diff --git a/CHANGELOG.md b/CHANGELOG.md
index b6a8eb9b..61490fd9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,9 @@ This file records user-facing changes for Terminal. Unless noted otherwise, vers
 
 ## [Unreleased]
 
+- **服务器终端输入与路径补全修复**。`cd ` 一类路径补全不再被 Fig 语料里的隐藏特殊参数（`-`/`~`）抢占——此前菜单只剩这两项，Tab 会把 `cd -` 写进输入行，原生路径补全永远到不了 shell；现在隐藏建议不进候选，本地没有候选时 Tab 原样透传。多候选时 Tab 只补公共前缀，方向键或鼠标明确选中后才接受该项，不再默认替用户填第一项。修复缓存命中后候选编辑范围停留在旧行尾的问题（`git checkout m` 续打成 `ma` 接受 `main` 不再得到 `maina`），以及异步/Worker 形态的补全引擎不调度动态候选的问题。SSH 目标的补全查询现在在终端当前目录执行（此前非空 cwd 一律被拒），切目录只作用于该次查询，不改变交互式会话。Ctrl+W 的行模型对齐 bash readline，保留被删词前的分隔空白（`cd /opt/` → `cd `）；原生 Tab、方向键等 shell 自有行改写之后，自动建议与 ghost 暂停到新的一行开始。
+  **Server terminal input and path completion fixes.** Path completion such as `cd ` is no longer hijacked by the hidden special arguments in the Fig corpus (`-`/`~`): the menu used to contain only those two, so Tab wrote `cd -` into the input line and native path completion never reached the shell — hidden suggestions are excluded now, and Tab passes straight through when there is no local candidate. With several candidates, Tab only extends the shared prefix; arrow keys or an explicit pointer selection decide which item is accepted instead of silently filling the first one. Also fixed: a cached generator result kept the previous line's edit range (`git checkout m` extended to `ma`, accepting `main`, used to produce `maina`), and asynchronous/Worker-shaped completion engines never scheduled dynamic candidates. Completion queries for SSH targets now run in the terminal's current directory (a non-empty cwd used to be rejected outright), and the directory switch is scoped to that one query without touching the interactive session. The Ctrl+W line model now matches bash readline by keeping the separator before the deleted word (`cd /opt/` → `cd `), and auto-suggestions and ghost text pause after shell-owned line rewrites such as native Tab or arrow keys until a new line starts.
+
 - **定时任务支持本地 Shell 目标与脚本文件**。调度任务编辑器新增两处能力：任务连接可选「本地 Shell」（新连接类型 `io.dbx.ssh.local`——表单只有连接名与可选 Shell 绝对路径，无网络端点、无凭据），让定时/常驻命令直接运行在 DBX 所在机器上（进程级应用环境变量与工作目录，流式日志、取消、超时与 SSH 同契约；取消/超时按进程组 TERM→SIGKILL 清理，本地路径忽略 PTY 选项）；两个触发器均新增可选「脚本文件」字段（带本机文件选择器），与「命令」互斥、至少填一个——SSH 连接把脚本上传到远端 `mktemp` 临时文件以 bash（无则 sh）执行、run 结束必删临时文件，本地 Shell 直接执行该文件。本地化覆盖全部既有语言。
   **Scheduled tasks gain a local shell target and script files.** The task editor adds two capabilities: task connections may bind a "Local shell" target (new connection type `io.dbx.ssh.local` — the form carries only a display name and an optional absolute shell path, no network endpoint and no credentials) so scheduled and resident commands run on the machine running DBX itself (environment and working directory apply at the process level; streaming logs, cancel and timeout follow the same contract as SSH, with cancel/timeout tearing down the whole process group TERM→SIGKILL; the PTY field is ignored on local targets); and both triggers gain an optional "Script file" field (with a native file picker), mutually exclusive with "Command" and at least one required — SSH targets upload the script to a remote `mktemp` temp file, run it with bash (falling back to sh) and always remove the temp file afterwards, while local-shell targets execute the file directly. Localizations cover every shipped language.
 
diff --git a/backend/src/completion/security.rs b/backend/src/completion/security.rs
index ca7a250d..67c16eeb 100644
--- a/backend/src/completion/security.rs
+++ b/backend/src/completion/security.rs
@@ -70,6 +70,30 @@ pub fn build_remote_command_line(command: &str, args: &[String]) -> String {
     line
 }
 
