wezard 2.7.3 → 2.7.4

package/dist/daemon/mirror-bridge.js

@@ -1,6 +1,6 @@
 import { finalId } from "./message-events.js";
 import { parseEnvelope, renderTail } from "../shared/reminder.js";
-import { codexSessions, codexSessionForPane } from "../shared/codex.js";
+import { codexSessions, codexSessionForPane, recordCodexPaneSession } from "../shared/codex.js";
 import { codexHookLaunchArgs, codexHookCommand } from "../shared/codex-hooks.js";
 import { fileURLToPath } from "node:url";
 // Mirror-mode bridge.
@@ -1305,6 +1305,9 @@ export const parseInputBox = (cap, styledLayout = cap) => {
     // Idle Codex hides the left hint after a paste but keeps a right-aligned
     // warnings footer. Its middle dot is not the status row's separator.
     const warnings = /^\s*⚠\s*\d+\s+warnings?\s*·\s*f2 to view\s*$/u.test(layout[footer] ?? "");
+    // --no-alt-screen 的 composer 没有背景 SGR; 原生 Context + cwd 行才是状态锚, warning 的 · 不能充当它。
+    const inlineStatus = /\bContext\s+\d+%\s+used\b/u.test(layout[footer] ?? "")
+        && /·\s+(?:\/|~\/)/u.test(layout[footer] ?? "");
     if (inputHint || warnings || (layout[footer] ?? "").includes("·")) {
         let status = inputHint || warnings ? footer - 1 : footer;
         while (status >= 0 && !layout[status].trim())
@@ -1318,7 +1321,7 @@ export const parseInputBox = (cap, styledLayout = cap) => {
                 prompt--;
             if (prompt >= 0 && /^›(?:\s|$)/u.test(layout[prompt])
                 && (prompt === 0 || !layout[prompt - 1].trim())
-                && (inputHint || /\x1b\[[0-9;:]*48[;:]/u.test(styledLines[prompt]))) {
+                && (inputHint || inlineStatus || /\x1b\[[0-9;:]*48[;:]/u.test(styledLines[prompt]))) {
                 const body = dropDim(styledLines.slice(prompt, status).join("\n"))
                     .replace(/^\s*›\s?/u, "").replace(/[\s\u200b\ufeff]+/gu, " ").trim();
                 return { known: true, body };
@@ -1555,7 +1558,7 @@ const witnessFor = (target, homeDir, jsonlPath, live, actualTranscript) => {
 // but the trailing Enter is eaten while the TUI is still initializing, so
 // the prompt sits typed-but-unsent. 校验策略见 injectViaTmuxText —— 以输入框
 // 整块为判据, 粘贴只在「确凿看见框仍是空的」时才重来。
-const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jsonlPath, bypassModalGuard = false, guard, eventId, expectedSessionId) => {
+const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jsonlPath, bypassModalGuard = false, guard, eventId, expectedSessionId, physicalGuard) => {
     const backendName = backend.name;
     log.info({ target, eventId, len: text.length, images: images.length, freshSpawn, backendName }, "mirror inject (tmux)");
     // 就绪门: pane 里得真有一个进入了交互态的 AI 会话, 才轮得到贴。先于 modal guard ——
@@ -1663,7 +1666,7 @@ const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jso
     // dispatch 已对 codebuddy 把 refs 合进 text (images 传空), 这里的
     // withImageRefs 是其它调用方直传 images 时的兜底 —— 幂等, 不会贴两份。
     if (backendName === "codebuddy") {
-        return injectViaTmuxText(target, withImageRefs(text, images), log, freshSpawn, witness, boundGuard, eventId, bypassModalGuard);
+        return injectViaTmuxText(target, withImageRefs(text, images), log, freshSpawn, witness, boundGuard, eventId, bypassModalGuard, physicalGuard);
     }
     // Pump images first via clipboard+C-v so each one is attached as a separate
     // image content block. Each C-v needs a brief settle for Claude Code's TUI
@@ -1715,7 +1718,7 @@ const injectViaTmux = async (target, text, images, log, freshSpawn, backend, jso
         const e = await runTmux(["send-keys", "-t", target, "Enter"]);
         return e.ok ? { ok: true } : { ok: false, reason: `tmux send-keys Enter failed: ${e.stderr.slice(-200)}` };
     }
-    return injectViaTmuxText(target, text, log, freshSpawn, witness, boundGuard, eventId, bypassModalGuard);
+    return injectViaTmuxText(target, text, log, freshSpawn, witness, boundGuard, eventId, bypassModalGuard, physicalGuard);
 };
 // 图片以 @<path> 文本提及的形式进会话 (codebuddy 的 tmux 路径、一切 spawn 路径)。
 // 提升为共享 helper: dispatch 侧的印章 / 回显去重 / turn 记录必须拿到与 inject
@@ -1737,7 +1740,7 @@ const withImageRefs = (text, images) => {
 // 证人不作声 (忙时排队、slash 命令、无注册表的后端) 才看框回没回到贴之前的样子。
 // 框认得出来时这条判据可信, 于是允许多补回车 (空框上的回车在 CLI 里是 no-op);
 // 每次补之前再问一遍证人, 已提交就不补。
-const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WITNESS, guard, eventId, bypassModalGuard = false) => {
+const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WITNESS, guard, eventId, bypassModalGuard = false, physicalGuard) => {
     // Warm pane: tight timings, low latency. Fresh spawn (claude --resume just
     // started, transcript still loading): extended timings — bracketed-paste
     // end can take 4-7s to be honored on a cold TUI. Only the fresh-spawn path
@@ -1793,7 +1796,7 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     const boxIntact = (b) => boxVerify && b.known && (b.body === "" || b.body === baseBody);
     const loadAndPaste = async () => {
         const start = Date.now();
-        const result = await pasteTmuxBuffer(target, text, guard ? () => guard("paste") : undefined);
+        const result = await pasteTmuxBuffer(target, text, async () => (!physicalGuard || await physicalGuard("paste")) && (!guard || guard("paste")));
         log.info({ target, eventId, tmuxPasteMs: Date.now() - start, boxVerify, ok: result.ok }, "mirror inject: paste completed");
         return result;
     };
@@ -1844,6 +1847,8 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     let pastedAt = Date.now();
     if (alreadyTyped) {
         // Existing text is already exposed, even if permission was just withdrawn.
+        if (physicalGuard && !(await physicalGuard("submit")))
+            return { ok: false, uncertain: true, reason: "original handoff CLI identity changed before existing input submission" };
         if (guard && !guard("paste"))
             return { ok: false, uncertain: true, reason: "existing input submission canceled by dispatch guard" };
         log.warn({ target, headFp }, "mirror inject: 输入框里已有这段文本 (上次未提交) — 不重贴, 直接提交");
@@ -1939,6 +1944,8 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
             if (!box.known || box.body !== landedBody)
                 return { ok: false, reason: "composer changed after paste verification; refusing Enter" };
         }
+        if (physicalGuard && !(await physicalGuard("submit")))
+            return { ok: false, reason: "original handoff CLI identity changed before submit" };
         if (guard && !guard("submit"))
             return { ok: false, reason: "submit canceled by dispatch guard" };
         if (tailFp && !Number.isFinite(enterAt)) {
@@ -2171,7 +2178,7 @@ const inject = async (args) => {
                 }
                 return true;
             };
-            return injectViaTmux(target, text, args.images ?? [], args.log, args.freshSpawn ?? false, backendForPath(args.jsonlPath), args.jsonlPath, args.bypassModalGuard ?? false, guard, args.eventId, args.sessionId);
+            return injectViaTmux(target, text, args.images ?? [], args.log, args.freshSpawn ?? false, backendForPath(args.jsonlPath), args.jsonlPath, args.bypassModalGuard ?? false, guard, args.eventId, args.sessionId, args.physicalGuard);
         }, { guard: args.guard }));
     }
     catch (error) {
@@ -2365,7 +2372,97 @@ export const startMirror = (deps) => {
     };
     const TOOL_DETAIL_PREFIX = "TOOL_DETAIL|";
     let eventFinalGate = () => true;
-    let eventHandedAway = () => false;
+    let eventOwnerGate = () => true;
+    const eventOwned = (id) => {
+        const event = id ? deps.events?.get(id) : undefined;
+        return !event || eventOwnerGate(event);
+    };
+    const briefMode = (a) => cfg.wrc.mirror.brief
+        || !!(a.activeEventId && deps.events?.get(a.activeEventId)?.payload.peer?.transferred);
+    const bubbleOwned = (a, b) => {
+        const event = b.owner ? deps.events?.get(b.owner) : undefined;
+        return !event || event.target === a.target && eventOwnerGate(event);
+    };
+    const replyBubbles = new Map();
+    const rememberReplyBubble = (id, bubble) => {
+        if (replyBubbles.has(id))
+            return;
+        replyBubbles.set(id, bubble);
+        setTimeout(() => { if (replyBubbles.get(id) === bubble)
+            replyBubbles.delete(id); }, Math.max(0, (bubble.expires ?? Date.now()) - Date.now()) + 60_000).unref?.();
+    };
+    const claimReplyBubble = (event) => {
+        if (!deps.events || !eventOwnerGate(event) || !event.channel)
+            return undefined;
+        const origin = deps.events.replyOrigin(event);
+        const human = origin?.payload.human;
+        if (!origin || !human)
+            return undefined;
+        const source = byTarget.get(origin.target);
+        const out = source?.outbound;
+        if (source && out?.streamId === human.streamId) {
+            if (out.kind === "deferred")
+                clearTimeout(out.timer);
+            source.outbound = undefined;
+        }
+        let bubble = replyBubbles.get(origin.id);
+        if (!bubble) {
+            const expires = origin.at + HARD_TIMEOUT_MS;
+            if (expires <= Date.now() || deps.events.hasReplyDelivery(human.streamId))
+                return undefined;
+            bubble = { frame: human.frame, streamId: human.streamId, expires, done: false, owner: event.id };
+            rememberReplyBubble(origin.id, bubble);
+        }
+        if (bubble.done || Date.now() >= (bubble.expires ?? 0))
+            return undefined;
+        if (bubble.source) {
+            const stream = bubble.source;
+            stream.closed = true;
+            clearTimeout(stream.flushTimer);
+            clearTimeout(stream.idleTimer);
+            clearTimeout(stream.hardTimer);
+            bubble.pending = stream.pending;
+            const source = byTarget.get(stream.target);
+            if (source?.liveStream === stream)
+                source.liveStream = undefined;
+            bubble.source = undefined;
+        }
+        if (bubble.owner !== event.id) {
+            // The same object carries the last in-flight write into the receiver's FIFO.
