Merge branch 'master' into worktree/short-default-labels

2026-07-30 12:56:11 +08:00
parent c7c37d64a4 818a504901
commit 432a64ef2f
187 changed files with 2533 additions and 775 deletions
--- a/packages/README.i18n.yaml
+++ b/packages/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/README.md
-README.md: fd5e1e8ec1a0ca426ed717cfa9613c51728c60e1
-README.zh.md: ad4f315171377677a934d8bb02d15c2db96e0e91
+README.md: 3f467641bbc9eae14a94aa2d3bff0402116a9d3f
+README.zh.md: c9d11bbf6239b4239a4e037dac63b05d3a9a58f7
--- a/packages/README.md
+++ b/packages/README.md
@@ -47,11 +47,12 @@ Packages live at `packages/<group>/<pkg>/`; groups are containers, while names r
 | [`ui/`](ui/README.md) | TUI and JSON-RPC integrations, approval/interaction seams, ask-user tool | Product — stable surface |
 | [`host/`](host/README.md) | Web-GUI host half: API gateway + HTTP route server | Product — stable surface |
 | [`client/`](client/README.md) | Web-GUI browser half: shell, wire, object services, slots, `ui-*` plugins | Product — stable surface |
+| [`experimental/`](experimental/README.md) | Prototypes and internal plugins | Unreleased |
 | [`examples/`](examples/README.md) | Demo bundles (agent-spine + TUI/CLI/ACP/JSON-RPC bins) leaves load | Support — example infra |
 | [`support/`](support/README.md) | Support infrastructure (testkits, invariants, replay, Loader smokes) | Support — lower compatibility expectations |
 | [`util/`](util/README.md) | Low-level zero-dependency utilities shared across groups (`Branded<B>`, Harness home/path helpers, timeout, retention) | Support — small, stable, harness-dep-free |

-Groups distinguish product API from support infrastructure. New packages join an existing group; a new group updates its README and this table.
+New packages join existing groups; new groups update their README and this table.

 ## Dependencies

--- a/packages/README.zh.md
+++ b/packages/README.zh.md
@@ -47,11 +47,12 @@
 | [`ui/`](ui/README.md) | TUI 与 JSON-RPC 集成、批准／交互 seam、用户问答工具 | 产品：稳定表面 |
 | [`host/`](host/README.md) | web GUI 宿主半侧：API 网关 + HTTP 路由服务器 | 产品：稳定表面 |
 | [`client/`](client/README.md) | web GUI 浏览器半侧：shell、协议层、对象服务、slot、`ui-*` 插件 | 产品：稳定表面 |
+| [`experimental/`](experimental/README.md) | 原型和内部插件 | 未发布 |
 | [`examples/`](examples/README.md) | 演示组合包（agent-spine + TUI/CLI/ACP/JSON-RPC bin），由叶节点加载 | 支持：示例基础设施 |
 | [`support/`](support/README.md) | 支持基础设施（testkit、不变式、回放、Loader 冒烟测试） | 支持：兼容性预期较低 |
 | [`util/`](util/README.md) | 组间共享的低层零依赖工具（`Branded<B>`、Harness home／路径辅助函数、超时、保留策略） | 支持：小型、稳定、无 harness 依赖 |

-组用于区分产品 API 与支持基础设施。新包加入现有组；新组则更新其 README 和此表。
+新包加入现有组；新组更新其 README 和此表。

 ## 依赖

--- a/packages/acp/acp/tests/turns.spec.ts
+++ b/packages/acp/acp/tests/turns.spec.ts
@@ -87,8 +87,8 @@ describe('ACP prompt lifecycle', () => {
    const sessionId = await newSession(harness)
    const agent = harness.ctx.agents.get(SessionId(sessionId))!
    let inserted = false
-    harness.ctx.on('agent/inbox/enqueue', (subject, message) => {
-      if (subject !== agent || message.source.kind !== 'user' || inserted) return
+    harness.ctx.on('agent/inbox/enqueue', (subject, item) => {
+      if (subject !== agent || item.message.source.kind !== 'user' || inserted) return
      inserted = true
      const source = { kind: 'plugin', plugin: 'test' } as const
      agent.session.append('turn/start', { turn: 1, trigger: { kind: 'message', source } })
--- a/packages/client/connection/src/client/api.ts
+++ b/packages/client/connection/src/client/api.ts
@@ -12,7 +12,7 @@ export type {
  WorkspaceApi, WorkspaceId, WorkspaceView,
  CommandsApi, CommandDescriptor, SkillsApi, SkillEntry,
  ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning,
-  ModelReasoningEffort, ModelTarget, SessionModels,
+  InboxItemId, ModelReasoningEffort, ModelTarget, QueueAction, QueuedInboxItem, SessionModels,
  GoalsApi, GoalRef,
 } from '@deepseek-ai/dsh-host-apiproxy/api'
 export type { ToolCallView, ToolResultView } from '@deepseek-ai/dsh-tools/presentation'
--- a/packages/client/connection/src/client/fixture.ts
+++ b/packages/client/connection/src/client/fixture.ts
@@ -1150,6 +1150,11 @@ export function createFixtureApi(options: FixtureOptions = {}): ApiProxy {
        )
        return ok(request, { accepted: true as const })
      },
+      updateQueue: request => err(request, {
+        code: 'queue-item-not-found',
+        message: 'fixture has no pending queue item',
+        details: { itemId: request.payload.itemId },
+      }),
      cancel: (request) => {
        const replay = replays.get(request.payload.sessionId)
        if (replay !== undefined) {
@@ -1587,6 +1592,7 @@ export class FixtureApiClient extends AbstractApiClient {
      case 'session.selectModel': return this.api.sessions.selectModel(request)
      case 'session.rename': return this.api.sessions.rename(request)
      case 'session.prompt': return this.api.sessions.prompt(request)
+      case 'session.updateQueue': return this.api.sessions.updateQueue(request)
      case 'session.cancel': return this.api.sessions.cancel(request)
      case 'host.describe': return this.api.host.describe(request)
      case 'host.pickDirectory': return this.api.host.pickDirectory(request, new AbortController().signal)
--- a/packages/client/connection/src/client/index.ts
+++ b/packages/client/connection/src/client/index.ts
@@ -17,7 +17,7 @@ export type {
  ToolCallView, ToolResultView, WorkspaceApi, WorkspaceId, WorkspaceView,
  CommandsApi, CommandDescriptor, SkillsApi, SkillEntry,
  ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning,
-  ModelReasoningEffort, ModelTarget, SessionModels,
+  InboxItemId, ModelReasoningEffort, ModelTarget, QueueAction, QueuedInboxItem, SessionModels,
  RpcRequest, RpcResponse, RpcResult, RpcError, RpcErrorCode,
  ClientRequest, ServerResponse, ServerRequest, ClientResponse, RpcMessage, RpcReceipt,
  IApiClient, SessionId, SessionEvent, ContentBlock, StreamChunk,
--- a/packages/client/connection/tests/fake-api.ts
+++ b/packages/client/connection/tests/fake-api.ts
@@ -63,6 +63,7 @@ export class FakeApiClient implements IApiClient {
  => Promise<RpcResponse<{ selected: ModelTarget }>> =
    payload => Promise.resolve(ok({ selected: { provider: payload.provider, model: payload.model } }))
  onPrompt: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
+  onUpdateQueue: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
  onCancel: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
  onDescribe: (payload: unknown) => Promise<RpcResponse<{ version: string; cwd: string; attachedSessions: number }>> =
    () => Promise.resolve(ok({ version: '0-fake', cwd: '/f', attachedSessions: 0 }))
@@ -99,6 +100,7 @@ export class FakeApiClient implements IApiClient {
      this.record('session.selectModel', payload, this.onSelectModel(payload)),
    rename: (payload: unknown) => this.record('session.rename', payload, this.onRename(payload)),
    prompt: (payload: unknown) => this.record('session.prompt', payload, this.onPrompt(payload)),
+    updateQueue: (payload: unknown) => this.record('session.updateQueue', payload, this.onUpdateQueue(payload)),
    cancel: (payload: unknown) => this.record('session.cancel', payload, this.onCancel(payload)),
  }

--- a/packages/client/runtime/README.i18n.yaml
+++ b/packages/client/runtime/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/runtime/README.md
-README.md: b51cc0276d8635ea9faa506e30246a107c1c1418
-README.zh.md: 4b2248d875ae37f1b848c51a0009d2497c6b3e61
+README.md: 766d8516225cd46cb1a3a80c832d1cf55e816140
+README.zh.md: 9b514afca91f604b3e895187de3b5532bf22a692
--- a/packages/client/runtime/README.md
+++ b/packages/client/runtime/README.md
@@ -16,6 +16,10 @@ SlotsService gives the renderer separate bare observables for `useSessions` and

 `WorkspacesService.connectWorkspace(workspaceId)` resolves the session a New Session flow lands in: it reuses the workspace's existing blank session from the list mirror (`blank && cwd == workspace.path`) or calls `session.create({workspaceId})`, returning the session id for the caller to open. `SessionSummary.blank` mirrors the host's derived empty-log bit and only ever lowers on the client: seeded by `session.list` / the `host/session-added` frame, flipped false by the first ACCEPTED local `prompt()` (on the RPC success response — acceptance proves the user message is in the host log; a rejected first prompt keeps the session blank and reusable) and by any `running: true` status frame, re-aligned by every list re-pull. List surfaces hide blank rows; the store carries every row. `SessionsService.create` accepts an optional caller-preallocated SessionId and throws `SessionCreateError` (carrying `requestedSessionId`) on failure.

+## Pending queue projection
+
+`ConversationSnapshot.queue` is the Host's authoritative transient Queue snapshot; pending steering stays outside this projection. Each row carries its `InboxItemId`, complete editable text when every content block is text, and a flattened preview. `session/queue` replaces the whole projection; reconnect buffering retains only the latest snapshot, and neither durable turn events nor running-status changes guess that an item was claimed. `Session.updateQueue()` sends edit/remove operations without optimistic mutation, so the next Host snapshot is the sole visible commit and a claim race can surface `queue-item-not-found`.
+
 ## Code Mode sub-dispatch index

 `ConversationSnapshot.codeDispatches` groups a `run_code` call's sub-dispatches under their parent callId, in start order, using the native call-block shapes: a `tool/code-dispatch-start` event lands the `RunningToolCall` form (rows derive the running ring from the shape) and its `tool/code-dispatch` settlement replaces it in place with the `ToolResultNode` form, `callTime` carrying the paired start's time. A settle whose start fell outside the replay window appends directly with `callTime: null` (duration unknown — never a fabricated zero). Live mux frames and history replay build the identical index; sub-calls never join the surface `nodes` flow; per-parent array and map references are memo-stable across unrelated snapshot swaps.
--- a/packages/client/runtime/README.zh.md
+++ b/packages/client/runtime/README.zh.md
@@ -16,6 +16,10 @@ SlotsService 分别为 renderer 提供 `useSessions` 与 `useWorkspaces` 的裸

 `WorkspacesService.connectWorkspace(workspaceId)` 解析 New Session 流程最终落入的会话：先在列表镜像中复用该 workspace 的既有空会话（`blank && cwd == workspace.path`），未命中则调用 `session.create({workspaceId})`，返回会话 id 由调用方 open。`SessionSummary.blank` 镜像主机派生的空日志位，在客户端只降不升：由 `session.list`／`host/session-added` 帧播种，本地首次获 Host 接受的 `prompt()`（RPC 成功响应时——受理即证明用户消息已入主机日志；首讯被拒则会话保持 blank、保持可复用）与任何 `running: true` 状态帧翻为 false，每次列表重拉重新对齐。列表界面隐藏 blank 行；store 保留全部行。`SessionsService.create` 接受可选的、由调用方预先分配的 SessionId，失败时抛出 `SessionCreateError`（携带 `requestedSessionId`）。

+## 待处理队列投影
+
+`ConversationSnapshot.queue` 是 Host 提供的权威瞬态 Queue 快照；待处理 steering（中途引导）不进入此投影。每行都携带其 `InboxItemId`、所有内容块均为文本时的完整可编辑文本，以及扁平化预览。`session/queue` 会整体替换该投影；重连缓冲只保留最新快照，持久轮次事件和 running 状态变化都不会猜测某个项已被认领。`Session.updateQueue()` 发送编辑／移除操作，不进行乐观更新，因此下一份 Host 快照是唯一可见的提交结果，认领竞态则会返回 `queue-item-not-found`。
+
 ## Code Mode 子调用索引

 `ConversationSnapshot.codeDispatches` 按父调用的 callId 和启动顺序，用原生调用块形状组织一个 `run_code` 调用的子调用：`tool/code-dispatch-start` 事件落成 `RunningToolCall` 形状（行组件从该形状推导运行中的转圈状态），其 `tool/code-dispatch` 完结事件原位替换为 `ToolResultNode` 形状，`callTime` 携带成对 start 事件的时间。start 落在回放窗口之外的完结事件则直接追加，`callTime: null`（耗时未知——绝不伪造零耗时）。live mux 帧与历史回放构建相同的索引；子调用永不进入 surface `nodes` 流；无关快照交换不会改变每个父调用对应的数组引用和映射引用，两者均保持 memo 稳定。
--- a/packages/client/runtime/src/client/contract/session.ts
+++ b/packages/client/runtime/src/client/contract/session.ts
@@ -8,7 +8,9 @@
 * dispatch) stay on the class, invisible out here.
 */
 import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
-import type { RpcResult, SessionId } from '@deepseek-ai/dsh-client-connection/client'
+import type {
+  InboxItemId, QueueAction, RpcResult, SessionId,
+} from '@deepseek-ai/dsh-client-connection/client'
 import type { ConversationSnapshot } from '../sessions/conversation.ts'
 import type { ObservableSnapshot } from './store.ts'

@@ -36,6 +38,13 @@ export interface ISession {
   * @returns acceptance, or the business error (also mirrored into snapshot.promptError).
   */
  prompt(content: ContentBlock[], mode: 'queue' | 'steer'): Promise<RpcResult<{ accepted: true }>>
+  /**
+   * Apply one mutation to a still-pending queue occurrence.
+   * @param itemId - agent-owned inbox occurrence identity.
+   * @param action - edit or remove operation.
+   * @returns acceptance, or a business/transport error.
+   */
+  updateQueue(itemId: InboxItemId, action: QueueAction): Promise<RpcResult<{ accepted: true }>>
  /**
   * Cancel the running turn.
   * @returns acceptance, or the business error.
--- a/packages/client/runtime/src/client/sessions/conversation.ts
+++ b/packages/client/runtime/src/client/sessions/conversation.ts
@@ -7,7 +7,7 @@ import type { CommandId } from '@deepseek-ai/dsh-commands/brand'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
 import type { TodoItem } from '@deepseek-ai/dsh-session/types'
 import type {
-  RpcError, SessionId, ToolCallView, ToolResultView,
+  InboxItemId, RpcError, SessionId, ToolCallView, ToolResultView,
 } from '@deepseek-ai/dsh-client-connection/client'
 import type { PendingInteraction } from './pending.ts'
 export type { TodoItem }
@@ -216,10 +216,12 @@ export interface RunningToolCall {
 }


-/** One queued-message row mirrored from `session/queued` frames (key: the enqueueing prompt's rpcId when wire-sourced). */
+/** One independently addressable row from the transient queue snapshot. */
 export interface QueuedMessage {
-  readonly key: string
+  readonly id: InboxItemId
  readonly preview: string
+  /** Complete editable text; null when the message contains non-text blocks. */
+  readonly text: string | null
 }

 /** In-progress assistant output (chunk accumulator product). */
@@ -277,7 +279,7 @@ export interface ConversationSnapshot {
   */
  codeDispatches: ReadonlyMap<string, readonly CodeSubCall[]>
  pending: readonly PendingInteraction[]
-  /** Read-only inbox mirror (session/queued frames + mux-open baseline; cleared by the leave-running flip). */
+  /** Authoritative transient inbox snapshot, replaced after every host-side change. */
  queue: readonly QueuedMessage[]
  running: boolean
  /** Input-area shape (see {@link ComposerPhase}); derived here, switched on by consumers. */
--- a/packages/client/runtime/src/client/sessions/manager.ts
+++ b/packages/client/runtime/src/client/sessions/manager.ts
@@ -351,14 +351,14 @@ export class SessionManager {
      // them so last-wins cannot pin a phantom value over recomputed truth.
      this.projectionStores.get(frame.sessionId)?.truncate(frame.lastSeq)
      this.notifier.markDirty()
-      // New mux-generation baseline: buffered session/queued frames belong to
+      // New mux-generation baseline: buffered session/queue frames belong to
      // the previous generation and the host is about to resend the live
      // snapshot — drop them, or every reconnect appends a duplicate batch
      // (and enough reconnects push real approval/question frames past the
      // cap). Same re-baseline signal Session uses for its own mirror.
      const buffered = this.pendingBuffers.get(frame.sessionId)
      if (buffered !== undefined) {
-        const kept = buffered.filter(item => item.payload.type !== 'session/queued')
+        const kept = buffered.filter(item => item.payload.type !== 'session/queue')
        if (kept.length !== buffered.length) {
          if (kept.length === 0) this.pendingBuffers.delete(frame.sessionId)
          else this.pendingBuffers.set(frame.sessionId, kept)
@@ -383,7 +383,7 @@ export class SessionManager {
    }
    const session = this.sessions.get(frame.sessionId)
    if (session === undefined) {
-      // Approval/question/queued frames never hit history: buffer for replay on
+      // Approval/question/queue frames never hit history: buffer for replay on
      // instantiation; everything else drops (not instantiated — history fully
      // backfills on open).
      switch (frame.type) {
@@ -391,8 +391,12 @@ export class SessionManager {
        case 'approval/resolved':
        case 'question/requested':
        case 'question/resolved':
-        case 'session/queued': {
+        case 'session/queue': {
          const buffer = this.pendingBuffers.get(frame.sessionId) ?? []
+          const prior = frame.type === 'session/queue'
+            ? buffer.findIndex(item => item.payload.type === 'session/queue')
+            : -1
+          if (prior !== -1) buffer.splice(prior, 1)
          buffer.push(envelope)
          if (buffer.length > PENDING_BUFFER_CAP) buffer.splice(0, buffer.length - PENDING_BUFFER_CAP)
          this.pendingBuffers.set(frame.sessionId, buffer)
--- a/packages/client/runtime/src/client/sessions/session.ts
+++ b/packages/client/runtime/src/client/sessions/session.ts
@@ -4,8 +4,8 @@ import type { Context } from 'cordis'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
 import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
 import type {
-  HistoryEntry, IApiClient, MuxFrame, RpcError, RpcId, RpcResult,
-  SessionId, ToolEventView,
+  HistoryEntry, IApiClient, InboxItemId, MuxFrame, QueueAction, RpcError,
+  RpcId, RpcResult, SessionId, ToolEventView,
 } from '@deepseek-ai/dsh-client-connection/client'
 // Value import from the inline-safe wire layer (not the connection plugin):
 // plugin-to-plugin value imports are a bundle purity error.
@@ -48,14 +48,6 @@ export interface SessionOptions {
 /** Queue-row preview cap: the dock renders one line, the full content never leaves the host mirror. */
 const QUEUE_PREVIEW_CHARS = 200

-/** Internal inbox-mirror entry: the snapshot row plus the retirement-matching fields the frames carry. */
-interface QueuedEntry {
-  row: QueuedMessage
-  steering: boolean
-  /** JSON-serialized MessageSource (steering retirement matches by source, the host-mirror precedent). */
-  sourceJson: string
-}
-
 /** Single-line queue-row preview: text blocks flattened, non-text as tags, capped by code point. */
 function queuePreviewOf(content: readonly ContentBlock[]): string {
  const flat = content
@@ -65,6 +57,12 @@ function queuePreviewOf(content: readonly ContentBlock[]): string {
  return chars.length > QUEUE_PREVIEW_CHARS ? `${chars.slice(0, QUEUE_PREVIEW_CHARS).join('')}…` : flat
 }

+/** Recover complete composer text only when editing cannot discard non-text blocks. */
+function queueTextOf(content: readonly ContentBlock[]): string | null {
+  if (!content.every(block => block.type === 'text')) return null
+  return content.map(block => block.text).join('')
+}
+
 /**
 * Owns a session's event window, derived conversation state, and observable
 * snapshot. React bindings remain outside this data layer. Features see only
@@ -102,9 +100,8 @@ export class Session implements SessionFace {
  private callsCache: { rev: number; value: RunningToolCall[] } | null = null
  private pendingRev = 0
  private pendingCache: { rev: number; value: PendingInteraction[] } | null = null
-  /** Inbox mirror (session/queued frames + mux-open baseline). Queue frames never hit history,
-   *  so this is stream-only state: reconnect clears it and the fresh baseline re-populates. */
-  private queued: QueuedEntry[] = []
+  /** Authoritative stream-only inbox snapshot; pending work never hits history. */
+  private queued: QueuedMessage[] = []
  private queueRev = 0
  private queueCache: { rev: number; value: QueuedMessage[] } | null = null
  private frozenRev = 0
@@ -234,6 +231,15 @@ export class Session implements SessionFace {
    return result
  }

+  /** Apply one operation to a still-pending queue occurrence. */
+  async updateQueue(itemId: InboxItemId, action: QueueAction): Promise<RpcResult<{ accepted: true }>> {
+    try {
+      return (await this.api.sessions.updateQueue({ sessionId: this.sessionId, itemId, action })).result
+    } catch (error) {
+      return transportError(error)
+    }
+  }
+
  /**
   * Stop: contract session.cancel 1:1; failures land in promptError (same error-strip display slot).
   * @returns the cancel result.
@@ -393,20 +399,15 @@ export class Session implements SessionFace {
  handleMuxEnvelope(rpcId: RpcId, frame: MuxFrame): void {
    switch (frame.type) {
      case 'session/event': {
-        this.retireQueued(frame.event)
        this.acceptLiveEvent(frame.event, frame.view)
        return
      }
-      case 'session/queued': {
-        const message = frame.message
-        // Row key: the enqueueing prompt's rpcId when it rode this wire (the
-        // provisional-echo reconciliation key); otherwise the frame envelope id.
-        const key = 'rpcId' in message.source ? String(message.source.rpcId) : `f:${rpcId}`
-        this.queued.push({
-          row: { key, preview: queuePreviewOf(message.content) },
-          steering: frame.steering,
-          sourceJson: JSON.stringify(message.source),
-        })
+      case 'session/queue': {
+        this.queued = frame.items.map(item => ({
+          id: item.id,
+          preview: queuePreviewOf(item.message.content),
+          text: queueTextOf(item.message.content),
+        }))
        this.queueRev++
        this.notifier.markDirty()
        return
@@ -459,15 +460,6 @@ export class Session implements SessionFace {
   * @param running - the new running state.
   */
  handleRunning(running: boolean): void {
-    // Leave-running sweep (host queuedMirror precedent): discard paths (cancel,
-    // terminal steering drop) have no per-entry frame, so ANY not-running signal
-    // with a nonempty mirror clears it — checked before the equality return so a
-    // stale replay on an already-idle session still sweeps.
-    if (!running && this.queued.length > 0) {
-      this.queued = []
-      this.queueRev++
-      this.notifier.markDirty()
-    }
    // Turn-start conversion: a blank session never runs, so the first
    // running:true proves another端's first message landed (设计稿 2.2).
    if (running && this.blankBit) {
@@ -632,27 +624,6 @@ export class Session implements SessionFace {
    }
  }

-  /** Consumption-event retirement, mirroring the host queuedMirror rules: a message-triggered
-   *  turn/start claims the oldest non-steering entry; a steering/message drains the oldest
-   *  steering entry with the same source (loop-authored steering matches nothing and drops none). */
-  private retireQueued(event: SessionEvent): void {
-    if (this.queued.length === 0) return
-    let index = -1
-    if (event.type === 'turn/start') {
-      if (event.data.trigger.kind !== 'message') return
-      index = this.queued.findIndex(entry => !entry.steering)
-    } else if (event.type === 'steering/message') {
-      const source = JSON.stringify(event.data.message.source)
-      index = this.queued.findIndex(entry => entry.steering && entry.sourceJson === source)
-    } else {
-      return
-    }
-    if (index < 0) return
-    this.queued.splice(index, 1)
-    this.queueRev++
-    this.notifier.markDirty()
-  }
-
  /** Per-event side effects (right column of the §A.9 dispatch table):
   *  chunk accumulation / partial clear on finalize / openCalls add-remove. */
  private applyEventSideEffects(event: SessionEvent, view?: ToolEventView): void {
@@ -832,7 +803,7 @@ export class Session implements SessionFace {
      this.dispatchesCache = { rev: this.dispatchesRev, value: new Map(this.codeDispatches) }
    }
    if (this.queueCache === null || this.queueCache.rev !== this.queueRev) {
-      this.queueCache = { rev: this.queueRev, value: this.queued.map(entry => entry.row) }
+      this.queueCache = { rev: this.queueRev, value: this.queued }
    }
    const partial = this.partial?.toPartial() ?? null
    return {
--- a/packages/client/runtime/tests/fake-api.ts
+++ b/packages/client/runtime/tests/fake-api.ts
@@ -81,6 +81,7 @@ export class FakeApiClient implements IApiClient {
  Promise<RpcResponse<{ selected: ModelTarget }>> =
    payload => Promise.resolve(ok({ selected: { provider: payload.provider, model: payload.model } }))
  onPrompt: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
+  onUpdateQueue: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))
  onCancel: (payload: unknown) => Promise<RpcResponse<{ accepted: true }>> = () => Promise.resolve(ok({ accepted: true as const }))

  onDescribe: (payload: unknown) => Promise<RpcResponse<{ version: string; cwd: string; attachedSessions: number }>> =
@@ -118,6 +119,7 @@ export class FakeApiClient implements IApiClient {
      this.record('session.selectModel', payload, this.onSelectModel(payload)),
    rename: (payload: unknown) => this.record('session.rename', payload, this.onRename(payload)),
    prompt: (payload: unknown) => this.record('session.prompt', payload, this.onPrompt(payload)),
+    updateQueue: (payload: unknown) => this.record('session.updateQueue', payload, this.onUpdateQueue(payload)),
    cancel: (payload: unknown) => this.record('session.cancel', payload, this.onCancel(payload)),
  }

--- a/packages/client/runtime/tests/queue-store.spec.ts
+++ b/packages/client/runtime/tests/queue-store.spec.ts
@@ -1,32 +1,41 @@
 /**
- * Queue mirror semantics (web input-triggers queue cut 1): session/queued
- * intake, host-rule retirement (message turn/start claims oldest non-steering;
- * steering/message drains by source), leave-running sweep, reconnect reset,
- * pre-instantiation buffering, and snapshot reference stability.
+ * Queue snapshot semantics: authoritative replacement after every host-side
+ * change, reconnect re-baselining, pre-instantiation buffering, editable-text
+ * projection, and snapshot reference stability.
 */
 import { describe, expect, it } from 'vitest'
 import { createUserMessage } from '@deepseek-ai/dsh-llm'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
-import type { MuxFrame, RpcId, SessionId } from '@deepseek-ai/dsh-client-connection/client'
+import type {
+  InboxItemId, MuxFrame, RpcId, SessionId,
+} from '@deepseek-ai/dsh-client-connection/client'
 import { Session } from '../src/client/sessions/session.ts'
 import { SessionManager } from '../src/client/sessions/manager.ts'
 import { FakeApiClient } from './fake-api.ts'
-import { ev } from './event-script.ts'

 const SID = 'fk-q1' as SessionId
-const text = (t: string): ContentBlock[] => [{ type: 'text', text: t }]
+const text = (value: string): ContentBlock[] => [{ type: 'text', text: value }]
 const rid = (id: string): RpcId => id as RpcId
+const iid = (id: string): InboxItemId => id as InboxItemId

