fix(channel,user): owner 车道只认白名单，堵住群主/伪造 role 冒充主人（裁决 06.4.2/06.4.3/06.4.4）

- 适配器只描述平台身份：qq_obv11 的 owner/admin 一律上报 RoleMember，不再上报 RoleOwner
- session 层唯一判主点只认白名单（owner.yaml Accounts ∪ 每渠道 adminIds），nil 档案 fail-closed 拒绝
- 新增「每渠道管理员层」：channels.json ChannelAccount.adminIds[] → runtimeconfig.AdminIDs → OwnerProfile.SetPlatformAdmins（整体替换语义，热重载后移除的 id 立即失效）
- 组合根接线：启动即播种、面板保存先灌白名单再重载适配器（cmd/cyrene/wire_channels.go + 4 条端到端单测）
- 06.4.3 节流与参与度状态按会话独立计数（ConversationKey 三处统一，空会话 GC）；06.4.4 未知平台主动发言保守默认 1 条/分钟

internal/services/channelbridge/channelbridge_test.go

@@ -89,10 +89,11 @@ func (s *stubSessions) GetOrCreate(_ context.Context, msg adapter.UnifiedMessage
 	return s.sess, nil
 }
 
-// directMessage is an owner-private direct message: the sender is tagged as the
-// owner (structural, not from text), so it exercises the owner-private path. The
-// single-account stub session in newTestBridge reports Owner=true to match, since
-// the production SessionManager derives Owner from the resolved actor.
+// directMessage 是一条主人私聊消息：platform telegram / 发送者 100。它是否是主人由**白名单**
+// 决定——夹具的主人档案（testOwnerProfile("telegram", "100")）把这个账号结构性地写进去
+// （裁决 06.4.2：owner 车道只认白名单）。这里仍带上适配器上报的 role=owner 标记，用来断言
+// 「白名单命中时适配器标记不影响判主」；反过来，未进白名单的账号即使带该标记也不是主人。
+// newTestBridge 的单账号 stub session 据此报 Owner=true，与生产 SessionManager 的派生一致。
 func directMessage() adapter.UnifiedMessage {
 	return adapter.UnifiedMessage{
 		Platform:    "telegram",
@@ -111,7 +112,9 @@ func newTestBridge(t *testing.T) (*Bridge, *stubChatter, *stubSessions, *fakeAda
 	sess := &stubSessions{sess: session.Session{SessionID: "sess-1", Owner: true, MemWritable: true}}
 	ad := &fakeAdapter{name: "telegram"}
 
-	b, err := New(Options{Loop: chat, Sessions: sess, Owner: &user.OwnerProfile{}})
+	// 主人私聊要进主会话，夹具必须把发送者结构性地写进白名单（owner 车道只认白名单，
+	// 裁决 06.4.2）；适配器上报的 RoleOwner 标记本身不再判主。
+	b, err := New(Options{Loop: chat, Sessions: sess, Owner: testOwnerProfile("telegram", "100")})
 	if err != nil {
 		t.Fatalf("New: %v", err)
 	}
@@ -311,7 +314,7 @@ func TestOwnerPrivatePersistsToMainSessionWithPlatform(t *testing.T) {
 	hist := &captureHistory{}
 	var persisted []history.Message
 	b, err := New(Options{
-		Loop: chat, Sessions: sess, Owner: &user.OwnerProfile{},
+		Loop: chat, Sessions: sess, Owner: testOwnerProfile("telegram", "100"),
 		History:     hist,
 		OnPersisted: func(m history.Message) { persisted = append(persisted, m) },
 	})
@@ -358,7 +361,7 @@ func TestOwnerPrivatePersistsToMainWithDeviceID(t *testing.T) {
 	sess := &stubSessions{sess: session.Session{SessionID: "sess-1", Owner: true, MemWritable: true}}
 	hist := &captureHistory{}
 	b, err := New(Options{
-		Loop: chat, Sessions: sess, Owner: &user.OwnerProfile{},
+		Loop: chat, Sessions: sess, Owner: testOwnerProfile("telegram", "100"),
 		History: hist,
 	})
 	if err != nil {
@@ -581,7 +584,7 @@ func TestOwnerInGroupIsIsolatedButNotLabeledThirdParty(t *testing.T) {
 	// but the owner is never labeled as a third party (design/16 §4.6 §1-2).
 	sess := &stubSessions{sess: session.Session{SessionID: "sess-g", IsGroup: true, Owner: true, MemWritable: false}}
 	hist := &captureHistory{}
-	b, err := New(Options{Loop: chat, Sessions: sess, Owner: &user.OwnerProfile{}, History: hist})
+	b, err := New(Options{Loop: chat, Sessions: sess, Owner: testOwnerProfile("telegram", "owner_uid"), History: hist})
 	if err != nil {
 		t.Fatalf("New: %v", err)
 	}

