(p.attemptId)) && boundary(phase))),
+                });
+                const r = !raw.ok && !raw.uncertain && !raw.retryable && events.get(e.id)?.exposure === "none" ? { ...raw, retryable: true } : raw;
+                if (p.attemptId && (r.uncertain || (!r.ok && !r.retryable)))
+                    workflow.dispatched(p.attemptId, false);
+                return r;
+            },
+        };
+        m.setEventFinalGate((e) => !e.awaitingContinuation && !e.canceled && !e.interjected && !receipts.pendingDelivery(e.target, { kind: "chat", channel: e.channel, turn: e.id }, e.currentContinuation) && !hasAnswerChildren(e.target, { kind: "chat", channel: e.channel, turn: e.id }) && !answers.all().some((r) => r.source === e.target && (r.sourceTurn === e.turn || r.origin === e.id)));
+        void m.restored.then(() => events.resume());
         /** tell_peer 的本体: 以 `self` 的名义说一句 —— HTTP 路由与 dispatch 共用。`extra` = 挂在信封后面的
          *  一段 (只进对方输入框, 不进 `text`: 公开时 text 会成群气泡)。 */
         const peerDispatching = new Map();
@@ -1533,10 +1725,6 @@ const main = async () => {
                     return { status: 409, body: { ok: false, reason: `你已有一件活 (${cur.turn}) 在 ${displayName(target)} 手上没落定, 同一对只有一个回执槽 —— 等它交差, 或把它也列进 after` } };
                 }
             }
-            const parkIt = prereqs.some((p) => p.state === "pending");
-            // 前置都已落定: 不停放, 结论附在信封后面照常投。
-            if (afters.length && !parkIt)
-                extra += afterNote(afters, Object.fromEntries(afters.map((t, i) => [t, prereqs[i].seen])), self);
             // 公开与否由发话方 (LLM) 判断: 公开 = 在它这一轮的公开频道里说, 气泡进群、对方
             // 那一轮的回复也发进这个群; 私聊 (默认) = 只落双方的 rolepage, 回复靠 wait_peer 取。
             // 只有两端都是登记在册的 wizard 才能当着人说: 裸 target 冒充的发话方、forget
@@ -1558,7 +1746,8 @@ const main = async () => {
             // 空 pane 会 resume 回旧 sid (见 handoff.ts)。发话时刻取在这之后。
             if (answer === "transfer" && handingOff(target))
                 return { status: 409, body: { ok: false, reason: "answer target is handing off; source retains answer and control" } };
-            await handedOff(target);
+            if (answer === "transfer")
+                await handedOff(target);
             if (!actorStillValid())
                 return { status: 409, body: { ok: false, reason: "caller turn/control changed while waiting; dispatch refused" } };
             // 投递策略。对方闲着三者一样 —— 立刻投; 只在它正忙时分岔:
@@ -1600,36 +1789,6 @@ const main = async () => {
                     throw new Error("plan dispatch canceled or job reserved");
                 return node ? workflow.begin(self, jobId, node, turn.turn, target, queued).id : undefined;
             };
-            if (parkIt) {
-                try {
-                    attemptId = beginNode(true);
-                }
-                catch (e) {
-                    return { status: 409, body: { ok: false, reason: e.message } };
-                }
-                const bp = body;
-                if (attemptId) {
-                    try {
-                        workflow.recordLeg(attemptId, { text, at: Date.now(), tell: { from: self, to: target, channel, job: jobId, turn: turn.turn, at: Date.now(), legs: 1, ...(k ? { k } : {}), ...(asker ? { asker } : {}) }, kind: "task", ...(roleParam(bp.role) ? { role: roleParam(bp.role) } : {}) });
-                        accountWorkflow(workflow.byTurn(self, turn.turn));
-                    }
-                    catch (e) {
-                        return { status: 409, body: { ok: false, attemptId, reason: e.message } };
-                    }
-                }
-                receipts.hold({
-                    from: self, to: target, turn: turn.turn, at: Date.now(), after: afters, channel, job: jobId,
-                    ...(k ? { k } : {}), ...(asker ? { asker } : {}),
-                    // force: 冷门控上面已过一遍, 放行时缓存又凉了也不再退回。