-/** session/queued frame with the wire-sourced rpcId key (the host prompt path). */
-function queuedFrame(body: string, rpcId: string, steering = false): MuxFrame {
+interface QueueFixture {
+  id: string
+  body: string
+  content?: ContentBlock[]
+}
+
+/** Build one authoritative queue snapshot. */
+function queueFrame(items: QueueFixture[]): MuxFrame {
  return {
-    type: 'session/queued',
+    type: 'session/queue',
    sessionId: SID,
-    message: createUserMessage({
-      content: text(body),
-      source: { kind: 'user', rpcId: rid(rpcId) } as never,
-    }),
-    steering,
+    items: items.map(item => ({
+      id: iid(item.id),
+      message: createUserMessage({
+        content: item.content ?? text(item.body),
+        source: { kind: 'user', rpcId: rid(`rpc-${item.id}`) } as never,
+      }),
+    })),
  }
 }

@@ -34,201 +43,131 @@ function makeSession(): Session {
  return new Session(SID, new FakeApiClient())
 }

-describe('queue intake', () => {
-  it('lands a queued frame as a row keyed by the source rpcId with a flat preview', () => {
+describe('queue snapshot intake', () => {
+  it('projects stable ids, flat previews, and complete text', () => {
    const session = makeSession()
-    session.handleMuxEnvelope(rid('env-1'), queuedFrame('第一条  排队\n消息', 'p-1'))
-    const queue = session.getSnapshot().queue
-    expect(queue).toEqual([{ key: 'p-1', preview: '第一条 排队 消息' }])
+    session.handleMuxEnvelope(rid('env-1'), queueFrame([
+      { id: 'q-1', body: '第一条  排队\n消息' },
+    ]))
+    expect(session.getSnapshot().queue).toEqual([
+      { id: 'q-1', preview: '第一条 排队 消息', text: '第一条  排队\n消息' },
+    ])
  })

-  it('falls back to the envelope rpcId when the source carries none, and tags non-text blocks', () => {
+  it('marks mixed-content messages non-editable while retaining their preview', () => {
    const session = makeSession()
-    session.handleMuxEnvelope(rid('env-2'), {
-      type: 'session/queued',
-      sessionId: SID,
-      message: createUserMessage({
-        content: [{ type: 'text', text: 'hi' }, { type: 'image', data: 'x' } as never],
-        source: { kind: 'plugin', plugin: 'loop' },
-      }),
-      steering: false,
-    })
-    expect(session.getSnapshot().queue).toEqual([{ key: 'f:env-2', preview: 'hi [image]' }])
+    session.handleMuxEnvelope(rid('env-2'), queueFrame([{
+      id: 'q-image',
+      body: '',
+      content: [{ type: 'text', text: 'hi' }, { type: 'image', data: 'x' } as never],
+    }]))
+    expect(session.getSnapshot().queue).toEqual([
+      { id: 'q-image', preview: 'hi [image]', text: null },
+    ])
  })

-  it('caps the preview at 200 code points with an ellipsis', () => {
+  it('caps previews at 200 code points and preserves the full editable text', () => {
    const session = makeSession()
-    session.handleMuxEnvelope(rid('env-3'), queuedFrame('长'.repeat(201), 'p-cap'))
-    const preview = session.getSnapshot().queue[0]?.preview ?? ''
-    expect(Array.from(preview)).toHaveLength(201) // 200 + …
-    expect(preview.endsWith('…')).toBe(true)
+    const body = '长'.repeat(201)
+    session.handleMuxEnvelope(rid('env-3'), queueFrame([{ id: 'q-cap', body }]))
+    const row = session.getSnapshot().queue[0]
+    expect(Array.from(row?.preview ?? '')).toHaveLength(201)
+    expect(row?.preview.endsWith('…')).toBe(true)
+    expect(row?.text).toBe(body)
+  })
+
+  it('replaces content, order, and membership from each authoritative frame', () => {
+    const session = makeSession()
+    session.handleMuxEnvelope(rid('env-4'), queueFrame([
+      { id: 'q-1', body: 'one' },
+      { id: 'q-2', body: 'two' },
+    ]))
+    session.handleMuxEnvelope(rid('env-5'), queueFrame([
+      { id: 'q-2', body: 'two edited' },
+    ]))
+    expect(session.getSnapshot().queue).toEqual([
+      { id: 'q-2', preview: 'two edited', text: 'two edited' },
+    ])
+    session.handleMuxEnvelope(rid('env-6'), queueFrame([]))
+    expect(session.getSnapshot().queue).toEqual([])
  })

  it('keeps the queue array reference stable across unrelated snapshot swaps', () => {
    const session = makeSession()
-    session.handleMuxEnvelope(rid('env-4'), queuedFrame('稳定', 'p-s'))
+    session.handleMuxEnvelope(rid('env-7'), queueFrame([{ id: 'q-stable', body: '稳定' }]))
    const before = session.getSnapshot().queue
-    session.handleAgentError('unrelated') // dirties the snapshot without touching the queue
+    session.handleAgentError('unrelated')
    expect(session.getSnapshot().queue).toBe(before)
  })
 })

-describe('queue retirement (host queuedMirror rules)', () => {
-  it('a message-triggered turn/start claims the oldest non-steering row', () => {
-    const session = makeSession()
-    session.handleMuxEnvelope(rid('e1'), queuedFrame('先', 'p-1'))
-    session.handleMuxEnvelope(rid('e2'), queuedFrame('后', 'p-2'))
-    session.handleMuxEnvelope(rid('e3'), { type: 'session/event', sessionId: SID, event: ev.turnStart(0, 0) })
-    expect(session.getSnapshot().queue.map(r => r.key)).toEqual(['p-2'])
-  })
+describe('queue operation transport', () => {
+  it('addresses the session.updateQueue RPC without optimistic local mutation', async () => {
+    const api = new FakeApiClient()
+    const session = new Session(SID, api)
+    session.handleMuxEnvelope(rid('env-op'), queueFrame([{ id: 'q-op', body: 'pending' }]))
+    const before = session.getSnapshot().queue

-  it('an injection-triggered turn/start claims nothing', () => {
-    const session = makeSession()
-    session.handleMuxEnvelope(rid('e1'), queuedFrame('留', 'p-1'))
-    const injection = {
-      ...ev.turnStart(0, 0),
-      data: { turn: 0, trigger: { kind: 'injection', source: { kind: 'plugin', plugin: 'x' } } },
-    } as never
-    session.handleMuxEnvelope(rid('e2'), { type: 'session/event', sessionId: SID, event: injection })
-    expect(session.getSnapshot().queue).toHaveLength(1)
-  })
-
-  it('steering/message drains the source-matched steering row only', () => {
-    const session = makeSession()
-    session.handleMuxEnvelope(rid('e1'), queuedFrame('普通', 'p-1')) // idle → non-steering
-    session.handleMuxEnvelope(rid('e3'), queuedFrame('插话', 'p-2', true))
-    // Loop-authored steering (different source) must not consume the user entry.
-    const foreignSteering = {
-      seq: 0, time: 1,
-      type: 'steering/message', surfaceOp: 'append',
-      data: {
-        turn: 0,
-        message: createUserMessage({
-          content: text('loop'),
-          source: { kind: 'plugin', plugin: 'loop' },
-        }),
-      },
-    } as never
-    session.handleMuxEnvelope(rid('e4'), { type: 'session/event', sessionId: SID, event: foreignSteering })
-    expect(session.getSnapshot().queue).toHaveLength(2)
-    const matchedSteering = {
-      seq: 1, time: 2,
-      type: 'steering/message', surfaceOp: 'append',
-      data: {
-        turn: 0,
-        message: createUserMessage({
-          content: text('插话'),
-          source: { kind: 'user', rpcId: rid('p-2') },
-        }),
-      },
-    } as never
-    session.handleMuxEnvelope(rid('e5'), { type: 'session/event', sessionId: SID, event: matchedSteering })
-    expect(session.getSnapshot().queue.map(r => r.key)).toEqual(['p-1'])
-  })
-
-  it('a leave-running flip sweeps the whole mirror (cancel/terminal-drop cover)', () => {
-    const session = makeSession()
-    session.handleRunning(true)
-    session.handleMuxEnvelope(rid('e1'), queuedFrame('一', 'p-1'))
-    session.handleMuxEnvelope(rid('e2'), queuedFrame('二', 'p-2'))
-    session.handleRunning(false)
-    expect(session.getSnapshot().queue).toEqual([])
-  })
-
-  it('a stale not-running relay on an idle session still sweeps replayed rows', () => {
-    const session = makeSession()
-    session.handleMuxEnvelope(rid('e1'), queuedFrame('孤儿', 'p-1'))
-    session.handleRunning(false) // running already false: equality path must not skip the sweep
-    expect(session.getSnapshot().queue).toEqual([])
+    await expect(session.updateQueue(iid('q-op'), { kind: 'edit', content: text('next') }))
+      .resolves.toEqual({ ok: true, value: { accepted: true } })
+    expect(api.callsOf('session.updateQueue')).toEqual([{
+      sessionId: SID,
+      itemId: 'q-op',
+      action: { kind: 'edit', content: text('next') },
+    }])
+    expect(session.getSnapshot().queue).toBe(before)
  })
 })

 describe('queue reconnect semantics', () => {
-  it('session/subscribed re-baselines the mirror: stale rows drop, the following snapshot lands fresh', () => {
+  it('session/subscribed clears stale state before the fresh snapshot lands', () => {
    const session = makeSession()
-    session.handleMuxEnvelope(rid('e1'), queuedFrame('旧连接', 'p-old'))
-    // New mux generation: subscribed arrives first on the same stream...
+    session.handleMuxEnvelope(rid('e1'), queueFrame([{ id: 'q-old', body: '旧连接' }]))
    session.handleMuxEnvelope(rid('e2'), { type: 'session/subscribed', sessionId: SID, lastSeq: 10 })
    expect(session.getSnapshot().queue).toEqual([])
-    // ...then the queue snapshot replays the live inbox.
-    session.handleMuxEnvelope(rid('e3'), queuedFrame('新基线', 'p-new'))
-    expect(session.getSnapshot().queue.map(r => r.key)).toEqual(['p-new'])
+    session.handleMuxEnvelope(rid('e3'), queueFrame([{ id: 'q-new', body: '新基线' }]))
+    expect(session.getSnapshot().queue.map(row => row.id)).toEqual(['q-new'])
  })

-  it('resync must NOT clear the mirror (regression: onConnected races the mux baseline)', async () => {
+  it('resync does not clear a baseline that raced ahead of the host connection signal', async () => {
    const session = makeSession()
-    // Reconnect ordering that broke: mux opened first and already delivered
-    // the fresh generation's baseline; host stream (and with it onConnected →
-    // resync) lands after. The host never resends — clearing here left the
-    // dock empty until the next enqueue.
    session.handleMuxEnvelope(rid('e1'), { type: 'session/subscribed', sessionId: SID, lastSeq: 5 })
-    session.handleMuxEnvelope(rid('e2'), queuedFrame('新基线', 'p-fresh'))
+    session.handleMuxEnvelope(rid('e2'), queueFrame([{ id: 'q-fresh', body: '新基线' }]))
    await session.resync()
-    expect(session.getSnapshot().queue.map(r => r.key)).toEqual(['p-fresh'])
+    expect(session.getSnapshot().queue.map(row => row.id)).toEqual(['q-fresh'])
  })

-  it('replayed steering retires without a replayed turn/start', () => {
+  it('running-status changes never guess at queue retirement', () => {
    const session = makeSession()
-    session.handleMuxEnvelope(rid('e1'), { type: 'session/subscribed', sessionId: SID, lastSeq: 5 })
-    session.handleMuxEnvelope(rid('e2'), queuedFrame('重连插话', 'p-steer', true))
-    const committed = {
-      seq: 6, time: 2,
-      type: 'steering/message', surfaceOp: 'append',
-      data: {
-        turn: 1,
-        message: createUserMessage({
-          content: text('重连插话'),
-          source: { kind: 'user', rpcId: rid('p-steer') },
-        }),
-      },
-    } as never
-    session.handleMuxEnvelope(rid('e3'), { type: 'session/event', sessionId: SID, event: committed })
-    expect(session.getSnapshot().queue).toEqual([])
+    session.handleMuxEnvelope(rid('e1'), queueFrame([{ id: 'q-live', body: '保留' }]))
+    session.handleRunning(true)
+    session.handleRunning(false)
+    expect(session.getSnapshot().queue.map(row => row.id)).toEqual(['q-live'])
  })
 })

-describe('manager buffering of queued frames', () => {
-  it('buffers session/queued for uninstantiated sessions and replays before the running sync', () => {
-    const api = new FakeApiClient()
-    const manager = new SessionManager(api)
-    manager.handleMuxEnvelope({ rpcId: rid('b1'), payload: queuedFrame('预热', 'p-b1') })
-    // Instantiation replays the buffer; no summary exists, so no running sweep runs.
-    const session = manager.get(SID)
-    expect(session.getSnapshot().queue.map(r => r.key)).toEqual(['p-b1'])
-    // The buffer is consumed: a second get must not double-replay.
-    expect(manager.get(SID).getSnapshot().queue).toHaveLength(1)
+describe('manager buffering of queue snapshots', () => {
+  it('replays only the latest snapshot for an uninstantiated session', () => {
+    const manager = new SessionManager(new FakeApiClient())
+    manager.handleMuxEnvelope({ rpcId: rid('b1'), payload: queueFrame([{ id: 'q-old', body: '旧' }]) })
+    manager.handleMuxEnvelope({ rpcId: rid('b2'), payload: queueFrame([{ id: 'q-new', body: '新' }]) })
+    expect(manager.get(SID).getSnapshot().queue.map(row => row.id)).toEqual(['q-new'])
  })

-  it('a not-running list summary sweeps replayed rows at instantiation', async () => {
-    const api = new FakeApiClient()
-    api.onList = () => Promise.resolve(ok([{ sessionId: SID, updatedAt: 1, running: false }]))
-    const manager = new SessionManager(api)
-    await manager.refreshList()
-    manager.handleMuxEnvelope({ rpcId: rid('b2'), payload: queuedFrame('该扫掉', 'p-b2') })
-    expect(manager.get(SID).getSnapshot().queue).toEqual([])
-  })
-
-  it('subscribed re-baselines the uninstantiated buffer: stale queued frames drop, non-queue frames survive (regression: reconnect duplication)', () => {
-    const api = new FakeApiClient()
-    const manager = new SessionManager(api)
-    // Generation 1 baseline lands while the session is uninstantiated, along
-    // with a pending approval (never re-derivable from history).
-    manager.handleMuxEnvelope({ rpcId: rid('g1a'), payload: queuedFrame('第一代', 'p-g1') })
+  it('subscribed drops the prior-generation snapshot while preserving answerable frames', () => {
+    const manager = new SessionManager(new FakeApiClient())
+    manager.handleMuxEnvelope({ rpcId: rid('g1a'), payload: queueFrame([{ id: 'q-g1', body: '第一代' }]) })
    manager.handleMuxEnvelope({
      rpcId: rid('g1b'),
      payload: { type: 'approval/requested', sessionId: SID, approvalId: 'ap-1' as never, toolName: 'bash' },
    })
-    // Reconnect: generation 2 replays subscribed + the SAME live queue entry.
-    manager.handleMuxEnvelope({ rpcId: rid('g2a'), payload: { type: 'session/subscribed', sessionId: SID, lastSeq: 3 } })
-    manager.handleMuxEnvelope({ rpcId: rid('g2b'), payload: queuedFrame('第一代', 'p-g1') })
+    manager.handleMuxEnvelope({
+      rpcId: rid('g2a'),
+      payload: { type: 'session/subscribed', sessionId: SID, lastSeq: 3 },
+    })
+    manager.handleMuxEnvelope({ rpcId: rid('g2b'), payload: queueFrame([{ id: 'q-g2', body: '第二代' }]) })
    const snapshot = manager.get(SID).getSnapshot()
-    // One queue row (no duplicate batch); the approval survived the re-baseline.
-    expect(snapshot.queue.map(r => r.key)).toEqual(['p-g1'])
-    expect(snapshot.pending.map(p => p.kind)).toEqual(['approval'])
+    expect(snapshot.queue.map(row => row.id)).toEqual(['q-g2'])
+    expect(snapshot.pending.map(pending => pending.kind)).toEqual(['approval'])
  })
 })
-
-/** ok wrapper with a typed items payload (the shared helper pins value to never[]). */
-function ok(items: { sessionId: SessionId; updatedAt: number; running: boolean }[]) {
-  return { rpcId: rid(`ok-${items.length}`), result: { ok: true as const, value: { items: items as never[] } } }
-}
--- a/packages/client/test-runtime/src/sessions.ts
+++ b/packages/client/test-runtime/src/sessions.ts
@@ -84,6 +84,14 @@ export class FixtureSession implements SessionFace {
    throw new Error(`test session "${this.sessionId}": prompt is not stubbed — supply it on the fixture's session face`)
  }

+  /**
+   * Fail-loud stub; supply `updateQueue` on the fixture's session face to exercise it.
+   * @returns never — always throws.
+   */
+  updateQueue(): never {
+    throw new Error(`test session "${this.sessionId}": updateQueue is not stubbed — supply it on the fixture's session face`)
+  }
+
  /**
   * Fail-loud stub; supply `cancel` on the fixture's session face to exercise it.
   * @returns never — always throws.
--- a/packages/client/test-runtime/tests/runtime.spec.tsx
+++ b/packages/client/test-runtime/tests/runtime.spec.tsx
@@ -467,6 +467,7 @@ describe('fixture session face', () => {
    await runtime.sessions.add({ id: 's1' })
    const bare = runtime.sessions.behavior('s1')
    expect(() => bare.prompt()).toThrow(/prompt is not stubbed/)
+    expect(() => bare.updateQueue()).toThrow(/updateQueue is not stubbed/)
    expect(() => bare.cancel()).toThrow(/cancel is not stubbed/)
    expect(() => bare.command()).toThrow(/command is not stubbed/)
    expect(() => bare.loadOlder()).toThrow(/loadOlder is not stubbed/)
--- a/packages/client/tsdown.client.ts
+++ b/packages/client/tsdown.client.ts
@@ -128,6 +128,7 @@ export function clientBundle(id: string, libEntry: readonly string[]): UserConfi
      async load(virtualId: string) {
        if (!virtualId.startsWith(CSS_VIRTUAL_PREFIX)) return null
        const fileId = virtualId.slice(CSS_VIRTUAL_PREFIX.length, -CSS_VIRTUAL_SUFFIX.length)
+        // The virtual id otherwise hides the physical stylesheet from Rolldown's watch graph.
        this.addWatchFile(fileId)
        const source = await readFile(fileId)
        const { code, exports: cssExports } = transform({
--- a/packages/client/ui-conversation/README.i18n.yaml
+++ b/packages/client/ui-conversation/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-conversation/README.md
-README.md: 5e24e4aad5154430fa48c80eb439694005df7c6f
-README.zh.md: 89a34041e156e137d966bdafbc92d86477df166e
+README.md: 75c181f2e1240f753d1f8c30152d2978151b059f
+README.zh.md: 6dc167c63af27dfbc37c51b9a55087cf2c50dc7f
--- a/packages/client/ui-conversation/README.md
+++ b/packages/client/ui-conversation/README.md
@@ -36,7 +36,9 @@ None; this package neither assembles nor sends a provider request.

 - **The stats line has no duration segment** — assistant `usage` carries token accounting only; elapsed-time needs a host data source.
 - **Details panel is the minimal form and currently has no entry point** — selected call args/result raw display; the Input/Output/Metadata switch, Prev/Next stepping, and See-in-trajectory deep link are deferred. Tool rows stopped being details-panel click targets and nothing replaced that gesture, so `ChatViewInjected.openDetails` is implemented but uncalled and the panel (including its terminal card) is unreachable in the assembled application; its rendering stays covered by mounting it with a selection directly.
- **Assistant per-message paging is a reserved slot** — drawn in the design, not implemented. The finalized IconActions row (copy / branch / clock) ships; branch remains a chrome stub.
+- **Assistant per-message paging is a reserved slot** — drawn in the design, not implemented. The finalized content IconActions row (copy / branch / clock) ships under text output only; branch remains a chrome stub.
 - **The sparkle icon for the others tool row is a hand-drawn approximation** — the design glyph's vector geometry is not exportable locally; promotion into ui-primitives waits on an exact export.
 - **The approval panel's "Always allow this type" is deferred** — durable grants need a grant-storage design; only allow-once/reject answer today.
 - **TodoPanel truncates long item text to one ellipsized line** — the figma strip has no wrap or expand affordance; full text is not readable inline.
+- **Queue edit is text-only** — rows containing non-text blocks still show a flattened preview, but their edit control is disabled because the inline editor cannot preserve those blocks. A text row's edit mode replaces delete with save and cancel; Enter saves and Escape cancels. QueueDock exposes no send-now control.
+- **Web exposes pending Queue only** — the Host omits pending steering from the Queue snapshot until steering has its own interaction. A consumed `steering/message` still renders in the durable transcript so external steering remains truthful on replay.
--- a/packages/client/ui-conversation/README.zh.md
+++ b/packages/client/ui-conversation/README.zh.md
@@ -36,7 +36,9 @@ todo 两个面就是在该形状上的两个注册项，都是普通注册方插

 - **统计行没有耗时区段**：assistant `usage` 只携带 token 计数；耗时需要主机数据源。
 - **详情面板是最小形态，且当前没有入口**：以原始形式显示已选择调用的参数／结果；Input/Output/Metadata 切换、Prev/Next 步进与 See-in-trajectory 深链接暂缓实现。工具行已不再是详情面板的点击目标，且没有任何手势接替它，因此 `ChatViewInjected.openDetails` 虽已实现却无人调用，该面板（含其终端卡片）在组装后的应用中不可达；其渲染仍由直接以选中态挂载它来覆盖。
- **assistant 逐消息分页是预留 slot**：设计中已有图稿，尚未实现。已定稿的 IconActions 行（复制／分支／时钟）已落地；分支仍是 chrome stub。
+- **assistant 逐消息分页是预留 slot**：设计中已有图稿，尚未实现。已定稿的内容 IconActions 行（复制／分支／时钟）只挂在 text 输出下；分支仍是 chrome stub。
 - **others 工具行的闪光图标是手绘近似版本**：无法在本地导出设计字形的矢量几何；等到存在精确导出后再将其提升到 ui-primitives。
 - **审批面板的「始终允许此类」暂缓**：持久授权需要授权存储设计；今天只能回答允许一次／拒绝。
 - **TodoPanel 将过长条目截成单行省略号**：figma 条没有换行或展开入口，完整文本无法在行内读完。
+- **Queue 编辑仅支持文本**：包含非文本块的行仍显示扁平化预览，但由于内联编辑器无法保留这些块，其编辑控件会被禁用。文本行进入编辑模式后，删除会替换为保存和取消；Enter 保存，Escape 取消。QueueDock 不提供立即发送控件。
+- **Web 仅暴露待处理 Queue**：在 steering（中途引导）拥有专用交互之前，Host 不会把待处理 steering 纳入 Queue 快照。已消费的 `steering/message` 仍会渲染到持久 transcript（文本记录）中，因此从外部提交的 steering 在回放时仍能如实呈现。
--- a/packages/client/ui-conversation/src/client/chat/AssistantMarkdown.module.css
+++ b/packages/client/ui-conversation/src/client/chat/AssistantMarkdown.module.css
@@ -34,11 +34,3 @@
  /* Optical align with 28px icon hit targets that pad 6px past the glyph. */
  margin-left: -6px;
 }
-
-/* Hover-capable pointers: reveal shared actions on root hover/focus. */
-@media (hover: hover) {
-  .root:hover .actions,
-  .root:focus-within .actions {
-    opacity: 1;
-  }
-}
--- a/packages/client/ui-conversation/src/client/chat/AssistantMarkdown.tsx
+++ b/packages/client/ui-conversation/src/client/chat/AssistantMarkdown.tsx
@@ -4,7 +4,8 @@
 // view groups them into tool rows through its keyed toolview slot (figma
 // step-summary flow). Shared by finalized nodes and the streaming partial;
 // the turn-level loading dots live in the chat view's tail, not here.
-// Finalized nodes append IconActions (copy / branch / clock) once streaming ends.
+// Finalized content (text) nodes append IconActions once streaming ends;
+// Think / tool-head-only nodes stay chrome-free.

 import { memo } from 'react'
 import type { AssistantBlock } from '@deepseek-ai/dsh-client-runtime/client'
@@ -38,6 +39,11 @@ function copyText(blocks: readonly AssistantBlock[]): string {
  return parts.join('')
 }

+/** True when the node has model-visible text content worth chrome under. */
+function hasContentText(blocks: readonly AssistantBlock[]): boolean {
+  return blocks.some(block => block.kind === 'text' && block.text.trim() !== '')
+}
+
 /** Reasoning block as the Think variant summary row (figma 39:28304). */
 function ThinkRow({ text, running }: { text: string; running: boolean }) {
  return (
@@ -64,8 +70,8 @@ export const AssistantMarkdown = memo(function AssistantMarkdown({
    || interrupted === true
    || blocks.some(block => block.kind !== 'tool-call')
  if (!hasVisible) return null
-  // Footer only after the turn settles with a known event time; streaming omits it.
-  const showActions = !streaming && time !== undefined
+  // Footer only under settled content text; Think-only / streaming omit it.
+  const showActions = !streaming && time !== undefined && hasContentText(blocks)
  return (
    <div className={css.root} data-streaming={streaming || undefined}>
      <div className={css.body}>
--- a/packages/client/ui-conversation/src/client/chat/MessageIconActions.module.css
+++ b/packages/client/ui-conversation/src/client/chat/MessageIconActions.module.css
@@ -1,5 +1,5 @@
 /* Shared message IconActions row (user + assistant). Parent modules own
-   hover-reveal selectors and layout offsets via the composed className. */
+   layout offsets via the composed className. Always visible when mounted. */

 .actions {
  display: flex;
@@ -25,14 +25,6 @@
  white-space: nowrap;
 }

-/* Hover-capable pointers: hide until a parent hover/focus rule reveals. */
-@media (hover: hover) {
-  .actions {
-    opacity: 0;
-    transition: opacity var(--ds-transition-duration) var(--ds-ease-in-out);
-  }
-}
-
 .action {
  display: inline-flex;
  align-items: center;
--- a/packages/client/ui-conversation/src/client/chat/MessageIconActions.tsx
+++ b/packages/client/ui-conversation/src/client/chat/MessageIconActions.tsx
@@ -18,7 +18,7 @@ export interface MessageIconActionsProps {
  clock: 'start' | 'end'
  /** When true, append the stub edit control (user bubble). */
  edit?: boolean | undefined
-  /** Parent layout / hover-reveal class composed onto the actions row. */
+  /** Parent layout class composed onto the actions row. */
  className?: string | undefined
 }

--- a/packages/client/ui-conversation/src/client/chat/MessageItem.module.css
+++ b/packages/client/ui-conversation/src/client/chat/MessageItem.module.css
@@ -20,14 +20,6 @@
  color: var(--dsw-alias-label-primary);
 }

-/* Hover-capable pointers: reveal shared MessageIconActions on row hover/focus. */
-@media (hover: hover) {
-  .userRow:hover .actions,
-  .userRow:focus-within .actions {
-    opacity: 1;
-  }
-}
-
 .badge {
  display: inline-block;
  margin-bottom: 4px;
--- a/packages/client/ui-conversation/src/client/contract/queue.ts
+++ b/packages/client/ui-conversation/src/client/contract/queue.ts
@@ -0,0 +1,13 @@
+/** Queue contracts derived from the runtime session face and snapshot. */
+import type {
+  ConversationSnapshot, SessionFace,
+} from '@deepseek-ai/dsh-client-runtime/client'
+
+/** One address accepted by the runtime session's queue mutation verb. */
+export type QueueItemId = Parameters<SessionFace['updateQueue']>[0]
+
+/** One mutation accepted by the runtime session's queue mutation verb. */
+export type QueueAction = Parameters<SessionFace['updateQueue']>[1]
+
+/** One row projected by the runtime session's authoritative queue snapshot. */
+export type QueueRow = ConversationSnapshot['queue'][number]
--- a/packages/client/ui-conversation/src/client/input/contract.ts
+++ b/packages/client/ui-conversation/src/client/input/contract.ts
@@ -10,6 +10,7 @@ import type {
  ArbitrateKey, ArbitrateOutcome, CommandClaim, ConsumeTokenRequest, PickOutcome,
  ReferenceInsert, SubmitOutcome, TokenSpan,
 } from '@deepseek-ai/dsh-client-ui-slash/client'
+import type { QueueRow } from '../contract/queue.ts'

