wezard 2.7.2 → 2.7.4

package/dist/daemon/mirror-bridge.js

@@ -1,6 +1,6 @@
 import { finalId } from "./message-events.js";
 import { parseEnvelope, renderTail } from "../shared/reminder.js";
-import { codexSessions, codexSessionForPane } from "../shared/codex.js";
+import { codexSessions, codexSessionForPane, recordCodexPaneSession } from "../shared/codex.js";
 import { codexHookLaunchArgs, codexHookCommand } from "../shared/codex-hooks.js";
 import { fileURLToPath } from "node:url";
 // Mirror-mode bridge.
@@ -1288,9 +1288,6 @@ const BOX_PROMPT_RE = /^\s*[❯>]\s?/u;
 const BOX_FOOTER_ROWS = 6;
 const UNKNOWN_BOX = { known: false, body: "" };
 export const parseInputBox = (cap, styledLayout = cap) => {
-    const lines = cap.split("\n");
-    while (lines.length && lines[lines.length - 1].trim() === "")
-        lines.pop();
     // Codex has no rulers. Anchor the composer to its bottom shortcuts footer,
     // then use the LAST › prompt: earlier prompts belong to the transcript.
     // Requiring a status row and a blank separator avoids treating arbitrary
@@ -1301,36 +1298,50 @@ export const parseInputBox = (cap, styledLayout = cap) => {
     while (layout.length && !layout[layout.length - 1].trim())
         layout.pop();
     const footer = layout.length - 1;
-    // Codex hides the shortcuts row while the composer contains text.
-    const shortcuts = /(?:^|\s)\? for shortcuts(?:\s|$)/u.test(layout[footer] ?? "");
-    if (shortcuts || (layout[footer] ?? "").includes("·")) {
-        let status = shortcuts ? footer - 1 : footer;
+    // A populated Codex composer replaces shortcuts with "tab to queue message"
+    // and may have no background SGR. Its footer still anchors the editable box;
+    // missing it sends collapsed pastes through the 15s late-landing window.
+    const inputHint = /(?:^|\s)(?:\? for shortcuts|tab to queue message)(?:\s|$)/u.test(layout[footer] ?? "");
+    // Idle Codex hides the left hint after a paste but keeps a right-aligned
+    // warnings footer. Its middle dot is not the status row's separator.
+    const warnings = /^\s*⚠\s*\d+\s+warnings?\s*·\s*f2 to view\s*$/u.test(layout[footer] ?? "");
+    // --no-alt-screen 的 composer 没有背景 SGR; 原生 Context + cwd 行才是状态锚, warning 的 · 不能充当它。
+    const inlineStatus = /\bContext\s+\d+%\s+used\b/u.test(layout[footer] ?? "")
+        && /·\s+(?:\/|~\/)/u.test(layout[footer] ?? "");
+    if (inputHint || warnings || (layout[footer] ?? "").includes("·")) {
+        let status = inputHint || warnings ? footer - 1 : footer;
         while (status >= 0 && !layout[status].trim())
             status--;
         if (status >= 0 && footer - status <= BOX_FOOTER_ROWS && layout[status].includes("·") && status > 0 && !layout[status - 1].trim()) {
             let prompt = status - 2;
-            // Continuation rows are indented; a › inside pasted content is not a
-            // new composer prompt.
-            while (prompt >= 0 && !/^›(?:\s|$)/u.test(layout[prompt]))
+            // Only contiguous, indented continuation rows belong to this composer.
+            // Crossing a blank/output row can otherwise select a historical user
+            // prompt (which may carry the same background SGR as the live box).
+            while (prompt >= 0 && /^\s{2,}\S/u.test(layout[prompt]))
                 prompt--;
-            if (prompt >= 0 && (shortcuts || /\x1b\[[0-9;:]*48[;:]/u.test(styledLines[prompt]))) {
+            if (prompt >= 0 && /^›(?:\s|$)/u.test(layout[prompt])
+                && (prompt === 0 || !layout[prompt - 1].trim())
+                && (inputHint || inlineStatus || /\x1b\[[0-9;:]*48[;:]/u.test(styledLines[prompt]))) {
                 const body = dropDim(styledLines.slice(prompt, status).join("\n"))
                     .replace(/^\s*›\s?/u, "").replace(/[\s\u200b\ufeff]+/gu, " ").trim();
                 return { known: true, body };
             }
         }
     }
-    const rulers = lines.reduce((acc, l, i) => (BOX_RULER_RE.test(l) ? [...acc, i] : acc), []);
+    // Dim is presentation, not layout: removing it before locating rulers also
+    // removes dim borders/prompts, leaving collapsed pastes unverifiable.
+    const rulers = layout.reduce((acc, l, i) => (BOX_RULER_RE.test(l) ? [...acc, i] : acc), []);
     const bottom = rulers[rulers.length - 1];
     const top = rulers[rulers.length - 2];
     if (top === undefined || bottom === undefined || bottom - top < 1)
         return UNKNOWN_BOX;
-    if (lines.length - bottom > BOX_FOOTER_ROWS)
+    if (layout.length - bottom > BOX_FOOTER_ROWS)
         return UNKNOWN_BOX;
-    const rows = lines.slice(top + 1, bottom);
+    const rows = layout.slice(top + 1, bottom);
     if (!rows.length || !BOX_PROMPT_RE.test(rows[0]))
         return UNKNOWN_BOX;
-    const body = [rows[0].replace(BOX_PROMPT_RE, ""), ...rows.slice(1)].join("\n").replace(/[\s\u200b\ufeff]+/gu, " ").trim();
+    const body = dropDim(styledLines.slice(top + 1, bottom).join("\n"))
+        .replace(BOX_PROMPT_RE, "").replace(/[\s\u200b\ufeff]+/gu, " ").trim();
     return { known: true, body };
 };
 // CodeBuddy 忙时回车不落盘: 那句挂进输入框上方的待发队列, 一条一行
@@ -1438,8 +1449,12 @@ const paneHasLiveSession = async (paneId, homeDir, panePid, ps) => {
     const root = panePid ?? (await panePidOf(paneId));
     if (!root)
         return false;
-    const { kids } = ps ?? (await psSnap());
-    return registeredPidUnder(root, liveSessionPids(homeDir), kids) !== undefined;
+    const snapshot = ps ?? (await psSnap());
+    // Codex runs under a foreground bash wrapper and has no Claude registry.
+    const codexPids = codexSessionForPane(paneId)
+        ? [...snapshot.commands].filter(([, command]) => basename(command) === "codex").map(([pid]) => pid)
+        : [];
+    return registeredPidUnder(root, new Set([...liveSessionPids(homeDir), ...codexPids]), snapshot.kids) !== undefined;
 };
 /** 注入前问 pane 一句话: 还在吗 / 里面还有 AI 会话吗。
  *  `unknown` 必须由调用方按「不知道」处理 —— 不许当 pane 死了去重生。 */
@@ -1456,6 +1471,19 @@ const probePane = async (paneId, jsonlPath) => {
         return { state: "unknown" };
     return SHELL_RE.test(cmd.stdout.trim()) ? { state: "shell" } : { state: "session" };
 };
+// Recover only an exact SessionStart transcript match; a shared cwd is not identity.
+const codexPaneForTranscript = async (jsonlPath) => {
+    if (backendForPath(jsonlPath).name !== "codex")
+        return "";
+    const panes = await runTmux(["list-panes", "-a", "-F", "#{pane_id}"]);
+    if (!panes.ok)
+        return "";
+    for (const pane of panes.stdout.trim().split("\n")) {
+        if (codexSessionForPane(pane)?.jsonlPath === jsonlPath && (await probePane(pane, jsonlPath)).state === "session")
+            return pane;
+    }
+    return "";
+};
 /** 注册表没有 tmux 字段的后端 (codebuddy): pane 里住着谁只能沿 pane 的进程树往下找
  *  注册表登记过、还活着的 pid。冷 pane 的注册行晚于进程出生, `waitMs` 内轮询。 */
 const hostPidOnPane = async (target, homeDir, waitMs) => {
@@ -1530,9 +1558,9 @@ const witnessFor = (target, homeDir, jsonlPath, live, actualTranscript) => {
 // but the trailing Enter is eaten while the TUI is still initializing, so
 // the prompt sits typed-but-unsent. 校验策略见 injectViaTmuxText —— 以输入框
 // 整块为判据, 粘贴只在「确凿看见框仍是空的」时才重来。
-const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jsonlPath, bypassModalGuard = false, guard, eventId, expectedSessionId) => {
+const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jsonlPath, bypassModalGuard = false, guard, eventId, expectedSessionId, physicalGuard) => {
     const backendName = backend.name;
-    log.info({ target, len: text.length, images: images.length, freshSpawn, backendName }, "mirror inject (tmux)");
+    log.info({ target, eventId, len: text.length, images: images.length, freshSpawn, backendName }, "mirror inject (tmux)");
     // 就绪门: pane 里得真有一个进入了交互态的 AI 会话, 才轮得到贴。先于 modal guard ——
     // 这一步只读注册表, 会话都不在时也就不必去 capture pane 找对话框了。
     const gate = await awaitSession(target, backend.homeDir, freshSpawn, log);
@@ -1638,7 +1666,7 @@ const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jso
     // dispatch 已对 codebuddy 把 refs 合进 text (images 传空), 这里的
     // withImageRefs 是其它调用方直传 images 时的兜底 —— 幂等, 不会贴两份。
     if (backendName === "codebuddy") {
-        return injectViaTmuxText(target, withImageRefs(text, images), log, freshSpawn, witness, boundGuard, eventId);
