Merge remote-tracking branch 'origin/master' into worktree/web-multimodal-image-input

# Conflicts: # docs/architecture.i18n.yaml # docs/core-data-structures/core.i18n.yaml # examples/acp-agent/tests/snapshots/cordis-inspect-jsdoc/session.jsonl # packages/README.i18n.yaml # packages/README.md # packages/README.zh.md # packages/client/connection/src/client/fixture.ts # packages/client/connection/tests/fake-api.ts # packages/client/runtime/README.i18n.yaml # packages/client/runtime/src/client/contract/session.ts # packages/client/runtime/src/client/sessions/session.ts # packages/client/runtime/tests/fake-api.ts # packages/client/test-runtime/src/sessions.ts # packages/client/test-runtime/tests/runtime.spec.tsx # packages/client/ui-conversation/README.i18n.yaml # packages/client/ui-conversation/src/client/service.ts # packages/client/ui-conversation/src/client/skeleton/InputBar.tsx # packages/client/ui-conversation/tests/queue-dock.spec.tsx # packages/client/ui-conversation/tests/service-orchestration.spec.ts # packages/cordis/tool-cordis/src/api-catalog.ts # packages/host/apiproxy/README.i18n.yaml # packages/host/apiproxy/src/api-proxy.ts # packages/host/apiproxy/src/api/index.ts # packages/host/apiproxy/src/api/rpc-map.ts # packages/host/apiproxy/src/api/rpc.schema.ts # packages/host/apiproxy/src/api/rpc.ts # packages/host/apiproxy/src/api/sessions.schema.ts # packages/host/apiproxy/src/api/sessions.ts # packages/host/apiproxy/src/fetch/client.ts # packages/host/apiproxy/src/fetch/handler.ts # packages/host/apiproxy/tests/api-proxy-commands.spec.ts # packages/host/apiproxy/tests/client-handler.spec.ts # packages/host/apiproxy/tests/fetch-carrier.spec.ts # packages/host/apiproxy/tests/rpc-schemas.spec.ts
2026-07-30 13:48:33 +08:00
parent dd59b28083 c66cf04ebf
commit 0a9b6e75d6
207 changed files with 2901 additions and 900 deletions
--- a/packages/README.i18n.yaml
+++ b/packages/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/README.md
-README.md: e2b0b95bdcfae905e1e40c3dc4d82641f392a3db
-README.zh.md: 56b02a2d1ca3975f25884846e71ec47aa5664162
+README.md: e195decd8486d5f2deba65dab83972c290b3fa95
+README.zh.md: 6eb5749ce62154fa54da4767afc6f529fd962f19
--- a/packages/README.md
+++ b/packages/README.md
@@ -48,11 +48,12 @@ Packages use the `@deepseek-ai/dsh-*` scope. Each is a Cordis `Service` subclass
 | [`ui/`](ui/README.md) | TUI and JSON-RPC integrations, approval/interaction seams, ask-user tool | Product — stable surface |
 | [`host/`](host/README.md) | Web-GUI host half: API gateway + HTTP route server | Product — stable surface |
 | [`client/`](client/README.md) | Web-GUI browser half: shell, wire, object services, slots, `ui-*` plugins | Product — stable surface |
+| [`experimental/`](experimental/README.md) | Prototypes and internal plugins | Unreleased |
 | [`examples/`](examples/README.md) | Demo bundles (agent-spine + TUI/CLI/ACP/JSON-RPC bins) leaves load | Support — example infra |
 | [`support/`](support/README.md) | Support infrastructure (testkits, invariants, replay, Loader smokes) | Support — lower compatibility expectations |
 | [`util/`](util/README.md) | Low-level zero-dependency utilities shared across groups (`Branded<B>`, Harness home/path helpers, timeout, retention) | Support — small, stable, harness-dep-free |

-Groups distinguish product and support infrastructure. Packages join an existing group; a new group updates its README and this table.
+New packages join existing groups; new groups update their README and this table.

 ## Dependencies

--- a/packages/README.zh.md
+++ b/packages/README.zh.md
@@ -48,11 +48,12 @@
 | [`ui/`](ui/README.md) | TUI 与 JSON-RPC 集成、批准／交互 seam、用户问答工具 | 产品：稳定表面 |
 | [`host/`](host/README.md) | web GUI 宿主半侧：API 网关 + HTTP 路由服务器 | 产品：稳定表面 |
 | [`client/`](client/README.md) | web GUI 浏览器半侧：shell、协议层、对象服务、slot、`ui-*` 插件 | 产品：稳定表面 |
+| [`experimental/`](experimental/README.md) | 原型和内部插件 | 未发布 |
 | [`examples/`](examples/README.md) | 演示组合包（agent-spine + TUI/CLI/ACP/JSON-RPC bin），由叶节点加载 | 支持：示例基础设施 |
 | [`support/`](support/README.md) | 支持基础设施（testkit、不变式、回放、Loader 冒烟测试） | 支持：兼容性预期较低 |
 | [`util/`](util/README.md) | 组间共享的低层零依赖工具（`Branded<B>`、Harness home／路径辅助函数、超时、保留策略） | 支持：小型、稳定、无 harness 依赖 |

-组用于区分产品与支持基础设施。包加入现有组；新组则更新其 README 和此表。
+新包加入现有组；新组更新其 README 和此表。

 ## 依赖

--- a/packages/acp/acp/tests/turns.spec.ts
+++ b/packages/acp/acp/tests/turns.spec.ts
@@ -116,8 +116,8 @@ describe('ACP prompt lifecycle', () => {
    const sessionId = await newSession(harness)
    const agent = harness.ctx.agents.get(SessionId(sessionId))!
    let inserted = false
-    harness.ctx.on('agent/inbox/enqueue', (subject, message) => {
-      if (subject !== agent || message.source.kind !== 'user' || inserted) return
+    harness.ctx.on('agent/inbox/enqueue', (subject, item) => {
+      if (subject !== agent || item.message.source.kind !== 'user' || inserted) return
      inserted = true
      const source = { kind: 'plugin', plugin: 'test' } as const
      agent.session.append('turn/start', { turn: 1, trigger: { kind: 'message', source } })
--- a/packages/client/connection/src/client/api.ts
+++ b/packages/client/connection/src/client/api.ts
@@ -12,7 +12,7 @@ export type {
  ResponseValue, WorkspaceApi, WorkspaceId, WorkspaceView,
  CommandsApi, CommandDescriptor, SkillsApi, SkillEntry,
  ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning,
-  ModelReasoningEffort, ModelTarget, SessionModels,
+  InboxItemId, ModelReasoningEffort, ModelTarget, QueueAction, QueuedInboxItem, SessionModels,
  GoalsApi, GoalRef,
 } from '@deepseek-ai/dsh-host-apiproxy/api'
 export type { ToolCallView, ToolResultView } from '@deepseek-ai/dsh-tools/presentation'
--- a/packages/client/connection/src/client/fixture.ts
+++ b/packages/client/connection/src/client/fixture.ts
@@ -1243,6 +1243,11 @@ export function createFixtureApi(options: FixtureOptions = {}): ApiProxy {
        }
        return ok(request, stored)
      },
+      updateQueue: request => err(request, {
+        code: 'queue-item-not-found',
+        message: 'fixture has no pending queue item',
+        details: { itemId: request.payload.itemId },
+      }),
      cancel: (request) => {
        const replay = replays.get(request.payload.sessionId)
        if (replay !== undefined) {
@@ -1687,6 +1692,7 @@ export class FixtureApiClient extends AbstractApiClient {
      case 'session.rename': return this.api.sessions.rename(request)
      case 'session.prompt': return this.api.sessions.prompt(request)
      case 'session.attachment': return this.api.sessions.attachment(request)
+      case 'session.updateQueue': return this.api.sessions.updateQueue(request)
      case 'session.cancel': return this.api.sessions.cancel(request)
      case 'host.describe': return this.api.host.describe(request)
      case 'host.pickDirectory': return this.api.host.pickDirectory(request, new AbortController().signal)
--- a/packages/client/connection/src/client/index.ts
+++ b/packages/client/connection/src/client/index.ts
@@ -17,7 +17,7 @@ export type {
  ToolCallView, ToolResultView, WorkspaceApi, WorkspaceId, WorkspaceView,
  CommandsApi, CommandDescriptor, SkillsApi, SkillEntry,
  ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning,
-  ModelReasoningEffort, ModelTarget, SessionModels,
+  InboxItemId, ModelReasoningEffort, ModelTarget, QueueAction, QueuedInboxItem, SessionModels,
  RpcRequest, RpcResponse, RpcResult, RpcError, RpcErrorCode,
  ClientRequest, ServerResponse, ServerRequest, ClientResponse, RpcMessage, RpcReceipt,
  HostDescription, IApiClient, SessionId, SessionEvent, ContentBlock, StreamChunk,
--- a/packages/client/connection/tests/fake-api.ts
+++ b/packages/client/connection/tests/fake-api.ts
@@ -65,6 +65,7 @@ export class FakeApiClient implements IApiClient {
  onPrompt: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
  onAttachment: (payload: unknown) => Promise<RpcResponse<{ attachment: { attachmentId: never; mediaType: 'image/png'; bytes: number; width: number; height: number }; data: string }>> =
    () => Promise.resolve(ok({ attachment: { attachmentId: 'a' as never, mediaType: 'image/png', bytes: 1, width: 1, height: 1 }, data: 'AA==' }))
+  onUpdateQueue: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
  onCancel: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
  onDescribe: (payload: unknown) => Promise<RpcResponse<{ version: string; cwd: string; attachedSessions: number }>> =
    () => Promise.resolve(ok({ version: '0-fake', cwd: '/f', attachedSessions: 0 }))
@@ -102,6 +103,7 @@ export class FakeApiClient implements IApiClient {
    rename: (payload: unknown) => this.record('session.rename', payload, this.onRename(payload)),
    prompt: (payload: unknown) => this.record('session.prompt', payload, this.onPrompt(payload)),
    attachment: (payload: unknown) => this.record('session.attachment', payload, this.onAttachment(payload)),
+    updateQueue: (payload: unknown) => this.record('session.updateQueue', payload, this.onUpdateQueue(payload)),
    cancel: (payload: unknown) => this.record('session.cancel', payload, this.onCancel(payload)),
  }

--- a/packages/client/runtime/README.i18n.yaml
+++ b/packages/client/runtime/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/runtime/README.md
-README.md: dff2f58969082ffa1092b72d702485c89539e491
-README.zh.md: 26fd9a91eef6e717e829aff70ff4e9bb384cb42d
+README.md: 10329668d9a7a3e7230ab6f3ef9cdb127aec584c
+README.zh.md: d6555bb4e71aee7ae195e4f9e98c21eb349acf3c
--- a/packages/client/runtime/README.md
+++ b/packages/client/runtime/README.md
@@ -16,6 +16,10 @@ SlotsService gives the renderer separate bare observables for `useSessions` and

 `WorkspacesService.connectWorkspace(workspaceId)` resolves the session a New Session flow lands in: it reuses the workspace's existing blank session from the list mirror (`blank && cwd == workspace.path`) or calls `session.create({workspaceId})`, returning the session id for the caller to open. `SessionSummary.blank` mirrors the host's derived empty-log bit and only ever lowers on the client: seeded by `session.list` / the `host/session-added` frame, flipped false by the first ACCEPTED local `prompt()` (on the RPC success response — acceptance proves the user message is in the host log; a rejected first prompt keeps the session blank and reusable) and by any `running: true` status frame, re-aligned by every list re-pull. List surfaces hide blank rows; the store carries every row. `SessionsService.create` accepts an optional caller-preallocated SessionId and throws `SessionCreateError` (carrying `requestedSessionId`) on failure.

+## Pending queue projection
+
+`ConversationSnapshot.queue` is the Host's authoritative transient Queue snapshot; pending steering stays outside this projection. Each row carries its `InboxItemId`, complete editable text when every content block is text, and a flattened preview. `session/queue` replaces the whole projection; reconnect buffering retains only the latest snapshot, and neither durable turn events nor running-status changes guess that an item was claimed. `Session.updateQueue()` sends edit/remove operations without optimistic mutation, so the next Host snapshot is the sole visible commit and a claim race can surface `queue-item-not-found`.
+
 ## Code Mode sub-dispatch index

 `ConversationSnapshot.codeDispatches` groups a `run_code` call's sub-dispatches under their parent callId, in start order, using the native call-block shapes: a `tool/code-dispatch-start` event lands the `RunningToolCall` form (rows derive the running ring from the shape) and its `tool/code-dispatch` settlement replaces it in place with the `ToolResultNode` form, `callTime` carrying the paired start's time. A settle whose start fell outside the replay window appends directly with `callTime: null` (duration unknown — never a fabricated zero). Live mux frames and history replay build the identical index; sub-calls never join the surface `nodes` flow; per-parent array and map references are memo-stable across unrelated snapshot swaps.
--- a/packages/client/runtime/README.zh.md
+++ b/packages/client/runtime/README.zh.md
@@ -16,6 +16,10 @@ SlotsService 分别为 renderer 提供 `useSessions` 与 `useWorkspaces` 的裸

 `WorkspacesService.connectWorkspace(workspaceId)` 解析 New Session 流程最终落入的会话：先在列表镜像中复用该 workspace 的既有空会话（`blank && cwd == workspace.path`），未命中则调用 `session.create({workspaceId})`，返回会话 id 由调用方 open。`SessionSummary.blank` 镜像主机派生的空日志位，在客户端只降不升：由 `session.list`／`host/session-added` 帧播种，本地首次获 Host 接受的 `prompt()`（RPC 成功响应时——受理即证明用户消息已入主机日志；首讯被拒则会话保持 blank、保持可复用）与任何 `running: true` 状态帧翻为 false，每次列表重拉重新对齐。列表界面隐藏 blank 行；store 保留全部行。`SessionsService.create` 接受可选的、由调用方预先分配的 SessionId，失败时抛出 `SessionCreateError`（携带 `requestedSessionId`）。

+## 待处理队列投影
+
+`ConversationSnapshot.queue` 是 Host 提供的权威瞬态 Queue 快照；待处理 steering（中途引导）不进入此投影。每行都携带其 `InboxItemId`、所有内容块均为文本时的完整可编辑文本，以及扁平化预览。`session/queue` 会整体替换该投影；重连缓冲只保留最新快照，持久轮次事件和 running 状态变化都不会猜测某个项已被认领。`Session.updateQueue()` 发送编辑／移除操作，不进行乐观更新，因此下一份 Host 快照是唯一可见的提交结果，认领竞态则会返回 `queue-item-not-found`。
+
 ## Code Mode 子调用索引

 `ConversationSnapshot.codeDispatches` 按父调用的 callId 和启动顺序，用原生调用块形状组织一个 `run_code` 调用的子调用：`tool/code-dispatch-start` 事件落成 `RunningToolCall` 形状（行组件从该形状推导运行中的转圈状态），其 `tool/code-dispatch` 完结事件原位替换为 `ToolResultNode` 形状，`callTime` 携带成对 start 事件的时间。start 落在回放窗口之外的完结事件则直接追加，`callTime: null`（耗时未知——绝不伪造零耗时）。live mux 帧与历史回放构建相同的索引；子调用永不进入 surface `nodes` 流；无关快照交换不会改变每个父调用对应的数组引用和映射引用，两者均保持 memo 稳定。
--- a/packages/client/runtime/src/client/contract/session.ts
+++ b/packages/client/runtime/src/client/contract/session.ts
@@ -7,7 +7,9 @@
 * must stub); runtime-internal entry points (history staging, wire-frame
 * dispatch) stay on the class, invisible out here.
 */
-import type { PromptContentPart, RpcResult, SessionId } from '@deepseek-ai/dsh-client-connection/client'
+import type {
+  InboxItemId, PromptContentPart, QueueAction, RpcResult, SessionId,
+} from '@deepseek-ai/dsh-client-connection/client'
 import type { AttachmentIdType, ImageAttachmentRef } from '@deepseek-ai/dsh-attachment'
 import type { ConversationSnapshot } from '../sessions/conversation.ts'
 import type { ObservableSnapshot } from './store.ts'
@@ -44,6 +46,13 @@ export interface ISession {
  readAttachment(
    attachmentId: AttachmentIdType,
  ): Promise<RpcResult<{ attachment: ImageAttachmentRef; data: Uint8Array }>>
+  /**
+   * Apply one mutation to a still-pending queue occurrence.
+   * @param itemId - agent-owned inbox occurrence identity.
+   * @param action - edit or remove operation.
+   * @returns acceptance, or a business/transport error.
+   */
+  updateQueue(itemId: InboxItemId, action: QueueAction): Promise<RpcResult<{ accepted: true }>>
  /**
   * Cancel the running turn.
   * @returns acceptance, or the business error.
--- a/packages/client/runtime/src/client/sessions/conversation.ts
+++ b/packages/client/runtime/src/client/sessions/conversation.ts
@@ -8,7 +8,7 @@ import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
 import type { ImageAttachmentRef } from '@deepseek-ai/dsh-attachment'
 import type { TodoItem } from '@deepseek-ai/dsh-session/types'
 import type {
-  RpcError, SessionId, ToolCallView, ToolResultView,
+  InboxItemId, RpcError, SessionId, ToolCallView, ToolResultView,
 } from '@deepseek-ai/dsh-client-connection/client'
 import type { PendingInteraction } from './pending.ts'
 export type { TodoItem }
@@ -219,10 +219,12 @@ export interface RunningToolCall {
 }


-/** One queued-message row mirrored from `session/queued` frames (key: the enqueueing prompt's rpcId when wire-sourced). */
+/** One independently addressable row from the transient queue snapshot. */
 export interface QueuedMessage {
-  readonly key: string
+  readonly id: InboxItemId
  readonly preview: string
+  /** Complete editable text; null when the message contains non-text blocks. */
+  readonly text: string | null
 }

 /** In-progress assistant output (chunk accumulator product). */
@@ -280,7 +282,7 @@ export interface ConversationSnapshot {
   */
  codeDispatches: ReadonlyMap<string, readonly CodeSubCall[]>
  pending: readonly PendingInteraction[]
-  /** Read-only inbox mirror (session/queued frames + mux-open baseline; cleared by the leave-running flip). */
+  /** Authoritative transient inbox snapshot, replaced after every host-side change. */
  queue: readonly QueuedMessage[]
  running: boolean
  /** Input-area shape (see {@link ComposerPhase}); derived here, switched on by consumers. */
--- a/packages/client/runtime/src/client/sessions/manager.ts
+++ b/packages/client/runtime/src/client/sessions/manager.ts
@@ -351,14 +351,14 @@ export class SessionManager {
      // them so last-wins cannot pin a phantom value over recomputed truth.
      this.projectionStores.get(frame.sessionId)?.truncate(frame.lastSeq)
      this.notifier.markDirty()
-      // New mux-generation baseline: buffered session/queued frames belong to
+      // New mux-generation baseline: buffered session/queue frames belong to
      // the previous generation and the host is about to resend the live
      // snapshot — drop them, or every reconnect appends a duplicate batch
      // (and enough reconnects push real approval/question frames past the
      // cap). Same re-baseline signal Session uses for its own mirror.
      const buffered = this.pendingBuffers.get(frame.sessionId)
      if (buffered !== undefined) {
-        const kept = buffered.filter(item => item.payload.type !== 'session/queued')
+        const kept = buffered.filter(item => item.payload.type !== 'session/queue')
        if (kept.length !== buffered.length) {
          if (kept.length === 0) this.pendingBuffers.delete(frame.sessionId)
          else this.pendingBuffers.set(frame.sessionId, kept)
@@ -383,7 +383,7 @@ export class SessionManager {
    }
    const session = this.sessions.get(frame.sessionId)
    if (session === undefined) {
-      // Approval/question/queued frames never hit history: buffer for replay on
+      // Approval/question/queue frames never hit history: buffer for replay on
      // instantiation; everything else drops (not instantiated — history fully
      // backfills on open).
      switch (frame.type) {
@@ -391,8 +391,12 @@ export class SessionManager {
        case 'approval/resolved':
        case 'question/requested':
        case 'question/resolved':
-        case 'session/queued': {
+        case 'session/queue': {
          const buffer = this.pendingBuffers.get(frame.sessionId) ?? []
+          const prior = frame.type === 'session/queue'
+            ? buffer.findIndex(item => item.payload.type === 'session/queue')
+            : -1
+          if (prior !== -1) buffer.splice(prior, 1)
          buffer.push(envelope)
          if (buffer.length > PENDING_BUFFER_CAP) buffer.splice(0, buffer.length - PENDING_BUFFER_CAP)
          this.pendingBuffers.set(frame.sessionId, buffer)
--- a/packages/client/runtime/src/client/sessions/session.ts
+++ b/packages/client/runtime/src/client/sessions/session.ts
@@ -5,8 +5,8 @@ import type { AttachmentIdType, ImageAttachmentRef } from '@deepseek-ai/dsh-atta
 import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
 import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
 import type {
-  HistoryEntry, IApiClient, MuxFrame, PromptContentPart, RpcError, RpcId,
-  RpcResult, SessionId, ToolEventView,
+  HistoryEntry, IApiClient, InboxItemId, MuxFrame, PromptContentPart,
+  QueueAction, RpcError, RpcId, RpcResult, SessionId, ToolEventView,
 } from '@deepseek-ai/dsh-client-connection/client'
 // Value import from the inline-safe wire layer (not the connection plugin):
 // plugin-to-plugin value imports are a bundle purity error.
@@ -49,14 +49,6 @@ export interface SessionOptions {
 /** Queue-row preview cap: the dock renders one line, the full content never leaves the host mirror. */
 const QUEUE_PREVIEW_CHARS = 200

-/** Internal inbox-mirror entry: the snapshot row plus the retirement-matching fields the frames carry. */
-interface QueuedEntry {
-  row: QueuedMessage
-  steering: boolean
-  /** JSON-serialized MessageSource (steering retirement matches by source, the host-mirror precedent). */
-  sourceJson: string
-}
-
 /** Single-line queue-row preview: text blocks flattened, non-text as tags, capped by code point. */
 function queuePreviewOf(content: readonly ContentBlock[]): string {
  const flat = content
@@ -66,6 +58,12 @@ function queuePreviewOf(content: readonly ContentBlock[]): string {
  return chars.length > QUEUE_PREVIEW_CHARS ? `${chars.slice(0, QUEUE_PREVIEW_CHARS).join('')}…` : flat
 }

+/** Recover complete composer text only when editing cannot discard non-text blocks. */
+function queueTextOf(content: readonly ContentBlock[]): string | null {
+  if (!content.every(block => block.type === 'text')) return null
+  return content.map(block => block.text).join('')
+}
+
 /**
 * Owns a session's event window, derived conversation state, and observable
 * snapshot. React bindings remain outside this data layer. Features see only
@@ -103,9 +101,8 @@ export class Session implements SessionFace {
  private callsCache: { rev: number; value: RunningToolCall[] } | null = null
  private pendingRev = 0
  private pendingCache: { rev: number; value: PendingInteraction[] } | null = null
-  /** Inbox mirror (session/queued frames + mux-open baseline). Queue frames never hit history,
-   *  so this is stream-only state: reconnect clears it and the fresh baseline re-populates. */
-  private queued: QueuedEntry[] = []
+  /** Authoritative stream-only inbox snapshot; pending work never hits history. */
+  private queued: QueuedMessage[] = []
  private queueRev = 0
  private queueCache: { rev: number; value: QueuedMessage[] } | null = null
  private frozenRev = 0
@@ -235,6 +232,15 @@ export class Session implements SessionFace {
    return result
  }

+  /** Apply one operation to a still-pending queue occurrence. */
+  async updateQueue(itemId: InboxItemId, action: QueueAction): Promise<RpcResult<{ accepted: true }>> {
+    try {
+      return (await this.api.sessions.updateQueue({ sessionId: this.sessionId, itemId, action })).result
+    } catch (error) {
+      return transportError(error)
+    }
+  }
+
  /**
   * Resolve one image referenced by this session into browser-consumable bytes.
   * @param attachmentId - opaque id found in the folded session log.
@@ -416,20 +422,15 @@ export class Session implements SessionFace {
  handleMuxEnvelope(rpcId: RpcId, frame: MuxFrame): void {
    switch (frame.type) {
      case 'session/event': {
-        this.retireQueued(frame.event)
        this.acceptLiveEvent(frame.event, frame.view)
        return
      }
-      case 'session/queued': {
-        const message = frame.message
-        // Row key: the enqueueing prompt's rpcId when it rode this wire (the
-        // provisional-echo reconciliation key); otherwise the frame envelope id.
-        const key = 'rpcId' in message.source ? String(message.source.rpcId) : `f:${rpcId}`
-        this.queued.push({
-          row: { key, preview: queuePreviewOf(message.content) },
-          steering: frame.steering,
-          sourceJson: JSON.stringify(message.source),
-        })
+      case 'session/queue': {
+        this.queued = frame.items.map(item => ({
+          id: item.id,
+          preview: queuePreviewOf(item.message.content),
+          text: queueTextOf(item.message.content),
+        }))
        this.queueRev++
        this.notifier.markDirty()
        return
@@ -482,15 +483,6 @@ export class Session implements SessionFace {
   * @param running - the new running state.
   */
  handleRunning(running: boolean): void {
-    // Leave-running sweep (host queuedMirror precedent): discard paths (cancel,
-    // terminal steering drop) have no per-entry frame, so ANY not-running signal
-    // with a nonempty mirror clears it — checked before the equality return so a
-    // stale replay on an already-idle session still sweeps.
-    if (!running && this.queued.length > 0) {
-      this.queued = []
-      this.queueRev++
-      this.notifier.markDirty()
-    }
    // Turn-start conversion: a blank session never runs, so the first
    // running:true proves another端's first message landed (设计稿 2.2).
    if (running && this.blankBit) {
@@ -655,27 +647,6 @@ export class Session implements SessionFace {
    }
  }