 /**
 * The scoped-event application verbs: the hub's bail listeners call these,
@@ -99,12 +100,8 @@ export interface ComposerKeyboard {
  dismissPopup(): void
 }

-/** One queued-message row projected from the session/queued frames (T9 supplies the store). */
-export interface QueuedMessage {
-  /** Stable row key: the enqueueing prompt's rpcId. */
-  readonly key: string
-  readonly preview: string
-}
+/** One independently addressable row projected from the transient queue snapshot. */
+export type QueuedMessage = QueueRow

 /** Guard union of the scoped consume-token event, checked by the machine. */
 export type ConsumeTokenGuard = ConsumeTokenRequest['guard']
--- a/packages/client/ui-conversation/src/client/queue/QueueDock.module.css
+++ b/packages/client/ui-conversation/src/client/queue/QueueDock.module.css
@@ -1,30 +1,114 @@
-/* Neutral stacked strip above the input (queue rows are informational, not a warn state). */
+/* Figma .FileContainerText 1:791: 776px wrapper around the inset 752px panel. */

 .dock {
-  margin: 6px 0;
-  padding: 8px 12px;
-  border: 1px solid var(--dsw-alias-separator-primary);
-  border-radius: 10px;
-  background: var(--dsw-alias-bg-base);
+  box-sizing: border-box;
+  flex: none;
+  width: 100%;
+  max-width: 776px;
+  /* Eat InputBar's 6px top padding and tuck the panel 2px under the card;
+     the later composer sibling paints its surface and shadow over this edge. */
+  margin: 0 auto -10px;
+  padding: 2px 12px;
 }

-.title {
-  font-size: 12px;
-  font-weight: 500;
-  color: var(--dsw-alias-label-secondary);
+.panel {
+  position: relative;
+  overflow: hidden;
+  width: 100%;
+  padding-top: 2px;
+  border-radius: 14px 14px 0 0;
+  background: var(--dsw-specific-tip);
+}
+
+.panel::after {
+  position: absolute;
+  inset: 0;
+  border: 1px solid var(--dsw-alias-border-l1);
+  border-bottom: none;
+  border-radius: inherit;
+  content: '';
+  pointer-events: none;
 }

 .list {
-  margin: 4px 0 0;
+  margin: 0;
  padding: 0;
  list-style: none;
 }

 .row {
-  overflow: hidden;
-  font-size: 12px;
-  line-height: 20px;
-  color: var(--dsw-alias-label-primary);
-  white-space: nowrap;
-  text-overflow: ellipsis;
+  box-sizing: border-box;
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  width: 100%;
+  height: 36px;
+  padding: 4px 5px 4px 12px;
+  border-radius: 8px;
+}
+
+.preview,
+.editor {
+  flex: 1 1 auto;
+  min-width: 0;
+  font: var(--dsw-font-xs-13);
+  font-family: Inter, var(--dsw-font-family);
+}
+
+.preview {
+  overflow: hidden;
+  color: var(--dsw-alias-label-primary-dimmed);
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  word-break: break-word;
+}
+
+.editor {
+  box-sizing: border-box;
+  height: 28px;
+  padding: 0 8px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 6px;
+  outline: none;
+  background: var(--dsw-alias-bg-base);
+  color: var(--dsw-alias-label-primary);
+}
+
+.editor:focus {
+  border-color: var(--dsw-alias-state-business-primary);
+}
+
+.actions {
+  display: flex;
+  flex: none;
+  align-items: center;
+  gap: 10px;
+}
+
+.action {
+  display: grid;
+  flex: none;
+  place-items: center;
+  width: 28px;
+  height: 28px;
+  padding: 0;
+  border: none;
+  border-radius: 999px;
+  background: transparent;
+  color: var(--dsw-alias-label-tertiary);
+  cursor: pointer;
+}
+
+.action:hover:not(:disabled) {
+  background: var(--dsw-alias-interactive-bg-hover);
+}
+
+.action:focus-visible {
+  outline: 2px solid var(--dsw-alias-label-tertiary);
+  outline-offset: -2px;
+}
+
+.action:disabled {
+  cursor: default;
+  opacity: 0.45;
 }
--- a/packages/client/ui-conversation/src/client/queue/QueueDock.tsx
+++ b/packages/client/ui-conversation/src/client/queue/QueueDock.tsx
@@ -1,48 +1,185 @@
-// Read-only queue dock entry (design v4 queue cut 1): renders the session's
-// inbox mirror (session/queued frames + connect baseline) as one stacked
-// strip above the input. No per-row actions — the host inbox has no
-// addressable entries yet (queue cut 2 ledger).
+// Queue dock entry: renders the authoritative transient inbox snapshot and
+// addresses per-row mutations through the session-scoped conversation face.
 //
 // The 'conversation.input.dock' SlotMap declaration lives in
 // ../contract/slots.ts beside the other input-region slots.
 import type { Context } from 'cordis'
+import { useEffect, useState } from 'react'
 import type { PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
-import type {} from '@deepseek-ai/dsh-client-runtime/client'
+import type { SessionId } from '@deepseek-ai/dsh-client-runtime/client'
+import {
+  IconCheckOutline16, IconCloseOutline16, IconEditOutline16, IconTrashOutline16,
+} from '@deepseek-ai/dsh-client-ui-primitives'
+import type { QueueAction, QueueItemId } from '../contract/queue.ts'
 import css from './QueueDock.module.css'

+/** Queue operations injected by the session-scoped registration. */
+export interface QueueDockInjected {
+  updateQueue: (itemId: QueueItemId, action: QueueAction) => Promise<void>
+  notify: (level: 'info' | 'error', text: string) => void
+}
+
 /** Full props of a dock entry: InputZone owner share + session standard kit + global seat. */
-export type QueueDockProps = PropsRuntime<'conversation.input.dock'>
+export type QueueDockProps = PropsRuntime<'conversation.input.dock'> & QueueDockInjected

 /** Queue strip: one preview line per queued message; renders null when the queue is empty. */
-export function QueueDock({ useSession }: QueueDockProps) {
+export function QueueDock({ useSession, updateQueue, notify }: QueueDockProps) {
  const queue = useSession(s => s.queue)
+  const [editing, setEditing] = useState<{ id: QueueItemId; text: string } | null>(null)
+  const [busy, setBusy] = useState<QueueItemId | null>(null)
+
+  useEffect(() => {
+    if (editing !== null && !queue.some(row => row.id === editing.id)) setEditing(null)
+  }, [editing, queue])
+
  if (queue.length === 0) return null
+
+  const applyAction = async (
+    itemId: QueueItemId,
+    action: QueueAction,
+    failure: string,
+  ): Promise<boolean> => {
+    setBusy(itemId)
+    try {
+      await updateQueue(itemId, action)
+      return true
+    } catch {
+      notify('error', failure)
+      return false
+    } finally {
+      setBusy(current => current === itemId ? null : current)
+    }
+  }
+
+  const saveEdit = async (): Promise<void> => {
+    if (editing === null || editing.text.trim() === '') return
+    if (await applyAction(
+      editing.id,
+      { kind: 'edit', content: [{ type: 'text', text: editing.text }] },
+      '编辑失败：这条消息可能已经开始发送。',
+    )) setEditing(null)
+  }
+
  return (
    <div className={css.dock}>
-      <div className={css.title}>已排队 {queue.length} 条</div>
-      <ul className={css.list}>
-        {queue.map(row => (
-          <li key={row.key} className={css.row}>{row.preview}</li>
-        ))}
-      </ul>
+      <div className={css.panel}>
+        <ul className={css.list}>
+          {queue.map(row => (
+            <li key={row.id} className={css.row}>
+              {editing?.id === row.id
+                ? (
+                  <input
+                    autoFocus
+                    className={css.editor}
+                    aria-label="编辑排队消息"
+                    value={editing.text}
+                    onChange={(event) => { setEditing({ id: row.id, text: event.currentTarget.value }) }}
+                    onKeyDown={(event) => {
+                      if (event.key === 'Escape') {
+                        setEditing(null)
+                        return
+                      }
+                      if (event.key === 'Enter' && !event.nativeEvent.isComposing) {
+                        event.preventDefault()
+                        void saveEdit()
+                      }
+                    }}
+                  />
+                )
+                : <span className={css.preview}>{row.preview}</span>}
+              <div className={css.actions}>
+                {editing?.id === row.id
+                  ? (
+                    <>
+                      <button
+                        type="button"
+                        className={css.action}
+                        aria-label="保存排队消息"
+                        title="保存排队消息"
+                        disabled={busy !== null || editing.text.trim() === ''}
+                        onClick={() => { void saveEdit() }}
+                      >
+                        <IconCheckOutline16 size={14} />
+                      </button>
+                      <button
+                        type="button"
+                        className={css.action}
+                        aria-label="取消编辑"
+                        title="取消编辑"
+                        disabled={busy !== null}
+                        onClick={() => { setEditing(null) }}
+                      >
+                        <IconCloseOutline16 size={14} />
+                      </button>
+                    </>
+                  )
+                  : (
+                    <>
+                      <button
+                        type="button"
+                        className={css.action}
+                        aria-label="编辑排队消息"
+                        title={row.text === null ? '包含非文本内容，暂不支持编辑' : '编辑排队消息'}
+                        disabled={busy !== null || row.text === null}
+                        onClick={() => {
+                          if (row.text !== null) setEditing({ id: row.id, text: row.text })
+                        }}
+                      >
+                        <IconEditOutline16 size={14} />
+                      </button>
+                      <button
+                        type="button"
+                        className={css.action}
+                        aria-label="删除排队消息"
+                        title="删除排队消息"
+                        disabled={busy !== null}
+                        onClick={() => {
+                          void applyAction(
+                            row.id,
+                            { kind: 'remove' },
+                            '删除失败：这条消息可能已经开始发送。',
+                          )
+                        }}
+                      >
+                        <IconTrashOutline16 size={14} />
+                      </button>
+                    </>
+                  )}
+              </div>
+            </li>
+          ))}
+        </ul>
+      </div>
    </div>
  )
 }

 /**
- * The dock entry as a plain registrant plugin (bash posture).
- * `inject: ['conversation']` is the ordering seam: the conversation service
- * mounts after ui-conversation's slot registrations, so the
- * 'conversation.input.dock' declaration is on the ledger by then.
+ * The dock entry as a plain registrant plugin. The conversation service is the
+ * ordering and action seam; session scopes provide the exact queue owner.
 */
 export const queueDockEntry = {
  name: 'conversation-queue-dock',
-  inject: ['slots', 'conversation'],
+  inject: ['slots', 'conversation', 'sessions'],
  /**
   * Register the queue strip into the input dock (list entry, order 0).
   * @param ctx - registrant context (disposal rides ctx.effect inside slots.register).
   */
  apply(ctx: Context): void {
-    ctx.slots.register({ name: 'conversation.input.dock', id: 'queue', order: 0 }, QueueDock)
+    ctx.slots.register({
+      name: 'conversation.input.dock',
+      id: 'queue',
+      order: 0,
+      inject: (sessionId: SessionId): QueueDockInjected => {
+        const actx = ctx.sessions.scope(sessionId)
+        if (actx === undefined) throw new Error(`queue dock: session "${sessionId}" resolved no scope`)
+        const conversation = actx.get('conversation')
+        if (conversation === undefined) throw new Error('queue dock: conversation service unavailable')
+        return {
+          updateQueue: (itemId, action) => conversation.updateQueue(itemId, action),
+          notify: (level, text) => { conversation.input.for(actx).notify(level, text) },
+        }
+      },
+    }, QueueDock)
  },
 }
--- a/packages/client/ui-conversation/src/client/queue/store.ts
+++ b/packages/client/ui-conversation/src/client/queue/store.ts
@@ -11,8 +11,8 @@ import type { QueuedMessage } from '../input/contract.ts'
 /**
 * Project a session's queue rows as a bare observable (subscribe/getSnapshot).
 * The wiring layer (T5) overlays this onto InputState.queue; the runtime
- * QueuedMessage and the input-contract QueuedMessage are structurally the
- * same frozen shape ({key, preview}).
+ * QueuedMessage and the input-contract QueuedMessage are structurally
+ * identical.
 * @param session - the resident session face.
 * @returns the queue read face (snapshot reference stable while the queue is unchanged).
 */
--- a/packages/client/ui-conversation/src/client/service.ts
+++ b/packages/client/ui-conversation/src/client/service.ts
@@ -13,6 +13,7 @@ import type { Context } from 'cordis'
 // error, so scope resolution goes through the sessions service (scopeOf
 // method) instead of the standalone helper.
 import type { ISessions, SessionFace, SessionId } from '@deepseek-ai/dsh-client-runtime/client'
+import type { QueueAction, QueueItemId } from './contract/queue.ts'
 import type { InputService } from './input/contract.ts'

 /**
@@ -30,6 +31,13 @@ export interface IConversation {
   * @returns completion; business failures reject (and land in promptError).
   */
  send(text: string, mode: 'queue' | 'steer'): Promise<void>
+  /**
+   * Apply one operation to a pending queue occurrence.
+   * @param itemId - agent-owned inbox occurrence identity.
+   * @param action - edit or remove operation.
+   * @returns completion; business failures reject.
+   */
+  updateQueue(itemId: QueueItemId, action: QueueAction): Promise<void>
  /**
   * Cancel the scoped session's in-flight turn.
   * @returns completion; failures reject as in send.
@@ -71,6 +79,15 @@ export class ConversationService extends Service implements IConversation {
    if (!result.ok) throw new Error(`conversation.send failed: ${result.error.code}: ${result.error.message}`)
  }

+  /** Apply one operation to a pending queue occurrence. */
+  async updateQueue(itemId: QueueItemId, action: QueueAction): Promise<void> {
+    const session = this.scopedSession('updateQueue')
+    const result = await session.updateQueue(itemId, action)
+    if (!result.ok) {
+      throw new Error(`conversation.updateQueue failed: ${result.error.code}: ${result.error.message}`)
+    }
+  }
+
  /** Cancel the scoped session's in-flight turn (failures land in promptError and reject, as in send). */
  async cancel(): Promise<void> {
    const session = this.scopedSession('cancel')
--- a/packages/client/ui-conversation/tests/chat-branch-tails.spec.tsx
+++ b/packages/client/ui-conversation/tests/chat-branch-tails.spec.tsx
@@ -177,7 +177,7 @@ describe('small branch tails', () => {
    expect(view.getByText('one-liner')).toBeTruthy()
  })

-  it('finalized assistant messages expose copy / branch / clock after the body; streaming omits them', () => {
+  it('finalized content messages expose copy / branch / clock; Think-only and streaming omit them', () => {
    const writeText = vi.fn().mockResolvedValue(undefined)
    Object.defineProperty(navigator, 'clipboard', {
      configurable: true,
@@ -199,6 +199,17 @@ describe('small branch tails', () => {
    expect(writeText).toHaveBeenCalledWith('answer body')
    settled.unmount()

+    const thinkOnly = render(
+      <AssistantMarkdown
+        blocks={[{ kind: 'reasoning', text: 'only thinking' }]}
+        streaming={false}
+        time={time}
+      />,
+    )
+    expect(thinkOnly.queryByRole('button', { name: '复制' })).toBeNull()
+    expect(thinkOnly.queryByText('14:24')).toBeNull()
+    thinkOnly.unmount()
+
    const streaming = render(
      <AssistantMarkdown blocks={[{ kind: 'text', text: 'partial' }]} streaming time={time} />,
    )
--- a/packages/client/ui-conversation/tests/queue-dock.spec.tsx
+++ b/packages/client/ui-conversation/tests/queue-dock.spec.tsx
@@ -1,20 +1,27 @@
 // @vitest-environment jsdom
 /**
- * QueueDock rendering (web input-triggers queue cut 1): empty queue renders
- * nothing, rows render one preview line each keyed by rpcId, and the strip
- * follows queue changes through the useSession selector.
+ * QueueDock rendering and operations: authoritative rows, inline editing,
+ * removal, failure notices, and live retirement.
 */
-import { afterEach, describe, expect, it } from 'vitest'
-import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { act, cleanup, fireEvent, render, waitFor } from '@testing-library/react'
 import { useSyncExternalStore } from 'react'
-import type { ConversationSnapshot, QueuedMessage, SessionId, SessionListState } from '@deepseek-ai/dsh-client-runtime/client'
+import type {
+  ConversationSnapshot, QueuedMessage, SessionId, SessionListState,
+} from '@deepseek-ai/dsh-client-runtime/client'
 import type { SnapshotSelectorHook } from '@deepseek-ai/dsh-client-ui-slots'
+import type { QueueItemId } from '../src/client/contract/queue.ts'
 import type { InputState } from '../src/client/input/contract.ts'
-import { QueueDock, queueDockEntry } from '../src/client/queue/QueueDock.tsx'
+import { QueueDock, queueDockEntry, type QueueDockInjected } from '../src/client/queue/QueueDock.tsx'

 afterEach(cleanup)

 const SID = 's1' as SessionId
+const iid = (id: string): QueueItemId => id as QueueItemId
+
+function row(id: string, text: string | null, preview = text ?? '[image]'): QueuedMessage {
+  return { id: iid(id), preview, text }
+}

 function snapshotWith(queue: QueuedMessage[]): ConversationSnapshot {
  return {
@@ -24,31 +31,30 @@ function snapshotWith(queue: QueuedMessage[]): ConversationSnapshot {
  }
 }

-/** Minimal live source backing the useSession stub (queue swaps notify subscribers). */
+/** Minimal live source backing the useSession stub. */
 function liveSession(initial: ConversationSnapshot) {
  let snapshot = initial
  const listeners = new Set<() => void>()
-  const useSession: SnapshotSelectorHook<ConversationSnapshot> = sel =>
+  const useSession: SnapshotSelectorHook<ConversationSnapshot> = selector =>
    useSyncExternalStore(
-      (fn) => {
-        listeners.add(fn)
-        return () => listeners.delete(fn)
+      (listener) => {
+        listeners.add(listener)
+        return () => listeners.delete(listener)
      },
-      () => sel(snapshot),
+      () => selector(snapshot),
    )
  return {
    useSession,
    push(next: ConversationSnapshot): void {
      snapshot = next
-      for (const fn of [...listeners]) fn()
+      for (const listener of [...listeners]) listener()
    },
  }
 }

-/** InputZone owner stub (the dock reads useSession only; the zone fields satisfy the owner share). */
 const INPUT_STATE: InputState = { draft: '', draftRev: 0, phase: 'plain', occurrences: [], queue: [] }

-function kitFor(snapshot: ConversationSnapshot) {
+function kitFor(snapshot: ConversationSnapshot, injected: Partial<QueueDockInjected> = {}) {
  return {
    sessionId: SID,
    useSessions: (() => { throw new Error('unused') }) as unknown as SnapshotSelectorHook<SessionListState>,
@@ -58,6 +64,9 @@ function kitFor(snapshot: ConversationSnapshot) {
    inputActions: { setDraft: () => {}, submit: () => {} } as never,
    session: snapshot,
    input: INPUT_STATE,
+    updateQueue: vi.fn(() => Promise.resolve()),
+    notify: vi.fn(),
+    ...injected,
  }
 }

@@ -69,20 +78,118 @@ describe('QueueDock', () => {
    expect(container.innerHTML).toBe('')
  })

-  it('renders one preview row per queued message with the count strip', () => {
+  it('renders active actions and disables editing for mixed-content rows', () => {
    const snap = snapshotWith([
-      { key: 'p-1', preview: '第一条排队消息' },
-      { key: 'p-2', preview: 'second queued line' },
+      row('i-1', '第一条排队消息'),
+      row('i-2', null, 'image [image]'),
    ])
    const source = liveSession(snap)
    const { container } = render(<QueueDock {...kitFor(snap)} useSession={source.useSession} />)
-    expect(container.textContent).toContain('已排队 2 条')
-    const rows = [...container.querySelectorAll('li')]
-    expect(rows.map(r => r.textContent)).toEqual(['第一条排队消息', 'second queued line'])
+    expect([...container.querySelectorAll('li')].map(item => item.textContent))
+      .toEqual(['第一条排队消息', 'image [image]'])
+    expect(container.querySelectorAll('button')).toHaveLength(4)
+    expect(container.querySelectorAll('[aria-label="编辑排队消息"]')).toHaveLength(2)
+    expect(container.querySelectorAll('[aria-label="删除排队消息"]')).toHaveLength(2)
+    expect(container.querySelectorAll('[aria-label="立即发送排队消息"]')).toHaveLength(0)
+    expect((container.querySelectorAll('[aria-label="编辑排队消息"]')[0] as HTMLButtonElement).disabled).toBe(false)
+    expect((container.querySelectorAll('[aria-label="编辑排队消息"]')[1] as HTMLButtonElement).disabled).toBe(true)
+    expect(container.querySelectorAll('[aria-label="编辑排队消息"]')[1]?.getAttribute('title'))
+      .toBe('包含非文本内容，暂不支持编辑')
  })

-  it('follows queue changes: retirement empties the strip back to null', () => {
-    const snap = snapshotWith([{ key: 'p-1', preview: '在场' }])
+  it('edits text inline with save and cancel controls, then saves with the same item identity', async () => {
+    const snap = snapshotWith([row('i-edit', 'before')])
+    const source = liveSession(snap)
+    const updateQueue = vi.fn(() => Promise.resolve())
+    const { getByLabelText, queryByLabelText } = render(
+      <QueueDock {...kitFor(snap, { updateQueue })} useSession={source.useSession} />,
+    )
+
+    fireEvent.click(getByLabelText('编辑排队消息'))
+    const editor = getByLabelText('编辑排队消息') as HTMLInputElement
+    expect(getByLabelText('保存排队消息')).toBeTruthy()
+    expect(getByLabelText('取消编辑')).toBeTruthy()
+    expect(queryByLabelText('删除排队消息')).toBeNull()
+    fireEvent.change(editor, { target: { value: 'after' } })
+    fireEvent.keyDown(editor, { key: 'Enter' })
+
+    await waitFor(() => {
+      expect(updateQueue).toHaveBeenCalledWith(iid('i-edit'), {
+        kind: 'edit',
+        content: [{ type: 'text', text: 'after' }],
+      })
+    })
+  })
+
+  it('cancels an edit by button or Escape without mutating the queue', () => {
+    const snap = snapshotWith([row('i-edit', 'before')])
+    const source = liveSession(snap)
+    const updateQueue = vi.fn(() => Promise.resolve())
+    const { getByLabelText, getByText } = render(
+      <QueueDock {...kitFor(snap, { updateQueue })} useSession={source.useSession} />,
+    )
+
+    fireEvent.click(getByLabelText('编辑排队消息'))
+    fireEvent.change(getByLabelText('编辑排队消息'), { target: { value: 'abandoned' } })
+    fireEvent.click(getByLabelText('取消编辑'))
+    expect(getByText('before')).toBeTruthy()
+
+    fireEvent.click(getByLabelText('编辑排队消息'))
+    fireEvent.keyDown(getByLabelText('编辑排队消息'), { key: 'Escape' })
+    expect(getByText('before')).toBeTruthy()
+    expect(updateQueue).not.toHaveBeenCalled()
+  })
+
+  it('keeps editing during IME composition and disables a blank save', () => {
+    const snap = snapshotWith([row('i-edit', 'before')])
+    const source = liveSession(snap)
+    const updateQueue = vi.fn(() => Promise.resolve())
+    const { getByLabelText } = render(
+      <QueueDock {...kitFor(snap, { updateQueue })} useSession={source.useSession} />,
+    )
+
+    fireEvent.click(getByLabelText('编辑排队消息'))
+    const editor = getByLabelText('编辑排队消息')
+    fireEvent.change(editor, { target: { value: '   ' } })
+    expect(getByLabelText('保存排队消息')).toHaveProperty('disabled', true)
+    fireEvent.change(editor, { target: { value: '输入中' } })
+    fireEvent.keyDown(editor, { key: 'Enter', isComposing: true })
+    expect(updateQueue).not.toHaveBeenCalled()
+    expect(getByLabelText('编辑排队消息')).toBeTruthy()
+  })
+
+  it('removes the addressed row', async () => {
+    const snap = snapshotWith([row('i-1', 'one'), row('i-2', 'two')])
+    const source = liveSession(snap)
+    const updateQueue = vi.fn(() => Promise.resolve())
+    const { getAllByLabelText } = render(
+      <QueueDock {...kitFor(snap, { updateQueue })} useSession={source.useSession} />,
+    )
+
+    fireEvent.click(getAllByLabelText('删除排队消息')[0]!)
+    await waitFor(() => {
+      expect(updateQueue).toHaveBeenCalledWith(iid('i-1'), { kind: 'remove' })
+    })
+  })
+
+  it('keeps the row and surfaces a notice when an operation loses the claim race', async () => {
+    const snap = snapshotWith([row('i-race', 'pending')])
+    const source = liveSession(snap)
+    const notify = vi.fn()
+    const updateQueue = vi.fn(() => Promise.reject(new Error('not found')))
+    const { getByLabelText, getByText } = render(
+      <QueueDock {...kitFor(snap, { updateQueue, notify })} useSession={source.useSession} />,
+    )
+
+    fireEvent.click(getByLabelText('删除排队消息'))
+    await waitFor(() => {
+      expect(notify).toHaveBeenCalledWith('error', '删除失败：这条消息可能已经开始发送。')
+    })
+    expect(getByText('pending')).toBeTruthy()
+  })
+
+  it('follows authoritative retirement back to null', () => {
+    const snap = snapshotWith([row('i-1', '在场')])
    const source = liveSession(snap)
    const { container } = render(<QueueDock {...kitFor(snap)} useSession={source.useSession} />)
    expect(container.textContent).toContain('在场')
@@ -90,11 +197,9 @@ describe('QueueDock', () => {
    expect(container.innerHTML).toBe('')
  })

