Questions from work handed out in a group show in the Bot's private chat instead of the group #550

Report

Owner report (Danyang, 2026-10-20 21:15 Asia/Shanghai): "群组聊天分配任务之后问用户的问题出现在bot自己的聊天对话内，这个不合理" — after a task is handed out in a group chat, the question the Bot then asks the user shows up in that Bot's own private chat, not in the group where the task came from.

Owner decision (2026-10-20 21:15 Asia/Shanghai): questions from group-assigned work must appear in the originating group, not the Bot's private chat.

Steps to reproduce

1. Make a group with an admin Bot (e.g. Chief) and a member Bot (e.g. Tester).
2. In the group, ask the admin for work it hands to Tester. The admin speaks from its group Session and hands the work over with message_bot (reply to "me").
3. Tester needs a decision and calls ask_user.

Actual

• Tester runs the handed-over work in a hidden turn of its own chat (message_bot always lands there). ask_user stores the card under that Session id (state.questions[<Tester's own chat>]), and because the turn is hidden the card goes to the composer dock of Tester's private chat.
• The group shows nothing to answer. If the user finds the card in Tester's chat and answers it there, the answer starts a visible turn in that private chat and Tester's result stays there; it never returns to the group (the reply path back to the admin's group Session is lost).

Expected

• The card shows in the group the work came from (its composer dock), naming the Bot that asks.
• Answering it there sends the answer back to the waiting work: Tester continues the same hidden exchange and its reply goes back to the admin's Session in the group, which posts it there, as the original work did.
• The group shows a short notice of the answer; Tester's private chat gets no duplicate card or answer turn.
• Only the asking Bot's owner (or the room's owner) may answer it, the same rule as group approval cards; other room members do not get an answerable card.

Where it sits

• core/src/host/tools.js ask_user (~L513–544): always writes state.questions[id] for the Bot's own chat; ignores that the turn's trigger is a request with senderRoomId (set by callerRoom in message_bot, ~L24–27, and used in turns.js answer ~L515 to route the reply back to the group).
• core/src/host/channel.js answer-question (~L395–419): answers only by follow-up into the same Session.
• core/src/host/turns.js (~L464–468): any user line in a Session clears its card.
• Approval cards already take the group route (approvals.js, room-roster cards around PR Add Always allow for a Bot or a group to tool approval cards #544); questions take a different path.

Fix scope

Host only: route ask_user from a turn that answers a group member's request to state.questions[<room id>] with the asking Bot and the reply route; answer it from the group as a hidden request to the asking Bot (reply goes back to the group Session); post a quiet notice in the group; authz limits answering to the Bot's owner or the room owner. Works for face-to-face rooms the same way (local home). Out of scope: ask_user inside a group Session itself (still refused there, the Bot asks in its reply, which already shows in the group), secret cards (deliberately private), reply_to: "user" hand-offs (answered in the Bot's own chat by design).