@nelsonlongxiang/dsh-open-a2a-net 0.6.24 → 0.6.26

package/lib/index.js

@@ -33,11 +33,14 @@ import { decodeSessionLog, extractTranscript, TRANSCRIPT_DEFAULT_LIMIT, TRANSCRI
 import { LayoutStore } from "./layout-store.js";
 import { fileURLToPath } from 'node:url';
 import { JoinedSessions } from "./joined-store.js";
+import { ExposureStore } from "./exposure-store.js";
+import { applyOwnerSettings } from "./owner-settings.js";
+import { CliDepositStore } from "./cli-deposit.js";
 import { TeamMembershipStore } from "./team-store.js";
 import { PeerStore } from "./peer-store.js";
 import { SelfReferralFilter } from "./self-suppress.js";
 import { resolveStageMount } from "./stage-mount.js";
-import { TaskLedger, TASK_STALE_TTL_MS, SUMMARY_CAP, briefOf } from "./task-ledger.js";
+import { TaskLedger, TASK_STALE_TTL_MS, SUMMARY_CAP, ARCHIVE_CAP, archivedEndedBy, briefOf } from "./task-ledger.js";
 import { formatReceipt, parseReceipt } from "./receipt.js";
 import { runReceiptLadder } from "./receipt-ladder.js";
 import { IdempotencyStore, WIRE_ERROR_IDEMPOTENCY_CONFLICT, WIRE_ERROR_REPLAY_REJECTED, peerPayloadFingerprint } from "./idempotency-store.js";
@@ -125,6 +128,15 @@ export const Config = s.object({
      * the legacy whole-store basis (fleet migration window).
      */
     referralTeamResolution: s.boolean().default(false),
+    /**
+     * #19 D2 (ruling final, owner-level knob): how much of a session team's
+     * activity EXCERPT the card face publishes in sessionTeams descriptions.
+     * 'full' (default) keeps the verbatim tail excerpt; 'masked' truncates
+     * to a shape-only prefix; 'off' omits the description field entirely.
+     * Titles and team handles stay in every tier — the knob is the excerpt,
+     * not the listing.
+     */
+    exposureExcerpt: s.union(['full', 'masked', 'off']).default('full'),
     /**
      * gh#9+gh#10 OriginClaim window: absent envelopes still walk N3 during
      * the window (counted as legacyInbound); closing it rejects them like
@@ -545,10 +557,27 @@ export function apply(ctx, config) {
     // host restarts silently dropped every join. The store remounts the node
     // whenever the Agent comes back, until the user leaves.
     const joinedSessions = new JoinedSessions(join(home, 'a2a', 'joined.json'));
+    // #19 D3/D4: per-session exposure tiers — 'linked' floor (the absence
+    // default, so existing members transfer automatically) with a voluntary
+    // 'fleet' opt-up. D4 (成文): group visibility = strictest member tier;
+    // v1 ships no group-level knob by design.
+    const exposureStore = new ExposureStore(join(home, 'a2a', 'exposure.json'));
+    // gh#34 owner three-key panel hot-apply state: allowlist and teamScopeInfo
+    // are read at call time, so the panel's write applies WITHOUT a restart;
+    // announce is boot-time publishing (restart pending flag for the UI).
+    let ownerAllowlist = [...(config.teamJoinAllowlist ?? [])];
+    // Truthiness matches the ORIGINAL read site (`if (config.teamScopeInfo)`):
+    // literal compositions without the schema default carry undefined, which
+    // reads as the OPEN plane — `!== false` would silently scope them.
+    let ownerTeamScopeInfo = config.teamScopeInfo === true;
+    let ownerAnnounceRestartPending = false;
     // S2: node-declared team memberships — the roster half of the
     // team-roster iteration. Joins ride the allowlist-gated tools; the store
     // is the durable declaration the card publishes and the state face reads.
     const teamMemberships = new TeamMembershipStore(join(home, 'a2a', 'teams.json'));
+    // gh#45 CLI 户口: deposited CLI identities (one key, multiple registrations,
+    // ≤4h online by owner ruling — expiry auto-deregisters).
+    const cliDeposits = new CliDepositStore(join(home, 'a2a', 'cli-deposits.json'));
     // S4 audit ring, hoisted beside the stores: the boot-settlement prune runs
     // before the tools section initializes, and it records archive-prune events.
     const teamAuditRing = [];
@@ -1033,6 +1062,19 @@ export function apply(ctx, config) {
         }
         return 'no activity yet';
     }
+    /**
+     * #19 D2: apply the owner-level excerpt knob to a session-team
+     * description at the card face. 'full' keeps the verbatim excerpt;
+     * 'masked' reduces to a shape-only prefix (16 chars — enough to
+     * recognize, not enough to read); 'off' omits the field entirely.
+     */
+    function exposureDescription(description) {
+        if (config.exposureExcerpt === 'off')
+            return undefined;
+        if (config.exposureExcerpt === 'masked')
+            return `${description.slice(0, 16)}${description.length > 16 ? '…' : ''}`;
+        return description;
+    }
     /**
      * Join one live top-level session: its team dispatches direct routes and
      * rides the announced card from this moment.
@@ -1388,6 +1430,9 @@ export function apply(ctx, config) {
                             joined: sessionNodes.has(String(agent.id)),
                             live: true,
                             teams: [...teamMemberships.teamsOf(String(agent.id))],
+                            // #19 D3: the session's exposure tier (linked floor /
+                            // fleet opt-up) — readable on the state face.
+                            exposure: exposureStore.tierOf(String(agent.id)),
                             ...(canvasStore.teamsOf(String(agent.id)).length > 0 ? { canvasTeams: [...canvasStore.teamsOf(String(agent.id))] } : {}),
                             ...(groupOf(String(agent.id)) !== undefined ? { group: groupOf(String(agent.id)) } : {}),
                         }));
@@ -1448,7 +1493,24 @@ export function apply(ctx, config) {
                                 })),
                             },
                             host: lanIp === '' ? {} : { lanIp },
-                            peers: peerStore.list().map(url => ({ url, score: peerStore.score(url) })),
+                            // gh#20 W-C (host rail): each peer row also carries its display
+                            // name and version from the warm card (absent until a fetch),
+                            // and the last-contact timestamp for the health lamp. W-A's
+                            // link/verified ride along for the badge.
+                            peers: peerStore.list().map(url => {
+                                const card = cardCache.get(url)?.card;
+                                const lastContact = peerStore.lastContact(url);
+                                const lastContactOk = peerStore.lastContactOk(url);
+                                return {
+                                    url,
+                                    score: peerStore.score(url),
+                                    ...(card?.name !== undefined && card.name !== '' ? { name: card.name } : {}),
+                                    ...(typeof card?.version === 'string' && card.version !== '' ? { version: card.version } : {}),
+                                    ...(lastContact !== undefined ? { lastContactAt: lastContact } : {}),
+                                    ...(lastContactOk !== undefined ? { lastContactOk } : {}),
+                                    ...peerLinkState(url),
+                                };
+                            }),
                             remote: (refreshRemoteRows(), (remoteRowsCache?.rows ?? []).map(row => {
                                 const canvasTeams = canvasStore.teamsOf(row.team);
                                 return canvasTeams.length > 0 ? { ...row, canvasTeams: [...canvasTeams] } : row;
@@ -1482,7 +1544,31 @@ export function apply(ctx, config) {
                             tasksStaleCount: taskLedger.list().filter(task => task.status === 'pending' && (task.receiptExpected === false || Date.now() - task.startedAt >= 60 * 60_000)).length,
                             tasksDead: taskLedger.list()
                                 .filter(task => task.status === 'dead')
-                                .map(task => ({ taskId: task.taskId, team: task.team, peer: task.peer, startedAt: task.startedAt, deadAt: task.deadAt ?? task.startedAt, reason: task.reason ?? 'unspecified', ...(task.brief !== undefined ? { brief: task.brief } : {}) })),
+                                .map(task => ({ taskId: task.taskId, team: task.team, peer: task.peer, startedAt: task.startedAt, deadAt: task.deadAt ?? task.startedAt, reason: task.reason ?? 'unspecified', ...(task.brief !== undefined ? { brief: task.brief } : {}), ...(task.direction !== undefined ? { direction: task.direction } : {}) })),
+                            // gh#31: per-task outcomes for rows that LEFT the ledger — the
+                            // chat drawer used to guess (settled, abandoned or cancelled).