internal/services/channelbridge/engage.go

@@ -96,18 +96,15 @@ func (b *Bridge) engageConfigured() bool {
 	return len(b.triggerWords) > 0 || b.engage.Enabled || b.engage.Probability > 0
 }
 
-// engageKey returns the per-conversation state key (design/18 §1: 群聊会话 platform:groupID).
-// A stranger direct chat (no group) falls back to platform:senderID so the engine still
-// applies to one-to-one strangers.
+// engageKey 返回该会话在参与度引擎里的状态键（design/18 §1/§6，裁决 06.4.3）。键口径与
+// 入站节流**完全一致**：adapter.ConversationKey（platform+channelID+groupID/peerID），
+// 所以同一会话在「滑窗计数」和「参与度状态机」里落在同一个桶——两个群并发互不挤占。
+// 群聊缺 group id 时用 actor 上报的群 id 补齐（适配器可能只填了 Sender.GroupID）。
 func engageKey(msg adapter.UnifiedMessage, actor adapter.Actor) string {
-	if msg.IsGroup() || actor.IsGroupChat() || actor.GroupID != "" {
-		g := msg.GroupID
-		if g == "" {
-			g = actor.GroupID
-		}
-		return msg.Platform + ":" + g
+	if msg.GroupID == "" && (msg.IsGroup() || actor.IsGroupChat() || actor.GroupID != "") {
+		msg.GroupID = actor.GroupID
 	}
-	return msg.Platform + ":" + firstNonEmptyStr(msg.SenderID, msg.Sender.UserID)
+	return adapter.ConversationKey(msg)
 }
 
 // engageState returns the state for a conversation key, creating an IDLE instance on