+        return injectViaTmuxText(target, withImageRefs(text, images), log, freshSpawn, witness, boundGuard, eventId, bypassModalGuard, physicalGuard);
     }
     // Pump images first via clipboard+C-v so each one is attached as a separate
     // image content block. Each C-v needs a brief settle for Claude Code's TUI
@@ -1690,7 +1718,7 @@ const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jso
         const e = await runTmux(["send-keys", "-t", target, "Enter"]);
         return e.ok ? { ok: true } : { ok: false, reason: `tmux send-keys Enter failed: ${e.stderr.slice(-200)}` };
     }
-    return injectViaTmuxText(target, text, log, freshSpawn, witness, boundGuard, eventId);
+    return injectViaTmuxText(target, text, log, freshSpawn, witness, boundGuard, eventId, bypassModalGuard, physicalGuard);
 };
 // 图片以 @<path> 文本提及的形式进会话 (codebuddy 的 tmux 路径、一切 spawn 路径)。
 // 提升为共享 helper: dispatch 侧的印章 / 回显去重 / turn 记录必须拿到与 inject
@@ -1712,7 +1740,7 @@ const withImageRefs = (text, images) => {
 // 证人不作声 (忙时排队、slash 命令、无注册表的后端) 才看框回没回到贴之前的样子。
 // 框认得出来时这条判据可信, 于是允许多补回车 (空框上的回车在 CLI 里是 no-op);
 // 每次补之前再问一遍证人, 已提交就不补。
-const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WITNESS, guard, eventId) => {
+const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WITNESS, guard, eventId, bypassModalGuard = false, physicalGuard) => {
     // Warm pane: tight timings, low latency. Fresh spawn (claude --resume just
     // started, transcript still loading): extended timings — bracketed-paste
     // end can take 4-7s to be honored on a cold TUI. Only the fresh-spawn path
@@ -1740,8 +1768,16 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     // 时间门往前放 1s: jsonl 的 timestamp 与本机时钟同源, 只差写盘的毫秒。
     const since = Date.now() - 1000;
     let enterAt = Number.POSITIVE_INFINITY;
-    const submitted = () => requireEventEvidence
-        ? witness.submittedEvent(eventId, since) : witness.submitted(probe, since, enterAt);
+    let confirmed = false;
+    const submitted = () => {
+        const yes = requireEventEvidence
+            ? witness.submittedEvent(eventId, since) : witness.submitted(probe, since, enterAt);
+        if (yes && !confirmed) {
+            confirmed = true;
+            log.info({ target, eventId, enterToEvidenceMs: Number.isFinite(enterAt) ? Date.now() - enterAt : undefined }, "mirror inject: submission confirmed");
+        }
+        return yes;
+    };
     // 贴之前框里是什么: 空框、幽灵提示 (`Try "how do I log an error?"`)、甚至用户
     // 自己敲了一半的字 —— 一律作为基线, 免得去维护一张「哪些文案算空」的清单。
     const pre = await readPaneInput(target);
@@ -1755,9 +1791,23 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     const alreadyTyped = boxVerify && Boolean(probe) && stripWs(preBox.body).includes(probe);
     // 提交后框该回到的样子: 正常是贴之前的基线; 文本本就在框里时基线就是它, 只能以「空」为准。
     const baseBody = alreadyTyped ? "" : preBox.body;
+    let landedBody = alreadyTyped ? preBox.body : undefined;
     /** 框里还是贴之前那样 (或彻底空了) = 我们的文本不在框里。 */
     const boxIntact = (b) => boxVerify && b.known && (b.body === "" || b.body === baseBody);
-    const loadAndPaste = () => pasteTmuxBuffer(target, text, guard ? () => guard("paste") : undefined);
+    const loadAndPaste = async () => {
+        const start = Date.now();
+        const result = await pasteTmuxBuffer(target, text, async () => (!physicalGuard || await physicalGuard("paste")) && (!guard || guard("paste")));
+        log.info({ target, eventId, tmuxPasteMs: Date.now() - start, boxVerify, ok: result.ok }, "mirror inject: paste completed");
+        return result;
+    };
+    const landed = (cap, box) => {
+        const seen = box.known ? (boxVerify ? !boxIntact(box) : box.body !== "") : Boolean(headFp) && stripWs(cap).includes(headFp);
+        // Bind recovery to the first observed paste, not arbitrary contents found
+        // after settling: another writer may have replaced the draft meanwhile.
+        if (seen && box.known && landedBody === undefined)
+            landedBody = box.body;
+        return seen;
+    };
     // 框认得出来 → 看它变没变; 认不出来 → 退回宽窗口找 headFp (长文本会换行,
     // 头部可能在框顶, 所以窗口要宽)。
     const sawLanded = async (timeoutMs) => {
@@ -1766,7 +1816,7 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
             const { cap, box } = await readPaneInput(target);
             // A redraw can hide the baseline. Once the composer reappears, its
             // nonempty body also proves landing of a collapsed paste.
-            if (box.known ? (boxVerify ? !boxIntact(box) : box.body !== "") : Boolean(headFp) && stripWs(cap).includes(headFp))
+            if (landed(cap, box))
                 return true;
             await sleep(POLL_MS);
         }
@@ -1778,7 +1828,7 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
         if (submitted())
             return "submitted";
         const { cap, box } = await readPaneInput(target);
-        if (box.known ? (boxVerify ? !boxIntact(box) : box.body !== "") : Boolean(headFp) && stripWs(cap).includes(headFp))
+        if (landed(cap, box))
             return "landed";
         if (Date.now() - t0 >= timeoutMs)
             return box.known ? "intact" : "unknown";
@@ -1797,6 +1847,8 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     let pastedAt = Date.now();
     if (alreadyTyped) {
         // Existing text is already exposed, even if permission was just withdrawn.
+        if (physicalGuard && !(await physicalGuard("submit")))
+            return { ok: false, uncertain: true, reason: "original handoff CLI identity changed before existing input submission" };
         if (guard && !guard("paste"))
             return { ok: false, uncertain: true, reason: "existing input submission canceled by dispatch guard" };
         log.warn({ target, headFp }, "mirror inject: 输入框里已有这段文本 (上次未提交) — 不重贴, 直接提交");
@@ -1878,8 +1930,28 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
             await sleep(Math.max(0, POST_PASTE_SETTLE_FALLBACK_MS - (Date.now() - pastedAt)));
     }
     const sendEnter = async () => {
+        // A picker can open after the pre-paste gate, especially during a delayed
+        // render. Check again before every Enter; askq text entry keeps its bypass.
+        if (process.env.WEZARD_MODAL_GUARD !== "0" && !bypassModalGuard) {
+            const modal = await detectModalPicker(target);
+            if (modal.modal || !modal.screen.trim())
+                return { ok: false, reason: "native picker or unreadable pane before submission; refusing Enter" };
+        }
+        if (submitted())
+            return { ok: true };
+        if (landedBody !== undefined) {
+            const box = await readInputBox(target);
+            if (!box.known || box.body !== landedBody)
+                return { ok: false, reason: "composer changed after paste verification; refusing Enter" };
+        }
+        if (physicalGuard && !(await physicalGuard("submit")))
+            return { ok: false, reason: "original handoff CLI identity changed before submit" };
         if (guard && !guard("submit"))
             return { ok: false, reason: "submit canceled by dispatch guard" };
+        if (tailFp && !Number.isFinite(enterAt)) {
+            enterAt = Date.now();
+            log.info({ target, eventId, pasteToEnterMs: enterAt - pastedAt, pasteSeen, boxTrusted, freshSpawn }, "mirror inject: first Enter");
+        }
         const e = await runTmux(["send-keys", "-t", target, "Enter"]);
         return e.ok ? { ok: true } : { ok: false, reason: `tmux send-keys failed: ${e.stderr.slice(-200)}` };
     };
@@ -1930,19 +2002,26 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     }
     // 回车可能被冷启动中的 TUI 吞掉 (框里躺着没提交的提示)。框认得出来时判据可信,
     // 多补一次; 认不出来时维持原来的「只补一次」, 免得判据出错往真实对话里灌回车。
-    const boxTrusted = boxVerify && (await readInputBox(target)).known;
-    const attempts = requireEventEvidence ? 1 : boxTrusted ? 3 : 2;
+    const pendingBox = await readInputBox(target);
+    const boxTrusted = boxVerify && pendingBox.known;
+    // An event may retry Enter only while the very same landed composer remains.
+    // Empty/unknown/changed boxes need transcript evidence, never another paste
+    // or a blind Enter that could confirm a newly opened native picker.