+            // Old final/cleanup/timer paths lose authority before this object is reused.
+            byTarget.forEach((a) => {
+                if (a.briefBubble === bubble) {
+                    clearCot(a);
+                    a.briefBubble = undefined;
+                }
+            });
+            clearTimeout(bubble.hardTimer);
+            bubble.owner = event.id;
+        }
+        return bubble;
+    };
+    const transferReply = (event) => {
+        const bubble = claimReplyBubble(event);
+        if (!bubble)
+            return;
+        const origin = deps.events?.replyOrigin(event);
+        bubble.pending = (bubble.pending ?? Promise.resolve()).catch(() => undefined).then(async () => {
+            if (bubble.done || bubble.owner !== event.id || !eventOwnerGate(event))
+                return;
+            await client.replyStream(bubble.frame, bubble.streamId, withLinkedTagHeader(event.target, "…", chatTurnUrl(event.target, event.turn || origin?.turn), undefined, undefined, event.channel), false);
+        }).catch((e) => { log.debug({ event: event.id, err: errText(e) }, "transfer reply refresh failed"); });
+    };
+    const armBriefBubble = (a, b, turnId, channel) => {
+        clearTimeout(b.hardTimer);
+        const owner = b.owner;
+        if (!isWxFrame(b.frame))
+            b.hardTimer = setTimeout(() => {
+                if (b.owner !== owner || !bubbleOwned(a, b))
+                    return;
+                const live = a.briefBubble === b && !a.briefConcluded;
+                void finishBubble(a, b, briefLine(a, turnId, live ? STILL_WORKING : "", channel), true);
+            }, Math.max(0, (b.expires ?? Date.now()) - Date.now()));
+    };
     const newTurnId = () => `t${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
     const newMarkId = () => `m${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
     const detailCardFor = (s, target) => {
@@ -2383,13 +2480,13 @@ export const startMirror = (deps) => {
     };
     const flushStream = async (s) => {
         s.flushTimer = undefined;
-        if (s.closed || s.dead || s.acc === s.lastSent)
+        if (s.closed || s.dead || s.acc === s.lastSent || !eventOwned(s.eventId))
             return;
         const content = s.acc;
         s.lastSent = content;
         try {
             await (s.pending = (s.pending ?? Promise.resolve()).catch(() => undefined).then(async () => {
-                if (s.closed || s.dead)
+                if (s.closed || s.dead || !eventOwned(s.eventId))
                     return;
                 await client.replyStream(s.frame, s.streamId, withLinkedTagHeader(s.target, content || "…", chatTurnUrl(s.target, s.turnId), undefined, undefined, s.dest), false);
             }));
@@ -2430,10 +2527,12 @@ export const startMirror = (deps) => {
         // 例外是 hard cap 超时: turn 还在跑, 收口时缀上中间结束语 —— 这时即使没正文
         // 也有话可说, 不算空覆盖。
         const body = timedOut ? [s.acc, STILL_WORKING].filter((x) => x.trim()).join("\n\n") : s.acc;
-        if (!s.dead && body.trim()) {
+        if (!s.dead && body.trim() && eventOwned(s.eventId)) {
             const card = detailCardFor(s, a.target);
             try {
                 await s.pending?.catch(() => undefined);
+                if (!eventOwned(s.eventId))
+                    return;
                 if (card) {
                     s.cardSent = true;
                     await client.replyStreamWithCard(s.frame, s.streamId, withLinkedTag(a, body, undefined, s.turnId), true, { templateCard: card });
@@ -2462,8 +2561,9 @@ export const startMirror = (deps) => {
         if (a.liveStream === s)
             a.liveStream = undefined;
     };
-    const openStream = (a, frame, streamId) => {
+    const openStream = (a, frame, streamId, eventId = a.activeEventId) => {
         const s = {
+            eventId,
             turnId: newTurnId(),
             frame, streamId,
             target: a.target,
@@ -2472,6 +2572,11 @@ export const startMirror = (deps) => {
             capped: false, closed: false, dead: false, cardSent: false,
             tools: [], sawTool: false,
         };
+        const event = eventId ? deps.events?.get(eventId) : undefined;
+        if (event?.payload.human)
+            rememberReplyBubble(event.id, {
+                frame, streamId, done: false, owner: event.id, source: s, expires: event.at + HARD_TIMEOUT_MS,
+            });
         // 微信帧没有 stream 窗口: 到点收口只会多发一条「仍在处理中」, 白占它那几格出站额度。
         if (!isWxFrame(frame))
             s.hardTimer = setTimeout(() => void finalizeStream(a, s, true), HARD_TIMEOUT_MS);
@@ -2496,7 +2601,8 @@ export const startMirror = (deps) => {
     // turnSilent 已被拦下; 非 brief 的逐条推送在这里兜一道 —— 只放 `[mirror]` /
     // `[wezard]` 系统提示 (它们回 home)。
     const sendStandalone = (a, content) => {
-        if (!hasVisibleBody(content))
+        const eventId = a.activeEventId;
+        if (!hasVisibleBody(content) || !eventOwned(eventId))
             return;
         if (isPrivate(a) && !/^\[(mirror|wezard)\]/.test(content.trim()))
             return;
@@ -2507,6 +2613,8 @@ export const startMirror = (deps) => {
         a.standalonePending = a.standalonePending
             .then(async () => {
             for (const c of chunks) {
+                if (!eventOwned(eventId))
+                    return;
                 try {
                     const ack = await client.sendMessage(chatId, { msgtype: "markdown", markdown: { content: c } });
                     log.info({ sessionId: a.sessionId, turnId, chatId, len: c.length, ack: JSON.stringify(ack ?? null).slice(0, 300) }, "standalone pushed");
@@ -2520,12 +2628,15 @@ export const startMirror = (deps) => {
     };
     // Like sendStandalone but skips withTagHeader — content already contains the tag header (e.g. as a link).
     const sendRaw = (a, content) => {
-        if (!hasVisibleBody(content))
+        const eventId = a.activeEventId;
+        if (!hasVisibleBody(content) || !eventOwned(eventId))
             return;
         const chatId = replyChatId(a);
         const turnId = a.briefTurnId ?? a.liveStream?.turnId;
         a.standalonePending = a.standalonePending
             .then(async () => {
+            if (!eventOwned(eventId))
+                return;
             try {
                 await client.sendMessage(chatId, { msgtype: "markdown", markdown: { content } });
                 log.info({ sessionId: a.sessionId, turnId, chatId, len: content.length }, "raw pushed");
@@ -2634,13 +2745,22 @@ export const startMirror = (deps) => {
     };
     // Path A: a needs-approval tool_use just landed. Aggregate the buffer as one
     // standalone, send it BEFORE the approval card race, transition to AWAITING_APPR.