-  /** Consumption-event retirement, mirroring the host queuedMirror rules: a message-triggered
-   *  turn/start claims the oldest non-steering entry; a steering/message drains the oldest
-   *  steering entry with the same source (loop-authored steering matches nothing and drops none). */
-  private retireQueued(event: SessionEvent): void {
-    if (this.queued.length === 0) return
-    let index = -1
-    if (event.type === 'turn/start') {
-      if (event.data.trigger.kind !== 'message') return
-      index = this.queued.findIndex(entry => !entry.steering)
-    } else if (event.type === 'steering/message') {
-      const source = JSON.stringify(event.data.message.source)
-      index = this.queued.findIndex(entry => entry.steering && entry.sourceJson === source)
-    } else {
-      return
-    }
-    if (index < 0) return
-    this.queued.splice(index, 1)
-    this.queueRev++
-    this.notifier.markDirty()
-  }
-
  /** Per-event side effects (right column of the §A.9 dispatch table):
   *  chunk accumulation / partial clear on finalize / openCalls add-remove. */
  private applyEventSideEffects(event: SessionEvent, view?: ToolEventView): void {
@@ -855,7 +826,7 @@ export class Session implements SessionFace {
      this.dispatchesCache = { rev: this.dispatchesRev, value: new Map(this.codeDispatches) }
    }
    if (this.queueCache === null || this.queueCache.rev !== this.queueRev) {
-      this.queueCache = { rev: this.queueRev, value: this.queued.map(entry => entry.row) }
+      this.queueCache = { rev: this.queueRev, value: this.queued }
    }
    const partial = this.partial?.toPartial() ?? null
    return {
--- a/packages/client/runtime/tests/fake-api.ts
+++ b/packages/client/runtime/tests/fake-api.ts
@@ -83,6 +83,7 @@ export class FakeApiClient implements IApiClient {
  onPrompt: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
  onAttachment: (payload: unknown) => Promise<RpcResponse<{ attachment: { attachmentId: never; mediaType: 'image/png'; bytes: number; width: number; height: number }; data: string }>> =
    () => Promise.resolve(ok({ attachment: { attachmentId: 'a' as never, mediaType: 'image/png', bytes: 1, width: 1, height: 1 }, data: 'AA==' }))
+  onUpdateQueue: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
  onCancel: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))

  onDescribe: (payload: unknown) => Promise<RpcResponse<{ version: string; cwd: string; attachedSessions: number }>> =
@@ -121,6 +122,7 @@ export class FakeApiClient implements IApiClient {
    rename: (payload: unknown) => this.record('session.rename', payload, this.onRename(payload)),
    prompt: (payload: unknown) => this.record('session.prompt', payload, this.onPrompt(payload)),
    attachment: (payload: unknown) => this.record('session.attachment', payload, this.onAttachment(payload)),
+    updateQueue: (payload: unknown) => this.record('session.updateQueue', payload, this.onUpdateQueue(payload)),
    cancel: (payload: unknown) => this.record('session.cancel', payload, this.onCancel(payload)),
  }

--- a/packages/client/runtime/tests/queue-store.spec.ts
+++ b/packages/client/runtime/tests/queue-store.spec.ts
@@ -1,32 +1,41 @@
 /**
- * Queue mirror semantics (web input-triggers queue cut 1): session/queued
- * intake, host-rule retirement (message turn/start claims oldest non-steering;
- * steering/message drains by source), leave-running sweep, reconnect reset,
- * pre-instantiation buffering, and snapshot reference stability.
+ * Queue snapshot semantics: authoritative replacement after every host-side
+ * change, reconnect re-baselining, pre-instantiation buffering, editable-text
+ * projection, and snapshot reference stability.
 */
 import { describe, expect, it } from 'vitest'
 import { createUserMessage } from '@deepseek-ai/dsh-llm'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
-import type { MuxFrame, RpcId, SessionId } from '@deepseek-ai/dsh-client-connection/client'
+import type {
+  InboxItemId, MuxFrame, RpcId, SessionId,
+} from '@deepseek-ai/dsh-client-connection/client'
 import { Session } from '../src/client/sessions/session.ts'
 import { SessionManager } from '../src/client/sessions/manager.ts'
 import { FakeApiClient } from './fake-api.ts'
-import { ev } from './event-script.ts'

 const SID = 'fk-q1' as SessionId
-const text = (t: string): ContentBlock[] => [{ type: 'text', text: t }]
+const text = (value: string): ContentBlock[] => [{ type: 'text', text: value }]
 const rid = (id: string): RpcId => id as RpcId
+const iid = (id: string): InboxItemId => id as InboxItemId

-/** session/queued frame with the wire-sourced rpcId key (the host prompt path). */
-function queuedFrame(body: string, rpcId: string, steering = false): MuxFrame {
+interface QueueFixture {
+  id: string
+  body: string
+  content?: ContentBlock[]
+}
+
+/** Build one authoritative queue snapshot. */
+function queueFrame(items: QueueFixture[]): MuxFrame {
  return {
-    type: 'session/queued',
+    type: 'session/queue',
    sessionId: SID,
-    message: createUserMessage({
-      content: text(body),
-      source: { kind: 'user', rpcId: rid(rpcId) } as never,
-    }),
-    steering,
+    items: items.map(item => ({
+      id: iid(item.id),
+      message: createUserMessage({
+        content: item.content ?? text(item.body),
+        source: { kind: 'user', rpcId: rid(`rpc-${item.id}`) } as never,
+      }),
+    })),
  }
 }

@@ -34,201 +43,131 @@ function makeSession(): Session {
  return new Session(SID, new FakeApiClient())
 }

-describe('queue intake', () => {
-  it('lands a queued frame as a row keyed by the source rpcId with a flat preview', () => {
+describe('queue snapshot intake', () => {
+  it('projects stable ids, flat previews, and complete text', () => {
    const session = makeSession()
-    session.handleMuxEnvelope(rid('env-1'), queuedFrame('第一条  排队\n消息', 'p-1'))
-    const queue = session.getSnapshot().queue
-    expect(queue).toEqual([{ key: 'p-1', preview: '第一条 排队 消息' }])
+    session.handleMuxEnvelope(rid('env-1'), queueFrame([
+      { id: 'q-1', body: '第一条  排队\n消息' },
+    ]))
+    expect(session.getSnapshot().queue).toEqual([
+      { id: 'q-1', preview: '第一条 排队 消息', text: '第一条  排队\n消息' },
+    ])
  })

-  it('falls back to the envelope rpcId when the source carries none, and tags non-text blocks', () => {
+  it('marks mixed-content messages non-editable while retaining their preview', () => {
    const session = makeSession()
-    session.handleMuxEnvelope(rid('env-2'), {
-      type: 'session/queued',
-      sessionId: SID,
-      message: createUserMessage({
-        content: [{ type: 'text', text: 'hi' }, { type: 'image', data: 'x' } as never],
-        source: { kind: 'plugin', plugin: 'loop' },
-      }),
-      steering: false,
-    })
-    expect(session.getSnapshot().queue).toEqual([{ key: 'f:env-2', preview: 'hi [image]' }])
+    session.handleMuxEnvelope(rid('env-2'), queueFrame([{
+      id: 'q-image',
+      body: '',
+      content: [{ type: 'text', text: 'hi' }, { type: 'image', data: 'x' } as never],
+    }]))
+    expect(session.getSnapshot().queue).toEqual([
+      { id: 'q-image', preview: 'hi [image]', text: null },
+    ])
  })

-  it('caps the preview at 200 code points with an ellipsis', () => {
+  it('caps previews at 200 code points and preserves the full editable text', () => {
    const session = makeSession()
-    session.handleMuxEnvelope(rid('env-3'), queuedFrame('长'.repeat(201), 'p-cap'))
-    const preview = session.getSnapshot().queue[0]?.preview ?? ''
-    expect(Array.from(preview)).toHaveLength(201) // 200 + …
-    expect(preview.endsWith('…')).toBe(true)
+    const body = '长'.repeat(201)
+    session.handleMuxEnvelope(rid('env-3'), queueFrame([{ id: 'q-cap', body }]))
+    const row = session.getSnapshot().queue[0]
+    expect(Array.from(row?.preview ?? '')).toHaveLength(201)
+    expect(row?.preview.endsWith('…')).toBe(true)
+    expect(row?.text).toBe(body)
+  })
+
+  it('replaces content, order, and membership from each authoritative frame', () => {
+    const session = makeSession()
+    session.handleMuxEnvelope(rid('env-4'), queueFrame([
+      { id: 'q-1', body: 'one' },
+      { id: 'q-2', body: 'two' },
+    ]))
+    session.handleMuxEnvelope(rid('env-5'), queueFrame([
+      { id: 'q-2', body: 'two edited' },
+    ]))
+    expect(session.getSnapshot().queue).toEqual([
+      { id: 'q-2', preview: 'two edited', text: 'two edited' },
+    ])
+    session.handleMuxEnvelope(rid('env-6'), queueFrame([]))
+    expect(session.getSnapshot().queue).toEqual([])
  })

  it('keeps the queue array reference stable across unrelated snapshot swaps', () => {
    const session = makeSession()
-    session.handleMuxEnvelope(rid('env-4'), queuedFrame('稳定', 'p-s'))
+    session.handleMuxEnvelope(rid('env-7'), queueFrame([{ id: 'q-stable', body: '稳定' }]))
    const before = session.getSnapshot().queue
-    session.handleAgentError('unrelated') // dirties the snapshot without touching the queue
+    session.handleAgentError('unrelated')
    expect(session.getSnapshot().queue).toBe(before)
  })
 })

-describe('queue retirement (host queuedMirror rules)', () => {
-  it('a message-triggered turn/start claims the oldest non-steering row', () => {
-    const session = makeSession()
-    session.handleMuxEnvelope(rid('e1'), queuedFrame('先', 'p-1'))
-    session.handleMuxEnvelope(rid('e2'), queuedFrame('后', 'p-2'))
-    session.handleMuxEnvelope(rid('e3'), { type: 'session/event', sessionId: SID, event: ev.turnStart(0, 0) })
-    expect(session.getSnapshot().queue.map(r => r.key)).toEqual(['p-2'])
-  })
+describe('queue operation transport', () => {
+  it('addresses the session.updateQueue RPC without optimistic local mutation', async () => {
+    const api = new FakeApiClient()
+    const session = new Session(SID, api)
+    session.handleMuxEnvelope(rid('env-op'), queueFrame([{ id: 'q-op', body: 'pending' }]))
+    const before = session.getSnapshot().queue

-  it('an injection-triggered turn/start claims nothing', () => {
-    const session = makeSession()
-    session.handleMuxEnvelope(rid('e1'), queuedFrame('留', 'p-1'))
-    const injection = {
-      ...ev.turnStart(0, 0),
-      data: { turn: 0, trigger: { kind: 'injection', source: { kind: 'plugin', plugin: 'x' } } },
-    } as never
-    session.handleMuxEnvelope(rid('e2'), { type: 'session/event', sessionId: SID, event: injection })
-    expect(session.getSnapshot().queue).toHaveLength(1)
-  })
-
-  it('steering/message drains the source-matched steering row only', () => {
-    const session = makeSession()
-    session.handleMuxEnvelope(rid('e1'), queuedFrame('普通', 'p-1')) // idle → non-steering
-    session.handleMuxEnvelope(rid('e3'), queuedFrame('插话', 'p-2', true))
-    // Loop-authored steering (different source) must not consume the user entry.
-    const foreignSteering = {
-      seq: 0, time: 1,
-      type: 'steering/message', surfaceOp: 'append',
-      data: {
-        turn: 0,
-        message: createUserMessage({
-          content: text('loop'),
-          source: { kind: 'plugin', plugin: 'loop' },
-        }),
-      },
-    } as never
-    session.handleMuxEnvelope(rid('e4'), { type: 'session/event', sessionId: SID, event: foreignSteering })
-    expect(session.getSnapshot().queue).toHaveLength(2)
-    const matchedSteering = {
-      seq: 1, time: 2,
-      type: 'steering/message', surfaceOp: 'append',
-      data: {
-        turn: 0,
-        message: createUserMessage({
-          content: text('插话'),
-          source: { kind: 'user', rpcId: rid('p-2') },
-        }),
-      },
-    } as never
-    session.handleMuxEnvelope(rid('e5'), { type: 'session/event', sessionId: SID, event: matchedSteering })
-    expect(session.getSnapshot().queue.map(r => r.key)).toEqual(['p-1'])
-  })
-
-  it('a leave-running flip sweeps the whole mirror (cancel/terminal-drop cover)', () => {
-    const session = makeSession()
-    session.handleRunning(true)
-    session.handleMuxEnvelope(rid('e1'), queuedFrame('一', 'p-1'))
-    session.handleMuxEnvelope(rid('e2'), queuedFrame('二', 'p-2'))
-    session.handleRunning(false)
-    expect(session.getSnapshot().queue).toEqual([])
-  })
-
-  it('a stale not-running relay on an idle session still sweeps replayed rows', () => {
-    const session = makeSession()
-    session.handleMuxEnvelope(rid('e1'), queuedFrame('孤儿', 'p-1'))
-    session.handleRunning(false) // running already false: equality path must not skip the sweep
-    expect(session.getSnapshot().queue).toEqual([])
+    await expect(session.updateQueue(iid('q-op'), { kind: 'edit', content: text('next') }))
+      .resolves.toEqual({ ok: true, value: { accepted: true } })
+    expect(api.callsOf('session.updateQueue')).toEqual([{
+      sessionId: SID,
+      itemId: 'q-op',
+      action: { kind: 'edit', content: text('next') },
+    }])
+    expect(session.getSnapshot().queue).toBe(before)
  })
 })

 describe('queue reconnect semantics', () => {
-  it('session/subscribed re-baselines the mirror: stale rows drop, the following snapshot lands fresh', () => {
+  it('session/subscribed clears stale state before the fresh snapshot lands', () => {
    const session = makeSession()
-    session.handleMuxEnvelope(rid('e1'), queuedFrame('旧连接', 'p-old'))
-    // New mux generation: subscribed arrives first on the same stream...
+    session.handleMuxEnvelope(rid('e1'), queueFrame([{ id: 'q-old', body: '旧连接' }]))
    session.handleMuxEnvelope(rid('e2'), { type: 'session/subscribed', sessionId: SID, lastSeq: 10 })
    expect(session.getSnapshot().queue).toEqual([])
-    // ...then the queue snapshot replays the live inbox.
-    session.handleMuxEnvelope(rid('e3'), queuedFrame('新基线', 'p-new'))
-    expect(session.getSnapshot().queue.map(r => r.key)).toEqual(['p-new'])
+    session.handleMuxEnvelope(rid('e3'), queueFrame([{ id: 'q-new', body: '新基线' }]))
+    expect(session.getSnapshot().queue.map(row => row.id)).toEqual(['q-new'])
  })

-  it('resync must NOT clear the mirror (regression: onConnected races the mux baseline)', async () => {
+  it('resync does not clear a baseline that raced ahead of the host connection signal', async () => {
    const session = makeSession()
-    // Reconnect ordering that broke: mux opened first and already delivered
-    // the fresh generation's baseline; host stream (and with it onConnected →
-    // resync) lands after. The host never resends — clearing here left the
-    // dock empty until the next enqueue.
    session.handleMuxEnvelope(rid('e1'), { type: 'session/subscribed', sessionId: SID, lastSeq: 5 })
-    session.handleMuxEnvelope(rid('e2'), queuedFrame('新基线', 'p-fresh'))
+    session.handleMuxEnvelope(rid('e2'), queueFrame([{ id: 'q-fresh', body: '新基线' }]))
    await session.resync()
-    expect(session.getSnapshot().queue.map(r => r.key)).toEqual(['p-fresh'])
+    expect(session.getSnapshot().queue.map(row => row.id)).toEqual(['q-fresh'])
  })

-  it('replayed steering retires without a replayed turn/start', () => {
+  it('running-status changes never guess at queue retirement', () => {
    const session = makeSession()
-    session.handleMuxEnvelope(rid('e1'), { type: 'session/subscribed', sessionId: SID, lastSeq: 5 })
-    session.handleMuxEnvelope(rid('e2'), queuedFrame('重连插话', 'p-steer', true))
-    const committed = {
-      seq: 6, time: 2,
-      type: 'steering/message', surfaceOp: 'append',
-      data: {
-        turn: 1,
-        message: createUserMessage({
-          content: text('重连插话'),
-          source: { kind: 'user', rpcId: rid('p-steer') },
-        }),
-      },
-    } as never
-    session.handleMuxEnvelope(rid('e3'), { type: 'session/event', sessionId: SID, event: committed })
-    expect(session.getSnapshot().queue).toEqual([])
+    session.handleMuxEnvelope(rid('e1'), queueFrame([{ id: 'q-live', body: '保留' }]))
+    session.handleRunning(true)
+    session.handleRunning(false)
+    expect(session.getSnapshot().queue.map(row => row.id)).toEqual(['q-live'])
  })
 })

-describe('manager buffering of queued frames', () => {
-  it('buffers session/queued for uninstantiated sessions and replays before the running sync', () => {
-    const api = new FakeApiClient()
-    const manager = new SessionManager(api)
-    manager.handleMuxEnvelope({ rpcId: rid('b1'), payload: queuedFrame('预热', 'p-b1') })
-    // Instantiation replays the buffer; no summary exists, so no running sweep runs.
-    const session = manager.get(SID)
-    expect(session.getSnapshot().queue.map(r => r.key)).toEqual(['p-b1'])
-    // The buffer is consumed: a second get must not double-replay.
-    expect(manager.get(SID).getSnapshot().queue).toHaveLength(1)
+describe('manager buffering of queue snapshots', () => {
+  it('replays only the latest snapshot for an uninstantiated session', () => {
+    const manager = new SessionManager(new FakeApiClient())
+    manager.handleMuxEnvelope({ rpcId: rid('b1'), payload: queueFrame([{ id: 'q-old', body: '旧' }]) })
+    manager.handleMuxEnvelope({ rpcId: rid('b2'), payload: queueFrame([{ id: 'q-new', body: '新' }]) })
+    expect(manager.get(SID).getSnapshot().queue.map(row => row.id)).toEqual(['q-new'])
  })

-  it('a not-running list summary sweeps replayed rows at instantiation', async () => {
-    const api = new FakeApiClient()
-    api.onList = () => Promise.resolve(ok([{ sessionId: SID, updatedAt: 1, running: false }]))
-    const manager = new SessionManager(api)
-    await manager.refreshList()
-    manager.handleMuxEnvelope({ rpcId: rid('b2'), payload: queuedFrame('该扫掉', 'p-b2') })
-    expect(manager.get(SID).getSnapshot().queue).toEqual([])
-  })
-
-  it('subscribed re-baselines the uninstantiated buffer: stale queued frames drop, non-queue frames survive (regression: reconnect duplication)', () => {
-    const api = new FakeApiClient()
-    const manager = new SessionManager(api)
-    // Generation 1 baseline lands while the session is uninstantiated, along
-    // with a pending approval (never re-derivable from history).
-    manager.handleMuxEnvelope({ rpcId: rid('g1a'), payload: queuedFrame('第一代', 'p-g1') })
+  it('subscribed drops the prior-generation snapshot while preserving answerable frames', () => {
+    const manager = new SessionManager(new FakeApiClient())
+    manager.handleMuxEnvelope({ rpcId: rid('g1a'), payload: queueFrame([{ id: 'q-g1', body: '第一代' }]) })
    manager.handleMuxEnvelope({
      rpcId: rid('g1b'),
      payload: { type: 'approval/requested', sessionId: SID, approvalId: 'ap-1' as never, toolName: 'bash' },
    })
-    // Reconnect: generation 2 replays subscribed + the SAME live queue entry.
-    manager.handleMuxEnvelope({ rpcId: rid('g2a'), payload: { type: 'session/subscribed', sessionId: SID, lastSeq: 3 } })
-    manager.handleMuxEnvelope({ rpcId: rid('g2b'), payload: queuedFrame('第一代', 'p-g1') })
+    manager.handleMuxEnvelope({
+      rpcId: rid('g2a'),
+      payload: { type: 'session/subscribed', sessionId: SID, lastSeq: 3 },
+    })
+    manager.handleMuxEnvelope({ rpcId: rid('g2b'), payload: queueFrame([{ id: 'q-g2', body: '第二代' }]) })
    const snapshot = manager.get(SID).getSnapshot()
-    // One queue row (no duplicate batch); the approval survived the re-baseline.
-    expect(snapshot.queue.map(r => r.key)).toEqual(['p-g1'])
-    expect(snapshot.pending.map(p => p.kind)).toEqual(['approval'])
+    expect(snapshot.queue.map(row => row.id)).toEqual(['q-g2'])
+    expect(snapshot.pending.map(pending => pending.kind)).toEqual(['approval'])
  })
 })
-
-/** ok wrapper with a typed items payload (the shared helper pins value to never[]). */
-function ok(items: { sessionId: SessionId; updatedAt: number; running: boolean }[]) {
-  return { rpcId: rid(`ok-${items.length}`), result: { ok: true as const, value: { items: items as never[] } } }
-}
--- a/packages/client/test-runtime/src/sessions.ts
+++ b/packages/client/test-runtime/src/sessions.ts
@@ -94,6 +94,14 @@ export class FixtureSession implements SessionFace {
    throw new Error(`test session "${this.sessionId}": readAttachment is not stubbed — supply it on the fixture's session face`)
  }

+  /**
+   * Fail-loud stub; supply `updateQueue` on the fixture's session face to exercise it.
+   * @returns never — always throws.
+   */
+  updateQueue(): never {
+    throw new Error(`test session "${this.sessionId}": updateQueue is not stubbed — supply it on the fixture's session face`)
+  }
+
  /**
   * Fail-loud stub; supply `cancel` on the fixture's session face to exercise it.
   * @returns never — always throws.
--- a/packages/client/test-runtime/tests/runtime.spec.tsx
+++ b/packages/client/test-runtime/tests/runtime.spec.tsx
@@ -468,6 +468,7 @@ describe('fixture session face', () => {
    const bare = runtime.sessions.behavior('s1')
    expect(() => bare.prompt()).toThrow(/prompt is not stubbed/)
    expect(() => bare.readAttachment('att-1' as Parameters<typeof bare.readAttachment>[0])).toThrow(/readAttachment is not stubbed/)
+    expect(() => bare.updateQueue()).toThrow(/updateQueue is not stubbed/)
    expect(() => bare.cancel()).toThrow(/cancel is not stubbed/)
    expect(() => bare.command()).toThrow(/command is not stubbed/)
    expect(() => bare.loadOlder()).toThrow(/loadOlder is not stubbed/)
--- a/packages/client/tsdown.client.ts
+++ b/packages/client/tsdown.client.ts
@@ -128,6 +128,7 @@ export function clientBundle(id: string, libEntry: readonly string[]): UserConfi
      async load(virtualId: string) {
        if (!virtualId.startsWith(CSS_VIRTUAL_PREFIX)) return null
        const fileId = virtualId.slice(CSS_VIRTUAL_PREFIX.length, -CSS_VIRTUAL_SUFFIX.length)
+        // The virtual id otherwise hides the physical stylesheet from Rolldown's watch graph.
        this.addWatchFile(fileId)
        const source = await readFile(fileId)
        const { code, exports: cssExports } = transform({
--- a/packages/client/ui-conversation/README.i18n.yaml
+++ b/packages/client/ui-conversation/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-conversation/README.md
-README.md: ad64511120e3d4308ab03bb45de21b7d577b4335
-README.zh.md: 69926a282dea3f13564fe97e75d0c7c937b86335
+README.md: c72183f3b323eda702ee9ebfb8722e3302b0f88d
+README.zh.md: 989c20a8fe6e50a6db021a5af610bfd044d7b210
--- a/packages/client/ui-conversation/README.md
+++ b/packages/client/ui-conversation/README.md
@@ -36,9 +36,11 @@ None; this package neither assembles nor sends a provider request.