+    const pendingBody = pasteSeen && pendingBox.known && pendingBox.body === landedBody
+        ? landedBody : undefined;
+    const attempts = requireEventEvidence ? pendingBody ? 3 : 1 : boxTrusted ? 3 : 2;
     for (let i = 0; i < attempts; i++) {
         if (i > 0) {
             await sleep(RETRY_SETTLE_MS);
             if (submitted())
                 return { ok: true }; // 迟到的确认 —— 补的这一下会落在空框上, 省了
+            if (requireEventEvidence) {
+                const box = await readInputBox(target);
+                if (!box.known || box.body !== pendingBody)
+                    break;
+            }
             log.warn({ target, tailFp, attempt: i + 1 }, "mirror inject: 回车后输入框未清空, 再补一次");
         }
-        if (i === 0) {
-            enterAt = Date.now();
-            log.info({ target, pasteToEnterMs: enterAt - pastedAt, pasteSeen, boxTrusted, freshSpawn }, "mirror inject: first Enter");
-        }
         const e = await sendEnter();
         if (!e.ok)
             return e;
@@ -1965,11 +2044,10 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
         log.warn({ target, eventId, freshSpawn, boxTrusted, witness: witness.status }, "mirror inject: 框空了且转录里始终没有这一笔, 判不确定并停止重贴");
         return { ok: false, uncertain: true, reason: "composer cleared without this event's transcript marker; delivery remains uncertain and will not be resubmitted" };
     }
-    // 补到头还没清空。通常是渲染滞后 (回车其实落了), 但也可能是目标会话正忙 /
-    // 上下文满了不消费输入 —— 那样用户这条消息会悄无声息地消失。不报硬失败 (用户
-    // 多半已经被服务到了), 标 uncertain 让调用方按需提示。
-    log.warn({ target, tailFp, freshSpawn, boxTrusted, witness: witness.status }, "mirror inject: clear not observed, trusting submit");
-    return { ok: true, uncertain: true, reason: "目标会话可能正忙或未消费输入(回车后输入框未清空)" };
+    // 补到头仍没证据: 可能只是渲染/落盘迟到, 也可能根本没提交。
+    // 保留 uncertain 阻止重贴, 但不能让只看 ok 的调用方把它当成已送达。
+    log.warn({ target, tailFp, freshSpawn, boxTrusted, witness: witness.status }, "mirror inject: submission unconfirmed, stopping input");
+    return { ok: false, uncertain: true, reason: "目标会话未确认收下消息，停止输入以避免误提交或重复投递" };
 };
 const injectViaSpawn = async (args) => {
     const { text, images = [], cfg, log, sessionId, jsonlPath } = args;
@@ -2100,7 +2178,7 @@ const inject = async (args) => {
                 }
                 return true;
             };
-            return injectViaTmux(target, text, args.images ?? [], args.log, args.freshSpawn ?? false, backendForPath(args.jsonlPath), args.jsonlPath, args.bypassModalGuard ?? false, guard, args.eventId, args.sessionId);
+            return injectViaTmux(target, text, args.images ?? [], args.log, args.freshSpawn ?? false, backendForPath(args.jsonlPath), args.jsonlPath, args.bypassModalGuard ?? false, guard, args.eventId, args.sessionId, args.physicalGuard);
         }, { guard: args.guard }));
     }
     catch (error) {
@@ -2128,17 +2206,19 @@ const etimeSec = (s) => {
     return ((d * 24 + h) * 60 + mi) * 60 + se;
 };
 const psSnap = () => new Promise((resolve) => {
-    const p = spawn("ps", ["-axo", "pid=,ppid=,etime="], { env: { ...process.env, PATH: augmentedPath(process.env.PATH) }, stdio: ["ignore", "pipe", "ignore"] });
+    const p = spawn("ps", ["-axo", "pid=,ppid=,etime=,comm="], { env: { ...process.env, PATH: augmentedPath(process.env.PATH) }, stdio: ["ignore", "pipe", "ignore"] });
     let out = "";
     p.stdout?.on("data", (c) => (out += c.toString("utf8")));
     const done = () => {
         const kids = new Map();
         const etimes = new Map();
+        const commands = new Map();
         for (const line of out.split("\n")) {
-            const [pidS = "", ppidS = "", etS = ""] = line.trim().split(/\s+/);
+            const [pidS = "", ppidS = "", etS = "", ...command] = line.trim().split(/\s+/);
             const pid = Number(pidS), ppid = Number(ppidS), et = etimeSec(etS);
             if (!pid || !ppid)
                 continue;
+            commands.set(pid, command.join(" "));
             const arr = kids.get(ppid);
             if (arr)
                 arr.push(pid);
@@ -2147,10 +2227,10 @@ const psSnap = () => new Promise((resolve) => {
             if (!Number.isNaN(et))
                 etimes.set(pid, et);
         }
-        resolve({ kids, etimes });
+        resolve({ kids, etimes, commands });
     };
     p.on("close", done);
-    p.on("error", () => resolve({ kids: new Map(), etimes: new Map() }));
+    p.on("error", () => resolve({ kids: new Map(), etimes: new Map(), commands: new Map() }));
 });
 /** Drop a session's queue chain. A hung job can't be cancelled (it's parked in a
  *  tmux read), but detaching the chain means the NEXT message doesn't inherit
@@ -2292,6 +2372,97 @@ export const startMirror = (deps) => {
     };
     const TOOL_DETAIL_PREFIX = "TOOL_DETAIL|";
     let eventFinalGate = () => true;
+    let eventOwnerGate = () => true;
+    const eventOwned = (id) => {
+        const event = id ? deps.events?.get(id) : undefined;
+        return !event || eventOwnerGate(event);
+    };
+    const briefMode = (a) => cfg.wrc.mirror.brief
+        || !!(a.activeEventId && deps.events?.get(a.activeEventId)?.payload.peer?.transferred);
+    const bubbleOwned = (a, b) => {
+        const event = b.owner ? deps.events?.get(b.owner) : undefined;
+        return !event || event.target === a.target && eventOwnerGate(event);
+    };
+    const replyBubbles = new Map();
+    const rememberReplyBubble = (id, bubble) => {
+        if (replyBubbles.has(id))
+            return;
+        replyBubbles.set(id, bubble);
+        setTimeout(() => { if (replyBubbles.get(id) === bubble)
+            replyBubbles.delete(id); }, Math.max(0, (bubble.expires ?? Date.now()) - Date.now()) + 60_000).unref?.();
+    };
+    const claimReplyBubble = (event) => {
+        if (!deps.events || !eventOwnerGate(event) || !event.channel)
+            return undefined;
+        const origin = deps.events.replyOrigin(event);
+        const human = origin?.payload.human;
+        if (!origin || !human)
+            return undefined;
+        const source = byTarget.get(origin.target);
+        const out = source?.outbound;
+        if (source && out?.streamId === human.streamId) {
+            if (out.kind === "deferred")
+                clearTimeout(out.timer);
+            source.outbound = undefined;
+        }
+        let bubble = replyBubbles.get(origin.id);
+        if (!bubble) {
+            const expires = origin.at + HARD_TIMEOUT_MS;
+            if (expires <= Date.now() || deps.events.hasReplyDelivery(human.streamId))
+                return undefined;
+            bubble = { frame: human.frame, streamId: human.streamId, expires, done: false, owner: event.id };
+            rememberReplyBubble(origin.id, bubble);
+        }
+        if (bubble.done || Date.now() >= (bubble.expires ?? 0))
+            return undefined;
+        if (bubble.source) {
+            const stream = bubble.source;
+            stream.closed = true;
+            clearTimeout(stream.flushTimer);
+            clearTimeout(stream.idleTimer);
+            clearTimeout(stream.hardTimer);
+            bubble.pending = stream.pending;
+            const source = byTarget.get(stream.target);
+            if (source?.liveStream === stream)
+                source.liveStream = undefined;
+            bubble.source = undefined;
+        }
+        if (bubble.owner !== event.id) {
+            // The same object carries the last in-flight write into the receiver's FIFO.
+            // Old final/cleanup/timer paths lose authority before this object is reused.
+            byTarget.forEach((a) => {
+                if (a.briefBubble === bubble) {
+                    clearCot(a);
+                    a.briefBubble = undefined;
+                }
+            });
+            clearTimeout(bubble.hardTimer);
+            bubble.owner = event.id;
+        }
+        return bubble;
+    };
+    const transferReply = (event) => {
+        const bubble = claimReplyBubble(event);
+        if (!bubble)
+            return;
+        const origin = deps.events?.replyOrigin(event);
+        bubble.pending = (bubble.pending ?? Promise.resolve()).catch(() => undefined).then(async () => {
+            if (bubble.done || bubble.owner !== event.id || !eventOwnerGate(event))
+                return;
+            await client.replyStream(bubble.frame, bubble.streamId, withLinkedTagHeader(event.target, "…", chatTurnUrl(event.target, event.turn || origin?.turn), undefined, undefined, event.channel), false);
+        }).catch((e) => { log.debug({ event: event.id, err: errText(e) }, "transfer reply refresh failed"); });
+    };
+    const armBriefBubble = (a, b, turnId, channel) => {
+        clearTimeout(b.hardTimer);
+        const owner = b.owner;
+        if (!isWxFrame(b.frame))
+            b.hardTimer = setTimeout(() => {
+                if (b.owner !== owner || !bubbleOwned(a, b))
+                    return;
+                const live = a.briefBubble === b && !a.briefConcluded;
+                void finishBubble(a, b, briefLine(a, turnId, live ? STILL_WORKING : "", channel), true);
+            }, Math.max(0, (b.expires ?? Date.now()) - Date.now()));
+    };
     const newTurnId = () => `t${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
     const newMarkId = () => `m${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
     const detailCardFor = (s, target) => {
@@ -2309,13 +2480,13 @@ export const startMirror = (deps) => {
     };
     const flushStream = async (s) => {
         s.flushTimer = undefined;
-        if (s.closed || s.dead || s.acc === s.lastSent)
+        if (s.closed || s.dead || s.acc === s.lastSent || !eventOwned(s.eventId))
             return;
         const content = s.acc;
         s.lastSent = content;
         try {
             await (s.pending = (s.pending ?? Promise.resolve()).catch(() => undefined).then(async () => {
-                if (s.closed || s.dead)
+                if (s.closed || s.dead || !eventOwned(s.eventId))
                     return;
                 await client.replyStream(s.frame, s.streamId, withLinkedTagHeader(s.target, content || "…", chatTurnUrl(s.target, s.turnId), undefined, undefined, s.dest), false);
             }));
@@ -2356,10 +2527,12 @@ export const startMirror = (deps) => {
         // 例外是 hard cap 超时: turn 还在跑, 收口时缀上中间结束语 —— 这时即使没正文
         // 也有话可说, 不算空覆盖。
         const body = timedOut ? [s.acc, STILL_WORKING].filter((x) => x.trim()).join("\n\n") : s.acc;
-        if (!s.dead && body.trim()) {
+        if (!s.dead && body.trim() && eventOwned(s.eventId)) {
             const card = detailCardFor(s, a.target);
             try {
                 await s.pending?.catch(() => undefined);
+                if (!eventOwned(s.eventId))
+                    return;
                 if (card) {
                     s.cardSent = true;
                     await client.replyStreamWithCard(s.frame, s.streamId, withLinkedTag(a, body, undefined, s.turnId), true, { templateCard: card });
@@ -2388,8 +2561,9 @@ export const startMirror = (deps) => {
         if (a.liveStream === s)
             a.liveStream = undefined;
     };
-    const openStream = (a, frame, streamId) => {
+    const openStream = (a, frame, streamId, eventId = a.activeEventId) => {
         const s = {
+            eventId,
             turnId: newTurnId(),
             frame, streamId,
             target: a.target,
@@ -2398,6 +2572,11 @@ export const startMirror = (deps) => {
             capped: false, closed: false, dead: false, cardSent: false,
             tools: [], sawTool: false,
         };
+        const event = eventId ? deps.events?.get(eventId) : undefined;
+        if (event?.payload.human)
+            rememberReplyBubble(event.id, {
+                frame, streamId, done: false, owner: event.id, source: s, expires: event.at + HARD_TIMEOUT_MS,
+            });
         // 微信帧没有 stream 窗口: 到点收口只会多发一条「仍在处理中」, 白占它那几格出站额度。
         if (!isWxFrame(frame))
             s.hardTimer = setTimeout(() => void finalizeStream(a, s, true), HARD_TIMEOUT_MS);
@@ -2422,7 +2601,8 @@ export const startMirror = (deps) => {
     // turnSilent 已被拦下; 非 brief 的逐条推送在这里兜一道 —— 只放 `[mirror]` /
     // `[wezard]` 系统提示 (它们回 home)。
     const sendStandalone = (a, content) => {
-        if (!hasVisibleBody(content))
+        const eventId = a.activeEventId;
+        if (!hasVisibleBody(content) || !eventOwned(eventId))
             return;
         if (isPrivate(a) && !/^\[(mirror|wezard)\]/.test(content.trim()))
             return;
@@ -2433,6 +2613,8 @@ export const startMirror = (deps) => {
         a.standalonePending = a.standalonePending
             .then(async () => {
             for (const c of chunks) {
+                if (!eventOwned(eventId))
+                    return;
                 try {
                     const ack = await client.sendMessage(chatId, { msgtype: "markdown", markdown: { content: c } });
                     log.info({ sessionId: a.sessionId, turnId, chatId, len: c.length, ack: JSON.stringify(ack ?? null).slice(0, 300) }, "standalone pushed");
@@ -2446,12 +2628,15 @@ export const startMirror = (deps) => {
     };
     // Like sendStandalone but skips withTagHeader — content already contains the tag header (e.g. as a link).