+/// SSH 目标接受的 cwd：绝对 POSIX 路径。`~`、相对路径、Windows 盘符的展开
+/// 规则由远端 Shell 决定，本轮不猜——明确定界而不是静默在错误目录执行。
+pub fn validate_ssh_cwd(cwd: &str) -> Result<(), String> {
+    if cwd.contains('\0') {
+        return Err("completion: invalid cwd".to_string());
+    }
+    if !cwd.starts_with('/') {
+        return Err("completion: cwd must be an absolute POSIX path".to_string());
+    }
+    Ok(())
+}
+
+/// 「切到 cwd 成功后才执行」的远端命令行：`cd` 走
+/// [`crate::exec::shell_quote`] 按字面量转义（空格/单引号/中文原样保留），
+/// `&&` 短路保证目录不可用时 generator 不执行；只抑制 `cd` 自身 stderr——
+/// exec 通道是 stdout+stderr 合并流，路径报错文本否则会被当作候选。
+pub fn build_command_line_in_cwd(command_line: &str, cwd: &str) -> String {
+    format!(
+        "cd {} 2>/dev/null && {}",
+        crate::exec::shell_quote(cwd),
+        command_line
+    )
+}
+
 /// 按 `cap` 字节截断 UTF-8 文本（回退到字符边界），返回 `(截断后文本,
 /// 是否截断)`。SSH 路径拿到的是 exec 合并流 String，上限在 completion
 /// 层统一施加。
@@ -235,4 +259,36 @@ mod tests {
         let (cut, _) = truncate_utf8("éz", 1);
         assert_eq!(cut, "");
     }
+
+    #[test]
+    fn ssh_cwd_accepts_only_absolute_posix_paths() {
+        const NOT_ABSOLUTE: &str = "completion: cwd must be an absolute POSIX path";
+        assert_eq!(validate_ssh_cwd("/home/me/src"), Ok(()));
+        assert_eq!(validate_ssh_cwd("/"), Ok(()));
+        assert_eq!(validate_ssh_cwd("src").unwrap_err(), NOT_ABSOLUTE);
+        assert_eq!(validate_ssh_cwd("./src").unwrap_err(), NOT_ABSOLUTE);
+        assert_eq!(validate_ssh_cwd("~/src").unwrap_err(), NOT_ABSOLUTE);
+        assert_eq!(validate_ssh_cwd("C:\\work").unwrap_err(), NOT_ABSOLUTE);
+        assert_eq!(
+            validate_ssh_cwd("/tmp/a\0b").unwrap_err(),
+            "completion: invalid cwd"
+        );
+    }
+
+    #[test]
+    fn cwd_prefix_quotes_path_and_short_circuits_on_failure() {
+        let line = build_command_line_in_cwd("git 'branch' '--list'", "/home/me/src");
+        assert_eq!(
+            line,
+            "cd '/home/me/src' 2>/dev/null && git 'branch' '--list'"
+        );
+        // 只抑制 cd 自身的 stderr：命令本身可诊断。
+        assert!(line.contains("2>/dev/null && "));
+    }
+
+    #[test]
+    fn cwd_prefix_keeps_spaces_quotes_and_unicode_verbatim() {
+        let line = build_command_line_in_cwd("ls", "/tmp/a b'c/目录");
+        assert_eq!(line, "cd '/tmp/a b'\\''c/目录' 2>/dev/null && ls");
+    }
 }
diff --git a/backend/src/completion/ssh.rs b/backend/src/completion/ssh.rs
index 1bf07955..ee27b68c 100644
--- a/backend/src/completion/ssh.rs
+++ b/backend/src/completion/ssh.rs
@@ -29,13 +29,19 @@ pub async fn execute(
     {
         return Err("completion: disabled by the read-only connection setting".to_string());
     }
-    // wave-1 未定义远端 cwd 语义：显式报错而不是悄悄在错误目录执行
-    //（git 类 generator 对目录敏感，静默忽略会产生错误结果）。
-    if req.cwd.as_deref().is_some_and(|cwd| !cwd.is_empty()) {
-        return Err("completion: cwd is not supported for ssh targets in wave 1".to_string());
-    }
+    // 远端 cwd（前端跟踪的 OSC 7/633 目录）：在本次独立 exec 通道内先切目录
+    // 再执行 generator，绝不向交互式 PTY 注入 `cd`——用户当前输入行、Shell
+    // 历史与会话状态都不受影响。只接受绝对 POSIX 路径：`~`/相对路径/Windows
+    // 盘符的展开规则依赖远端 Shell，本轮明确报错让前端安全回落，而不是猜。
     let exec_id = format!("completion-{}", uuid::Uuid::new_v4());
-    let command_line = security::build_remote_command_line(&req.command, &req.args);
+    let base_line = security::build_remote_command_line(&req.command, &req.args);
+    let command_line = match req.cwd.as_deref().filter(|cwd| !cwd.is_empty()) {
+        Some(cwd) => {
+            security::validate_ssh_cwd(cwd)?;
+            security::build_command_line_in_cwd(&base_line, cwd)
+        }
+        None => base_line,
+    };
     let exec = ssh.exec(session_id, Some(&exec_id), &command_line, false, None);
     match tokio::time::timeout(Duration::from_millis(req.timeout_ms), exec).await {
         Ok(Ok(value)) => map_exec_response(&value, req.max_output_bytes),
diff --git a/docs/PROTOCOL.zh-CN.md b/docs/PROTOCOL.zh-CN.md
index 35af38b9..d7152f24 100644
--- a/docs/PROTOCOL.zh-CN.md
+++ b/docs/PROTOCOL.zh-CN.md
@@ -1378,7 +1378,7 @@ FIG 补全引擎的专用执行通道（wave-1 lane B）：把一条 generator 
 - `target`：`{ kind: "local" | "ssh", sessionId }`（internally tagged）。local 的 `sessionId` 标识发起补全的本地终端会话（wave-1 仅透传）；ssh 的 `sessionId` 是既有 SSH 会话 id。
 - `command`：generator 程序名（非空、不含 NUL）。
 - `args`：参数数组（≤32 个、每个不含 NUL）。
-- `cwd`（可选）：工作目录。local target 生效（子进程 `current_dir`）；**ssh target wave-1 不支持，非空即报 `completion: cwd is not supported for ssh targets in wave 1`**（远端 cwd 语义留 wave 2 定义，显式失败优于静默在错误目录执行）。
+- `cwd`（可选）：工作目录。local target 生效（子进程 `current_dir`）；ssh target 仅接受**绝对 POSIX 路径**：在该次独立 exec 通道内先 `cd '<cwd>' 2>/dev/null &&` 再执行 generator（`&&` 短路：目录不可用时命令不执行；只抑制 `cd` 自身 stderr，避免把路径报错文本当作候选）。`~`/相对路径/Windows 盘符一律报 `completion: cwd must be an absolute POSIX path`（展开规则属远端 Shell，本轮不猜），含 NUL 报 `completion: invalid cwd`。切目录只作用于本次 exec，不向交互式 PTY 注入 `cd`，用户输入行、Shell 历史与会话状态都不受影响。缺省/null/空串保持原有命令拼装语义。
 - `timeoutMs`：completion 层超时，clamp 到 [200, 3000]，缺省（0/缺字段）1200。
 - `maxOutputBytes`：单流输出上限，stdout 与 stderr **各自**截断；缺省（0）或超过 256 KiB 时取 256 KiB。
 - `mode`：必须为 `"completion-generator"`（防止普通 RPC 复用本通道）。
diff --git a/frontend/src/App.vue b/frontend/src/App.vue
index 17fd36c0..e82bd8ee 100644
--- a/frontend/src/App.vue
+++ b/frontend/src/App.vue
@@ -1000,6 +1000,7 @@ const {
   completionOpen,
   completionItems,
   completionActiveIndex,
+  activateCompletion,
   completionAnchor,
   completionLoading,
   closeSuggestions,
@@ -9583,7 +9584,7 @@ watch(historyScope, () => {
           :viewport="suggestionViewport"
           :loading="completionLoading"
           :t="t"
-          @activate="(index) => (completionActiveIndex = index)"
+          @activate="activateCompletion"
           @accept="acceptCompletionRow"
         />
         <!-- 终端行内 ghost 自动建议（对标 Warp/fish）：灰色剩余文本盖在光标右侧，
diff --git a/frontend/src/composables/useCommandSuggestions.spec.ts b/frontend/src/composables/useCommandSuggestions.spec.ts
new file mode 100644
index 00000000..882fcd24
--- /dev/null
+++ b/frontend/src/composables/useCommandSuggestions.spec.ts
@@ -0,0 +1,221 @@
+// @vitest-environment happy-dom
+// 结构化补全菜单的按键归属（T1 / §4.1）：本文件不验证「候选数组长什么样」，
+// 而是驱动真实 fig 语料 + 真实 composable 键盘处理器，观察最终写入终端的
+// 字节与行缓冲——菜单显示 ≠ 键盘所有权，验收只看输入行变成了什么。
+import { describe, expect, it } from "vitest";
+import { createApp, defineComponent, h, ref } from "vue";
+import { useCommandSuggestions } from "./useCommandSuggestions";
+
+interface Harness {
+  pending: { value: string };
+  written: string[];
+  completionOpen: { value: boolean };
+  completionItems: { value: Array<{ id: string; label: string; kind: string; edit: unknown }> };
+  completionLoading: { value: boolean };
+  activationIndex: { value: number };
+  openManually: () => void;
+  key: (key: string) => boolean;
+  setTrusted: (trusted: boolean) => void;
+  setLine: (line: string) => void;
+}
+
+function harness(): Harness {
+  const pending = { value: "" };
+  const written: string[] = [];
+  let trusted = true;
+  const commandRunning = ref(false);
+  const terminal = { focus: () => undefined, buffer: { active: { type: "normal" as const } } };