+                            // Bounded to the archive (≤64), newest first, with the
+                            // controlled-vocabulary verdict each row settled by.
+                            // gh#31 follow-up: archive() is already newest first (settles
+                            // prepend), so the projection keeps that order — the earlier
+                            // .reverse() served it oldest first. Each row also says HOW it
+                            // ended (endedBy: abandon and cancel both record outcome
+                            // 'abandoned', and so does a peer's own 'abandoned' receipt),
+                            // whether a receipt came after the caller ended it (late), and
+                            // its direction when known.
+                            archived: taskLedger.archive().slice(0, ARCHIVE_CAP).map(row => ({
+                                taskId: row.taskId,
+                                team: row.team,
+                                peer: row.peer,
+                                startedAt: row.startedAt,
+                                resolvedAt: row.resolvedAt,
+                                outcome: row.outcome ?? 'unclassified',
+                                endedBy: archivedEndedBy(row),
+                                ...(row.direction !== undefined ? { direction: row.direction } : {}),
+                                ...(row.lateReceiptAt !== undefined ? { late: true } : {}),
+                                ...(row.brief !== undefined ? { brief: row.brief } : {}),
+                                ...(row.summary !== undefined && row.summary !== '' ? { summary: row.summary.slice(0, 160) } : {}),
+                            })),
                             archivedCount: taskLedger.archive().length,
                             // Ledger density face: the settled archive split by verdict, so
                             // the workbench can say WHICH way those rows settled instead of
@@ -1503,6 +1589,19 @@ export function apply(ctx, config) {
                             // Read-only; no fingerprints cross here (they are /a2a/query's
                             // only auth material).
                             idempotency: idempotencyStore.stats(),
+                            // gh#41 fleet planning: each tracked peer's published canvas
+                            // org (full-card canvasOrg) from the warm card cache — the
+                            // board renders REMOTE team frames from this. Absent until a
+                            // linked fetch warmed the card.
+                            peerOrg: peerStore.list().map(url => {
+                                const card = cardCache.get(url)?.card;
+                                const org = card?.canvasOrg;
+                                return Array.isArray(org)
+                                    ? { url, org: org.filter((e) => e !== null && typeof e === 'object')
+                                            .map(e => ({ name: typeof e.name === 'string' ? e.name : '', team: typeof e.team === 'string' ? e.team : '', members: Array.isArray(e.members) ? e.members.filter((m) => typeof m === 'string') : [] }))
+                                            .filter(e => e.team !== '') }
+                                    : { url, org: [] };
+                            }),
                             // gh#9+gh#10 M1: envelope-absent deliveries during the
                             // OriginClaim window — the operator watches this drain to
                             // zero before closing the window.
@@ -1620,6 +1719,157 @@ export function apply(ctx, config) {
                     });
                 }),
             }), 'a2a: session-node leave route');
+            // gh#45 CLI 户口 control face (loopback/key gated like every write):
+            // publish (deposit a signed CLI card, ≤4h by ruling), revoke, list,
+            // and mailbox readout — the CLI polls this while alive.
+            ctx.effect(() => webServer.register({
+                kind: 'exact',
+                path: '/__dsh_a2a/cli-deposit',
+                handler: controlRoute((req, res) => {
+                    readJsonBody(req, res, (body) => {
+                        const action = body.action;
+                        let payload;
+                        if (action === 'publish') {
+                            const card = typeof body.card === 'string' ? body.card : '';
+                            const out = cliDeposits.deposit(card);
+                            payload = JSON.stringify(out.ok
+                                ? { ok: true, handle: out.handle, expiresAt: out.expiresAt, cardUrl: `${ownCardUrl}/a2a/cli/${encodeURIComponent(out.handle)}` }
+                                : { ok: false, error: out.error });
+                        }
+                        else if (action === 'revoke') {
+                            payload = JSON.stringify({ ok: cliDeposits.revoke(typeof body.handle === 'string' ? body.handle : '') });
+                        }
+                        else if (action === 'inbox') {
+                            const handle = typeof body.handle === 'string' ? body.handle : '';
+                            payload = JSON.stringify({ ok: true, mail: cliDeposits.readMail(handle) });
+                        }
+                        else {
+                            payload = JSON.stringify({ ok: true, deposits: cliDeposits.list().map(row => ({ handle: row.handle, name: row.name, depositedAt: row.depositedAt, expiresAt: row.expiresAt })) });
+                        }
+                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
+                    });
+                }),
+            }), 'a2a: cli-deposit route');
+            // gh#41 fleet planning relay: the GUI asks THIS host to regulate a
+            // REMOTE peer's canvas team. The node key never leaves the server —
+            // the relay stamps the OriginClaim envelope and forwards to the
+            // peer's /a2a/canvas-op face; the peer's link gate authorizes.
+            ctx.effect(() => webServer.register({
+                kind: 'exact',
+                path: '/__dsh_a2a/fleet-canvas-op',
+                handler: controlRoute((req, res) => {
+                    readJsonBody(req, res, async (body) => {
+                        const { peer, op, name, id } = body;
+                        const peerUrl = typeof peer === 'string' ? peer : '';
+                        const opV = typeof op === 'string' ? op : '';
+                        const nameV = typeof name === 'string' ? name : '';
+                        const idV = typeof id === 'string' ? id : '';
+                        const send = (payload) => {
+                            res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                            res.end(payload);
+                        };
+                        if (peerUrl === '' || !/^https?:\/\//.test(peerUrl) || !['create', 'add-member', 'remove-member'].includes(opV) || (opV !== 'create' && nameV === '')) {
+                            send(JSON.stringify({ ok: false, error: 'peer (http url), op (create | add-member | remove-member), and name are required' }));
+                            return;
+                        }
+                        if (!peerStore.list().includes(peerUrl)) {
+                            send(JSON.stringify({ ok: false, error: `peer ${peerUrl} is not tracked — regulate tracked peers only` }));
+                            return;
+                        }
+                        try {
+                            const target = peerUrl.replace(/\/$/, '') + '/a2a/canvas-op';
+                            const reply = await globalThis.fetch(target, {
+                                method: 'POST',
+                                headers: { 'Content-Type': 'application/json', ...originClaimHeaders() },
+                                body: JSON.stringify({ op: opV, name: nameV, ...(opV !== 'create' ? { id: idV } : {}) }),
+                                signal: AbortSignal.timeout(15_000),
+                            });
+                            const raw = await reply.text();
+                            try {
+                                const out = JSON.parse(raw);
+                                send(JSON.stringify(out));
+                            }
+                            catch {
+                                // A non-JSON reply is a peer WITHOUT the canvas-op face (a
+                                // pre-gh41 build) or a proxy page — name the shape honestly.
+                                send(JSON.stringify({ ok: false, error: `peer ${peerUrl} answered HTTP ${String(reply.status)} without JSON — it likely runs a build without the fleet canvas-op face (pre gh#41); upgrade it, or regulate its teams on that host directly` }));
+                            }
+                        }
+                        catch (error) {
+                            send(JSON.stringify({ ok: false, error: `fleet op failed: ${error instanceof Error ? error.message : String(error)}` }));
+                        }
+                    });
+                }),
+            }), 'a2a: fleet-canvas-op relay route');
+            // gh#34 owner three-key panel: the remote build-out unlock knobs,
+            // surfaced as a control face instead of "翻配置文件". GET reads the
+            // effective values; POST writes the HOME patch layer (the
+            // authoritative surface) AND hot-applies the two call-time keys
+            // (teamJoinAllowlist / teamScopeInfo); announce is boot-time
+            // publishing, so its change lands on the next host restart and the
+            // reply says so. Same key gate as every write face.