+    const discardUnownedOutbound = (a, out) => {
+        if (eventOwned(out.eventId))
+            return false;
+        if (out.kind === "deferred")
+            clearTimeout(out.timer);
+        if (a.outbound === out)
+            a.outbound = undefined;
+        return true;
+    };
     const promoteToStandalone = (a) => {
         const out = a.outbound;
-        if (out?.kind !== "deferred")
+        if (out?.kind !== "deferred" || discardUnownedOutbound(a, out))
             return;
         clearTimeout(out.timer);
         const md = renderBuf(out.buf);
-        a.outbound = { kind: "awaiting_appr", frame: out.frame, streamId: out.streamId };
+        a.outbound = { kind: "awaiting_appr", eventId: out.eventId, frame: out.frame, streamId: out.streamId };
         flushPendingStandalone(a);
         if (md)
             sendStandalone(a, md);
@@ -2660,7 +2780,7 @@ export const startMirror = (deps) => {
     // Pure-text turn or no trailing final text → no split, all into streamId.
     const exitDeferredAsFinalStream = (a) => {
         const out = a.outbound;
-        if (out?.kind !== "deferred")
+        if (out?.kind !== "deferred" || discardUnownedOutbound(a, out))
             return;
         clearTimeout(out.timer);
         const buf = out.buf;
@@ -2685,15 +2805,15 @@ export const startMirror = (deps) => {
             try {
                 // 有正文才写旧 streamId (收入 stream); 空缓冲一个字都不写 —— 否则
                 // loading 气泡被 " " 覆盖, 结束处理自己凭空制造一条空消息。
-                if (bubbleMd)
+                if (bubbleMd && eventOwned(out.eventId))
                     await client.replyStream(out.frame, out.streamId, withLinkedTag(a, bubbleMd), true);
             }
             catch (e) {
                 log.warn({ sessionId: a.sessionId, err: e.message }, "exit-deferred finalize failed; falling back to standalone");
-                if (bubbleMd)
+                if (bubbleMd && eventOwned(out.eventId))
                     sendStandalone(a, bubbleMd);
             }
-            if (trailingMd)
+            if (trailingMd && eventOwned(out.eventId))
                 sendStandalone(a, trailingMd);
         })();
         log.info({ sessionId: a.sessionId, items: buf.length, bubbleLen: bubbleMd.length, trailingLen: trailingMd.length, sawTool }, "outbound: DEFERRED → IDLE (turn_end, finalized to streamId)");
@@ -2703,17 +2823,19 @@ export const startMirror = (deps) => {
     // STREAMING branch since outbound is now undefined.
     const promoteToStream = (a) => {
         const out = a.outbound;
-        if (out?.kind !== "deferred")
+        if (out?.kind !== "deferred" || discardUnownedOutbound(a, out))
             return;
         const { buf, frame, streamId } = out;
         a.outbound = undefined;
-        const s = openStream(a, frame, streamId);
+        const s = openStream(a, frame, streamId, out.eventId);
         a.liveStream = s;
         if (buf.length === 0) {
             // Empty buffer — claude still thinking. Send the "…" ack so the user
             // sees the bubble; subsequent items grow it as today.
             void (async () => {
                 try {
+                    if (!eventOwned(s.eventId) || s.closed)
+                        return;
                     await (s.pending = client.replyStream(frame, streamId, withTagHeader(a.target, "…"), false));
                 }
                 catch (e) {
@@ -2736,7 +2858,7 @@ export const startMirror = (deps) => {
         // an empty buffer before any tool_use can be evaluated for approval-needs.
         const SAFETY_MS = 5 * 60_000;
         const timer = setTimeout(() => promoteToStream(a), SAFETY_MS);
-        a.outbound = { kind: "deferred", buf: [], frame, streamId, timer };
+        a.outbound = { kind: "deferred", eventId: a.activeEventId, buf: [], frame, streamId, timer };
         log.info({ sessionId: a.sessionId, safetyMs: SAFETY_MS }, "outbound: IDLE → DEFERRED (safety net)");
     };
     // Buffer / decide while in DEFERRED. user_text is CLI-side typing (not the
@@ -2745,7 +2867,7 @@ export const startMirror = (deps) => {
     // subsequent items don't reset (bounded promote delay).
     const handleDeferredItem = (a, item) => {
         const out = a.outbound;
-        if (out?.kind !== "deferred")
+        if (out?.kind !== "deferred" || discardUnownedOutbound(a, out))
             return;
         if (item.kind === "turn_end") {
             exitDeferredAsFinalStream(a);
@@ -2822,12 +2944,12 @@ export const startMirror = (deps) => {
         const b = a.briefBubble;
         const turnId = a.briefTurnId;
         // 收口后这一路全部失效: 气泡要么已 done, 要么 turn 已经换人/清空。
-        if (!text || !b || b.done || !turnId || a.briefConcluded)
+        if (!text || !b || b.done || !turnId || a.briefConcluded || !bubbleOwned(a, b))
             return;
         a.cotLastSent = text;
         try {
             await (b.pending = (b.pending ?? Promise.resolve()).catch(() => undefined).then(async () => {
-                if (b.done || a.briefBubble !== b || a.briefTurnId !== turnId)
+                if (b.done || a.briefBubble !== b || a.briefTurnId !== turnId || !bubbleOwned(a, b))
                     return;
                 await client.replyStream(b.frame, b.streamId, briefLine(a, turnId, text), false);
             }));
@@ -2839,7 +2961,7 @@ export const startMirror = (deps) => {
     /** 推进气泡里的 CoT 进度。节流窗口内到达的多条只留最后一条 —— 进度永远只展示"最新"。 */
     const updateBriefProgress = (a, raw) => {
         const b = a.briefBubble;
-        if (!b || b.done || a.briefConcluded)
+        if (!b || b.done || a.briefConcluded || !bubbleOwned(a, b))
             return;
         const line = cotLine(raw);
         if (!line)
@@ -2853,7 +2975,7 @@ export const startMirror = (deps) => {
      *  只有没有新 text 的窗口才把最新 tool 行刷上气泡。节流与 text 共用一个计时器。 */
     const updateBriefToolProgress = (a, raw) => {
         const b = a.briefBubble;
-        if (!b || b.done || a.briefConcluded)
+        if (!b || b.done || a.briefConcluded || !bubbleOwned(a, b))
             return;
         const line = cotLine(raw);
         if (!line)
@@ -2875,7 +2997,7 @@ export const startMirror = (deps) => {
     // `[mirror]` 系统提示 —— 它们都不走这道门。
     // 只在 brief 下生效: 抑制的前提是详情页兜得住内容, 而 turn store 只有 brief 在写。
     // 私聊轮 (wizard 之间, 非 public) 同理: 它的回复属于那场私聊, 只进双方的 rolepage。
-    const turnSilent = (a) => isPrivate(a) || (cfg.wrc.mirror.brief && cfg.wrc.mirror.chatOriginOnly && a.turnFromChat === false);
+    const turnSilent = (a) => !eventOwned(a.activeEventId) || isPrivate(a) || (cfg.wrc.mirror.brief && cfg.wrc.mirror.chatOriginOnly && a.turnFromChat === false);
     const formatFinal = (target, turn, channel, body) => {
         const pieces = splitMarkdown(body, Math.max(200, cfg.wrc.mirror.chunkBytes - TAG_HEADER_BUDGET));
         return pieces.map((text, n) => withLinkedTagHeader(target, text, chatTurnUrl(target, turn), pieces.length > 1 ? `${n + 1}/${pieces.length}` : undefined, undefined, channel));
@@ -2904,12 +3026,13 @@ export const startMirror = (deps) => {
         return id;
     };
     const recoverEventFinal = (event, bubble) => {
-        if (!event.result || event.interjected || event.canceled)
+        if ((deps.events?.get(event.id) ?? event).handoffCut || !event.result || event.interjected || event.canceled || !eventOwnerGate(event))
             return;
         // 事件泵的 evidence 探针 (observe → io.recovered) 与 brief 软收口赛跑: 两者同为
         // ~1s 周期, 探针常先跑到, 而它调这里不带气泡 —— queueFinal 拿不到 stream, 终句
         // 全部走 standalone, 气泡定格在最后一行 CoT 进度。没传气泡时按 target/turn 找回
         // 活着的那只 (turn 已换人/气泡已收则不挂, 维持 standalone)。
+        bubble ??= claimReplyBubble(event);
         bubble ??= (() => {
             const a = byTarget.get(event.target);
             return a && (!event.turn || a.briefTurnId === event.turn) && a.briefBubble && !a.briefBubble.done ? a.briefBubble : undefined;
@@ -2934,6 +3057,15 @@ export const startMirror = (deps) => {
         if (event.channel && eventFinalGate(event))
             queueFinal(event.target, turn, event.channel, event.result.body, event.id, bubble);
     };
+    const deliverTransferredFinal = (event, body) => {
+        if (!eventOwnerGate(event) || !event.channel)
+            return;
+        const turn = event.turn || event.id;
+        if (!getDetail(turn))
+            recordTurnStart({ id: turn, eventId: event.id, target: event.target,
+                userQuery: event.payload.text, createdAt: event.at, channel: event.channel, from: event.payload.peer?.from });
+        queueFinal(event.target, turn, event.channel, body, event.id, claimReplyBubble(event));
+    };
     // 收口一条 loading 气泡: finish=true 写入最终内容, 只生效一次。发送失败退回 standalone。
     // raw=true skips withTagHeader (used when content already contains the linked tag header).