-  it('ships the registrant plugin shape (list entry into conversation.input.dock)', () => {
-    // Registration itself runs under T5's slot declaration; here we pin the
-    // frozen registration surface so the wiring layer can mount it verbatim.
+  it('ships the session-scoped registrant plugin shape', () => {
    expect(queueDockEntry.name).toBe('conversation-queue-dock')
-    expect(queueDockEntry.inject).toEqual(['slots', 'conversation'])
+    expect(queueDockEntry.inject).toEqual(['slots', 'conversation', 'sessions'])
    expect(typeof queueDockEntry.apply).toBe('function')
  })
 })
--- a/packages/client/ui-conversation/tests/service-orchestration.spec.ts
+++ b/packages/client/ui-conversation/tests/service-orchestration.spec.ts
@@ -12,11 +12,12 @@ import { InputHub } from '../src/client/input/hub.ts'
 async function bench() {
  const runtime = await SlotTestRuntime.create()
  const prompt = vi.fn(() => Promise.resolve({ ok: true as const, value: { accepted: true as const } }))
+  const updateQueue = vi.fn(() => Promise.resolve({ ok: true as const, value: { accepted: true as const } }))
  const cancel = vi.fn(() => Promise.resolve({ ok: true as const, value: { accepted: true as const } }))
  const loadOlder = vi.fn(() => Promise.resolve())
  await runtime.sessions.add({
    id: 's1',
-    session: { prompt, cancel, loadOlder },
+    session: { prompt, updateQueue, cancel, loadOlder },
  })
  // config.input is required (the apply shares its hub with the inject
  // factories); the bench passes its own instance explicitly.
@@ -26,16 +27,18 @@ async function bench() {
  await fiber.await()
  const root = runtime.ctx.get('conversation') as ConversationService
  const scoped = runtime.sessions.scope('s1')!.get('conversation') as ConversationService
-  return { runtime, root, scoped, prompt, cancel, loadOlder }
+  return { runtime, root, scoped, prompt, updateQueue, cancel, loadOlder }
 }

 describe('ConversationService', () => {
  it('routes operations through the public Session binding', async () => {
    const b = await bench()
    await b.scoped.send('hello', 'steer')
+    await b.scoped.updateQueue('item-1' as never, { kind: 'remove' })
    await b.scoped.cancel()
    await b.scoped.loadOlder()
    expect(b.prompt).toHaveBeenCalledWith([{ type: 'text', text: 'hello' }], 'steer')
+    expect(b.updateQueue).toHaveBeenCalledWith('item-1', { kind: 'remove' })
    expect(b.cancel).toHaveBeenCalledOnce()
    expect(b.loadOlder).toHaveBeenCalledOnce()
    await b.runtime.dispose()
--- a/packages/context/time-context/tests/time-context.spec.ts
+++ b/packages/context/time-context/tests/time-context.spec.ts
@@ -49,6 +49,7 @@ function sessionAgent(session: Session, id = 'agent'): Agent {
      session.append('user/message', input, { surfaceOp: 'append' })
    },
    send: () => {},
+    updateInbox: () => 'not-found',
    cancel() {},
    whenIdle: () => Promise.resolve(),
  }
--- a/packages/context/tmux-context/tests/tmux-context.spec.ts
+++ b/packages/context/tmux-context/tests/tmux-context.spec.ts
@@ -101,6 +101,7 @@ function sessionAgent(session: Session, id = 'agent'): Agent {
    ctx: new Context(),
    followup: () => {},
    steer: () => {},
+    updateInbox: () => 'not-found',
    inject(input) {
      session.append('user/message', input, { surfaceOp: 'append' })
    },
--- a/packages/context/workspace-context/README.i18n.yaml
+++ b/packages/context/workspace-context/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/context/workspace-context/README.md
-README.md: df75b29dd3e8dbb504aac9e9885c32a809cbf70f
-README.zh.md: 555e55464071261f5d1752b65ed6884c5452f4ae
+README.md: 2669422ec1fa7a74ba329cd96ee6b7e5e6da7e9d
+README.zh.md: e9fab4c6998f1193068389b41bdd7fa7d8c98dca
--- a/packages/context/workspace-context/README.md
+++ b/packages/context/workspace-context/README.md
@@ -42,7 +42,7 @@ These instructions apply to work under `packages/app`. Use them as guidance when
 </system-reminder>
 ```

-A same-file edit starts with `Updated instructions from: <path>` and says to use the new content instead of the previously loaded content. When a candidate disappears or becomes a per-directory duplicate of an earlier candidate, the message is `Instructions removed: <path>` followed by `The previously loaded instructions from this file no longer apply.` Literal `</system-reminder>` text inside an instruction file is escaped so file content cannot close the plugin-owned frame.
+A same-file edit starts with `Updated instructions from: <path>` and says to use the new content instead of the previously loaded content. When a candidate disappears or becomes a per-directory duplicate of an earlier candidate, the message is `Instructions removed: <path>` followed by `The previously loaded instructions from this file no longer apply.` Literal `</system-reminder>` text anywhere in instruction content or model-visible path, scope, and budget metadata is escaped so repository-controlled text cannot close the plugin-owned frame.

 The plugin owns the complete `<system-reminder>` framing, and every injected `user/message` reaches the model verbatim with no core wrapper.

--- a/packages/context/workspace-context/README.zh.md
+++ b/packages/context/workspace-context/README.zh.md
@@ -42,7 +42,7 @@ These instructions apply to work under `packages/app`. Use them as guidance when
 </system-reminder>
 ```

-同一文件的编辑以 `Updated instructions from: <path>` 开头，并说明使用新内容替代之前加载的内容。候选文件消失或成为同一目录中较早候选文件的重复项时，消息是 `Instructions removed: <path>`，后跟 `The previously loaded instructions from this file no longer apply.`。指令文件中的字面 `</system-reminder>` 文本会转义，因此文件内容无法关闭插件控制的框架。
+同一文件的编辑以 `Updated instructions from: <path>` 开头，并说明使用新内容替代之前加载的内容。候选文件消失或成为同一目录中较早候选文件的重复项时，消息是 `Instructions removed: <path>`，后跟 `The previously loaded instructions from this file no longer apply.`。指令内容或模型可见的路径、scope 与预算元数据中出现的字面 `</system-reminder>` 文本都会转义，因此仓库控制的文本无法关闭插件控制的框架。

 该插件控制完整的 `<system-reminder>` 框架，每个注入的 `user/message` 都不经核心包装便原样传给模型。

--- a/packages/context/workspace-context/src/render.ts
+++ b/packages/context/workspace-context/src/render.ts
@@ -59,15 +59,12 @@ function truncateUtf8(value: string, maxBytes: number): string {
  return truncated
 }

-function escapeInstructionContent(content: string): string {
-  // TODO(instruction-frame-paths): apply the same delimiter neutralization to
-  // every interpolated path and scope; repository-controlled names can
-  // otherwise close the plugin-owned system-reminder frame.
-  return content.replaceAll(SYSTEM_REMINDER_CLOSE, '<\\/system-reminder>')
+function escapeInstructionFrameBody(body: string): string {
+  return body.replaceAll(SYSTEM_REMINDER_CLOSE, '<\\/system-reminder>')
 }

 function sectionText(file: LoadedInstructionFile): string {
-  return `Instructions from: ${file.displayPath}\n\n${escapeInstructionContent(file.content)}`
+  return `Instructions from: ${file.displayPath}\n\n${file.content}`
 }

 /** Directory component that identifies the single user-global instruction scope. */
@@ -136,7 +133,7 @@ function additionalSectionText(file: LoadedInstructionFile): string {
    '',
    `These instructions apply to work under \`${scope}\`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.`,
    '',
-    escapeInstructionContent(file.content),
+    file.content,
  ].join('\n')
 }

@@ -153,7 +150,7 @@ function changedSectionText(item: ChangeRenderItem): string {
    '',
    'This file changed after it was loaded. Use the following content instead of the previously loaded instructions from this file.',
    '',
-    escapeInstructionContent(file.content),
+    file.content,
  ].join('\n')
 }

@@ -214,7 +211,7 @@ function buildInstructionText(
  // producer's content (the pattern a future `meta`-driven renderer would
  // generalize — see the deferred note in
  // ../../../../.agents/notes/implemented/simplification/2026-07-20-unwrap-injected-content-envelopes.md).
-  return [SYSTEM_REMINDER_OPEN, body.join('\n\n'), SYSTEM_REMINDER_CLOSE].join('\n')
+  return [SYSTEM_REMINDER_OPEN, escapeInstructionFrameBody(body.join('\n\n')), SYSTEM_REMINDER_CLOSE].join('\n')
 }

 function withTruncatedContent(file: LoadedInstructionFile, includedBytes: number): LoadedInstructionFile {
@@ -285,8 +282,10 @@ function renderInstructionContext(
    originalBytes: byteLength(mostSpecific.content),
    includedBytes: 0,
  }]
-  const compactNotice = markerText(maxBytes, omitted, truncated)
-  const compactWithHeading = [compactNotice, style.section(withTruncatedContent(mostSpecific, 0))].join('\n\n')
+  const compactNotice = escapeInstructionFrameBody(markerText(maxBytes, omitted, truncated))
+  const compactWithHeading = escapeInstructionFrameBody(
+    [compactNotice, style.section(withTruncatedContent(mostSpecific, 0))].join('\n\n'),
+  )
  if (byteLength(compactWithHeading) <= maxBytes) return { text: compactWithHeading, omitted, truncated }
  const text = byteLength(compactNotice) <= maxBytes ? compactNotice : truncateUtf8(compactNotice, maxBytes)
  return { text, omitted, truncated }
--- a/packages/context/workspace-context/tests/workspace-context.spec.ts
+++ b/packages/context/workspace-context/tests/workspace-context.spec.ts
@@ -41,7 +41,7 @@ import {
  type InstructionVersionCache,
  type PendingInstructionChange,
 } from '../src/state.ts'
-import { candidateScopeKey } from '../src/render.ts'
+import { candidateScopeKey, renderInstructionChanges } from '../src/render.ts'
 import { MockAdapter, textResponse, toolCallResponse } from '../../../core/agent-loop/tests/mock-adapter.ts'

 /** Per-candidate reconciliation scope key: directory paired with the file name. */
@@ -184,6 +184,7 @@ function stubAgent(cwd?: string, seed: SessionEvent[] = []): Agent {
      session.append('user/message', input, { surfaceOp: 'append' })
    },
    send: () => {},
+    updateInbox: () => 'not-found',
    cancel() {},
    whenIdle: () => Promise.resolve(),
  }
@@ -681,6 +682,37 @@ describe('workspace context rendering', () => {
    expect(rendered.text).toContain('<\\/system-reminder>')
  })

+  it('neutralizes system-reminder closing delimiters in paths and derived scopes', () => {
+    const displayPath = 'scope</system-reminder>/AGENTS.md'
+    const file = { absolutePath: `/repo/${displayPath}`, displayPath, content: 'rules' }
+    const rendered = [
+      renderWorkspaceContext([file], { maxBytes: 65536 }).text,
+      ...(['set', 'replace', 'remove'] as const).map(action => renderInstructionChanges([{
+        change: { action, scope: 'scope</system-reminder>\0AGENTS.md', path: displayPath },
+        file,
+      }], 65536).text),
+    ]
+
+    for (const text of rendered) {
+      expect(text.match(/<\/system-reminder>/g)).toHaveLength(1)
+      expect(text).toContain('scope<\\/system-reminder>')
+    }
+  })
+
+  it('neutralizes a system-reminder closing delimiter in budget marker paths', () => {
+    const rendered = renderWorkspaceContext([
+      {
+        absolutePath: '/repo/scope</system-reminder>/AGENTS.md',
+        displayPath: 'scope</system-reminder>/AGENTS.md',
+        content: 'root '.repeat(100),
+      },
+      { absolutePath: '/repo/leaf/AGENTS.md', displayPath: 'leaf/AGENTS.md', content: 'leaf rules' },
+    ], { maxBytes: 400 })
+
+    expect(rendered.text).toContain('omitted scope<\\/system-reminder>/AGENTS.md')
+    expect(rendered.text.match(/<\/system-reminder>/g)).toHaveLength(1)
+  })
+
  it('preserves more specific files under the byte budget and names omitted/truncated paths', () => {
    const rendered = renderWorkspaceContext([
      { absolutePath: '/repo/AGENTS.md', displayPath: 'AGENTS.md', content: 'root '.repeat(100) },
--- a/packages/cordis/tool-cordis/src/api-catalog.ts
+++ b/packages/cordis/tool-cordis/src/api-catalog.ts
@@ -1150,24 +1150,31 @@ export const EVENT_API: readonly EventApiEntry[] = [
  {
    name: 'agent/inbox/dequeue',
    mode: 'emit',
-    signature: '\'agent/inbox/dequeue\'( this: Scoped<Agent>, agent: Agent, message: UserMessage, placement: InboxPlacement, ): void',
-    jsDoc: '/**\n * The driver claimed one item out of the inbox: a queued item at a turn\n * boundary, or steering drained between steps. Fires after the item leaves\n * its FIFO and before it becomes a durable message.\n * @param agent - the agent whose inbox item was claimed.\n * @param message - the claimed message.\n * @param placement - the FIFO that claimed this occurrence; together with\n *   `message.id`, it matches the earliest outstanding enqueue in that FIFO.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
+    signature: '\'agent/inbox/dequeue\'(this: Scoped<Agent>, agent: Agent, item: InboxItem): void',
+    jsDoc: '/**\n * The driver claimed one item out of the inbox: a queued item at a turn\n * boundary, or steering drained between steps. Fires after the item leaves\n * its FIFO and before it becomes a durable message.\n * @param agent - the agent whose inbox item was claimed.\n * @param item - the exact claimed occurrence.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
    summary: 'The driver claimed one item out of the inbox: a queued item at a turn boundary, or steering drained between steps.',
  },
  {
    name: 'agent/inbox/discard',
    mode: 'emit',
-    signature: '\'agent/inbox/discard\'(this: Scoped<Agent>, agent: Agent, messages: UserMessage[]): void',
-    jsDoc: '/**\n * Pending inbox items were dropped without delivering them, so every\n * enqueue occurrence receives exactly one terminal `agent/inbox/dequeue` OR\n * `agent/inbox/discard`. `cancel()` without `keepInbox`, including disposal,\n * emits this after `agent/cancel-requested` when applicable and before\n * aborting the active work. Fires once per drop with every dropped item.\n * @param agent - the agent whose inbox items were dropped.\n * @param messages - the discarded messages in FIFO order (queued then steering); never empty.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
+    signature: '\'agent/inbox/discard\'(this: Scoped<Agent>, agent: Agent, items: InboxItem[]): void',
+    jsDoc: '/**\n * Pending inbox items were dropped without delivering them, so every\n * enqueue occurrence receives exactly one terminal `agent/inbox/dequeue` OR\n * `agent/inbox/discard`. `cancel()` without `keepInbox`, including disposal,\n * emits this after `agent/cancel-requested` when applicable and before\n * aborting the active work. Fires once per drop with every dropped item.\n * @param agent - the agent whose inbox items were dropped.\n * @param items - the discarded occurrences in FIFO order (queued then steering); never empty.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
    summary: 'Pending inbox items were dropped without delivering them, so every enqueue occurrence receives exactly one terminal `agent/inbox/dequeue` OR `agent/inbox/discard`.',
  },
  {
    name: 'agent/inbox/enqueue',
    mode: 'emit',
-    signature: '\'agent/inbox/enqueue\'(this: Scoped<Agent>, agent: Agent, message: UserMessage, placement: InboxPlacement): void',
-    jsDoc: '/**\n * An item entered the queued or steering inbox. `placement` is the\n * acceptance-time routing result; listeners must not reconstruct it from\n * later agent or session state.\n * @param agent - the owning agent.\n * @param message - accepted content, source, and correlation identity.\n * @param placement - resolved queued or steering placement.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
+    signature: '\'agent/inbox/enqueue\'(this: Scoped<Agent>, agent: Agent, item: InboxItem): void',
+    jsDoc: '/**\n * An item entered the queued or steering inbox. `placement` is the\n * acceptance-time routing result; listeners must not reconstruct it from\n * later agent or session state.\n * @param agent - the owning agent.\n * @param item - accepted occurrence, message, and resolved placement.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
    summary: 'An item entered the queued or steering inbox.',
  },
+  {
+    name: 'agent/inbox/update',
+    mode: 'emit',
+    signature: '\'agent/inbox/update\'(this: Scoped<Agent>, agent: Agent, item: InboxItem): void',
+    jsDoc: '/**\n * A still-pending queued item changed content. The item id, placement, and\n * position remain stable while the event carries the replacement message.\n * @param agent - the owning agent.\n * @param item - the complete post-update occurrence.\n * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.\n * @mode emit\n */',
+    summary: 'A still-pending queued item changed content.',
+  },
  {
    name: 'agent/prompt-submit',
    mode: 'waterfall',
@@ -1454,7 +1461,7 @@ export const EVENT_API: readonly EventApiEntry[] = [
 export const TYPE_API: readonly TypeApiEntry[] = [
  {
    name: 'Agent',
-    declaration: 'export interface Agent {\n    readonly id: SessionId;\n    readonly options: AgentOptions;\n    readonly session: Session;\n    readonly status: AgentStatus;\n    readonly acceptsNextStep: boolean;\n    readonly ctx: Context;\n    send(message: UserMessage, options: SendOptions): void;\n    cancel(cause: AgentCancelCause, options?: CancelOptions): void;\n    whenIdle(): Promise<void>;\n    followup(message: UserMessage): void;\n    steer(message: UserMessage): void;\n    inject(message: UserMessage): void;\n}',
+    declaration: 'export interface Agent {\n    readonly id: SessionId;\n    readonly options: AgentOptions;\n    readonly session: Session;\n    readonly status: AgentStatus;\n    readonly acceptsNextStep: boolean;\n    readonly ctx: Context;\n    send(message: UserMessage, options: SendOptions): void;\n    updateInbox(id: InboxItemId, action: InboxAction): InboxActionResult;\n    cancel(cause: AgentCancelCause, options?: CancelOptions): void;\n    whenIdle(): Promise<void>;\n    followup(message: UserMessage): void;\n    steer(message: UserMessage): void;\n    inject(message: UserMessage): void;\n}',
  },
  {
    name: 'AgentCancelCause',
@@ -1848,6 +1855,18 @@ export const TYPE_API: readonly TypeApiEntry[] = [
    name: 'GoalView',
    declaration: 'export interface GoalView extends GoalSnapshot {\n    readonly roundsStarted: number;\n    readonly createdAt: number;\n    readonly updatedAt: number;\n    readonly activation: GoalActivation;\n}',
  },
+  {
+    name: 'InboxAction',
+    declaration: 'export type InboxAction = {\n    readonly kind: \'edit\';\n    readonly content: ContentBlock[];\n} | {\n    readonly kind: \'remove\';\n};',
+  },
+  {
+    name: 'InboxActionResult',
+    declaration: 'export type InboxActionResult = \'applied\' | \'not-found\';',
+  },
+  {
+    name: 'InboxItemId',
+    declaration: 'export type InboxItemId = Branded<\'InboxItemId\'>;',
+  },
  {
    name: 'InvariantFailure',
    declaration: 'export type InvariantFailure = (message: string) => never;',
--- a/packages/core/agent-loop/README.i18n.yaml
+++ b/packages/core/agent-loop/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/core/agent-loop/README.md
-README.md: 16d70cc06498fec1221b7872f988a0126f69f39f
-README.zh.md: ce68595072766ebbf1e4cbd9f7c262cee36c5eff
+README.md: a1617a1ef871f61157e0d70a06d055168170dced
+README.zh.md: 6ba945a41e700331929dabb557802c14256921fb
--- a/packages/core/agent-loop/README.md
+++ b/packages/core/agent-loop/README.md
@@ -55,7 +55,9 @@ Configured agents start automatically. A model call requires both `provider` and

 The concrete `ReactLoopAgent`, its queued input, outbox, and run controls are package-internal. The package root exports only the plugin/service/config contract, and the package exports map exposes no `./src/*` escape hatch; lifecycle owners create agents through `ctx.agents` rather than naming, constructing, or starting driver internals. One prepared session can be claimed by only one concrete driver, and everything observable happens through session events and the `agent/*` event taxonomy.

-The unified `send()` primitive routes content and source by (`target` × `wakeup`); `followup`/`steer`/`inject` are its fixed-preset aliases. A `next-turn` item joins the queued FIFO, waking the driver unless `wakeup: false`; admission happens before any turn opens. The loop opens a private next-step acceptance window before `agent/prompt-submit` and closes it before `turn/end`. During that window, `steer()` and `inject()` stage in one outbox; an allowed admission opens the turn, records the prompt and returned `additionalContexts`, then drains the staged input before the first request. A blocked or failed admission writes no prompt or hook-produced context. A caller-staged context-only batch then takes idle injection's immediate append, while steering and context staged beside it remain pending for retry or a later admitted prompt. Outside the window, steering becomes a waking queued prompt and injection immediately appends `user/message` without opening a turn or running the model. Every inbox enqueue publishes `agent/inbox/enqueue` with the resolved queued-or-steering placement; taking it publishes `agent/inbox/dequeue` with the same placement, and `cancel()` without `keepInbox` publishes `agent/inbox/discard`.
+The unified `send()` primitive routes content and source by (`target` × `wakeup`); `followup`/`steer`/`inject` are its fixed-preset aliases. A `next-turn` item joins the queued FIFO, waking the driver unless `wakeup: false`; admission happens before any turn opens. The loop opens a private next-step acceptance window before `agent/prompt-submit` and closes it before `turn/end`. During that window, `steer()` and `inject()` stage in one outbox; an allowed admission opens the turn, records the prompt and returned `additionalContexts`, then drains the staged input before the first request. A blocked or failed admission writes no prompt or hook-produced context. A caller-staged context-only batch then takes idle injection's immediate append, while steering and context staged beside it remain pending for retry or a later admitted prompt. Outside the window, steering becomes a waking queued prompt and injection immediately appends `user/message` without opening a turn or running the model.
+
+Every FIFO acceptance mints an `InboxItemId` and publishes `agent/inbox/enqueue` with the complete occurrence. `updateInbox()` owns the synchronous queued-item boundary: edit freezes replacement content without changing message identity or position, while remove publishes discard. Edit publishes `agent/inbox/update`; steering and claimed occurrences return `not-found`. Claim publishes `agent/inbox/dequeue` and irrevocably removes the live address before prompt admission, so a racing update cannot rewrite durable history; `cancel()` without `keepInbox` publishes `agent/inbox/discard`.

 ### Loop lifecycle (`agent.ts`)

--- a/packages/core/agent-loop/README.zh.md
+++ b/packages/core/agent-loop/README.zh.md
@@ -55,7 +55,9 @@ interface Config {

 实体 `ReactLoopAgent`、其排队输入、outbox 与运行控制均为包内部实现。包根只导出插件／服务／配置契约，包导出映射不提供 `./src/*` 逃逸路径；生命周期拥有方通过 `ctx.agents` 创建 agent，而不是点名、构造或启动驱动器内部组件。一个准备完成的会话只能由一个实体驱动器认领；所有可观测行为都通过会话事件和 `agent/*` 事件分类体系发生。

-统一的 `send()` 原语按（`target` × `wakeup`）路由内容与来源；`followup`/`steer`/`inject` 是它的固定预设别名。`next-turn` 项加入排队 FIFO，除非 `wakeup: false`，否则会唤醒驱动器；接纳发生在任何轮次开启之前。循环在 `agent/prompt-submit` 之前打开一个私有的 next-step 接收窗口，并在 `turn/end` 之前关闭它。在该窗口内，`steer()` 与 `inject()` 会暂存到同一个 outbox；接纳获准后会开启轮次，记录提示词及其返回的 `additionalContexts`，再于首次请求前排空暂存输入。接纳被阻止或失败时，不会写入提示词或钩子生成的上下文。之后，仅含调用方暂存上下文的批次会采用空闲注入的立即追加行为，而 steering（中途引导）及与其一同暂存的上下文则继续待处理，以供重试或之后获准的提示词使用。窗口之外，steering 会成为唤醒驱动器的排队提示词，而注入会立即追加 `user/message`，不开启轮次也不运行模型。每次 inbox 入队都会发布 `agent/inbox/enqueue`，并携带解析出的 queued 或 steering 路由归类；取走它会发布 `agent/inbox/dequeue`，并携带相同的路由归类；`cancel()` 在不带 `keepInbox` 时会发布 `agent/inbox/discard`。
+统一的 `send()` 原语按（`target` × `wakeup`）路由内容与来源；`followup`/`steer`/`inject` 是它的固定预设别名。`next-turn` 项加入排队 FIFO，除非 `wakeup: false`，否则会唤醒驱动器；接纳发生在任何轮次开启之前。循环在 `agent/prompt-submit` 之前打开一个私有的 next-step 接收窗口，并在 `turn/end` 之前关闭它。在该窗口内，`steer()` 与 `inject()` 会暂存到同一个 outbox；接纳获准后会开启轮次，记录提示词及其返回的 `additionalContexts`，再于首次请求前排空暂存输入。接纳被阻止或失败时，不会写入提示词或钩子生成的上下文。之后，仅含调用方暂存上下文的批次会采用空闲注入的立即追加行为，而 steering（中途引导）及与其一同暂存的上下文则继续待处理，以供重试或之后获准的提示词使用。窗口之外，steering 会成为唤醒驱动器的排队提示词，而注入会立即追加 `user/message`，不开启轮次也不运行模型。
+
+每次 FIFO 接受项时都会铸造一个 `InboxItemId`，并通过 `agent/inbox/enqueue` 发布完整的单次入队项。`updateInbox()` 持有同步 queued 项边界：编辑会冻结替换内容，但不改变消息标识或位置；移除会发布 discard。编辑会发布 `agent/inbox/update`；steering 项和已被认领的项会返回 `not-found`。认领操作会发布 `agent/inbox/dequeue`，并在提示词接纳前不可逆地移除实时寻址标识，因此竞态中的更新无法改写持久历史；`cancel()` 在不带 `keepInbox` 时会发布 `agent/inbox/discard`。

 ### 循环生命周期（`agent.ts`）

--- a/packages/core/agent-loop/src/agent.ts
+++ b/packages/core/agent-loop/src/agent.ts
@@ -8,13 +8,18 @@
 */

 import type { Context } from 'cordis'
-import { agentCarrier, assembleContextFor, emitAgentEvent } from '@deepseek-ai/dsh-agent'
+import { randomUUID } from 'node:crypto'
+import { agentCarrier, assembleContextFor, emitAgentEvent, InboxItemId } from '@deepseek-ai/dsh-agent'
 import { createScope } from '@deepseek-ai/dsh-scope'
 import type { Scope } from '@deepseek-ai/dsh-scope'
 import type {
  Agent,
  CancelOptions,
  AgentInterruptReason,
+  InboxAction,
+  InboxActionResult,
+  InboxItem,
+  InboxItemId as InboxItemIdType,
  InboxPlacement,
  AgentOptions,
  AgentStatus,
@@ -55,9 +60,9 @@ type StepOutcome =
 */
 export class ReactLoopAgent implements Agent {
  /** Prompts awaiting individual turns. */
-  private queued: { message: UserMessage; wakeup: boolean }[] = []
+  private queued: { item: InboxItem; wakeup: boolean }[] = []
  /** Input taken into the session log at step boundaries. */
-  private outbox: { message: UserMessage; steering: boolean }[] = []
+  private outbox: { message: UserMessage; steering: boolean; item?: InboxItem }[] = []

  /** Whether observers see a running interval; consecutive turns share it. */
  private busy = false
@@ -115,16 +120,52 @@ export class ReactLoopAgent implements Agent {
    }

    const placement: InboxPlacement = target === 'next-step' && this.acceptsNextStep ? 'steering' : 'queued'
+    const item: InboxItem = Object.freeze({
+      id: InboxItemId(randomUUID()),
+      message,
+      placement,
+    })
    if (placement === 'steering') {
-      this.outbox.push({ message, steering: true })
+      this.outbox.push({ message, steering: true, item })
    } else {
-      this.queued.push({ message, wakeup })
+      this.queued.push({ item, wakeup })
    }
    // Preserve the routing decision for every send in this synchronous caller
    // stack, while installing quiescence ownership before enqueue observers
    // can cancel or dispose.
    if (placement === 'queued' && wakeup) this.scheduleKick()
-    emitAgentEvent(this.loopCtx, this, 'agent/inbox/enqueue', message, placement)
+    emitAgentEvent(this.loopCtx, this, 'agent/inbox/enqueue', item)
+  }
+
+  /** Apply one synchronous mutation to a still-pending queued occurrence. */
+  updateInbox(id: InboxItemIdType, action: InboxAction): InboxActionResult {
+    const queuedIndex = this.queued.findIndex(candidate => candidate.item.id === id)
+    if (queuedIndex === -1) return 'not-found'
+
+    const pending = this.queued[queuedIndex]
+    /* v8 ignore next -- the index was resolved from this array without an async boundary. */
+    if (pending === undefined) throw new Error(`agent "${this.id}" queued item disappeared during update`)
+
+    /* v8 ignore next -- InboxAction is a closed discriminated union; all variants are covered below. */
+    switch (action.kind) {
+      case 'edit': {
+        const item: InboxItem = Object.freeze({
+          ...pending.item,
+          message: freezeMessage({ ...pending.item.message, content: action.content }),
+        })
+        this.queued[queuedIndex] = { ...pending, item }
+        emitAgentEvent(this.loopCtx, this, 'agent/inbox/update', item)
+        return 'applied'
+      }
+      case 'remove': {
+        this.queued.splice(queuedIndex, 1)
+        emitAgentEvent(this.loopCtx, this, 'agent/inbox/discard', [pending.item])
+        return 'applied'
+      }
+      default:
+        /* v8 ignore next -- InboxAction is a closed discriminated union. */
+        return assertNever(action)
+    }
  }