     const sendRaw = (a, content) => {
-        if (!hasVisibleBody(content))
+        const eventId = a.activeEventId;
+        if (!hasVisibleBody(content) || !eventOwned(eventId))
             return;
         const chatId = replyChatId(a);
         const turnId = a.briefTurnId ?? a.liveStream?.turnId;
         a.standalonePending = a.standalonePending
             .then(async () => {
+            if (!eventOwned(eventId))
+                return;
             try {
                 await client.sendMessage(chatId, { msgtype: "markdown", markdown: { content } });
                 log.info({ sessionId: a.sessionId, turnId, chatId, len: content.length }, "raw pushed");
@@ -2560,13 +2745,22 @@ export const startMirror = (deps) => {
     };
     // Path A: a needs-approval tool_use just landed. Aggregate the buffer as one
     // standalone, send it BEFORE the approval card race, transition to AWAITING_APPR.
+    const discardUnownedOutbound = (a, out) => {
+        if (eventOwned(out.eventId))
+            return false;
+        if (out.kind === "deferred")
+            clearTimeout(out.timer);
+        if (a.outbound === out)
+            a.outbound = undefined;
+        return true;
+    };
     const promoteToStandalone = (a) => {
         const out = a.outbound;
-        if (out?.kind !== "deferred")
+        if (out?.kind !== "deferred" || discardUnownedOutbound(a, out))
             return;
         clearTimeout(out.timer);
         const md = renderBuf(out.buf);
-        a.outbound = { kind: "awaiting_appr", frame: out.frame, streamId: out.streamId };
+        a.outbound = { kind: "awaiting_appr", eventId: out.eventId, frame: out.frame, streamId: out.streamId };
         flushPendingStandalone(a);
         if (md)
             sendStandalone(a, md);
@@ -2586,7 +2780,7 @@ export const startMirror = (deps) => {
     // Pure-text turn or no trailing final text → no split, all into streamId.
     const exitDeferredAsFinalStream = (a) => {
         const out = a.outbound;
-        if (out?.kind !== "deferred")
+        if (out?.kind !== "deferred" || discardUnownedOutbound(a, out))
             return;
         clearTimeout(out.timer);
         const buf = out.buf;
@@ -2611,15 +2805,15 @@ export const startMirror = (deps) => {
             try {
                 // 有正文才写旧 streamId (收入 stream); 空缓冲一个字都不写 —— 否则
                 // loading 气泡被 " " 覆盖, 结束处理自己凭空制造一条空消息。
-                if (bubbleMd)
+                if (bubbleMd && eventOwned(out.eventId))
                     await client.replyStream(out.frame, out.streamId, withLinkedTag(a, bubbleMd), true);
             }
             catch (e) {
                 log.warn({ sessionId: a.sessionId, err: e.message }, "exit-deferred finalize failed; falling back to standalone");
-                if (bubbleMd)
+                if (bubbleMd && eventOwned(out.eventId))
                     sendStandalone(a, bubbleMd);
             }
-            if (trailingMd)
+            if (trailingMd && eventOwned(out.eventId))
                 sendStandalone(a, trailingMd);
         })();
         log.info({ sessionId: a.sessionId, items: buf.length, bubbleLen: bubbleMd.length, trailingLen: trailingMd.length, sawTool }, "outbound: DEFERRED → IDLE (turn_end, finalized to streamId)");
@@ -2629,17 +2823,19 @@ export const startMirror = (deps) => {
     // STREAMING branch since outbound is now undefined.
     const promoteToStream = (a) => {
         const out = a.outbound;
-        if (out?.kind !== "deferred")
+        if (out?.kind !== "deferred" || discardUnownedOutbound(a, out))
             return;
         const { buf, frame, streamId } = out;
         a.outbound = undefined;
-        const s = openStream(a, frame, streamId);
+        const s = openStream(a, frame, streamId, out.eventId);
         a.liveStream = s;
         if (buf.length === 0) {
             // Empty buffer — claude still thinking. Send the "…" ack so the user
             // sees the bubble; subsequent items grow it as today.
             void (async () => {
                 try {
+                    if (!eventOwned(s.eventId) || s.closed)
+                        return;
                     await (s.pending = client.replyStream(frame, streamId, withTagHeader(a.target, "…"), false));
                 }
                 catch (e) {
@@ -2662,7 +2858,7 @@ export const startMirror = (deps) => {
         // an empty buffer before any tool_use can be evaluated for approval-needs.
         const SAFETY_MS = 5 * 60_000;
         const timer = setTimeout(() => promoteToStream(a), SAFETY_MS);
-        a.outbound = { kind: "deferred", buf: [], frame, streamId, timer };
+        a.outbound = { kind: "deferred", eventId: a.activeEventId, buf: [], frame, streamId, timer };
         log.info({ sessionId: a.sessionId, safetyMs: SAFETY_MS }, "outbound: IDLE → DEFERRED (safety net)");
     };
     // Buffer / decide while in DEFERRED. user_text is CLI-side typing (not the
@@ -2671,7 +2867,7 @@ export const startMirror = (deps) => {
     // subsequent items don't reset (bounded promote delay).
     const handleDeferredItem = (a, item) => {
         const out = a.outbound;
-        if (out?.kind !== "deferred")
+        if (out?.kind !== "deferred" || discardUnownedOutbound(a, out))
             return;
         if (item.kind === "turn_end") {
             exitDeferredAsFinalStream(a);
@@ -2748,12 +2944,12 @@ export const startMirror = (deps) => {
         const b = a.briefBubble;
         const turnId = a.briefTurnId;
         // 收口后这一路全部失效: 气泡要么已 done, 要么 turn 已经换人/清空。
-        if (!text || !b || b.done || !turnId || a.briefConcluded)
+        if (!text || !b || b.done || !turnId || a.briefConcluded || !bubbleOwned(a, b))
             return;
         a.cotLastSent = text;
         try {
             await (b.pending = (b.pending ?? Promise.resolve()).catch(() => undefined).then(async () => {
-                if (b.done || a.briefBubble !== b || a.briefTurnId !== turnId)
+                if (b.done || a.briefBubble !== b || a.briefTurnId !== turnId || !bubbleOwned(a, b))
                     return;
                 await client.replyStream(b.frame, b.streamId, briefLine(a, turnId, text), false);
             }));
@@ -2765,7 +2961,7 @@ export const startMirror = (deps) => {
     /** 推进气泡里的 CoT 进度。节流窗口内到达的多条只留最后一条 —— 进度永远只展示"最新"。 */
     const updateBriefProgress = (a, raw) => {
         const b = a.briefBubble;
-        if (!b || b.done || a.briefConcluded)
+        if (!b || b.done || a.briefConcluded || !bubbleOwned(a, b))
             return;
         const line = cotLine(raw);
         if (!line)
@@ -2779,7 +2975,7 @@ export const startMirror = (deps) => {
      *  只有没有新 text 的窗口才把最新 tool 行刷上气泡。节流与 text 共用一个计时器。 */
     const updateBriefToolProgress = (a, raw) => {
         const b = a.briefBubble;
-        if (!b || b.done || a.briefConcluded)
+        if (!b || b.done || a.briefConcluded || !bubbleOwned(a, b))
             return;
         const line = cotLine(raw);
         if (!line)
@@ -2801,7 +2997,7 @@ export const startMirror = (deps) => {
     // `[mirror]` 系统提示 —— 它们都不走这道门。
     // 只在 brief 下生效: 抑制的前提是详情页兜得住内容, 而 turn store 只有 brief 在写。
     // 私聊轮 (wizard 之间, 非 public) 同理: 它的回复属于那场私聊, 只进双方的 rolepage。
-    const turnSilent = (a) => isPrivate(a) || (cfg.wrc.mirror.brief && cfg.wrc.mirror.chatOriginOnly && a.turnFromChat === false);
+    const turnSilent = (a) => !eventOwned(a.activeEventId) || isPrivate(a) || (cfg.wrc.mirror.brief && cfg.wrc.mirror.chatOriginOnly && a.turnFromChat === false);
     const formatFinal = (target, turn, channel, body) => {
         const pieces = splitMarkdown(body, Math.max(200, cfg.wrc.mirror.chunkBytes - TAG_HEADER_BUDGET));
         return pieces.map((text, n) => withLinkedTagHeader(target, text, chatTurnUrl(target, turn), pieces.length > 1 ? `${n + 1}/${pieces.length}` : undefined, undefined, channel));
@@ -2830,12 +3026,13 @@ export const startMirror = (deps) => {
         return id;
     };
     const recoverEventFinal = (event, bubble) => {
-        if (!event.result || event.interjected || event.canceled)
+        if ((deps.events?.get(event.id) ?? event).handoffCut || !event.result || event.interjected || event.canceled || !eventOwnerGate(event))
             return;
         // 事件泵的 evidence 探针 (observe → io.recovered) 与 brief 软收口赛跑: 两者同为
         // ~1s 周期, 探针常先跑到, 而它调这里不带气泡 —— queueFinal 拿不到 stream, 终句
         // 全部走 standalone, 气泡定格在最后一行 CoT 进度。没传气泡时按 target/turn 找回
         // 活着的那只 (turn 已换人/气泡已收则不挂, 维持 standalone)。
+        bubble ??= claimReplyBubble(event);
         bubble ??= (() => {
             const a = byTarget.get(event.target);
             return a && (!event.turn || a.briefTurnId === event.turn) && a.briefBubble && !a.briefBubble.done ? a.briefBubble : undefined;
@@ -2860,6 +3057,15 @@ export const startMirror = (deps) => {
         if (event.channel && eventFinalGate(event))
             queueFinal(event.target, turn, event.channel, event.result.body, event.id, bubble);
     };
+    const deliverTransferredFinal = (event, body) => {
+        if (!eventOwnerGate(event) || !event.channel)
+            return;
+        const turn = event.turn || event.id;
+        if (!getDetail(turn))
+            recordTurnStart({ id: turn, eventId: event.id, target: event.target,
+                userQuery: event.payload.text, createdAt: event.at, channel: event.channel, from: event.payload.peer?.from });
+        queueFinal(event.target, turn, event.channel, body, event.id, claimReplyBubble(event));
+    };
     // 收口一条 loading 气泡: finish=true 写入最终内容, 只生效一次。发送失败退回 standalone。
     // raw=true skips withTagHeader (used when content already contains the linked tag header).