internal/services/channelbridge/engage_session_test.go

@@ -0,0 +1,81 @@
+package channelbridge
+
+// 本文件覆盖裁决 06.4.3 在参与度引擎侧的断言：会话状态键与入站节流键是同一个口径，
+// 且每个会话的参与度状态互相独立——一个群冷场/参与中不影响另一个群。
+
+import (
+	"context"
+	"testing"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/channel/adapter"
+)
+
+// TestEngageKeyMatchesThrottleKey 固定「成对契约」：参与度引擎的状态键与入站节流键
+// （adapter.ConversationKey）必须同口径，否则同一会话会在「计数」与「状态机」里分裂成
+// 两个桶（裁决 06.4.3）。
+func TestEngageKeyMatchesThrottleKey(t *testing.T) {
+	t.Parallel()
+
+	msg := nonOwnerGroupMsg("hi")
+	msg.ChannelID, msg.GroupID = "-100", "-100"
+	actor := adapter.Actor{Role: adapter.RoleMember, IsGroup: true, GroupID: "-100"}
+	if got, want := engageKey(msg, actor), adapter.ConversationKey(msg); got != want {
+		t.Errorf("engageKey = %q, 节流键 = %q, 两者必须同口径", got, want)
+	}
+
+	// 群聊缺 group id 时用 actor 上报的群 id 补齐后仍与节流键一致。
+	bare := nonOwnerGroupMsg("hi")
+	bare.ChannelID, bare.GroupID = "", ""
+	patchActor := adapter.Actor{Role: adapter.RoleMember, IsGroup: true, GroupID: "-20"}
+	patched := bare
+	patched.GroupID = "-20"
+	if got, want := engageKey(bare, patchActor), adapter.ConversationKey(patched); got != want {
+		t.Errorf("缺 group id 时 engageKey = %q, 期望 %q", got, want)
+	}
+
+	// 两个群必须是两个键。
+	other := nonOwnerGroupMsg("hi")
+	other.ChannelID, other.GroupID = "-200", "-200"
+	if engageKey(msg, actor) == engageKey(other, actor) {
+		t.Error("两个群共用同一个参与度状态键（会话未隔离）")
+	}
+}
+
+// TestEngageStateIsPerConversation 断言两个群并发互不挤占：A 群被要求安静进入 COOLDOWN
+// 后，B 群仍能正常触发判定并回复（状态与计数都按会话独立，裁决 06.4.3）。
+func TestEngageStateIsPerConversation(t *testing.T) {
+	t.Parallel()
+
+	judge := &engageScriptJudge{responses: []LightDecision{
+		{WorthReply: true, Interesting: true, Reason: "想聊"},
+	}}
+	b, chat, _ := engageTestBridge(t, judge, DefaultEngageConfig(), dayNow(), nil)
+	ctx := context.Background()
+
+	// A 群冷场：一句「太吵了」把 A 群打进 COOLDOWN，且不消耗判定。
+	cold := nonOwnerGroupMsg("太吵了，闭嘴")
+	cold.ChannelID, cold.GroupID = "-100", "-100"
+	b.process(ctx, cold)
+	if judge.calls != 0 {
+		t.Fatalf("冷场消息触发了轻判调用 = %d, want 0", judge.calls)
+	}
+
+	// A 群的后续触发消息处于 COOLDOWN：必须不调判定、不回复。
+	groupA := nonOwnerGroupMsg("昔涟 你来说说")
+	groupA.ChannelID, groupA.GroupID = "-100", "-100"
+	b.process(ctx, groupA)
+	if judge.calls != 0 {
+		t.Fatalf("A 群 COOLDOWN 期间仍调用了判定 = %d, want 0", judge.calls)
+	}
+
+	// B 群不受 A 群影响：照常 PROBING → 判定 → 回复。
+	groupB := nonOwnerGroupMsg("昔涟 你来说说")
+	groupB.ChannelID, groupB.GroupID = "-200", "-200"
+	b.process(ctx, groupB)
+	if judge.calls != 1 {
+		t.Fatalf("B 群判定被 A 群 COOLDOWN 挤占，judge.calls = %d, want 1", judge.calls)
+	}
+	if chat.sessionID != "sess-g" {
+		t.Fatalf("B 群判定为想聊后应驱动 loop，session = %q", chat.sessionID)
+	}
+}

internal/services/channelbridge/flowgate.go

@@ -14,8 +14,10 @@ import (
 
 // gateFor returns the per-account flow gate for an adapter, building it lazily
 // from the adapter's Config snapshot on first use. Gates are keyed by the adapter
-// name so every account (platform:confId) gets an independent rate limit and
-// pending-cap (design/12 §6 策略三/四), and they survive adapter reconnects.
+// name so every account (platform:confId) keeps its own gate that survives adapter
+// reconnects; **the throttling counters inside a gate are per conversation**
+// (adapter.ConversationKey: platform+channelID+groupID/peerID), so two groups never
+// squeeze each other (design/12 §6 策略三/四, 裁决 06.4.3).
 func (b *Bridge) gateFor(a adapter.PlatformAdapter) *adapter.FlowGate {
 	name := a.Name()
 	b.gateMu.Lock()