 ## Known Limitations and Deferred Work

- **The stats line has no duration segment** — assistant `usage` carries token accounting only; elapsed-time needs a host data source.
+- **Stats-line durations cover the in-window flow only** — LLM and tool wall times fold the snapshot's assistant `timing` and tool call/result pairs, so nodes outside the loaded event window (older history) are not counted.
 - **Details panel is the minimal form and currently has no entry point** — selected call args/result raw display; the Input/Output/Metadata switch, Prev/Next stepping, and See-in-trajectory deep link are deferred. Tool rows stopped being details-panel click targets and nothing replaced that gesture, so `ChatViewInjected.openDetails` is implemented but uncalled and the panel (including its terminal card) is unreachable in the assembled application; its rendering stays covered by mounting it with a selection directly.
- **Assistant per-message paging is a reserved slot** — drawn in the design, not implemented. The finalized IconActions row (copy / branch / clock) ships; branch remains a chrome stub.
+- **Assistant per-message paging is a reserved slot** — drawn in the design, not implemented. The finalized content IconActions row (copy / branch / clock) ships under text output only; branch remains a chrome stub.
 - **The sparkle icon for the others tool row is a hand-drawn approximation** — the design glyph's vector geometry is not exportable locally; promotion into ui-primitives waits on an exact export.
 - **The approval panel's "Always allow this type" is deferred** — durable grants need a grant-storage design; only allow-once/reject answer today.
 - **TodoPanel truncates long item text to one ellipsized line** — the figma strip has no wrap or expand affordance; full text is not readable inline.
+- **Queue edit is text-only** — rows containing non-text blocks still show a flattened preview, but their edit control is disabled because the inline editor cannot preserve those blocks. A text row's edit mode replaces delete with save and cancel; Enter saves and Escape cancels. QueueDock exposes no send-now control.
+- **Web exposes pending Queue only** — the Host omits pending steering from the Queue snapshot until steering has its own interaction. A consumed `steering/message` still renders in the durable transcript so external steering remains truthful on replay.
--- a/packages/client/ui-conversation/README.zh.md
+++ b/packages/client/ui-conversation/README.zh.md
@@ -36,9 +36,11 @@ todo 两个面就是在该形状上的两个注册项，都是普通注册方插

 ## 已知限制与暂缓事项

- **统计行没有耗时区段**：assistant `usage` 只携带 token 计数；耗时需要主机数据源。
+- **统计行的耗时只覆盖窗口内消息流**：LLM 与工具墙钟时间由快照的 assistant `timing` 与工具 call/result 配对折算，落在已加载事件窗口之外的节点（更早的历史）不计入。
 - **详情面板是最小形态，且当前没有入口**：以原始形式显示已选择调用的参数／结果；Input/Output/Metadata 切换、Prev/Next 步进与 See-in-trajectory 深链接暂缓实现。工具行已不再是详情面板的点击目标，且没有任何手势接替它，因此 `ChatViewInjected.openDetails` 虽已实现却无人调用，该面板（含其终端卡片）在组装后的应用中不可达；其渲染仍由直接以选中态挂载它来覆盖。
- **assistant 逐消息分页是预留 slot**：设计中已有图稿，尚未实现。已定稿的 IconActions 行（复制／分支／时钟）已落地；分支仍是 chrome stub。
+- **assistant 逐消息分页是预留 slot**：设计中已有图稿，尚未实现。已定稿的内容 IconActions 行（复制／分支／时钟）只挂在 text 输出下；分支仍是 chrome stub。
 - **others 工具行的闪光图标是手绘近似版本**：无法在本地导出设计字形的矢量几何；等到存在精确导出后再将其提升到 ui-primitives。
 - **审批面板的「始终允许此类」暂缓**：持久授权需要授权存储设计；今天只能回答允许一次／拒绝。
 - **TodoPanel 将过长条目截成单行省略号**：figma 条没有换行或展开入口，完整文本无法在行内读完。
+- **Queue 编辑仅支持文本**：包含非文本块的行仍显示扁平化预览，但由于内联编辑器无法保留这些块，其编辑控件会被禁用。文本行进入编辑模式后，删除会替换为保存和取消；Enter 保存，Escape 取消。QueueDock 不提供立即发送控件。
+- **Web 仅暴露待处理 Queue**：在 steering（中途引导）拥有专用交互之前，Host 不会把待处理 steering 纳入 Queue 快照。已消费的 `steering/message` 仍会渲染到持久 transcript（文本记录）中，因此从外部提交的 steering 在回放时仍能如实呈现。
--- a/packages/client/ui-conversation/src/client/chat/AssistantMarkdown.module.css
+++ b/packages/client/ui-conversation/src/client/chat/AssistantMarkdown.module.css
@@ -34,11 +34,3 @@
  /* Optical align with 28px icon hit targets that pad 6px past the glyph. */
  margin-left: -6px;
 }
-
-/* Hover-capable pointers: reveal shared actions on root hover/focus. */
-@media (hover: hover) {
-  .root:hover .actions,
-  .root:focus-within .actions {
-    opacity: 1;
-  }
-}
--- a/packages/client/ui-conversation/src/client/chat/AssistantMarkdown.tsx
+++ b/packages/client/ui-conversation/src/client/chat/AssistantMarkdown.tsx
@@ -4,7 +4,8 @@
 // view groups them into tool rows through its keyed toolview slot (figma
 // step-summary flow). Shared by finalized nodes and the streaming partial;
 // the turn-level loading dots live in the chat view's tail, not here.
-// Finalized nodes append IconActions (copy / branch / clock) once streaming ends.
+// Finalized content (text) nodes append IconActions once streaming ends;
+// Think / tool-head-only nodes stay chrome-free.

 import { memo } from 'react'
 import type { AssistantBlock } from '@deepseek-ai/dsh-client-runtime/client'
@@ -40,6 +41,11 @@ function copyText(blocks: readonly AssistantBlock[]): string {
  return parts.join('')
 }

+/** True when the node has model-visible text content worth chrome under. */
+function hasContentText(blocks: readonly AssistantBlock[]): boolean {
+  return blocks.some(block => block.kind === 'text' && block.text.trim() !== '')
+}
+
 /** Reasoning block as the Think variant summary row (figma 39:28304). */
 function ThinkRow({ text, running }: { text: string; running: boolean }) {
  return (
@@ -66,8 +72,8 @@ export const AssistantMarkdown = memo(function AssistantMarkdown({
    || interrupted === true
    || blocks.some(block => block.kind !== 'tool-call')
  if (!hasVisible) return null
-  // Footer only after the turn settles with a known event time; streaming omits it.
-  const showActions = !streaming && time !== undefined
+  // Footer only under settled content text; Think-only / streaming omit it.
+  const showActions = !streaming && time !== undefined && hasContentText(blocks)
  return (
    <div className={css.root} data-streaming={streaming || undefined}>
      <div className={css.body}>
--- a/packages/client/ui-conversation/src/client/chat/ChatView.module.css
+++ b/packages/client/ui-conversation/src/client/chat/ChatView.module.css
@@ -144,8 +144,11 @@
 }

 :global([data-conversation-scroll]) .toBottomSlot {
-  /* Clears the sticky composer stack (stats + docks + input card). */
-  bottom: 168px;
+  /* Clears the sticky composer stack (docks + input card + stats): the live
+     height rides --dsh-composer-height (ConversationRoot's seat observer) so
+     the control follows a growing textarea; the fallback covers the first
+     paint before the observer fires. */
+  bottom: calc(var(--dsh-composer-height, 152px) + 16px);
 }

 .toBottom {
--- a/packages/client/ui-conversation/src/client/chat/MessageIconActions.module.css
+++ b/packages/client/ui-conversation/src/client/chat/MessageIconActions.module.css
@@ -1,5 +1,5 @@
 /* Shared message IconActions row (user + assistant). Parent modules own
-   hover-reveal selectors and layout offsets via the composed className. */
+   layout offsets via the composed className. Always visible when mounted. */

 .actions {
  display: flex;
@@ -25,14 +25,6 @@
  white-space: nowrap;
 }

-/* Hover-capable pointers: hide until a parent hover/focus rule reveals. */
-@media (hover: hover) {
-  .actions {
-    opacity: 0;
-    transition: opacity var(--ds-transition-duration) var(--ds-ease-in-out);
-  }
-}
-
 .action {
  display: inline-flex;
  align-items: center;
--- a/packages/client/ui-conversation/src/client/chat/MessageIconActions.tsx
+++ b/packages/client/ui-conversation/src/client/chat/MessageIconActions.tsx
@@ -18,7 +18,7 @@ export interface MessageIconActionsProps {
  clock: 'start' | 'end'
  /** When true, append the stub edit control (user bubble). */
  edit?: boolean | undefined
-  /** Parent layout / hover-reveal class composed onto the actions row. */
+  /** Parent layout class composed onto the actions row. */
  className?: string | undefined
 }

--- a/packages/client/ui-conversation/src/client/chat/MessageItem.module.css
+++ b/packages/client/ui-conversation/src/client/chat/MessageItem.module.css
@@ -29,14 +29,6 @@
  color: var(--dsw-alias-label-primary);
 }

-/* Hover-capable pointers: reveal shared MessageIconActions on row hover/focus. */
-@media (hover: hover) {
-  .userRow:hover .actions,
-  .userRow:focus-within .actions {
-    opacity: 1;
-  }
-}
-
 .badge {
  display: inline-block;
  margin-bottom: 4px;
--- a/packages/client/ui-conversation/src/client/chat/StatsLine.module.css
+++ b/packages/client/ui-conversation/src/client/chat/StatsLine.module.css
@@ -2,12 +2,22 @@
   736px message column axis. */

 .root {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 10px;
  max-width: 736px;
  width: 100%;
  margin: 0 auto;
  box-sizing: border-box;
-  padding: 4px 24px 8px;
+  padding: 4px 24px 0px;
  font-size: 12px;
  line-height: 20px;
  color: var(--dsw-alias-label-tertiary);
+  white-space: nowrap;
+  overflow: hidden;
+}
+
+.sep {
+  color: var(--dsw-alias-separator-primary);
 }
--- a/packages/client/ui-conversation/src/client/chat/StatsLine.tsx
+++ b/packages/client/ui-conversation/src/client/chat/StatsLine.tsx
@@ -2,7 +2,7 @@
 // Mounted on 'conversation.composer.dock' so it sticks with the composer in the
 // active conversation scrollport (see ConversationRoot data-conversation-scroll).

-import { memo, useMemo } from 'react'
+import { Fragment, memo, useMemo } from 'react'
 import type { ConversationSnapshot } from '@deepseek-ai/dsh-client-runtime/client'
 import type { SnapshotSelectorHook } from '@deepseek-ai/dsh-client-ui-slots'
 import css from './StatsLine.module.css'
@@ -10,7 +10,13 @@ import css from './StatsLine.module.css'
 interface UsageTotals {
  turns: number
  steps: number
-  tokens: number
+  /** Summed request wall time (step/start → assistant/message); 0 when no node carries timing. */
+  llmMs: number
+  /** Summed tool wall time (tool/call → tool/result); 0 when no pair is in-window. */
+  toolMs: number
+  /** Prompt-side tokens: inputTokens + cacheReadTokens. */
+  inputTokens: number
+  outputTokens: number
  cacheHitPct: number | null
 }

@@ -22,35 +28,72 @@ interface UsageLike {
 }

 /**
- * Fold assistant nodes into display totals.
+ * Fold assistant and tool-result nodes into display totals.
 * @param nodes - snapshot nodes.
 * @returns totals; cacheHitPct null until any cache accounting arrives.
 */
 export function deriveStats(nodes: ConversationSnapshot['nodes']): UsageTotals {
  const turns = new Set<number>()
  let steps = 0
-  let tokens = 0
+  let llmMs = 0
+  let toolMs = 0
  let input = 0
+  let output = 0
  let cacheRead = 0
  for (const node of nodes) {
+    if (node.kind === 'tool-result') {
+      if (node.callTime !== null) toolMs += Math.max(0, node.time - node.callTime)
+      continue
+    }
    if (node.kind !== 'assistant') continue
    turns.add(node.turn)
    steps += 1
+    if (node.timing !== undefined && node.timing.stepStartTime !== null) {
+      llmMs += Math.max(0, node.timing.completedTime - node.timing.stepStartTime)
+    }
    const usage = node.usage as UsageLike | undefined
    if (usage === undefined) continue
    input += usage.inputTokens ?? 0
+    output += usage.outputTokens ?? 0
    cacheRead += usage.cacheReadTokens ?? 0
-    tokens += (usage.inputTokens ?? 0) + (usage.outputTokens ?? 0) + (usage.cacheReadTokens ?? 0)
  }
  const denom = input + cacheRead
  return {
    turns: turns.size,
    steps,
-    tokens,
+    llmMs,
+    toolMs,
+    inputTokens: input + cacheRead,
+    outputTokens: output,
    cacheHitPct: denom === 0 ? null : Math.round((cacheRead / denom) * 100),
  }
 }

+/**
+ * Compact token count: 517 / 12.2K / 517K / 1.2M (one decimal under three digits).
+ * @param n - token count.
+ * @returns display string.
+ */
+export function formatTokens(n: number): string {
+  const scaled = (v: number): string =>
+    v >= 100 ? String(Math.round(v)) : String(Math.round(v * 10) / 10)
+  if (n < 1_000) return String(n)
+  if (n < 1_000_000) return `${scaled(n / 1_000)}K`
+  return `${scaled(n / 1_000_000)}M`
+}
+
+/**
+ * Compact duration: 45.2s under a minute, 2m42s from there on.
+ * @param ms - duration in milliseconds.
+ * @returns display string.
+ */
+export function formatDuration(ms: number): string {
+  const s = ms / 1_000
+  if (s < 60) return `${Math.round(s * 10) / 10}s`
+  const whole = Math.round(s)
+  return `${Math.floor(whole / 60)}m${whole % 60}s`
+}
+
 /** Props: the conversation-snapshot selector (dock registration or unit mount). */
 export interface StatsLineProps { useSession: SnapshotSelectorHook<ConversationSnapshot> }

@@ -58,10 +101,22 @@ export const StatsLine = memo(function StatsLine({ useSession }: StatsLineProps)
  const nodes = useSession(s => s.nodes)
  const stats = useMemo(() => deriveStats(nodes), [nodes])
  if (stats.steps === 0) return null
-  const parts: string[] = []
-  if (stats.cacheHitPct !== null) parts.push(`cache hit ${stats.cacheHitPct}%`)
-  parts.push(`${stats.tokens.toLocaleString('en-US')} tokens`)
-  parts.push(`${stats.turns} turns`)
-  parts.push(`${stats.steps} steps`)
-  return <div className={css.root}>{parts.join(' · ')}</div>
+  // Pipe-separated groups (figma stats strip); a group with no data drops out whole.
+  const groups: string[] = [`${stats.turns} turns · ${stats.steps} steps`]
+  const durations: string[] = []
+  if (stats.llmMs > 0) durations.push(`LLM ${formatDuration(stats.llmMs)}`)
+  if (stats.toolMs > 0) durations.push(`Tool call ${formatDuration(stats.toolMs)}`)
+  if (durations.length > 0) groups.push(durations.join(' · '))
+  if (stats.cacheHitPct !== null) groups.push(`Cache hit ${stats.cacheHitPct}%`)
+  groups.push(`Input ${formatTokens(stats.inputTokens)} tok · Output ${formatTokens(stats.outputTokens)} tok`)
+  return (
+    <div className={css.root}>
+      {groups.map((group, i) => (
+        <Fragment key={group}>
+          {i > 0 && <span className={css.sep} aria-hidden>|</span>}
+          <span>{group}</span>
+        </Fragment>
+      ))}
+    </div>
+  )
 })
--- a/packages/client/ui-conversation/src/client/contract/queue.ts
+++ b/packages/client/ui-conversation/src/client/contract/queue.ts
@@ -0,0 +1,13 @@
+/** Queue contracts derived from the runtime session face and snapshot. */
+import type {
+  ConversationSnapshot, SessionFace,
+} from '@deepseek-ai/dsh-client-runtime/client'
+
+/** One address accepted by the runtime session's queue mutation verb. */
+export type QueueItemId = Parameters<SessionFace['updateQueue']>[0]
+
+/** One mutation accepted by the runtime session's queue mutation verb. */
+export type QueueAction = Parameters<SessionFace['updateQueue']>[1]
+
+/** One row projected by the runtime session's authoritative queue snapshot. */
+export type QueueRow = ConversationSnapshot['queue'][number]
--- a/packages/client/ui-conversation/src/client/contract/slots.ts
+++ b/packages/client/ui-conversation/src/client/contract/slots.ts
@@ -76,7 +76,7 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
     * design §6 MIX evidence: entries coexist in fixed order).
     */
    'conversation.input.dock': { kind: 'list'; scope: 'session'; owner: InputZone }
-    /** The composer top-edge band (stats line family). */
+    /** The band under the composer card (stats line family), rendered inside the bar's width column via the `footer` owner prop. */
    'conversation.composer.dock': { kind: 'list'; scope: 'session'; owner: InputZone }
    /** Tool-row left region inside the input card (existing chrome stays in place beside entries). */
    'conversation.input.left': { kind: 'list'; scope: 'session'; owner: InputZone }
@@ -264,6 +264,8 @@ export interface ComposerBarOwnerProps {
  leftItems?: ReactNode
  /** input.right slot entries (tool row, before the primary button). */
  rightItems?: ReactNode
+  /** composer.dock entries (stats line), rendered under the card inside the bar's width column. */
+  footer?: ReactNode
  onAdd?: () => void
  addLabel?: string
 }
--- a/packages/client/ui-conversation/src/client/input/contract.ts
+++ b/packages/client/ui-conversation/src/client/input/contract.ts
@@ -11,6 +11,7 @@ import type {
  ArbitrateKey, ArbitrateOutcome, CommandClaim, ConsumeTokenRequest, PickOutcome,
  ReferenceInsert, SubmitOutcome, TokenSpan,
 } from '@deepseek-ai/dsh-client-ui-slash/client'
+import type { QueueRow } from '../contract/queue.ts'

 /** Browser-runtime identity of one unsent image draft. */
 export type DraftAttachmentId = Branded<'DraftAttachmentId'>
@@ -115,12 +116,8 @@ export interface ComposerKeyboard {
  dismissPopup(): void
 }

-/** One queued-message row projected from the session/queued frames (T9 supplies the store). */
-export interface QueuedMessage {
-  /** Stable row key: the enqueueing prompt's rpcId. */
-  readonly key: string
-  readonly preview: string
-}
+/** One independently addressable row projected from the transient queue snapshot. */
+export type QueuedMessage = QueueRow

 /** Guard union of the scoped consume-token event, checked by the machine. */
 export type ConsumeTokenGuard = ConsumeTokenRequest['guard']
--- a/packages/client/ui-conversation/src/client/queue/QueueDock.module.css
+++ b/packages/client/ui-conversation/src/client/queue/QueueDock.module.css
@@ -1,30 +1,114 @@
-/* Neutral stacked strip above the input (queue rows are informational, not a warn state). */
+/* Figma .FileContainerText 1:791: 776px wrapper around the inset 752px panel. */

 .dock {
-  margin: 6px 0;
-  padding: 8px 12px;
-  border: 1px solid var(--dsw-alias-separator-primary);
-  border-radius: 10px;
-  background: var(--dsw-alias-bg-base);
+  box-sizing: border-box;
+  flex: none;
+  width: 100%;
+  max-width: 776px;
+  /* Eat InputBar's 6px top padding and tuck the panel 2px under the card;
+     the later composer sibling paints its surface and shadow over this edge. */
+  margin: 0 auto -10px;
+  padding: 2px 12px;
 }

-.title {
-  font-size: 12px;
-  font-weight: 500;
-  color: var(--dsw-alias-label-secondary);
+.panel {
+  position: relative;
+  overflow: hidden;
+  width: 100%;
+  padding-top: 2px;
+  border-radius: 14px 14px 0 0;
+  background: var(--dsw-specific-tip);
+}
+
+.panel::after {
+  position: absolute;
+  inset: 0;
+  border: 1px solid var(--dsw-alias-border-l1);
+  border-bottom: none;
+  border-radius: inherit;
+  content: '';
+  pointer-events: none;
 }

 .list {
-  margin: 4px 0 0;
+  margin: 0;
  padding: 0;
  list-style: none;
 }

 .row {
-  overflow: hidden;
-  font-size: 12px;
-  line-height: 20px;
-  color: var(--dsw-alias-label-primary);
-  white-space: nowrap;
-  text-overflow: ellipsis;
+  box-sizing: border-box;
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  width: 100%;
+  height: 36px;
+  padding: 4px 5px 4px 12px;
+  border-radius: 8px;
+}
+
+.preview,
+.editor {
+  flex: 1 1 auto;
+  min-width: 0;
+  font: var(--dsw-font-xs-13);
+  font-family: Inter, var(--dsw-font-family);
+}
+
+.preview {
+  overflow: hidden;
+  color: var(--dsw-alias-label-primary-dimmed);
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  word-break: break-word;
+}
+
+.editor {
+  box-sizing: border-box;
+  height: 28px;
+  padding: 0 8px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 6px;
+  outline: none;
+  background: var(--dsw-alias-bg-base);
+  color: var(--dsw-alias-label-primary);
+}
+
+.editor:focus {
+  border-color: var(--dsw-alias-state-business-primary);
+}
+
+.actions {
+  display: flex;
+  flex: none;
+  align-items: center;
+  gap: 10px;
+}
+
+.action {
+  display: grid;
+  flex: none;
+  place-items: center;
+  width: 28px;
+  height: 28px;
+  padding: 0;
+  border: none;
+  border-radius: 999px;
+  background: transparent;
+  color: var(--dsw-alias-label-tertiary);
+  cursor: pointer;
+}
+
+.action:hover:not(:disabled) {
+  background: var(--dsw-alias-interactive-bg-hover);
+}
+
+.action:focus-visible {
+  outline: 2px solid var(--dsw-alias-label-tertiary);
+  outline-offset: -2px;
+}
+
+.action:disabled {
+  cursor: default;
+  opacity: 0.45;
 }
--- a/packages/client/ui-conversation/src/client/queue/QueueDock.tsx
+++ b/packages/client/ui-conversation/src/client/queue/QueueDock.tsx
@@ -1,48 +1,185 @@
-// Read-only queue dock entry (design v4 queue cut 1): renders the session's
-// inbox mirror (session/queued frames + connect baseline) as one stacked
-// strip above the input. No per-row actions — the host inbox has no
-// addressable entries yet (queue cut 2 ledger).
+// Queue dock entry: renders the authoritative transient inbox snapshot and
+// addresses per-row mutations through the session-scoped conversation face.
 //
 // The 'conversation.input.dock' SlotMap declaration lives in
 // ../contract/slots.ts beside the other input-region slots.
 import type { Context } from 'cordis'
+import { useEffect, useState } from 'react'
 import type { PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
-import type {} from '@deepseek-ai/dsh-client-runtime/client'
+import type { SessionId } from '@deepseek-ai/dsh-client-runtime/client'
+import {
+  IconCheckOutline16, IconCloseOutline16, IconEditOutline16, IconTrashOutline16,
+} from '@deepseek-ai/dsh-client-ui-primitives'
+import type { QueueAction, QueueItemId } from '../contract/queue.ts'
 import css from './QueueDock.module.css'

+/** Queue operations injected by the session-scoped registration. */
+export interface QueueDockInjected {
+  updateQueue: (itemId: QueueItemId, action: QueueAction) => Promise<void>
+  notify: (level: 'info' | 'error', text: string) => void
+}
+
 /** Full props of a dock entry: InputZone owner share + session standard kit + global seat. */
-export type QueueDockProps = PropsRuntime<'conversation.input.dock'>
+export type QueueDockProps = PropsRuntime<'conversation.input.dock'> & QueueDockInjected

 /** Queue strip: one preview line per queued message; renders null when the queue is empty. */
-export function QueueDock({ useSession }: QueueDockProps) {
+export function QueueDock({ useSession, updateQueue, notify }: QueueDockProps) {
  const queue = useSession(s => s.queue)
+  const [editing, setEditing] = useState<{ id: QueueItemId; text: string } | null>(null)
+  const [busy, setBusy] = useState<QueueItemId | null>(null)
+
+  useEffect(() => {
+    if (editing !== null && !queue.some(row => row.id === editing.id)) setEditing(null)
+  }, [editing, queue])
+
  if (queue.length === 0) return null
+
+  const applyAction = async (
+    itemId: QueueItemId,
+    action: QueueAction,
+    failure: string,
+  ): Promise<boolean> => {
+    setBusy(itemId)
+    try {
+      await updateQueue(itemId, action)
+      return true
+    } catch {
+      notify('error', failure)
+      return false
+    } finally {
+      setBusy(current => current === itemId ? null : current)
+    }
+  }
+
+  const saveEdit = async (): Promise<void> => {
+    if (editing === null || editing.text.trim() === '') return
+    if (await applyAction(
+      editing.id,
+      { kind: 'edit', content: [{ type: 'text', text: editing.text }] },
+      '编辑失败：这条消息可能已经开始发送。',
+    )) setEditing(null)
+  }
+
  return (
    <div className={css.dock}>
-      <div className={css.title}>已排队 {queue.length} 条</div>
-      <ul className={css.list}>
-        {queue.map(row => (
-          <li key={row.key} className={css.row}>{row.preview}</li>
-        ))}
-      </ul>
+      <div className={css.panel}>
+        <ul className={css.list}>
+          {queue.map(row => (
+            <li key={row.id} className={css.row}>
+              {editing?.id === row.id
+                ? (
+                  <input
+                    autoFocus
+                    className={css.editor}
+                    aria-label="编辑排队消息"
+                    value={editing.text}
+                    onChange={(event) => { setEditing({ id: row.id, text: event.currentTarget.value }) }}
+                    onKeyDown={(event) => {
+                      if (event.key === 'Escape') {
+                        setEditing(null)
+                        return
+                      }
+                      if (event.key === 'Enter' && !event.nativeEvent.isComposing) {
+                        event.preventDefault()
+                        void saveEdit()
+                      }
+                    }}
+                  />
+                )
+                : <span className={css.preview}>{row.preview}</span>}
+              <div className={css.actions}>
+                {editing?.id === row.id
+                  ? (
+                    <>
+                      <button
+                        type="button"
+                        className={css.action}
+                        aria-label="保存排队消息"
+                        title="保存排队消息"
+                        disabled={busy !== null || editing.text.trim() === ''}
+                        onClick={() => { void saveEdit() }}
+                      >
+                        <IconCheckOutline16 size={14} />
+                      </button>
+                      <button
+                        type="button"
+                        className={css.action}
+                        aria-label="取消编辑"
+                        title="取消编辑"
+                        disabled={busy !== null}
+                        onClick={() => { setEditing(null) }}
+                      >
+                        <IconCloseOutline16 size={14} />
+                      </button>
+                    </>
+                  )
+                  : (
+                    <>
+                      <button
+                        type="button"
+                        className={css.action}
+                        aria-label="编辑排队消息"
+                        title={row.text === null ? '包含非文本内容，暂不支持编辑' : '编辑排队消息'}
+                        disabled={busy !== null || row.text === null}
+                        onClick={() => {
+                          if (row.text !== null) setEditing({ id: row.id, text: row.text })
+                        }}
+                      >
+                        <IconEditOutline16 size={14} />
+                      </button>
+                      <button
+                        type="button"
+                        className={css.action}
+                        aria-label="删除排队消息"
+                        title="删除排队消息"
+                        disabled={busy !== null}
+                        onClick={() => {
+                          void applyAction(
+                            row.id,
+                            { kind: 'remove' },
+                            '删除失败：这条消息可能已经开始发送。',
+                          )
+                        }}
+                      >
+                        <IconTrashOutline16 size={14} />
+                      </button>
+                    </>
+                  )}
+              </div>
+            </li>
+          ))}
+        </ul>
+      </div>
    </div>
  )
 }

 /**
- * The dock entry as a plain registrant plugin (bash posture).
- * `inject: ['conversation']` is the ordering seam: the conversation service
- * mounts after ui-conversation's slot registrations, so the
- * 'conversation.input.dock' declaration is on the ledger by then.
+ * The dock entry as a plain registrant plugin. The conversation service is the
+ * ordering and action seam; session scopes provide the exact queue owner.
 */
 export const queueDockEntry = {
  name: 'conversation-queue-dock',
-  inject: ['slots', 'conversation'],
+  inject: ['slots', 'conversation', 'sessions'],
  /**
   * Register the queue strip into the input dock (list entry, order 0).
   * @param ctx - registrant context (disposal rides ctx.effect inside slots.register).
   */
  apply(ctx: Context): void {
-    ctx.slots.register({ name: 'conversation.input.dock', id: 'queue', order: 0 }, QueueDock)
+    ctx.slots.register({
+      name: 'conversation.input.dock',
+      id: 'queue',
+      order: 0,
+      inject: (sessionId: SessionId): QueueDockInjected => {
+        const actx = ctx.sessions.scope(sessionId)
+        if (actx === undefined) throw new Error(`queue dock: session "${sessionId}" resolved no scope`)
+        const conversation = actx.get('conversation')
+        if (conversation === undefined) throw new Error('queue dock: conversation service unavailable')
+        return {
+          updateQueue: (itemId, action) => conversation.updateQueue(itemId, action),
+          notify: (level, text) => { conversation.input.for(actx).notify(level, text) },
+        }
+      },
+    }, QueueDock)
  },
 }
--- a/packages/client/ui-conversation/src/client/queue/store.ts
+++ b/packages/client/ui-conversation/src/client/queue/store.ts
@@ -11,8 +11,8 @@ import type { QueuedMessage } from '../input/contract.ts'
 /**
 * Project a session's queue rows as a bare observable (subscribe/getSnapshot).
 * The wiring layer (T5) overlays this onto InputState.queue; the runtime
- * QueuedMessage and the input-contract QueuedMessage are structurally the
- * same frozen shape ({key, preview}).
+ * QueuedMessage and the input-contract QueuedMessage are structurally
+ * identical.
 * @param session - the resident session face.
 * @returns the queue read face (snapshot reference stable while the queue is unchanged).
 */
--- a/packages/client/ui-conversation/src/client/service.ts
+++ b/packages/client/ui-conversation/src/client/service.ts
@@ -15,6 +15,7 @@ import type { Context } from 'cordis'
 import type { ISessions, SessionFace, SessionId } from '@deepseek-ai/dsh-client-runtime/client'
 import type { ImageAttachmentRef, ImageMediaType } from '@deepseek-ai/dsh-attachment'
 import type { ComposerAttachment } from './contract/slots.ts'
+import type { QueueAction, QueueItemId } from './contract/queue.ts'
 import type { DraftAttachmentId, InputService } from './input/contract.ts'