+  let api!: ReturnType<typeof useCommandSuggestions>;
+  const app = createApp(
+    defineComponent({
+      setup() {
+        api = useCommandSuggestions({
+    terminal: () => terminal as never,
+    getTerminalHost: () => null,
+    sendTerminalBytes: (bytes: Uint8Array) => written.push(new TextDecoder().decode(bytes)),
+    getPendingTerminalInput: () => pending.value,
+    isInputLineTrusted: () => trusted,
+    setPendingTerminalInput: (value: string) => {
+      pending.value = value;
+    },
+    commandRunning,
+    isTerminalTransferBusy: () => false,
+    commandHistory: ref([]),
+    quickCommands: ref([]),
+    suggestionsEnabledState: ref(true),
+    suggestionMinCharsState: ref(1),
+    suggestionMaxCharsState: ref(200),
+    terminalCwd: ref(""),
+    session: ref(undefined),
+    getSessionId: () => "session-a",
+    getLocalSessionId: () => undefined,
+    persistCommandHistory: () => undefined,
+    isHistoryPanelOpen: () => false,
+    syncHistoryPanelAnchor: () => undefined,
+    updateHistoryPanelFilter: () => undefined,
+    pushTerminalCommandHistory: () => undefined,
+    inlineGhostActive: () => false,
+    isInteractivePromptPending: () => false,
+        });
+        return () => h("div");
+      },
+    }),
+  );
+  app.mount(document.createElement("div"));
+  return {
+    pending,
+    written,
+    completionOpen: api.completionOpen as unknown as Harness["completionOpen"],
+    completionItems: api.completionItems as unknown as Harness["completionItems"],
+    completionLoading: api.completionLoading as unknown as Harness["completionLoading"],
+    activationIndex: api.completionActiveIndex as unknown as Harness["activationIndex"],
+    openManually: api.openCompletionsManually,
+    key: (key: string) => api.handleCompletionKey({ type: "keydown", key } as KeyboardEvent),
+    setTrusted: (next: boolean) => {
+      trusted = next;
+    },
+    setLine: (line: string) => {
+      pending.value = line;
+    },
+  };
+}
+
+describe("completion menu key ownership（字节级）", () => {
+  // A01：cd 的本地候选面为空（fig 语料的 `-`/`~` 是 hidden 建议、目录生成器
+  // 是 custom 回调），Tab 必须原样交给 shell——此前会写入 `\u0015cd -`。
+  it("cd + Tab：无本地候选时不写任何字节，Tab 透传", () => {
+    const h = harness();
+    h.setLine("cd ");
+    h.openManually();
+
+    expect(h.completionOpen.value).toBe(false);
+    const consumed = h.key("Tab");
+
+    expect(consumed).toBe(false);
+    expect(h.written).toEqual([]);
+    expect(h.pending.value).toBe("cd ");
+  });
+
+  it("cd pro + Tab：路径前缀同样原样透传", () => {
+    const h = harness();
+    h.setLine("cd pro");
+    h.openManually();
+
+    expect(h.key("Tab")).toBe(false);
+    expect(h.written).toEqual([]);
+    expect(h.pending.value).toBe("cd pro");
+  });
+
+  // A02：相对/绝对/带空格与中文的路径都必须逐字透传，不能被本地候选改写。
+  it.each(["cd ./", "cd ../src", "cd /usr/local", "cd 我的 目录", "cd 'a b'"])("%s + Tab：原样透传", (line) => {
+    const h = harness();
+    h.setLine(line);
+    h.openManually();
+
+    expect(h.key("Tab")).toBe(false);
+    expect(h.written).toEqual([]);
+    expect(h.pending.value).toBe(line);
+  });
+
+  // A04：多候选、用户还没选 → 只推进公共前缀；到公共边界后既不填第一项，
+  // 也不改行，把选择权留给方向键/点击。
+  it("多候选未选择 + Tab：只推进公共前缀，到边界后不再改动输入", () => {
+    const h = harness();
+    h.setLine("git ch");
+    h.openManually();
+    expect(h.completionOpen.value).toBe(true);
+    expect(h.completionItems.value.length).toBeGreaterThan(1);
+    const labels = h.completionItems.value.map((item) => item.label);
+    expect(labels).toContain("checkout");
+    expect(labels.every((label) => label.startsWith("ch"))).toBe(true);
+
+    // 公共前缀 "che" 比当前 token "ch" 更长 → 只填前缀，菜单保持。
+    expect(h.key("Tab")).toBe(true);
+    expect(h.written).toEqual(["\u0015git che"]);
+    expect(h.pending.value).toBe("git che");
+    expect(h.completionOpen.value).toBe(true);
+
+    // 已在公共前缀边界：再按 Tab 不得填空、不得填第一项、不得关闭菜单。
+    expect(h.key("Tab")).toBe(true);
+    expect(h.written).toEqual(["\u0015git che"]);
+    expect(h.pending.value).toBe("git che");
+    expect(h.completionOpen.value).toBe(true);
+  });
+
+  // A05：方向键是「明确选择」，之后 Tab 接受所选项（而不是公共前缀）。
+  it("方向键选中后 Tab：接受所选项并写入整行", () => {
+    const h = harness();
+    h.setLine("git ch");
+    h.openManually();
+    const items = h.completionItems.value;
+
+    h.key("ArrowDown");
+    const selected = items[h.activationIndex.value];
+    expect(h.activationIndex.value).toBe(1);
+    expect(selected.label).not.toBe(items[0].label);
+
+    expect(h.key("Tab")).toBe(true);
+
+    expect(h.pending.value).toBe(`git ${selected.label} `);
+    expect(h.written).toEqual([`\u0015git ${selected.label} `]);
+    // 接受候选不得附带回车。
+    expect(h.written.join("")).not.toContain("\r");
+  });
+
+  it("唯一候选 + Tab：直接填充（单候选才算唯一）", () => {
+    const h = harness();
+    h.setLine("git ch");
+    h.openManually();
+    expect(h.completionOpen.value).toBe(true);
+    const only = h.completionItems.value[0];
+    h.completionItems.value = [only];
+
+    expect(h.key("Tab")).toBe(true);
+
+    expect(h.pending.value).toBe(`git ${only.label} `);
+    expect(h.written).toEqual([`\u0015git ${only.label} `]);
+  });
+
+  // A17：模型不可信（原生 Tab/中间编辑后）时不拿旧前缀改写输入行。
+  it("输入模型不可信 + Tab：不替换本地候选，Tab 交还 shell", () => {
+    const h = harness();
+    h.setLine("git ch");
+    h.openManually();
+    expect(h.completionOpen.value).toBe(true);
+    h.setTrusted(false);
+
+    expect(h.key("Tab")).toBe(false);
+
+    expect(h.written).toEqual([]);
+    expect(h.pending.value).toBe("git ch");
+    expect(h.completionOpen.value).toBe(false);
+  });
+
+  it("行已变化（菜单过期）+ Tab：不回填旧行", () => {
+    const h = harness();
+    h.setLine("git ch");
+    h.openManually();
+    expect(h.completionOpen.value).toBe(true);
+    h.setLine("git ch --");
+
+    expect(h.key("Tab")).toBe(false);
+
+    expect(h.written).toEqual([]);
+    expect(h.pending.value).toBe("git ch --");
+  });
+
+  it("Escape 关闭菜单不改行；Enter 透传（执行当前行）", () => {
+    const h = harness();
+    h.setLine("git ch");
+    h.openManually();
+
+    expect(h.key("Escape")).toBe(true);
+    expect(h.completionOpen.value).toBe(false);
+    expect(h.written).toEqual([]);
+
+    h.openManually();
+    expect(h.key("Enter")).toBe(false);
+    expect(h.written).toEqual([]);
+    expect(h.pending.value).toBe("git ch");
+  });
+});
diff --git a/frontend/src/composables/useCommandSuggestions.ts b/frontend/src/composables/useCommandSuggestions.ts
index 9992614b..52bd8864 100644
--- a/frontend/src/composables/useCommandSuggestions.ts
+++ b/frontend/src/composables/useCommandSuggestions.ts
@@ -132,12 +132,22 @@ const completionLoading = ref(false);
 // （与基线一致）；guard 抑制（alternate screen/跟随程序锁存/历史建议总开关
 // 关）同样关门。controller 在 lineChanged 调度时与 dispatch 前各查一次。
 let completionInputAllowed = false;
+// 显式选择锁（§4.1）：↑↓ 或指针激活后锁定候选 id。默认高亮第 0 项只是
+// 视觉焦点，不代表用户「选好了」——多候选时 Tab 不再默默接受第一项。
+let completionSelectionId: string | null = null;
+// 菜单归属快照：接受前核对行/会话仍与菜单一致。异步响应等待期间上一行的
+// 菜单即使还显示，也不该取得当前按键的回填权。
+let completionLineSnapshot = "";
+let completionSessionSnapshot = "";
+let completionRequestId = -1;
 