     // WeCom 客户端收到 finish=true 后仍有打字机动画要播放, 如果紧接着就下发
@@ -2942,8 +3074,9 @@ export const startMirror = (deps) => {
     // standalone 自然排在 finish 之后; 额外加一小段延迟留给客户端渲染。
     const BUBBLE_FINISH_SETTLE_MS = 600;
     const finishBubble = async (a, b, content, raw = false) => {
-        if (!b || b.done)
+        if (!b || b.done || !bubbleOwned(a, b))
             return;
+        const owner = b.owner;
         b.done = true;
         clearTimeout(b.hardTimer);
         if (a.briefBubble === b)
@@ -2952,6 +3085,9 @@ export const startMirror = (deps) => {
         clearCot(a);
         const p = (async () => {
             try {
+                await b.pending?.catch(() => undefined);
+                if (b.owner !== owner || !bubbleOwned(a, b))
+                    return;
                 await client.replyStream(b.frame, b.streamId, raw ? (content || " ") : withLinkedTag(a, content || " "), true);
                 // 给 WeCom 客户端留一点时间完成打字机动画, 再放行 standalone 队列。
                 await new Promise((r) => setTimeout(r, BUBBLE_FINISH_SETTLE_MS));
@@ -2967,62 +3103,6 @@ export const startMirror = (deps) => {
         return p;
     };
     const finishBriefBubble = (a, content, raw = false) => finishBubble(a, a.briefBubble, content, raw);
-    // ── transfer 的气泡移交 ───────────────────────────────────────────────
-    // 人问的那一笔 transfer 出去, 气泡 (那句人话的 frame/streamId) 跟着行走: 从交出方这一轮摘下,
-    // 按接手方的注入事件 id 寄存, 接手方开出那一轮时 (ensureBriefTurn) 接过去 —— CoT 进度与终句
-    // 续写同一颗气泡, 不另开新的。寄存只在内存: reload 后丢了就退回 standalone, 与过期同。
-    const handedBubbles = new Map();
-    const writeBubble = (b, content, finish) => (b.pending = (b.pending ?? Promise.resolve()).catch(() => undefined)
-        .then(() => client.replyStream(b.frame, b.streamId, content, finish))
-        .catch((e) => log.warn({ err: e.message, finish }, "transfer: handed bubble write failed")));
-    /** 6min 窗口的兜底收口按气泡自己的到期点算 (它从人那句话起算, 不因转手重置)。 */
-    const untilExpiry = (b) => Math.max(0, (b.expires ?? Date.now()) - Date.now());
-    const handBubble = (source, serves, eventId, target) => {
-        const a = byTarget.get(source);
-        const b = a?.briefBubble;
-        const turnId = a?.briefTurnId;
-        // 只交「这一轮正服务着那一笔」的气泡: 别的轮的气泡与这次移交无关。
-        if (!a || !b || b.done || !turnId || !a.activeEventId || deps.events?.get(a.activeEventId)?.serves !== serves)
-            return false;
-        clearTimeout(b.hardTimer);
-        a.briefBubble = undefined;
-        clearCot(a);
-        const channel = a.channel || undefined;
-        const line = (rest) => headed(chatHead(target, chatTurnUrl(target, turnId), undefined, channel), rest) || "…";
-        void writeBubble(b, line("…"), false);
-        const held = { bubble: b };
-        // 接手方迟迟不开轮 (在忙 / 被并进别的轮): 到期前收口成「仍在处理中」, 终句届时走 standalone。
-        if (!isWxFrame(b.frame))
-            held.timer = setTimeout(() => {
-                if (handedBubbles.get(eventId) !== held)
-                    return;
-                handedBubbles.delete(eventId);
-                b.done = true;
-                void writeBubble(b, line(STILL_WORKING), true);
-            }, untilExpiry(b));
-        handedBubbles.set(eventId, held);
-        log.info({ source, target, serves, eventId, turnId }, "transfer: bubble handed to new owner");
-        return true;
-    };
-    /** 接手方这一轮 (`a.activeEventId`) 若有寄存的气泡: 接成本轮气泡, 头换成它自己的链接。 */
-    const adoptBubble = (a, turnId) => {
-        const held = a.activeEventId ? handedBubbles.get(a.activeEventId) : undefined;
-        if (!held)
-            return undefined;
-        handedBubbles.delete(a.activeEventId);
-        clearTimeout(held.timer);
-        const b = held.bubble;
-        if (b.done || untilExpiry(b) === 0)
-            return undefined;
-        if (!isWxFrame(b.frame))
-            b.hardTimer = setTimeout(() => {
-                const live = a.briefBubble === b && !a.briefConcluded;
-                void finishBubble(a, b, briefLine(a, turnId, live ? STILL_WORKING : ""), true);
-            }, untilExpiry(b));
-        void writeBubble(b, briefLine(a, turnId, "…"), false);
-        log.info({ sessionId: a.sessionId, turnId, eventId: a.activeEventId }, "transfer: handed bubble adopted");
-        return b;
-    };
     // 让一个已建好记录的 turn 成为活跃 turn。turn 级状态在这里统一归零 —— 唯一入口。
     const openBriefTurn = (a, q) => {
         a.briefTurnId = q.turnId;
@@ -3065,7 +3145,7 @@ export const startMirror = (deps) => {
     /** 这一轮挂在哪一笔上: 回执 (与老派活信封) 写在信封上; 新派活信封不带, 问注入事件的 `serves`。 */
     const rowOf = (env) => env.event ?? (env.eventId ? deps.events?.get(env.eventId)?.serves : undefined);
     const openingOf = (a) => {
-        const t = a.jsonlPath ? lastUserTurn(a.jsonlPath) : undefined;
+        const t = a.jsonlPath ? lastUserTurn(a.jsonlPath, a.openingOffset) : undefined;
         const env = t?.env;
         a.activeEventId = env?.eventId;
         if (!env)
@@ -3239,7 +3319,7 @@ export const startMirror = (deps) => {
         a.pendingChannel = { channel: s.channel ?? baseOfKey(a.target), speaker: s.speaker, at: now };
         a.pendingBriefQuery = s.query;
         a.pendingBriefAt = ts;
-        if (!cfg.wrc.mirror.brief) {
+        if (!briefMode(a)) {
             consumeChannel(a, false, consumeFrom(a));
             if (a.liveStream && !a.liveStream.closed)
                 a.liveStream.dest = s.channel ?? baseOfKey(a.target);
@@ -3249,19 +3329,14 @@ export const startMirror = (deps) => {
     const startBriefTurn = async (a, frame, streamId, isSlash = false, userQuery = "", channel, speaker, eventId) => {
         const turnId = newTurnId();
         // hardTimer 兜底: turn 若无终句 / turn_end 收口 (卡死/漏收), 到点仍收气泡。
-        const bubble = { frame, streamId, done: false, expires: (eventId ? deps.events?.get(eventId)?.at ?? Date.now() : Date.now()) + HARD_TIMEOUT_MS };
+        const bubble = { frame, streamId, done: false, owner: eventId, expires: (eventId ? deps.events?.get(eventId)?.at ?? Date.now() : Date.now()) + HARD_TIMEOUT_MS };
         if (eventId)
             deps.events?.bind(eventId, turnId);
         const q = { turnId, bubble, isSlash };
         // 微信帧不挂: 没有 stream 窗口要赶, 气泡等终句来了再一次发出 (见 openStream 同一条)。
-        if (!isWxFrame(frame))
-            bubble.hardTimer = setTimeout(() => {
-                // WeCom ~6min stream 窗口快到, 必须 finish=true 收口。finish 是整条替换 ——
-                // 定格在一行过期的 CoT 进度上看着像卡死, 光链接又像说完了; 气泡仍是本轮活跃
-                // 气泡 (turn 还在跑) 就明说「仍在处理中」, 已被顶替的旧轮只留链接。
-                const live = a.briefBubble === bubble && !a.briefConcluded;
-                void finishBubble(a, bubble, briefLine(a, turnId, live ? STILL_WORKING : "", channel), true);