-                    body: { name: peerAddress(cfg, self, target), text, kind, force: true, ...(node ? { node } : {}), ...(jobId ? { job: jobId } : {}), ...(bp.role ? { role: bp.role } : {}), ...(bp.priority ? { priority: bp.priority } : {}), ...(bp.waitSec ? { waitSec: bp.waitSec } : {}), ...(bp.deadline !== undefined ? { deadline: bp.deadline } : {}), ...(bp.receipt === false ? { receipt: false } : {}) },
-                });
-                if (jobId && !attemptId) {
-                    const role = roleParam(bp.role);
-                    jobs.attach(jobId, { target, task: text, spawned: false, ...(role ? { role } : {}) }, kind === "ask" ? "ask" : "task");
-                    jobs.spend(jobId);
-                }
-                return { status: 200, body: { ok: true, parked: true, after: afters, turn: turn.turn, ...(attemptId ? { node, attemptId } : {}), name: peerAddress(cfg, self, target), ...(jobId ? { job: jobId } : {}), receipt: `排在 ${afters.join(" ")} 之后: 前置满足放行条件才投（tracked 要 accepted，legacy 要 done；带上结论）, 任一失败这件不投、按 canceled 回给你; 不要挂在 wait_peer 上等, 接着干你自己的事` } };
-            }
             try {
                 attemptId = beginNode(true);
             }
@@ -1645,6 +1804,44 @@ const main = async () => {
             // 打断就误伤了那件 —— 降成 normal, 等它这一轮做完再投。
             const others = asked === "urgent" && wasBusy ? await othersTurn(target, self) : undefined;
             const policy = others ? "normal" : asked;
+            if (answer !== "transfer") {
+                if (canceledBeforeDispatch() || !actorStillValid())
+                    return { status: 409, body: { ok: false, reason: "caller authority or dispatch permit changed before acceptance" } };
+                if (jobId) {
+                    const budget = checkJob(jobId, target, (!!open?.need && open.turn === turn.turn) || !!held);
+                    if (!budget.ok)
+                        return { status: budget.status, body: { ok: false, reason: budget.reason } };
+                }
+                // All caller-dependent facts are frozen here; workers never reread the caller's current turn.
+                const at = held?.at ?? Date.now();
+                const deadlineAt = deadlineOf(at, body.deadline);
+                const wantReceipt = kind !== "fyi" && body.receipt !== false;
+                const eventId = `p:${self}:${target}:${turn.turn}:${turn.legs}`;
+                let tell = { from: self, to: target, channel, job: jobId, at, turn: turn.turn, legs: turn.legs, deadlineAt, k, asker, dispatchKey: eventId };
+                if (attemptId) {
+                    const leg = workflow.recordLeg(attemptId, { text, tell, continuation: turn.legs > 1, at, kind: "task", role: roleParam(body.role), free: !!open?.need && open.turn === turn.turn }, !!held);
+                    tell = { ...tell, dispatchKey: leg.key };
+                }
+                let accepted;
+                try {
+                    accepted = events.accept({ id: eventId, target, speaker: self, channel, asker, k, priority: policy, deadline: deadlineAt,
+                        payload: { text, peer: {
+                                from: { kind: "peer", from: self, turn: turn.turn, ...(jobId ? { job: jobId } : {}), ...(isPublic ? { public: true } : {}), ...(asker ? { asker } : {}) },
+                                envelope: envelopeFor(self, channel, { turn: turn.turn, asker, legs: turn.legs, ...(turn.legs > 1 ? { re: true } : {}),
+                                    ...(body.deadline !== undefined ? { deadline: deadlineAt } : {}), ...(kind !== "task" ? { act: kind } : {}), ...(wantReceipt ? {} : { quiet: true }) }) + extra,
+                                ...(wantReceipt ? { tell } : {}), job: jobId, kind, attemptId, after: held?.after ?? afters, afterSeen: held?.seen,
+                                controlTransfer: answers.all().find((r) => r.target === self && r.tell.turn === openingOfSelf(self)?.env?.turn && !r.outcome)?.id,
+                                role: roleParam(body.role), free: !!open?.need && open.turn === turn.turn, held: !!held,
+                            } } });
+                }
+                catch (error) {