 /**
@@ -32,6 +33,13 @@ export interface IConversation {
   * @returns completion; business failures reject (and land in promptError).
   */
  send(text: string, mode: 'queue' | 'steer'): Promise<void>
+  /**
+   * Apply one operation to a pending queue occurrence.
+   * @param itemId - agent-owned inbox occurrence identity.
+   * @param action - edit or remove operation.
+   * @returns completion; business failures reject.
+   */
+  updateQueue(itemId: QueueItemId, action: QueueAction): Promise<void>
  /**
   * Cancel the scoped session's in-flight turn.
   * @returns completion; failures reject as in send.
@@ -237,6 +245,15 @@ export class ConversationService extends Service implements IConversation {
    }
  }

+  /** Apply one operation to a pending queue occurrence. */
+  async updateQueue(itemId: QueueItemId, action: QueueAction): Promise<void> {
+    const session = this.scopedSession('updateQueue')
+    const result = await session.updateQueue(itemId, action)
+    if (!result.ok) {
+      throw new Error(`conversation.updateQueue failed: ${result.error.code}: ${result.error.message}`)
+    }
+  }
+
  /** Cancel the scoped session's in-flight turn (failures land in promptError and reject, as in send). */
  async cancel(): Promise<void> {
    const session = this.scopedSession('cancel')
--- a/packages/client/ui-conversation/src/client/skeleton/ConversationRoot.module.css
+++ b/packages/client/ui-conversation/src/client/skeleton/ConversationRoot.module.css
@@ -127,10 +127,14 @@
  min-height: 0;
 }

-/* Composer stack: dock strips above the input card (design §6 MIX order). */
+/* Composer stack: dock strips above the input card (design §6 MIX order).
+   The stack owns the vertical rhythm: one gap here, entries carry no outer
+   margins — an entry that renders null costs nothing, so spacing stays
+   correct for any dock combination. */
 .composerStack {
  display: flex;
  flex-direction: column;
+  gap: 8px;
 }

 /* Common seat for the composer chain (fallback + elected overlay siblings). */
@@ -170,7 +174,17 @@
  /* Above markdown CodeBlock sticky banners (z-index 6) so the footer never
     paints under a sticking code header while scrolling. */
  z-index: 7;
-  background: var(--dsw-alias-bg-base);
+  /* Input mask (figma 1205:27463): transcript fades out under a FIXED 36px
+     band at the seat's top (the figma 24% of the resting ~150px composer),
+     solid below — px stops, not %, so a growing draft only widens the solid
+     region and the fade band never stretches. The 0px stop is bg-base at
+     zero alpha (not white, which the figma export hardcodes) so both themes
+     fade from their own base. */
+  background: linear-gradient(
+    180deg,
+    color-mix(in srgb, var(--dsw-alias-bg-base) 0%, transparent) 0px,
+    var(--dsw-alias-bg-base) 36px
+  );
 }

 /* Hero phase: the composer stack (hero chrome + workspace row + card) is
--- a/packages/client/ui-conversation/src/client/skeleton/ConversationRoot.tsx
+++ b/packages/client/ui-conversation/src/client/skeleton/ConversationRoot.tsx
@@ -2,7 +2,7 @@
 // chain stay mounted across no-session/session transitions. Only the inert
 // input body swaps for the strict session InputBar.

-import { useEffect, useRef, useState, type ReactNode } from 'react'
+import { useCallback, useEffect, useRef, useState, type ReactNode } from 'react'
 import clsx from 'clsx'
 import type { WorkspaceId } from '@deepseek-ai/dsh-client-runtime/client'
 import type { ConversationSlotProps, InputZone } from '../contract/slots.ts'
@@ -29,6 +29,23 @@ export function ConversationRoot({
  const [pendingWorkspaceId, setPendingWorkspaceId] = useState<WorkspaceId | undefined>()
  const pickerAnchor = useRef<HTMLButtonElement>(null)

+  // Publishes the seat's live height as --dsh-composer-height on the scroll
+  // body so floating controls (ChatView back-to-bottom) clear the composer as
+  // it grows. Callback ref, not an effect: the seat remounts when the tree
+  // moves between the no-session and session paths. Stable identity so React
+  // reattaches only on those remounts, not on every render.
+  const seatObserver = useRef<ResizeObserver | null>(null)
+  const seatResizeRef = useCallback((seat: HTMLDivElement | null): void => {
+    seatObserver.current?.disconnect()
+    seatObserver.current = null
+    const scroller = seat?.parentElement ?? null
+    if (seat === null || scroller === null) return
+    seatObserver.current = new ResizeObserver(() => {
+      scroller.style.setProperty('--dsh-composer-height', `${seat.offsetHeight}px`)
+    })
+    seatObserver.current.observe(seat)
+  }, [])
+
  const sessionWorkspace = sessionId === undefined
    ? undefined
    : workspaces.items.find(workspace => workspace.sessionIds.includes(sessionId))
@@ -106,6 +123,9 @@ export function ConversationRoot({
      overlay: renderSlot('conversation.input.overlay', {}),
      leftItems: zone === undefined ? null : renderSlot('conversation.input.left', zone),
      rightItems: zone === undefined ? null : renderSlot('conversation.input.right', zone),
+      // Stats band under the card, inside the bar's width column so both
+      // share one constraint (composer.dock = stats-line family).
+      footer: !hero && zone !== undefined ? renderSlot('conversation.composer.dock', zone) : null,
    })

  const composerBar = (
@@ -113,9 +133,6 @@ export function ConversationRoot({
      {hero && <HeroGlow className={css.heroGlow} />}
      {hero && <HeroShell />}
      {hero && heroWorkspaceRow}
-      {/* Stats band above the input-dock strips so the prior ChatView footer
-          order (stats → todo/queue → card) is preserved under the sticky stack. */}
-      {!hero && zone !== undefined && renderSlot('conversation.composer.dock', zone)}
      {!hero && zone !== undefined && renderSlot('conversation.input.dock', zone)}
      {inputBar}
    </div>
@@ -133,7 +150,7 @@ export function ConversationRoot({
  // on the fallback alone would leave Question/Approval panels at the content
  // end off-screen when the user is not pinned to the floor.
  const composerSeat = (
-    <div className={css.composerSeat} data-composer-seat="">
+    <div ref={seatResizeRef} className={css.composerSeat} data-composer-seat="">
      {composer}
    </div>
  )
--- a/packages/client/ui-conversation/src/client/skeleton/InputBar.module.css
+++ b/packages/client/ui-conversation/src/client/skeleton/InputBar.module.css
@@ -20,10 +20,10 @@
  display: flex;
  flex-direction: column;
  align-items: center;
-  /* figma Input_Bottom: pad L32/R32/B12; the bottom gradient mask is owned by
-     the chat scroller. Top 6 is the gap under the dock todo strip (12px todo
-     margin + 6px here); error/status strips still carry their own margin. */
-  padding: 6px 32px 12px;
+  /* figma Input_Bottom: pad L32/R32/B8; the bottom gradient mask is owned by
+     the chat scroller. No top pad: the composer stack's gap owns the space
+     above; error/status strips still carry their own margin. */
+  padding: 0 32px 8px;
 }

 .hero {
@@ -279,12 +279,16 @@
 .mirror {
  visibility: hidden;
  pointer-events: none;
-  /* figma min-h 52 (= ~2 × 24 line + 4pt); 14-line cap (336px). */
-  min-height: 52px;
  max-height: 336px;
  overflow: hidden;
 }

+/* Hero (centered empty-state) keeps the 2-line floor (figma min-h 52 = ~2 × 24
+   line + 4pt); the docked composer collapses to the content height. */
+.hero .mirror {
+  min-height: 52px;
+}
+
 /* Toolbar: attach + Plan + Read-only on the left; model + send on the right
   (figma Input_Bottom chrome). */
 .row {
--- a/packages/client/ui-conversation/src/client/skeleton/InputBar.tsx
+++ b/packages/client/ui-conversation/src/client/skeleton/InputBar.tsx
@@ -32,7 +32,7 @@ export type InputBarProps = ComposerBarProps
 export function InputBar({
  useSession, useInput, inputActions, keyboard, addImages, removeImage, draftImages,
  stop, command, translateHint, renderSlot, useNotices, useLexicon, useProjection,
-  variant, placeholder, accessory, overlay, leftItems, rightItems, onAdd, addLabel = 'Add attachment',
+  variant, placeholder, accessory, overlay, leftItems, rightItems, footer, onAdd, addLabel = 'Add attachment',
 }: InputBarProps) {
  const input = useInput(s => s)
  const notice = useNotices(s => s)
@@ -516,6 +516,7 @@ export function InputBar({
        </div>
      </div>
      {preview !== null && <ImageLightbox src={preview.previewUrl} alt={preview.file.name || '原图'} onClose={closePreview} />}
+      {footer}
    </div>
  )
 }
--- a/packages/client/ui-conversation/src/client/skeleton/TodoPanel.module.css
+++ b/packages/client/ui-conversation/src/client/skeleton/TodoPanel.module.css
@@ -1,13 +1,14 @@
 /* Todo strip above the composer (figma 772:51905 / 772:52972 / 772:53419):
   tip surface, 14px radius, status icons + secondary item labels. Column is
-   calc(100% - 88px) / max 776, centered; InputBar top pad supplies the gap. */
+   calc(100% - 88px) / max 752 (GoalBar's column), centered; the composer
+   stack owns the gap. */

 .root {
  flex: none;
  overflow: hidden;
  margin: 0 auto;
  width: calc(100% - 88px);
-  max-width: 776px;
+  max-width: 752px;
  border: 1px solid var(--dsw-alias-border-l1);
  border-radius: 14px;
  background: var(--dsw-specific-tip);
@@ -20,11 +21,13 @@
  --dsh-scrollbar-thumb-hover: var(--dsw-alias-scrollbar-hover-l2);
 }

+/* Compact scale (GoalBar reference): collapsed header totals the goal
+   strip's 38px (8+8 pad + 20 line + 2 border). */
 .body {
  display: flex;
  flex-direction: column;
-  gap: 10px;
-  padding: 10px 16px;
+  gap: 8px;
+  padding: 8px 14px;
 }

 .header {
@@ -41,8 +44,8 @@

 .title {
  flex: none;
-  font-size: 14px;
-  line-height: 24px;
+  font-size: 13px;
+  line-height: 20px;
  font-weight: 500;
  color: var(--dsw-alias-label-primary);
 }
--- a/packages/client/ui-conversation/tests/assembly-surfaces.spec.tsx
+++ b/packages/client/ui-conversation/tests/assembly-surfaces.spec.tsx
@@ -29,9 +29,20 @@ import { apply, inject } from '@deepseek-ai/dsh-client-ui-conversation/client'

 const SID = 's1' as SessionId

-afterEach(cleanup)
+/** jsdom has no ResizeObserver; the composer seat publishes its height through one. */
+class ResizeObserverStub {
+  observe(): void {}
+  unobserve(): void {}
+  disconnect(): void {}
+}
+
+afterEach(() => {
+  cleanup()
+  vi.unstubAllGlobals()
+})
 beforeEach(() => {
  localStorage.clear()
+  vi.stubGlobal('ResizeObserver', ResizeObserverStub)
 })

 const TODOS: TodoItem[] = [
--- a/packages/client/ui-conversation/tests/chat-branch-tails.spec.tsx
+++ b/packages/client/ui-conversation/tests/chat-branch-tails.spec.tsx
@@ -177,7 +177,7 @@ describe('small branch tails', () => {
    expect(view.getByText('one-liner')).toBeTruthy()
  })

-  it('finalized assistant messages expose copy / branch / clock after the body; streaming omits them', () => {
+  it('finalized content messages expose copy / branch / clock; Think-only and streaming omit them', () => {
    const writeText = vi.fn().mockResolvedValue(undefined)
    Object.defineProperty(navigator, 'clipboard', {
      configurable: true,
@@ -199,6 +199,17 @@ describe('small branch tails', () => {
    expect(writeText).toHaveBeenCalledWith('answer body')
    settled.unmount()

+    const thinkOnly = render(
+      <AssistantMarkdown
+        blocks={[{ kind: 'reasoning', text: 'only thinking' }]}
+        streaming={false}
+        time={time}
+      />,
+    )
+    expect(thinkOnly.queryByRole('button', { name: '复制' })).toBeNull()
+    expect(thinkOnly.queryByText('14:24')).toBeNull()
+    thinkOnly.unmount()
+
    const streaming = render(
      <AssistantMarkdown blocks={[{ kind: 'text', text: 'partial' }]} streaming time={time} />,
    )
@@ -216,6 +227,6 @@ describe('small branch tails', () => {
    const view = render(
      <StatsLine useSession={bindSnapshotSelector(source) as unknown as StatsLineProps['useSession']} />,
    )
-    expect(view.getByText('10 tokens · 1 turns · 1 steps')).toBeTruthy()
+    expect(view.container.textContent).toBe('1 turns · 1 steps|Input 0 tok · Output 10 tok')
  })
 })
--- a/packages/client/ui-conversation/tests/chat-code-subcalls.spec.tsx
+++ b/packages/client/ui-conversation/tests/chat-code-subcalls.spec.tsx
@@ -23,9 +23,20 @@ import { apply, inject } from '@deepseek-ai/dsh-client-ui-conversation/client'

 const SID = 's1' as SessionId

-afterEach(cleanup)
+/** jsdom has no ResizeObserver; the composer seat publishes its height through one. */
+class ResizeObserverStub {
+  observe(): void {}
+  unobserve(): void {}
+  disconnect(): void {}
+}
+
+afterEach(() => {
+  cleanup()
+  vi.unstubAllGlobals()
+})
 beforeEach(() => {
  localStorage.clear()
+  vi.stubGlobal('ResizeObserver', ResizeObserverStub)
 })

 const PROGRAM = 'const listing = await tools.bash({ command: "ls notes", description: "List notes" })\nreturn listing'
--- a/packages/client/ui-conversation/tests/chat-stats-bash-sample.spec.tsx
+++ b/packages/client/ui-conversation/tests/chat-stats-bash-sample.spec.tsx
@@ -12,7 +12,7 @@ import type {
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
 import { bindSnapshotSelector } from '@deepseek-ai/dsh-client-web-react'
 import type { ToolRowProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
-import { StatsLine, deriveStats, type StatsLineProps } from '../src/client/chat/StatsLine.tsx'
+import { StatsLine, deriveStats, formatDuration, formatTokens, type StatsLineProps } from '../src/client/chat/StatsLine.tsx'
 import { BashRow } from '../src/client/toolviews/bash-sample.tsx'

 afterEach(cleanup)
@@ -51,7 +51,7 @@ function makeSource(init?: Partial<ConversationSnapshot>) {
 }

 describe('deriveStats', () => {
-  it('folds turns/steps/tokens and cache hit percentage', () => {
+  it('folds turns/steps/token split and cache hit percentage', () => {
    const stats = deriveStats([
      assistant(1, 1, { inputTokens: 100, outputTokens: 50, cacheReadTokens: 900 }),
      assistant(2, 1, { inputTokens: 100, outputTokens: 50 }),
@@ -59,19 +59,53 @@ describe('deriveStats', () => {
    ])
    expect(stats.turns).toBe(2)
    expect(stats.steps).toBe(3)
-    expect(stats.tokens).toBe(1200)
+    expect(stats.inputTokens).toBe(1100)
+    expect(stats.outputTokens).toBe(100)
    expect(stats.cacheHitPct).toBe(82)
  })

-  it('cache hit stays null with no cache accounting; non-assistant nodes ignored', () => {
+  it('cache hit stays null with no cache accounting; out-of-window tool results ignored', () => {
    const tool: ToolResultNode = {
      kind: 'tool-result', seq: 5, time: 5_000, callId: 'c', call: null, callTime: null, content: [],
      isError: false, callView: null, resultView: null,
    }
    const stats = deriveStats([tool, assistant(1, 1)])
    expect(stats.steps).toBe(1)
+    expect(stats.toolMs).toBe(0)
    expect(stats.cacheHitPct).toBeNull()
  })
+
+  it('sums LLM wall time from assistant timing and tool wall time from call/result pairs', () => {
+    const timed: AssistantMessageNode = {
+      ...assistant(1, 1),
+      timing: { stepStartTime: 1_000, firstTokenTime: 1_200, completedTime: 3_500 },
+    }
+    const untimed: AssistantMessageNode = {
+      ...assistant(2, 1),
+      timing: { stepStartTime: null, firstTokenTime: null, completedTime: 9_000 },
+    }
+    const tool: ToolResultNode = {
+      kind: 'tool-result', seq: 5, time: 7_000, callId: 'c', call: null, callTime: 4_000, content: [],
+      isError: false, callView: null, resultView: null,
+    }
+    const stats = deriveStats([timed, untimed, tool])
+    expect(stats.llmMs).toBe(2_500)
+    expect(stats.toolMs).toBe(3_000)
+  })
+})
+
+describe('formatters', () => {
+  it('formats token counts compactly', () => {
+    expect(formatTokens(517)).toBe('517')
+    expect(formatTokens(12_240)).toBe('12.2K')
+    expect(formatTokens(517_000)).toBe('517K')
+    expect(formatTokens(1_230_000)).toBe('1.2M')
+  })
+
+  it('formats durations under and over a minute', () => {
+    expect(formatDuration(45_230)).toBe('45.2s')
+    expect(formatDuration(162_000)).toBe('2m42s')
+  })
 })

 describe('StatsLine', () => {
@@ -79,12 +113,13 @@ describe('StatsLine', () => {
    return { useSession: bindSnapshotSelector(source) }
  }

-  it('renders the joined stats row and hides with zero steps', () => {
+  it('renders the grouped stats row and hides with zero steps', () => {
    const { source } = makeSource({
      nodes: [assistant(1, 1, { inputTokens: 10, outputTokens: 5, cacheReadTokens: 90 })],
    })
    const view = render(<StatsLine {...props(source)} />)
-    expect(view.getByText('cache hit 90% · 105 tokens · 1 turns · 1 steps')).toBeTruthy()
+    // No timing on the fixture: the duration group drops out whole.
+    expect(view.container.textContent).toBe('1 turns · 1 steps|Cache hit 90%|Input 100 tok · Output 5 tok')
    const empty = makeSource()
    const emptyView = render(<StatsLine {...props(empty.source)} />)
    expect(emptyView.container.textContent).toBe('')
--- a/packages/client/ui-conversation/tests/chat-toolview-slot.spec.tsx
+++ b/packages/client/ui-conversation/tests/chat-toolview-slot.spec.tsx
@@ -21,10 +21,21 @@ import type { ToolRowProps } from '@deepseek-ai/dsh-client-ui-conversation/clien

 const SID = 's1' as SessionId

-afterEach(cleanup)
+/** jsdom has no ResizeObserver; the composer seat publishes its height through one. */
+class ResizeObserverStub {
+  observe(): void {}
+  unobserve(): void {}
+  disconnect(): void {}
+}
+
+afterEach(() => {
+  cleanup()
+  vi.unstubAllGlobals()
+})
 // The chat store persists under its declared key; clear between cases.
 beforeEach(() => {
  localStorage.clear()
+  vi.stubGlobal('ResizeObserver', ResizeObserverStub)
 })

 const toolResult = (seq: number, callId: string, name: string, args = '{"command":"make build","description":"Build"}'): ToolResultNode => ({
--- a/packages/client/ui-conversation/tests/gate-branch-tails.spec.tsx
+++ b/packages/client/ui-conversation/tests/gate-branch-tails.spec.tsx
@@ -49,7 +49,7 @@ describe('render branch tails', () => {
    const view = render(
      <StatsLine useSession={bindSnapshotSelector(source) as unknown as UseSession<ConversationSnapshot>} />,
    )
-    expect(view.getByText('cache hit 0% · 15 tokens · 2 turns · 3 steps')).toBeTruthy()
+    expect(view.container.textContent).toBe('2 turns · 3 steps|Cache hit 0%|Input 9 tok · Output 6 tok')
  })

  it('AssistantMarkdown reasoning as the streaming tail renders the running ring', () => {
--- a/packages/client/ui-conversation/tests/queue-dock.spec.tsx
+++ b/packages/client/ui-conversation/tests/queue-dock.spec.tsx
@@ -1,20 +1,27 @@
 // @vitest-environment jsdom
 /**
- * QueueDock rendering (web input-triggers queue cut 1): empty queue renders
- * nothing, rows render one preview line each keyed by rpcId, and the strip
- * follows queue changes through the useSession selector.
+ * QueueDock rendering and operations: authoritative rows, inline editing,
+ * removal, failure notices, and live retirement.
 */
-import { afterEach, describe, expect, it } from 'vitest'
-import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { act, cleanup, fireEvent, render, waitFor } from '@testing-library/react'
 import { useSyncExternalStore } from 'react'
-import type { ConversationSnapshot, QueuedMessage, SessionId, SessionListState } from '@deepseek-ai/dsh-client-runtime/client'
+import type {
+  ConversationSnapshot, QueuedMessage, SessionId, SessionListState,
+} from '@deepseek-ai/dsh-client-runtime/client'
 import type { SnapshotSelectorHook } from '@deepseek-ai/dsh-client-ui-slots'
+import type { QueueItemId } from '../src/client/contract/queue.ts'
 import type { InputState } from '../src/client/input/contract.ts'
-import { QueueDock, queueDockEntry } from '../src/client/queue/QueueDock.tsx'
+import { QueueDock, queueDockEntry, type QueueDockInjected } from '../src/client/queue/QueueDock.tsx'

 afterEach(cleanup)

 const SID = 's1' as SessionId
+const iid = (id: string): QueueItemId => id as QueueItemId
+
+function row(id: string, text: string | null, preview = text ?? '[image]'): QueuedMessage {
+  return { id: iid(id), preview, text }
+}

 function snapshotWith(queue: QueuedMessage[]): ConversationSnapshot {
  return {
@@ -24,23 +31,23 @@ function snapshotWith(queue: QueuedMessage[]): ConversationSnapshot {
  }
 }

-/** Minimal live source backing the useSession stub (queue swaps notify subscribers). */
+/** Minimal live source backing the useSession stub. */
 function liveSession(initial: ConversationSnapshot) {
  let snapshot = initial
  const listeners = new Set<() => void>()
-  const useSession: SnapshotSelectorHook<ConversationSnapshot> = sel =>
+  const useSession: SnapshotSelectorHook<ConversationSnapshot> = selector =>
    useSyncExternalStore(
-      (fn) => {
-        listeners.add(fn)
-        return () => listeners.delete(fn)
+      (listener) => {
+        listeners.add(listener)
+        return () => listeners.delete(listener)
      },
-      () => sel(snapshot),
+      () => selector(snapshot),
    )
  return {
    useSession,
    push(next: ConversationSnapshot): void {
      snapshot = next
-      for (const fn of [...listeners]) fn()
+      for (const listener of [...listeners]) listener()
    },
  }
 }
@@ -48,7 +55,7 @@ function liveSession(initial: ConversationSnapshot) {
 /** InputZone owner stub (the dock reads useSession only; the zone fields satisfy the owner share). */
 const INPUT_STATE: InputState = { draft: '', imageIds: [], draftRev: 0, phase: 'plain', occurrences: [], queue: [] }

-function kitFor(snapshot: ConversationSnapshot) {
+function kitFor(snapshot: ConversationSnapshot, injected: Partial<QueueDockInjected> = {}) {
  return {
    sessionId: SID,
    useSessions: (() => { throw new Error('unused') }) as unknown as SnapshotSelectorHook<SessionListState>,
@@ -58,6 +65,9 @@ function kitFor(snapshot: ConversationSnapshot) {
    inputActions: { setDraft: () => {}, submit: () => {} } as never,
    session: snapshot,
    input: INPUT_STATE,
+    updateQueue: vi.fn(() => Promise.resolve()),
+    notify: vi.fn(),
+    ...injected,
  }
 }

@@ -69,20 +79,118 @@ describe('QueueDock', () => {
    expect(container.innerHTML).toBe('')
  })

-  it('renders one preview row per queued message with the count strip', () => {
+  it('renders active actions and disables editing for mixed-content rows', () => {
    const snap = snapshotWith([
-      { key: 'p-1', preview: '第一条排队消息' },
-      { key: 'p-2', preview: 'second queued line' },
+      row('i-1', '第一条排队消息'),
+      row('i-2', null, 'image [image]'),
    ])
    const source = liveSession(snap)
    const { container } = render(<QueueDock {...kitFor(snap)} useSession={source.useSession} />)
-    expect(container.textContent).toContain('已排队 2 条')
-    const rows = [...container.querySelectorAll('li')]
-    expect(rows.map(r => r.textContent)).toEqual(['第一条排队消息', 'second queued line'])
+    expect([...container.querySelectorAll('li')].map(item => item.textContent))
+      .toEqual(['第一条排队消息', 'image [image]'])
+    expect(container.querySelectorAll('button')).toHaveLength(4)
+    expect(container.querySelectorAll('[aria-label="编辑排队消息"]')).toHaveLength(2)
+    expect(container.querySelectorAll('[aria-label="删除排队消息"]')).toHaveLength(2)
+    expect(container.querySelectorAll('[aria-label="立即发送排队消息"]')).toHaveLength(0)
+    expect((container.querySelectorAll('[aria-label="编辑排队消息"]')[0] as HTMLButtonElement).disabled).toBe(false)
+    expect((container.querySelectorAll('[aria-label="编辑排队消息"]')[1] as HTMLButtonElement).disabled).toBe(true)
+    expect(container.querySelectorAll('[aria-label="编辑排队消息"]')[1]?.getAttribute('title'))
+      .toBe('包含非文本内容，暂不支持编辑')
  })