+            ctx.effect(() => webServer.register({
+                kind: 'exact',
+                path: '/__dsh_a2a/owner-settings',
+                handler: controlRoute((req, res) => {
+                    if (req.method === 'GET') {
+                        const payload = JSON.stringify({
+                            ok: true,
+                            teamJoinAllowlist: [...ownerAllowlist],
+                            teamScopeInfo: ownerTeamScopeInfo,
+                            announce: config.announce === true,
+                            announceRestartPending: ownerAnnounceRestartPending,
+                        });
+                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
+                        return;
+                    }
+                    readJsonBody(req, res, (rawBody) => {
+                        const body = rawBody;
+                        const changes = {};
+                        if (Array.isArray(body.teamJoinAllowlist)) {
+                            const list = body.teamJoinAllowlist.filter((name) => typeof name === 'string' && name !== '' && name.length <= 128);
+                            changes.teamJoinAllowlist = [...new Set(list)];
+                        }
+                        if (typeof body.teamScopeInfo === 'boolean')
+                            changes.teamScopeInfo = body.teamScopeInfo;
+                        if (typeof body.announce === 'boolean')
+                            changes.announce = body.announce;
+                        if (Object.keys(changes).length === 0) {
+                            const payload = JSON.stringify({ ok: false, error: 'no recognized keys: teamJoinAllowlist (string[]), teamScopeInfo (bool), announce (bool)' });
+                            res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                            res.end(payload);
+                            return;
+                        }
+                        try {
+                            const patchPath = join(home, 'cordis.patch.yml');
+                            const current = existsSync(patchPath) ? readFileSync(patchPath, 'utf8') : '';
+                            const { yaml, restartNeeded } = applyOwnerSettings(current, changes);
+                            mkdirSync(home, { recursive: true });
+                            writeFileSync(patchPath, yaml, 'utf8');
+                            // Hot-apply the two call-time keys.
+                            if (changes.teamJoinAllowlist !== undefined)
+                                ownerAllowlist = [...changes.teamJoinAllowlist];
+                            if (changes.teamScopeInfo !== undefined)
+                                ownerTeamScopeInfo = changes.teamScopeInfo;
+                            if (changes.announce !== undefined && changes.announce !== (config.announce === true))
+                                ownerAnnounceRestartPending = true;
+                            if (changes.announce !== undefined && changes.announce === (config.announce === true))
+                                ownerAnnounceRestartPending = false;
+                            logger.info(`a2a: owner settings updated (${Object.keys(changes).join(', ')}${restartNeeded ? ' — restart pending for announce' : ''})`);
+                            const payload = JSON.stringify({ ok: true, restartNeeded, keys: Object.keys(changes) });
+                            res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                            res.end(payload);
+                        }
+                        catch (error) {
+                            const payload = JSON.stringify({ ok: false, error: `patch-layer write failed: ${error instanceof Error ? error.message : String(error)}` });
+                            res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                            res.end(payload);
+                        }
+                    });
+                }),
+            }), 'a2a: owner-settings route');
             // Groups control: create/remove named groups and assign sessions to
             // them (an empty name unassigns). Same guard as join/leave — the
             // group taxonomy enumerates session ids, so it stays behind the key.
@@ -1904,7 +2154,17 @@ export function apply(ctx, config) {
                         void named;
                     };
                     const claim = await verifyOriginClaim(req);
-                    const named = claim.ok;
+                    // W3 (#18 half-side, 0.6.25): a VERIFIED envelope proves the
+                    // caller holds a real node key — it does not prove a relationship
+                    // with THIS host. The full card (sessionTeams/rosters =
+                    // collaboration facts) additionally requires a LINK (same-host
+                    // membership, canvas remote ref, or the caller's own card seeding
+                    // us — see callerLinkedToThisHost). An unlinked-but-verified
+                    // stranger gets the MINIMAL discovery card, #18 X1's shape.
+                    // Interaction with the OriginClaim narrowing: the caller is a
+                    // bare zone; linkage judges that zone face against our canvas
+                    // remote refs, joined handles, and the caller card's peers.
+                    const named = claim.ok && callerLinkedToThisHost(claim.caller, claim.ok ? claim.callerUrl : '', claim.ok ? claim.card : undefined);
                     // gh#7 G1 (review-seat R2 ruling): the card serves two faces.
                     // A NAMED caller — ?caller_session= or the X-A2A-Caller header in
                     // the zone or zone/id8 shape — gets the FULL card. An anonymous
@@ -1943,11 +2203,23 @@ export function apply(ctx, config) {
                             return false;
                         }
                     };
+                    // #19 D2: the excerpt knob rides the served-fresh rows at the
+                    // card face — live nodes (nodeMetadataOf description) and cold
+                    // rows alike. 'off' omits the field (undefined drops out).
+                    const exposureRow = (team, meta) => {
+                        const { description, ...rest } = meta;
+                        const excerpt = exposureDescription(description ?? '');
+                        return { team, ...rest, ...(excerpt !== undefined ? { description: excerpt } : {}) };
+                    };
                     const sessionTeams = [
-                        ...[...sessionNodes.values()].filter(isJoinedNode).map(agent => ({ team: sessionTeamOf(agent), ...nodeMetadataOf(agent) })),
+                        ...[...sessionNodes.values()].filter(isJoinedNode).map(agent => exposureRow(sessionTeamOf(agent), nodeMetadataOf(agent))),
                         ...joinedSessions.list()
                             .filter(id => !liveRoots.has(id) && isArchived?.(id) !== true)
-                            .map(id => ({ team: `${config.team}/${id8(id)}`, name: `${session}-${id8(id)}`, description: 'cold — not loaded; routing here wakes the session' })),
+                            .map(id => exposureRow(`${config.team}/${id8(id)}`, { name: `${session}-${id8(id)}`, description: 'cold — not loaded; routing here wakes the session' })),
+                        // gh#45: deposited CLI identities publish as directory rows —
+                        // the fleet sees them as member cards (draggable = the operator
+                        // link). Their "zone" is the agent-name; expiry drops the row.
+                        ...cliDeposits.cardRows().map(row => exposureRow(row.team, { name: row.name, description: row.description })),
                     ];
                     const memberships = teamMemberships.list().flatMap(entry => entry.teams.map(team => ({ node: `${config.team}/${id8(entry.session)}`, team })));
                     const body = JSON.stringify({
@@ -1955,6 +2227,15 @@ export function apply(ctx, config) {
                         peers: peerStore.list(),
                         ...(named && sessionTeams.length > 0 ? { sessionTeams } : {}),
                         ...(named && memberships.length > 0 ? { teamMemberships: memberships } : {}),
+                        // gh#41 fleet planning (owner ruling: any peer composes and
+                        // regulates): the host's own canvas org rides the FULL card as a
+                        // served-fresh unsigned field — linked peers render each other's
+                        // team structure on the planning board; the minimal face omits
+                        // it exactly like sessionTeams. Members are CANONICALIZED to
+                        // zone/id8 handles (local session ids translate to the node's
+                        // session-team handle) — one form on the wire, so readers never
+                        // mix id/handle shapes (owner: 数据对不上).