  /** Queue one ordinary prompt turn and wake the driver. */
@@ -169,9 +210,9 @@ export class ReactLoopAgent implements Agent {
      if (cause.kind !== 'disposed') emitAgentEvent(this.loopCtx, this, 'agent/cancel-requested', cause)
    }
    if (!options.keepInbox) {
-      const discarded = this.queued.map(item => item.message)
+      const discarded = this.queued.map(item => item.item)
      for (const item of this.outbox) {
-        if (item.steering) discarded.push(item.message)
+        if (item.steering && item.item !== undefined) discarded.push(item.item)
      }
      // Clear before abort observers run: replacement work belongs to the next turn.
      this.queued.length = 0
@@ -222,7 +263,8 @@ export class ReactLoopAgent implements Agent {
    // The some() guard above proves the queue is non-empty; the non-null
    // assertion expresses that invariant.
    // oxlint-disable-next-line typescript/no-non-null-assertion
-    const { message } = this.queued.shift()!
+    const { item } = this.queued.shift()!
+    const { message } = item
    const inheritedOutboxLength = this.outbox.length

    const admission = new AbortController()
@@ -293,7 +335,7 @@ export class ReactLoopAgent implements Agent {
    // Published only after the abort owner and pending done are installed: a
    // dequeue listener that cancels or disposes must find live cancellation
    // and quiescence ownership, not the previous activity's settled state.
-    emitAgentEvent(this.loopCtx, this, 'agent/inbox/dequeue', message, 'queued')
+    emitAgentEvent(this.loopCtx, this, 'agent/inbox/dequeue', item)
  }

  /**
@@ -643,7 +685,9 @@ export class ReactLoopAgent implements Agent {
    for (const item of this.outbox.splice(0, limit)) {
      if (item.steering) {
        steered = true
-        emitAgentEvent(this.loopCtx, this, 'agent/inbox/dequeue', item.message, 'steering')
+        /* v8 ignore next -- only inbox-backed steer entries carry steering:true. */
+        if (item.item === undefined) throw new Error(`agent "${this.id}" steering outbox item has no inbox identity`)
+        emitAgentEvent(this.loopCtx, this, 'agent/inbox/dequeue', item.item)
        this.session.append(
          'steering/message',
          { turn, message: item.message },
--- a/packages/core/agent-loop/tests/contract-regressions.spec.ts
+++ b/packages/core/agent-loop/tests/contract-regressions.spec.ts
@@ -4,7 +4,7 @@ import LlmService, { createUserMessage, CallId, MessageSource, ProviderRequestId
 import SessionStore, { Session, SessionEvent, SessionId, TurnEndReason } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry, { defineContentToolFixture, type PostToolDecision } from '@deepseek-ai/dsh-tools'
-import AgentRegistry, { type Agent, type InboxPlacement } from '@deepseek-ai/dsh-agent'
+import AgentRegistry, { type Agent, type InboxItem, type InboxPlacement } from '@deepseek-ai/dsh-agent'
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
 import { ReactLoopAgent } from '../src/agent.ts'
 import InvariantService from '@deepseek-ai/dsh-invariants'
@@ -53,6 +53,111 @@ function send(agent: Agent, text: string) {
  agent.followup(createUserMessage({ content: [{ type: 'text', text }], source: { kind: 'user' } }))
 }

+function inboxText(item: InboxItem): string {
+  return item.message.content
+    .flatMap(block => block.type === 'text' ? [block.text] : [])
+    .join('')
+}
+
+describe('addressable inbox operations', () => {
+  it('edits in place and removes exactly one queued item', async () => {
+    const adapter = new MockAdapter([
+      textResponse('first reply'),
+      textResponse('edited reply'),
+    ])
+    const ctx = await harness(adapter)
+    const agent = ctx.agentLoop.create(SessionId('inbox-actions'), { provider: 'mock', model: 'mock' })
+    const admission = Promise.withResolvers<undefined>()
+    const release = Promise.withResolvers<undefined>()
+    ctx.on('agent/prompt-submit', async (_subject, message, _signal, next) => {
+      if (message.content[0]?.type === 'text' && message.content[0].text === 'first') {
+        admission.resolve(undefined)
+        await release.promise
+      }
+      return next()
+    })
+
+    const pending: InboxItem[] = []
+    const updates: { id: string; text: string }[] = []
+    const discards: string[][] = []
+    ctx.on('agent/inbox/enqueue', (subject, item) => {
+      if (subject === agent && inboxText(item) !== 'first') pending.push(item)
+    })
+    ctx.on('agent/inbox/update', (subject, item) => {
+      if (subject === agent) updates.push({ id: item.id, text: inboxText(item) })
+    })
+    ctx.on('agent/inbox/discard', (subject, items) => {
+      if (subject === agent) discards.push(items.map(item => item.id))
+    })
+
+    send(agent, 'first')
+    await admission.promise
+    send(agent, 'remove me')
+    send(agent, 'edit me')
+    expect(pending.map(inboxText)).toEqual(['remove me', 'edit me'])
+
+    const remove = pending[0]!
+    const edit = pending[1]!
+    expect(agent.updateInbox(edit.id, {
+      kind: 'edit',
+      content: [{ type: 'text', text: 'edited' }],
+    })).toBe('applied')
+    expect(agent.updateInbox(remove.id, { kind: 'remove' })).toBe('applied')
+    expect(updates).toEqual([{ id: edit.id, text: 'edited' }])
+    expect(discards).toEqual([[remove.id]])
+
+    const idle = waitForIdle(ctx, agent)
+    release.resolve(undefined)
+    await idle
+    expect(agent.session.events
+      .filter(event => event.type === 'user/message')
+      .map(event => event.type === 'user/message'
+        ? event.data.content.flatMap(block => block.type === 'text' ? [block.text] : []).join('')
+        : ''))
+      .toEqual(['first', 'edited'])
+    expect(agent.updateInbox(edit.id, { kind: 'remove' })).toBe('not-found')
+  })
+
+  it('does not mutate steering occurrences', async () => {
+    const adapter = new MockAdapter([textResponse('done')])
+    const ctx = await harness(adapter)
+    const agent = ctx.agentLoop.create(SessionId('steering-inbox-actions'), { provider: 'mock', model: 'mock' })
+    const entered = Promise.withResolvers<undefined>()
+    const decision = Promise.withResolvers<{ kind: 'allow' }>()
+    ctx.on('agent/prompt-submit', async () => {
+      entered.resolve(undefined)
+      return decision.promise
+    })
+
+    const pending: InboxItem[] = []
+    ctx.on('agent/inbox/enqueue', (subject, item) => {
+      if (subject === agent && item.placement === 'steering') pending.push(item)
+    })
+
+    const idle = waitForIdle(ctx, agent)
+    send(agent, 'admitted prompt')
+    await entered.promise
+    agent.steer(createUserMessage({ content: [{ type: 'text', text: 'keep me' }], source: { kind: 'user' } }))
+    expect(pending.map(inboxText)).toEqual(['keep me'])
+
+    const steering = pending[0]!
+    expect(agent.updateInbox(steering.id, {
+      kind: 'edit',
+      content: [{ type: 'text', text: 'edited' }],
+    })).toBe('not-found')
+    expect(agent.updateInbox(steering.id, { kind: 'remove' })).toBe('not-found')
+
+    decision.resolve({ kind: 'allow' })
+    await idle
+    expect(agent.session.events
+      .filter(event => event.type === 'steering/message')
+      .map(event => event.type === 'steering/message'
+        ? event.data.message.content.flatMap(block => block.type === 'text' ? [block.text] : []).join('')
+        : ''))
+      .toEqual(['keep me'])
+  })
+})
+
 describe('assistant replay provenance', () => {
  it('records adapter replay state with the assembled assistant content', async () => {
    const response = textResponse('unchanged')
@@ -502,10 +607,10 @@ describe('adapter registration, routing, and accepted-input ownership', () => {
    const queuedSources: MessageSource[] = []
    const queuedShapes: string[][] = []
    const placements: InboxPlacement[] = []
-    ctx.on('agent/inbox/enqueue', (_agent, message, placement) => {
-      queuedSources.push(message.source)
-      queuedShapes.push(Object.keys(message).sort())
-      placements.push(placement)
+    ctx.on('agent/inbox/enqueue', (_agent, item) => {
+      queuedSources.push(item.message.source)
+      queuedShapes.push(Object.keys(item.message).sort())
+      placements.push(item.placement)
    })

    send(agent, 'go') // no explicit source → default {kind:'user'} must be visible
--- a/packages/core/agent-loop/tests/interception.spec.ts
+++ b/packages/core/agent-loop/tests/interception.spec.ts
@@ -86,8 +86,9 @@ describe('agent/prompt-submit', () => {
    const entered = Promise.withResolvers<undefined>()
    const decision = Promise.withResolvers<PromptDecision>()
    const observed: UserMessage[] = []
-    ctx.on('agent/inbox/enqueue', (subject, message) => {
+    ctx.on('agent/inbox/enqueue', (subject, item) => {
      if (subject !== agent) return
+      const message = item.message
      expect(Object.isFrozen(message)).toBe(true)
      expect(Object.isFrozen(message.content)).toBe(true)
      expect(Object.isFrozen(message.content[0])).toBe(true)
@@ -97,8 +98,8 @@ describe('agent/prompt-submit', () => {
        if (block?.type === 'text') block.text = 'listener mutation'
      }).toThrow()
    })
-    ctx.on('agent/inbox/enqueue', (subject, message) => {
-      if (subject === agent) observed.push(message)
+    ctx.on('agent/inbox/enqueue', (subject, item) => {
+      if (subject === agent) observed.push(item.message)
    })
    ctx.on('agent/prompt-submit', async () => {
      entered.resolve(undefined)
@@ -240,8 +241,8 @@ describe('agent/prompt-submit', () => {
      entered.resolve(undefined)
      return decision.promise
    })
-    ctx.on('agent/inbox/enqueue', (subject, _message, placement) => {
-      if (subject === agent) placements.push(placement)
+    ctx.on('agent/inbox/enqueue', (subject, item) => {
+      if (subject === agent) placements.push(item.placement)
    })

    const idle = waitForIdle(ctx, agent)
--- a/packages/core/agent-loop/tests/loop.spec.ts
+++ b/packages/core/agent-loop/tests/loop.spec.ts
@@ -59,6 +59,20 @@ describe('agent loop', () => {
    },
  )

+  it('seeds a valid AgentOptions.maxTokens into the first model request', async () => {
+    const adapter = new MockAdapter([textResponse('bounded')])
+    const ctx = await harness(adapter)
+    const agent = ctx.agentLoop.create(
+      SessionId('valid-max-tokens'),
+      { provider: 'mock', model: 'mock', maxTokens: 256 },
+    )
+
+    send(agent, 'use the configured output limit')
+    await waitForIdle(ctx, agent)
+
+    expect(adapter.requests[0]?.maxTokens).toBe(256)
+  })
+
  it('runs a simple turn: queued message → model → idle, with ordered events', async () => {
    const adapter = new MockAdapter([textResponse('hello there')])
    const ctx = await harness(adapter)
--- a/packages/core/agent/README.i18n.yaml
+++ b/packages/core/agent/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/core/agent/README.md
-README.md: 9ca79f28506b133a555bd7d1e984386c715fd9d6
-README.zh.md: a32f75431a6d7ced64ae2f2171b6aa924d23de3e
+README.md: 6bd5279ace93b6d2569833be6f102c854105c2eb
+README.zh.md: cdbb0c0b70124e0037a0f7a7a03ddedf1e3b78d3
--- a/packages/core/agent/README.md
+++ b/packages/core/agent/README.md
@@ -60,7 +60,8 @@ Turn and step boundaries and the model token stream are durable `session/event`

 The handle every plugin programs against:

- `agent.send(message, options)` — the one delivery primitive over the (`target` × `wakeup`) matrix. `message` is an already identified, frozen `UserMessage`; callers normally create it with `createUserMessage()` before routing begins. `SendOptions` owns only the `target` and `wakeup` policy. The agent publishes or queues the complete value as-is without minting or replacing its identity. The message's `agent/inbox/enqueue`/`dequeue`/`discard` events carry it so callers can correlate a queued item with its lifecycle; enqueue and dequeue also carry the resolved `queued | steering` placement so repeated message identities retire from the correct FIFO. `target: 'next-turn'` queues one independent FIFO item that, if admitted, becomes the sole ordinary prompt in its turn. `target: 'next-step'` with `wakeup: true` submits steering, while `target: 'next-step'` with `wakeup: false` injects durable context without running the model. The [one-send-one-turn Agent Note](../../../.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.md) owns the turn rationale.
+- `agent.send(message, options)` — the one delivery primitive over the (`target` × `wakeup`) matrix. `message` is an already identified, frozen `UserMessage`; callers normally create it with `createUserMessage()` before routing begins. `SendOptions` owns only the `target` and `wakeup` policy. Each accepted FIFO occurrence receives its own `InboxItemId`, even when callers reuse a `MessageId`; `agent/inbox/enqueue`/`update` and the terminal `dequeue` or `discard` carry that complete `InboxItem`. `target: 'next-turn'` queues one independent FIFO item that, if admitted, becomes the sole ordinary prompt in its turn. `target: 'next-step'` with `wakeup: true` submits steering, while `target: 'next-step'` with `wakeup: false` injects durable context without running the model. The [one-send-one-turn Agent Note](../../../.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.md) owns the turn rationale.
+- `agent.updateInbox(itemId, action)` — synchronously edits or removes one still-pending queued occurrence. Edit keeps its `MessageId`, `InboxItemId`, source, and FIFO position while replacing frozen content; remove emits the occurrence's terminal discard. Steering and claimed occurrences return `not-found`.
 - `agent.followup(input)` — the `next-turn`/wakeup preset of `send()`: queue an ordinary follow-up turn and wake the driver.
 - `agent.steer(input)` — the `next-step`/wakeup preset: during prompt admission or an open turn, stage steering for the next safe boundary without dispatching `agent/prompt-submit`; outside that acceptance window, delegate to a woken follow-up. Admission failure leaves staged steering for retry or a later admitted prompt, while cancellation or disposal may discard it.
 - `agent.inject(input)` — the `next-step`/no-wakeup preset: append model-facing context without running the model; the next request sees a verbatim user-role message whose provenance is carried by the required `input.source`. During prompt admission or an open turn, injection waits in the outbox for the next safe boundary. Outside that acceptance window, it appends immediately without opening a turn; a context-only admission batch takes this fallback if admission closes without a turn, while context staged beside steering remains pending with it. Persistence reacts to `session/event` independently. Injection emits no `agent/inbox/*` event.
--- a/packages/core/agent/README.zh.md
+++ b/packages/core/agent/README.zh.md
@@ -60,7 +60,8 @@ Agent *创建* 由实现 `AgentFactory` 的插件（`dsh-agent-loop`）提供，

 每个插件面向的 handle：

- `agent.send(message, options)`：覆盖（`target` × `wakeup`）矩阵的唯一投递原语。`message` 是已有标识且已冻结的 `UserMessage`；调用方通常会在开始路由前使用 `createUserMessage()` 创建它。`SendOptions` 只持有 `target` 与 `wakeup` 策略。agent 会原样发布或排队完整值，不会生成或替换其标识。该消息的 `agent/inbox/enqueue`/`dequeue`/`discard` 事件会携带完整消息，调用方可据此把排队项与其生命周期关联；入队与出队事件还会携带解析出的 `queued | steering` 路由归类，使重复出现的消息标识能在正确的 FIFO 中完成结算。`target: 'next-turn'` 在 FIFO 中排入一个独立项，获准后成为其轮次中唯一的普通提示词。`target: 'next-step'` 且 `wakeup: true` 提交 steering（中途引导），而 `target: 'next-step'` 且 `wakeup: false` 注入持久上下文，不运行模型。轮次原理由 [one-send-one-turn Agent Note](../../../.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.md)拥有。
+- `agent.send(message, options)`：覆盖（`target` × `wakeup`）矩阵的唯一投递原语。`message` 是已有标识且已冻结的 `UserMessage`；调用方通常会在开始路由前使用 `createUserMessage()` 创建它。`SendOptions` 只持有 `target` 与 `wakeup` 策略。每次获准进入 FIFO 的项都会获得独立的 `InboxItemId`，即使调用方复用了同一个 `MessageId`；`agent/inbox/enqueue`／`update` 及终态 `dequeue` 或 `discard` 都会携带这一完整 `InboxItem`。`target: 'next-turn'` 排队一条独立 FIFO 项，获准后成为其轮次中唯一的普通提示词。`target: 'next-step'` 且 `wakeup: true` 提交 steering（中途引导），而 `target: 'next-step'` 且 `wakeup: false` 注入持久上下文，不运行模型。轮次原理由 [one-send-one-turn Agent Note](../../../.agents/notes/implemented/simplification/2026-07-17-one-send-one-turn.md)拥有。
+- `agent.updateInbox(itemId, action)`：同步编辑或移除一个仍处于待处理状态的 queued 入队项。编辑会替换已冻结的内容，同时保留其 `MessageId`、`InboxItemId`、来源与 FIFO 位置；移除会发出该项的终态 discard。steering 项和已被认领的项会返回 `not-found`。
 - `agent.followup(input)`：`send()` 的 `next-turn`／wakeup 预设：排队一个普通后续轮次并唤醒驱动器。
 - `agent.steer(input)`：`next-step`／wakeup 预设：提示词接纳期间或轮次打开时，为下一个安全边界暂存 steering，且不分发 `agent/prompt-submit`；该接收窗口之外则委托给会唤醒的后续轮次。接纳失败会保留暂存的 steering，以供重试或之后获准的提示词使用，而取消或 dispose 可能丢弃它。
 - `agent.inject(input)`：`next-step`／不唤醒预设：追加面向模型的上下文而不运行模型；下一次请求会看到一条逐字的 user role 消息，其来源由必填的 `input.source` 携带。提示词接纳期间或轮次打开时，注入会在 outbox 中等待下一个安全边界。该接收窗口之外，它会立即追加而不开启轮次；如果接纳结束却未开启轮次，仅含上下文的接纳批次会采用这一回退，而与 steering 一同暂存的上下文则会随其继续待处理。持久化独立地响应 `session/event`。注入不发出 `agent/inbox/*` 事件。
--- a/packages/core/agent/package.json
+++ b/packages/core/agent/package.json
@@ -15,12 +15,17 @@
      "types": "./lib/types/invariant.d.ts",
      "default": "./lib/invariant.js"
    },
+    "./brand": {
+      "types": "./lib/types/brand.d.ts",
+      "default": "./lib/types/brand.js"
+    },
    "./src/*": "./src/*",
    "./package.json": "./package.json"
  },
  "files": [
    "lib/index.js",
    "lib/invariant.js",
+    "lib/types/**/*.js",
    "lib/types/**/*.d.ts",
    "lib/types/**/*.d.ts.map",
    "src"
--- a/packages/core/agent/src/brand.ts
+++ b/packages/core/agent/src/brand.ts
@@ -0,0 +1,23 @@
+/**
+ * dsh-agent's owned branded ids for live inbox occurrences.
+ *
+ * @module @deepseek-ai/dsh-agent/brand
+ */
+
+import type { Branded } from '@deepseek-ai/dsh-brand'
+
+/**
+ * Identifies one accepted occurrence in an agent inbox. Re-sending the same
+ * message creates a distinct item id, so pending work remains independently
+ * addressable.
+ */
+export type InboxItemId = Branded<'InboxItemId'>
+
+/**
+ * Brand a string as an {@link InboxItemId}.
+ * @param id - the agent-loop-minted occurrence identifier.
+ * @returns the same string, branded; no validation is performed.
+ */
+export function InboxItemId(id: string): InboxItemId {
+  return id as InboxItemId
+}
--- a/packages/core/agent/src/index.ts
+++ b/packages/core/agent/src/index.ts
@@ -15,6 +15,7 @@ import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session'
 import type { Agent, AgentOptions } from './types.ts'

 export * from './types.ts'
+export * from './brand.ts'
 export * from './llm-target.ts'
 export { agentCarrier, agentEvents, assembleContextFor, emitAgentEvent } from './dispatch.ts'
 export type { AgentEventDispatch, AgentSubjectEvent } from './dispatch.ts'
--- a/packages/core/agent/src/types.ts
+++ b/packages/core/agent/src/types.ts
@@ -9,6 +9,7 @@ import type { Context } from 'cordis'
 import type { Scoped } from '@deepseek-ai/dsh-scope'
 import type { ContentBlock, LlmCallConfig, LlmFailure, ResolvedRetryPolicy } from '@deepseek-ai/dsh-llm'
 import type { Session, SessionId, UserMessage } from '@deepseek-ai/dsh-session'
+import type { InboxItemId } from './brand.ts'
 import type {} from '@deepseek-ai/dsh-system-prompt'
 declare module '@deepseek-ai/dsh-system-prompt' {
  interface AssembleContext {
@@ -39,6 +40,24 @@ export type SendTarget = 'next-turn' | 'next-step'
 /** Resolved inbox placement reported when an accepted message is enqueued. */
 export type InboxPlacement = 'queued' | 'steering'

+/** One independently addressable accepted occurrence in an agent inbox. */
+export interface InboxItem {
+  /** Agent-loop-minted occurrence identity. */
+  readonly id: InboxItemId
+  /** Identified message delivered by the caller. */
+  readonly message: UserMessage
+  /** Acceptance-time FIFO classification. */
+  readonly placement: InboxPlacement
+}
+
+/** A user-requested mutation of one still-pending queued occurrence. */
+export type InboxAction =
+  | { readonly kind: 'edit'; readonly content: ContentBlock[] }
+  | { readonly kind: 'remove' }
+
+/** Result of applying an inbox action at the synchronous ownership boundary. */
+export type InboxActionResult = 'applied' | 'not-found'
+
 /**
 * Options for the unified {@link Agent.send} primitive over the
 * (`target` × `wakeup`) matrix. Named presets: {@link Agent.followup}
@@ -159,6 +178,16 @@ export interface Agent {
   */
  send(message: UserMessage, options: SendOptions): void

+  /**
+   * Mutate one still-pending queued occurrence synchronously. Editing preserves
+   * the message identity and queue position; removal publishes its terminal
+   * discard. Steering occurrences and driver-claimed items return `not-found`.
+   * @param id - independently addressable queued occurrence.
+   * @param action - edit or remove operation.
+   * @returns whether the pending occurrence was found and updated.
+   */
+  updateInbox(id: InboxItemId, action: InboxAction): InboxActionResult
+
  /**
   * Clear queued and steering work — unless `keepInbox` — and abort the active
   * turn. An effective call first emits `agent/cancel-requested` with the
@@ -242,29 +271,30 @@ declare module 'cordis' {
     * acceptance-time routing result; listeners must not reconstruct it from
     * later agent or session state.
     * @param agent - the owning agent.
-     * @param message - accepted content, source, and correlation identity.
-     * @param placement - resolved queued or steering placement.
+     * @param item - accepted occurrence, message, and resolved placement.
     * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.
     * @mode emit
     */
-    'agent/inbox/enqueue'(this: Scoped<Agent>, agent: Agent, message: UserMessage, placement: InboxPlacement): void
+    'agent/inbox/enqueue'(this: Scoped<Agent>, agent: Agent, item: InboxItem): void
+    /**
+     * A still-pending queued item changed content. The item id, placement, and
+     * position remain stable while the event carries the replacement message.
+     * @param agent - the owning agent.
+     * @param item - the complete post-update occurrence.
+     * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.
+     * @mode emit
+     */
+    'agent/inbox/update'(this: Scoped<Agent>, agent: Agent, item: InboxItem): void
    /**
     * The driver claimed one item out of the inbox: a queued item at a turn
     * boundary, or steering drained between steps. Fires after the item leaves
     * its FIFO and before it becomes a durable message.
     * @param agent - the agent whose inbox item was claimed.
-     * @param message - the claimed message.
-     * @param placement - the FIFO that claimed this occurrence; together with
-     *   `message.id`, it matches the earliest outstanding enqueue in that FIFO.
+     * @param item - the exact claimed occurrence.
     * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.
     * @mode emit
     */
-    'agent/inbox/dequeue'(
-      this: Scoped<Agent>,
-      agent: Agent,
-      message: UserMessage,
-      placement: InboxPlacement,
-    ): void
+    'agent/inbox/dequeue'(this: Scoped<Agent>, agent: Agent, item: InboxItem): void
    /**
     * Pending inbox items were dropped without delivering them, so every
     * enqueue occurrence receives exactly one terminal `agent/inbox/dequeue` OR
@@ -272,11 +302,11 @@ declare module 'cordis' {
     * emits this after `agent/cancel-requested` when applicable and before
     * aborting the active work. Fires once per drop with every dropped item.
     * @param agent - the agent whose inbox items were dropped.
-     * @param messages - the discarded messages in FIFO order (queued then steering); never empty.
+     * @param items - the discarded occurrences in FIFO order (queued then steering); never empty.
     * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners receive only that agent.
     * @mode emit
     */
-    'agent/inbox/discard'(this: Scoped<Agent>, agent: Agent, messages: UserMessage[]): void
+    'agent/inbox/discard'(this: Scoped<Agent>, agent: Agent, items: InboxItem[]): void
    /**
     * Effective broad cancellation was requested, before queued/outbox work
     * is cleared or the active turn is aborted. This observe-only notification
--- a/packages/core/agent/tests/agent.spec.ts
+++ b/packages/core/agent/tests/agent.spec.ts
@@ -24,6 +24,7 @@ function stubAgent(rawId: string, overrides: Partial<Agent> = {}): Agent {
    acceptsNextStep: false,
    ctx: new Context(),
    send: () => {},
+    updateInbox: () => 'not-found',
    followup: () => {},
    steer: () => {},
    inject: () => {},
--- a/packages/core/agent/tests/invariant.spec.ts
+++ b/packages/core/agent/tests/invariant.spec.ts
@@ -1,7 +1,7 @@
 import { freezeMessage, MessageId } from '@deepseek-ai/dsh-llm'
 import { describe, expect, it } from 'vitest'
 import { Context } from 'cordis'
-import { type Agent } from '@deepseek-ai/dsh-agent'
+import { InboxItemId, type Agent, type InboxItem, type InboxPlacement } from '@deepseek-ai/dsh-agent'
 import * as AgentInvariant from '@deepseek-ai/dsh-agent/invariant'
 import { scopeTarget } from '@deepseek-ai/dsh-scope'
 import InvariantService from '@deepseek-ai/dsh-invariants'
@@ -46,11 +46,16 @@ describe('agent status invariants', () => {
 })

 describe('agent inbox invariants', () => {
-  const info = () => freezeMessage({
-    id: MessageId('m'),
-    role: 'user' as const,
-    content: [],
-    source: { kind: 'user' as const },
+  let nextItem = 0
+  const info = (placement: InboxPlacement = 'queued'): InboxItem => ({
+    id: InboxItemId(`i-${nextItem++}`),
+    message: freezeMessage({
+      id: MessageId('m'),
+      role: 'user' as const,
+      content: [],
+      source: { kind: 'user' as const },
+    }),
+    placement,
  })

  it('accepts a dequeue and a discard covered by prior enqueues', async () => {
@@ -58,9 +63,9 @@ describe('agent inbox invariants', () => {
    const agent = mockAgent('i1')
    const at = scopeTarget(agent, agent)
    expect(() => {
-      ctx.emit(at, 'agent/inbox/enqueue', agent, info(), 'queued')
-      ctx.emit(at, 'agent/inbox/enqueue', agent, info(), 'steering')
-      ctx.emit(at, 'agent/inbox/dequeue', agent, info(), 'queued')
+      ctx.emit(at, 'agent/inbox/enqueue', agent, info())
+      ctx.emit(at, 'agent/inbox/enqueue', agent, info('steering'))
+      ctx.emit(at, 'agent/inbox/dequeue', agent, info())
      ctx.emit(at, 'agent/inbox/discard', agent, [info()])
    }).not.toThrow()
  })
@@ -68,7 +73,7 @@ describe('agent inbox invariants', () => {
  it('rejects a dequeue with no outstanding item', async () => {
    const ctx = await setup()
    const agent = mockAgent('i2')
-    expect(() => { ctx.emit(scopeTarget(agent, agent), 'agent/inbox/dequeue', agent, info(), 'queued') })
+    expect(() => { ctx.emit(scopeTarget(agent, agent), 'agent/inbox/dequeue', agent, info()) })
      .toThrow(/without a matching prior enqueue/)
  })