+                    return { status: 409, body: { ok: false, eventId, reason: errText(error) } };
+                }
+                return { status: 200, body: { ...accepted, queued: true, ...(prereqs.some((p) => p.state === "pending") ? { parked: true, after: afters } : {}), turn: turn.turn, name: peerAddress(cfg, self, target), priority: policy, wasBusy,
+                        ...(jobId ? { job: jobId } : {}), ...(attemptId ? { node, attemptId, acceptance: "pending" } : {}),
+                        ...(wantReceipt ? { receipt: "已持久化排队；提交后观察原件回执，结论自动返回" } : {}),
+                        ...(others ? { urgentDowngraded: "目标正在处理他人的轮次，按 normal 排队" } : {}) } };
+            }
             let waitedMs = 0;
             let interrupted;
             if (policy === "normal" && wasBusy) {
@@ -1733,7 +1930,7 @@ const main = async () => {
             }
             if (answerContext && k?.kind === "chat") {
                 try {
-                    answers.reserve({ id: turn.turn, source: self, target, sourceTurn: answerContext.turn, sourceOpening: answerSourceOpening, origin: answerTransferOrigin(self, answerContext.turn), channel: k.channel, prefix: answerContext.prefix, tell: trackedTell, state: "reserved" });
+                    answers.reserve({ id: turn.turn, source: self, target, sourceTurn: answerContext.turn, sourceOpening: answerSourceOpening, origin: openingOfSelf(self)?.env?.eventId ?? answerTransferOrigin(self, answerContext.turn), channel: k.channel, prefix: answerContext.prefix, tell: trackedTell, state: "reserved" });
                 }
                 catch (e) {
                     return { status: 409, body: { ok: false, reason: e.message } };
@@ -1948,7 +2145,7 @@ const main = async () => {
                 return;
             }
             // 同一个 wizard 写两遍不该顶掉两个名额。
-            const uniq = hits.filter((h, i) => hits.findIndex((o) => o.target === h.target) === i);
+            const uniq = hits.filter((h, i) => hits.findIndex((o) => o.target === h.target) === i).map((h) => ({ ...h, turn: receipts.sentTurn(self, h.target), at: receipts.sentAt(self, h.target) }));
             const need = Math.min(Math.max(Number(b.need ?? uniq.length) || uniq.length, 1), uniq.length);
             const timeoutMs = Math.min(Math.max(Number(b.timeoutSec ?? 900) || 900, 10), 7200) * 1000;
             const wrs = await waitForQuorum(uniq.map((h) => h.target), m.isBusy, timeoutMs, need);
@@ -1963,8 +2160,8 @@ const main = async () => {
             const results = uniq.map((h, i) => {
                 const wr = wrs[i];
                 // 取走就占位: 同一段话不会再作为回执 paste 进来一遍 (见 receipts.claim)。
-                const full = wr.idle ? m.lastReply(h.target, receipts.sentAt(self, h.target)) : "";
-                const already = full ? receipts.claim(self, h.target) : false;
+                const full = wr.idle && h.turn ? m.replyToPeer(h.target, displayName(self), h.at, h.turn)?.text ?? "" : "";
+                const already = full ? receipts.claim(self, h.target, h.turn) : false;
                 const closing = parseClosing(already === "uncertain" ? "" : full);
                 const result = closing.kind === "result" ? closing.text : "";
                 return {
@@ -3140,11 +3337,7 @@ const main = async () => {
                     cwd: b.cwd,
                     systemPrompt: charter,
                     inherit,
-                    // 继承路径上第一句话是分叉的触发器, 所以直接把活当开场白 —— 少一次往返,
-                    // 也少一次"就位了但没事干"的空转。
-                    // 子 lead 的宪章只有层级规矩, 打法跟第一句的信封走 (同 dispatch 对已有 wizard 的做法)。
-                    bootstrap: task ? task + envelopeFor(self, "", { turn: taskTurn, asker }) + (b.lead === true ? renderReminder({ wezard: "lead" }, renderLeadPlaybook()) : "") : undefined,
-                    ...(task ? { bootstrapFrom: { from: { kind: "peer", from: self, turn: taskTurn, ...(jobId ? { job: jobId } : {}), ...(asker ? { asker } : {}) }, query: task } } : {}),
+                    // Fork initialization carries no task; actual work is durably accepted below.