+                        ...(named ? { canvasOrg: canvasStore.list().map(name => ({ name, team: canvasTeamOf(name), members: canvasStore.membersOf(name).map(id => sessionNodes.has(id) || joinedSessions.has(id) ? `${config.team}/${id8(id)}` : id) })) } : {}),
                         ...(named && lanIp !== '' ? { lanIp } : {}),
                         ...(PLUGIN_VERSION !== '' ? { version: PLUGIN_VERSION } : {}),
                         description: `A2A node exposing team ${config.team}${named ? '' : ' (minimal card — OriginClaim envelope required for the full card: X-A2A-Caller/-Url/-Ts/-Sig signed with your card key)'}`,
@@ -2291,7 +2572,7 @@ export function apply(ctx, config) {
             // <id>" answer correlates with the caller's own route result.
             const from = caller === '' ? 'an unknown node' : caller;
             const taskPrefix = taskId === undefined ? '' : `(task ${taskId}) `;
-            const text = `[A2A direct] ${taskPrefix}from "${from}" (routed to ${team}) sent:
+            const text = `[A2A direct] ${taskPrefix}${fromClause(from)} (routed to ${team}) sent:
 
 ${message}`;
             try {
@@ -2392,7 +2673,7 @@ ${message}`;
     function bridgeEnvelope(team, caller, message, taskId) {
         const from = caller === '' ? 'an unknown node' : caller;
         const taskPrefix = taskId === undefined ? '' : `(task ${taskId}) `;
-        return `[A2A direct] ${taskPrefix}from "${from}" (routed to ${team}) sent:\n\n${message}`;
+        return `[A2A direct] ${taskPrefix}${fromClause(from)} (routed to ${team}) sent:\n\n${message}`;
     }
     /** The projection for a round that outlived the reply window: unlike the
      * steer deadline's text, this must NOT promise a receipt — native-teams
@@ -2499,8 +2780,12 @@ ${message}`;
                 const verdict = verifyCard(JSON.parse(text), Date.now());
                 if (verdict.ok)
                     card = verdict.card;
+                else
+                    req.__claimDbg = { stage: 'verify', reason: verdict.reason, head: text.slice(0, 100) };
             }
             catch (error) {
+                ;
+                req.__claimDbg = { stage: 'fetch', error: error instanceof Error ? error.message : String(error) };
                 card = undefined;
             }
         }
@@ -2528,16 +2813,218 @@ ${message}`;
         if (card.team !== caller) {
             return { ok: false, reason: 'not-derivable' };
         }
-        return { ok: true, caller };
+        return { ok: true, caller, callerUrl, card };
+    }
+    /**
+     * W3 (#18 half-side): is a VERIFIED caller LINKED to this host? Key
+     * possession proves the caller is a real host; it says nothing about a
+     * relationship with US. The full card carries collaboration facts
+     * (sessionTeams/rosters), so it additionally requires a link:
+     *   1. same-host membership — the caller's card URL origin equals OUR
+     *      card URL origin (the loopback self-fetch face: true self is an
+     *      ORIGIN equality; zone-name equality carries no identity in a
+     *      single-zone fleet), or one of our session pseudo-handles;
+     *   2. a canvas remote ref — the EXACT handle only (#19 D1, ruling
+     *      final: the zone-sibling variant was a blanket fallback that any
+     *      one ref opened to a whole zone's hosts in single-zone fleets; the
+     *      operator names THAT node, that node links);
+     *   3. BILATERAL seeding (review M1 fix): our config.peers contains the
+     *      caller's URL **and** the caller's card (fetched fresh during
+     *      verification) carries our origin among its peers — both
+     *      operators made the gesture, each on their own side. The single-
+     *      sided card-claims variant was a hole the reviewer's adversarial
+     *      probe walked through (one config.peers line → full card with
+     *      zero commitment from us): peers is an unsigned served-fresh
+     *      field, exactly the self-description trust class N3/V5 abolished.
+     *      Our operator's config anchors; the card shadow corroborates.
+     */
+    function callerLinkedToThisHost(caller, callerUrl, callerCard) {
+        // Basis 1, same-host membership (review second-round M-fix): "self" is
+        // an ORIGIN equality, not a zone-name equality. `caller === config.team`
+        // granted unconditionally in a single-zone fleet (the deployment
+        // reality: every host named 'dsh') — any verified caller naming the
+        // shared zone string was "us". True self is the loopback self-fetch
+        // face: the caller's card URL origin equals OUR card URL origin.
+        try {
+            if (callerUrl !== '' && new URL(callerUrl).origin === new URL(ownCardUrl).origin)
+                return true;
+        }
+        catch { /* malformed callerUrl — falls through to the record bases */ }
+        for (const id of joinedSessions.list()) {
+            if (`${config.team}/${id8(id)}` === caller)
+                return true;
+        }
+        // #19 D1 (ruling final): canvas remote refs admit by EXACT HANDLE only.
+        // The zone-sibling variant (`refZone === zone`) was a blanket fallback —
+        // in a single-zone fleet any one ref linked the whole zone face, the
+        // exact trust shape the exposure ruling removed. Exact handle in, the
+        // operator named THAT node.
+        for (const name of canvasStore.list()) {
+            for (const ref of canvasStore.remoteMembersOf(name)) {
+                if (ref === caller)
+                    return true;
+            }
+        }
+        // Basis 3, BILATERAL (review M1 fix): OUR config.peers seeds a URL
+        // whose origin matches the caller's card URL, AND the caller's card
+        // reciprocates by carrying OUR origin among its peers — both
+        // operators made the gesture, each on their own side. The single-
+        // sided card-claims variant was a hole the reviewer's adversarial
+        // probe walked through (one config.peers line on the CALLER → full
+        // card with zero commitment from us): peers is an unsigned
+        // served-fresh field, exactly the self-description trust class
+        // N3/V5 abolished. Our operator's own config anchors; the card
+        // shadow only corroborates.
+        if (callerCard !== undefined && ownCardUrl !== '') {
+            const ourOrigin = new URL(ownCardUrl).origin;
+            const callerOrigin = new URL(callerUrl).origin;
+            const weSeedThem = config.peers.some(peer => {
+                try {
+                    return new URL(peer).origin === callerOrigin;
+                }
+                catch {
+                    return false;
+                }
+            });
+            const theySeedUs = (callerCard.peers ?? []).some(peer => {
+                try {
+                    return new URL(peer).origin === ourOrigin;
+                }
+                catch {
+                    return false;
+                }
+            });
+            if (weSeedThem && theySeedUs)
+                return true;
+        }
+        return false;
     }
     /* ── Inbound admission shared by the peer faces (/a2a/direct,
-       /a2a/log): caller_session is the protocol contract. Anonymous is
-       refused, and admission is decided by THIS host's own records — never
-       by the caller's self-description (gh#7 N3, V3/V5): not its
-       caller_session spelling, not its own card's team claims, not
-       first-contact defaults. Returns the refusal detail, or undefined
-       when admissible. */
-    function a2aCallerRefusal(caller) {
+       /a2a/log) and — since the boundary-hardening wave (W1) — the LOCAL
+       dispatch candidate: caller_session is the protocol contract.
+       Anonymous is refused, and admission is decided by THIS host's own
+       records — never by the caller's self-description (gh#7 N3, V3/V5).
+       Returns the refusal detail, or undefined when admissible. */
+    /**
+     * W1/W2 shared-team admission core (pure over the host's stores): a
+     * same-zone zone/id8 caller passes when it holds a team this host's
+     * records also hold. The caller's basis is its roster declarations UNION
+     * its canvas memberships (W2②: canvas teammates share a team by being in
+     * the team — the roster is not the only link record); the host's basis is
+     * the routable set (bare zone, joined handles, canvas names) union other
+     * sessions' declarations. Used by both the inbound faces and the local
+     * dispatch candidate so the two paths can never diverge.
+     */
+    function sameZoneSharedTeamRefusal(caller, targetTeam) {
+        const declared = new Set();
+        let callerSessionId;
+        for (const entry of teamMemberships.list()) {
+            if (`${config.team}/${id8(entry.session)}` === caller) {
+                callerSessionId = entry.session;
+                for (const t of entry.teams)
+                    declared.add(t);
+            }
+        }
+        // W2②: canvas membership is a link record too — the caller's session
+        // sitting in a canvas team declares that team as much as a roster line.