@@ -76,7 +81,7 @@ describe('agent inbox invariants', () => {
    const ctx = await setup()
    const agent = mockAgent('i3')
    const at = scopeTarget(agent, agent)
-    ctx.emit(at, 'agent/inbox/enqueue', agent, info(), 'queued')
+    ctx.emit(at, 'agent/inbox/enqueue', agent, info())
    expect(() => { ctx.emit(at, 'agent/inbox/discard', agent, [info(), info()]) })
      .toThrow(/dropped 2 items but only 1 were outstanding/)
  })
--- a/packages/core/scope/src/scoped-events.generated.ts
+++ b/packages/core/scope/src/scoped-events.generated.ts
@@ -15,6 +15,7 @@ const scopedSubjectResolvers: Readonly<Record<string, ScopedSubjectResolver | nu
  'agent/inbox/dequeue': args => args[0],
  'agent/inbox/discard': args => args[0],
  'agent/inbox/enqueue': args => args[0],
+  'agent/inbox/update': args => args[0],
  'agent/prompt-submit': args => args[0],
  'agent/request': args => args[0],
  'agent/request-error': args => args[0],
--- a/packages/core/scope/tests/invariant.spec.ts
+++ b/packages/core/scope/tests/invariant.spec.ts
@@ -2,7 +2,7 @@ import { freezeMessage, MessageId } from '@deepseek-ai/dsh-llm'
 import { describe, expect, it } from 'vitest'
 import { Context } from 'cordis'
 import type { Events } from 'cordis'
-import { type Agent } from '@deepseek-ai/dsh-agent'
+import { InboxItemId, type Agent } from '@deepseek-ai/dsh-agent'
 import { scopeTarget } from '@deepseek-ai/dsh-scope'
 import * as ScopeInvariant from '@deepseek-ai/dsh-scope/invariant'
 import InvariantService from '@deepseek-ai/dsh-invariants'
@@ -44,12 +44,14 @@ describe('scoped-dispatch invariants', () => {
      content: [],
      source: { kind: 'user' },
    })
+    const item = { id: InboxItemId('i'), message, placement: 'queued' as const }
    const agentRows = {
      'agent/created': [agent],
      'agent/disposed': [agent],
      'agent/status': [agent, 'idle'],
-      'agent/inbox/enqueue': [agent, message, 'queued'],
-      'agent/inbox/dequeue': [agent, message, 'queued'],
+      'agent/inbox/enqueue': [agent, item],
+      'agent/inbox/update': [agent, item],
+      'agent/inbox/dequeue': [agent, item],
      'agent/inbox/discard': [agent, []],
      'agent/cancel-requested': [agent, { kind: 'user' }],
      'agent/session-start': [agent, 'startup'],
--- a/packages/experimental/AGENTS.md
+++ b/packages/experimental/AGENTS.md
@@ -0,0 +1,11 @@
+# AGENTS.md — Experimental and internal packages
+
+These rules supplement the [package rules](../AGENTS.md). The [experimental and internal package group decision](../../.agents/notes/implemented/architecture/2026-07-28-experimental-plugin-package-group.md) owns the rationale.
+
+- All Cordis plugin packages whose whole public contract is experimental or internal-only belong here. An experimental option inside an otherwise stable package stays in that package's product-role group.
+- Use this directory to share engineering and product-manager prototypes across the team so others can discover, run, review, and extend them against the real plugin graph.
+- Official releases exclude this directory. A package enters a release only after moving to its product-role group; do not add packages here to release manifests or bundles.
+- Experimental packages carry no stability, compatibility, migration, or support promise. Internal-only packages may define narrower internal contracts but make no public release promise.
+- Experimental or internal-only status never relaxes repository engineering, security, documentation, lifecycle, testing, or snapshot requirements.
+- Release packages must not take runtime dependencies on packages here. Examples may; every other runtime dependent is also experimental or internal-only and belongs here. Tests may use them as development dependencies.
+- Promotion moves a package to its product-role group without renaming its `@deepseek-ai/dsh-*` package. Require explicit review of its public contract, limitations, test evidence, and a named owner accepting stable-package obligations.
--- a/packages/experimental/README.i18n.yaml
+++ b/packages/experimental/README.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/experimental/README.md
+README.md: db39af8bb1b1bcfd257e16e4ad1dd112f604ffb1
+README.zh.md: df9b8cb2a91faab7af782e0f53685368e99583ff
--- a/packages/experimental/README.md
+++ b/packages/experimental/README.md
@@ -0,0 +1,7 @@
+# experimental/ — experimental and internal packages
+
+English | [中文](README.zh.md)
+
+This group hosts team-shared engineering and product-manager prototypes plus internal-only Cordis plugins. It is excluded from official releases; packages move to their product-role group before release.
+
+No packages live here yet. The [subtree rules](AGENTS.md) define the no-warranty, dependency, and promotion boundaries.
--- a/packages/experimental/README.zh.md
+++ b/packages/experimental/README.zh.md
@@ -0,0 +1,7 @@
+# experimental/：实验性与内部专用包（package）
+
+[English](README.md) | 中文
+
+该分组容纳工程人员与产品经理在团队内共享的原型，以及内部专用 Cordis 插件。该分组不纳入官方发布版本；包在发布前移入对应的产品角色分组。
+
+该分组尚未包含任何包。[子树规则](AGENTS.md)界定不作保证、依赖关系和提升机制的边界。
--- a/packages/goal/command-goal/tests/command-goal.spec.ts
+++ b/packages/goal/command-goal/tests/command-goal.spec.ts
@@ -38,6 +38,7 @@ function stubAgent(ctx: Context, id: string): { agent: Agent; session: Session }
    get status() { return status },
    get acceptsNextStep() { return status === 'running' },
    send: () => {},
+    updateInbox: () => 'not-found',
    followup: () => {},
    steer: () => {},
    inject(input) { appendInjection(session, input) },
--- a/packages/goal/goal-session/src/index.ts
+++ b/packages/goal/goal-session/src/index.ts
@@ -307,10 +307,10 @@ export function apply(ctx: Context): void {
        requestDrive(state)
      }
    })
-    ctx.on('agent/inbox/enqueue', (agent, info) => {
+    ctx.on('agent/inbox/enqueue', (agent, item) => {
      const state = stateFor(agent)
      const attempt = state.attempt
-      if (attempt !== undefined && sameQueued(info.content, info.source, attempt)) return
+      if (attempt !== undefined && sameQueued(item.message.content, item.message.source, attempt)) return
      state.competingQueued = true
      if (attempt?.phase === 'queued') attempt.stale = true
    })
--- a/packages/goal/goal-session/tests/goal-session.spec.ts
+++ b/packages/goal/goal-session/tests/goal-session.spec.ts
@@ -287,7 +287,7 @@ describe('same-session goal driving', () => {
  it('pauses and drops a reserved round when cancellation lands before admission', async () => {
    const test = await harness([])
    const cancel = test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent === test.agent && info.source.kind === 'goal') {
+      if (agent === test.agent && info.message.source.kind === 'goal') {
        cancel()
        agent.cancel({ kind: 'user' })
      }
@@ -340,7 +340,7 @@ describe('same-session goal driving', () => {
    test.ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof test.ctx.logger.warn
    let inserted = false
    test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent !== test.agent || info.source.kind !== 'goal' || inserted) return
+      if (agent !== test.agent || info.message.source.kind !== 'goal' || inserted) return
      inserted = true
      const lastStart = agent.session.events.findLast(event => event.type === 'turn/start')
      const turn = (lastStart?.data.turn ?? 0) + 1
@@ -363,7 +363,7 @@ describe('same-session goal driving', () => {
    const test = await harness([textResponse('human batch'), textResponse('later goal')])
    let inserted = false
    test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent !== test.agent || info.source.kind !== 'goal' || inserted) return
+      if (agent !== test.agent || info.message.source.kind !== 'goal' || inserted) return
      inserted = true
      agent.followup(createUserMessage({ content: [{ type: 'text', text: 'human joined the pending batch' }], source: { kind: 'user' } }))
    })
@@ -381,7 +381,7 @@ describe('same-session goal driving', () => {
    const test = await harness([textResponse('new revision')])
    let edited = false
    test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent !== test.agent || info.source.kind !== 'goal' || edited) return
+      if (agent !== test.agent || info.message.source.kind !== 'goal' || edited) return
      edited = true
      const current = test.ctx.goals.get(agent)
      if (current === undefined) throw new Error('missing goal during queued edit')
@@ -661,7 +661,7 @@ describe('same-session goal driving', () => {
    const test = await harness([textResponse('retry after containment')])
    let armed = true
    test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent !== test.agent || info.source.kind !== 'goal' || !armed) return
+      if (agent !== test.agent || info.message.source.kind !== 'goal' || !armed) return
      armed = false
      vi.spyOn(test.ctx.goals, 'get').mockImplementationOnce(() => {
        throw new Error('admission projection failed')
@@ -737,7 +737,7 @@ describe('same-session goal driving', () => {
  it('falls back to disarming when a cancelled reservation cannot be paused', async () => {
    const test = await harness([])
    const cancel = test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent !== test.agent || info.source.kind !== 'goal') return
+      if (agent !== test.agent || info.message.source.kind !== 'goal') return
      cancel()
      vi.spyOn(test.ctx.goals, 'pause').mockImplementationOnce(() => {
        throw new Error('pause failed')
@@ -791,7 +791,7 @@ describe('same-session goal driving', () => {
    const test = await harness([])
    let unloading: Promise<void> | undefined
    test.ctx.on('agent/inbox/enqueue', (agent, info) => {
-      if (agent === test.agent && info.source.kind === 'goal' && unloading === undefined) {
+      if (agent === test.agent && info.message.source.kind === 'goal' && unloading === undefined) {
        unloading = Promise.resolve(test.driver.dispose())
      }
    })
--- a/packages/goal/goal/tests/goal.spec.ts
+++ b/packages/goal/goal/tests/goal.spec.ts
@@ -48,6 +48,7 @@ function stubAgentForSession(session: Session): StubAgent {
    get status() { return status },
    get acceptsNextStep() { return status === 'running' },
    send: () => {},
+    updateInbox: () => 'not-found',
    followup: () => {},
    steer: () => {},
    inject(input) {
--- a/packages/goal/goal/tests/projection.spec.ts
+++ b/packages/goal/goal/tests/projection.spec.ts
@@ -39,6 +39,7 @@ function liveAgent(ctx: Context, session: Session): Agent {
    get status() { return status },
    get acceptsNextStep() { return false },
    send: () => {},
+    updateInbox: () => 'not-found',
    followup: () => {},
    steer: () => {},
    inject(input: UserMessage) {
--- a/packages/goal/tool-goal/tests/tool-goal.spec.ts
+++ b/packages/goal/tool-goal/tests/tool-goal.spec.ts
@@ -33,6 +33,7 @@ function stubAgent(rawId: string, supplied?: Session): StubAgent {
    get acceptsNextStep() { return status === 'running' },
    ctx: new Context(),
    send: () => {},
+    updateInbox: () => 'not-found',
    followup: () => {},
    steer: () => {},
    inject(input) {
--- a/packages/hooks/README.i18n.yaml
+++ b/packages/hooks/README.i18n.yaml
@@ -3,4 +3,4 @@
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/hooks/README.md
 README.md: 23478fb5e9b813a3370ce465104b1f9db8b0a26a
-README.zh.md: 41024a8bd268550aa07401fd8b21c74db0914796
+README.zh.md: 741300a9a390a8f254c01733e5326be84541a78d
--- a/packages/hooks/README.zh.md
+++ b/packages/hooks/README.zh.md
@@ -10,4 +10,4 @@ hooks 子系统让用户可以像使用 Claude Code 和 Codex 一样，在 agent
 | `hooks-claude/` | Claude Code `hooks.json`／settings 的桥接 | 插件 |
 | `hooks-codex/` | Codex `hooks.json` 的桥接 | 插件 |

-Codex 有意重新实现 Claude Code 协议的一个*子集*（`hooks.json` 结构相同、5 个事件而非 CC 的众多事件、仅命令、仅正则表达式 matcher、没有 env／替换），因此 `hook-protocol` 负责真正相同的原语，每个桥接只负责不同部分（逐事件 stdin 载荷、env，以及把 hook 的中性结果映射到 harness 类型化 Decision 的方式）。参见 [hook-protocol/README.md](hook-protocol/README.md)。
+Codex 有意重新实现 Claude Code 协议的一个*子集*（`hooks.json` 结构相同、5 个事件而非 CC 的众多事件、仅命令、仅使用正则的 matcher、没有 env／替换），因此 `hook-protocol` 负责真正相同的原语，每个桥接只负责不同部分（逐事件 stdin 载荷、env，以及把 hook 的中性结果映射到 harness 类型化 Decision 的方式）。参见 [hook-protocol/README.md](hook-protocol/README.md)。
--- a/packages/hooks/hook-protocol/README.i18n.yaml
+++ b/packages/hooks/hook-protocol/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/hooks/hook-protocol/README.md
-README.md: 10cfcdcbf819f318f2ccaf412ae04bba60812397
-README.zh.md: 9862d4f332e0e82fb6479fcadf9376403fb9bef8
+README.md: 8cf4b95c95d43b8fbc27bbdcaf727dabf7d96805
+README.zh.md: 15a537b67677a401ab434a3e73af1973030780c0
--- a/packages/hooks/hook-protocol/README.md
+++ b/packages/hooks/hook-protocol/README.md
@@ -10,7 +10,7 @@ Why a shared lib at all: Codex deliberately reimplements a *subset* of the Claud

 | Concern | Here (`dsh-hook-protocol`) | The bridge (`dsh-hooks-claude` / `-codex`) |
 |---|---|---|
-| Matcher test | `matchesMatcher(pattern, query, mode)` — literal-or-regex by `mode` | picks its `mode` (`claude` = literal-or-regex, `codex` = always regex) |
+| Matcher validation + test | `matcherDiagnostic(pattern, mode)` for parse-time diagnostics; `matchesMatcher(pattern, query, mode)` for contained runtime matching | picks its `mode` (`claude` = literal-or-regex, `codex` = always regex) and rejects a config group carrying a diagnostic |
 | Run a hook | `runHook(bash, hook, opts, now)` — stdin payload + env via `ctx.bash`, decode | builds the per-event stdin **payload** + the dialect's **env** |
 | Decode output | `parseHookOutput(exit, stdout, stderr)` → neutral `HookOutput` | maps the neutral `HookOutput` onto a seam-specific typed Decision |
 | Merge N hooks | `mergeHookOutputs(outputs)` → most-restrictive `MergedHookOutcome` | — |
@@ -19,7 +19,7 @@ Why a shared lib at all: Codex deliberately reimplements a *subset* of the Claud

 ## Primitives

- **`matchesMatcher(matcher, query, mode)`** — match-all on absent/`''`/`'*'`; `claude` mode treats a pure `[A-Za-z0-9_|]+` pattern as a literal (pipe = exact-match alternation) and anything else as a regex; `codex` mode is always an unanchored regex. An invalid regex matches nothing (never throws).
+- **`matcherDiagnostic(matcher, mode)` / `matchesMatcher(matcher, query, mode)`** — match-all on absent/`''`/`'*'`; `claude` mode treats a pure `[A-Za-z0-9_|]+` pattern as a literal (pipe = exact-match alternation) and anything else as a regex; `codex` mode is always an unanchored regex. Bridge parsers discard matcher fields for events without matcher subjects, then use `matcherDiagnostic` to reject an invalid consumed regex with a stable diagnostic before registering any hooks. The runtime predicate still contains an invalid pattern as a non-match, so a direct library caller cannot throw into the agent loop.
 - **`runHook(bash, hook, options, now)`** — require and forward the caller-owned `options.signal`, serialize `options.payload` to the hook's stdin (with a trailing newline iff `options.trailingNewline`), merge `options.env` after the executor's credential scrub (the `dsh-bash` trusted-plugin surface), honor the hook's `timeoutSec` (else `options.defaultTimeoutMs` — the bridge owns the default, its config defaulting to the lib's `DEFAULT_HOOK_TIMEOUT_MS` 10-minute reference), and decode the result (threading `options.expectedEventName` to the codec). Cancellation therefore reaches the executor's process-group kill and join boundary. Never throws: an executor rejection (infra fault) becomes a `HookOutput` with `exitCode: undefined` (a non-blocking error). `now` is injected for testable durations.
 - **`parseHookOutput(exitCode, stdout, stderr, expectedEventName?)`** decodes exit status and structured stdout. Exit 2 blocks with stderr; other failures are non-blocking. A matching hook-specific permission decision overrides the legacy top-level decision; mismatched or missing event discriminators suppress only event-specific fields. Top-level fields remain event-agnostic, and successful non-JSON output is left to the bridge.
 - **`mergeHookOutputs(outputs)`** — fold the results of every hook that matched one point: permission precedence **deny > ask > allow**, halt sticky on the first `continue:false`, block reasons joined with `\n\n`, `additionalContext`/`systemMessages` accumulated in order.
@@ -42,4 +42,3 @@ No direct invalidation; the named consumer owns any request-prefix changes.
 ## Known Limitations and Deferred Work

 - **`HookOutput.updatedInput` is parsed but not honored** — input rewrite is a deferred consistency-design problem ([the pre-tool-input-rewrite Agent Note](../../../.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.md)); a bridge logs + warns when a hook sets it. See `src/types.ts` for the full contracts.
- **An invalid matcher regex matches nothing, silently** — `matchesMatcher` never throws; surfacing the error needs a diagnostic-returning variant or parse-time validation (`TODO(matcher-diagnostics)`).
--- a/packages/hooks/hook-protocol/README.zh.md
+++ b/packages/hooks/hook-protocol/README.zh.md
@@ -10,7 +10,7 @@ Claude Code／Codex hook 协议格式（wire format）的**共享核心**。它

 | 关注点 | 此处（`dsh-hook-protocol`） | 桥接（`dsh-hooks-claude` / `-codex`） |
 |---|---|---|
-| Matcher 测试 | `matchesMatcher(pattern, query, mode)`：根据 `mode` 使用字面匹配或正则匹配 | 选择自身 `mode`（`claude` = 字面或正则，`codex` = 始终使用正则） |
+| Matcher 校验 + 测试 | `matcherDiagnostic(pattern, mode)` 用于解析时诊断；`matchesMatcher(pattern, query, mode)` 用于隔离的运行时匹配 | 选择自身的 `mode`（`claude` = 字面量或正则，`codex` = 始终使用正则），并拒绝带有诊断的配置组 |
 | 运行 hook | `runHook(bash, hook, opts, now)`：通过 `ctx.bash` 提供 stdin payload + env，再解码 | 构造每个事件的 stdin **payload** + 该方言的 **env** |
 | 解码输出 | `parseHookOutput(exit, stdout, stderr)` → 中性 `HookOutput` | 将中性 `HookOutput` 映射到 seam 特定的类型化 Decision |
 | 合并 N 个 hook | `mergeHookOutputs(outputs)` → 最严格的 `MergedHookOutcome` | （无） |
@@ -19,7 +19,7 @@ Claude Code／Codex hook 协议格式（wire format）的**共享核心**。它

 ## 原语

- **`matchesMatcher(matcher, query, mode)`**：缺失、`''` 或 `'*'` 时匹配全部；`claude` 模式将纯 `[A-Za-z0-9_|]+` pattern 视为字面值（pipe = 精确匹配交替），其他 pattern 视为正则；`codex` 模式始终使用未锚定正则。无效正则不匹配任何内容（绝不抛出异常）。
+- **`matcherDiagnostic(matcher, mode)` / `matchesMatcher(matcher, query, mode)`**：缺失、`''` 或 `'*'` 时匹配全部；`claude` mode 将纯 `[A-Za-z0-9_|]+` pattern 视为字面量（管道符 = 精确匹配多选），其他 pattern 视为正则；`codex` mode 始终使用未锚定正则。桥接解析器会丢弃没有 matcher 匹配对象的事件所带字段，再用 `matcherDiagnostic` 拒绝事件实际使用的无效正则，并在注册任何钩子之前给出稳定诊断。运行时谓词仍会将无效 pattern 隔离为不匹配，因此直接调用本库不会向 agent loop（智能体循环）抛异常。
 - **`runHook(bash, hook, options, now)`**：要求并转发调用方拥有的 `options.signal`，将 `options.payload` 序列化到 hook stdin（当且仅当 `options.trailingNewline` 时添加尾随换行符），在执行器凭证清理后合并 `options.env`（`dsh-bash` 受信任插件接口），遵循 hook 的 `timeoutSec`（否则使用 `options.defaultTimeoutMs`；默认值属于桥接，其配置默认为 lib 的 `DEFAULT_HOOK_TIMEOUT_MS` 10 分钟参考值），再解码结果（将 `options.expectedEventName` 传递给 codec）。因此取消会到达执行器的进程组终止与 join 边界。它绝不抛出异常：执行器拒绝（基础设施故障）会变为 `HookOutput`，其 `exitCode: undefined`（非阻塞错误）。`now` 会被注入，以便测试持续时间。
 - **`parseHookOutput(exitCode, stdout, stderr, expectedEventName?)`** 解码退出状态与结构化 stdout。退出码为 2 时，会以 stderr 内容阻止执行；其他失败不阻塞。匹配的 hook 特定权限决策会覆盖遗留顶层决策；事件判别字段不匹配或缺失只会抑制事件特定字段。顶层字段仍与事件无关，成功但非 JSON 的输出会留给桥接处理。
 - **`mergeHookOutputs(outputs)`**：折叠在一个点上匹配的每个 hook 结果：权限优先级为 **deny > ask > allow**，从首个 `continue:false` 起，halt 状态保持不变，阻塞原因用 `\n\n` 连接，`additionalContext`／`systemMessages` 按顺序累积。
@@ -29,7 +29,7 @@ Claude Code／Codex hook 协议格式（wire format）的**共享核心**。它

 通过 declaration merging 合并到 `SessionEventMap`（仅日志，与 `compact/*` 相同；不是 `SurfaceEventType`，没有 `surfaceOp`）：`hook/invoked`（hook 命令已运行）与 `hook/result`（其结果，按 `handlerId` 配对，决策规则由 `appendHookResult` 负责）。Payload 与每事件 JSDoc 位于生成的 [持久化日志事件目录](../../../docs/persistence-catalog.md)；`stderrSummary` 会截断到记录的 `stderrSummaryMaxChars`（桥接配置，参考默认值 `DEFAULT_STDERR_SUMMARY_MAX_CHARS` = 500；为空时省略）。

-Hook 溯源记录必须位于一个尚未结束的轮次内。轮次中的点（`PreToolUse`／`PostToolUse`／`Stop`）按构造满足这条由所有者定义的关系。`SessionStart` 与轮次前的 `UserPromptSubmit` 准入 seam 没有 `hook/*` 记录；获准的上下文改由其带来源的 `user/message` 作为证据，详见 hooks Agent Note（agent 决策记录）。
+Hook 溯源记录必须位于一个尚未结束的轮次内。轮次中的点（`PreToolUse`／`PostToolUse`／`Stop`）按构造满足这条由所有者定义的关系。`SessionStart` 与轮次前的 `UserPromptSubmit` 准入 seam 没有 `hook/*` 记录；获准的上下文改由其带来源的 `user/message` 作为证据，详见 hooks Agent Note。

 ## 模型体验

@@ -42,4 +42,3 @@ Hook 溯源记录必须位于一个尚未结束的轮次内。轮次中的点（
 ## 已知限制与暂缓事项

 - **`HookOutput.updatedInput` 会被解析但不会应用**：输入改写是已暂缓的一致性设计问题（见 [pre-tool-input-rewrite Agent Note](../../../.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.md)）；当 hook 设置它时，桥接会记录 + 警告。完整契约见 `src/types.ts`。
- **无效 matcher 正则会静默地不匹配任何内容**：`matchesMatcher` 绝不抛出异常；显示该错误需要返回诊断的变体或解析时验证（`TODO(matcher-diagnostics)`）。
--- a/packages/hooks/hook-protocol/src/index.ts
+++ b/packages/hooks/hook-protocol/src/index.ts
@@ -13,7 +13,7 @@ export type {
  MatcherGroup,
  MatcherMode,
 } from './types.ts'
-export { matchesMatcher } from './matcher.ts'
+export { matcherDiagnostic, matchesMatcher } from './matcher.ts'
 export { parseHookOutput } from './codec.ts'
 export { DEFAULT_HOOK_TIMEOUT_MS, runHook } from './runner.ts'
 export type { RunHookOptions, RunHookResult } from './runner.ts'
--- a/packages/hooks/hook-protocol/src/matcher.ts
+++ b/packages/hooks/hook-protocol/src/matcher.ts
@@ -2,7 +2,8 @@
 * Matcher shared by both hook dialects. Claude treats alphanumeric/underscore/
 * pipe patterns as literal alternatives and other patterns as regex; Codex
 * treats every non-empty pattern as an unanchored regex. Missing, empty, and
- * `*` match all; invalid regexes silently match nothing.
+ * `*` match all. Runtime matching contains invalid regexes as non-matches;
+ * config parsers use {@link matcherDiagnostic} to reject them with a diagnostic.
 * @module @deepseek-ai/dsh-hook-protocol/matcher
 */

@@ -16,10 +17,37 @@ function isMatchAll(matcher: string | undefined): boolean {
 /** A Claude-literal pattern is purely word chars + `|` (the regex-vs-literal discriminator). */
 const CLAUDE_LITERAL = /^[A-Za-z0-9_|]+$/