     // WeCom 客户端收到 finish=true 后仍有打字机动画要播放, 如果紧接着就下发
@@ -2868,8 +3074,9 @@ export const startMirror = (deps) => {
     // standalone 自然排在 finish 之后; 额外加一小段延迟留给客户端渲染。
     const BUBBLE_FINISH_SETTLE_MS = 600;
     const finishBubble = async (a, b, content, raw = false) => {
-        if (!b || b.done)
+        if (!b || b.done || !bubbleOwned(a, b))
             return;
+        const owner = b.owner;
         b.done = true;
         clearTimeout(b.hardTimer);
         if (a.briefBubble === b)
@@ -2878,6 +3085,9 @@ export const startMirror = (deps) => {
         clearCot(a);
         const p = (async () => {
             try {
+                await b.pending?.catch(() => undefined);
+                if (b.owner !== owner || !bubbleOwned(a, b))
+                    return;
                 await client.replyStream(b.frame, b.streamId, raw ? (content || " ") : withLinkedTag(a, content || " "), true);
                 // 给 WeCom 客户端留一点时间完成打字机动画, 再放行 standalone 队列。
                 await new Promise((r) => setTimeout(r, BUBBLE_FINISH_SETTLE_MS));
@@ -2935,7 +3145,7 @@ export const startMirror = (deps) => {
     /** 这一轮挂在哪一笔上: 回执 (与老派活信封) 写在信封上; 新派活信封不带, 问注入事件的 `serves`。 */
     const rowOf = (env) => env.event ?? (env.eventId ? deps.events?.get(env.eventId)?.serves : undefined);
     const openingOf = (a) => {
-        const t = a.jsonlPath ? lastUserTurn(a.jsonlPath) : undefined;
+        const t = a.jsonlPath ? lastUserTurn(a.jsonlPath, a.openingOffset) : undefined;
         const env = t?.env;
         a.activeEventId = env?.eventId;
         if (!env)
@@ -3109,7 +3319,7 @@ export const startMirror = (deps) => {
         a.pendingChannel = { channel: s.channel ?? baseOfKey(a.target), speaker: s.speaker, at: now };
         a.pendingBriefQuery = s.query;
         a.pendingBriefAt = ts;
-        if (!cfg.wrc.mirror.brief) {
+        if (!briefMode(a)) {
             consumeChannel(a, false, consumeFrom(a));
             if (a.liveStream && !a.liveStream.closed)
                 a.liveStream.dest = s.channel ?? baseOfKey(a.target);
@@ -3119,19 +3329,14 @@ export const startMirror = (deps) => {
     const startBriefTurn = async (a, frame, streamId, isSlash = false, userQuery = "", channel, speaker, eventId) => {
         const turnId = newTurnId();
         // hardTimer 兜底: turn 若无终句 / turn_end 收口 (卡死/漏收), 到点仍收气泡。
-        const bubble = { frame, streamId, done: false, expires: (eventId ? deps.events?.get(eventId)?.at ?? Date.now() : Date.now()) + HARD_TIMEOUT_MS };
+        const bubble = { frame, streamId, done: false, owner: eventId, expires: (eventId ? deps.events?.get(eventId)?.at ?? Date.now() : Date.now()) + HARD_TIMEOUT_MS };
         if (eventId)
             deps.events?.bind(eventId, turnId);
         const q = { turnId, bubble, isSlash };
         // 微信帧不挂: 没有 stream 窗口要赶, 气泡等终句来了再一次发出 (见 openStream 同一条)。
-        if (!isWxFrame(frame))
-            bubble.hardTimer = setTimeout(() => {
-                // WeCom ~6min stream 窗口快到, 必须 finish=true 收口。finish 是整条替换 ——
-                // 定格在一行过期的 CoT 进度上看着像卡死, 光链接又像说完了; 气泡仍是本轮活跃
-                // 气泡 (turn 还在跑) 就明说「仍在处理中」, 已被顶替的旧轮只留链接。
-                const live = a.briefBubble === bubble && !a.briefConcluded;
-                void finishBubble(a, bubble, briefLine(a, turnId, live ? STILL_WORKING : "", channel), true);
-            }, HARD_TIMEOUT_MS);
+        if (eventId)
+            rememberReplyBubble(eventId, bubble);
+        armBriefBubble(a, bubble, turnId, channel);
         const seal = { eventId, keys: sealKeys(userQuery), at: Date.now(), query: userQuery, channel, speaker, fresh: true, turn: q };
         // 对方闲着 → 这一句就是下一轮, 当场接上。正忙 (在跑别人的回执 / 派活 / 上一句) 就先排着:
         // 那一轮的回复不能流进这一句的气泡, 等它在 transcript 里露面再接 (bindLine)。turn 记录
@@ -3161,7 +3366,7 @@ export const startMirror = (deps) => {
         if (a.channelSeeded)
             return false;
         const head = (t) => (t ?? "").replace(/\s+/g, " ").trim().slice(0, 60);
-        const opening = a.jsonlPath ? lastUserTurn(a.jsonlPath) : undefined;
+        const opening = a.jsonlPath ? lastUserTurn(a.jsonlPath, a.openingOffset) : undefined;
         const said = head(opening?.text);
         const eventId = opening?.env?.eventId;
         const r = openTurnsOf(a.target, a.sessionId).find((t) => eventId ? t.eventId === eventId : !!said && head(t.userQuery) === said);
@@ -3178,7 +3383,10 @@ export const startMirror = (deps) => {
         a.replyTo = publicPeer(r.from);
         a.turnFromChat = a.turnFromChat ?? true;
         a.briefTurnId = r.id;
-        a.briefBubble = undefined;
+        const event = eventId ? deps.events?.get(eventId) : undefined;
+        a.briefBubble = event ? claimReplyBubble(event) : undefined;
+        if (a.briefBubble)
+            armBriefBubble(a, a.briefBubble, r.id, a.channel);
         a.briefIsSlash = false;
         a.briefHadTool = r.items.some((it) => it.t === "tool_use");
         a.briefConcluded = false;
@@ -3212,7 +3420,10 @@ export const startMirror = (deps) => {
         a.briefTurnId = turnId;
         if (a.activeEventId)
             deps.events?.bind(a.activeEventId, turnId);
-        a.briefBubble = undefined;
+        const event = a.activeEventId ? deps.events?.get(a.activeEventId) : undefined;
+        a.briefBubble = event ? claimReplyBubble(event) : undefined;
+        if (a.briefBubble)
+            armBriefBubble(a, a.briefBubble, turnId, a.channel);
         a.briefIsSlash = false;
         a.briefHadTool = false;
         a.briefConcluded = false;
@@ -3269,7 +3480,7 @@ export const startMirror = (deps) => {
             else
                 queueFinal(a.target, turnId, a.channel ?? baseOfKey(a.target), body, undefined, a.briefBubble);
         }
-        else if (gated && !turnSilent(a)) {
+        else if (gated && eventOwned(a.activeEventId) && !turnSilent(a)) {
             // 链式收口 (eventFinalGate: 子活未落定) 延后的是 closing 的释放, 不该扣住气泡:
             // queueFinal 没跑 = 没人收气泡, 它会定格在最后一行 CoT 进度上 (看着像卡在 tool
             // use), hardTimer 到点的空 finish 又被 chat-gate 当 empty push 丢掉。气泡还在
@@ -3699,7 +3910,7 @@ export const startMirror = (deps) => {
             handleGoalItem(a, { kind: "turn_end" });
             return;
         }
-        if (cfg.wrc.mirror.brief && a.briefTurnId) {
+        if (briefMode(a) && a.briefTurnId) {
             closeBriefTurn(a);
             return;
         }
@@ -3710,6 +3921,8 @@ export const startMirror = (deps) => {
         // 新 spawn 的 pane 在首次 inject 落地前吞掉所有初始输出 (greeting/system)。
         if (a.muteUntilInject)
             return;
+        if (item.kind === "user_text" || item.kind === "user_query" || item.kind === "user_inject")
+            a.openingOffset = undefined;
         if (item.kind === "user_text") {
             // 回显去重只认 60s 内的注入: 排在长轮后面的那一行露面时已经过期, 会被当成人在 CLI 里敲的。
             // 印章认得出就仍是那次注入 —— 不回显, 也不算 CLI 轮。
@@ -3728,7 +3941,7 @@ export const startMirror = (deps) => {
             a.pendingChannel = undefined;
             a.activeEventId = item.eventId;
             a.pendingFromCli = true;
-            if (!cfg.wrc.mirror.brief)
+            if (!briefMode(a))
                 consumeChannel(a, true, undefined);
         }
         if (item.kind === "user_inject") {
@@ -3775,13 +3988,18 @@ export const startMirror = (deps) => {
         // 有活跃 turn 时 handleBriefItem 本就丢它, 没有 turn 时 (user_text 不是
         // BRIEF_TURN_OPENERS) 它会一路穿到底部的 standalone fallback —— includeUser=true
         // 的配置下, 人在 CLI 敲的那一行就这么原样回显进了群, 正好破了 chatOriginOnly。
-        if (item.kind === "user_text" && (item.quiet || cfg.wrc.mirror.brief))
+        if (item.kind === "user_text" && (item.quiet || briefMode(a)))
             return;
         // thinking 唯一的出口是 brief 气泡的 CoT 进度行。必须在这里就吃掉 —— 漏到下面任何
         // 一条通道 (deferred buf → renderBuf / standalone / stream append) 都会把它写进正文,
         // 那就变回已下线的 thinkStyle 了。
         if (item.kind === "thinking") {
-            if (cfg.wrc.mirror.brief && a.briefTurnId)
+            const event = a.activeEventId ? deps.events?.get(a.activeEventId) : undefined;
+            // A receiver can begin with thinking, before any text/tool opener. Bind its
+            // turn and inherited bubble now; pending input alone never authorizes output.