+        if (callerSessionId === undefined) {
+            for (const id of joinedSessions.list()) {
+                if (`${config.team}/${id8(id)}` === caller) {
+                    callerSessionId = id;
+                    break;
+                }
+            }
+        }
+        if (callerSessionId !== undefined) {
+            for (const name of canvasStore.teamsOf(callerSessionId))
+                declared.add(canvasTeamOf(name));
+        }
+        const routable = new Set([config.team]);
+        for (const id of joinedSessions.list())
+            routable.add(`${config.team}/${id8(id)}`);
+        for (const name of canvasStore.list())
+            routable.add(canvasTeamOf(name));
+        const otherLocalDeclarations = new Set();
+        for (const entry of teamMemberships.list()) {
+            if (`${config.team}/${id8(entry.session)}` === caller)
+                continue;
+            for (const t of entry.teams)
+                otherLocalDeclarations.add(t);
+        }
+        const shared = [...declared].some(t => routable.has(t) || otherLocalDeclarations.has(t));
+        // F5 (gh#26, attribute-owner ruling): same-host admission needs a
+        // TARGET-level intersection — a canvas member used to reach ANY session
+        // team on this host through a host-level link alone. The target's link
+        // set = its roster declarations ∪ its canvas teams. EXCEPTION (ruling,
+        // 成文): the PROCESS face (target === config.team) is the owner face,
+        // not a member face — any shared team clears it.
+        if (targetTeam !== undefined && targetTeam !== config.team) {
+            let targetLinks;
+            const targetId8 = targetTeam.startsWith(`${config.team}/`) ? targetTeam.slice(config.team.length + 1) : undefined;
+            if (targetId8 !== undefined) {
+                // Only a KNOWN local session earns target-level judgement; an
+                // unresolvable handle (archived/foreign spelling) keeps the
+                // host-level basis — an empty target set must not refuse everyone.
+                // The handle carries the id8 SLICE, so resolve it back to the
+                // session id before asking the stores (canvas teamsOf keys by id).
+                const targetSession = joinedSessions.list().find(sessionId => id8(sessionId) === targetId8)
+                    ?? teamMemberships.list().find(entry => id8(entry.session) === targetId8)?.session;
+                if (targetSession !== undefined) {
+                    targetLinks = new Set();
+                    for (const entry of teamMemberships.list()) {
+                        if (entry.session === targetSession)
+                            for (const t of entry.teams)
+                                targetLinks.add(t);
+                    }
+                    for (const name of canvasStore.teamsOf(targetSession))
+                        targetLinks.add(canvasTeamOf(name));
+                }
+            }
+            else {
+                const canvasName = canvasStore.list().find(name => canvasTeamOf(name) === targetTeam);
+                if (canvasName !== undefined) {
+                    targetLinks = new Set([targetTeam]);
+                    for (const memberId of canvasStore.membersOf(canvasName)) {
+                        for (const entry of teamMemberships.list())
+                            if (entry.session === memberId)
+                                for (const t of entry.teams)
+                                    targetLinks.add(t);
+                    }
+                }
+            }
+            if (targetLinks !== undefined) {
+                if ([...declared].some(t => targetLinks.has(t)))
+                    return undefined;
+                return declared.size === 0
+                    ? `caller "${caller}" declares no team membership on this host's roster — a teamless node has no network (S3 phase-3 admission). Declare a shared team on both ends, or route through a teamed member.`
+                    : `caller "${caller}" shares no team with target "${targetTeam}" — declared [${[...declared].join(', ')}], target links [${[...targetLinks].join(', ')}] (F5 target-level admission: a host-level link alone does not open every session team).`;
+            }
+            // Unresolvable target (foreign/zone delegation): host-level basis.
+        }
+        if (shared)
+            return undefined;
+        return declared.size === 0
+            ? `caller "${caller}" declares no team membership on this host's roster — a teamless node has no network (S3 phase-3 admission). Declare a shared team on both ends, or route through a teamed member.`
+            : `caller "${caller}" declares teams [${[...declared].join(', ')}] — none is routable on this node (shared-team admission). Declare a shared team on both ends, or route through a teamed member.`;
+    }
+    /**
+     * W1: does a caller label fall under the joined-face admission gate? The
+     * zone/id8 shape with THIS zone names a joined session node — the face
+     * the boundary-hardening wave closes. The initiator face (bare node
+     * team) and foreign-zone labels are judged elsewhere (F1b host-face
+     * rules; the foreign branch below) and stay untouched.
+     */
+    const joinedFaceCallerShape = /^[a-z0-9-]+\/[0-9a-f]{8}$/i;
+    function joinedFaceAdmissionRefusal(callerSession, targetTeam) {
+        if (callerSession === undefined || callerSession === '')
+            return undefined;
+        if (!joinedFaceCallerShape.test(callerSession))
+            return undefined;
+        if (callerSession.slice(0, callerSession.indexOf('/')) !== config.team)
+            return undefined;
+        return sameZoneSharedTeamRefusal(callerSession, targetTeam);
+    }
+    function a2aCallerRefusal(caller, targetTeam) {
         if (!config.teamScopeRouting)
             return undefined;
         if (caller === '') {
@@ -2551,33 +3038,12 @@ ${message}`;
         if (zoneShaped) {
             const callerZone = caller.slice(0, caller.indexOf('/'));
             if (callerZone === config.team) {
-                // Same-zone handle: judged by this host's own roster — the
-                // operator-established link record for local nodes.
-                const declared = new Set();
-                for (const entry of teamMemberships.list()) {
-                    if (`${config.team}/${id8(entry.session)}` === caller)
-                        for (const t of entry.teams)
-                            declared.add(t);
-                }
-                const routable = new Set([config.team]);
-                for (const id of joinedSessions.list())
-                    routable.add(`${config.team}/${id8(id)}`);
-                for (const name of canvasStore.list())
-                    routable.add(canvasTeamOf(name));
-                const otherLocalDeclarations = new Set();
-                for (const entry of teamMemberships.list()) {
-                    if (`${config.team}/${id8(entry.session)}` === caller)
-                        continue;
-                    for (const t of entry.teams)
-                        otherLocalDeclarations.add(t);
-                }
-                const shared = [...declared].some(t => routable.has(t) || otherLocalDeclarations.has(t));
-                if (!shared) {
-                    return declared.size === 0
-                        ? `caller "${caller}" declares no team membership on this host's roster — a teamless node has no network (S3 phase-3 admission). Declare a shared team on both ends, or route through a teamed member.`
-                        : `caller "${caller}" declares teams [${[...declared].join(', ')}] — none is routable on this node (shared-team admission). Declare a shared team on both ends, or route through a teamed member.`;
-                }
-                return undefined;
+                // Same-zone handle: the W1/W2 shared admission core — roster
+                // declarations UNION canvas memberships against this host's
+                // records (canvas names are link records too; see the helper).
+                // F5: the routed team rides along so admission can require a
+                // TARGET-level intersection.
+                return sameZoneSharedTeamRefusal(caller, targetTeam);
             }
             // Foreign-zone handle (N3/N4): admitted ONLY through this host's
             // operator-established cross-host links — a canvas remote member ref
@@ -2607,7 +3073,14 @@ ${message}`;
             if (String(agent.id) === caller)
                 return undefined;
         }
-        return `caller_session "${caller}" matches no node fact on this host (joined session id or live node label) — free-form caller labels are self-description and are not admissible (N3). Pass caller_session as <zone>/<id8> with an operator-established link.`;
+        // gh#45: a DEPOSITED CLI handle is a published node fact of this host
+        // (the card's sessionTeams carries it; the envelope's zone derivation
+        // already proved the CLI key on the wire face's own verify). The
+        // handle is <agent-name>/<uuid16> — not zone/id8-shaped, hence this
+        // branch, but it is as much a fact as a joined session.