+/** Compile an unanchored matcher regex; invalid patterns return `undefined`. */
+function compileRegex(pattern: string): RegExp | undefined {
+  try {
+    return new RegExp(pattern)
+  } catch (_syntaxError) {
+    // RegExp construction is the try's only operation, so malformed pattern
+    // syntax is the only expected failure.
+    return undefined
+  }
+}
+
+/**
+ * Validate one matcher before a bridge accepts its config group.
+ * @param matcher - configured pattern; match-all sentinels are valid.
+ * @param mode - dialect deciding whether a word-and-pipe pattern is literal.
+ * @returns `undefined` for a valid matcher, otherwise a stable diagnostic.
+ */
+export function matcherDiagnostic(matcher: string | undefined, mode: MatcherMode): string | undefined {
+  if (isMatchAll(matcher)) return undefined
+  const pattern = matcher as string
+  if (mode === 'claude' && CLAUDE_LITERAL.test(pattern)) return undefined
+  return compileRegex(pattern) === undefined
+    ? `invalid ${mode} regex matcher ${JSON.stringify(pattern)}`
+    : undefined
+}
+
 /**
 * Whether `matcher` selects `query` under the given dialect. Claude literal
 * patterns exact-match pipe-separated alternatives; all other patterns are
- * unanchored regexes. Invalid regexes return `false` rather than throwing.
+ * unanchored regexes. Invalid regexes return `false` rather than throwing;
+ * bridge config parsers surface them through {@link matcherDiagnostic} before use.
 * @param matcher - the configured pattern; absent/empty/`'*'` are the match-all sentinels.
 * @param query - the candidate value (a tool name, a session source, …).
 * @param mode - the dialect deciding literal-vs-regex interpretation of the pattern.
@@ -33,13 +61,5 @@ export function matchesMatcher(matcher: string | undefined, query: string, mode:
  if (mode === 'claude' && CLAUDE_LITERAL.test(pattern)) {
    return pattern.split('|').includes(query)
  }
-  try {
-    return new RegExp(pattern).test(query)
-  } catch {
-    // Invalid regex: a broken matcher selects nothing rather than throwing into
-    // the agent loop. This is silent — callers get `false`, indistinguishable
-    // from a genuine non-match, so a typo'd pattern quietly disables the matcher.
-    // Surfacing it needs a diagnostic-returning variant (TODO(matcher-diagnostics)).
-    return false
-  }
+  return compileRegex(pattern)?.test(query) ?? false
 }
--- a/packages/hooks/hook-protocol/tests/matcher.spec.ts
+++ b/packages/hooks/hook-protocol/tests/matcher.spec.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { matchesMatcher } from '@deepseek-ai/dsh-hook-protocol'
+import { matcherDiagnostic, matchesMatcher } from '@deepseek-ai/dsh-hook-protocol'

 describe('matchesMatcher — match-all sentinels (both dialects)', () => {
  for (const mode of ['claude', 'codex'] as const) {
@@ -56,3 +56,19 @@ describe('matchesMatcher — invalid regex is a non-match (never throws)', () =>
    expect(matchesMatcher('[', 'x', 'codex')).toBe(false)
  })
 })
+
+describe('matcherDiagnostic — parse-time diagnostics', () => {
+  it('accepts match-all sentinels, Claude literals, and valid regexes', () => {
+    expect(matcherDiagnostic(undefined, 'claude')).toBeUndefined()
+    expect(matcherDiagnostic('', 'codex')).toBeUndefined()
+    expect(matcherDiagnostic('*', 'codex')).toBeUndefined()
+    expect(matcherDiagnostic('Edit|Write', 'claude')).toBeUndefined()
+    expect(matcherDiagnostic('^Bash$', 'claude')).toBeUndefined()
+    expect(matcherDiagnostic('Edit|Write', 'codex')).toBeUndefined()
+  })
+
+  it('returns a stable diagnostic for invalid regexes in either dialect', () => {
+    expect(matcherDiagnostic('(', 'claude')).toBe('invalid claude regex matcher "("')
+    expect(matcherDiagnostic('[', 'codex')).toBe('invalid codex regex matcher "["')
+  })
+})
--- a/packages/hooks/hooks-claude/README.i18n.yaml
+++ b/packages/hooks/hooks-claude/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/hooks/hooks-claude/README.md
-README.md: 24259c24ea35cd450f8ea27ca2cca423ed4406bd
-README.zh.md: 0a7afc20eba02d59d293124936cb81aeba6d3f0f
+README.md: 61c2d152dacdbec31bca015b94b9f2ac6d24c3aa
+README.zh.md: 38509ab6e6f72bb62a6bed064257603f728812cb
--- a/packages/hooks/hooks-claude/README.md
+++ b/packages/hooks/hooks-claude/README.md
@@ -28,7 +28,7 @@ In a `cordis.yml`:
    projectDir: .
 ```

-The config is parsed **once** at load. `configPath` is **process-level**: a relative path resolves against the process's launch cwd at load time, so a single config applies to the whole process — there is no per-session (`session/new.cwd`) config discovery yet (`TODO(per-session-hook-config)`). A read/parse failure is contained — the bridge logs a warning and registers nothing rather than crashing boot (a typo'd path must not take the agent down). Only shell-form `type: 'command'` hooks run; an `http`/`mcp_tool`/`prompt`/`agent` hook is parsed-and-skipped with a warning. A hook with no per-hook `timeout` runs under the protocol's reference default (`DEFAULT_HOOK_TIMEOUT_MS` from `dsh-hook-protocol`, 10 minutes — the CC default).
+The config is parsed **once** at load. `configPath` is **process-level**: a relative path resolves against the process's launch cwd at load time, so a single config applies to the whole process — there is no per-session (`session/new.cwd`) config discovery yet (`TODO(per-session-hook-config)`). A read/parse failure is contained — including an invalid regex matcher on an event that consumes matchers, reported with its pattern and event — and the bridge logs a warning and registers nothing rather than crashing boot (a typo'd path must not take the agent down). Only shell-form `type: 'command'` hooks run; an `http`/`mcp_tool`/`prompt`/`agent` hook is parsed-and-skipped with a warning. A hook with no per-hook `timeout` runs under the protocol's reference default (`DEFAULT_HOOK_TIMEOUT_MS` from `dsh-hook-protocol`, 10 minutes — the CC default).

 The hooks **themselves** run in the agent's session workspace: for the agent-scoped points the bridge passes the session's `cwd` (the `session/new.cwd`) as the hook process's working directory, so a hook's `pwd`/relative-path/marker operates in the user's project tree, not the server launch dir.

@@ -86,7 +86,7 @@ A blocked prompt sends no request and invalidates nothing. Denial, feedback, and

 ## Known Limitations and Deferred Work

- **Unsupported hook events (23 of Claude Code's current 30):** `Setup`, `InstructionsLoaded`, `UserPromptExpansion`, `MessageDisplay`, `PermissionRequest`, `PostToolUseFailure`, `PostToolBatch`, `PermissionDenied`, `Notification`, `TaskCreated`, `TaskCompleted`, `StopFailure`, `TeammateIdle`, `ConfigChange`, `CwdChanged`, `FileChanged`, `WorktreeCreate`, `WorktreeRemove`, `PreCompact`, `PostCompact`, `SessionEnd`, `Elicitation`, and `ElicitationResult`. Config for these events is parsed but never dispatched. The comparison baseline is Claude Code's [official hook-event reference](https://code.claude.com/docs/en/hooks#hook-events).
+- **Unsupported hook events (23 of Claude Code's current 30):** `Setup`, `InstructionsLoaded`, `UserPromptExpansion`, `MessageDisplay`, `PermissionRequest`, `PostToolUseFailure`, `PostToolBatch`, `PermissionDenied`, `Notification`, `TaskCreated`, `TaskCompleted`, `StopFailure`, `TeammateIdle`, `ConfigChange`, `CwdChanged`, `FileChanged`, `WorktreeCreate`, `WorktreeRemove`, `PreCompact`, `PostCompact`, `SessionEnd`, `Elicitation`, and `ElicitationResult`. Config for these events is ignored before group parsing, so an unsupported event cannot invalidate or register hooks. The comparison baseline is Claude Code's [official hook-event reference](https://code.claude.com/docs/en/hooks#hook-events).
 - **`SessionStart` is partial:** JSON `additionalContext` is consumed, but plain stdout context, `initialUserMessage`, `sessionTitle`, `watchPaths`, `reloadSkills`, and `CLAUDE_ENV_FILE` are unsupported. The hook runs detached, so context can miss the first request (`TODO(session-start-gating)`), and the payload omits current optional fields such as `model`, `agent_type`, and `session_title`.
 - **`UserPromptSubmit` is partial:** blocking and JSON `additionalContext` work, but plain stdout context, `sessionTitle`, and `suppressOriginalPrompt` are unsupported. Unless overridden, the bridge also uses its 600-second default instead of Claude Code's event-specific 30-second command timeout.
 - **`PreToolUse` is partial:** `deny` and `ask` decisions work; `allow` does not pre-approve, `defer` is unsupported, `additionalContext` is ignored, and `updatedInput` is logged + warned but not honored ([the pre-tool-input-rewrite Agent Note](../../../.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.md)).
--- a/packages/hooks/hooks-claude/README.zh.md
+++ b/packages/hooks/hooks-claude/README.zh.md
@@ -28,7 +28,7 @@ const config: Config = {
    projectDir: .
 ```

-配置只在加载时解析**一次**。`configPath` 是**进程级**配置：相对路径在加载时根据进程启动 cwd 解析，因此一份配置应用于整个进程。尚未进行每会话（`session/new.cwd`）配置发现（`TODO(per-session-hook-config)`）。读取／解析失败会被隔离处理：桥接记录警告且不注册任何内容，而不是使启动崩溃（路径拼写错误不应使 agent（智能体）停止）。只运行 shell 形式 `type: 'command'` hook；`http`／`mcp_tool`／`prompt`／`agent` hook 会被解析并跳过，同时记录警告。没有每 hook `timeout` 的 hook 会使用协议参考默认值 `DEFAULT_HOOK_TIMEOUT_MS`（来自 `dsh-hook-protocol`，10 分钟，即 CC 默认值）。
+配置只在加载时解析**一次**。`configPath` 是**进程级**配置：相对路径在加载时根据进程启动 cwd 解析，因此一份配置应用于整个进程。尚未进行每会话（`session/new.cwd`）配置发现（`TODO(per-session-hook-config)`）。读取／解析失败会被隔离处理，其中包括实际消费 matcher 的事件所带的无效 matcher 正则（会报告其 pattern 与事件）：桥接记录警告且不注册任何内容，而不是使启动崩溃（路径拼写错误不应使 agent（智能体）停止）。只运行 shell 形式 `type: 'command'` hook；`http`／`mcp_tool`／`prompt`／`agent` hook 会被解析并跳过，同时记录警告。没有每 hook `timeout` 的 hook 会使用协议参考默认值 `DEFAULT_HOOK_TIMEOUT_MS`（来自 `dsh-hook-protocol`，10 分钟，即 CC 默认值）。

 hook **本身**会在 agent 的会话工作区中运行：对 agent scope 点，桥接会将会话 `cwd`（`session/new.cwd`）作为 hook 进程工作目录，因此 hook 的 `pwd`／相对路径／marker 作用于用户项目树，而非服务器启动目录。

@@ -86,7 +86,7 @@ hook 不返回上下文时没有成本。Hook 文本取决于数据，会被记

 ## 已知限制与暂缓事项

- **不支持的 hook 事件（Claude Code 当前 30 项中的 23 项）：** `Setup`、`InstructionsLoaded`、`UserPromptExpansion`、`MessageDisplay`、`PermissionRequest`、`PostToolUseFailure`、`PostToolBatch`、`PermissionDenied`、`Notification`、`TaskCreated`、`TaskCompleted`、`StopFailure`、`TeammateIdle`、`ConfigChange`、`CwdChanged`、`FileChanged`、`WorktreeCreate`、`WorktreeRemove`、`PreCompact`、`PostCompact`、`SessionEnd`、`Elicitation` 和 `ElicitationResult`。这些事件的配置会被解析，但绝不分派。比较基线是 Claude Code [官方 hook 事件参考](https://code.claude.com/docs/en/hooks#hook-events)。
+- **不支持的 hook 事件（Claude Code 当前 30 项中的 23 项）：** `Setup`、`InstructionsLoaded`、`UserPromptExpansion`、`MessageDisplay`、`PermissionRequest`、`PostToolUseFailure`、`PostToolBatch`、`PermissionDenied`、`Notification`、`TaskCreated`、`TaskCompleted`、`StopFailure`、`TeammateIdle`、`ConfigChange`、`CwdChanged`、`FileChanged`、`WorktreeCreate`、`WorktreeRemove`、`PreCompact`、`PostCompact`、`SessionEnd`、`Elicitation` 和 `ElicitationResult`。这些事件的配置会在配置组解析前被忽略，因此不支持的事件既不会使配置失效，也不会注册 hook。比较基线是 Claude Code [官方 hook 事件参考](https://code.claude.com/docs/en/hooks#hook-events)。
 - **`SessionStart` 只支持部分功能：** 会消费 JSON `additionalContext`，但不支持纯 stdout 上下文、`initialUserMessage`、`sessionTitle`、`watchPaths`、`reloadSkills` 与 `CLAUDE_ENV_FILE`。hook 脱离运行，因此上下文可能错过第一个请求（`TODO(session-start-gating)`），payload 会省略 `model`、`agent_type` 和 `session_title` 等当前可选字段。
 - **`UserPromptSubmit` 只支持部分功能：** 支持阻塞与 JSON `additionalContext`，但不支持纯 stdout 上下文、`sessionTitle` 和 `suppressOriginalPrompt`。除非被覆盖，否则桥接还会使用自身 600 秒默认值，而非 Claude Code 的事件特定 30 秒 command 超时。
 - **`PreToolUse` 只支持部分功能：** `deny` 与 `ask` 决策可用；`allow` 不会预审批，不支持 `defer`，`additionalContext` 会被忽略，`updatedInput` 会被记录 + 警告但不应用（见 [pre-tool-input-rewrite Agent Note](../../../.agents/notes/proposed/feature/2026-06-30-pre-tool-input-rewrite.md)）。
--- a/packages/hooks/hooks-claude/src/config.ts
+++ b/packages/hooks/hooks-claude/src/config.ts
@@ -6,7 +6,17 @@
 * @module @deepseek-ai/dsh-hooks-claude/config
 */

-import type { MatcherGroup } from '@deepseek-ai/dsh-hook-protocol'
+import { matcherDiagnostic, type MatcherGroup } from '@deepseek-ai/dsh-hook-protocol'
+
+const CLAUDE_EVENTS = [
+  'SessionStart',
+  'UserPromptSubmit',
+  'PreToolUse',
+  'PostToolUse',
+  'Stop',
+  'SubagentStart',
+  'SubagentStop',
+] as const

 /** A parsed CC config: event name → its matcher groups (command hooks only). */
 export type ClaudeHookConfig = Record<string, MatcherGroup[]>
@@ -53,8 +63,11 @@ export function substituteCommand(command: string, vars: SubstitutionVars): stri

 /**
 * Parse either a settings `hooks` value or a bare `hooks.json` event map. Malformed entries are
- * ignored rather than failing boot; non-command hooks are returned in `skipped`, and substitutions
- * are applied to every surviving command.
+ * ignored rather than failing boot; unsupported events are ignored before their groups are parsed,
+ * non-command hooks are returned in `skipped`, and substitutions are applied to every surviving
+ * command. Matcher fields on UserPromptSubmit and Stop are discarded because those events have no
+ * matcher subject. A matcher-bearing supported runnable group with an invalid regex throws a
+ * `SyntaxError`, allowing the bridge to reject the complete config before listener registration.
 *
 * @param raw - the parsed JSON config: a settings object with a `hooks` key, or the bare
 *   event map.
@@ -70,7 +83,8 @@ export function parseClaudeConfig(raw: unknown, vars: SubstitutionVars = {}): Pa
  const hooksMap = root ? asObject(root.hooks) ?? root : undefined
  if (!hooksMap) return { config, skipped }

-  for (const [event, rawGroups] of Object.entries(hooksMap)) {
+  for (const event of CLAUDE_EVENTS) {
+    const rawGroups = hooksMap[event]
    if (!Array.isArray(rawGroups)) continue
    const groups: MatcherGroup[] = []
    for (const rawGroup of rawGroups) {
@@ -92,8 +106,13 @@ export function parseClaudeConfig(raw: unknown, vars: SubstitutionVars = {}): Pa
        })
      }
      if (commands.length === 0) continue
+      const matcher = event === 'UserPromptSubmit' || event === 'Stop'
+        ? undefined
+        : typeof group.matcher === 'string' ? group.matcher : undefined
+      const diagnostic = matcherDiagnostic(matcher, 'claude')
+      if (diagnostic !== undefined) throw new SyntaxError(`${diagnostic} on event ${JSON.stringify(event)}`)
      groups.push({
-        ...typeof group.matcher === 'string' ? { matcher: group.matcher } : {},
+        ...matcher !== undefined ? { matcher } : {},
        hooks: commands,
      })
    }
--- a/packages/hooks/hooks-claude/tests/bridge.spec.ts
+++ b/packages/hooks/hooks-claude/tests/bridge.spec.ts
@@ -45,17 +45,22 @@ function writeConfig(hooks: unknown, scripts: Record<string, string> = {}): stri
  return dir
 }

-async function harness(configDir: string, adapter: MockAdapter): Promise<Context> {
-  return (await harnessWithFiber(configDir, adapter)).ctx
+async function harness(configDir: string, adapter: MockAdapter, beforeHooks?: (ctx: Context) => void): Promise<Context> {
+  return (await harnessWithFiber(configDir, adapter, beforeHooks)).ctx
 }

 /** {@link harness}, also exposing the bridge's fiber for tests that dispose it. */
-async function harnessWithFiber(configDir: string, adapter: MockAdapter): Promise<{ ctx: Context; hooks: Fiber }> {
+async function harnessWithFiber(
+  configDir: string,
+  adapter: MockAdapter,
+  beforeHooks?: (ctx: Context) => void,
+): Promise<{ ctx: Context; hooks: Fiber }> {
  const ctx = new Context()
  await mountAgentLoopTestDependencies(ctx)
  await ctx.plugin(AgentLoop, { agents: [] })
  await ctx.plugin(LocalSubprocessService)
  await ctx.plugin(LocalBashExecutor, { timeoutMs: 10_000 })
+  beforeHooks?.(ctx)
  const hooks = await ctx.plugin(HooksClaude, { configPath: join(configDir, 'hooks.json') })
  ctx.llm.registerAdapter(['mock'], adapter)
  return { ctx, hooks }
@@ -85,13 +90,14 @@ async function waitFor(predicate: () => boolean, timeout = 5000, interval = 10):

 describe('hooks-claude bridge — UserPromptSubmit', () => {
  it('a UserPromptSubmit hook that exits 2 rejects admission without a turn', async () => {
-    // The UserPromptSubmit hook exits 2 (blocking) with a reason on stderr.
+    // UserPromptSubmit ignores its malformed matcher field, then exit 2 blocks
+    // with the reason on stderr.
    const dir = mkdtempSync(join(tmpdir(), 'dsh-hooks-claude-'))
    dirs.push(dir)
    const block = join(dir, 'block.sh')
    writeFileSync(block, '#!/usr/bin/env bash\necho "prompt denied by policy" >&2\nexit 2\n')
    chmodSync(block, 0o755)
-    writeFileSync(join(dir, 'hooks.json'), JSON.stringify({ hooks: { UserPromptSubmit: [{ hooks: [{ type: 'command', command: block }] }] } }))
+    writeFileSync(join(dir, 'hooks.json'), JSON.stringify({ hooks: { UserPromptSubmit: [{ matcher: '[', hooks: [{ type: 'command', command: block }] }] } }))

    const adapter = new MockAdapter([textResponse('should not run')])
    const ctx = await harness(dir, adapter)
@@ -361,6 +367,42 @@ describe('hooks-claude bridge — load resilience', () => {
    expect(adapter.requests).toHaveLength(1)
  })

+  it('an invalid regex matcher is reported and registers no hooks', async () => {
+    const dir = writeConfig({
+      UserPromptSubmit: [{ hooks: [{ type: 'command', command: 'exit 2' }] }],
+      PreToolUse: [{ matcher: '(', hooks: [{ type: 'command', command: 'exit 2' }] }],
+    })
+    const adapter = new MockAdapter([textResponse('fine')])
+    const warn = vi.fn()
+    const ctx = await harness(dir, adapter, (ctx) => { ctx.logger.warn = warn as never })
+    const agent = ctx.agentLoop.create(SessionId('invalid-claude-matcher'), { provider: 'mock', model: 'mock' })
+    agent.followup(createUserMessage({ content: [{ type: 'text', text: 'go' }], source: { kind: 'user' } }))
+    await waitForIdle(ctx, agent)
+    expect(adapter.requests).toHaveLength(1)
+    expect(events(agent).some(event => event.type === 'hook/invoked')).toBe(false)
+
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining(
+      'invalid claude regex matcher "(" on event "PreToolUse"',
+    ))
+  })
+
+  it('an invalid matcher on an unsupported event does not disable supported hooks', async () => {
+    const dir = writeConfig({
+      Setup: [{ matcher: '(', hooks: [{ type: 'command', command: 'exit 0' }] }],
+      UserPromptSubmit: [{ hooks: [{ type: 'command', command: 'exit 2' }] }],
+    })
+    const adapter = new MockAdapter([textResponse('should not run')])
+    const warn = vi.fn()
+    const ctx = await harness(dir, adapter, (ctx) => { ctx.logger.warn = warn as never })
+    const agent = ctx.agentLoop.create(SessionId('unsupported-claude-matcher'), { provider: 'mock', model: 'mock' })
+    agent.followup(createUserMessage({ content: [{ type: 'text', text: 'go' }], source: { kind: 'user' } }))
+    await waitForIdle(ctx, agent)
+
+    expect(adapter.requests).toHaveLength(0)
+    expect(events(agent).some(event => event.type === 'turn/start')).toBe(false)
+    expect(warn).not.toHaveBeenCalledWith(expect.stringContaining('invalid claude regex matcher'))
+  })
+
  it('disposing the bridge fiber removes its listeners (HMR safety)', async () => {
    // A BLOCKING UserPromptSubmit hook: if the listener leaked past dispose it
    // would veto the prompt (0 model requests) and log a hook/invoked. Build the
--- a/packages/hooks/hooks-claude/tests/config.spec.ts
+++ b/packages/hooks/hooks-claude/tests/config.spec.ts
@@ -63,4 +63,33 @@ describe('parseClaudeConfig', () => {
    const { config } = parseClaudeConfig({ Stop: [{ hooks: [{ type: 'command', command: 's.sh' }] }] })
    expect('matcher' in config.Stop![0]!).toBe(false)
  })
+
+  it('rejects an invalid regex matcher with its event name', () => {
+    expect(() => parseClaudeConfig({
+      PreToolUse: [{ matcher: '(', hooks: [{ type: 'command', command: 'x.sh' }] }],
+    })).toThrow('invalid claude regex matcher "(" on event "PreToolUse"')
+  })
+
+  it('discards matcher fields on events without matcher subjects before validation', () => {
+    const { config } = parseClaudeConfig({
+      UserPromptSubmit: [{ matcher: '[', hooks: [{ type: 'command', command: 'prompt.sh' }] }],
+      Stop: [{ matcher: '(', hooks: [{ type: 'command', command: 'stop.sh' }] }],
+    })
+
+    expect(config).toEqual({
+      UserPromptSubmit: [{ hooks: [{ command: 'prompt.sh' }] }],
+      Stop: [{ hooks: [{ command: 'stop.sh' }] }],
+    })
+  })
+
+  it('ignores invalid matchers on unsupported events without dropping supported hooks', () => {
+    const { config } = parseClaudeConfig({
+      Setup: [{ matcher: '(', hooks: [{ type: 'command', command: 'ignored.sh' }] }],
+      PreToolUse: [{ matcher: 'Bash', hooks: [{ type: 'command', command: 'kept.sh' }] }],
+    })
+
+    expect(config).toEqual({
+      PreToolUse: [{ matcher: 'Bash', hooks: [{ command: 'kept.sh' }] }],
+    })
+  })
 })
--- a/packages/hooks/hooks-codex/README.i18n.yaml
+++ b/packages/hooks/hooks-codex/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/hooks/hooks-codex/README.md
-README.md: fd57762c6fb91e0ea47ec57c30bf9850bc488a33
-README.zh.md: 58b387e22f0e56770e4ea779f184c6c82a38ff98
+README.md: e906810ed58c3d0204c618c32787af06c91cfb78
+README.zh.md: 4940fdb976dd963bbb2e41c0ec6ef274ee475334
--- a/packages/hooks/hooks-codex/README.md
+++ b/packages/hooks/hooks-codex/README.md
@@ -34,7 +34,7 @@ In a `cordis.yml`:
    model: deepseek-v4
 ```

-The config is parsed **once** at load. `configPath` is **process-level** — a relative path resolves against the process launch cwd at load time, not per-session (`TODO(per-session-hook-config)`). A read/parse failure is contained (logs + registers nothing). Only sync `type: 'command'` hooks run — a non-command or `async: true` hook is parsed-and-skipped with a warning. A hook accepts `timeout` or the `timeoutSec` alias; one that sets neither runs under the protocol's reference default (`DEFAULT_HOOK_TIMEOUT_MS` from `dsh-hook-protocol`, 10 minutes). Events outside the five bridge-supported points are dropped at parse.
+The config is parsed **once** at load. `configPath` is **process-level** — a relative path resolves against the process launch cwd at load time, not per-session (`TODO(per-session-hook-config)`). A read/parse failure is contained (logs + registers nothing); an invalid regex matcher on an event that consumes matchers is one such failure and reports its pattern and event. Only sync `type: 'command'` hooks run — a non-command or `async: true` hook is parsed-and-skipped with a warning. A hook accepts `timeout` or the `timeoutSec` alias; one that sets neither runs under the protocol's reference default (`DEFAULT_HOOK_TIMEOUT_MS` from `dsh-hook-protocol`, 10 minutes). Events outside the five bridge-supported points are dropped at parse.

 The hooks themselves run in the agent's session workspace: for the agent-scoped points the bridge passes the session's `cwd` as the hook process's working directory, so a hook operates in the user's project tree, not the server launch dir.

--- a/packages/hooks/hooks-codex/README.zh.md
+++ b/packages/hooks/hooks-codex/README.zh.md
@@ -7,7 +7,7 @@
 该桥接实现 Codex 当前 hook 协议的一个明确子集：

 - **10 个 hook 点中的 5 个：** `PreToolUse`、`PostToolUse`、`SessionStart`、`UserPromptSubmit` 和 `Stop`。
- **只使用正则 matcher**（没有字面快速路径；matcher 始终是未锚定正则）。
+- **仅使用正则的 matcher**（没有字面量快速路径；matcher 始终是未锚定正则）。
 - **snake_case stdin payload**，携带 `turn_id`／`model` 额外字段，写入时**不带**尾随换行符。
 - **没有 Codex 插件 env 注入，也没有配置时 placeholder 替换**（命令仍会接收执行器环境，并通过其 shell 运行）。
 - **没有工具前审批或改写路径**：hook 可以阻塞，但桥接不会预审批或替换工具输入。
@@ -34,7 +34,7 @@ const config: Config = {
    model: deepseek-v4
 ```

-配置只在加载时解析**一次**。`configPath` 是**进程级**配置：相对路径在加载时根据进程启动 cwd 解析，而非每会话解析（`TODO(per-session-hook-config)`）。读取／解析失败会被隔离处理（记录 + 不注册任何内容）。只运行同步 `type: 'command'` hook；非 command 或 `async: true` hook 会被解析并跳过，同时记录警告。hook 接受 `timeout` 或 `timeoutSec` alias；两者都未设置时，使用协议参考默认值 `DEFAULT_HOOK_TIMEOUT_MS`（来自 `dsh-hook-protocol`，10 分钟）。五个桥接支持点之外的事件会在解析时丢弃。
+配置只在加载时解析**一次**。`configPath` 是**进程级**配置：相对路径在加载时根据进程启动 cwd 解析，而非每会话解析（`TODO(per-session-hook-config)`）。读取／解析失败会被隔离处理（记录 + 不注册任何内容）；实际消费 matcher 的事件所带的无效 matcher 正则属于此类失败，并报告其 pattern 与事件。只运行同步 `type: 'command'` hook；非 command 或 `async: true` hook 会被解析并跳过，同时记录警告。hook 接受 `timeout` 或 `timeoutSec` alias；两者都未设置时，使用协议参考默认值 `DEFAULT_HOOK_TIMEOUT_MS`（来自 `dsh-hook-protocol`，10 分钟）。五个桥接支持点之外的事件会在解析时丢弃。

 hook 本身会在 agent（智能体）的会话工作区中运行：对 agent scope 点，桥接会将会话 `cwd` 作为 hook 进程工作目录，因此 hook 作用于用户项目树，而非服务器启动目录。

--- a/packages/hooks/hooks-codex/src/config.ts
+++ b/packages/hooks/hooks-codex/src/config.ts
@@ -5,7 +5,7 @@
 * @module @deepseek-ai/dsh-hooks-codex/config
 */

-import type { MatcherGroup } from '@deepseek-ai/dsh-hook-protocol'
+import { matcherDiagnostic, type MatcherGroup } from '@deepseek-ai/dsh-hook-protocol'