-            }, HARD_TIMEOUT_MS);
+        if (eventId)
+            rememberReplyBubble(eventId, bubble);
+        armBriefBubble(a, bubble, turnId, channel);
         const seal = { eventId, keys: sealKeys(userQuery), at: Date.now(), query: userQuery, channel, speaker, fresh: true, turn: q };
         // 对方闲着 → 这一句就是下一轮, 当场接上。正忙 (在跑别人的回执 / 派活 / 上一句) 就先排着:
         // 那一轮的回复不能流进这一句的气泡, 等它在 transcript 里露面再接 (bindLine)。turn 记录
@@ -3291,7 +3366,7 @@ export const startMirror = (deps) => {
         if (a.channelSeeded)
             return false;
         const head = (t) => (t ?? "").replace(/\s+/g, " ").trim().slice(0, 60);
-        const opening = a.jsonlPath ? lastUserTurn(a.jsonlPath) : undefined;
+        const opening = a.jsonlPath ? lastUserTurn(a.jsonlPath, a.openingOffset) : undefined;
         const said = head(opening?.text);
         const eventId = opening?.env?.eventId;
         const r = openTurnsOf(a.target, a.sessionId).find((t) => eventId ? t.eventId === eventId : !!said && head(t.userQuery) === said);
@@ -3308,7 +3383,10 @@ export const startMirror = (deps) => {
         a.replyTo = publicPeer(r.from);
         a.turnFromChat = a.turnFromChat ?? true;
         a.briefTurnId = r.id;
-        a.briefBubble = undefined;
+        const event = eventId ? deps.events?.get(eventId) : undefined;
+        a.briefBubble = event ? claimReplyBubble(event) : undefined;
+        if (a.briefBubble)
+            armBriefBubble(a, a.briefBubble, r.id, a.channel);
         a.briefIsSlash = false;
         a.briefHadTool = r.items.some((it) => it.t === "tool_use");
         a.briefConcluded = false;
@@ -3342,15 +3420,15 @@ export const startMirror = (deps) => {
         a.briefTurnId = turnId;
         if (a.activeEventId)
             deps.events?.bind(a.activeEventId, turnId);
+        const event = a.activeEventId ? deps.events?.get(a.activeEventId) : undefined;
+        a.briefBubble = event ? claimReplyBubble(event) : undefined;
+        if (a.briefBubble)
+            armBriefBubble(a, a.briefBubble, turnId, a.channel);
         a.briefIsSlash = false;
         a.briefHadTool = false;
         a.briefConcluded = false;
         a.briefLastText = undefined;
         clearCot(a);
-        // transfer 接过来的那一笔: 续写人那句话的气泡 —— 这一轮就是在答群里的人。
-        a.briefBubble = adoptBubble(a, turnId);
-        if (a.briefBubble)
-            a.turnFromChat = true;
         // 详情链接不在这里单独发 — 本轮的每条 standalone 都由 withLinkedTag 自带
         // (chatTurnUrl 读的正是 a.briefTurnId)。静默轮没有 standalone 可搭车, 那就
         // 一条都不发: 群里只该出现有正文的消息, 纯入口提示是噪音。
@@ -3396,16 +3474,13 @@ export const startMirror = (deps) => {
         if (event)
             deps.events.result(event.id, body, finalId(event.id, event.channel, body), turnId);
         const gated = !!event && !eventFinalGate(event);
-        // 那一笔已交出: 交代归接手方, 这句只留 rolepage —— 不进气泡 (已移交) 也不 standalone。
-        if (event && eventHandedAway(event))
-            log.info({ sessionId: a.sessionId, turnId, event: event.id }, "brief: final of a transferred-away row kept off chat");
-        else if (!turnSilent(a) && !gated) {
+        if (!turnSilent(a) && !gated) {
             if (event)
                 recoverEventFinal(deps.events.get(event.id), a.briefBubble);
             else
                 queueFinal(a.target, turnId, a.channel ?? baseOfKey(a.target), body, undefined, a.briefBubble);
         }
-        else if (gated && !turnSilent(a)) {
+        else if (gated && eventOwned(a.activeEventId) && !turnSilent(a)) {
             // 链式收口 (eventFinalGate: 子活未落定) 延后的是 closing 的释放, 不该扣住气泡:
             // queueFinal 没跑 = 没人收气泡, 它会定格在最后一行 CoT 进度上 (看着像卡在 tool
             // use), hardTimer 到点的空 finish 又被 chat-gate 当 empty push 丢掉。气泡还在
@@ -3835,7 +3910,7 @@ export const startMirror = (deps) => {
             handleGoalItem(a, { kind: "turn_end" });
             return;
         }
-        if (cfg.wrc.mirror.brief && a.briefTurnId) {
+        if (briefMode(a) && a.briefTurnId) {
             closeBriefTurn(a);
             return;
         }
@@ -3846,6 +3921,8 @@ export const startMirror = (deps) => {
         // 新 spawn 的 pane 在首次 inject 落地前吞掉所有初始输出 (greeting/system)。
         if (a.muteUntilInject)
             return;
+        if (item.kind === "user_text" || item.kind === "user_query" || item.kind === "user_inject")
+            a.openingOffset = undefined;
         if (item.kind === "user_text") {
             // 回显去重只认 60s 内的注入: 排在长轮后面的那一行露面时已经过期, 会被当成人在 CLI 里敲的。
             // 印章认得出就仍是那次注入 —— 不回显, 也不算 CLI 轮。
@@ -3864,7 +3941,7 @@ export const startMirror = (deps) => {
             a.pendingChannel = undefined;
             a.activeEventId = item.eventId;
             a.pendingFromCli = true;
-            if (!cfg.wrc.mirror.brief)
+            if (!briefMode(a))
                 consumeChannel(a, true, undefined);
         }
         if (item.kind === "user_inject") {
@@ -3911,13 +3988,18 @@ export const startMirror = (deps) => {
         // 有活跃 turn 时 handleBriefItem 本就丢它, 没有 turn 时 (user_text 不是
         // BRIEF_TURN_OPENERS) 它会一路穿到底部的 standalone fallback —— includeUser=true
         // 的配置下, 人在 CLI 敲的那一行就这么原样回显进了群, 正好破了 chatOriginOnly。
-        if (item.kind === "user_text" && (item.quiet || cfg.wrc.mirror.brief))
+        if (item.kind === "user_text" && (item.quiet || briefMode(a)))
             return;
         // thinking 唯一的出口是 brief 气泡的 CoT 进度行。必须在这里就吃掉 —— 漏到下面任何
         // 一条通道 (deferred buf → renderBuf / standalone / stream append) 都会把它写进正文,
         // 那就变回已下线的 thinkStyle 了。
         if (item.kind === "thinking") {
-            if (cfg.wrc.mirror.brief && a.briefTurnId)
+            const event = a.activeEventId ? deps.events?.get(a.activeEventId) : undefined;
+            // A receiver can begin with thinking, before any text/tool opener. Bind its
+            // turn and inherited bubble now; pending input alone never authorizes output.
+            if (!a.briefTurnId && event?.payload.peer?.transferred && eventOwnerGate(event))
+                ensureBriefTurn(a);
+            if (briefMode(a) && a.briefTurnId)
                 updateBriefProgress(a, item.body);
             return;
         }
@@ -4060,7 +4142,7 @@ export const startMirror = (deps) => {
                 }
             }
         }
-        if (!cfg.wrc.mirror.brief && item.kind === "text" && item.final !== false && a.activeEventId && deps.events) {
+        if (!briefMode(a) && item.kind === "text" && item.final !== false && a.activeEventId && deps.events) {
             const e = deps.events.get(a.activeEventId);
             if (e) {
                 // Soft final text waits for transcript/idle evidence; it must not escape through the legacy stream.