+        if (cliDeposits.get(caller) !== undefined)
+            return undefined;
+        return `caller_session "${caller}" matches no node fact on this host (joined session id, live node label, or deposited CLI handle) — free-form caller labels are self-description and are not admissible (N3). Pass caller_session as <zone>/<id8> with an operator-established link.`;
     }
     /* ── Session-log read faces (shared by the local control route and the
        peer /a2a/log face): both answer from <dshHome>/sessions with
@@ -2672,6 +3145,106 @@ ${message}`;
         return { ok: true, id, messages: entries.map(entry => ({ role: entry.role, text: entry.text, ...(entry.time !== undefined ? { time: entry.time } : {}) })) };
     }
     whenWebServerSettled((webServer) => {
+        // gh#45 CLI 户口卡面 (peer face, unsigned card serve): the deposited
+        // CLI's SIGNED card is served verbatim under its own base URL — an
+        // OriginClaim verification of a CLI envelope fetches exactly here
+        // (callerUrl + /.well-known/agent-card.json). Expired or unknown
+        // handles 404 (auto-deregistered — the identity is dead until
+        // re-publish).
+        ctx.effect(() => webServer.register({
+            kind: 'prefix',
+            path: '/a2a/cli',
+            handler: (req, res) => {
+                const MOUNT = '/a2a/cli';
+                const rest = (req.url ?? '').slice(MOUNT.length);
+                const m = /^\/([^/]+)\/\.well-known\/agent-card\.json$/.exec(rest);
+                if (req.method !== 'GET' || m === null) {
+                    res.writeHead(404, { 'Content-Type': 'text/plain' });
+                    res.end();
+                    return;
+                }
+                const handle = decodeURIComponent(m[1]);
+                const row = cliDeposits.get(handle);
+                if (row === undefined) {
+                    res.writeHead(404, { 'Content-Type': 'text/plain' });
+                    res.end();
+                    return;
+                }
+                res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+                res.end(row.cardJson);
+            },
+        }), 'a2a: cli deposit card face');
+        // gh#41 fleet planning, peer-write face: a LINKED peer may regulate this
+        // host's canvas teams (create / add-member / remove-member) with a
+        // VERIFIED OriginClaim envelope. The owner's ruling: any peer composes
+        // and regulates the whole fleet — the bilateral/operator link IS the
+        // authorization, the envelope proves the key, and every op lands in the
+        // activity ring + host log for audit. Unlinked or unsigned callers get
+        // a refusal, never a mutation.
+        ctx.effect(() => webServer.register({
+            kind: 'exact',
+            path: '/a2a/canvas-op',
+            handler: async (req, res) => {
+                const send = (status, payload) => {
+                    res.writeHead(status, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                    res.end(payload);
+                };
+                if (req.method !== 'POST') {
+                    send(200, JSON.stringify({ ok: false, error: 'POST required' }));
+                    return;
+                }
+                const chunks = [];
+                let size = 0;
+                req.on('data', (chunk) => { size += chunk.length; if (size > 16 * 1024) {
+                    chunks.length = 0;
+                    return;
+                } chunks.push(chunk); });
+                req.on('end', () => {
+                    void (async () => {
+                        try {
+                            const body = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                            const claim = await verifyOriginClaim(req);
+                            if (!claim.ok) {
+                                logger.warn(`a2a: canvas-op claim failed (${claim.reason}) — caller=${String(req.headers['x-a2a-caller'] ?? '')} url=${String(req.headers['x-a2a-caller-url'] ?? '')} ts=${String(req.headers['x-a2a-caller-ts'] ?? '')}`);
+                                send(200, JSON.stringify({ ok: false, error: `untrusted-origin: OriginClaim verification failed (${claim.reason}) — canvas regulation requires a signed envelope`, code: -32000 }));
+                                return;
+                            }
+                            if (!callerLinkedToThisHost(claim.caller, claim.callerUrl, claim.card)) {
+                                recordActivity('in', 'fleet-canvas', claim.caller, false);
+                                send(200, JSON.stringify({ ok: false, error: `caller "${claim.caller}" is not linked to this host — canvas regulation requires the operator link (bilateral seed, canvas ref, or same-host membership)` }));
+                                return;
+                            }
+                            const op = body.op;
+                            const name = typeof body.name === 'string' ? body.name : '';
+                            const id = typeof body.id === 'string' ? body.id : '';
+                            let payload;
+                            if (op === 'create') {
+                                const stored = canvasStore.create(name);
+                                payload = stored === undefined ? { ok: false, error: 'invalid name or team cap reached' } : { ok: true, members: canvasStore.membersOf(stored) };
+                            }
+                            else if (op === 'add-member') {
+                                const memberValid = isRemoteMemberRef(id) ? validRemoteMemberRef(id) : id !== '' && (sessionNodes.has(id) || joinedSessions.has(id));
+                                payload = name === '' || !memberValid
+                                    ? { ok: false, error: 'name and a member (joined session id, or a zone-qualified remote team handle) are required' }
+                                    : (canvasStore.create(name), { ok: canvasStore.addMember(name, id), members: canvasStore.membersOf(name) });
+                            }
+                            else if (op === 'remove-member') {
+                                payload = { ok: name !== '' && canvasStore.removeMember(name, id), members: name !== '' ? canvasStore.membersOf(name) : undefined };
+                            }
+                            else {
+                                payload = { ok: false, error: 'op must be create | add-member | remove-member' };
+                            }
+                            recordActivity('in', 'fleet-canvas', `${claim.caller}:${String(op)}`, payload.ok);
+                            logger.info(`a2a: fleet canvas op from ${claim.caller} (${String(op)} ${name}${id !== '' ? ` ${id}` : ''}) -> ${payload.ok ? 'applied' : `refused: ${payload.error ?? '?'}`}`);
+                            send(200, JSON.stringify(payload));
+                        }
+                        catch (error) {
+                            send(200, JSON.stringify({ ok: false, error: `canvas-op failed: ${error instanceof Error ? error.message : String(error)}` }));
+                        }
+                    })();
+                });
+            },
+        }), 'a2a: fleet canvas-op peer route');
         ctx.effect(() => webServer.register({
             kind: 'exact',
             path: '/a2a/direct',
@@ -2775,7 +3348,7 @@ ${message}`;
                     // (0.6.15: the rule now lives in a2aCallerRefusal so the
                     // read-only /a2a/log face admits callers by exactly the same
                     // standard as message delivery.)
-                    const callerRefusal = a2aCallerRefusal(caller);
+                    const callerRefusal = a2aCallerRefusal(caller, team);
                     if (callerRefusal !== undefined) {
                         recordActivity('in', team, caller === '' ? 'anonymous' : caller, false);
                         const payload = JSON.stringify({ error: callerRefusal, code: -32000, team, task_status: 'TASK_STATE_FAILED' });
@@ -2831,6 +3404,20 @@ ${message}`;
                     // carried it here. Correlation is bookkeeping only — the message
                     // steers on exactly as before.
                     settleAndAnnounce(message);
+                    // gh#45 CLI mailbox (wire face): a delivery targeting a DEPOSITED
+                    // CLI handle never resolves a session and never wakes — it lands
+                    // in the deposit's mailbox and answers delivered. Placement here
+                    // keeps the idempotency claim (above) exactly as for sessions.