-  it('follows queue changes: retirement empties the strip back to null', () => {
-    const snap = snapshotWith([{ key: 'p-1', preview: '在场' }])
+  it('edits text inline with save and cancel controls, then saves with the same item identity', async () => {
+    const snap = snapshotWith([row('i-edit', 'before')])
+    const source = liveSession(snap)
+    const updateQueue = vi.fn(() => Promise.resolve())
+    const { getByLabelText, queryByLabelText } = render(
+      <QueueDock {...kitFor(snap, { updateQueue })} useSession={source.useSession} />,
+    )
+
+    fireEvent.click(getByLabelText('编辑排队消息'))
+    const editor = getByLabelText('编辑排队消息') as HTMLInputElement
+    expect(getByLabelText('保存排队消息')).toBeTruthy()
+    expect(getByLabelText('取消编辑')).toBeTruthy()
+    expect(queryByLabelText('删除排队消息')).toBeNull()
+    fireEvent.change(editor, { target: { value: 'after' } })
+    fireEvent.keyDown(editor, { key: 'Enter' })
+
+    await waitFor(() => {
+      expect(updateQueue).toHaveBeenCalledWith(iid('i-edit'), {
+        kind: 'edit',
+        content: [{ type: 'text', text: 'after' }],
+      })
+    })
+  })
+
+  it('cancels an edit by button or Escape without mutating the queue', () => {
+    const snap = snapshotWith([row('i-edit', 'before')])
+    const source = liveSession(snap)
+    const updateQueue = vi.fn(() => Promise.resolve())
+    const { getByLabelText, getByText } = render(
+      <QueueDock {...kitFor(snap, { updateQueue })} useSession={source.useSession} />,
+    )
+
+    fireEvent.click(getByLabelText('编辑排队消息'))
+    fireEvent.change(getByLabelText('编辑排队消息'), { target: { value: 'abandoned' } })
+    fireEvent.click(getByLabelText('取消编辑'))
+    expect(getByText('before')).toBeTruthy()
+
+    fireEvent.click(getByLabelText('编辑排队消息'))
+    fireEvent.keyDown(getByLabelText('编辑排队消息'), { key: 'Escape' })
+    expect(getByText('before')).toBeTruthy()
+    expect(updateQueue).not.toHaveBeenCalled()
+  })
+
+  it('keeps editing during IME composition and disables a blank save', () => {
+    const snap = snapshotWith([row('i-edit', 'before')])
+    const source = liveSession(snap)
+    const updateQueue = vi.fn(() => Promise.resolve())
+    const { getByLabelText } = render(
+      <QueueDock {...kitFor(snap, { updateQueue })} useSession={source.useSession} />,
+    )
+
+    fireEvent.click(getByLabelText('编辑排队消息'))
+    const editor = getByLabelText('编辑排队消息')
+    fireEvent.change(editor, { target: { value: '   ' } })
+    expect(getByLabelText('保存排队消息')).toHaveProperty('disabled', true)
+    fireEvent.change(editor, { target: { value: '输入中' } })
+    fireEvent.keyDown(editor, { key: 'Enter', isComposing: true })
+    expect(updateQueue).not.toHaveBeenCalled()
+    expect(getByLabelText('编辑排队消息')).toBeTruthy()
+  })
+
+  it('removes the addressed row', async () => {
+    const snap = snapshotWith([row('i-1', 'one'), row('i-2', 'two')])
+    const source = liveSession(snap)
+    const updateQueue = vi.fn(() => Promise.resolve())
+    const { getAllByLabelText } = render(
+      <QueueDock {...kitFor(snap, { updateQueue })} useSession={source.useSession} />,
+    )
+
+    fireEvent.click(getAllByLabelText('删除排队消息')[0]!)
+    await waitFor(() => {
+      expect(updateQueue).toHaveBeenCalledWith(iid('i-1'), { kind: 'remove' })
+    })
+  })
+
+  it('keeps the row and surfaces a notice when an operation loses the claim race', async () => {
+    const snap = snapshotWith([row('i-race', 'pending')])
+    const source = liveSession(snap)
+    const notify = vi.fn()
+    const updateQueue = vi.fn(() => Promise.reject(new Error('not found')))
+    const { getByLabelText, getByText } = render(
+      <QueueDock {...kitFor(snap, { updateQueue, notify })} useSession={source.useSession} />,
+    )
+
+    fireEvent.click(getByLabelText('删除排队消息'))
+    await waitFor(() => {
+      expect(notify).toHaveBeenCalledWith('error', '删除失败：这条消息可能已经开始发送。')
+    })
+    expect(getByText('pending')).toBeTruthy()
+  })
+
+  it('follows authoritative retirement back to null', () => {
+    const snap = snapshotWith([row('i-1', '在场')])
    const source = liveSession(snap)
    const { container } = render(<QueueDock {...kitFor(snap)} useSession={source.useSession} />)
    expect(container.textContent).toContain('在场')
@@ -90,11 +198,9 @@ describe('QueueDock', () => {
    expect(container.innerHTML).toBe('')
  })

-  it('ships the registrant plugin shape (list entry into conversation.input.dock)', () => {
-    // Registration itself runs under T5's slot declaration; here we pin the
-    // frozen registration surface so the wiring layer can mount it verbatim.
+  it('ships the session-scoped registrant plugin shape', () => {
    expect(queueDockEntry.name).toBe('conversation-queue-dock')
-    expect(queueDockEntry.inject).toEqual(['slots', 'conversation'])
+    expect(queueDockEntry.inject).toEqual(['slots', 'conversation', 'sessions'])
    expect(typeof queueDockEntry.apply).toBe('function')
  })
 })
--- a/packages/client/ui-conversation/tests/service-orchestration.spec.ts
+++ b/packages/client/ui-conversation/tests/service-orchestration.spec.ts
@@ -14,11 +14,12 @@ import { ConversationService } from '../src/client/service.ts'
 async function bench(readAttachment?: SessionFace['readAttachment']) {
  const runtime = await SlotTestRuntime.create()
  const prompt = vi.fn(() => Promise.resolve({ ok: true as const, value: { accepted: true as const } }))
+  const updateQueue = vi.fn(() => Promise.resolve({ ok: true as const, value: { accepted: true as const } }))
  const cancel = vi.fn(() => Promise.resolve({ ok: true as const, value: { accepted: true as const } }))
  const loadOlder = vi.fn(() => Promise.resolve())
  await runtime.sessions.add({
    id: 's1',
-    session: { prompt, cancel, loadOlder, ...(readAttachment === undefined ? {} : { readAttachment }) },
+    session: { prompt, updateQueue, cancel, loadOlder, ...(readAttachment === undefined ? {} : { readAttachment }) },
  })
  // config.input is required (the apply shares its hub with the inject
  // factories); the bench passes its own instance explicitly.
@@ -27,16 +28,18 @@ async function bench(readAttachment?: SessionFace['readAttachment']) {
  await fiber.await()
  const root = runtime.ctx.get('conversation') as ConversationService
  const scoped = runtime.sessions.scope('s1')!.get('conversation') as ConversationService
-  return { runtime, fiber, hub, root, scoped, prompt, cancel, loadOlder }
+  return { runtime, fiber, hub, root, scoped, prompt, updateQueue, cancel, loadOlder }
 }

 describe('ConversationService', () => {
  it('routes operations through the public Session binding', async () => {
    const b = await bench()
    await b.scoped.send('hello', 'steer')
+    await b.scoped.updateQueue('item-1' as never, { kind: 'remove' })
    await b.scoped.cancel()
    await b.scoped.loadOlder()
    expect(b.prompt).toHaveBeenCalledWith([{ type: 'text', text: 'hello' }], 'steer')
+    expect(b.updateQueue).toHaveBeenCalledWith('item-1', { kind: 'remove' })
    expect(b.cancel).toHaveBeenCalledOnce()
    expect(b.loadOlder).toHaveBeenCalledOnce()
    await b.runtime.dispose()
--- a/packages/client/ui-conversation/tests/skeleton.spec.tsx
+++ b/packages/client/ui-conversation/tests/skeleton.spec.tsx
@@ -28,8 +28,21 @@ function fakeWiring() {
  return { wiring: shell, sink, shell }
 }

-afterEach(cleanup)
-beforeEach(() => { localStorage.clear() })
+/** jsdom has no ResizeObserver; the composer seat publishes its height through one. */
+class ResizeObserverStub {
+  observe(): void {}
+  unobserve(): void {}
+  disconnect(): void {}
+}
+
+afterEach(() => {
+  cleanup()
+  vi.unstubAllGlobals()
+})
+beforeEach(() => {
+  localStorage.clear()
+  vi.stubGlobal('ResizeObserver', ResizeObserverStub)
+})

 const sid = (id: string) => id as SessionId
 const wid = (id: string) => id as WorkspaceId
--- a/packages/client/ui-goal/src/client/GoalBar.module.css
+++ b/packages/client/ui-goal/src/client/GoalBar.module.css
@@ -1,11 +1,12 @@
-/* GoalBar: the goal strip docked above the composer card. The dock mirrors
-   InputBar's horizontal geometry (32px side padding, 776px centered cap)
-   plus the mock's 12px inset, so the bar's edges land 12px inside the
-   composer card's edges in both the capped and the squeezed regimes. The
-   negative bottom margin eats InputBar's 8px top padding and tucks the
+/* GoalBar: the goal strip docked above the composer card. The dock's 44px
+   side padding and the bar's 752px cap match the todo strip's column
+   (TodoPanel.module.css), 24px inside the composer card's edges. The
+   negative bottom margin cancels the composer stack's 8px gap and tucks the
   bar's square bottom edge 2px under the composer card's top edge (the
-   card, later in DOM order, paints over it). All states share one fixed
-   38px height so switching between them never resizes the strip. */
+   card, later in DOM order, paints over it). Surface matches the todo
+   strip: tip fill, l1 border — no bottom edge where it disappears under the
+   card. All states share one fixed 38px height so switching between them
+   never resizes the strip. */

 .dock {
  padding: 0 44px;
@@ -20,10 +21,10 @@
  height: 38px;
  margin: 0 auto -10px;
  padding: 0 14px;
+  border: 1px solid var(--dsw-alias-border-l1);
+  border-bottom: none;
  border-radius: 14px 14px 0 0;
-  /* Translucent hover gray doubles as the mock's #F5F6F7 over the white
-     base and lifts the strip off the composer card in dark mode. */
-  background: var(--dsw-alias-interactive-bg-hover);
+  background: var(--dsw-specific-tip);
 }

 .sparkle {
--- a/packages/context/time-context/tests/time-context.spec.ts
+++ b/packages/context/time-context/tests/time-context.spec.ts
@@ -49,6 +49,7 @@ function sessionAgent(session: Session, id = 'agent'): Agent {
      session.append('user/message', input, { surfaceOp: 'append' })
    },
    send: () => {},
+    updateInbox: () => 'not-found',
    cancel() {},
    whenIdle: () => Promise.resolve(),
  }
--- a/packages/context/tmux-context/tests/tmux-context.spec.ts
+++ b/packages/context/tmux-context/tests/tmux-context.spec.ts
@@ -101,6 +101,7 @@ function sessionAgent(session: Session, id = 'agent'): Agent {
    ctx: new Context(),
    followup: () => {},
    steer: () => {},
+    updateInbox: () => 'not-found',
    inject(input) {
      session.append('user/message', input, { surfaceOp: 'append' })
    },
--- a/packages/context/workspace-context/README.i18n.yaml
+++ b/packages/context/workspace-context/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/context/workspace-context/README.md
-README.md: df75b29dd3e8dbb504aac9e9885c32a809cbf70f
-README.zh.md: 555e55464071261f5d1752b65ed6884c5452f4ae
+README.md: 2669422ec1fa7a74ba329cd96ee6b7e5e6da7e9d
+README.zh.md: e9fab4c6998f1193068389b41bdd7fa7d8c98dca
--- a/packages/context/workspace-context/README.md
+++ b/packages/context/workspace-context/README.md
@@ -42,7 +42,7 @@ These instructions apply to work under `packages/app`. Use them as guidance when
 </system-reminder>
 ```

-A same-file edit starts with `Updated instructions from: <path>` and says to use the new content instead of the previously loaded content. When a candidate disappears or becomes a per-directory duplicate of an earlier candidate, the message is `Instructions removed: <path>` followed by `The previously loaded instructions from this file no longer apply.` Literal `</system-reminder>` text inside an instruction file is escaped so file content cannot close the plugin-owned frame.
+A same-file edit starts with `Updated instructions from: <path>` and says to use the new content instead of the previously loaded content. When a candidate disappears or becomes a per-directory duplicate of an earlier candidate, the message is `Instructions removed: <path>` followed by `The previously loaded instructions from this file no longer apply.` Literal `</system-reminder>` text anywhere in instruction content or model-visible path, scope, and budget metadata is escaped so repository-controlled text cannot close the plugin-owned frame.

 The plugin owns the complete `<system-reminder>` framing, and every injected `user/message` reaches the model verbatim with no core wrapper.

--- a/packages/context/workspace-context/README.zh.md
+++ b/packages/context/workspace-context/README.zh.md
@@ -42,7 +42,7 @@ These instructions apply to work under `packages/app`. Use them as guidance when
 </system-reminder>
 ```

-同一文件的编辑以 `Updated instructions from: <path>` 开头，并说明使用新内容替代之前加载的内容。候选文件消失或成为同一目录中较早候选文件的重复项时，消息是 `Instructions removed: <path>`，后跟 `The previously loaded instructions from this file no longer apply.`。指令文件中的字面 `</system-reminder>` 文本会转义，因此文件内容无法关闭插件控制的框架。
+同一文件的编辑以 `Updated instructions from: <path>` 开头，并说明使用新内容替代之前加载的内容。候选文件消失或成为同一目录中较早候选文件的重复项时，消息是 `Instructions removed: <path>`，后跟 `The previously loaded instructions from this file no longer apply.`。指令内容或模型可见的路径、scope 与预算元数据中出现的字面 `</system-reminder>` 文本都会转义，因此仓库控制的文本无法关闭插件控制的框架。

 该插件控制完整的 `<system-reminder>` 框架，每个注入的 `user/message` 都不经核心包装便原样传给模型。

--- a/packages/context/workspace-context/src/render.ts
+++ b/packages/context/workspace-context/src/render.ts
@@ -59,15 +59,12 @@ function truncateUtf8(value: string, maxBytes: number): string {
  return truncated
 }

-function escapeInstructionContent(content: string): string {
-  // TODO(instruction-frame-paths): apply the same delimiter neutralization to
-  // every interpolated path and scope; repository-controlled names can
-  // otherwise close the plugin-owned system-reminder frame.
-  return content.replaceAll(SYSTEM_REMINDER_CLOSE, '<\\/system-reminder>')
+function escapeInstructionFrameBody(body: string): string {
+  return body.replaceAll(SYSTEM_REMINDER_CLOSE, '<\\/system-reminder>')
 }

 function sectionText(file: LoadedInstructionFile): string {
-  return `Instructions from: ${file.displayPath}\n\n${escapeInstructionContent(file.content)}`
+  return `Instructions from: ${file.displayPath}\n\n${file.content}`
 }

 /** Directory component that identifies the single user-global instruction scope. */
@@ -136,7 +133,7 @@ function additionalSectionText(file: LoadedInstructionFile): string {
    '',
    `These instructions apply to work under \`${scope}\`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.`,
    '',
-    escapeInstructionContent(file.content),
+    file.content,
  ].join('\n')
 }

@@ -153,7 +150,7 @@ function changedSectionText(item: ChangeRenderItem): string {
    '',
    'This file changed after it was loaded. Use the following content instead of the previously loaded instructions from this file.',
    '',
-    escapeInstructionContent(file.content),
+    file.content,
  ].join('\n')
 }

@@ -214,7 +211,7 @@ function buildInstructionText(
  // producer's content (the pattern a future `meta`-driven renderer would
  // generalize — see the deferred note in
  // ../../../../.agents/notes/implemented/simplification/2026-07-20-unwrap-injected-content-envelopes.md).
-  return [SYSTEM_REMINDER_OPEN, body.join('\n\n'), SYSTEM_REMINDER_CLOSE].join('\n')
+  return [SYSTEM_REMINDER_OPEN, escapeInstructionFrameBody(body.join('\n\n')), SYSTEM_REMINDER_CLOSE].join('\n')
 }

 function withTruncatedContent(file: LoadedInstructionFile, includedBytes: number): LoadedInstructionFile {
@@ -285,8 +282,10 @@ function renderInstructionContext(
    originalBytes: byteLength(mostSpecific.content),
    includedBytes: 0,
  }]
-  const compactNotice = markerText(maxBytes, omitted, truncated)
-  const compactWithHeading = [compactNotice, style.section(withTruncatedContent(mostSpecific, 0))].join('\n\n')
+  const compactNotice = escapeInstructionFrameBody(markerText(maxBytes, omitted, truncated))
+  const compactWithHeading = escapeInstructionFrameBody(
+    [compactNotice, style.section(withTruncatedContent(mostSpecific, 0))].join('\n\n'),
+  )
  if (byteLength(compactWithHeading) <= maxBytes) return { text: compactWithHeading, omitted, truncated }
  const text = byteLength(compactNotice) <= maxBytes ? compactNotice : truncateUtf8(compactNotice, maxBytes)
  return { text, omitted, truncated }
--- a/packages/context/workspace-context/tests/workspace-context.spec.ts
+++ b/packages/context/workspace-context/tests/workspace-context.spec.ts
@@ -41,7 +41,7 @@ import {
  type InstructionVersionCache,
  type PendingInstructionChange,
 } from '../src/state.ts'
-import { candidateScopeKey } from '../src/render.ts'
+import { candidateScopeKey, renderInstructionChanges } from '../src/render.ts'
 import { MockAdapter, textResponse, toolCallResponse } from '../../../core/agent-loop/tests/mock-adapter.ts'

 /** Per-candidate reconciliation scope key: directory paired with the file name. */
@@ -184,6 +184,7 @@ function stubAgent(cwd?: string, seed: SessionEvent[] = []): Agent {
      session.append('user/message', input, { surfaceOp: 'append' })
    },
    send: () => {},
+    updateInbox: () => 'not-found',
    cancel() {},
    whenIdle: () => Promise.resolve(),
  }
@@ -681,6 +682,37 @@ describe('workspace context rendering', () => {
    expect(rendered.text).toContain('<\\/system-reminder>')
  })

+  it('neutralizes system-reminder closing delimiters in paths and derived scopes', () => {
+    const displayPath = 'scope</system-reminder>/AGENTS.md'
+    const file = { absolutePath: `/repo/${displayPath}`, displayPath, content: 'rules' }
+    const rendered = [
+      renderWorkspaceContext([file], { maxBytes: 65536 }).text,
+      ...(['set', 'replace', 'remove'] as const).map(action => renderInstructionChanges([{
+        change: { action, scope: 'scope</system-reminder>\0AGENTS.md', path: displayPath },
+        file,
+      }], 65536).text),
+    ]
+
+    for (const text of rendered) {
+      expect(text.match(/<\/system-reminder>/g)).toHaveLength(1)
+      expect(text).toContain('scope<\\/system-reminder>')
+    }
+  })
+
+  it('neutralizes a system-reminder closing delimiter in budget marker paths', () => {
+    const rendered = renderWorkspaceContext([
+      {
+        absolutePath: '/repo/scope</system-reminder>/AGENTS.md',
+        displayPath: 'scope</system-reminder>/AGENTS.md',
+        content: 'root '.repeat(100),
+      },
+      { absolutePath: '/repo/leaf/AGENTS.md', displayPath: 'leaf/AGENTS.md', content: 'leaf rules' },
+    ], { maxBytes: 400 })
+
+    expect(rendered.text).toContain('omitted scope<\\/system-reminder>/AGENTS.md')
+    expect(rendered.text.match(/<\/system-reminder>/g)).toHaveLength(1)
+  })
+
  it('preserves more specific files under the byte budget and names omitted/truncated paths', () => {
    const rendered = renderWorkspaceContext([
      { absolutePath: '/repo/AGENTS.md', displayPath: 'AGENTS.md', content: 'root '.repeat(100) },
--- a/packages/cordis/tool-cordis/src/api-catalog.ts
+++ b/packages/cordis/tool-cordis/src/api-catalog.ts
@@ -1168,24 +1168,31 @@ export const EVENT_API: readonly EventApiEntry[] = [
  {
    name: 'agent/inbox/dequeue',
    mode: 'emit',
-    signature: '\'agent/inbox/dequeue\'( this: Scoped<Agent>, agent: Agent, message: UserMessage, placement: InboxPlacement, ): void',
-    jsDoc: '/**\n * The driver claimed one item out of the inbox: a queued item at a turn\n * boundary, or steering drained between steps. Fires after the item leaves\n * its FIFO and before it becomes a durable message.\n * @param agent - the agent whose inbox item was claimed.\n * @param message - the claimed message.\n * @param placement - the FIFO that claimed this occurrence; together with\n *   `message.id`, it matches the earliest outstanding enqueue in that FIFO.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
+    signature: '\'agent/inbox/dequeue\'(this: Scoped<Agent>, agent: Agent, item: InboxItem): void',
+    jsDoc: '/**\n * The driver claimed one item out of the inbox: a queued item at a turn\n * boundary, or steering drained between steps. Fires after the item leaves\n * its FIFO and before it becomes a durable message.\n * @param agent - the agent whose inbox item was claimed.\n * @param item - the exact claimed occurrence.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
    summary: 'The driver claimed one item out of the inbox: a queued item at a turn boundary, or steering drained between steps.',
  },
  {
    name: 'agent/inbox/discard',
    mode: 'emit',
-    signature: '\'agent/inbox/discard\'(this: Scoped<Agent>, agent: Agent, messages: UserMessage[]): void',
-    jsDoc: '/**\n * Pending inbox items were dropped without delivering them, so every\n * enqueue occurrence receives exactly one terminal `agent/inbox/dequeue` OR\n * `agent/inbox/discard`. `cancel()` without `keepInbox`, including disposal,\n * emits this after `agent/cancel-requested` when applicable and before\n * aborting the active work. Fires once per drop with every dropped item.\n * @param agent - the agent whose inbox items were dropped.\n * @param messages - the discarded messages in FIFO order (queued then steering); never empty.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
+    signature: '\'agent/inbox/discard\'(this: Scoped<Agent>, agent: Agent, items: InboxItem[]): void',
+    jsDoc: '/**\n * Pending inbox items were dropped without delivering them, so every\n * enqueue occurrence receives exactly one terminal `agent/inbox/dequeue` OR\n * `agent/inbox/discard`. `cancel()` without `keepInbox`, including disposal,\n * emits this after `agent/cancel-requested` when applicable and before\n * aborting the active work. Fires once per drop with every dropped item.\n * @param agent - the agent whose inbox items were dropped.\n * @param items - the discarded occurrences in FIFO order (queued then steering); never empty.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
    summary: 'Pending inbox items were dropped without delivering them, so every enqueue occurrence receives exactly one terminal `agent/inbox/dequeue` OR `agent/inbox/discard`.',
  },
  {
    name: 'agent/inbox/enqueue',
    mode: 'emit',
-    signature: '\'agent/inbox/enqueue\'(this: Scoped<Agent>, agent: Agent, message: UserMessage, placement: InboxPlacement): void',
-    jsDoc: '/**\n * An item entered the queued or steering inbox. `placement` is the\n * acceptance-time routing result; listeners must not reconstruct it from\n * later agent or session state.\n * @param agent - the owning agent.\n * @param message - accepted content, source, and correlation identity.\n * @param placement - resolved queued or steering placement.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
+    signature: '\'agent/inbox/enqueue\'(this: Scoped<Agent>, agent: Agent, item: InboxItem): void',
+    jsDoc: '/**\n * An item entered the queued or steering inbox. `placement` is the\n * acceptance-time routing result; listeners must not reconstruct it from\n * later agent or session state.\n * @param agent - the owning agent.\n * @param item - accepted occurrence, message, and resolved placement.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
    summary: 'An item entered the queued or steering inbox.',
  },
+  {
+    name: 'agent/inbox/update',
+    mode: 'emit',
+    signature: '\'agent/inbox/update\'(this: Scoped<Agent>, agent: Agent, item: InboxItem): void',
+    jsDoc: '/**\n * A still-pending queued item changed content. The item id, placement, and\n * position remain stable while the event carries the replacement message.\n * @param agent - the owning agent.\n * @param item - the complete post-update occurrence.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
+    summary: 'A still-pending queued item changed content.',
+  },
  {
    name: 'agent/prompt-submit',
    mode: 'waterfall',
@@ -1472,7 +1479,7 @@ export const EVENT_API: readonly EventApiEntry[] = [
 export const TYPE_API: readonly TypeApiEntry[] = [
  {
    name: 'Agent',
-    declaration: 'export interface Agent {\n    readonly id: SessionId;\n    readonly options: AgentOptions;\n    readonly session: Session;\n    readonly status: AgentStatus;\n    readonly acceptsNextStep: boolean;\n    readonly ctx: Context;\n    send(message: UserMessage, options: SendOptions): void;\n    cancel(cause: AgentCancelCause, options?: CancelOptions): void;\n    whenIdle(): Promise<void>;\n    followup(message: UserMessage): void;\n    steer(message: UserMessage): void;\n    inject(message: UserMessage): void;\n}',
+    declaration: 'export interface Agent {\n    readonly id: SessionId;\n    readonly options: AgentOptions;\n    readonly session: Session;\n    readonly status: AgentStatus;\n    readonly acceptsNextStep: boolean;\n    readonly ctx: Context;\n    send(message: UserMessage, options: SendOptions): void;\n    updateInbox(id: InboxItemId, action: InboxAction): InboxActionResult;\n    cancel(cause: AgentCancelCause, options?: CancelOptions): void;\n    whenIdle(): Promise<void>;\n    followup(message: UserMessage): void;\n    steer(message: UserMessage): void;\n    inject(message: UserMessage): void;\n}',
  },
  {
    name: 'AgentCancelCause',
@@ -1882,6 +1889,18 @@ export const TYPE_API: readonly TypeApiEntry[] = [
    name: 'ImageMediaType',
    declaration: 'export type ImageMediaType = \'image/png\' | \'image/jpeg\' | \'image/webp\' | \'image/gif\';',
  },
+  {
+    name: 'InboxAction',
+    declaration: 'export type InboxAction = {\n    readonly kind: \'edit\';\n    readonly content: ContentBlock[];\n} | {\n    readonly kind: \'remove\';\n};',
+  },
+  {
+    name: 'InboxActionResult',
+    declaration: 'export type InboxActionResult = \'applied\' | \'not-found\';',
+  },
+  {
+    name: 'InboxItemId',
+    declaration: 'export type InboxItemId = Branded<\'InboxItemId\'>;',
+  },
  {
    name: 'InvariantFailure',
    declaration: 'export type InvariantFailure = (message: string) => never;',
--- a/packages/core/agent-loop/README.i18n.yaml
+++ b/packages/core/agent-loop/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/core/agent-loop/README.md
-README.md: 16d70cc06498fec1221b7872f988a0126f69f39f
-README.zh.md: ce68595072766ebbf1e4cbd9f7c262cee36c5eff
+README.md: a1617a1ef871f61157e0d70a06d055168170dced
+README.zh.md: 6ba945a41e700331929dabb557802c14256921fb
--- a/packages/core/agent-loop/README.md
+++ b/packages/core/agent-loop/README.md
@@ -55,7 +55,9 @@ Configured agents start automatically. A model call requires both `provider` and

 The concrete `ReactLoopAgent`, its queued input, outbox, and run controls are package-internal. The package root exports only the plugin/service/config contract, and the package exports map exposes no `./src/*` escape hatch; lifecycle owners create agents through `ctx.agents` rather than naming, constructing, or starting driver internals. One prepared session can be claimed by only one concrete driver, and everything observable happens through session events and the `agent/*` event taxonomy.