 function closeCompletionMenu() {
   completionOpen.value = false;
   completionItems.value = [];
   completionActiveIndex.value = 0;
   completionLoading.value = false;
+  completionSelectionId = null;
+  completionRequestId = -1;
 }
 
 /** 响应落地：ready（rankItems 排序截断后非空）开浮层；loading（generator
@@ -164,9 +174,19 @@ function openCompletionMenu(response: CompletionResponse) {
     closeCompletionMenu();
     return;
   }
+  // 新请求（新 requestId）= 用户又键入了内容 → 丢弃旧的选择锁；同一请求的
+  // 静态/动态合并则按候选 id 保留用户选择，候选消失才取消。
+  if (response.requestId !== completionRequestId) {
+    completionSelectionId = null;
+    completionRequestId = response.requestId;
+  }
+  const selectedIndex = completionSelectionId === null ? -1 : items.findIndex((item) => item.id === completionSelectionId);
+  if (completionSelectionId !== null && selectedIndex < 0) completionSelectionId = null;
   completionItems.value = items;
-  completionActiveIndex.value = 0;
+  completionActiveIndex.value = selectedIndex >= 0 ? selectedIndex : 0;
   completionAnchor.value = readTerminalSuggestionAnchor();
+  completionLineSnapshot = getPendingTerminalInput();
+  completionSessionSnapshot = getSessionId();
   completionOpen.value = true;
   // 双浮层仲裁（#138 丝滑度 review P0-A）：worker 模式下补全响应异步到达，
   // 键入时刻的互斥检查（refreshSuggestionsAfterInput 里 completionOpen 为
@@ -175,6 +195,23 @@ function openCompletionMenu(response: CompletionResponse) {
   closeSuggestionsOnly();
 }
 
+/** 指针/键盘激活为「明确选择」（§4.1）：菜单 click/hover 统一走这里，
+ *  避免只写 activeIndex 而漏掉选择锁。 */
+function activateCompletion(index: number) {
+  const item = completionItems.value[index];
+  completionSelectionId = item ? item.id : null;
+  completionActiveIndex.value = index;
+}
+
+/** 接受前的归属与信任门：菜单对应的行/会话、输入模型可信度、命令运行与
+ *  传输占用都在此核对。任一不满足 → 不做本地替换，把 Tab 交还 shell。 */
+function completionAcceptAllowed(): boolean {
+  if (options.isInputLineTrusted?.() === false) return false;
+  if (commandRunning.value || isTerminalTransferBusy()) return false;
+  if (completionSessionSnapshot !== getSessionId()) return false;
+  return completionLineSnapshot === getPendingTerminalInput();
+}
+
 /**
  * 结构化补全浮层的按键消费（方案 §21，规则表固化在 keyboard.ts）：
  * ↑↓ 选择、Tab 填充静态候选、Esc 关闭；**Enter 恒定放行 shell 执行当前行**
@@ -197,26 +234,43 @@ function handleCompletionKey(event: KeyboardEvent): boolean {
     case "accept": {
       const item = items[completionActiveIndex.value];
       if (!item) return true;
-      // 批 4b（Warp prefix.rs / shell 语义）：多候选共享同一替换区间时，Tab
-      // 先补最长公共前缀并保持菜单打开（refreshCompletionMenu 按新行重算）；
-      // 无推进（已到公共边界）或区间不一致才接受高亮项。
+      // §4.1 接受门：菜单必须仍属于当前行/会话，输入模型可信，且没有命令
+      // 或传输占用。不满足时不做本地替换——Tab 原样交给 shell。
+      if (!completionAcceptAllowed()) {
+        closeCompletionMenu();
+        return false;
+      }
+      // 1) 用户已明确选择（↑↓ 或指针激活）→ 接受该项，不走公共前缀分支。
+      const selected = completionSelectionId === null ? undefined : items.find((entry) => entry.id === completionSelectionId);
+      if (selected) {
+        acceptCompletionRow(selected);
+        return true;
+      }
+      // 2) 唯一候选 → 直接填充。
+      if (items.length === 1) {
+        acceptCompletionRow(item);
+        return true;
+      }
+      // 3) 批 4b（Warp prefix.rs / shell 语义）：多候选共享同一替换区间时，
+      // 只补最长公共前缀并保持菜单打开（refreshCompletionMenu 按新行重算）。
       const prefixEdit = longestCommonPrefixEdit(items, getPendingTerminalInput());
       if (prefixEdit) {
         completionController.accept({ ...item, edit: prefixEdit });
         refreshCompletionMenu();
         return true;
       }
-      acceptCompletionRow(item);
+      // 4) 多候选、无明确选择、公共前缀也无推进：消费本次 Tab，但不改输入、
+      // 不替用户填第一项——等方向键或点击。
       return true;
     }
     case "close":
       closeCompletionMenu();
       return true;
     case "next":
-      completionActiveIndex.value = (completionActiveIndex.value + 1) % items.length;
+      activateCompletion((completionActiveIndex.value + 1) % items.length);
       return true;
     case "prev":
-      completionActiveIndex.value = (completionActiveIndex.value - 1 + items.length) % items.length;
+      activateCompletion((completionActiveIndex.value - 1 + items.length) % items.length);
       return true;
     case "passthrough":
       // Enter 恒执行当前行、Tab 交还 shell（静态候选外的透传面）：同基线，
@@ -693,6 +747,7 @@ function resetSuggestionsForSession() {
     completionOpen,
     completionItems,
     completionActiveIndex,
+    activateCompletion,
     completionAnchor,
     completionLoading,
     closeSuggestions,
diff --git a/frontend/src/lib/completion/CompletionController.spec.ts b/frontend/src/lib/completion/CompletionController.spec.ts
index cc95fa20..9e438f09 100644
--- a/frontend/src/lib/completion/CompletionController.spec.ts
+++ b/frontend/src/lib/completion/CompletionController.spec.ts
@@ -553,6 +553,137 @@ describe("CompletionController · generator 防陈旧（批次 2-1，§30）", (
   });
 });
 