+                    const cliRow = cliDeposits.get(team);
+                    if (cliRow !== undefined) {
+                        cliDeposits.mail(team, caller, message);
+                        recordActivity('in', team, caller, true);
+                        logger.info(`a2a: cli mailbox delivery for ${team} (from ${caller})`);
+                        const payload = JSON.stringify({ routed: true, delivered: true, receipt: 'mailbox', team, task_id: taskId, task_status: 'TASK_STATE_COMPLETED', note: `delivered to the mailbox of ${team} — the CLI polls while online` });
+                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
+                        return;
+                    }
                     // Inbound routing is foreground demand: boot prewarm yields for a
                     // quiet window around it.
                     lastWakeDemandAt = Date.now();
@@ -2858,7 +3445,7 @@ ${message}`;
                                 // latched, so the post-steer read alone would answer a false
                                 // consumed:true and strand the message.
                                 const runningBeforeSteer = probeConsumption(target, taskId);
-                                steerRelay(target, `[A2A direct] (task ${taskId}) from "${from}" (routed to ${team}) sent:\n\n${message}\n\n(When done, route your outcome back with one call — a2a_route { team: "${receiptTarget}", message: "[A2A receipt] task ${taskId} <one-line outcome>" }.)`, from === 'an unknown node' ? undefined : from);
+                                steerRelay(target, `[A2A direct] (task ${taskId}) ${fromClause(from)} (routed to ${team}) sent:\n\n${message}\n\n(When done, route your outcome back with one call — a2a_route { team: "${receiptTarget}", message: "[A2A receipt] task ${taskId} <one-line outcome>" }.)`, from === 'an unknown node' ? undefined : from);
                                 recordActivity('in', team, caller, true);
                                 armReceiptAutosend(target, taskId, receiptTarget, message);
                                 // v0.5.23 (async-stall): "delivered" only proves the steer call
@@ -3302,7 +3889,16 @@ ${message}`;
                     else {
                         dispatchLastAt.set(client, now);
                         try {
-                            result = await routeTrunk({ team: target, message, async: true }, undefined, AbortSignal.timeout(20_000), config.team);
+                            // gh#36: a quick dispatch rides a LIVE joined session's node
+                            // team as its caller face when one exists — receipts then
+                            // route back to that session and the owner SEES the answer in
+                            // its chat drawer. Bare-zone callers (the old shape) cannot
+                            // receive: the receipt ladder failed every lane and the owner
+                            // read it as 派发异常没有收信. No live session keeps the
+                            // host face (the reply's reconciliation note still applies).
+                            const liveJoined = joinedSessions.list().find(id => liveRoots.has(id));
+                            const hostFace = liveJoined !== undefined ? `${config.team}/${id8(liveJoined)}` : config.team;
+                            result = await routeTrunk({ team: target, message, async: true }, undefined, AbortSignal.timeout(20_000), hostFace);
                         }
                         catch (error) {
                             result = { ok: false, error: `dispatch failed: ${error instanceof Error ? error.message : String(error)}` };
@@ -3536,6 +4132,138 @@ ${message}`;
     }
     const cardCache = new Map();
     const cardCacheInFlight = new Map();
+    /**
+     * The from-line display name (owner ruling, claim 8ea4150f94): a bare
+     * routing handle (`dsh/74555a36`) carries zero semantics for the reader.
+     * Resolve what the handle NAMES, cheaply and read-only:
+     *   1. a local handle — a joined/live session id, its zone/id8 pseudo-team,
+     *      or a live node label → nodeMetadataOf(agent).name (the session-title
+     *      product, exactly what the directory shows);
+     *   2. a remote bare-zone caller → the warmest cached card whose team
+     *      equals the zone (the publisher's own card NAME is the display name);
+     *   3. a remote zone/id8 caller → the cached card whose sessionTeams row
+     *      matches the handle → that row's name;
+     *   4. nothing resolves → '' (the from line stays bare — no false names).
+     * Read-only over warm caches: never fetches, so a cold cache degrades to
+     * the bare handle, never to a stall.
+     */
+    function callerDisplayName(caller) {
+        if (caller === '' || caller === 'an unknown node')
+            return '';
+        // Local: joined/live session facts on THIS host.
+        for (const [id, agent] of sessionNodes) {
+            if (id === caller || sessionLabelOf(agent) === caller || `${config.team}/${id8(id)}` === caller) {
+                return nodeMetadataOf(agent).name;
+            }
+        }
+        for (const [id, agent] of liveRoots) {
+            if (id === caller || sessionLabelOf(agent) === caller || `${config.team}/${id8(id)}` === caller) {
+                return nodeMetadataOf(agent).name;
+            }
+        }
+        // Remote: warm card cache only.
+        const zone = caller.includes('/') ? caller.slice(0, caller.indexOf('/')) : caller;
+        let zoneName = '';
+        for (const entry of cardCache.values()) {
+            const card = entry.card;
+            if (card === undefined)
+                continue;
+            if (card.team === zone && zoneName === '')
+                zoneName = card.name;
+            if (caller.includes('/')) {
+                const row = (card.sessionTeams ?? []).find(item => item.team === caller);
+                if (row !== undefined && row.name !== '')
+                    return row.name;
+            }
+        }
+        if (!caller.includes('/') && zoneName !== '')
+            return zoneName;
+        return '';
+    }
+    /** The from clause with the display name in full-width parens when resolved. */
+    function fromClause(from) {
+        const display = callerDisplayName(from);
+        return `from "${from}"${display !== '' ? `（${display}）` : ''}`;
+    }
+    /**
+     * gh#20 W-A: THIS host's view of one tracked peer's link state (the
+     * mirror of callerLinkedToThisHost, judged from our side about THEM):
+     *   · linked — bilateral seeding (our config.peers carries a URL of the
+     *     peer's origin AND the peer's card carries ours), or a canvas remote
+     *     ref naming the peer's zone or one of its session teams;
+     *   · stranger — no operator-established basis (a verified key is not a
+     *     relationship);
+     *   · verified — we hold a signature-valid cached card (the badge's
+     *     tick/cross: reachable-and-authentic vs unknown/bad).
+     * NOTE (gh#20 review observation, ruling-accepted): the UI's third
+     * colour — fleet blue — has no v1 data source: a peer's #19 exposure
+     * tier is that host's state-face private fact and is NOT published on
+     * its card, so we cannot classify a peer as fleet-visible. The badge
+     * renders two colours (linked green / stranger gray) and the blue slot
+     * lights up the day the card face carries a tier field (or an
+     * a2a_exposure state query is added to fetch it).
+     * Pure over warm caches and config; never fetches.
+     */
+    function peerLinkState(peerUrl) {
+        const cached = cardCache.get(peerUrl)?.card;
+        const verified = cached !== undefined;
+        const zone = cached?.team ?? '';
+        const handles = new Set();
+        if (zone !== '')
+            handles.add(zone);
+        for (const row of cached?.sessionTeams ?? [])
+            handles.add(row.team);
+        let linked = false;
+        // Basis 1: bilateral seeds (origin match both ways).
+        if (cached !== undefined && ownCardUrl !== '') {
+            try {
+                const peerOrigin = new URL(peerUrl).origin;
+                const ourOrigin = new URL(ownCardUrl).origin;
+                const weSeedThem = config.peers.some(peer => {
+                    try {
+                        return new URL(peer).origin === peerOrigin;
+                    }
+                    catch {
+                        return false;
+                    }
+                });
+                const theySeedUs = (cached.peers ?? []).some(peer => {
+                    try {
+                        return new URL(peer).origin === ourOrigin;
+                    }
+                    catch {
+                        return false;
+                    }
+                });
+                if (weSeedThem && theySeedUs)
+                    linked = true;
+            }
+            catch { /* malformed peer URL — falls through to the canvas basis */ }
+        }
+        // Basis 2: a canvas remote ref names the peer's zone or one of its
+        // session teams. Exact-handle match first (the admission basis); the
+        // ref's ZONE prefix against card.team accepts the common compose form
+        // (the operator added the peer's session-team handle; we see the
+        // minimal card without sessionTeams until linked — display-level
+        // zone matching is exact-host here: the ref names a handle of THAT
+        // zone, and the tracked peer IS that zone's card).