+            if (!a.briefTurnId && event?.payload.peer?.transferred && eventOwnerGate(event))
+                ensureBriefTurn(a);
+            if (briefMode(a) && a.briefTurnId)
                 updateBriefProgress(a, item.body);
             return;
         }
@@ -3924,7 +4142,7 @@ export const startMirror = (deps) => {
                 }
             }
         }
-        if (!cfg.wrc.mirror.brief && item.kind === "text" && item.final !== false && a.activeEventId && deps.events) {
+        if (!briefMode(a) && item.kind === "text" && item.final !== false && a.activeEventId && deps.events) {
             const e = deps.events.get(a.activeEventId);
             if (e) {
                 // Soft final text waits for transcript/idle evidence; it must not escape through the legacy stream.
@@ -3937,7 +4155,7 @@ export const startMirror = (deps) => {
                 return;
             }
         }
-        if (!cfg.wrc.mirror.brief && isPrivate(a))
+        if (!briefMode(a) && (isPrivate(a) || !eventOwned(a.activeEventId)))
             return;
         // /goal mode overrides everything below: the session-scoped Stop hook
         // self-drives the model with no terminal stop_reason, so turn_end never fires
@@ -3956,17 +4174,17 @@ export const startMirror = (deps) => {
         // Brief 模式下没有活跃 turn 时, 任何 assistant 侧产出都补开一个无气泡 turn ——
         // 覆盖 CLI 侧直接开的新一轮 (WeCom 没参与, 拿不到 frame) 与收口后的零星补写。
         // user 行不开 turn (CLI 敲字 ≠ 一定有回复), 它的 query/出处已在上面记下。
-        if (cfg.wrc.mirror.brief && !a.briefTurnId && BRIEF_TURN_OPENERS.has(item.kind))
+        if (briefMode(a) && !a.briefTurnId && BRIEF_TURN_OPENERS.has(item.kind))
             ensureBriefTurn(a);
         // Usage snapshots never flow into WeCom bubbles — brief 分支下 handleBriefItem
         // 会把它写进 turn store, 非 brief 下直接吞掉, 保持 onItem 主流程只处理有渲染
         // 输出的 item 类型。
-        if (item.kind === "turn_usage" && !(cfg.wrc.mirror.brief && a.briefTurnId)) {
+        if (item.kind === "turn_usage" && !(briefMode(a) && a.briefTurnId)) {
             return;
         }
         // Brief mode 短路: 所有正常流/deferral/awaiting 全跳过, 只写入 turn store,
         // 唯一发到群里的是 turn 结束时的 finish text (下文 handleBriefItem 处理)。
-        if (cfg.wrc.mirror.brief && a.briefTurnId) {
+        if (briefMode(a) && a.briefTurnId) {
             handleBriefItem(a, item);
             return;
         }
@@ -3982,7 +4200,7 @@ export const startMirror = (deps) => {
             return;
         // Brief mode 短路: 所有正常流/deferral/awaiting 全跳过, 只写入 turn store,
         // 唯一发到群里的是 turn 结束时的 finish text (下文 handleBriefItem 处理)。
-        if (cfg.wrc.mirror.brief && a.briefTurnId) {
+        if (briefMode(a) && a.briefTurnId) {
             handleBriefItem(a, item);
             return;
         }
@@ -3997,9 +4215,11 @@ export const startMirror = (deps) => {
         // 说明 claude 已继续执行 (hook 必然已返回 / 根本没拦), 把状态提升回 STREAMING,
         // 复用原 frame/streamId 让本轮回到打字机气泡。
         if (a.outbound?.kind === "awaiting_appr") {
-            const { frame, streamId } = a.outbound;
+            if (discardUnownedOutbound(a, a.outbound))
+                return;
+            const { frame, streamId, eventId } = a.outbound;
             a.outbound = undefined;
-            const s = openStream(a, frame, streamId);
+            const s = openStream(a, frame, streamId, eventId);
             a.liveStream = s;
             log.info({ sessionId: a.sessionId, kind: item.kind, turnId: s.turnId }, "outbound: AWAITING_APPR → STREAMING (hook bypassed, item arrived)");
         }
@@ -4133,11 +4353,21 @@ export const startMirror = (deps) => {
         const carryEffort = effort !== undefined ? effort.trim() : (prevByTarget?.effort ?? deps.store.get(target)?.effort ?? "");
         if (prevByTarget)
             detach(prevByTarget, "target reassigned");
+        const startOffset = (() => { try {
+            return statSync(jsonlPath).size;
+        }
+        catch {
+            return 0;
+        } })();
         // Build the attachment first so the tail's onItem closure can capture it.
         const a = {
             sessionId,
             jsonlPath,
             target,
+            // Tail starts at EOF after reload; recover ownership before its first item,
+            // including non-brief output that never enters ensureBriefTurn.
+            activeEventId: lastUserTurn(jsonlPath, startOffset)?.env?.eventId,
+            openingOffset: startOffset,
             tmuxPane: (tmuxPane ?? "").trim(),
             tmuxSession: (tmuxSession ?? "").trim(),
             // Explicit cwd (spawn path) wins; otherwise derive from jsonl head so
@@ -4153,6 +4383,7 @@ export const startMirror = (deps) => {
         };
         a.tail = startMirrorTail({
             jsonlPath,
+            startOffset,
             log: log.child({ sub: "tail", sessionId }),
             includeUser: cfg.wrc.mirror.includeUser,
             includeTools: cfg.wrc.mirror.includeTools,
@@ -4252,7 +4483,7 @@ export const startMirror = (deps) => {
         // jsonl means "no input yet", NOT "rotated away" — healing it onto some
         // unrelated newest-in-cwd file is exactly the cross-wire we must avoid.
         const storedPane = (rec.tmuxPane ?? "").trim();
-        const livePane = storedPane && (panes ? panes.has(storedPane) : await tmuxPaneAlive(storedPane)) ? storedPane : "";
+        const livePane = storedPane && (panes ? panes.has(storedPane) : await tmuxPaneAlive(storedPane)) ? storedPane : await codexPaneForTranscript(jsonlAbs);
         if (permitted && !permitted())
             return undefined;
         if (!existsSync(jsonlAbs)) {
@@ -4542,7 +4773,7 @@ export const startMirror = (deps) => {
     // freshly-rotated jsonl (only holds the /clear line + new content); resume
     // migration omits it (→ tail from EOF) because the fork file is seeded with
     // the FULL prior transcript and replaying from 0 would re-dump it to WeCom.
-    const migrateAttachment = (a, newSessionId, newJsonlPath, startOffset) => {
+    const migrateAttachment = (a, newSessionId, newJsonlPath, startOffset, knownClear = false) => {
         // Guard: if newSessionId is already bound to a DIFFERENT principal, abort —
         // prevents silent cross-wire (path B: /clear rotation or drift landing on
         // a sibling's live session).
@@ -4556,7 +4787,7 @@ export const startMirror = (deps) => {
         // 迁移是所有会话轮换的唯一漏斗 (注入的 /clear、TUI 里手打的 /clear、resume fork、
         // worktree drift)。只有目标 jsonl 首条用户行是 /clear 的那种才是真清空 —— fork /
         // drift 上下文是延续的, 画中性的 "switch"。
-        const cleared = jsonlIsPostClearChild(newJsonlPath);
+        const cleared = knownClear || jsonlIsPostClearChild(newJsonlPath);
         markCut(a.target, newSessionId, cleared ? "clear" : "switch");
         if (cleared)
             contextCut(a.target, "clear");
@@ -4593,6 +4824,8 @@ export const startMirror = (deps) => {
             tmuxSession: a.tmuxSession || undefined,
             tmuxPane: a.tmuxPane || undefined,
             cwd: a.runningCwd || undefined,
+            model: a.model || undefined,
+            effort: a.effort || undefined,
             pendingCwd: a.pendingCwd || undefined,
         });
         log.info({ target: a.target, oldSessionId, newSessionId, oldJsonlPath, newJsonlPath, startOffset }, "mirror migrated session");
@@ -5391,17 +5624,29 @@ export const startMirror = (deps) => {
         // store — e.g. after a reload that couldn't re-attach — is still killable.
         const a = byTarget.get(target);
         const pane = a?.tmuxPane || paneOf(target);
+        const sid = a?.sessionId ?? deps.store.get(target)?.sessionId;
+        const birth = wizardStore()?.get(target)?.birthToken;
+        const same = () => byTarget.get(target) === a && (a?.tmuxPane || paneOf(target)) === pane
+            && (a?.sessionId ?? deps.store.get(target)?.sessionId) === sid && wizardStore()?.get(target)?.birthToken === birth;
+        const replaced = { ok: false, reason: "target identity changed during pane cleanup; cleanup withheld" };
         if (!a && !pane)
             return { ok: false, reason: "no session bound to target" };
         if (pane && (await tmuxPaneAlive(pane))) {
+            if (!same())
+                return replaced;
             // Esc first, like /stop: a mid-generation CLI gets a beat to unwind and
             // flush its transcript before the TTY is yanked out from under it.
             await runTmux(["send-keys", "-t", pane, "Escape"]);
             await sleep(250);
+            if (!same())
+                return replaced;
             const r = await runTmux(["kill-pane", "-t", pane]);
             if (r.code !== 0)
                 return { ok: false, reason: `kill-pane failed: ${r.stdout.slice(-200) || r.code}` };
         }
+        // A late stop must not detach a new wizard that reused this target/name.