+// 缺陷回归（P3）：thenable source 的分支此前直接 deliver 响应就 return，
+// 静态结果能到 UI，但声明式 generator 槽位从未被调度——Worker 形态下动态
+// 补全整条通道静默失效。
+describe("CompletionController · 异步 source（thenable）与动态槽位组合", () => {
+  interface AsyncHarness {
+    controller: CompletionController;
+    responses: CompletionResponse[];
+    runResults: Array<{ slot: FigGeneratorSlot; resolve: (items: CompletionItem[] | null) => void; reject: (cause?: unknown) => void }>;
+    pending: Array<{ request: FigSourceRequest; resolve: (response: CompletionResponse | null) => void; reject: (cause?: unknown) => void }>;
+    setEnabled: (enabled: boolean) => void;
+  }
+
+  function asyncHarness(config: { slots?: FigGeneratorSlot[] } = {}): AsyncHarness {
+    const line = "git checkout ma";
+    let enabled = true;
+    const responses: CompletionResponse[] = [];
+    const runResults: AsyncHarness["runResults"] = [];
+    const pending: AsyncHarness["pending"] = [];
+    const controller = new CompletionController({
+      source: {
+        id: "async-fixture",
+        resolve: (request) =>
+          new Promise<CompletionResponse | null>((resolve, reject) => pending.push({ request, resolve, reject })) as unknown as CompletionResponse,
+      },
+      sessionId: () => "session-a",
+      readLine: () => line,
+      enabled: () => enabled,
+      generators: {
+        slots: () => config.slots ?? [generatorSlot()],
+        run: (slot) => new Promise<CompletionItem[] | null>((resolve, reject) => runResults.push({ slot, resolve, reject })),
+      },
+      onResponse: (response) => responses.push(response),
+      onAcceptEdit: () => undefined,
+    });
+    return { controller, responses, runResults, pending, setEnabled: (next) => (enabled = next) };
+  }
+
+  it("异步 ready：静态候选与动态槽位都交付（旧实现不调度槽位）", async () => {
+    const h = asyncHarness();
+    h.controller.request("typing");
+    expect(h.responses).toEqual([]); // thenable 未 resolve，同步面无交付
+    const call = h.pending[0];
+    call.resolve(readyResponse(call.request, [item("checkout")]));
+    await vi.advanceTimersByTimeAsync(0);
+
+    expect(h.responses.map((response) => response.state)).toEqual(["ready"]);
+    expect(h.responses[0].items.map((entry) => entry.label)).toEqual(["checkout"]);
+    expect(h.runResults).toHaveLength(1); // 动态通道被调度
+
+    h.runResults[0].resolve([genItem("main")]);
+    await vi.advanceTimersByTimeAsync(0);
+    expect(h.responses).toHaveLength(2);
+    expect(h.responses[1].items.map((entry) => entry.label)).toEqual(["checkout", "main"]);
+  });
+
+  it("异步 null：仍尝试动态槽位（loading 占位 → 合并 ready）", async () => {
+    const h = asyncHarness();
+    h.controller.request("typing");
+    h.pending[0].resolve(null);
+    await vi.advanceTimersByTimeAsync(0);
+
+    expect(h.responses.map((response) => response.state)).toEqual(["loading"]);
+    expect(h.runResults).toHaveLength(1);
+
+    h.runResults[0].resolve([genItem("main")]);
+    await vi.advanceTimersByTimeAsync(0);
+    expect(h.responses[1].state).toBe("ready");
+    expect(h.responses[1].items.map((entry) => entry.label)).toEqual(["main"]);
+  });
+
+  it("异步 reject：降级 pass-through，且不启动任何动态查询", async () => {
+    const h = asyncHarness();
+    h.controller.request("typing");
+    h.pending[0].reject(new Error("worker boom"));
+    await vi.advanceTimersByTimeAsync(0);
+
+    expect(h.responses.map((response) => response.state)).toEqual(["pass-through"]);
+    expect(h.runResults).toHaveLength(0);
+  });
+
+  it("resolve 时已过期（新输入）：既不交付也不启动动态查询", async () => {
+    const h = asyncHarness();
+    h.controller.request("typing");
+    h.controller.lineChanged(); // revision 前进
+    h.pending[0].resolve(readyResponse(h.pending[0].request, [item("checkout")]));
+    await vi.advanceTimersByTimeAsync(0);
+
+    expect(h.responses).toEqual([]);
+    expect(h.runResults).toHaveLength(0);
+  });
+
+  it("resolve 时引擎已关或菜单已关：不交付、不拉起动态查询", async () => {
+    const disabled = asyncHarness();
+    disabled.controller.request("typing");
+    disabled.setEnabled(false);
+    disabled.pending[0].resolve(readyResponse(disabled.pending[0].request, [item("checkout")]));
+    await vi.advanceTimersByTimeAsync(0);
+    expect(disabled.responses).toEqual([]);
+    expect(disabled.runResults).toHaveLength(0);
+
+    const dismissed = asyncHarness();
+    dismissed.controller.request("typing");
+    dismissed.controller.dismiss();
+    dismissed.pending[0].resolve(readyResponse(dismissed.pending[0].request, [item("checkout")]));
+    await vi.advanceTimersByTimeAsync(0);
+    expect(dismissed.responses).toEqual([]);
+    expect(dismissed.runResults).toHaveLength(0);
+  });
+
+  it("每个有效请求的槽位最多启动一次，新旧请求不串结果", async () => {
+    const h = asyncHarness();
+    h.controller.request("typing");
+    h.pending[0].resolve(null);
+    await vi.advanceTimersByTimeAsync(0);
+    expect(h.runResults).toHaveLength(1);
+
+    h.controller.request("manual");
+    h.pending[1].resolve(null);
+    await vi.advanceTimersByTimeAsync(0);
+    expect(h.runResults).toHaveLength(2);
+
+    // 旧请求的槽位结果仍然被丢弃（phase 已换）。
+    h.runResults[0].resolve([genItem("main")]);
+    await vi.advanceTimersByTimeAsync(0);
+    expect(h.responses.filter((response) => response.state === "ready")).toHaveLength(0);
+    h.runResults[1].resolve([genItem("main")]);
+    await vi.advanceTimersByTimeAsync(0);
+    expect(h.responses.at(-1)?.state).toBe("ready");
+  });
+});
+
 describe("FakeFigCompletionSource · 小语料行为（手动清单锚点）", () => {
   const source = new FakeFigCompletionSource();
   const requestOf = (line: string): FigSourceRequest => ({ line, requestId: 1, revision: 0, sessionId: "s", trigger: "typing" });
diff --git a/frontend/src/lib/completion/CompletionController.ts b/frontend/src/lib/completion/CompletionController.ts
index 54a9e7ad..05c8827b 100644
--- a/frontend/src/lib/completion/CompletionController.ts
+++ b/frontend/src/lib/completion/CompletionController.ts
@@ -159,16 +159,38 @@ export class CompletionController {
       outcome = null;
     }
     if (outcome !== null && typeof (outcome as { then?: unknown }).then === "function") {
-      // 防御分支：冻结接口为同步，此处仅为测试桩 / Worker 化留位。
-      // Worker 形态的 generator 第二段并发驱动不在本批次范围。
+      // Worker 化 / 测试桩的 thenable 形态：resolve 后走与同步路径完全相同的
+      // 后续流程（静态交付 + 声明式 generator 第二段）。此前这里直接交付
+      // 响应就返回，异步 source 的动态候选通道从未被调度。
       void Promise.resolve(outcome).then(
-        (response) => this.deliver(requestId, revision, sessionId, response ?? this.passThrough(requestId, revision)),
+        (response) => this.deliverOutcome(requestId, revision, sessionId, request, response ?? null),
+        // source 抛错/reject：安全降级为 pass-through，且不产生任何动态执行
+        // 副作用（不为错误请求启动远端查询）。
         () => this.deliver(requestId, revision, sessionId, this.passThrough(requestId, revision)),
       );
       return;
     }
+    this.deliverOutcome(requestId, revision, sessionId, request, outcome);
+  }
+
+  /**
+   * 一次解析结果落地：静态候选交付 + 声明式 generator 第二段调度。同步与
+   * 异步 source 共用本方法，保证两边的时序/guard/两段渲染语义一致。
+   *
+   * 过期请求在这里就被丢掉：既不进 UI（三重 guard），也不采集槽位、不启动
+   * 新的远端查询；引擎在等待期间被关闭同样不再拉起菜单。
+   */
+  private deliverOutcome(
+    requestId: number,
+    revision: number,
+    sessionId: string,
+    request: FigSourceRequest,
+    outcome: CompletionResponse | null,
+  ): void {
+    if (requestId !== this.requestId || revision !== this.revision || sessionId !== this.options.sessionId()) return;
+    if (!this.options.enabled()) return;
 