-The unified `send()` primitive routes content and source by (`target` × `wakeup`); `followup`/`steer`/`inject` are its fixed-preset aliases. A `next-turn` item joins the queued FIFO, waking the driver unless `wakeup: false`; admission happens before any turn opens. The loop opens a private next-step acceptance window before `agent/prompt-submit` and closes it before `turn/end`. During that window, `steer()` and `inject()` stage in one outbox; an allowed admission opens the turn, records the prompt and returned `additionalContexts`, then drains the staged input before the first request. A blocked or failed admission writes no prompt or hook-produced context. A caller-staged context-only batch then takes idle injection's immediate append, while steering and context staged beside it remain pending for retry or a later admitted prompt. Outside the window, steering becomes a waking queued prompt and injection immediately appends `user/message` without opening a turn or running the model. Every inbox enqueue publishes `agent/inbox/enqueue` with the resolved queued-or-steering placement; taking it publishes `agent/inbox/dequeue` with the same placement, and `cancel()` without `keepInbox` publishes `agent/inbox/discard`.
+The unified `send()` primitive routes content and source by (`target` × `wakeup`); `followup`/`steer`/`inject` are its fixed-preset aliases. A `next-turn` item joins the queued FIFO, waking the driver unless `wakeup: false`; admission happens before any turn opens. The loop opens a private next-step acceptance window before `agent/prompt-submit` and closes it before `turn/end`. During that window, `steer()` and `inject()` stage in one outbox; an allowed admission opens the turn, records the prompt and returned `additionalContexts`, then drains the staged input before the first request. A blocked or failed admission writes no prompt or hook-produced context. A caller-staged context-only batch then takes idle injection's immediate append, while steering and context staged beside it remain pending for retry or a later admitted prompt. Outside the window, steering becomes a waking queued prompt and injection immediately appends `user/message` without opening a turn or running the model.
+
+Every FIFO acceptance mints an `InboxItemId` and publishes `agent/inbox/enqueue` with the complete occurrence. `updateInbox()` owns the synchronous queued-item boundary: edit freezes replacement content without changing message identity or position, while remove publishes discard. Edit publishes `agent/inbox/update`; steering and claimed occurrences return `not-found`. Claim publishes `agent/inbox/dequeue` and irrevocably removes the live address before prompt admission, so a racing update cannot rewrite durable history; `cancel()` without `keepInbox` publishes `agent/inbox/discard`.

 ### Loop lifecycle (`agent.ts`)

--- a/packages/core/agent-loop/README.zh.md
+++ b/packages/core/agent-loop/README.zh.md
@@ -55,7 +55,9 @@ interface Config {

 实体 `ReactLoopAgent`、其排队输入、outbox 与运行控制均为包内部实现。包根只导出插件／服务／配置契约，包导出映射不提供 `./src/*` 逃逸路径；生命周期拥有方通过 `ctx.agents` 创建 agent，而不是点名、构造或启动驱动器内部组件。一个准备完成的会话只能由一个实体驱动器认领；所有可观测行为都通过会话事件和 `agent/*` 事件分类体系发生。

-统一的 `send()` 原语按（`target` × `wakeup`）路由内容与来源；`followup`/`steer`/`inject` 是它的固定预设别名。`next-turn` 项加入排队 FIFO，除非 `wakeup: false`，否则会唤醒驱动器；接纳发生在任何轮次开启之前。循环在 `agent/prompt-submit` 之前打开一个私有的 next-step 接收窗口，并在 `turn/end` 之前关闭它。在该窗口内，`steer()` 与 `inject()` 会暂存到同一个 outbox；接纳获准后会开启轮次，记录提示词及其返回的 `additionalContexts`，再于首次请求前排空暂存输入。接纳被阻止或失败时，不会写入提示词或钩子生成的上下文。之后，仅含调用方暂存上下文的批次会采用空闲注入的立即追加行为，而 steering（中途引导）及与其一同暂存的上下文则继续待处理，以供重试或之后获准的提示词使用。窗口之外，steering 会成为唤醒驱动器的排队提示词，而注入会立即追加 `user/message`，不开启轮次也不运行模型。每次 inbox 入队都会发布 `agent/inbox/enqueue`，并携带解析出的 queued 或 steering 路由归类；取走它会发布 `agent/inbox/dequeue`，并携带相同的路由归类；`cancel()` 在不带 `keepInbox` 时会发布 `agent/inbox/discard`。
+统一的 `send()` 原语按（`target` × `wakeup`）路由内容与来源；`followup`/`steer`/`inject` 是它的固定预设别名。`next-turn` 项加入排队 FIFO，除非 `wakeup: false`，否则会唤醒驱动器；接纳发生在任何轮次开启之前。循环在 `agent/prompt-submit` 之前打开一个私有的 next-step 接收窗口，并在 `turn/end` 之前关闭它。在该窗口内，`steer()` 与 `inject()` 会暂存到同一个 outbox；接纳获准后会开启轮次，记录提示词及其返回的 `additionalContexts`，再于首次请求前排空暂存输入。接纳被阻止或失败时，不会写入提示词或钩子生成的上下文。之后，仅含调用方暂存上下文的批次会采用空闲注入的立即追加行为，而 steering（中途引导）及与其一同暂存的上下文则继续待处理，以供重试或之后获准的提示词使用。窗口之外，steering 会成为唤醒驱动器的排队提示词，而注入会立即追加 `user/message`，不开启轮次也不运行模型。
+
+每次 FIFO 接受项时都会铸造一个 `InboxItemId`，并通过 `agent/inbox/enqueue` 发布完整的单次入队项。`updateInbox()` 持有同步 queued 项边界：编辑会冻结替换内容，但不改变消息标识或位置；移除会发布 discard。编辑会发布 `agent/inbox/update`；steering 项和已被认领的项会返回 `not-found`。认领操作会发布 `agent/inbox/dequeue`，并在提示词接纳前不可逆地移除实时寻址标识，因此竞态中的更新无法改写持久历史；`cancel()` 在不带 `keepInbox` 时会发布 `agent/inbox/discard`。

 ### 循环生命周期（`agent.ts`）

--- a/packages/core/agent-loop/src/agent.ts
+++ b/packages/core/agent-loop/src/agent.ts
@@ -8,13 +8,18 @@
 */

 import type { Context } from 'cordis'
-import { agentCarrier, assembleContextFor, emitAgentEvent } from '@deepseek-ai/dsh-agent'
+import { randomUUID } from 'node:crypto'
+import { agentCarrier, assembleContextFor, emitAgentEvent, InboxItemId } from '@deepseek-ai/dsh-agent'
 import { createScope } from '@deepseek-ai/dsh-scope'
 import type { Scope } from '@deepseek-ai/dsh-scope'
 import type {
  Agent,
  CancelOptions,
  AgentInterruptReason,
+  InboxAction,
+  InboxActionResult,
+  InboxItem,
+  InboxItemId as InboxItemIdType,
  InboxPlacement,
  AgentOptions,
  AgentStatus,
@@ -55,9 +60,9 @@ type StepOutcome =
 */
 export class ReactLoopAgent implements Agent {
  /** Prompts awaiting individual turns. */
-  private queued: { message: UserMessage; wakeup: boolean }[] = []
+  private queued: { item: InboxItem; wakeup: boolean }[] = []
  /** Input taken into the session log at step boundaries. */
-  private outbox: { message: UserMessage; steering: boolean }[] = []
+  private outbox: { message: UserMessage; steering: boolean; item?: InboxItem }[] = []

  /** Whether observers see a running interval; consecutive turns share it. */
  private busy = false
@@ -115,16 +120,52 @@ export class ReactLoopAgent implements Agent {
    }

    const placement: InboxPlacement = target === 'next-step' && this.acceptsNextStep ? 'steering' : 'queued'
+    const item: InboxItem = Object.freeze({
+      id: InboxItemId(randomUUID()),
+      message,
+      placement,
+    })
    if (placement === 'steering') {
-      this.outbox.push({ message, steering: true })
+      this.outbox.push({ message, steering: true, item })
    } else {
-      this.queued.push({ message, wakeup })
+      this.queued.push({ item, wakeup })
    }
    // Preserve the routing decision for every send in this synchronous caller
    // stack, while installing quiescence ownership before enqueue observers
    // can cancel or dispose.
    if (placement === 'queued' && wakeup) this.scheduleKick()
-    emitAgentEvent(this.loopCtx, this, 'agent/inbox/enqueue', message, placement)
+    emitAgentEvent(this.loopCtx, this, 'agent/inbox/enqueue', item)
+  }
+
+  /** Apply one synchronous mutation to a still-pending queued occurrence. */
+  updateInbox(id: InboxItemIdType, action: InboxAction): InboxActionResult {
+    const queuedIndex = this.queued.findIndex(candidate => candidate.item.id === id)
+    if (queuedIndex === -1) return 'not-found'
+
+    const pending = this.queued[queuedIndex]
+    /* v8 ignore next -- the index was resolved from this array without an async boundary. */
+    if (pending === undefined) throw new Error(`agent "${this.id}" queued item disappeared during update`)
+
+    /* v8 ignore next -- InboxAction is a closed discriminated union; all variants are covered below. */
+    switch (action.kind) {
+      case 'edit': {
+        const item: InboxItem = Object.freeze({
+          ...pending.item,
+          message: freezeMessage({ ...pending.item.message, content: action.content }),
+        })
+        this.queued[queuedIndex] = { ...pending, item }
+        emitAgentEvent(this.loopCtx, this, 'agent/inbox/update', item)
+        return 'applied'
+      }
+      case 'remove': {
+        this.queued.splice(queuedIndex, 1)
+        emitAgentEvent(this.loopCtx, this, 'agent/inbox/discard', [pending.item])
+        return 'applied'
+      }
+      default:
+        /* v8 ignore next -- InboxAction is a closed discriminated union. */
+        return assertNever(action)
+    }
  }

  /** Queue one ordinary prompt turn and wake the driver. */
@@ -169,9 +210,9 @@ export class ReactLoopAgent implements Agent {
      if (cause.kind !== 'disposed') emitAgentEvent(this.loopCtx, this, 'agent/cancel-requested', cause)
    }
    if (!options.keepInbox) {
-      const discarded = this.queued.map(item => item.message)
+      const discarded = this.queued.map(item => item.item)
      for (const item of this.outbox) {
-        if (item.steering) discarded.push(item.message)
+        if (item.steering && item.item !== undefined) discarded.push(item.item)
      }
      // Clear before abort observers run: replacement work belongs to the next turn.
      this.queued.length = 0
@@ -222,7 +263,8 @@ export class ReactLoopAgent implements Agent {
    // The some() guard above proves the queue is non-empty; the non-null
    // assertion expresses that invariant.
    // oxlint-disable-next-line typescript/no-non-null-assertion
-    const { message } = this.queued.shift()!
+    const { item } = this.queued.shift()!
+    const { message } = item
    const inheritedOutboxLength = this.outbox.length

    const admission = new AbortController()
@@ -293,7 +335,7 @@ export class ReactLoopAgent implements Agent {
    // Published only after the abort owner and pending done are installed: a
    // dequeue listener that cancels or disposes must find live cancellation
    // and quiescence ownership, not the previous activity's settled state.
-    emitAgentEvent(this.loopCtx, this, 'agent/inbox/dequeue', message, 'queued')
+    emitAgentEvent(this.loopCtx, this, 'agent/inbox/dequeue', item)
  }

  /**
@@ -643,7 +685,9 @@ export class ReactLoopAgent implements Agent {
    for (const item of this.outbox.splice(0, limit)) {
      if (item.steering) {
        steered = true
-        emitAgentEvent(this.loopCtx, this, 'agent/inbox/dequeue', item.message, 'steering')
+        /* v8 ignore next -- only inbox-backed steer entries carry steering:true. */
+        if (item.item === undefined) throw new Error(`agent "${this.id}" steering outbox item has no inbox identity`)
+        emitAgentEvent(this.loopCtx, this, 'agent/inbox/dequeue', item.item)
        this.session.append(
          'steering/message',
          { turn, message: item.message },
--- a/packages/core/agent-loop/tests/contract-regressions.spec.ts
+++ b/packages/core/agent-loop/tests/contract-regressions.spec.ts
@@ -4,7 +4,7 @@ import LlmService, { createUserMessage, CallId, MessageSource, ProviderRequestId
 import SessionStore, { Session, SessionEvent, SessionId, TurnEndReason } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry, { defineContentToolFixture, type PostToolDecision } from '@deepseek-ai/dsh-tools'
-import AgentRegistry, { type Agent, type InboxPlacement } from '@deepseek-ai/dsh-agent'
+import AgentRegistry, { type Agent, type InboxItem, type InboxPlacement } from '@deepseek-ai/dsh-agent'
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
 import { ReactLoopAgent } from '../src/agent.ts'
 import InvariantService from '@deepseek-ai/dsh-invariants'
@@ -53,6 +53,111 @@ function send(agent: Agent, text: string) {
  agent.followup(createUserMessage({ content: [{ type: 'text', text }], source: { kind: 'user' } }))
 }

+function inboxText(item: InboxItem): string {
+  return item.message.content
+    .flatMap(block => block.type === 'text' ? [block.text] : [])
+    .join('')
+}
+
+describe('addressable inbox operations', () => {
+  it('edits in place and removes exactly one queued item', async () => {
+    const adapter = new MockAdapter([
+      textResponse('first reply'),
+      textResponse('edited reply'),
+    ])
+    const ctx = await harness(adapter)
+    const agent = ctx.agentLoop.create(SessionId('inbox-actions'), { provider: 'mock', model: 'mock' })
+    const admission = Promise.withResolvers<undefined>()
+    const release = Promise.withResolvers<undefined>()
+    ctx.on('agent/prompt-submit', async (_subject, message, _signal, next) => {
+      if (message.content[0]?.type === 'text' && message.content[0].text === 'first') {
+        admission.resolve(undefined)
+        await release.promise
+      }
+      return next()
+    })
+
+    const pending: InboxItem[] = []
+    const updates: { id: string; text: string }[] = []
+    const discards: string[][] = []
+    ctx.on('agent/inbox/enqueue', (subject, item) => {
+      if (subject === agent && inboxText(item) !== 'first') pending.push(item)
+    })
+    ctx.on('agent/inbox/update', (subject, item) => {
+      if (subject === agent) updates.push({ id: item.id, text: inboxText(item) })
+    })
+    ctx.on('agent/inbox/discard', (subject, items) => {
+      if (subject === agent) discards.push(items.map(item => item.id))
+    })
+
+    send(agent, 'first')
+    await admission.promise
+    send(agent, 'remove me')
+    send(agent, 'edit me')
+    expect(pending.map(inboxText)).toEqual(['remove me', 'edit me'])
+
+    const remove = pending[0]!
+    const edit = pending[1]!
+    expect(agent.updateInbox(edit.id, {
+      kind: 'edit',
+      content: [{ type: 'text', text: 'edited' }],
+    })).toBe('applied')
+    expect(agent.updateInbox(remove.id, { kind: 'remove' })).toBe('applied')
+    expect(updates).toEqual([{ id: edit.id, text: 'edited' }])
+    expect(discards).toEqual([[remove.id]])
+
+    const idle = waitForIdle(ctx, agent)
+    release.resolve(undefined)
+    await idle
+    expect(agent.session.events
+      .filter(event => event.type === 'user/message')
+      .map(event => event.type === 'user/message'
+        ? event.data.content.flatMap(block => block.type === 'text' ? [block.text] : []).join('')
+        : ''))
+      .toEqual(['first', 'edited'])
+    expect(agent.updateInbox(edit.id, { kind: 'remove' })).toBe('not-found')
+  })
+
+  it('does not mutate steering occurrences', async () => {
+    const adapter = new MockAdapter([textResponse('done')])
+    const ctx = await harness(adapter)
+    const agent = ctx.agentLoop.create(SessionId('steering-inbox-actions'), { provider: 'mock', model: 'mock' })
+    const entered = Promise.withResolvers<undefined>()
+    const decision = Promise.withResolvers<{ kind: 'allow' }>()
+    ctx.on('agent/prompt-submit', async () => {
+      entered.resolve(undefined)
+      return decision.promise
+    })
+
+    const pending: InboxItem[] = []
+    ctx.on('agent/inbox/enqueue', (subject, item) => {
+      if (subject === agent && item.placement === 'steering') pending.push(item)
+    })
+
+    const idle = waitForIdle(ctx, agent)
+    send(agent, 'admitted prompt')
+    await entered.promise
+    agent.steer(createUserMessage({ content: [{ type: 'text', text: 'keep me' }], source: { kind: 'user' } }))
+    expect(pending.map(inboxText)).toEqual(['keep me'])
+
+    const steering = pending[0]!
+    expect(agent.updateInbox(steering.id, {
+      kind: 'edit',
+      content: [{ type: 'text', text: 'edited' }],
+    })).toBe('not-found')
+    expect(agent.updateInbox(steering.id, { kind: 'remove' })).toBe('not-found')
+
+    decision.resolve({ kind: 'allow' })
+    await idle
+    expect(agent.session.events
+      .filter(event => event.type === 'steering/message')
+      .map(event => event.type === 'steering/message'
+        ? event.data.message.content.flatMap(block => block.type === 'text' ? [block.text] : []).join('')
+        : ''))
+      .toEqual(['keep me'])
+  })
+})
+
 describe('assistant replay provenance', () => {
  it('records adapter replay state with the assembled assistant content', async () => {
    const response = textResponse('unchanged')
@@ -502,10 +607,10 @@ describe('adapter registration, routing, and accepted-input ownership', () => {
    const queuedSources: MessageSource[] = []
    const queuedShapes: string[][] = []
    const placements: InboxPlacement[] = []
-    ctx.on('agent/inbox/enqueue', (_agent, message, placement) => {
-      queuedSources.push(message.source)
-      queuedShapes.push(Object.keys(message).sort())
-      placements.push(placement)
+    ctx.on('agent/inbox/enqueue', (_agent, item) => {
+      queuedSources.push(item.message.source)
+      queuedShapes.push(Object.keys(item.message).sort())
+      placements.push(item.placement)
    })

    send(agent, 'go') // no explicit source → default {kind:'user'} must be visible
--- a/packages/core/agent-loop/tests/interception.spec.ts
+++ b/packages/core/agent-loop/tests/interception.spec.ts
@@ -86,8 +86,9 @@ describe('agent/prompt-submit', () => {
    const entered = Promise.withResolvers<undefined>()
    const decision = Promise.withResolvers<PromptDecision>()
    const observed: UserMessage[] = []
-    ctx.on('agent/inbox/enqueue', (subject, message) => {
+    ctx.on('agent/inbox/enqueue', (subject, item) => {
      if (subject !== agent) return
+      const message = item.message
      expect(Object.isFrozen(message)).toBe(true)
      expect(Object.isFrozen(message.content)).toBe(true)
      expect(Object.isFrozen(message.content[0])).toBe(true)
@@ -97,8 +98,8 @@ describe('agent/prompt-submit', () => {
        if (block?.type === 'text') block.text = 'listener mutation'
      }).toThrow()
    })
-    ctx.on('agent/inbox/enqueue', (subject, message) => {
-      if (subject === agent) observed.push(message)
+    ctx.on('agent/inbox/enqueue', (subject, item) => {
+      if (subject === agent) observed.push(item.message)
    })
    ctx.on('agent/prompt-submit', async () => {
      entered.resolve(undefined)
@@ -240,8 +241,8 @@ describe('agent/prompt-submit', () => {
      entered.resolve(undefined)
      return decision.promise
    })
-    ctx.on('agent/inbox/enqueue', (subject, _message, placement) => {
-      if (subject === agent) placements.push(placement)
+    ctx.on('agent/inbox/enqueue', (subject, item) => {
+      if (subject === agent) placements.push(item.placement)
    })

    const idle = waitForIdle(ctx, agent)
--- a/packages/core/agent-loop/tests/loop.spec.ts
+++ b/packages/core/agent-loop/tests/loop.spec.ts
@@ -59,6 +59,20 @@ describe('agent loop', () => {
    },
  )

+  it('seeds a valid AgentOptions.maxTokens into the first model request', async () => {
+    const adapter = new MockAdapter([textResponse('bounded')])
+    const ctx = await harness(adapter)
+    const agent = ctx.agentLoop.create(
+      SessionId('valid-max-tokens'),
+      { provider: 'mock', model: 'mock', maxTokens: 256 },
+    )
+
+    send(agent, 'use the configured output limit')
+    await waitForIdle(ctx, agent)
+
+    expect(adapter.requests[0]?.maxTokens).toBe(256)
+  })
+
  it('runs a simple turn: queued message → model → idle, with ordered events', async () => {
    const adapter = new MockAdapter([textResponse('hello there')])
    const ctx = await harness(adapter)
--- a/packages/core/agent/README.i18n.yaml
+++ b/packages/core/agent/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/core/agent/README.md
-README.md: 9ca79f28506b133a555bd7d1e984386c715fd9d6
-README.zh.md: a32f75431a6d7ced64ae2f2171b6aa924d23de3e
+README.md: 6bd5279ace93b6d2569833be6f102c854105c2eb
+README.zh.md: cdbb0c0b70124e0037a0f7a7a03ddedf1e3b78d3
--- a/packages/core/agent/README.md
+++ b/packages/core/agent/README.md
@@ -60,7 +60,8 @@ Turn and step boundaries and the model token stream are durable `session/event`

 The handle every plugin programs against:

- `agent.send(message, options)` — the one delivery primitive over the (`target` × `wakeup`) matrix. `message` is an already identified, frozen `UserMessage`; callers normally create it with `createUserMessage()` before routing begins. `SendOptions` owns only the `target` and `wakeup` policy. The agent publishes or queues the complete value as-is without minting or replacing its identity. The message's `agent/inbox/enqueue`/`dequeue`/`discard` events carry it so callers can correlate a queued item with its lifecycle; enqueue and dequeue also carry the resolved `queued | steering` placement so repeated message identities retire from the correct FIFO. `target: 'next-turn'` queues one independent FIFO item that, if admitted, becomes the sole ordinary prompt in its turn. `target: 'next-step'` with `wakeup: true` submits steering, while `target: 'next-step'` with `wakeup: false` injects durable context without running the model. The [one-send-one-turn Agent Note](../../../.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.md) owns the turn rationale.
+- `agent.send(message, options)` — the one delivery primitive over the (`target` × `wakeup`) matrix. `message` is an already identified, frozen `UserMessage`; callers normally create it with `createUserMessage()` before routing begins. `SendOptions` owns only the `target` and `wakeup` policy. Each accepted FIFO occurrence receives its own `InboxItemId`, even when callers reuse a `MessageId`; `agent/inbox/enqueue`/`update` and the terminal `dequeue` or `discard` carry that complete `InboxItem`. `target: 'next-turn'` queues one independent FIFO item that, if admitted, becomes the sole ordinary prompt in its turn. `target: 'next-step'` with `wakeup: true` submits steering, while `target: 'next-step'` with `wakeup: false` injects durable context without running the model. The [one-send-one-turn Agent Note](../../../.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.md) owns the turn rationale.
+- `agent.updateInbox(itemId, action)` — synchronously edits or removes one still-pending queued occurrence. Edit keeps its `MessageId`, `InboxItemId`, source, and FIFO position while replacing frozen content; remove emits the occurrence's terminal discard. Steering and claimed occurrences return `not-found`.
 - `agent.followup(input)` — the `next-turn`/wakeup preset of `send()`: queue an ordinary follow-up turn and wake the driver.
 - `agent.steer(input)` — the `next-step`/wakeup preset: during prompt admission or an open turn, stage steering for the next safe boundary without dispatching `agent/prompt-submit`; outside that acceptance window, delegate to a woken follow-up. Admission failure leaves staged steering for retry or a later admitted prompt, while cancellation or disposal may discard it.
 - `agent.inject(input)` — the `next-step`/no-wakeup preset: append model-facing context without running the model; the next request sees a verbatim user-role message whose provenance is carried by the required `input.source`. During prompt admission or an open turn, injection waits in the outbox for the next safe boundary. Outside that acceptance window, it appends immediately without opening a turn; a context-only admission batch takes this fallback if admission closes without a turn, while context staged beside steering remains pending with it. Persistence reacts to `session/event` independently. Injection emits no `agent/inbox/*` event.
--- a/packages/core/agent/README.zh.md
+++ b/packages/core/agent/README.zh.md
@@ -60,7 +60,8 @@ Agent *创建* 由实现 `AgentFactory` 的插件（`dsh-agent-loop`）提供，