                     keepalive,
                 }).catch((e) => ({ ok: false, reason: `spawn threw: ${String(e)}`, inherited: false }));
                 // 生不出来就回滚身份 —— 否则名字被一个永远没有会话的记录占住。
@@ -3167,26 +3360,22 @@ const main = async () => {
                         ...(kid.description ? { job: kid.description } : {}), cwd: r.cwd,
                     }, subjectOf(wizards.get(target)));
                 }
-                // 继承路径上活已经随开场白进去了, 空白分身才需要在这里补一次注入 (私聊)。
-                let dispatched = r.inherited && !!task;
-                if (task && !r.inherited && birthGuard()) {
-                    const inj = await m.injectText(target, task, undefined, { from: { kind: "peer", from: self, turn: taskTurn, ...(jobId ? { job: jobId } : {}), ...(asker ? { asker } : {}) }, channel: "", envelope: envelopeFor(self, "", { turn: taskTurn, asker }), guard: birthGuard });
-                    dispatched = inj.ok;
+                const dispatched = !!task && birthGuard();
+                if (dispatched) {
+                    const eventId = `p:${self}:${target}:${taskTurn}:1`;
+                    const deadlineAt = deadlineOf(taskAt);
+                    events.accept({ id: eventId, target, speaker: self, channel: "", asker, k, priority: "normal", deadline: deadlineAt,
+                        payload: { text: task, peer: {
+                                from: { kind: "peer", from: self, turn: taskTurn, ...(jobId ? { job: jobId } : {}), ...(asker ? { asker } : {}) },
+                                envelope: envelopeFor(self, "", { turn: taskTurn, asker }) + (b.lead === true ? renderReminder({ wezard: "lead" }, renderLeadPlaybook()) : ""),
+                                tell: { from: self, to: target, channel: "", job: jobId, at: taskAt, turn: taskTurn, legs: 1, deadlineAt, k, asker, dispatchKey: eventId },
+                                job: jobId, kind: "task", spawned: true, role: roleParam(body.role),
+                            } } });
                 }
-                if (jobId && birthGuard()) {
-                    const role = roleParam(body.role);
-                    const from = inherit ? source : undefined;
-                    jobs.attach(jobId, { target, task, spawned: true, ...(role ? { role } : {}), ...(from ? { forkOf: from } : {}) });
+                else if (jobId && birthGuard()) {
+                    jobs.attach(jobId, { target, task: "", spawned: true, ...(roleParam(body.role) ? { role: roleParam(body.role) } : {}) });
                 }
-                if (jobId && dispatched)
-                    jobs.spend(jobId);
-                // 分身的第一件活也守回执: fan-out 最常见的形状就是 clone_wizard({task}) × N,
-                // 让它们干完自己把结论送回来, 发起方不必挂在 wait_peer 上。
-                if (dispatched)
-                    receipts.register({ from: self, to: target, channel: "", job: jobId, at: taskAt, turn: taskTurn, ...(k ? { k } : {}), ...(asker ? { asker } : {}) });
-                if (dispatched)
-                    ledger.open({ turn: taskTurn, owner: self, to: target, text: task, at: taskAt, ...(jobId ? { job: jobId } : {}), ...(k ? { for: k } : {}), ...(asker ? { asker } : {}) });
-                return { status: 200, body: { ok: true, target, name, address: name, inherited: r.inherited, sessionId: r.sessionId, cwd: r.cwd, dispatched, ...(dispatched ? { turn: taskTurn } : {}), keepalive, ...(r.model ? { model: r.model } : {}), ...(r.modelWarning ? { modelWarning: r.modelWarning } : {}), ...(r.effort ? { effort: r.effort } : {}), ...(pick.tier ? { tier: pick.tier } : {}), via: pick.via, ...(pick.note ? { tierNote: pick.note } : {}), ...(jobId ? { job: jobId } : {}), ...(detached ? { detached: true } : {}) } };
+                return { status: 200, body: { ok: true, target, name, address: name, inherited: r.inherited, sessionId: r.sessionId, cwd: r.cwd, dispatched, queued: dispatched, ...(dispatched ? { turn: taskTurn } : {}), keepalive, ...(r.model ? { model: r.model } : {}), ...(r.modelWarning ? { modelWarning: r.modelWarning } : {}), ...(r.effort ? { effort: r.effort } : {}), ...(pick.tier ? { tier: pick.tier } : {}), via: pick.via, ...(pick.note ? { tierNote: pick.note } : {}), ...(jobId ? { job: jobId } : {}), ...(detached ? { detached: true } : {}) } };
             }
             finally {
                 if (birthJob) {
@@ -3211,6 +3400,7 @@ const main = async () => {
             cancel: (run) => {
                 workflow.cancel(undefined, run.owner, run.plan.job);
                 run.nodes.filter((n) => n.to).forEach((n) => receipts.cancel(n.to, run.owner, (x) => x.from === run.owner && x.turn === n.turn));
+                events.cancel((e) => e.speaker === run.owner && e.payload.peer?.job === run.plan.job);
                 receipts.cancelHeld(run.plan.job, run.owner);
             },
             error: (e) => log.error({ err: errText(e) }, "workflow plan advancement paused"),
@@ -3514,6 +3704,7 @@ const main = async () => {
                 if (how === "cancel")
                     j.members.filter((mm) => !mm.outcome).forEach((mm) => receipts.cancel(mm.target, j.owner, (x) => x.from === j.owner));
                 // 这张单名下还排着没投的 (after 停放) 也不投了。
+                events.cancel((e) => e.speaker === j.owner && e.payload.peer?.job === j.id);
                 receipts.cancelHeld(j.id, j.owner);
                 const closed = jobs.close(j.id, summary, mark);
                 ledger.closeJob(j.id);
@@ -4086,6 +4277,8 @@ const main = async () => {
                     const turn = newTurn();
                     // Confirm idle inside the physical pane transaction; a race is unsent
                     // and returns to the target consumer, without releasing task dedup.