 /** The five Codex hook points this bridge supports. */
 export const CODEX_EVENTS = ['PreToolUse', 'PostToolUse', 'SessionStart', 'UserPromptSubmit', 'Stop'] as const
@@ -33,7 +33,10 @@ function asObject(value: unknown): Record<string, unknown> | undefined {

 /**
 * Parse a wrapped or bare Codex event map. Unknown events and malformed entries are ignored rather
- * than failing boot; unsupported or asynchronous hooks are returned in `skipped`.
+ * than failing boot; unsupported or asynchronous hooks are returned in `skipped`. Matcher fields on
+ * UserPromptSubmit and Stop are discarded because those events have no matcher subject. A
+ * matcher-bearing runnable group with an invalid regex throws a `SyntaxError`, allowing the bridge
+ * to reject the complete config before listener registration.
 * @param raw - the parsed JSON config: a `{ hooks: … }` wrapper or the bare event map.
 * @returns the runnable per-event groups plus the skipped hooks with their reasons.
 */
@@ -69,7 +72,12 @@ export function parseCodexConfig(raw: unknown): ParsedCodexConfig {
        commands.push({ command: hook.command, ...timeout !== undefined ? { timeoutSec: timeout } : {} })
      }
      if (commands.length === 0) continue
-      groups.push({ ...typeof group.matcher === 'string' ? { matcher: group.matcher } : {}, hooks: commands })
+      const matcher = event === 'UserPromptSubmit' || event === 'Stop'
+        ? undefined
+        : typeof group.matcher === 'string' ? group.matcher : undefined
+      const diagnostic = matcherDiagnostic(matcher, 'codex')
+      if (diagnostic !== undefined) throw new SyntaxError(`${diagnostic} on event ${JSON.stringify(event)}`)
+      groups.push({ ...matcher !== undefined ? { matcher } : {}, hooks: commands })
    }
    if (groups.length > 0) config[event] = groups
  }
--- a/packages/hooks/hooks-codex/tests/bridge.spec.ts
+++ b/packages/hooks/hooks-codex/tests/bridge.spec.ts
@@ -39,12 +39,13 @@ function writeHooks(dir: string, hooks: unknown): void {
  writeFileSync(join(dir, 'hooks.json'), JSON.stringify({ hooks }))
 }

-async function harness(dir: string, adapter: MockAdapter): Promise<Context> {
+async function harness(dir: string, adapter: MockAdapter, beforeHooks?: (ctx: Context) => void): Promise<Context> {
  const ctx = new Context()
  await mountAgentLoopTestDependencies(ctx)
  await ctx.plugin(AgentLoop, { agents: [] })
  await ctx.plugin(LocalSubprocessService)
  await ctx.plugin(LocalBashExecutor, { timeoutMs: 10_000 })
+  beforeHooks?.(ctx)
  await ctx.plugin(HooksCodex, { configPath: join(dir, 'hooks.json'), model: 'test-model' })
  ctx.llm.registerAdapter(['mock'], adapter)
  return ctx
@@ -88,11 +89,11 @@ describe('hooks-codex bridge', () => {

  it('a Stop hook (exit 2) forces the turn to continue with the reason as steering', async () => {
    const dir = configDir()
-    // Block once with a marker; until the loop guard lands, an always-blocking
-    // hook would never let this test finish.
+    // Stop ignores its malformed matcher field. Block once with a marker;
+    // until the loop guard lands, an always-blocking hook would never finish.
    const marker = join(dir, 'fired')
    const cont = script(dir, 'cont.sh', `#!/usr/bin/env bash\nif [ -e "${marker}" ]; then exit 0; fi\ntouch "${marker}"\necho "keep going: address the goal" >&2\nexit 2\n`)
-    writeHooks(dir, { Stop: [{ hooks: [{ type: 'command', command: cont }] }] })
+    writeHooks(dir, { Stop: [{ matcher: '[', hooks: [{ type: 'command', command: cont }] }] })

    const adapter = new MockAdapter([textResponse('first answer'), textResponse('second answer after goal')])
    const ctx = await harness(dir, adapter)
@@ -151,6 +152,26 @@ describe('hooks-codex bridge', () => {
    expect(adapter.requests).toHaveLength(1)
  })

+  it('an invalid regex matcher is reported and registers no hooks', async () => {
+    const dir = configDir()
+    writeHooks(dir, {
+      UserPromptSubmit: [{ hooks: [{ type: 'command', command: 'exit 2' }] }],
+      PreToolUse: [{ matcher: '[', hooks: [{ type: 'command', command: 'exit 2' }] }],
+    })
+    const adapter = new MockAdapter([textResponse('ok')])
+    const warn = vi.fn()
+    const ctx = await harness(dir, adapter, (ctx) => { ctx.logger.warn = warn as never })
+    const agent = ctx.agentLoop.create(SessionId('invalid-codex-matcher'), { provider: 'mock', model: 'mock' })
+    agent.followup(createUserMessage({ content: [{ type: 'text', text: 'go' }], source: { kind: 'user' } }))
+    await waitForIdle(ctx, agent)
+    expect(adapter.requests).toHaveLength(1)
+    expect(events(agent).some(event => event.type === 'hook/invoked')).toBe(false)
+
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining(
+      'invalid codex regex matcher "[" on event "PreToolUse"',
+    ))
+  })
+
  it('disposing the bridge fiber removes its listeners (HMR safety)', async () => {
    const dir = configDir()
    // A leaked listener would let this blocking hook veto the prompt and log an invocation; a
--- a/packages/hooks/hooks-codex/tests/config.spec.ts
+++ b/packages/hooks/hooks-codex/tests/config.spec.ts
@@ -65,4 +65,22 @@ describe('parseCodexConfig', () => {
    const { config } = parseCodexConfig({ PreToolUse: [{ matcher: '^Bash$', hooks: [{ type: 'command', command: 'b.sh' }] }] })
    expect(config.PreToolUse![0]!.matcher).toBe('^Bash$')
  })
+
+  it('rejects an invalid regex matcher with its event name', () => {
+    expect(() => parseCodexConfig({
+      PreToolUse: [{ matcher: '[', hooks: [{ type: 'command', command: 's.sh' }] }],
+    })).toThrow('invalid codex regex matcher "[" on event "PreToolUse"')
+  })
+
+  it('discards matcher fields on events without matcher subjects before validation', () => {
+    const { config } = parseCodexConfig({
+      UserPromptSubmit: [{ matcher: '[', hooks: [{ type: 'command', command: 'prompt.sh' }] }],
+      Stop: [{ matcher: '(', hooks: [{ type: 'command', command: 'stop.sh' }] }],
+    })
+
+    expect(config).toEqual({
+      UserPromptSubmit: [{ hooks: [{ command: 'prompt.sh' }] }],
+      Stop: [{ hooks: [{ command: 'stop.sh' }] }],
+    })
+  })
 })
--- a/packages/host/apiproxy/README.i18n.yaml
+++ b/packages/host/apiproxy/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/host/apiproxy/README.md
-README.md: 1f0daedc54888a1951bc83c474f83287aaf42307
-README.zh.md: abf5417cdbe93f1199c621ac101249986969da93
+README.md: 7129842a0cc89f5fa10c0bceec7cf0997ac71a99
+README.zh.md: 8765627236ea7af9e5cd3b7029133181ef499905
--- a/packages/host/apiproxy/README.md
+++ b/packages/host/apiproxy/README.md
@@ -16,6 +16,8 @@ Session titles ride the generic projection pair like every other domain — the

 Session model routing is a session-domain contract. `session.models` returns the selected provider/model/reasoning target with provider-grouped advisory models, exact-route reasoning metadata, and provider-local lookup failures. `session.selectModel` validates the optional adapter-owned reasoning effort and replaces the complete target selected for the next prompt-assembly boundary. Catalog membership is not validation: an adapter may resolve an unlisted model, while an unavailable route or unsupported effort returns `model-unavailable`.

+Pending queued input is a live control-plane contract, not session history. The gateway mirrors queued `InboxItem` occurrences from `agent/inbox/*` and broadcasts authoritative `session/queue` snapshots on every queued change and reconnect; pending steering stays outside this Web projection. `session.updateQueue` addresses one `InboxItemId`: edit replaces pending content and remove discards it. A driver claim wins races by retiring the address before admission; a later operation returns `queue-item-not-found`. The operation queries only an attached Agent and never resumes a cold session because process-local inbox identities do not survive restart or disposal. The client never infers retirement from turn or status events.
+
 Workspace and Session lists are separate reconnect baselines. `workspace.create` creates a unique name or adopts an existing directory, `workspace.delete` removes only the Workspace registration, `session.create` accepts an optional preallocated Session id, and `host/workspace-changed`, `host/workspace-removed`, plus `host/session-added` carry committed increments in either arrival order. Registration deletion preserves the directory and session logs; its Sessions remain in `session.list` and become Ungrouped. `SessionSummary.blank` and the `host/session-added` frame carry the derived zero-events bit: clients hide blank sessions and reuse them per workspace, flip blank on the first `host/session-status(running:true)`, and treat `session.list` as the reconnect authority; cold summaries are never blank because lazy persistence keeps never-appended sessions out of `list()`.

 Directory picking delegates to the composed `ctx.directoryPicker` backend ([the directory-picker seam](../directory-picker/README.md)); a method called outside the composed capability's kind fails with `directory-picker-unavailable` (the client needs no advertisement — the composed picker package's own client half renders the matching interaction). Under `native`, `host.pickDirectory` opens one native chooser and returns its selected path (`null` on cancel); this user-paced method is the sole unary call exempt from the default 30-second timeout, and caller/connection aborts still propagate to the native process. Under `browse`, `host.listDirectory` returns one name-sorted directory level with breadcrumb ancestry, a `home` anchor, and host-owned `hidden` flags (absent path = home directory), and `host.createDirectory` creates one validated child segment; the backend's typed failures map 1:1 onto the `directory-unreadable`/`directory-exists`/`directory-create-failed` codes. The browser carrier's prefix-wide trust fence (dsh-client-connection) covers all of these like every other `/api` request.
--- a/packages/host/apiproxy/README.zh.md
+++ b/packages/host/apiproxy/README.zh.md
@@ -16,6 +16,8 @@

 会话模型路由属于会话领域契约。`session.models` 返回选中的提供方／模型／推理（reasoning）目标，以及按提供方分组的建议性模型、精确路由推理元数据和逐提供方查询失败记录。`session.selectModel` 校验由适配器持有的可选推理强度，并替换将在下一提示词组装边界使用的完整目标。目录成员关系不构成校验：适配器可以解析未列出的模型，而不可用路由或不受支持的推理强度会返回 `model-unavailable`。

+待处理的 queued 输入属于实时控制平面契约，而非会话历史。网关镜像来自 `agent/inbox/*` 的 queued `InboxItem` 入队项，并在每次 queued 变更和重连时广播权威的 `session/queue` 快照；待处理 steering（中途引导）不进入此 Web 投影。`session.updateQueue` 通过 `InboxItemId` 寻址单个项：编辑会替换待处理内容，移除会将其丢弃。驱动器在接纳前退役寻址标识，因此认领会赢得竞态；之后的操作返回 `queue-item-not-found`。该操作只查询当前已挂载的 Agent，绝不恢复冷会话，因为进程本地 inbox 标识无法在重启或资源释放后存活。客户端绝不根据轮次或状态事件推断项已退役。
+
 Workspace 列表与 Session 列表是相互独立的重连基线。`workspace.create` 会创建唯一名称或接纳现有目录，`workspace.delete` 只移除 Workspace 注册记录，`session.create` 接受可选的预分配 Session id，`host/workspace-changed`、`host/workspace-removed` 与 `host/session-added` 则以任意到达顺序携带已提交的增量。删除注册记录会保留目录和会话日志；相关 Session 仍留在 `session.list` 中，并进入 Ungrouped。`SessionSummary.blank` 与 `host/session-added` 帧携带派生的零事件位：客户端隐藏空白会话并按 workspace 复用它们，在首个 `host/session-status(running:true)` 时翻转 blank，并以 `session.list` 作为重连权威；冷会话摘要永远不是空白：惰性持久化让从未追加过事件的会话根本不出现在 `list()` 中。

 目录选择委托给组合的 `ctx.directoryPicker` 后端（[目录选择 seam](../directory-picker/README.md)）；调用组合能力 kind 之外的方法会以 `directory-picker-unavailable` 失败（客户端不需要广播——组合的选择器包自己的 client half 渲染匹配的交互）。在 `native` 下，`host.pickDirectory` 打开一个原生选择器并返回选中路径（取消为 `null`）；该方法需等待用户完成操作，是唯一不受默认 30 秒超时限制的一元调用，调用方与连接的中止仍会传播至原生进程。在 `browse` 下，`host.listDirectory` 返回一个按名称排序的目录层级，携带面包屑祖先链、`home` 锚点与宿主判定的 `hidden` 标志（不带路径即家目录），`host.createDirectory` 创建一个经校验的子段；后端的类型化失败 1:1 映射为 `directory-unreadable`／`directory-exists`／`directory-create-failed` 错误码。浏览器载体的前缀级信任栅栏（dsh-client-connection）像覆盖其他所有 `/api` 请求一样覆盖上述全部方法。
--- a/packages/host/apiproxy/src/api-proxy.ts
+++ b/packages/host/apiproxy/src/api-proxy.ts
@@ -9,11 +9,11 @@ import { join } from 'node:path'
 import type { Context } from 'cordis'
 import { installAgentLlmTarget } from '@deepseek-ai/dsh-agent'
 import type {
-  Agent, AgentLlmTarget, AgentLlmTargetRef, AgentStatus, InboxPlacement,
+  Agent, AgentLlmTarget, AgentLlmTargetRef, AgentStatus, InboxItem, InboxItemId,
 } from '@deepseek-ai/dsh-agent'
 import { createUserMessage, ReasoningEffortId } from '@deepseek-ai/dsh-llm'
 import { errorChain } from '@deepseek-ai/dsh-llm'
-import type { MessageId, MessageSource } from '@deepseek-ai/dsh-llm'
+import type { MessageSource } from '@deepseek-ai/dsh-llm'
 import type { Session, SessionEvent, SessionHeader, SessionId, UserMessage } from '@deepseek-ai/dsh-session'
 import type { SessionPersistence } from '@deepseek-ai/dsh-session-persistence'
 import type { Workspace, WorkspaceRecord } from '@deepseek-ai/dsh-workspace'
@@ -508,46 +508,106 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
  })

  /**
-   * Per-session inbox occurrence mirror serving the mux-open queue snapshot
+   * Per-session queued-occurrence mirror serving the mux-open queue snapshot
   * (the same refresh-recovery baseline as pending questions). Each terminal
-   * inbox event retires one matching occurrence, so repeated sends of the same
+   * queue event retires one matching occurrence, so repeated sends of the same
   * identified message remain visible until every occurrence is claimed.
   */
-  const queuedMirror = new Map<SessionId, { message: UserMessage; steering: boolean }[]>()
+  const queuedMirror = new Map<SessionId, InboxItem[]>()
+  type UnseenQueueEvent =
+    | { readonly kind: 'update'; readonly item: InboxItem }
+    | { readonly kind: 'terminal' }
+  const unseenQueueEvents = new Map<SessionId, Map<InboxItemId, UnseenQueueEvent>>()
+  const rememberUnseen = (sessionId: SessionId, itemId: InboxItemId, event: UnseenQueueEvent): void => {
+    let events = unseenQueueEvents.get(sessionId)
+    if (events === undefined) {
+      events = new Map()
+      unseenQueueEvents.set(sessionId, events)
+    }
+    events.set(itemId, event)
+    // Only synchronous re-entrancy may deliver a mutation before its outer
+    // enqueue observer. Drop unmatched protocol-invalid observations instead
+    // of retaining process-local ids indefinitely.
+    queueMicrotask(() => {
+      const current = unseenQueueEvents.get(sessionId)
+      if (current?.get(itemId) !== event) return
+      current.delete(itemId)
+      if (current.size === 0) unseenQueueEvents.delete(sessionId)
+    })
+  }
+  const takeUnseen = (sessionId: SessionId, itemId: InboxItemId): UnseenQueueEvent | undefined => {
+    const events = unseenQueueEvents.get(sessionId)
+    const event = events?.get(itemId)
+    if (event === undefined) return undefined
+    events?.delete(itemId)
+    if (events?.size === 0) unseenQueueEvents.delete(sessionId)
+    return event
+  }
+  const publishQueue = (sessionId: SessionId): void => {
+    const items = queuedMirror.get(sessionId) ?? []
+    broadcast({
+      type: 'session/queue',
+      sessionId,
+      items: items.map(item => ({
+        id: item.id,
+        message: item.message,
+      })),
+    })
+  }
  ctx.effect(() => {
-    const retire = (agent: Agent, id: MessageId, placement?: InboxPlacement): void => {
+    const retire = (agent: Agent, item: InboxItem): boolean => {
      const entries = queuedMirror.get(agent.id)
-      if (entries === undefined) return
-      const index = entries.findIndex(entry =>
-        entry.message.id === id
-        && (placement === undefined || entry.steering === (placement === 'steering')))
-      if (index !== -1) entries.splice(index, 1)
+      if (entries === undefined) {
+        rememberUnseen(agent.id, item.id, { kind: 'terminal' })
+        return false
+      }
+      const index = entries.findIndex(entry => entry.id === item.id)
+      if (index === -1) {
+        rememberUnseen(agent.id, item.id, { kind: 'terminal' })
+        return false
+      }
+      entries.splice(index, 1)
      if (entries.length === 0) queuedMirror.delete(agent.id)
+      return true
    }
    const disposers = [
-      ctx.on('agent/inbox/enqueue', (agent: Agent, message: UserMessage, placement) => {
+      ctx.on('agent/inbox/enqueue', (agent: Agent, item: InboxItem) => {
+        if (item.placement !== 'queued') return
+        const unseen = takeUnseen(agent.id, item.id)
+        if (unseen?.kind === 'terminal') return
        let entries = queuedMirror.get(agent.id)
        if (entries === undefined) {
          entries = []
          queuedMirror.set(agent.id, entries)
        }
-        const steering = placement === 'steering'
-        entries.push({ message, steering })
-        broadcast({
-          type: 'session/queued',
-          sessionId: agent.id,
-          message,
-          steering,
-        })
+        entries.push(unseen?.kind === 'update' ? unseen.item : item)
+        publishQueue(agent.id)
      }),
-      ctx.on('agent/inbox/dequeue', (agent: Agent, message: UserMessage, placement) => {
-        retire(agent, message.id, placement)
+      ctx.on('agent/inbox/update', (agent: Agent, item: InboxItem) => {
+        const entries = queuedMirror.get(agent.id)
+        if (entries === undefined) {
+          rememberUnseen(agent.id, item.id, { kind: 'update', item })
+          return
+        }
+        const index = entries.findIndex(entry => entry.id === item.id)
+        if (index === -1) {
+          rememberUnseen(agent.id, item.id, { kind: 'update', item })
+          return
+        }
+        entries.splice(index, 1, item)
+        publishQueue(agent.id)
      }),
-      ctx.on('agent/inbox/discard', (agent: Agent, messages: UserMessage[]) => {
-        for (const message of messages) retire(agent, message.id)
+      ctx.on('agent/inbox/dequeue', (agent: Agent, item: InboxItem) => {
+        if (retire(agent, item)) publishQueue(agent.id)
+      }),
+      ctx.on('agent/inbox/discard', (agent: Agent, items: InboxItem[]) => {
+        let changed = false
+        for (const item of items) changed = retire(agent, item) || changed
+        if (changed) publishQueue(agent.id)
      }),
      ctx.on('session/disposed', (session: Session) => {
        queuedMirror.delete(session.id)
+        unseenQueueEvents.delete(session.id)
      }),
    ]
    return () => { for (const dispose of disposers) dispose() }
@@ -1099,6 +1159,19 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
        return ok(request, { accepted: true as const })
      },

+      updateQueue(request) {
+        const { sessionId, itemId, action } = request.payload
+        const agent = ctx.agents.get(sessionId)
+        if (agent === undefined || agent.updateInbox(itemId, action) === 'not-found') {
+          return Promise.resolve(err(request, {
+            code: 'queue-item-not-found',
+            message: 'queued item is no longer pending',
+            details: { itemId },
+          }))
+        }
+        return Promise.resolve(ok(request, { accepted: true as const }))
+      },
+
      cancel(request) {
        const { sessionId } = request.payload
        const agent = ctx.agents.get(sessionId)
@@ -1494,15 +1567,15 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
        // Queue snapshot baseline (pendingQuestions precedent): frames replayed
        // in arrival order per session; a reconnecting client rebuilds its
        // queue view from these alone.
-        for (const [sessionId, entries] of queuedMirror) {
-          for (const entry of entries) {
-            queue.push(frame({
-              type: 'session/queued',
-              sessionId,
-              message: entry.message,
-              steering: entry.steering,
-            }))
-          }
+        for (const [sessionId, items] of queuedMirror) {
+          queue.push(frame({
+            type: 'session/queue',
+            sessionId,
+            items: items.map(item => ({
+              id: item.id,
+              message: item.message,
+            })),
+          }))
        }
        // Per-session open-call table for result-view pairing. Bounded by the
        // per-turn call count: entries clear on turn/end; a table miss (stream
--- a/packages/host/apiproxy/src/api/events.schema.ts
+++ b/packages/host/apiproxy/src/api/events.schema.ts
@@ -10,7 +10,9 @@ import type { HostFrame, MuxFrame } from './events.ts'
 import type { Wire } from './rpc.schema.ts'
 import { rpcErrorSchema, rpcIdSchema } from './rpc.schema.ts'
 import { approvalRequestIdSchema } from './approvals.schema.ts'
-import { contentBlockSchema, sessionEventSchema, sessionIdSchema, toolEventViewSchema } from './sessions.schema.ts'
+import {
+  contentBlockSchema, inboxItemIdSchema, sessionEventSchema, sessionIdSchema, toolEventViewSchema,
+} from './sessions.schema.ts'
 import { workspaceIdSchema, workspaceViewSchema } from './workspace.schema.ts'

 /** Question shape validated strictly against core dsh-user-interaction. */
@@ -42,7 +44,14 @@ export const muxFrameSchema = z.discriminatedUnion('type', [
  // and must fail loud here, not reach the composer.
  z.object({ type: z.literal('question/requested'), sessionId: sessionIdSchema, questions: z.array(askUserQuestionItemSchema).min(1) }),
  z.object({ type: z.literal('question/resolved'), sessionId: sessionIdSchema, questionRpcId: rpcIdSchema, outcome: z.union([z.literal('answered'), z.literal('cancelled')]) }),
-  z.object({ type: z.literal('session/queued'), sessionId: sessionIdSchema, message: messageSchema, steering: z.boolean() }),
+  z.object({
+    type: z.literal('session/queue'),
+    sessionId: sessionIdSchema,
+    items: z.array(z.object({
+      id: inboxItemIdSchema,
+      message: messageSchema,
+    })),
+  }),
  // value stays wide: it already passed its unit's own schema on the host,
  // and deep-validating here would import every domain's schema into the carrier.
  z.object({ type: z.literal('session/projection'), sessionId: sessionIdSchema, key: z.string().min(1), value: z.unknown(), seq: z.number().int().nonnegative() }),
--- a/packages/host/apiproxy/src/api/events.ts
+++ b/packages/host/apiproxy/src/api/events.ts
@@ -9,6 +9,7 @@
 import type { AskUserQuestionItem } from '@deepseek-ai/dsh-user-interaction/types'
 import type { ApprovalOutcome, ApprovalRequestId } from '@deepseek-ai/dsh-user-approval/types'
 import type { Message } from '@deepseek-ai/dsh-llm/types'
+import type { InboxItemId } from '@deepseek-ai/dsh-agent/brand'
 import type { CallId } from '@deepseek-ai/dsh-llm/brand'
 import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session/types'
 import type { ToolCallView, ToolResultView } from '@deepseek-ai/dsh-tools/presentation'
@@ -31,6 +32,14 @@ export type ToolEventView =
  | { for: 'call'; view: ToolCallView }
  | { for: 'result'; view: ToolResultView }

+/** One pending queued occurrence in an authoritative queue snapshot. */
+export interface QueuedInboxItem {
+  /** Agent-owned occurrence identity used by queue mutations. */
+  id: InboxItemId
+  /** Complete pending message; it is not durable until the Agent claims it. */
+  message: Message
+}
+
 /** Streaming face of the contract: the two SSE stream openers (mux + host). */
 export interface EventsApi {
  /**
@@ -62,18 +71,13 @@ export type MuxFrame =
  | { type: 'question/requested'; sessionId: SessionId; questions: AskUserQuestionItem[] }
  | { type: 'question/resolved'; sessionId: SessionId; questionRpcId: RpcId; outcome: 'answered' | 'cancelled' }
  /**
-   * A message entered the addressed agent's inbox. A queued message is not
-   * model-visible, so there is no session event to carry it; this transient
-   * frame is the only wire signal. On stream open the
-   * host replays the current queue snapshot for every attached session (same
-   * refresh-recovery baseline as pending questions); queue clearing on cancel
-   * has no dedicated frame — clients fold it from the status flip.
-   * `steering` is the host's acceptance-time queue classification and remains
-   * authoritative in reconnect snapshots. `message.source` carries the prompt's rpcId
-   * when the message came over this wire (the client's provisional-echo
-   * reconciliation key).
+   * Complete transient queue state after every enqueue, mutation, claim, or
+   * discard. Pending work is not model-visible and therefore has no durable
+   * session event; the whole snapshot makes edit, deletion, cancel, and
+   * reconnect converge through one authoritative signal. Pending steering is
+   * outside this Web queue projection.
   */
-  | { type: 'session/queued'; sessionId: SessionId; message: Message; steering: boolean }
+  | { type: 'session/queue'; sessionId: SessionId; items: QueuedInboxItem[] }
  /**
   * One projection unit's finished value changed (session-projection RFC).
   * Live push state, never logged — replay recomputes on the host (the
--- a/packages/host/apiproxy/src/api/index.ts
+++ b/packages/host/apiproxy/src/api/index.ts
@@ -29,13 +29,13 @@ export interface ApiProxy {
 // ---- Domain interfaces and payload entities ----
 export type {
  HistoryEntry, ModelCatalogFailure, ModelCatalogModel, ModelProviderGroup, ModelReasoning,
-  ModelReasoningEffort, ModelTarget, SessionModels, SessionProjectionsBlock, SessionsApi, SessionSummary,
+  ModelReasoningEffort, ModelTarget, QueueAction, SessionModels, SessionProjectionsBlock, SessionsApi, SessionSummary,
 } from './sessions.ts'
 export type { DirectoryEntry, DirectoryListing, HostApi } from './host.ts'
 export type { WorkspaceApi, WorkspaceId, WorkspaceView } from './workspace.ts'
 export type { CommandsApi, CommandDescriptor } from './commands.ts'
 export type { SkillsApi, SkillEntry } from './skills.ts'
-export type { EventsApi, MuxFrame, HostFrame, ToolCallView, ToolEventView, ToolResultView } from './events.ts'
+export type { EventsApi, MuxFrame, HostFrame, QueuedInboxItem, ToolCallView, ToolEventView, ToolResultView } from './events.ts'
 export type { GoalsApi, GoalId, GoalRef } from './goals.ts'
 export type { ApprovalResponsePayload } from './approvals.ts'
 export type { QuestionResponsePayload } from './questions.ts'
@@ -56,6 +56,7 @@ export type {
 // ---- Errors and ids ----
 export { RpcId, transportError } from './rpc.ts'
 export type { RpcError, RpcErrorCode, RpcErrorDetailsMap, RpcResult } from './rpc.ts'
+export type { InboxItemId } from '@deepseek-ai/dsh-agent/brand'

 // ---- Method registry and derived generics ----
 export type { RequestPayload, ResponseValue, RpcMethodMap } from './rpc-map.ts'
--- a/Show More
+++ b/Show More