+        if (!same())
+            return replaced;
         if (a)
             detach(a, drop ? "/kill" : "sleep");
         if (!drop) {
@@ -5911,8 +6156,196 @@ export const startMirror = (deps) => {
             : { ok: true, label: `${pick.index}. ${pick.label}` };
     };
     const pressNativePicker = async (a, fingerprint, what, guard) => withPaneInput(a.tmuxPane, (live) => pressNativePickerUnlocked(a, fingerprint, what, live), { guard });
+    // 调用方持有 pane 输入锁; clear 与 carry 的原生身份探测共用同一条 slash 提交流程。
+    const nativeCommands = (target, pane, codex, sameProcess, sameSession, allowed = () => true) => {
+        // 每次 slash 都在同一个物理输入锁里核对空框、idle 与进程; 不借用有补 Enter 的通用注入器。
+        const command = async (text, before) => {
+            if (!allowed() || !(await sameProcess()) || !(await idleNow(target)))
+                return false;
+            const input = await readPaneInput(pane);
+            if (!input.box.known || input.box.body || paneIsBusy(input.cap) || isModalPane(input.cap).modal)
+                return false;
+            if (!(await sameSession()))
+                return false;
+            if (!(await sameProcess()))
+                return false;
+            if (!allowed())
+                return false;
+            before?.();
+            if (!allowed())
+                return false;
+            if (!(await runTmux(["send-keys", "-t", pane, "-l", text])).ok)
+                return false;
+            for (const end = Date.now() + 3000; Date.now() < end; await sleep(50)) {
+                const typed = await readPaneInput(pane);
+                if (!(await sameProcess()) || await isBusy(target))
+                    return false;
+                if (!(await sameSession()))
+                    return false;
+                // Codex 的 slash 菜单会暂时藏掉 model/cwd 状态行, 只留精确命令框与 queue footer。
+                const rows = typed.cap.trimEnd().split("\n");
+                const end = rows.length - 1;
+                const slashBox = codex && /^\s*tab to queue message(?:\s|$)/u.test(rows[end] ?? "")
+                    && !rows[end - 1]?.trim() && !rows[end - 3]?.trim() && rows[end - 2]?.trim() === `› ${text}`;
+                if (((typed.box.known && typed.box.body === text) || slashBox) && !paneIsBusy(typed.cap)) {
+                    if (!allowed())
+                        return false;
+                    return (await runTmux(["send-keys", "-t", pane, "Enter"])).ok;
+                }
+            }
+            return false;
+        };
+        const emptyComposer = async () => {
+            const input = await readPaneInput(pane);
+            return input.box.known && !input.box.body && !paneIsBusy(input.cap) && !isModalPane(input.cap).modal;
+        };
+        const statusId = async () => {
+            const before = await runTmux(["capture-pane", "-t", pane, "-p", "-J", "-S", "-200"]);
+            if (!before.ok || !(await command("/status")))
+                return undefined;
+            for (const end = Date.now() + 5000; Date.now() < end; await sleep(100)) {
+                const screen = await runTmux(["capture-pane", "-t", pane, "-p", "-J", "-S", "-200"]);
+                if (!screen.ok || !(await sameProcess()))
+                    return undefined;
+                const lastStatus = [...screen.stdout.matchAll(/(?:^|\n)(?:›\s*)?\/status\s*\n/gu)].at(-1);
+                const id = [...screen.stdout.matchAll(/\bSession:\s*([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/gu)].at(-1);
+                if (screen.stdout !== before.stdout && lastStatus && id && id.index > lastStatus.index && await emptyComposer())
+                    return id[1];
+            }
+            return undefined;
+        };
+        return { command, emptyComposer, statusId };
+    };
+    const verifyClearContext = async (target, clear) => {
+        const a = byTarget.get(target);
+        if (!a || !clear.nextSid || !clear.panePid || a.tmuxPane !== clear.pane || a.sessionId !== clear.nextSid || await panePidOf(clear.pane) !== clear.panePid)
+            return false;
+        const backend = backendForPath(a.jsonlPath);
+        if (backend.name === "claude") {
+            const actual = sessionOnPane(backend.homeDir, clear.pane);
+            return actual?.pid === clear.pid && actual.sessionId === clear.nextSid;
+        }
+        if (backend.name !== "codex" || codexSessionForPane(clear.pane)?.sessionId !== clear.nextSid)
+            return false;
+        const ps = await psSnap();
+        const pids = new Set([...ps.commands].filter(([, command]) => basename(command) === "codex").map(([pid]) => pid));
+        return registeredPidUnder(clear.panePid, pids, ps.kids) === clear.pid;
+    };
+    const verifyClearInput = async (target, clear, phase, allowed) => {
+        if (!allowed() || !(await verifyClearContext(target, clear)))
+            return false;
+        const a = byTarget.get(target);
+        if (phase === "paste" && backendForPath(a.jsonlPath).name === "codex") {
+            // 本机 Codex 不触发 SessionStart; 同 PID 原生 /new 也会让旧映射失真。
+            // brief 尚未粘贴时用 /status 重取当前 ID; submit 阶段由原进程 + 原框内容核验保护。
+            const { statusId } = nativeCommands(target, clear.pane, true, () => verifyClearContext(target, clear), () => true, allowed);
+            return await statusId() === clear.nextSid && await verifyClearContext(target, clear) && allowed();
+        }
+        return true;
+    };
+    const clearContext = async (target, attempt, submitted, guard = () => true) => {
+        if (!guard())
+            return { ok: false, reason: "handoff continuation authority withdrawn; no input" };
+        const a = byTarget.get(target);
+        if (!a?.tmuxPane)
+            return { ok: false, reason: "handoff requires the original live pane; no respawn" };
+        const backend = backendForPath(a.jsonlPath);
+        // 只开放本机真实探针验证过的后端; 不能因家族相近就假定 slash/注册表语义相同。
+        if (!["claude", "codex"].includes(backend.name))
+            return { ok: false, reason: `${backend.name} native /clear completion is not verified; pane unchanged` };
+        if (a.pendingCwd && a.pendingCwd !== a.runningCwd)
+            return { ok: false, reason: "pending workspace switch requires an explicit /new; /clear keeps the original process cwd" };
+        const pane = a.tmuxPane;
+        const valid = () => guard() && byTarget.get(target) === a && a.tmuxPane === pane;
+        try {
+            return await withPaneInput(pane, async (live) => {
+                const codex = backend.name === "codex";
+                const nativePid = async () => {
+                    if (!codex)
+                        return sessionOnPane(backend.homeDir, pane)?.pid;
+                    const root = await panePidOf(pane);
+                    const ps = await psSnap();
+                    return registeredPidUnder(root, new Set([...ps.commands].filter(([, command]) => basename(command) === "codex").map(([pid]) => pid)), ps.kids);
+                };
+                const pid = await nativePid();
+                const panePid = await panePidOf(pane);
+                if (!pid || !panePid || !(await tmuxPaneAlive(pane)))
+                    return { ok: false, reason: "original CLI process identity is unavailable" };
+                const original = sessionOnPane(backend.homeDir, pane);
+                let transaction = attempt ?? { pane, pid, panePid, sid: a.sessionId, at: Date.now() };
+                if (transaction.pane !== pane || transaction.pid !== pid || (transaction.panePid && transaction.panePid !== panePid))
+                    return { ok: false, reason: "original pane/CLI process changed; refusing /clear" };
+                const sameProcess = async () => live() && valid() && await nativePid() === transaction.pid && await panePidOf(pane) === panePid;
+                const { command, emptyComposer, statusId } = nativeCommands(target, pane, codex, sameProcess, () => codex || (sessionOnPane(backend.homeDir, pane)?.sessionId === transaction.sid && sessionOnPane(backend.homeDir, pane)?.status === "idle"), guard);
+                if (!attempt) {
+                    const actualSid = codex ? await statusId() : original?.sessionId;
+                    if (actualSid !== transaction.sid)
+                        return { ok: false, reason: "native pane session changed/unconfirmed before /clear; refusing to clear an unbound context" };
+                    // 凭证先于第一下 /clear 按键落盘; reload 只核验原生状态, 绝不再次清空。
+                    if (!(await command("/clear", () => submitted(transaction))))
+                        return { ok: false, reason: "native /clear submission unconfirmed; no retry" };
+                }
+                if (codex) {
+                    let empty = false;
+                    for (const end = Date.now() + 5000; Date.now() < end; await sleep(100)) {
+                        if (!(await sameProcess()))
+                            return { ok: false, reason: "Codex CLI process changed during /clear" };
+                        if (await emptyComposer()) {
+                            empty = true;
+                            break;
+                        }
+                    }
+                    const nextSid = empty ? await statusId() : undefined;
+                    if (!nextSid || nextSid === transaction.sid || (transaction.nextSid && transaction.nextSid !== nextSid))
+                        return { ok: false, reason: "Codex native /status did not confirm the cleared thread; no retry" };
+                    if (sidsClaimedByOthers(target).has(nextSid))
+                        return { ok: false, reason: "native Codex thread belongs to another wizard" };
+                    transaction = { ...transaction, nextSid };
+                    submitted(transaction);
+                    const actualRollout = () => codexSessions(expandHome(backend.projectsDir), expandHome(a.runningCwd)).find((s) => s.sessionId === nextSid);
+                    // 空 thread 不会先写 rollout; /rename 原生持久化当前 thread, 不发模型消息、不另起 thread。
+                    if (!actualRollout() && !(await command(`/rename ${displayName(target).replace(/[\r\n]/gu, " ") || "wezard"}`)))
+                        return { ok: false, reason: "Codex /rename persistence unconfirmed; thread preserved" };
+                    let rollout = actualRollout();
+                    for (const end = Date.now() + 5000; !rollout && Date.now() < end; await sleep(100))
+                        rollout = actualRollout();
+                    // rename 和 metadata 扫描之间仍可能有人原生切 thread; 最后再读当前 ID, 不绑错现场。
+                    if (!rollout || await statusId() !== nextSid || !(await sameProcess()))
+                        return { ok: false, reason: "Codex current thread/actual rollout metadata not confirmed; refusing binding" };
+                    recordCodexPaneSession({ sessionId: nextSid, jsonlPath: rollout.jsonlPath, cwd: a.runningCwd, pane, startedAt: transaction.at }, cfg.daemon.stateDir);
+                    if (a.sessionId !== nextSid)
+                        migrateAttachment(a, nextSid, rollout.jsonlPath, 0, true);
+                    log.info({ target, pane, pid, panePid, oldSessionId: transaction.sid, sessionId: nextSid, jsonlPath: rollout.jsonlPath }, "handoff: Codex native clear/status/rename confirmed in original CLI process");
+                    return { ok: true };
+                }
+                for (const end = Date.now() + 20_000; Date.now() < end; await sleep(200)) {
+                    if (!(await sameProcess()))
+                        return { ok: false, reason: "CLI process changed during /clear" };
+                    const current = sessionOnPane(backend.homeDir, pane);
+                    if (!current || current.sessionId === transaction.sid || current.status !== "idle" || !(await emptyComposer()))
+                        continue;
+                    if (sidsClaimedByOthers(target).has(current.sessionId))
+                        return { ok: false, reason: "native session identity belongs to another wizard" };
+                    if (transaction.nextSid && transaction.nextSid !== current.sessionId)
+                        return { ok: false, reason: "Claude native session changed after clear confirmation" };
+                    transaction = { ...transaction, nextSid: current.sessionId };
+                    submitted(transaction);
+                    if (a.sessionId !== current.sessionId)
+                        migrateAttachment(a, current.sessionId, join(dirname(a.jsonlPath), `${current.sessionId}.jsonl`), 0, true);
+                    log.info({ target, pane, pid, panePid, oldSessionId: transaction.sid, sessionId: current.sessionId }, "handoff: native /clear confirmed in original CLI process");
+                    return { ok: true };
+                }
+                return { ok: false, reason: "native /clear completion unconfirmed; original pane preserved, brief retained, no retry" };
+            }, { guard: valid, timeoutMs: 60_000 });
+        }
+        catch (e) {
+            return { ok: false, reason: String(e) };
+        }
+    };
     return {
         attach,
+        clearContext,
+        verifyClearContext,
         chatTargets,
         peers,
         foreignPeers,
@@ -6040,9 +6473,11 @@ export const startMirror = (deps) => {
             // the first flushStream will reject, mark s.dead=true, and subsequent items
             // route to standalone via the existing :1206 fall-through. Self-healing.