-    // —— 第一段（§31）：静态候选同步立即交付 ——
+    // —— 第一段（§31）：静态候选立即交付 ——
     const staticReady =
       outcome !== null && outcome.state === "ready" && outcome.items.length > 0 ? outcome : null;
 
diff --git a/frontend/src/lib/completion/fig/figCompletionSource.spec.ts b/frontend/src/lib/completion/fig/figCompletionSource.spec.ts
index 0a864336..e1ed65b4 100644
--- a/frontend/src/lib/completion/fig/figCompletionSource.spec.ts
+++ b/frontend/src/lib/completion/fig/figCompletionSource.spec.ts
@@ -197,6 +197,24 @@ const fixtureBroken = {
   parserDirectives: {},
   args: [],
 };
+const fixtureHiddenArg = {
+  // Fig 语料的 hidden 建议（cd 的 `-`/`~` 同形态）：不进菜单、不被 Tab 接受。
+  name: ["myhidden"],
+  subcommands: [],
+  options: [],
+  persistentOptions: [],
+  parserDirectives: {},
+  args: [
+    {
+      name: "target",
+      isOptional: true,
+      suggestions: [
+        { name: "hidden-one", description: "not offered", hidden: true },
+        { name: "visible-one", description: "offered" },
+      ],
+    },
+  ],
+};
 const fixtureManifest = {
   mygit: fixtureMyGit,
   mycat: fixtureVariadic,
@@ -209,6 +227,7 @@ const fixtureManifest = {
   "myaws/ec2": specEc2,
   mysudo: fixtureSudo,
   mybroken: fixtureBroken,
+  myhidden: fixtureHiddenArg,
 } as unknown as FigSpecManifest;
 
 const makeSource = () => new FigCompletionSourceImpl({ manifest: fixtureManifest });
@@ -428,3 +447,29 @@ describe("FigCompletionSource · 声明式 generator 槽位（批次 2-1 collect
     expect(source.collectGenerators(baseRequest('mygit commit -m "未闭合'))).toEqual([]);
   });
 });
+
+// 缺陷回归（P1）：`cd ` 的候选曾被 fig 语料里的两个 hidden 特殊参数（`-`/`~`）
+// 占满，Tab 于是把 `\u0015cd -` 写进输入行，原生路径补全永远到不了 shell。
+describe("FigCompletionSource · hidden 参数建议（P1）", () => {
+  const source = makeSource();
+
+  it("hidden 建议不进候选，可见建议照常", () => {
+    expect(itemLabels(source.resolve(baseRequest("myhidden ")))).toEqual(["visible-one"]);
+    expect(itemLabels(source.resolve(baseRequest("myhidden vis")))).toEqual(["visible-one"]);
+  });
+
+  it("只命中 hidden 建议的前缀 → pass-through（Tab 交还 shell）", () => {
+    expect(source.resolve(baseRequest("myhidden hidden"))).toBeNull();
+  });
+
+  it("真实 cd 语料：空参数不再出现 `-`/`~`，本地无候选即 pass-through", () => {
+    const real = createFigCompletionSource();
+    // 隐藏特殊参数即使可以枚举也不得展示（`cd ` 曾因此变成 `cd -`）。
+    expect(itemLabels(real.resolve(baseRequest("cd ")))).toEqual([]);
+    expect(real.resolve(baseRequest("cd "))).toBeNull();
+    expect(itemLabels(real.resolve(baseRequest("cd -")))).toEqual([]);
+    // 目录生成器是 Fig custom 回调形态：不产声明式槽位，不擅自执行。
+    expect(real.collectGenerators(baseRequest("cd "))).toEqual([]);
+    expect(real.collectGenerators(baseRequest("cd pro"))).toEqual([]);
+  });
+});
diff --git a/frontend/src/lib/completion/fig/figCompletionSource.ts b/frontend/src/lib/completion/fig/figCompletionSource.ts
index 0d076cfd..897b134d 100644
--- a/frontend/src/lib/completion/fig/figCompletionSource.ts
+++ b/frontend/src/lib/completion/fig/figCompletionSource.ts
@@ -592,6 +592,12 @@ export class FigCompletionSourceImpl implements FigCompletionSource {
     if ((flags & SuggestionFlag.Args) !== 0) {
       const arg = result.currentArg;
       for (const suggestion of arg?.suggestions ?? []) {
+        // Fig 的 hidden 标记 = 不进菜单、也不参与 Tab 接受的特殊参数
+        // （cd 语料里的 `-`/`~` 就是这种）。展示它们会让 `cd ` 的菜单只剩
+        // 两个特殊值，Tab 直接把 `cd -` 写进输入行。用户手打 `cd -`/`cd ~`
+        // 后仍按原有 shell 语义执行，这里只影响本地候选面。
+        // parser 的 suggestion 类型未声明该字段（spec 数据面），按 Fig 语义读。
+        if ((suggestion as { hidden?: boolean } | undefined)?.hidden === true) continue;
         const label = suggestion?.name;
         if (typeof label !== "string" || !label.startsWith(searchTerm)) continue;
         items.push(
diff --git a/frontend/src/lib/completion/fig/generatorScheduler.spec.ts b/frontend/src/lib/completion/fig/generatorScheduler.spec.ts
index ca207763..f9d6b25a 100644
--- a/frontend/src/lib/completion/fig/generatorScheduler.spec.ts
+++ b/frontend/src/lib/completion/fig/generatorScheduler.spec.ts
@@ -8,6 +8,7 @@
 import { describe, expect, it, vi } from "vitest";
 import type { CompletionExecuteRequest, CompletionExecuteResult } from "../host/protocol";
 import { createCompletionHostClient, type CompletionHostInvoke } from "../host/hostClient";
+import { applyEditToText } from "../core/edit";
 import { GENERATOR_ITEM_SOURCE } from "./generatorRunner";
 import { GeneratorScheduler, type FigGeneratorSlot } from "./generatorScheduler";
 