@@ -4073,7 +4155,7 @@ export const startMirror = (deps) => {
                 return;
             }
         }
-        if (!cfg.wrc.mirror.brief && isPrivate(a))
+        if (!briefMode(a) && (isPrivate(a) || !eventOwned(a.activeEventId)))
             return;
         // /goal mode overrides everything below: the session-scoped Stop hook
         // self-drives the model with no terminal stop_reason, so turn_end never fires
@@ -4092,17 +4174,17 @@ export const startMirror = (deps) => {
         // Brief 模式下没有活跃 turn 时, 任何 assistant 侧产出都补开一个无气泡 turn ——
         // 覆盖 CLI 侧直接开的新一轮 (WeCom 没参与, 拿不到 frame) 与收口后的零星补写。
         // user 行不开 turn (CLI 敲字 ≠ 一定有回复), 它的 query/出处已在上面记下。
-        if (cfg.wrc.mirror.brief && !a.briefTurnId && BRIEF_TURN_OPENERS.has(item.kind))
+        if (briefMode(a) && !a.briefTurnId && BRIEF_TURN_OPENERS.has(item.kind))
             ensureBriefTurn(a);
         // Usage snapshots never flow into WeCom bubbles — brief 分支下 handleBriefItem
         // 会把它写进 turn store, 非 brief 下直接吞掉, 保持 onItem 主流程只处理有渲染
         // 输出的 item 类型。
-        if (item.kind === "turn_usage" && !(cfg.wrc.mirror.brief && a.briefTurnId)) {
+        if (item.kind === "turn_usage" && !(briefMode(a) && a.briefTurnId)) {
             return;
         }
         // Brief mode 短路: 所有正常流/deferral/awaiting 全跳过, 只写入 turn store,
         // 唯一发到群里的是 turn 结束时的 finish text (下文 handleBriefItem 处理)。
-        if (cfg.wrc.mirror.brief && a.briefTurnId) {
+        if (briefMode(a) && a.briefTurnId) {
             handleBriefItem(a, item);
             return;
         }
@@ -4118,7 +4200,7 @@ export const startMirror = (deps) => {
             return;
         // Brief mode 短路: 所有正常流/deferral/awaiting 全跳过, 只写入 turn store,
         // 唯一发到群里的是 turn 结束时的 finish text (下文 handleBriefItem 处理)。
-        if (cfg.wrc.mirror.brief && a.briefTurnId) {
+        if (briefMode(a) && a.briefTurnId) {
             handleBriefItem(a, item);
             return;
         }
@@ -4133,9 +4215,11 @@ export const startMirror = (deps) => {
         // 说明 claude 已继续执行 (hook 必然已返回 / 根本没拦), 把状态提升回 STREAMING,
         // 复用原 frame/streamId 让本轮回到打字机气泡。
         if (a.outbound?.kind === "awaiting_appr") {
-            const { frame, streamId } = a.outbound;
+            if (discardUnownedOutbound(a, a.outbound))
+                return;
+            const { frame, streamId, eventId } = a.outbound;
             a.outbound = undefined;
-            const s = openStream(a, frame, streamId);
+            const s = openStream(a, frame, streamId, eventId);
             a.liveStream = s;
             log.info({ sessionId: a.sessionId, kind: item.kind, turnId: s.turnId }, "outbound: AWAITING_APPR → STREAMING (hook bypassed, item arrived)");
         }
@@ -4269,11 +4353,21 @@ export const startMirror = (deps) => {
         const carryEffort = effort !== undefined ? effort.trim() : (prevByTarget?.effort ?? deps.store.get(target)?.effort ?? "");
         if (prevByTarget)
             detach(prevByTarget, "target reassigned");
+        const startOffset = (() => { try {
+            return statSync(jsonlPath).size;
+        }
+        catch {
+            return 0;
+        } })();
         // Build the attachment first so the tail's onItem closure can capture it.
         const a = {
             sessionId,
             jsonlPath,
             target,
+            // Tail starts at EOF after reload; recover ownership before its first item,
+            // including non-brief output that never enters ensureBriefTurn.
+            activeEventId: lastUserTurn(jsonlPath, startOffset)?.env?.eventId,
+            openingOffset: startOffset,
             tmuxPane: (tmuxPane ?? "").trim(),
             tmuxSession: (tmuxSession ?? "").trim(),
             // Explicit cwd (spawn path) wins; otherwise derive from jsonl head so
@@ -4289,6 +4383,7 @@ export const startMirror = (deps) => {
         };
         a.tail = startMirrorTail({
             jsonlPath,
+            startOffset,
             log: log.child({ sub: "tail", sessionId }),
             includeUser: cfg.wrc.mirror.includeUser,
             includeTools: cfg.wrc.mirror.includeTools,
@@ -4678,7 +4773,7 @@ export const startMirror = (deps) => {
     // freshly-rotated jsonl (only holds the /clear line + new content); resume
     // migration omits it (→ tail from EOF) because the fork file is seeded with
     // the FULL prior transcript and replaying from 0 would re-dump it to WeCom.
-    const migrateAttachment = (a, newSessionId, newJsonlPath, startOffset) => {
+    const migrateAttachment = (a, newSessionId, newJsonlPath, startOffset, knownClear = false) => {
         // Guard: if newSessionId is already bound to a DIFFERENT principal, abort —
         // prevents silent cross-wire (path B: /clear rotation or drift landing on
         // a sibling's live session).
@@ -4692,7 +4787,7 @@ export const startMirror = (deps) => {
         // 迁移是所有会话轮换的唯一漏斗 (注入的 /clear、TUI 里手打的 /clear、resume fork、
         // worktree drift)。只有目标 jsonl 首条用户行是 /clear 的那种才是真清空 —— fork /
         // drift 上下文是延续的, 画中性的 "switch"。
-        const cleared = jsonlIsPostClearChild(newJsonlPath);
+        const cleared = knownClear || jsonlIsPostClearChild(newJsonlPath);
         markCut(a.target, newSessionId, cleared ? "clear" : "switch");
         if (cleared)
             contextCut(a.target, "clear");
@@ -4729,6 +4824,8 @@ export const startMirror = (deps) => {
             tmuxSession: a.tmuxSession || undefined,
             tmuxPane: a.tmuxPane || undefined,
             cwd: a.runningCwd || undefined,
+            model: a.model || undefined,
+            effort: a.effort || undefined,
             pendingCwd: a.pendingCwd || undefined,
         });
         log.info({ target: a.target, oldSessionId, newSessionId, oldJsonlPath, newJsonlPath, startOffset }, "mirror migrated session");
@@ -5527,17 +5624,29 @@ export const startMirror = (deps) => {
         // store — e.g. after a reload that couldn't re-attach — is still killable.
         const a = byTarget.get(target);
         const pane = a?.tmuxPane || paneOf(target);
+        const sid = a?.sessionId ?? deps.store.get(target)?.sessionId;
+        const birth = wizardStore()?.get(target)?.birthToken;
+        const same = () => byTarget.get(target) === a && (a?.tmuxPane || paneOf(target)) === pane
+            && (a?.sessionId ?? deps.store.get(target)?.sessionId) === sid && wizardStore()?.get(target)?.birthToken === birth;
+        const replaced = { ok: false, reason: "target identity changed during pane cleanup; cleanup withheld" };
         if (!a && !pane)
             return { ok: false, reason: "no session bound to target" };
         if (pane && (await tmuxPaneAlive(pane))) {
+            if (!same())
+                return replaced;
             // Esc first, like /stop: a mid-generation CLI gets a beat to unwind and
             // flush its transcript before the TTY is yanked out from under it.
             await runTmux(["send-keys", "-t", pane, "Escape"]);
             await sleep(250);
+            if (!same())
+                return replaced;
             const r = await runTmux(["kill-pane", "-t", pane]);
             if (r.code !== 0)
                 return { ok: false, reason: `kill-pane failed: ${r.stdout.slice(-200) || r.code}` };
         }
+        // A late stop must not detach a new wizard that reused this target/name.