             if (a.outbound?.kind === "awaiting_appr") {
-                const { frame, streamId } = a.outbound;
+                if (discardUnownedOutbound(a, a.outbound))
+                    return;
+                const { frame, streamId, eventId } = a.outbound;
                 a.outbound = undefined;
-                const s = openStream(a, frame, streamId);
+                const s = openStream(a, frame, streamId, eventId);
                 a.liveStream = s;
                 log.info({ sessionId, turnId: s.turnId }, "outbound: AWAITING_APPR → STREAMING (approved)");
             }
@@ -6143,11 +6578,21 @@ export const startMirror = (deps) => {
             const a = byTarget.get(target) ?? (await restoreFromStore(target, undefined, permission));
             if (!permission())
                 return denied;
+            // A missing binding cannot recover on retry; let receipts escalate.
             if (!a)
-                return { ok: false, retryable: true, reason: "no mirror attached for target" };
+                return { ok: false, retryable: true, reason: "no mirror attached for target", ...(deps.store.get(target) ? {} : { gone: true }) };
+            if (opts?.handoff && !(await verifyClearContext(target, opts.handoff)))
+                return { ok: false, retryable: false, reason: "original cleared CLI process/session changed; handoff carry withheld" };
             const sid = a.sessionId;
             const generation = a.injectGen ?? 0;
             const permitted = () => permission() && byTarget.get(target) === a && a.sessionId === sid && (a.injectGen ?? 0) === generation;
+            if (!a.tmuxPane) {
+                const recovered = await codexPaneForTranscript(a.jsonlPath);
+                if (!permitted())
+                    return denied;
+                if (!a.tmuxPane)
+                    a.tmuxPane = recovered;
+            }
             const probedPane = a.tmuxPane;
             const probe = a.tmuxPane ? await probePane(a.tmuxPane, a.jsonlPath) : { state: "gone" };
             if (!permitted() || a.tmuxPane !== probedPane)
@@ -6163,6 +6608,8 @@ export const startMirror = (deps) => {
             // 也按冷启动等 idle 至多 15s, 「不等不打断」就成了「晚 15–20s 才进」(handoff-owe 的竞态即此)。
             let fresh = a.justSpawned === true;
             if (probe.state !== "session") {
+                if (opts?.noRespawn)
+                    return { ok: false, retryable: false, reason: "original CLI is unavailable; handoff never respawns" };
                 log.warn({ target, sessionId: sid, oldPane: a.tmuxPane, why: probe.state }, "injectText: pane not alive, respawning");
                 // Same resume-fork hazard as dispatch: snapshot before spawn, re-bind
                 // onto the forked jsonl once it appears (EOF offset — fork is seeded).
@@ -6211,13 +6658,18 @@ export const startMirror = (deps) => {
             const clearing = isClearCommand(text);
             const preClearBaseline = clearing ? listJsonls(dirname(a.jsonlPath)) : undefined;
             const injectPane = a.tmuxPane;
+            let pinRejected = false;
             const r = await inject({
                 text: full, images: [], cfg, guard: (phase, identity) => permitted() && a.tmuxPane === injectPane && (!opts?.guard || opts.guard(phase, identity)), log: log.child({ principal: target, sessionId: sid, sub: "init-demo" }),
                 sessionId: sid, eventId: opts?.eventId, jsonlPath: a.jsonlPath, tmuxTarget: a.tmuxPane, freshSpawn: fresh,
+                physicalGuard: opts?.handoff ? async (phase) => { const ok = permission() && await verifyClearInput(target, opts.handoff, phase, permission) && permission(); if (!ok)
+                    pinRejected = true; return ok; } : undefined,
                 requireIdle: opts?.requireIdle ? () => idleNow(target) : undefined,
                 prepareText: () => (full = text + renderTail(envelope, noticeSuffixFor(target, text))),
                 beforeInput,
             });
+            if (pinRejected)
+                return { ...r, ok: false, retryable: false, reason: "handoff process/session or continuation authority changed at physical input; carry withheld" };
             if (r.ok && a.tmuxPane && permitted()) {
                 if (preClearBaseline) {
                     a.clearRebind = { baseline: preClearBaseline };
@@ -6575,7 +7027,10 @@ export const startMirror = (deps) => {
         },
         formatFinal,
         recoverEventFinal,
+        deliverTransferredFinal,
+        transferReply,
         setEventFinalGate: (gate) => { eventFinalGate = gate; },
+        setEventOwnerGate: (gate) => { eventOwnerGate = gate; },
         settleFinalProgress,
         dispatch: async ({ principal, text, images, frame, streamId, channel, speaker, eventId, guard, onSubmitted }) => {
             // Route by inbound principal — the WeCom chat the user just messaged us
@@ -6698,10 +7153,12 @@ export const startMirror = (deps) => {
             //  • outboundDeferMs === 0 → eager openStream + "…" ack (legacy behavior)
             const brief = cfg.wrc.mirror.brief && !armMigration;
             const eagerOpen = !armMigration && !brief && cfg.wrc.mirror.outboundDeferMs <= 0;
-            const s = eagerOpen ? openStream(a, frame, streamId) : undefined;
+            const s = eagerOpen ? openStream(a, frame, streamId, eventId) : undefined;
             if (s) {
                 a.liveStream = s;
                 try {
+                    if (!eventOwned(s.eventId) || s.closed)
+                        return;
                     await (s.pending = client.replyStream(frame, streamId, withTagHeader(a.target, "…"), false));
                 }
                 catch (e) {
@@ -6734,6 +7191,15 @@ export const startMirror = (deps) => {
                 // First step of the job and the historical hang point — log BEFORE the
                 // probe so a stall is attributable to it next time, not invisible.
                 log.info({ target: a.target, sessionId: sid, pane: a.tmuxPane, gen: myGen }, "inject job start");
+                if (!a.tmuxPane) {
+                    const recovered = await codexPaneForTranscript(a.jsonlPath);
+                    if (byTarget.get(a.target) !== a || (a.injectGen ?? 0) !== myGen || (guard && !guard())) {
+                        onSubmitted?.({ ok: false, retryable: true, reason: "pane recovery permission withdrawn" });
+                        return;
+                    }
+                    if (!a.tmuxPane)
+                        a.tmuxPane = recovered;
+                }
                 const probe = a.tmuxPane ? await probePane(a.tmuxPane, a.jsonlPath) : { state: "gone" };
                 let freshSpawn = a.justSpawned === true;
                 a.justSpawned = false;
@@ -6787,7 +7253,16 @@ export const startMirror = (deps) => {
                     else {
                         // Drop only the stale pane id; keep tmuxSession (if any) so the
                         // store still reflects "user wanted tmux" — next turn retries.
-                        log.error({ reason: r.reason }, "mirror: tmux respawn failed, this turn falls back to spawn-mode");
+                        log.error({ reason: r.reason }, "mirror: tmux respawn failed");
+                        if (eventId) {
+                            onSubmitted?.({ ok: false, retryable: true, reason: `respawn failed: ${r.reason ?? "unknown"}` });
+                            if (s)
+                                await finalizeStream(a, s);
+                            if (a.outbound?.kind === "deferred")
+                                clearTimeout(a.outbound.timer);
+                            a.outbound = undefined;
+                            return;
+                        }
                         a.tmuxPane = "";
                     }
                 }
@@ -6833,9 +7308,15 @@ export const startMirror = (deps) => {
                 if (!r.ok) {
                     // retryable = 一个字都没进输入框, 消息事件层会稍后重投 —— 不是失败, 别报 ✗
                     // (每次退避重试都会走到这里, 报 ✗ 就是一串假警报)。
-                    const note = r.retryable && eventId
-                        ? `[mirror] ⏳ 暂未送达, 稍后自动重投 (${r.reason ?? "deferred"})`
-                        : `[mirror] ✗ ${r.reason ?? "failed"}`;
+                    if (r.retryable && eventId) {
+                        if (s)
+                            await finalizeStream(a, s);
+                        if (a.outbound?.kind === "deferred")
+                            clearTimeout(a.outbound.timer);
+                        a.outbound = undefined;
+                        return;
+                    }
+                    const note = `[mirror] ✗ ${r.reason ?? "failed"}`;
                     if (s) {
                         s.acc = s.acc ? `${s.acc}\n\n${note}` : note;
                         await finalizeStream(a, s);