@@ -220,6 +221,43 @@ describe("GeneratorScheduler · TTL 缓存（§29）", () => {
     await h.scheduler.run(baseSlot({ prefix: "ma", tokenStart: 12 }));
     expect(h.invoke).toHaveBeenCalledTimes(2);
   });
+
+  // 缺陷回归（P2）：`git checkout m` → `ma`，TTL 内命中同一次执行；缓存里的
+  // edit 范围停在首次调用的 tokenEnd，直接把旧对象交给新行就会插到旧行尾，
+  // 接受 `main` 得到 `git checkout maina`。
+  it("缓存命中按本次 tokenEnd 重建 edit：m → ma 接受 main 得到正确整行", async () => {
+    const h = harness();
+    const line = "git checkout ma";
+    const tokenStart = "git checkout ".length;
+
+    const stale = await h.scheduler.run(baseSlot({ prefix: "m", tokenStart, tokenEnd: tokenStart + 1 }));
+    const fresh = await h.scheduler.run(baseSlot({ prefix: "ma", tokenStart, tokenEnd: line.length }));
+    expect(h.invoke).toHaveBeenCalledTimes(1); // 同一次查询被复用，不重打
+
+    const staleItem = stale?.find((item) => item.label === "main");
+    const freshItem = fresh?.find((item) => item.label === "main");
+    expect(staleItem?.edit.replaceEnd).toBe(tokenStart + 1);
+    expect(freshItem?.edit.replaceEnd).toBe(line.length);
+    expect(applyEditToText(line, freshItem!.edit).text).toBe("git checkout main");
+    // 旧调用拿到的候选不被后续调用改写（各调用独立对象）。
+    expect(staleItem?.edit.replaceEnd).toBe(tokenStart + 1);
+    expect(freshItem).not.toBe(staleItem);
+    expect(freshItem?.edit).not.toBe(staleItem?.edit);
+  });
+
+  it("在途共享的同一次执行：两个并发调用各拿独立 edit，互不污染", async () => {
+    const h = harness();
+    const line = "git checkout ma";
+    const tokenStart = "git checkout ".length;
+    const [shortPrefix, longPrefix] = await Promise.all([
+      h.scheduler.run(baseSlot({ prefix: "m", tokenStart, tokenEnd: tokenStart + 1 })),
+      h.scheduler.run(baseSlot({ prefix: "ma", tokenStart, tokenEnd: line.length })),
+    ]);
+    expect(h.invoke).toHaveBeenCalledTimes(1);
+    expect(shortPrefix?.[0]?.edit.replaceEnd).toBe(tokenStart + 1);
+    expect(longPrefix?.[0]?.edit.replaceEnd).toBe(line.length);
+    expect(longPrefix?.[0]).not.toBe(shortPrefix?.[0]);
+  });
 });
 
 describe("GeneratorScheduler · slots（收集面）", () => {
diff --git a/frontend/src/lib/completion/fig/generatorScheduler.ts b/frontend/src/lib/completion/fig/generatorScheduler.ts
index 42435d5c..d6295852 100644
--- a/frontend/src/lib/completion/fig/generatorScheduler.ts
+++ b/frontend/src/lib/completion/fig/generatorScheduler.ts
@@ -110,7 +110,12 @@ export class GeneratorScheduler {
         this.cache.set(key, promise);
         this.prune(timestamp);
       }
-      return promise.promise.then((items) => this.filterByPrefix(items, slot.prefix));
+      // 缓存条目是「一次执行的全量产出」，其中的 edit 范围来自首次调用的
+      // tokenEnd；前缀继续增长时（`ma`→`mav`）同一个 key 命中旧条目，直接
+      // 交出会把候选插到旧行尾（`git checkout maina`）。这里按本次 slot 的
+      // 前缀过滤并重建候选/edit 副本——文本与元数据复用，替换范围取当前
+      // tokenStart/tokenEnd，缓存对象本身绝不改写。
+      return promise.promise.then((items) => this.forSlot(items, slot));
     } catch {
       return Promise.resolve(null);
     }
@@ -167,6 +172,18 @@ export class GeneratorScheduler {
     return items.filter((item) => item.label.startsWith(prefix));
   }
 
+  /** 为「本次调用」生成候选与 edit 副本：前缀过滤 + 替换范围取当前 slot
+   * 的 tokenStart/tokenEnd。缓存（含在途共享的同一次执行）保存的是原始
+   * 产出，绝不被调用方改写，先后到达的调用互不污染。 */
+  private forSlot(items: CompletionItem[] | null, slot: FigGeneratorSlot): CompletionItem[] | null {
+    const filtered = this.filterByPrefix(items, slot.prefix);
+    if (!filtered) return null;
+    return filtered.map((item) => ({
+      ...item,
+      edit: { ...item.edit, replaceStart: slot.tokenStart, replaceEnd: slot.tokenEnd },
+    }));
+  }
+
   /** spec 原生 postProcess → runDeclarativeGenerator 的适配器。无 postProcess
    * 时按 Fig 缺省语义：非空切分片段即候选名。抛错由 runner 兜住 → null。 */
   private adaptPostProcess(slot: FigGeneratorSlot): GeneratorPostProcess {
diff --git a/frontend/src/lib/terminalLineModel.spec.ts b/frontend/src/lib/terminalLineModel.spec.ts
index 9b8c81f9..5be9d7a0 100644
--- a/frontend/src/lib/terminalLineModel.spec.ts
+++ b/frontend/src/lib/terminalLineModel.spec.ts
@@ -7,21 +7,29 @@ describe("applyLineEditControlChar (readline 编辑键, #138 丝滑度 review P0
     expect(applyLineEditControlChar("", "\u0015")).toBe("");
   });
 
-  it("Ctrl+W kills the trailing word plus preceding whitespace", () => {
-    expect(applyLineEditControlChar("git status", "\u0017")).toBe("git");
-    expect(applyLineEditControlChar("cd /opt/", "\u0017")).toBe("cd");
+  it("Ctrl+W kills the trailing word but keeps the separator before it", () => {
+    // 实测 bash readline（`read -e` + Ctrl+W）：词前的分隔空白保留。
+    expect(applyLineEditControlChar("git status", "\u0017")).toBe("git ");
+    expect(applyLineEditControlChar("cd /opt/", "\u0017")).toBe("cd ");
   });
 
   it("Ctrl+W on a whitespace-only tail kills back to the previous word boundary", () => {
-    // bash unix-word-rubout：词后已敲的空白随词一并删除（"abc " → ""）。
+    // bash unix-word-rubout：先吃掉词后的空白，再吃掉词，词前空白保留
+    // （"abc  def  " → "abc  "）；只有空白、没有词时才整行清空。
     expect(applyLineEditControlChar("abc ", "\u0017")).toBe("");
-    expect(applyLineEditControlChar("abc  def  ", "\u0017")).toBe("abc");
+    expect(applyLineEditControlChar("abc  def  ", "\u0017")).toBe("abc  ");
+    expect(applyLineEditControlChar("   ", "\u0017")).toBe("");
   });
 
   it("Ctrl+W on an empty line keeps it empty", () => {
     expect(applyLineEditControlChar("", "\u0017")).toBe("");
   });
 
+  it("Ctrl+W treats quotes as ordinary characters, not word boundaries", () => {
+    // 词边界只看空白：'a b' → "'a "。
+    expect(applyLineEditControlChar("'a b'", "\u0017")).toBe("'a ");
+  });
+
   it("returns null for characters the model handles elsewhere", () => {
     // 可打印字符、退格/回车/Ctrl+C（trackPendingInput 主分支）与未知控制字节
     // 一律不认领，避免与既有处理重复叠加。
diff --git a/frontend/src/lib/terminalLineModel.ts b/frontend/src/lib/terminalLineModel.ts
index efc90cfd..5aaf2777 100644
--- a/frontend/src/lib/terminalLineModel.ts
+++ b/frontend/src/lib/terminalLineModel.ts
@@ -4,13 +4,19 @@
 // 就会与真实提示符行失步（Ctrl+U 后模型仍留着死字符，建议/补全/ghost 对着
 // 错误的行检索，#138 丝滑度 review P0-B）。纯函数，语义对齐 bash readline：
 // - Ctrl+U（0x15，unix-line-discard）：清空整行；
-// - Ctrl+W（0x17，unix-word-rubout）：删掉行尾的词与词前空白
-//   （"abc def" → "abc"，"abc " → ""——词与间隔空白一并删除）。
+// - Ctrl+W（0x17，unix-word-rubout）：删掉行尾空白与它前面的一个词，**保留**
+//   该词之前的分隔空白（实测 bash 3.2/5.x readline：
+//   "abc def" → "abc "，"abc  def  " → "abc  "，"abc " → ""，"   " → ""）。
 