internal/services/channelbridge/flowgate_test.go

@@ -83,7 +83,7 @@ func TestFlowGate_OwnerPrivateBypassesGate(t *testing.T) {
 	sess := &stubSessions{sess: session.Session{SessionID: "sess-1", Owner: true, MemWritable: true}}
 	var rejected []string
 	b, err := New(Options{
-		Loop: chat, Sessions: sess, Owner: &user.OwnerProfile{},
+		Loop: chat, Sessions: sess, Owner: testOwnerProfile("kook", "u0", "u1", "u2"),
 		OnRejected: func(_ adapter.UnifiedMessage, reason string) { rejected = append(rejected, reason) },
 	})
 	if err != nil {

internal/services/channelbridge/light_test.go

@@ -183,7 +183,7 @@ func TestOwnerUnaffectedInQuietHours(t *testing.T) {
 	sess := &stubSessions{sess: session.Session{SessionID: "sess-1", Owner: true, MemWritable: true}}
 	ad := &fakeAdapter{name: "telegram"}
 	b, err := New(Options{
-		Loop: chat, Sessions: sess, Owner: &user.OwnerProfile{}, History: &captureHistory{},
+		Loop: chat, Sessions: sess, Owner: testOwnerProfile("telegram", "100"), History: &captureHistory{},
 		QuietStartHour: 23, QuietEndHour: 7,
 		Now: func() time.Time { return time.Date(2026, 1, 1, 2, 0, 0, 0, time.UTC) },
 	})

internal/services/channelbridge/ownerfixture_test.go

@@ -0,0 +1,18 @@
+package channelbridge
+
+// 自裁决 06.4.2 起 owner 车道**只认白名单**：测试夹具不能再靠适配器上报的
+// `adapter.Actor{Role: adapter.RoleOwner}` 标记把某条消息变成主人消息——那正是本次修掉的
+// 漏洞（群主/伪造 role=owner 冒充主人）。需要主人私聊/主人群聊路径的用例，改为把该账号
+// 结构性地写进主人档案白名单，与生产路径（owner.yaml + 渠道 adminIds[]）同源。
+
+import "git.yeij.top/AskaEth/Cyrene_v2/internal/user"
+
+// testOwnerProfile 返回一个把给定账号写进白名单的主人档案。DisplayName 故意留空：
+// ruleLightJudge 会用 DisplayName 做「被点名」判定，空值保持这些夹具原有的语义。
+func testOwnerProfile(platform string, accountIDs ...string) *user.OwnerProfile {
+	p := &user.OwnerProfile{ID: "owner"}
+	for _, id := range accountIDs {
+		p.Accounts = append(p.Accounts, user.OwnerAccount{Platform: platform, AccountID: id})
+	}
+	return p
+}

internal/services/channelbridge/persona_test.go

@@ -50,7 +50,7 @@ func personaBridge(t *testing.T, mainSessionPersona, channelPersona string) (*Br
 	b, err := New(Options{
 		Loop:           chat,
 		Sessions:       &stubSessions{sess: session.Session{SessionID: "sess-1", Owner: true, MemWritable: true}},
-		Owner:          &user.OwnerProfile{},
+		Owner:          testOwnerProfile("telegram", "100"),
 		History:        &personaHistory{captureHistory: &captureHistory{}, personas: map[string]string{history.MainSessionID: mainSessionPersona}},
 		ChannelPersona: func(platform, accountID string) string { return channelPersona },
 	})
@@ -125,7 +125,7 @@ func TestInboundGroupForcesDefaultRole(t *testing.T) {
 	b, err := New(Options{
 		Loop:           chat,
 		Sessions:       &stubSessions{sess: session.Session{SessionID: "sess-g", IsGroup: true, Owner: true, MemWritable: false}},
-		Owner:          &user.OwnerProfile{},
+		Owner:          testOwnerProfile("telegram", "100"),
 		History:        &personaHistory{captureHistory: &captureHistory{}, personas: map[string]string{history.MainSessionID: "xilian"}},
 		ChannelPersona: func(platform, accountID string) string { return "yuki" },
 	})