+        if (!same())
+            return replaced;
         if (a)
             detach(a, drop ? "/kill" : "sleep");
         if (!drop) {
@@ -6047,8 +6156,196 @@ export const startMirror = (deps) => {
             : { ok: true, label: `${pick.index}. ${pick.label}` };
     };
     const pressNativePicker = async (a, fingerprint, what, guard) => withPaneInput(a.tmuxPane, (live) => pressNativePickerUnlocked(a, fingerprint, what, live), { guard });
+    // 调用方持有 pane 输入锁; clear 与 carry 的原生身份探测共用同一条 slash 提交流程。
+    const nativeCommands = (target, pane, codex, sameProcess, sameSession, allowed = () => true) => {
+        // 每次 slash 都在同一个物理输入锁里核对空框、idle 与进程; 不借用有补 Enter 的通用注入器。
+        const command = async (text, before) => {
+            if (!allowed() || !(await sameProcess()) || !(await idleNow(target)))
+                return false;
+            const input = await readPaneInput(pane);
+            if (!input.box.known || input.box.body || paneIsBusy(input.cap) || isModalPane(input.cap).modal)
+                return false;
+            if (!(await sameSession()))
+                return false;
+            if (!(await sameProcess()))
+                return false;
+            if (!allowed())
+                return false;
+            before?.();
+            if (!allowed())
+                return false;
+            if (!(await runTmux(["send-keys", "-t", pane, "-l", text])).ok)
+                return false;
+            for (const end = Date.now() + 3000; Date.now() < end; await sleep(50)) {
+                const typed = await readPaneInput(pane);
+                if (!(await sameProcess()) || await isBusy(target))
+                    return false;
+                if (!(await sameSession()))
+                    return false;
+                // Codex 的 slash 菜单会暂时藏掉 model/cwd 状态行, 只留精确命令框与 queue footer。
+                const rows = typed.cap.trimEnd().split("\n");
+                const end = rows.length - 1;
+                const slashBox = codex && /^\s*tab to queue message(?:\s|$)/u.test(rows[end] ?? "")
+                    && !rows[end - 1]?.trim() && !rows[end - 3]?.trim() && rows[end - 2]?.trim() === `› ${text}`;
+                if (((typed.box.known && typed.box.body === text) || slashBox) && !paneIsBusy(typed.cap)) {
+                    if (!allowed())
+                        return false;
+                    return (await runTmux(["send-keys", "-t", pane, "Enter"])).ok;
+                }
+            }
+            return false;
+        };
+        const emptyComposer = async () => {
+            const input = await readPaneInput(pane);
+            return input.box.known && !input.box.body && !paneIsBusy(input.cap) && !isModalPane(input.cap).modal;
+        };
+        const statusId = async () => {
+            const before = await runTmux(["capture-pane", "-t", pane, "-p", "-J", "-S", "-200"]);
+            if (!before.ok || !(await command("/status")))
+                return undefined;
+            for (const end = Date.now() + 5000; Date.now() < end; await sleep(100)) {
+                const screen = await runTmux(["capture-pane", "-t", pane, "-p", "-J", "-S", "-200"]);
+                if (!screen.ok || !(await sameProcess()))
+                    return undefined;
+                const lastStatus = [...screen.stdout.matchAll(/(?:^|\n)(?:›\s*)?\/status\s*\n/gu)].at(-1);
+                const id = [...screen.stdout.matchAll(/\bSession:\s*([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/gu)].at(-1);
+                if (screen.stdout !== before.stdout && lastStatus && id && id.index > lastStatus.index && await emptyComposer())
+                    return id[1];
+            }
+            return undefined;
+        };
+        return { command, emptyComposer, statusId };
+    };
+    const verifyClearContext = async (target, clear) => {
+        const a = byTarget.get(target);
+        if (!a || !clear.nextSid || !clear.panePid || a.tmuxPane !== clear.pane || a.sessionId !== clear.nextSid || await panePidOf(clear.pane) !== clear.panePid)
+            return false;
+        const backend = backendForPath(a.jsonlPath);
+        if (backend.name === "claude") {
+            const actual = sessionOnPane(backend.homeDir, clear.pane);
+            return actual?.pid === clear.pid && actual.sessionId === clear.nextSid;
+        }
+        if (backend.name !== "codex" || codexSessionForPane(clear.pane)?.sessionId !== clear.nextSid)
+            return false;
+        const ps = await psSnap();
+        const pids = new Set([...ps.commands].filter(([, command]) => basename(command) === "codex").map(([pid]) => pid));
+        return registeredPidUnder(clear.panePid, pids, ps.kids) === clear.pid;
+    };
+    const verifyClearInput = async (target, clear, phase, allowed) => {
+        if (!allowed() || !(await verifyClearContext(target, clear)))
+            return false;
+        const a = byTarget.get(target);
+        if (phase === "paste" && backendForPath(a.jsonlPath).name === "codex") {
+            // 本机 Codex 不触发 SessionStart; 同 PID 原生 /new 也会让旧映射失真。
+            // brief 尚未粘贴时用 /status 重取当前 ID; submit 阶段由原进程 + 原框内容核验保护。
+            const { statusId } = nativeCommands(target, clear.pane, true, () => verifyClearContext(target, clear), () => true, allowed);
+            return await statusId() === clear.nextSid && await verifyClearContext(target, clear) && allowed();
+        }
+        return true;
+    };
+    const clearContext = async (target, attempt, submitted, guard = () => true) => {
+        if (!guard())
+            return { ok: false, reason: "handoff continuation authority withdrawn; no input" };
+        const a = byTarget.get(target);
+        if (!a?.tmuxPane)
+            return { ok: false, reason: "handoff requires the original live pane; no respawn" };
+        const backend = backendForPath(a.jsonlPath);
+        // 只开放本机真实探针验证过的后端; 不能因家族相近就假定 slash/注册表语义相同。
+        if (!["claude", "codex"].includes(backend.name))
+            return { ok: false, reason: `${backend.name} native /clear completion is not verified; pane unchanged` };
+        if (a.pendingCwd && a.pendingCwd !== a.runningCwd)
+            return { ok: false, reason: "pending workspace switch requires an explicit /new; /clear keeps the original process cwd" };
+        const pane = a.tmuxPane;
+        const valid = () => guard() && byTarget.get(target) === a && a.tmuxPane === pane;
+        try {
+            return await withPaneInput(pane, async (live) => {
+                const codex = backend.name === "codex";
+                const nativePid = async () => {
+                    if (!codex)
+                        return sessionOnPane(backend.homeDir, pane)?.pid;
+                    const root = await panePidOf(pane);
+                    const ps = await psSnap();
+                    return registeredPidUnder(root, new Set([...ps.commands].filter(([, command]) => basename(command) === "codex").map(([pid]) => pid)), ps.kids);
+                };
+                const pid = await nativePid();
+                const panePid = await panePidOf(pane);
+                if (!pid || !panePid || !(await tmuxPaneAlive(pane)))
+                    return { ok: false, reason: "original CLI process identity is unavailable" };
+                const original = sessionOnPane(backend.homeDir, pane);
+                let transaction = attempt ?? { pane, pid, panePid, sid: a.sessionId, at: Date.now() };
+                if (transaction.pane !== pane || transaction.pid !== pid || (transaction.panePid && transaction.panePid !== panePid))
+                    return { ok: false, reason: "original pane/CLI process changed; refusing /clear" };
+                const sameProcess = async () => live() && valid() && await nativePid() === transaction.pid && await panePidOf(pane) === panePid;
+                const { command, emptyComposer, statusId } = nativeCommands(target, pane, codex, sameProcess, () => codex || (sessionOnPane(backend.homeDir, pane)?.sessionId === transaction.sid && sessionOnPane(backend.homeDir, pane)?.status === "idle"), guard);
+                if (!attempt) {
+                    const actualSid = codex ? await statusId() : original?.sessionId;
+                    if (actualSid !== transaction.sid)
+                        return { ok: false, reason: "native pane session changed/unconfirmed before /clear; refusing to clear an unbound context" };
+                    // 凭证先于第一下 /clear 按键落盘; reload 只核验原生状态, 绝不再次清空。
+                    if (!(await command("/clear", () => submitted(transaction))))
+                        return { ok: false, reason: "native /clear submission unconfirmed; no retry" };
+                }
+                if (codex) {
+                    let empty = false;
+                    for (const end = Date.now() + 5000; Date.now() < end; await sleep(100)) {
+                        if (!(await sameProcess()))
+                            return { ok: false, reason: "Codex CLI process changed during /clear" };
+                        if (await emptyComposer()) {
+                            empty = true;
+                            break;
+                        }
+                    }
+                    const nextSid = empty ? await statusId() : undefined;
+                    if (!nextSid || nextSid === transaction.sid || (transaction.nextSid && transaction.nextSid !== nextSid))