+                    if (quiet)
+                        quietRelays.set(turn, { target, at, base: baseOfKey(target) });
                     const inj = await m.injectText(target, text, undefined, quiet
                         ? { guard, requireIdle: true, from: { kind: "task", taskId }, channel: "", envelope: renderTaskEnvelope(taskId, { turn }) }
                         : { guard, requireIdle: true, fromChat: true, from: { kind: "task", taskId }, envelope: renderTaskEnvelope(taskId) });
@@ -4106,12 +4299,19 @@ const main = async () => {
             const end = at + TASK_QUIET_WAIT_MS;
             // 先等它动起来: 刚注入时注册表还报 idle。
             await sleep(5000);
-            while (Date.now() < end) {
-                await m.untilIdle(t, end - Date.now());
+            let firstObservation = true;
+            while (firstObservation || Date.now() < end) {
+                firstObservation = false;
+                if (Date.now() < end)
+                    await m.untilIdle(t, end - Date.now());
                 const reply = (m.replyToPeer(t, "", at, turn)?.text ?? "").trim();
                 if (reply && (await m.idleNow(t))) {
-                    if (!isQuiet(reply))
-                        notifyChat(base, withTagHeader(t, reply, undefined, base));
+                    if (!isQuiet(reply)) {
+                        const eventId = `quiet:${t}:${turn}`;
+                        const revision = finalId(eventId, base, reply);
+                        events.delivery({ id: finalId(eventId, base, revision), eventId, target: t, turn, channel: base,
+                            revision, body: reply, chunks: m.formatFinal(t, turn, base, reply) });
+                    }
                     log.info({ target: t, quiet: isQuiet(reply), len: reply.length }, "quiet task: 一轮结束");
                     quietRelays.drop(turn);
                     return;
@@ -4119,10 +4319,10 @@ const main = async () => {
                 await sleep(5000);
             }
             log.warn({ target: t }, "quiet task: 等满仍没收口, 不转发");
-            quietRelays.drop(turn);
+            quietRelays.set(turn, { target: t, at, base, reason: "deadline passed; final not observed, retained for reconciliation" });
         };
         // 落盘: 这个仓库里 reload 是常态, 守在内存里的那一轮一 reload 就既不转发也不说 QUIET 了。
-        const quietRelays = loadJsonMap(join(cfg.daemon.stateDir, "quiet-relays.json"), (rows) => Object.fromEntries(Object.entries(rows).filter(([, r]) => Date.now() - r.at < TASK_QUIET_WAIT_MS)));
+        const quietRelays = loadJsonMap(join(cfg.daemon.stateDir, "quiet-relays.json"), undefined, { strict: true });
         void m.restored.then(() => Object.entries(quietRelays.all()).forEach(([turn, r]) => void relayUnlessQuiet(r.target, r.at, turn, r.base)));
         /** 到点起一个白板 wizard 执行这一枪, 跑完自动收掉。 */
         const runTaskInRunner = async (target, text, taskId, quiet, busy, guard) => {
@@ -4171,6 +4371,8 @@ const main = async () => {
             }
             const at = Date.now();
             const turn = newTurn();
+            if (quiet)
+                quietRelays.set(turn, { target: runner, at, base });
             const inj = await m.injectText(runner, text, undefined, quiet
                 ? { guard: allowed, from: { kind: "task", taskId }, channel: "", envelope: renderTaskEnvelope(taskId, { turn }) }
                 : { guard: allowed, fromChat: true, from: { kind: "task", taskId }, envelope: renderTaskEnvelope(taskId) });
@@ -4304,6 +4506,7 @@ const main = async () => {
     }
     const shutdown = async (signal) => {
         log.info({ signal }, "shutdown signal");
+        events.stop();
         stopReceipts();
         scheduler.stop();
         steward?.stop();