 每个插件面向的 handle：

- `agent.send(message, options)`：覆盖（`target` × `wakeup`）矩阵的唯一投递原语。`message` 是已有标识且已冻结的 `UserMessage`；调用方通常会在开始路由前使用 `createUserMessage()` 创建它。`SendOptions` 只持有 `target` 与 `wakeup` 策略。agent 会原样发布或排队完整值，不会生成或替换其标识。该消息的 `agent/inbox/enqueue`/`dequeue`/`discard` 事件会携带完整消息，调用方可据此把排队项与其生命周期关联；入队与出队事件还会携带解析出的 `queued | steering` 路由归类，使重复出现的消息标识能在正确的 FIFO 中完成结算。`target: 'next-turn'` 在 FIFO 中排入一个独立项，获准后成为其轮次中唯一的普通提示词。`target: 'next-step'` 且 `wakeup: true` 提交 steering（中途引导），而 `target: 'next-step'` 且 `wakeup: false` 注入持久上下文，不运行模型。轮次原理由 [one-send-one-turn Agent Note](../../../.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.md)拥有。
+- `agent.send(message, options)`：覆盖（`target` × `wakeup`）矩阵的唯一投递原语。`message` 是已有标识且已冻结的 `UserMessage`；调用方通常会在开始路由前使用 `createUserMessage()` 创建它。`SendOptions` 只持有 `target` 与 `wakeup` 策略。每次获准进入 FIFO 的项都会获得独立的 `InboxItemId`，即使调用方复用了同一个 `MessageId`；`agent/inbox/enqueue`／`update` 及终态 `dequeue` 或 `discard` 都会携带这一完整 `InboxItem`。`target: 'next-turn'` 排队一条独立 FIFO 项，获准后成为其轮次中唯一的普通提示词。`target: 'next-step'` 且 `wakeup: true` 提交 steering（中途引导），而 `target: 'next-step'` 且 `wakeup: false` 注入持久上下文，不运行模型。轮次原理由 [one-send-one-turn Agent Note](../../../.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.md)拥有。
+- `agent.updateInbox(itemId, action)`：同步编辑或移除一个仍处于待处理状态的 queued 入队项。编辑会替换已冻结的内容，同时保留其 `MessageId`、`InboxItemId`、来源与 FIFO 位置；移除会发出该项的终态 discard。steering 项和已被认领的项会返回 `not-found`。
 - `agent.followup(input)`：`send()` 的 `next-turn`／wakeup 预设：排队一个普通后续轮次并唤醒驱动器。
 - `agent.steer(input)`：`next-step`／wakeup 预设：提示词接纳期间或轮次打开时，为下一个安全边界暂存 steering，且不分发 `agent/prompt-submit`；该接收窗口之外则委托给会唤醒的后续轮次。接纳失败会保留暂存的 steering，以供重试或之后获准的提示词使用，而取消或 dispose 可能丢弃它。
 - `agent.inject(input)`：`next-step`／不唤醒预设：追加面向模型的上下文而不运行模型；下一次请求会看到一条逐字的 user role 消息，其来源由必填的 `input.source` 携带。提示词接纳期间或轮次打开时，注入会在 outbox 中等待下一个安全边界。该接收窗口之外，它会立即追加而不开启轮次；如果接纳结束却未开启轮次，仅含上下文的接纳批次会采用这一回退，而与 steering 一同暂存的上下文则会随其继续待处理。持久化独立地响应 `session/event`。注入不发出 `agent/inbox/*` 事件。
--- a/packages/core/agent/package.json
+++ b/packages/core/agent/package.json
@@ -15,12 +15,17 @@
      "types": "./lib/types/invariant.d.ts",
      "default": "./lib/invariant.js"
    },
+    "./brand": {
+      "types": "./lib/types/brand.d.ts",
+      "default": "./lib/types/brand.js"
+    },
    "./src/*": "./src/*",
    "./package.json": "./package.json"
  },
  "files": [
    "lib/index.js",
    "lib/invariant.js",
+    "lib/types/**/*.js",
    "lib/types/**/*.d.ts",
    "lib/types/**/*.d.ts.map",
    "src"
--- a/packages/core/agent/src/brand.ts
+++ b/packages/core/agent/src/brand.ts
@@ -0,0 +1,23 @@
+/**
+ * dsh-agent's owned branded ids for live inbox occurrences.
+ *
+ * @module @deepseek-ai/dsh-agent/brand
+ */
+
+import type { Branded } from '@deepseek-ai/dsh-brand'
+
+/**
+ * Identifies one accepted occurrence in an agent inbox. Re-sending the same
+ * message creates a distinct item id, so pending work remains independently
+ * addressable.
+ */
+export type InboxItemId = Branded<'InboxItemId'>
+
+/**
+ * Brand a string as an {@link InboxItemId}.
+ * @param id - the agent-loop-minted occurrence identifier.
+ * @returns the same string, branded; no validation is performed.
+ */
+export function InboxItemId(id: string): InboxItemId {
+  return id as InboxItemId
+}
--- a/packages/core/agent/src/index.ts
+++ b/packages/core/agent/src/index.ts
@@ -15,6 +15,7 @@ import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session'
 import type { Agent, AgentOptions } from './types.ts'

 export * from './types.ts'
+export * from './brand.ts'
 export * from './llm-target.ts'
 export { agentCarrier, agentEvents, assembleContextFor, emitAgentEvent } from './dispatch.ts'
 export type { AgentEventDispatch, AgentSubjectEvent } from './dispatch.ts'
--- a/packages/core/agent/src/types.ts
+++ b/packages/core/agent/src/types.ts
@@ -9,6 +9,7 @@ import type { Context } from 'cordis'
 import type { Scoped } from '@deepseek-ai/dsh-scope'
 import type { ContentBlock, LlmCallConfig, LlmFailure, ResolvedRetryPolicy } from '@deepseek-ai/dsh-llm'
 import type { Session, SessionId, UserMessage } from '@deepseek-ai/dsh-session'
+import type { InboxItemId } from './brand.ts'
 import type {} from '@deepseek-ai/dsh-system-prompt'
 declare module '@deepseek-ai/dsh-system-prompt' {
  interface AssembleContext {
@@ -39,6 +40,24 @@ export type SendTarget = 'next-turn' | 'next-step'
 /** Resolved inbox placement reported when an accepted message is enqueued. */
 export type InboxPlacement = 'queued' | 'steering'

+/** One independently addressable accepted occurrence in an agent inbox. */
+export interface InboxItem {
+  /** Agent-loop-minted occurrence identity. */
+  readonly id: InboxItemId
+  /** Identified message delivered by the caller. */
+  readonly message: UserMessage
+  /** Acceptance-time FIFO classification. */
+  readonly placement: InboxPlacement
+}
+
+/** A user-requested mutation of one still-pending queued occurrence. */
+export type InboxAction =
+  | { readonly kind: 'edit'; readonly content: ContentBlock[] }
+  | { readonly kind: 'remove' }
+
+/** Result of applying an inbox action at the synchronous ownership boundary. */
+export type InboxActionResult = 'applied' | 'not-found'
+
 /**
 * Options for the unified {@link Agent.send} primitive over the
 * (`target` × `wakeup`) matrix. Named presets: {@link Agent.followup}
@@ -159,6 +178,16 @@ export interface Agent {
   */
  send(message: UserMessage, options: SendOptions): void

+  /**
+   * Mutate one still-pending queued occurrence synchronously. Editing preserves
+   * the message identity and queue position; removal publishes its terminal
+   * discard. Steering occurrences and driver-claimed items return `not-found`.
+   * @param id - independently addressable queued occurrence.
+   * @param action - edit or remove operation.
+   * @returns whether the pending occurrence was found and updated.
+   */
+  updateInbox(id: InboxItemId, action: InboxAction): InboxActionResult
+
  /**
   * Clear queued and steering work — unless `keepInbox` — and abort the active
   * turn. An effective call first emits `agent/cancel-requested` with the
@@ -242,29 +271,30 @@ declare module 'cordis' {
     * acceptance-time routing result; listeners must not reconstruct it from
     * later agent or session state.
     * @param agent - the owning agent.
-     * @param message - accepted content, source, and correlation identity.
-     * @param placement - resolved queued or steering placement.
+     * @param item - accepted occurrence, message, and resolved placement.
     * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.
     * @mode emit
     */
-    'agent/inbox/enqueue'(this: Scoped<Agent>, agent: Agent, message: UserMessage, placement: InboxPlacement): void
+    'agent/inbox/enqueue'(this: Scoped<Agent>, agent: Agent, item: InboxItem): void
+    /**
+     * A still-pending queued item changed content. The item id, placement, and
+     * position remain stable while the event carries the replacement message.
+     * @param agent - the owning agent.
+     * @param item - the complete post-update occurrence.
+     * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.
+     * @mode emit
+     */
+    'agent/inbox/update'(this: Scoped<Agent>, agent: Agent, item: InboxItem): void
    /**
     * The driver claimed one item out of the inbox: a queued item at a turn
     * boundary, or steering drained between steps. Fires after the item leaves
     * its FIFO and before it becomes a durable message.
     * @param agent - the agent whose inbox item was claimed.
-     * @param message - the claimed message.
-     * @param placement - the FIFO that claimed this occurrence; together with
-     *   `message.id`, it matches the earliest outstanding enqueue in that FIFO.
+     * @param item - the exact claimed occurrence.
     * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.
     * @mode emit
     */
-    'agent/inbox/dequeue'(
-      this: Scoped<Agent>,
-      agent: Agent,
-      message: UserMessage,
-      placement: InboxPlacement,
-    ): void
+    'agent/inbox/dequeue'(this: Scoped<Agent>, agent: Agent, item: InboxItem): void
    /**
     * Pending inbox items were dropped without delivering them, so every
     * enqueue occurrence receives exactly one terminal `agent/inbox/dequeue` OR
@@ -272,11 +302,11 @@ declare module 'cordis' {
     * emits this after `agent/cancel-requested` when applicable and before
     * aborting the active work. Fires once per drop with every dropped item.
     * @param agent - the agent whose inbox items were dropped.
-     * @param messages - the discarded messages in FIFO order (queued then steering); never empty.
+     * @param items - the discarded occurrences in FIFO order (queued then steering); never empty.
     * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.
     * @mode emit
     */
-    'agent/inbox/discard'(this: Scoped<Agent>, agent: Agent, messages: UserMessage[]): void
+    'agent/inbox/discard'(this: Scoped<Agent>, agent: Agent, items: InboxItem[]): void
    /**
     * Effective broad cancellation was requested, before queued/outbox work
     * is cleared or the active turn is aborted. This observe-only notification
--- a/packages/core/agent/tests/agent.spec.ts
+++ b/packages/core/agent/tests/agent.spec.ts
@@ -24,6 +24,7 @@ function stubAgent(rawId: string, overrides: Partial<Agent> = {}): Agent {
    acceptsNextStep: false,
    ctx: new Context(),
    send: () => {},
+    updateInbox: () => 'not-found',
    followup: () => {},
    steer: () => {},
    inject: () => {},
--- a/packages/core/agent/tests/invariant.spec.ts
+++ b/packages/core/agent/tests/invariant.spec.ts
@@ -1,7 +1,7 @@
 import { freezeMessage, MessageId } from '@deepseek-ai/dsh-llm'
 import { describe, expect, it } from 'vitest'
 import { Context } from 'cordis'
-import { type Agent } from '@deepseek-ai/dsh-agent'
+import { InboxItemId, type Agent, type InboxItem, type InboxPlacement } from '@deepseek-ai/dsh-agent'
 import * as AgentInvariant from '@deepseek-ai/dsh-agent/invariant'
 import { scopeTarget } from '@deepseek-ai/dsh-scope'
 import InvariantService from '@deepseek-ai/dsh-invariants'
@@ -46,11 +46,16 @@ describe('agent status invariants', () => {
 })

 describe('agent inbox invariants', () => {
-  const info = () => freezeMessage({
-    id: MessageId('m'),
-    role: 'user' as const,
-    content: [],
-    source: { kind: 'user' as const },
+  let nextItem = 0
+  const info = (placement: InboxPlacement = 'queued'): InboxItem => ({
+    id: InboxItemId(`i-${nextItem++}`),
+    message: freezeMessage({
+      id: MessageId('m'),
+      role: 'user' as const,
+      content: [],
+      source: { kind: 'user' as const },
+    }),
+    placement,
  })

  it('accepts a dequeue and a discard covered by prior enqueues', async () => {
@@ -58,9 +63,9 @@ describe('agent inbox invariants', () => {
    const agent = mockAgent('i1')
    const at = scopeTarget(agent, agent)
    expect(() => {
-      ctx.emit(at, 'agent/inbox/enqueue', agent, info(), 'queued')
-      ctx.emit(at, 'agent/inbox/enqueue', agent, info(), 'steering')
-      ctx.emit(at, 'agent/inbox/dequeue', agent, info(), 'queued')
+      ctx.emit(at, 'agent/inbox/enqueue', agent, info())
+      ctx.emit(at, 'agent/inbox/enqueue', agent, info('steering'))
+      ctx.emit(at, 'agent/inbox/dequeue', agent, info())
      ctx.emit(at, 'agent/inbox/discard', agent, [info()])
    }).not.toThrow()
  })
@@ -68,7 +73,7 @@ describe('agent inbox invariants', () => {
  it('rejects a dequeue with no outstanding item', async () => {
    const ctx = await setup()
    const agent = mockAgent('i2')
-    expect(() => { ctx.emit(scopeTarget(agent, agent), 'agent/inbox/dequeue', agent, info(), 'queued') })
+    expect(() => { ctx.emit(scopeTarget(agent, agent), 'agent/inbox/dequeue', agent, info()) })
      .toThrow(/without a matching prior enqueue/)
  })

@@ -76,7 +81,7 @@ describe('agent inbox invariants', () => {
    const ctx = await setup()
    const agent = mockAgent('i3')
    const at = scopeTarget(agent, agent)
-    ctx.emit(at, 'agent/inbox/enqueue', agent, info(), 'queued')
+    ctx.emit(at, 'agent/inbox/enqueue', agent, info())
    expect(() => { ctx.emit(at, 'agent/inbox/discard', agent, [info(), info()]) })
      .toThrow(/dropped 2 items but only 1 were outstanding/)
  })
--- a/packages/core/scope/src/scoped-events.generated.ts
+++ b/packages/core/scope/src/scoped-events.generated.ts
@@ -15,6 +15,7 @@ const scopedSubjectResolvers: Readonly<Record<string, ScopedSubjectResolver | nu
  'agent/inbox/dequeue': args => args[0],
  'agent/inbox/discard': args => args[0],
  'agent/inbox/enqueue': args => args[0],
+  'agent/inbox/update': args => args[0],
  'agent/prompt-submit': args => args[0],
  'agent/request': args => args[0],
  'agent/request-error': args => args[0],
--- a/packages/core/scope/tests/invariant.spec.ts
+++ b/packages/core/scope/tests/invariant.spec.ts
@@ -2,7 +2,7 @@ import { freezeMessage, MessageId } from '@deepseek-ai/dsh-llm'
 import { describe, expect, it } from 'vitest'
 import { Context } from 'cordis'
 import type { Events } from 'cordis'
-import { type Agent } from '@deepseek-ai/dsh-agent'
+import { InboxItemId, type Agent } from '@deepseek-ai/dsh-agent'
 import { scopeTarget } from '@deepseek-ai/dsh-scope'
 import * as ScopeInvariant from '@deepseek-ai/dsh-scope/invariant'
 import InvariantService from '@deepseek-ai/dsh-invariants'
@@ -44,12 +44,14 @@ describe('scoped-dispatch invariants', () => {
      content: [],
      source: { kind: 'user' },
    })
+    const item = { id: InboxItemId('i'), message, placement: 'queued' as const }
    const agentRows = {
      'agent/created': [agent],
      'agent/disposed': [agent],
      'agent/status': [agent, 'idle'],
-      'agent/inbox/enqueue': [agent, message, 'queued'],
-      'agent/inbox/dequeue': [agent, message, 'queued'],
+      'agent/inbox/enqueue': [agent, item],
+      'agent/inbox/update': [agent, item],
+      'agent/inbox/dequeue': [agent, item],
      'agent/inbox/discard': [agent, []],
      'agent/cancel-requested': [agent, { kind: 'user' }],
      'agent/session-start': [agent, 'startup'],
--- a/packages/experimental/AGENTS.md
+++ b/packages/experimental/AGENTS.md
@@ -0,0 +1,11 @@
+# AGENTS.md — Experimental and internal packages
+
+These rules supplement the [package rules](../AGENTS.md). The [experimental and internal package group decision](../../.agents/notes/implemented/architecture/2026-07-28-experimental-plugin-package-group.md) owns the rationale.
+
+- All Cordis plugin packages whose whole public contract is experimental or internal-only belong here. An experimental option inside an otherwise stable package stays in that package's product-role group.
+- Use this directory to share engineering and product-manager prototypes across the team so others can discover, run, review, and extend them against the real plugin graph.
+- Official releases exclude this directory. A package enters a release only after moving to its product-role group; do not add packages here to release manifests or bundles.
+- Experimental packages carry no stability, compatibility, migration, or support promise. Internal-only packages may define narrower internal contracts but make no public release promise.
+- Experimental or internal-only status never relaxes repository engineering, security, documentation, lifecycle, testing, or snapshot requirements.
+- Release packages must not take runtime dependencies on packages here. Examples may; every other runtime dependent is also experimental or internal-only and belongs here. Tests may use them as development dependencies.
+- Promotion moves a package to its product-role group without renaming its `@deepseek-ai/dsh-*` package. Require explicit review of its public contract, limitations, test evidence, and a named owner accepting stable-package obligations.
--- a/packages/experimental/README.i18n.yaml
+++ b/packages/experimental/README.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/experimental/README.md
+README.md: db39af8bb1b1bcfd257e16e4ad1dd112f604ffb1
+README.zh.md: df9b8cb2a91faab7af782e0f53685368e99583ff
--- a/packages/experimental/README.md
+++ b/packages/experimental/README.md
@@ -0,0 +1,7 @@
+# experimental/ — experimental and internal packages
+
+English | [中文](README.zh.md)
+
+This group hosts team-shared engineering and product-manager prototypes plus internal-only Cordis plugins. It is excluded from official releases; packages move to their product-role group before release.
+
+No packages live here yet. The [subtree rules](AGENTS.md) define the no-warranty, dependency, and promotion boundaries.
--- a/packages/experimental/README.zh.md
+++ b/packages/experimental/README.zh.md
@@ -0,0 +1,7 @@
+# experimental/：实验性与内部专用包（package）
+
+[English](README.md) | 中文
+
+该分组容纳工程人员与产品经理在团队内共享的原型，以及内部专用 Cordis 插件。该分组不纳入官方发布版本；包在发布前移入对应的产品角色分组。
+
+该分组尚未包含任何包。[子树规则](AGENTS.md)界定不作保证、依赖关系和提升机制的边界。
--- a/packages/goal/command-goal/tests/command-goal.spec.ts
+++ b/packages/goal/command-goal/tests/command-goal.spec.ts
@@ -38,6 +38,7 @@ function stubAgent(ctx: Context, id: string): { agent: Agent; session: Session }
    get status() { return status },
    get acceptsNextStep() { return status === 'running' },
    send: () => {},
+    updateInbox: () => 'not-found',
    followup: () => {},
    steer: () => {},
    inject(input) { appendInjection(session, input) },
--- a/packages/goal/goal-session/src/index.ts
+++ b/packages/goal/goal-session/src/index.ts
@@ -307,10 +307,10 @@ export function apply(ctx: Context): void {
        requestDrive(state)
      }
    })
-    ctx.on('agent/inbox/enqueue', (agent, info) => {
+    ctx.on('agent/inbox/enqueue', (agent, item) => {
      const state = stateFor(agent)
      const attempt = state.attempt
-      if (attempt !== undefined && sameQueued(info.content, info.source, attempt)) return
+      if (attempt !== undefined && sameQueued(item.message.content, item.message.source, attempt)) return
      state.competingQueued = true
      if (attempt?.phase === 'queued') attempt.stale = true
    })
--- a/packages/goal/goal-session/tests/goal-session.spec.ts
+++ b/packages/goal/goal-session/tests/goal-session.spec.ts
@@ -287,7 +287,7 @@ describe('same-session goal driving', () => {
  it('pauses and drops a reserved round when cancellation lands before admission', async () => {
    const test = await harness([])
    const cancel = test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent === test.agent && info.source.kind === 'goal') {
+      if (agent === test.agent && info.message.source.kind === 'goal') {
        cancel()
        agent.cancel({ kind: 'user' })
      }
@@ -340,7 +340,7 @@ describe('same-session goal driving', () => {
    test.ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof test.ctx.logger.warn
    let inserted = false
    test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent !== test.agent || info.source.kind !== 'goal' || inserted) return
+      if (agent !== test.agent || info.message.source.kind !== 'goal' || inserted) return
      inserted = true
      const lastStart = agent.session.events.findLast(event => event.type === 'turn/start')
      const turn = (lastStart?.data.turn ?? 0) + 1
@@ -363,7 +363,7 @@ describe('same-session goal driving', () => {
    const test = await harness([textResponse('human batch'), textResponse('later goal')])
    let inserted = false
    test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent !== test.agent || info.source.kind !== 'goal' || inserted) return
+      if (agent !== test.agent || info.message.source.kind !== 'goal' || inserted) return
      inserted = true
      agent.followup(createUserMessage({ content: [{ type: 'text', text: 'human joined the pending batch' }], source: { kind: 'user' } }))
    })
@@ -381,7 +381,7 @@ describe('same-session goal driving', () => {
    const test = await harness([textResponse('new revision')])
    let edited = false
    test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent !== test.agent || info.source.kind !== 'goal' || edited) return
+      if (agent !== test.agent || info.message.source.kind !== 'goal' || edited) return
      edited = true
      const current = test.ctx.goals.get(agent)
      if (current === undefined) throw new Error('missing goal during queued edit')
@@ -661,7 +661,7 @@ describe('same-session goal driving', () => {
    const test = await harness([textResponse('retry after containment')])
    let armed = true
    test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent !== test.agent || info.source.kind !== 'goal' || !armed) return
+      if (agent !== test.agent || info.message.source.kind !== 'goal' || !armed) return
      armed = false
      vi.spyOn(test.ctx.goals, 'get').mockImplementationOnce(() => {
        throw new Error('admission projection failed')
@@ -737,7 +737,7 @@ describe('same-session goal driving', () => {
  it('falls back to disarming when a cancelled reservation cannot be paused', async () => {
    const test = await harness([])
    const cancel = test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent !== test.agent || info.source.kind !== 'goal') return
+      if (agent !== test.agent || info.message.source.kind !== 'goal') return
      cancel()
      vi.spyOn(test.ctx.goals, 'pause').mockImplementationOnce(() => {
        throw new Error('pause failed')
@@ -791,7 +791,7 @@ describe('same-session goal driving', () => {
    const test = await harness([])
    let unloading: Promise<void> | undefined
    test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent === test.agent && info.source.kind === 'goal' && unloading === undefined) {
+      if (agent === test.agent && info.message.source.kind === 'goal' && unloading === undefined) {
        unloading = Promise.resolve(test.driver.dispose())
      }
    })
--- a/packages/goal/goal/tests/goal.spec.ts
+++ b/packages/goal/goal/tests/goal.spec.ts
@@ -48,6 +48,7 @@ function stubAgentForSession(session: Session): StubAgent {
    get status() { return status },
    get acceptsNextStep() { return status === 'running' },
    send: () => {},
+    updateInbox: () => 'not-found',
    followup: () => {},
    steer: () => {},
    inject(input) {
--- a/packages/goal/goal/tests/projection.spec.ts
+++ b/packages/goal/goal/tests/projection.spec.ts
@@ -39,6 +39,7 @@ function liveAgent(ctx: Context, session: Session): Agent {
    get status() { return status },
    get acceptsNextStep() { return false },
    send: () => {},
+    updateInbox: () => 'not-found',
    followup: () => {},
    steer: () => {},
    inject(input: UserMessage) {
--- a/packages/goal/tool-goal/tests/tool-goal.spec.ts
+++ b/packages/goal/tool-goal/tests/tool-goal.spec.ts
@@ -33,6 +33,7 @@ function stubAgent(rawId: string, supplied?: Session): StubAgent {
    get acceptsNextStep() { return status === 'running' },
    ctx: new Context(),
    send: () => {},
+    updateInbox: () => 'not-found',
    followup: () => {},
    steer: () => {},
    inject(input) {
--- a/packages/hooks/README.i18n.yaml
+++ b/packages/hooks/README.i18n.yaml
@@ -3,4 +3,4 @@
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/hooks/README.md
 README.md: 23478fb5e9b813a3370ce465104b1f9db8b0a26a
-README.zh.md: 41024a8bd268550aa07401fd8b21c74db0914796
+README.zh.md: 741300a9a390a8f254c01733e5326be84541a78d
--- a/packages/hooks/README.zh.md
+++ b/packages/hooks/README.zh.md
@@ -10,4 +10,4 @@ hooks 子系统让用户可以像使用 Claude Code 和 Codex 一样，在 agent
 | `hooks-claude/` | Claude Code `hooks.json`／settings 的桥接 | 插件 |
 | `hooks-codex/` | Codex `hooks.json` 的桥接 | 插件 |