 /** 已知行编辑控制字符 → 新行内容；其余返回 null（调用方按原逻辑处理）。 */
 export function applyLineEditControlChar(line: string, char: string): string | null {
   if (char === "\u0015") return "";
-  // 「词 + 前后空白」一次删净；全空白行（无词可删）整体清空。
-  if (char === "\u0017") return /\S/.test(line) ? line.replace(/\s*\S+\s*$/, "") : "";
+  if (char === "\u0017") {
+    // 先吃掉行尾空白，再吃掉最后一个词；词前的分隔空白保留（bash 的
+    // unix-word-rubout 只删「空白 + 词」，不删词前空白）。全空白行或无词
+    // 可删时整行清空。
+    const trimmed = line.replace(/\s+$/, "");
+    return trimmed.replace(/\S+$/, "");
+  }
   return null;
 }
diff --git a/frontend/src/lib/terminalWordEditing.spec.ts b/frontend/src/lib/terminalWordEditing.spec.ts
index 847752af..2e33a101 100644
--- a/frontend/src/lib/terminalWordEditing.spec.ts
+++ b/frontend/src/lib/terminalWordEditing.spec.ts
@@ -47,4 +47,29 @@ describe("Alt/Option word editing", () => {
     }
     expect(wordEditingLineUntrusted(false, "x")).toBe(false);
   });
+
+  it("marks shell-owned line rewrites as untrusted on their own", () => {
+    // Tab（shell 自己的补全）、Ctrl+W/A/E/R、方向键/Home/End/历史序列都会
+    // 让增量模型与真实行失步；此后普通键入不得把它重新变成可信。
+    for (const data of ["\t", "\x17", "\x01", "\x05", "\x12"]) {
+      expect(wordEditingLineUntrusted(false, data)).toBe(true);
+    }
+    for (const data of ["\x1b[A", "\x1b[B", "\x1b[C", "\x1b[D", "\x1b[H", "\x1b[F", "\x1bOH", "\x1b[3~"]) {
+      expect(wordEditingLineUntrusted(false, data)).toBe(true);
+    }
+    // 序列被拆包：末尾残留 ESC / CSI / SS3 起始符同样不可追踪。
+    for (const data of ["\x1b", "\x1b[", "\x1b[1", "\x1bO"]) {
+      expect(wordEditingLineUntrusted(false, data)).toBe(true);
+    }
+    // 多字节块内嵌控制序列同样命中。
+    expect(wordEditingLineUntrusted(false, "ab\x17")).toBe(true);
+  });
+
+  it("keeps ordinary typing trusted and resets only on a new line", () => {
+    expect(wordEditingLineUntrusted(false, "abc")).toBe(false);
+    expect(wordEditingLineUntrusted(false, "/opt/aa")).toBe(false);
+    // 键入不解除不可信：只有回车/Ctrl+C 开新行才恢复。
+    expect(wordEditingLineUntrusted(true, "abc")).toBe(true);
+    expect(wordEditingLineUntrusted(true, "\r")).toBe(false);
+  });
 });
diff --git a/frontend/src/lib/terminalWordEditing.ts b/frontend/src/lib/terminalWordEditing.ts
index bd3128d6..f94da1c9 100644
--- a/frontend/src/lib/terminalWordEditing.ts
+++ b/frontend/src/lib/terminalWordEditing.ts
@@ -16,10 +16,54 @@ export function terminalWordEditingInput(
   return Object.hasOwn(WORD_KEYS, event.key) ? WORD_KEYS[event.key] : undefined;
 }
 
+/**
+ * Input the append-only line model cannot follow, so auto suggestions must stop
+ * trusting it until a fresh line starts:
+ * - Tab: the shell's own completion rewrites the line, and the inserted text
+ *   never reaches the key model;
+ * - Ctrl+W (delete word) plus the cursor/history edits Ctrl+A/Ctrl+E/Ctrl+R;
+ * - CSI/SS3 cursor, Home/End and history-navigation sequences, which redraw
+ *   the line from shell state.
+ * Deliberately conservative: modelling every mid-line edit of every shell is
+ * out of scope, so anything ambiguous keeps the model untrusted.
+ */
+const UNTRACKABLE_SEQUENCES: readonly string[] = [
+  "\t",
+  "\x17",
+  "\x01",
+  "\x05",
+  "\x12",
+  "\x1b[A",
+  "\x1b[B",
+  "\x1b[C",
+  "\x1b[D",
+  "\x1b[H",
+  "\x1b[F",
+  "\x1bOA",
+  "\x1bOB",
+  "\x1bOC",
+  "\x1bOD",
+  "\x1bOH",
+  "\x1bOF",
+  "\x1b[1~",
+  "\x1b[3~",
+  "\x1b[4~",
+  "\x1b[7~",
+  "\x1b[8~",
+  ...Object.values(WORD_KEYS),
+];
+
+/** A chunk that ends on a partial escape sequence cannot be classified yet. */
+const PARTIAL_ESCAPE_TAIL = /(?:\x1b|\x1b\[|\x1b\[[\d;]*|\x1bO)$/;
+
+function untrackableInput(data: string): boolean {
+  return UNTRACKABLE_SEQUENCES.some((sequence) => data.includes(sequence)) || PARTIAL_ESCAPE_TAIL.test(data);
+}
+
 /** The append-only suggestion model cannot follow shell-owned word edits.
  * Keep it suppressed until a new line; do not guess a remote shell's cursor.
  */
 export function wordEditingLineUntrusted(previous: boolean, data: string): boolean {
   if (/[\r\n\x03]/.test(data)) return false;
-  return previous || Object.values(WORD_KEYS).includes(data);
+  return previous || untrackableInput(data);
 }
diff --git a/scripts/smoke_terminal_word_editing.py b/scripts/smoke_terminal_word_editing.py
index 0487f461..d8cf422c 100644
--- a/scripts/smoke_terminal_word_editing.py
+++ b/scripts/smoke_terminal_word_editing.py
@@ -33,6 +33,13 @@ def receive(fd, marker):
     ("backward delete", b"one two three\x1b\x7f\r", b"one two "),
     ("forward delete", b"one two three\x01\x1bd\r", b" two three"),
     ("middle edit", b"one two three\x1bb\x1b\x7fNEW \x05\r", b"one NEW three"),
+    # Ctrl+W（unix-word-rubout）与 terminalLineModel.applyLineEditControlChar
+    # 的语义对照：删「行尾空白 + 最后一个词」，保留词前的分隔空白。
+    ("ctrl-w word", b"abc def\x17\r", b"abc "),
+    ("ctrl-w multiple trailing spaces", b"abc  def  \x17\r", b"abc  "),
+    ("ctrl-w trailing blank only", b"abc \x17\r", b""),
+    ("ctrl-w blank line", b"   \x17\r", b""),
+    ("ctrl-w quoted word", b"'a b'\x17\r", b"'a "),
 ]
 for name, keys, expected in cases:
     master, slave = pty.openpty()