+                        return { ok: false, reason: "Codex native /status did not confirm the cleared thread; no retry" };
+                    if (sidsClaimedByOthers(target).has(nextSid))
+                        return { ok: false, reason: "native Codex thread belongs to another wizard" };
+                    transaction = { ...transaction, nextSid };
+                    submitted(transaction);
+                    const actualRollout = () => codexSessions(expandHome(backend.projectsDir), expandHome(a.runningCwd)).find((s) => s.sessionId === nextSid);
+                    // 空 thread 不会先写 rollout; /rename 原生持久化当前 thread, 不发模型消息、不另起 thread。
+                    if (!actualRollout() && !(await command(`/rename ${displayName(target).replace(/[\r\n]/gu, " ") || "wezard"}`)))
+                        return { ok: false, reason: "Codex /rename persistence unconfirmed; thread preserved" };
+                    let rollout = actualRollout();
+                    for (const end = Date.now() + 5000; !rollout && Date.now() < end; await sleep(100))
+                        rollout = actualRollout();
+                    // rename 和 metadata 扫描之间仍可能有人原生切 thread; 最后再读当前 ID, 不绑错现场。
+                    if (!rollout || await statusId() !== nextSid || !(await sameProcess()))
+                        return { ok: false, reason: "Codex current thread/actual rollout metadata not confirmed; refusing binding" };
+                    recordCodexPaneSession({ sessionId: nextSid, jsonlPath: rollout.jsonlPath, cwd: a.runningCwd, pane, startedAt: transaction.at }, cfg.daemon.stateDir);
+                    if (a.sessionId !== nextSid)
+                        migrateAttachment(a, nextSid, rollout.jsonlPath, 0, true);
+                    log.info({ target, pane, pid, panePid, oldSessionId: transaction.sid, sessionId: nextSid, jsonlPath: rollout.jsonlPath }, "handoff: Codex native clear/status/rename confirmed in original CLI process");
+                    return { ok: true };
+                }
+                for (const end = Date.now() + 20_000; Date.now() < end; await sleep(200)) {
+                    if (!(await sameProcess()))
+                        return { ok: false, reason: "CLI process changed during /clear" };
+                    const current = sessionOnPane(backend.homeDir, pane);
+                    if (!current || current.sessionId === transaction.sid || current.status !== "idle" || !(await emptyComposer()))
+                        continue;
+                    if (sidsClaimedByOthers(target).has(current.sessionId))
+                        return { ok: false, reason: "native session identity belongs to another wizard" };
+                    if (transaction.nextSid && transaction.nextSid !== current.sessionId)
+                        return { ok: false, reason: "Claude native session changed after clear confirmation" };
+                    transaction = { ...transaction, nextSid: current.sessionId };
+                    submitted(transaction);
+                    if (a.sessionId !== current.sessionId)
+                        migrateAttachment(a, current.sessionId, join(dirname(a.jsonlPath), `${current.sessionId}.jsonl`), 0, true);
+                    log.info({ target, pane, pid, panePid, oldSessionId: transaction.sid, sessionId: current.sessionId }, "handoff: native /clear confirmed in original CLI process");
+                    return { ok: true };
+                }
+                return { ok: false, reason: "native /clear completion unconfirmed; original pane preserved, brief retained, no retry" };
+            }, { guard: valid, timeoutMs: 60_000 });
+        }
+        catch (e) {
+            return { ok: false, reason: String(e) };
+        }
+    };
     return {
         attach,
+        clearContext,
+        verifyClearContext,
         chatTargets,
         peers,
         foreignPeers,
@@ -6176,9 +6473,11 @@ export const startMirror = (deps) => {
             // the first flushStream will reject, mark s.dead=true, and subsequent items
             // route to standalone via the existing :1206 fall-through. Self-healing.
             if (a.outbound?.kind === "awaiting_appr") {
-                const { frame, streamId } = a.outbound;
+                if (discardUnownedOutbound(a, a.outbound))
+                    return;
+                const { frame, streamId, eventId } = a.outbound;
                 a.outbound = undefined;
-                const s = openStream(a, frame, streamId);
+                const s = openStream(a, frame, streamId, eventId);
                 a.liveStream = s;
                 log.info({ sessionId, turnId: s.turnId }, "outbound: AWAITING_APPR → STREAMING (approved)");
             }
@@ -6279,10 +6578,11 @@ export const startMirror = (deps) => {
             const a = byTarget.get(target) ?? (await restoreFromStore(target, undefined, permission));
             if (!permission())
                 return denied;
-            // 恢复已经试过了: store 里连绑定都没有 (被 stop / kill 收掉, 或 transcript 没了被 drop) =
-            // 收方真不在了, 报 gone 让上层改投; 还有绑定只是这次 attach 没成, 照旧稍后重试。
+            // A missing binding cannot recover on retry; let receipts escalate.
             if (!a)
                 return { ok: false, retryable: true, reason: "no mirror attached for target", ...(deps.store.get(target) ? {} : { gone: true }) };
+            if (opts?.handoff && !(await verifyClearContext(target, opts.handoff)))
+                return { ok: false, retryable: false, reason: "original cleared CLI process/session changed; handoff carry withheld" };
             const sid = a.sessionId;
             const generation = a.injectGen ?? 0;
             const permitted = () => permission() && byTarget.get(target) === a && a.sessionId === sid && (a.injectGen ?? 0) === generation;
@@ -6308,6 +6608,8 @@ export const startMirror = (deps) => {
             // 也按冷启动等 idle 至多 15s, 「不等不打断」就成了「晚 15–20s 才进」(handoff-owe 的竞态即此)。
             let fresh = a.justSpawned === true;
             if (probe.state !== "session") {
+                if (opts?.noRespawn)
+                    return { ok: false, retryable: false, reason: "original CLI is unavailable; handoff never respawns" };
                 log.warn({ target, sessionId: sid, oldPane: a.tmuxPane, why: probe.state }, "injectText: pane not alive, respawning");
                 // Same resume-fork hazard as dispatch: snapshot before spawn, re-bind
                 // onto the forked jsonl once it appears (EOF offset — fork is seeded).
@@ -6356,13 +6658,18 @@ export const startMirror = (deps) => {
             const clearing = isClearCommand(text);
             const preClearBaseline = clearing ? listJsonls(dirname(a.jsonlPath)) : undefined;
             const injectPane = a.tmuxPane;
+            let pinRejected = false;
             const r = await inject({
                 text: full, images: [], cfg, guard: (phase, identity) => permitted() && a.tmuxPane === injectPane && (!opts?.guard || opts.guard(phase, identity)), log: log.child({ principal: target, sessionId: sid, sub: "init-demo" }),
                 sessionId: sid, eventId: opts?.eventId, jsonlPath: a.jsonlPath, tmuxTarget: a.tmuxPane, freshSpawn: fresh,
+                physicalGuard: opts?.handoff ? async (phase) => { const ok = permission() && await verifyClearInput(target, opts.handoff, phase, permission) && permission(); if (!ok)
+                    pinRejected = true; return ok; } : undefined,
                 requireIdle: opts?.requireIdle ? () => idleNow(target) : undefined,
                 prepareText: () => (full = text + renderTail(envelope, noticeSuffixFor(target, text))),
                 beforeInput,
             });
+            if (pinRejected)
+                return { ...r, ok: false, retryable: false, reason: "handoff process/session or continuation authority changed at physical input; carry withheld" };
             if (r.ok && a.tmuxPane && permitted()) {
                 if (preClearBaseline) {
                     a.clearRebind = { baseline: preClearBaseline };
@@ -6720,9 +7027,10 @@ export const startMirror = (deps) => {
         },
         formatFinal,
         recoverEventFinal,
+        deliverTransferredFinal,
+        transferReply,
         setEventFinalGate: (gate) => { eventFinalGate = gate; },
-        setEventHandedAway: (away) => { eventHandedAway = away; },
-        handBubble,
+        setEventOwnerGate: (gate) => { eventOwnerGate = gate; },
         settleFinalProgress,
         dispatch: async ({ principal, text, images, frame, streamId, channel, speaker, eventId, guard, onSubmitted }) => {
             // Route by inbound principal — the WeCom chat the user just messaged us
@@ -6845,10 +7153,12 @@ export const startMirror = (deps) => {
             //  • outboundDeferMs === 0 → eager openStream + "…" ack (legacy behavior)
             const brief = cfg.wrc.mirror.brief && !armMigration;
             const eagerOpen = !armMigration && !brief && cfg.wrc.mirror.outboundDeferMs <= 0;
-            const s = eagerOpen ? openStream(a, frame, streamId) : undefined;
+            const s = eagerOpen ? openStream(a, frame, streamId, eventId) : undefined;
             if (s) {
                 a.liveStream = s;
                 try {
+                    if (!eventOwned(s.eventId) || s.closed)
+                        return;
                     await (s.pending = client.replyStream(frame, streamId, withTagHeader(a.target, "…"), false));
                 }
                 catch (e) {