-Codex 有意重新实现 Claude Code 协议的一个*子集*（`hooks.json` 结构相同、5 个事件而非 CC 的众多事件、仅命令、仅正则表达式 matcher、没有 env／替换），因此 `hook-protocol` 负责真正相同的原语，每个桥接只负责不同部分（逐事件 stdin 载荷、env，以及把 hook 的中性结果映射到 harness 类型化 Decision 的方式）。参见 [hook-protocol/README.md](hook-protocol/README.md)。
+Codex 有意重新实现 Claude Code 协议的一个*子集*（`hooks.json` 结构相同、5 个事件而非 CC 的众多事件、仅命令、仅使用正则的 matcher、没有 env／替换），因此 `hook-protocol` 负责真正相同的原语，每个桥接只负责不同部分（逐事件 stdin 载荷、env，以及把 hook 的中性结果映射到 harness 类型化 Decision 的方式）。参见 [hook-protocol/README.md](hook-protocol/README.md)。
--- a/packages/hooks/hook-protocol/README.i18n.yaml
+++ b/packages/hooks/hook-protocol/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/hooks/hook-protocol/README.md
-README.md: 10cfcdcbf819f318f2ccaf412ae04bba60812397
-README.zh.md: 9862d4f332e0e82fb6479fcadf9376403fb9bef8
+README.md: 8cf4b95c95d43b8fbc27bbdcaf727dabf7d96805
+README.zh.md: 15a537b67677a401ab434a3e73af1973030780c0
--- a/packages/hooks/hook-protocol/README.md
+++ b/packages/hooks/hook-protocol/README.md
@@ -10,7 +10,7 @@ Why a shared lib at all: Codex deliberately reimplements a *subset* of the Claud

 | Concern | Here (`dsh-hook-protocol`) | The bridge (`dsh-hooks-claude` / `-codex`) |
 |---|---|---|
-| Matcher test | `matchesMatcher(pattern, query, mode)` — literal-or-regex by `mode` | picks its `mode` (`claude` = literal-or-regex, `codex` = always regex) |
+| Matcher validation + test | `matcherDiagnostic(pattern, mode)` for parse-time diagnostics; `matchesMatcher(pattern, query, mode)` for contained runtime matching | picks its `mode` (`claude` = literal-or-regex, `codex` = always regex) and rejects a config group carrying a diagnostic |
 | Run a hook | `runHook(bash, hook, opts, now)` — stdin payload + env via `ctx.bash`, decode | builds the per-event stdin **payload** + the dialect's **env** |
 | Decode output | `parseHookOutput(exit, stdout, stderr)` → neutral `HookOutput` | maps the neutral `HookOutput` onto a seam-specific typed Decision |
 | Merge N hooks | `mergeHookOutputs(outputs)` → most-restrictive `MergedHookOutcome` | — |
@@ -19,7 +19,7 @@ Why a shared lib at all: Codex deliberately reimplements a *subset* of the Claud

 ## Primitives

- **`matchesMatcher(matcher, query, mode)`** — match-all on absent/`''`/`'*'`; `claude` mode treats a pure `[A-Za-z0-9_|]+` pattern as a literal (pipe = exact-match alternation) and anything else as a regex; `codex` mode is always an unanchored regex. An invalid regex matches nothing (never throws).
+- **`matcherDiagnostic(matcher, mode)` / `matchesMatcher(matcher, query, mode)`** — match-all on absent/`''`/`'*'`; `claude` mode treats a pure `[A-Za-z0-9_|]+` pattern as a literal (pipe = exact-match alternation) and anything else as a regex; `codex` mode is always an unanchored regex. Bridge parsers discard matcher fields for events without matcher subjects, then use `matcherDiagnostic` to reject an invalid consumed regex with a stable diagnostic before registering any hooks. The runtime predicate still contains an invalid pattern as a non-match, so a direct library caller cannot throw into the agent loop.
 - **`runHook(bash, hook, options, now)`** — require and forward the caller-owned `options.signal`, serialize `options.payload` to the hook's stdin (with a trailing newline iff `options.trailingNewline`), merge `options.env` after the executor's credential scrub (the `dsh-bash` trusted-plugin surface), honor the hook's `timeoutSec` (else `options.defaultTimeoutMs` — the bridge owns the default, its config defaulting to the lib's `DEFAULT_HOOK_TIMEOUT_MS` 10-minute reference), and decode the result (threading `options.expectedEventName` to the codec). Cancellation therefore reaches the executor's process-group kill and join boundary. Never throws: an executor rejection (infra fault) becomes a `HookOutput` with `exitCode: undefined` (a non-blocking error). `now` is injected for testable durations.
 - **`parseHookOutput(exitCode, stdout, stderr, expectedEventName?)`** decodes exit status and structured stdout. Exit 2 blocks with stderr; other failures are non-blocking. A matching hook-specific permission decision overrides the legacy top-level decision; mismatched or missing event discriminators suppress only event-specific fields. Top-level fields remain event-agnostic, and successful non-JSON output is left to the bridge.
 - **`mergeHookOutputs(outputs)`** — fold the results of every hook that matched one point: permission precedence **deny > ask > allow**, halt sticky on the first `continue:false`, block reasons joined with `\n\n`, `additionalContext`/`systemMessages` accumulated in order.
@@ -42,4 +42,3 @@ No direct invalidation; the named consumer owns any request-prefix changes.
 ## Known Limitations and Deferred Work

 - **`HookOutput.updatedInput` is parsed but not honored** — input rewrite is a deferred consistency-design problem ([the pre-tool-input-rewrite Agent Note](../../../.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.md)); a bridge logs + warns when a hook sets it. See `src/types.ts` for the full contracts.
- **An invalid matcher regex matches nothing, silently** — `matchesMatcher` never throws; surfacing the error needs a diagnostic-returning variant or parse-time validation (`TODO(matcher-diagnostics)`).
--- a/packages/hooks/hook-protocol/README.zh.md
+++ b/packages/hooks/hook-protocol/README.zh.md
@@ -10,7 +10,7 @@ Claude Code／Codex hook 协议格式（wire format）的**共享核心**。它

 | 关注点 | 此处（`dsh-hook-protocol`） | 桥接（`dsh-hooks-claude` / `-codex`） |
 |---|---|---|
-| Matcher 测试 | `matchesMatcher(pattern, query, mode)`：根据 `mode` 使用字面匹配或正则匹配 | 选择自身 `mode`（`claude` = 字面或正则，`codex` = 始终使用正则） |
+| Matcher 校验 + 测试 | `matcherDiagnostic(pattern, mode)` 用于解析时诊断；`matchesMatcher(pattern, query, mode)` 用于隔离的运行时匹配 | 选择自身的 `mode`（`claude` = 字面量或正则，`codex` = 始终使用正则），并拒绝带有诊断的配置组 |
 | 运行 hook | `runHook(bash, hook, opts, now)`：通过 `ctx.bash` 提供 stdin payload + env，再解码 | 构造每个事件的 stdin **payload** + 该方言的 **env** |
 | 解码输出 | `parseHookOutput(exit, stdout, stderr)` → 中性 `HookOutput` | 将中性 `HookOutput` 映射到 seam 特定的类型化 Decision |
 | 合并 N 个 hook | `mergeHookOutputs(outputs)` → 最严格的 `MergedHookOutcome` | （无） |
@@ -19,7 +19,7 @@ Claude Code／Codex hook 协议格式（wire format）的**共享核心**。它

 ## 原语

- **`matchesMatcher(matcher, query, mode)`**：缺失、`''` 或 `'*'` 时匹配全部；`claude` 模式将纯 `[A-Za-z0-9_|]+` pattern 视为字面值（pipe = 精确匹配交替），其他 pattern 视为正则；`codex` 模式始终使用未锚定正则。无效正则不匹配任何内容（绝不抛出异常）。
+- **`matcherDiagnostic(matcher, mode)` / `matchesMatcher(matcher, query, mode)`**：缺失、`''` 或 `'*'` 时匹配全部；`claude` mode 将纯 `[A-Za-z0-9_|]+` pattern 视为字面量（管道符 = 精确匹配多选），其他 pattern 视为正则；`codex` mode 始终使用未锚定正则。桥接解析器会丢弃没有 matcher 匹配对象的事件所带字段，再用 `matcherDiagnostic` 拒绝事件实际使用的无效正则，并在注册任何钩子之前给出稳定诊断。运行时谓词仍会将无效 pattern 隔离为不匹配，因此直接调用本库不会向 agent loop（智能体循环）抛异常。
 - **`runHook(bash, hook, options, now)`**：要求并转发调用方拥有的 `options.signal`，将 `options.payload` 序列化到 hook stdin（当且仅当 `options.trailingNewline` 时添加尾随换行符），在执行器凭证清理后合并 `options.env`（`dsh-bash` 受信任插件接口），遵循 hook 的 `timeoutSec`（否则使用 `options.defaultTimeoutMs`；默认值属于桥接，其配置默认为 lib 的 `DEFAULT_HOOK_TIMEOUT_MS` 10 分钟参考值），再解码结果（将 `options.expectedEventName` 传递给 codec）。因此取消会到达执行器的进程组终止与 join 边界。它绝不抛出异常：执行器拒绝（基础设施故障）会变为 `HookOutput`，其 `exitCode: undefined`（非阻塞错误）。`now` 会被注入，以便测试持续时间。
 - **`parseHookOutput(exitCode, stdout, stderr, expectedEventName?)`** 解码退出状态与结构化 stdout。退出码为 2 时，会以 stderr 内容阻止执行；其他失败不阻塞。匹配的 hook 特定权限决策会覆盖遗留顶层决策；事件判别字段不匹配或缺失只会抑制事件特定字段。顶层字段仍与事件无关，成功但非 JSON 的输出会留给桥接处理。
 - **`mergeHookOutputs(outputs)`**：折叠在一个点上匹配的每个 hook 结果：权限优先级为 **deny > ask > allow**，从首个 `continue:false` 起，halt 状态保持不变，阻塞原因用 `\n\n` 连接，`additionalContext`／`systemMessages` 按顺序累积。
@@ -29,7 +29,7 @@ Claude Code／Codex hook 协议格式（wire format）的**共享核心**。它

 通过 declaration merging 合并到 `SessionEventMap`（仅日志，与 `compact/*` 相同；不是 `SurfaceEventType`，没有 `surfaceOp`）：`hook/invoked`（hook 命令已运行）与 `hook/result`（其结果，按 `handlerId` 配对，决策规则由 `appendHookResult` 负责）。Payload 与每事件 JSDoc 位于生成的 [持久化日志事件目录](../../../docs/persistence-catalog.md)；`stderrSummary` 会截断到记录的 `stderrSummaryMaxChars`（桥接配置，参考默认值 `DEFAULT_STDERR_SUMMARY_MAX_CHARS` = 500；为空时省略）。

-Hook 溯源记录必须位于一个尚未结束的轮次内。轮次中的点（`PreToolUse`／`PostToolUse`／`Stop`）按构造满足这条由所有者定义的关系。`SessionStart` 与轮次前的 `UserPromptSubmit` 准入 seam 没有 `hook/*` 记录；获准的上下文改由其带来源的 `user/message` 作为证据，详见 hooks Agent Note（agent 决策记录）。
+Hook 溯源记录必须位于一个尚未结束的轮次内。轮次中的点（`PreToolUse`／`PostToolUse`／`Stop`）按构造满足这条由所有者定义的关系。`SessionStart` 与轮次前的 `UserPromptSubmit` 准入 seam 没有 `hook/*` 记录；获准的上下文改由其带来源的 `user/message` 作为证据，详见 hooks Agent Note。

 ## 模型体验

@@ -42,4 +42,3 @@ Hook 溯源记录必须位于一个尚未结束的轮次内。轮次中的点（
 ## 已知限制与暂缓事项

 - **`HookOutput.updatedInput` 会被解析但不会应用**：输入改写是已暂缓的一致性设计问题（见 [pre-tool-input-rewrite Agent Note](../../../.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.md)）；当 hook 设置它时，桥接会记录 + 警告。完整契约见 `src/types.ts`。
- **无效 matcher 正则会静默地不匹配任何内容**：`matchesMatcher` 绝不抛出异常；显示该错误需要返回诊断的变体或解析时验证（`TODO(matcher-diagnostics)`）。
--- a/packages/hooks/hook-protocol/src/index.ts
+++ b/packages/hooks/hook-protocol/src/index.ts
@@ -13,7 +13,7 @@ export type {
  MatcherGroup,
  MatcherMode,
 } from './types.ts'
-export { matchesMatcher } from './matcher.ts'
+export { matcherDiagnostic, matchesMatcher } from './matcher.ts'
 export { parseHookOutput } from './codec.ts'
 export { DEFAULT_HOOK_TIMEOUT_MS, runHook } from './runner.ts'
 export type { RunHookOptions, RunHookResult } from './runner.ts'
--- a/packages/hooks/hook-protocol/src/matcher.ts
+++ b/packages/hooks/hook-protocol/src/matcher.ts
@@ -2,7 +2,8 @@
 * Matcher shared by both hook dialects. Claude treats alphanumeric/underscore/
 * pipe patterns as literal alternatives and other patterns as regex; Codex
 * treats every non-empty pattern as an unanchored regex. Missing, empty, and
- * `*` match all; invalid regexes silently match nothing.
+ * `*` match all. Runtime matching contains invalid regexes as non-matches;
+ * config parsers use {@link matcherDiagnostic} to reject them with a diagnostic.
 * @module @deepseek-ai/dsh-hook-protocol/matcher
 */

@@ -16,10 +17,37 @@ function isMatchAll(matcher: string | undefined): boolean {
 /** A Claude-literal pattern is purely word chars + `|` (the regex-vs-literal discriminator). */
 const CLAUDE_LITERAL = /^[A-Za-z0-9_|]+$/

+/** Compile an unanchored matcher regex; invalid patterns return `undefined`. */
+function compileRegex(pattern: string): RegExp | undefined {
+  try {
+    return new RegExp(pattern)
+  } catch (_syntaxError) {
+    // RegExp construction is the try's only operation, so malformed pattern
+    // syntax is the only expected failure.
+    return undefined
+  }
+}
+
+/**
+ * Validate one matcher before a bridge accepts its config group.
+ * @param matcher - configured pattern; match-all sentinels are valid.
+ * @param mode - dialect deciding whether a word-and-pipe pattern is literal.
+ * @returns `undefined` for a valid matcher, otherwise a stable diagnostic.
+ */
+export function matcherDiagnostic(matcher: string | undefined, mode: MatcherMode): string | undefined {
+  if (isMatchAll(matcher)) return undefined
+  const pattern = matcher as string
+  if (mode === 'claude' && CLAUDE_LITERAL.test(pattern)) return undefined
+  return compileRegex(pattern) === undefined
+    ? `invalid ${mode} regex matcher ${JSON.stringify(pattern)}`
+    : undefined
+}
+
 /**
 * Whether `matcher` selects `query` under the given dialect. Claude literal
 * patterns exact-match pipe-separated alternatives; all other patterns are
- * unanchored regexes. Invalid regexes return `false` rather than throwing.
+ * unanchored regexes. Invalid regexes return `false` rather than throwing;
+ * bridge config parsers surface them through {@link matcherDiagnostic} before use.
 * @param matcher - the configured pattern; absent/empty/`'*'` are the match-all sentinels.
 * @param query - the candidate value (a tool name, a session source, …).
 * @param mode - the dialect deciding literal-vs-regex interpretation of the pattern.
@@ -33,13 +61,5 @@ export function matchesMatcher(matcher: string | undefined, query: string, mode:
  if (mode === 'claude' && CLAUDE_LITERAL.test(pattern)) {
    return pattern.split('|').includes(query)
  }
-  try {
-    return new RegExp(pattern).test(query)
-  } catch {
-    // Invalid regex: a broken matcher selects nothing rather than throwing into
-    // the agent loop. This is silent — callers get `false`, indistinguishable
-    // from a genuine non-match, so a typo'd pattern quietly disables the matcher.
-    // Surfacing it needs a diagnostic-returning variant (TODO(matcher-diagnostics)).
-    return false
-  }
+  return compileRegex(pattern)?.test(query) ?? false
 }
--- a/packages/hooks/hook-protocol/tests/matcher.spec.ts
+++ b/packages/hooks/hook-protocol/tests/matcher.spec.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { matchesMatcher } from '@deepseek-ai/dsh-hook-protocol'
+import { matcherDiagnostic, matchesMatcher } from '@deepseek-ai/dsh-hook-protocol'

 describe('matchesMatcher — match-all sentinels (both dialects)', () => {
  for (const mode of ['claude', 'codex'] as const) {
@@ -56,3 +56,19 @@ describe('matchesMatcher — invalid regex is a non-match (never throws)', () =>
    expect(matchesMatcher('[', 'x', 'codex')).toBe(false)
  })
 })
+
+describe('matcherDiagnostic — parse-time diagnostics', () => {
+  it('accepts match-all sentinels, Claude literals, and valid regexes', () => {
+    expect(matcherDiagnostic(undefined, 'claude')).toBeUndefined()
+    expect(matcherDiagnostic('', 'codex')).toBeUndefined()
+    expect(matcherDiagnostic('*', 'codex')).toBeUndefined()
+    expect(matcherDiagnostic('Edit|Write', 'claude')).toBeUndefined()
+    expect(matcherDiagnostic('^Bash$', 'claude')).toBeUndefined()
+    expect(matcherDiagnostic('Edit|Write', 'codex')).toBeUndefined()
+  })
+
+  it('returns a stable diagnostic for invalid regexes in either dialect', () => {
+    expect(matcherDiagnostic('(', 'claude')).toBe('invalid claude regex matcher "("')
+    expect(matcherDiagnostic('[', 'codex')).toBe('invalid codex regex matcher "["')
+  })
+})
--- a/packages/hooks/hooks-claude/README.i18n.yaml
+++ b/packages/hooks/hooks-claude/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/hooks/hooks-claude/README.md
-README.md: 24259c24ea35cd450f8ea27ca2cca423ed4406bd
-README.zh.md: 0a7afc20eba02d59d293124936cb81aeba6d3f0f
+README.md: 61c2d152dacdbec31bca015b94b9f2ac6d24c3aa
+README.zh.md: 38509ab6e6f72bb62a6bed064257603f728812cb
--- a/packages/hooks/hooks-claude/README.md
+++ b/packages/hooks/hooks-claude/README.md
@@ -28,7 +28,7 @@ In a `cordis.yml`:
    projectDir: .
 ```

-The config is parsed **once** at load. `configPath` is **process-level**: a relative path resolves against the process's launch cwd at load time, so a single config applies to the whole process — there is no per-session (`session/new.cwd`) config discovery yet (`TODO(per-session-hook-config)`). A read/parse failure is contained — the bridge logs a warning and registers nothing rather than crashing boot (a typo'd path must not take the agent down). Only shell-form `type: 'command'` hooks run; an `http`/`mcp_tool`/`prompt`/`agent` hook is parsed-and-skipped with a warning. A hook with no per-hook `timeout` runs under the protocol's reference default (`DEFAULT_HOOK_TIMEOUT_MS` from `dsh-hook-protocol`, 10 minutes — the CC default).
+The config is parsed **once** at load. `configPath` is **process-level**: a relative path resolves against the process's launch cwd at load time, so a single config applies to the whole process — there is no per-session (`session/new.cwd`) config discovery yet (`TODO(per-session-hook-config)`). A read/parse failure is contained — including an invalid regex matcher on an event that consumes matchers, reported with its pattern and event — and the bridge logs a warning and registers nothing rather than crashing boot (a typo'd path must not take the agent down). Only shell-form `type: 'command'` hooks run; an `http`/`mcp_tool`/`prompt`/`agent` hook is parsed-and-skipped with a warning. A hook with no per-hook `timeout` runs under the protocol's reference default (`DEFAULT_HOOK_TIMEOUT_MS` from `dsh-hook-protocol`, 10 minutes — the CC default).

 The hooks **themselves** run in the agent's session workspace: for the agent-scoped points the bridge passes the session's `cwd` (the `session/new.cwd`) as the hook process's working directory, so a hook's `pwd`/relative-path/marker operates in the user's project tree, not the server launch dir.

@@ -86,7 +86,7 @@ A blocked prompt sends no request and invalidates nothing. Denial, feedback, and

 ## Known Limitations and Deferred Work

- **Unsupported hook events (23 of Claude Code's current 30):** `Setup`, `InstructionsLoaded`, `UserPromptExpansion`, `MessageDisplay`, `PermissionRequest`, `PostToolUseFailure`, `PostToolBatch`, `PermissionDenied`, `Notification`, `TaskCreated`, `TaskCompleted`, `StopFailure`, `TeammateIdle`, `ConfigChange`, `CwdChanged`, `FileChanged`, `WorktreeCreate`, `WorktreeRemove`, `PreCompact`, `PostCompact`, `SessionEnd`, `Elicitation`, and `ElicitationResult`. Config for these events is parsed but never dispatched. The comparison baseline is Claude Code's [official hook-event reference](https://code.claude.com/docs/en/hooks#hook-events).
+- **Unsupported hook events (23 of Claude Code's current 30):** `Setup`, `InstructionsLoaded`, `UserPromptExpansion`, `MessageDisplay`, `PermissionRequest`, `PostToolUseFailure`, `PostToolBatch`, `PermissionDenied`, `Notification`, `TaskCreated`, `TaskCompleted`, `StopFailure`, `TeammateIdle`, `ConfigChange`, `CwdChanged`, `FileChanged`, `WorktreeCreate`, `WorktreeRemove`, `PreCompact`, `PostCompact`, `SessionEnd`, `Elicitation`, and `ElicitationResult`. Config for these events is ignored before group parsing, so an unsupported event cannot invalidate or register hooks. The comparison baseline is Claude Code's [official hook-event reference](https://code.claude.com/docs/en/hooks#hook-events).
 - **`SessionStart` is partial:** JSON `additionalContext` is consumed, but plain stdout context, `initialUserMessage`, `sessionTitle`, `watchPaths`, `reloadSkills`, and `CLAUDE_ENV_FILE` are unsupported. The hook runs detached, so context can miss the first request (`TODO(session-start-gating)`), and the payload omits current optional fields such as `model`, `agent_type`, and `session_title`.
 - **`UserPromptSubmit` is partial:** blocking and JSON `additionalContext` work, but plain stdout context, `sessionTitle`, and `suppressOriginalPrompt` are unsupported. Unless overridden, the bridge also uses its 600-second default instead of Claude Code's event-specific 30-second command timeout.
 - **`PreToolUse` is partial:** `deny` and `ask` decisions work; `allow` does not pre-approve, `defer` is unsupported, `additionalContext` is ignored, and `updatedInput` is logged + warned but not honored ([the pre-tool-input-rewrite Agent Note](../../../.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.md)).
--- a/packages/hooks/hooks-claude/README.zh.md
+++ b/packages/hooks/hooks-claude/README.zh.md
@@ -28,7 +28,7 @@ const config: Config = {
    projectDir: .
 ```

-配置只在加载时解析**一次**。`configPath` 是**进程级**配置：相对路径在加载时根据进程启动 cwd 解析，因此一份配置应用于整个进程。尚未进行每会话（`session/new.cwd`）配置发现（`TODO(per-session-hook-config)`）。读取／解析失败会被隔离处理：桥接记录警告且不注册任何内容，而不是使启动崩溃（路径拼写错误不应使 agent（智能体）停止）。只运行 shell 形式 `type: 'command'` hook；`http`／`mcp_tool`／`prompt`／`agent` hook 会被解析并跳过，同时记录警告。没有每 hook `timeout` 的 hook 会使用协议参考默认值 `DEFAULT_HOOK_TIMEOUT_MS`（来自 `dsh-hook-protocol`，10 分钟，即 CC 默认值）。
+配置只在加载时解析**一次**。`configPath` 是**进程级**配置：相对路径在加载时根据进程启动 cwd 解析，因此一份配置应用于整个进程。尚未进行每会话（`session/new.cwd`）配置发现（`TODO(per-session-hook-config)`）。读取／解析失败会被隔离处理，其中包括实际消费 matcher 的事件所带的无效 matcher 正则（会报告其 pattern 与事件）：桥接记录警告且不注册任何内容，而不是使启动崩溃（路径拼写错误不应使 agent（智能体）停止）。只运行 shell 形式 `type: 'command'` hook；`http`／`mcp_tool`／`prompt`／`agent` hook 会被解析并跳过，同时记录警告。没有每 hook `timeout` 的 hook 会使用协议参考默认值 `DEFAULT_HOOK_TIMEOUT_MS`（来自 `dsh-hook-protocol`，10 分钟，即 CC 默认值）。

 hook **本身**会在 agent 的会话工作区中运行：对 agent scope 点，桥接会将会话 `cwd`（`session/new.cwd`）作为 hook 进程工作目录，因此 hook 的 `pwd`／相对路径／marker 作用于用户项目树，而非服务器启动目录。

@@ -86,7 +86,7 @@ hook 不返回上下文时没有成本。Hook 文本取决于数据，会被记

 ## 已知限制与暂缓事项

- **不支持的 hook 事件（Claude Code 当前 30 项中的 23 项）：** `Setup`、`InstructionsLoaded`、`UserPromptExpansion`、`MessageDisplay`、`PermissionRequest`、`PostToolUseFailure`、`PostToolBatch`、`PermissionDenied`、`Notification`、`TaskCreated`、`TaskCompleted`、`StopFailure`、`TeammateIdle`、`ConfigChange`、`CwdChanged`、`FileChanged`、`WorktreeCreate`、`WorktreeRemove`、`PreCompact`、`PostCompact`、`SessionEnd`、`Elicitation` 和 `ElicitationResult`。这些事件的配置会被解析，但绝不分派。比较基线是 Claude Code [官方 hook 事件参考](https://code.claude.com/docs/en/hooks#hook-events)。
+- **不支持的 hook 事件（Claude Code 当前 30 项中的 23 项）：** `Setup`、`InstructionsLoaded`、`UserPromptExpansion`、`MessageDisplay`、`PermissionRequest`、`PostToolUseFailure`、`PostToolBatch`、`PermissionDenied`、`Notification`、`TaskCreated`、`TaskCompleted`、`StopFailure`、`TeammateIdle`、`ConfigChange`、`CwdChanged`、`FileChanged`、`WorktreeCreate`、`WorktreeRemove`、`PreCompact`、`PostCompact`、`SessionEnd`、`Elicitation` 和 `ElicitationResult`。这些事件的配置会在配置组解析前被忽略，因此不支持的事件既不会使配置失效，也不会注册 hook。比较基线是 Claude Code [官方 hook 事件参考](https://code.claude.com/docs/en/hooks#hook-events)。
 - **`SessionStart` 只支持部分功能：** 会消费 JSON `additionalContext`，但不支持纯 stdout 上下文、`initialUserMessage`、`sessionTitle`、`watchPaths`、`reloadSkills` 与 `CLAUDE_ENV_FILE`。hook 脱离运行，因此上下文可能错过第一个请求（`TODO(session-start-gating)`），payload 会省略 `model`、`agent_type` 和 `session_title` 等当前可选字段。
 - **`UserPromptSubmit` 只支持部分功能：** 支持阻塞与 JSON `additionalContext`，但不支持纯 stdout 上下文、`sessionTitle` 和 `suppressOriginalPrompt`。除非被覆盖，否则桥接还会使用自身 600 秒默认值，而非 Claude Code 的事件特定 30 秒 command 超时。
 - **`PreToolUse` 只支持部分功能：** `deny` 与 `ask` 决策可用；`allow` 不会预审批，不支持 `defer`，`additionalContext` 会被忽略，`updatedInput` 会被记录 + 警告但不应用（见 [pre-tool-input-rewrite Agent Note](../../../.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.md)）。
--- a/Show More
+++ b/Show More