+        if (!linked && handles.size > 0 && zone !== '') {
+            outer: for (const name of canvasStore.list()) {
+                for (const ref of canvasStore.remoteMembersOf(name)) {
+                    if (handles.has(ref)) {
+                        linked = true;
+                        break outer;
+                    }
+                    const refZone = ref.includes('/') ? ref.slice(0, ref.indexOf('/')) : ref;
+                    if (refZone === zone) {
+                        linked = true;
+                        break outer;
+                    }
+                }
+            }
+        }
+        return { link: linked ? 'linked' : 'stranger', verified };
+    }
     function cachedCardFetch(url) {
         const hit = cardCache.get(url);
         const now = Date.now();
@@ -3624,8 +4352,8 @@ ${message}`;
     // nothing at join time: a pattern pre-authorizing every future name
     // under it would let a model mint teams nobody created. Pattern entries
     // remain readable (whoami shows them) but carry no mint rights.
-    const teamJoinExactAllowed = (team) => (config.teamJoinAllowlist ?? []).includes(team);
-    const teamJoinPatternMatches = (team) => (config.teamJoinAllowlist ?? []).some(pattern => {
+    const teamJoinExactAllowed = (team) => ownerAllowlist.includes(team);
+    const teamJoinPatternMatches = (team) => ownerAllowlist.some(pattern => {
         if (pattern === '*')
             return true;
         if (pattern.endsWith('*')) {
@@ -3707,7 +4435,7 @@ ${message}`;
                 .slice(-3)
                 .reverse()
                 .map(entry => ({ at: entry.at, action: entry.action, team: entry.team, reason: entry.reason ?? '' }));
-            const patterns = [...config.teamJoinAllowlist];
+            const patterns = [...ownerAllowlist];
             return {
                 ok: true,
                 face: 'session',
@@ -3877,6 +4605,51 @@ ${message}`;
             return { ok: true, team, id, teams: [...teamMemberships.teamsOf(id)] };
         },
     }));
+    ctx.tools.register(defineTool({
+        name: 'a2a_exposure',
+        description: '#19 exposure tiers: set THIS session\'s network visibility. \'linked\' (the default '
+            + 'floor) — visible to linked callers per the card-face link gate; \'fleet\' — a voluntary '
+            + 'opt-UP making the session\'s team visible to any fleet peer. Members may raise and lower '
+            + 'their own tier freely; nothing exists below linked (no private tier in v1), and group '
+            + 'visibility always derives from the strictest member (no group knobs). Requires the '
+            + 'session to be joined to the network.',
+        parameters: {
+            tier: { type: 'string', enum: ['linked', 'fleet'], required: true, description: 'The exposure tier to set for this session.' },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    ok: { type: 'boolean', required: true },
+                    id: { type: 'string' },
+                    tier: { type: 'string' },
+                    error: { type: 'string', description: 'Refusal reason when ok is false (not joined, or no agent context).' },
+                },
+            },
+            render: (_args, value) => [{
+                    type: 'text',
+                    text: value.ok === true
+                        ? `Session ${String(value.id)} exposure tier set to ${String(value.tier)}`
+                        : `Exposure refused: ${String(value.error)}`,
+                }],
+        },
+        presentCall: () => ({ card: 'generic', title: 'A2A exposure tier', kind: 'other', rawInput: null }),
+        execute: async (args, exec) => {
+            const agent = exec.agent;
+            if (agent === undefined) {
+                return { ok: false, error: 'no agent context — the exposure tier is a per-session fact; call from a session' };
+            }
+            const id = String(agent.id);
+            if (!joinedSessions.has(id)) {
+                return { ok: false, error: 'session is not joined to the A2A network — join first (the sidebar control or the host join route)' };
+            }
+            const tier = args.tier === 'fleet' ? 'fleet' : 'linked';
+            exposureStore.setTier(id, tier);
+            logger.info(`a2a: ${id8(id)} exposure tier -> ${tier}`);
+            return { ok: true, id, tier };
+        },
+    }));
     ctx.tools.register(defineTool({
         name: 'a2a_report',
         description: 'Report a task or status to this host\'s A2A network — the ONE ingress a session WITHOUT network '
@@ -3996,7 +4769,7 @@ ${message}`;
             + 'by keyword (case-insensitive substring over team name, title, excerpt, origin, or workspace) — searching '
             + 'discovers one extra referral hop within the call. Canvas teams (<team>/canvas/<name>, user-composed multi-member groups) '
             + 'list as local rows; routing to one resolves the first live member or wakes the first cold one. '
-            + 'While teamScopeInfo is on (default), peer rows serve only teams joined by this host\'s nodes — [this host] rows always show and the note field explains the scope. '
+            + 'While teamScopeInfo is on (default), the listing follows YOUR collaboration circle: remote rows serve only teams joined by this host\'s nodes, and [this host] session rows show only your own row, your canvas teams, and sessions sharing a team with you — an exposed node id invites mis-routing, so the directory does not advertise strangers. The owner\'s GUI panel keeps the full plane; teamScopeInfo: false opens it for tools too. '
             + 'Call this before a2a_route to pick a target team.',
         parameters: {
             query: { type: 'string', description: 'Optional keyword filter (case-insensitive substring over team/name/description).' },
@@ -4028,7 +4801,7 @@ ${message}`;
                             },
                         },
                     },
-                    note: { type: 'string', description: 'Present while teamScopeInfo scoping is on: the joined-team scope and how many remote rows it withheld ([this host] rows always show).' },
+                    note: { type: 'string', description: 'Present while teamScopeInfo scoping is on: the joined-team scope plus how many rows outside YOUR collaboration circle were withheld (remote/local split; the process team, your own row, and your canvas teams always show).' },
                 },
             },
             render: (args, value) => [{
@@ -4049,12 +4822,46 @@ ${message}`;
             // are host-internal facts and always survive. The note keeps the
             // model from reading a scoped listing as an empty fleet.
             let note;
-            if (config.teamScopeInfo) {
+            if (ownerTeamScopeInfo) {
                 const joined = joinedTeamScope();
                 const remoteBefore = teams.filter(row => row.local !== true).length;
                 teams = teams.filter(row => row.local === true || joined.has(row.team) || (row.teams ?? []).some(name => joined.has(name)));
-                const hidden = remoteBefore - teams.filter(row => row.local !== true).length;
-                note = `teamScopeInfo on: ${String(joined.size)} joined team${joined.size === 1 ? '' : 's'} on this host — ${String(hidden)} remote row${hidden === 1 ? '' : 's'} outside the joined scope withheld ([this host] rows always show). To widen the scope: the owner adds the EXACT team name to teamJoinAllowlist (patterns carry no mint rights, gh#11) and a session declares membership with a2a_team_join, or the owner sets teamScopeInfo: false for the open plane`;
+                const hiddenRemote = remoteBefore - teams.filter(row => row.local !== true).length;
+                // gh#39 (owner ruling: the listing ADVERTISES targets — an exposed
+                // node id invites a session with no collaboration relationship to
+                // route at it): [this host] session rows follow the CALLER's
+                // collaboration circle. The host's own GUI/panel keeps the full
+                // plane (the owner's eyes); the model-tool face is scoped.
+                let hiddenLocal = 0;
+                const callerAgent = exec.agent;
+                if (callerAgent !== undefined) {
+                    const callerId = String(callerAgent.id);
+                    const ownHandle = sessionTeamOf(callerAgent);
+                    const myCanvas = new Set(canvasStore.teamsOf(callerId));
+                    const myRoster = new Set(teamMemberships.teamsOf(callerId));
+                    const before = teams.length;
+                    teams = teams.filter(row => {
+                        if (row.local !== true)
+                            return true;
+                        if (row.team === config.team || row.team === ownHandle)
+                            return true;
+                        if (row.team.startsWith(`${config.team}/canvas/`))
+                            return myCanvas.has(row.name);
+                        // Another session's team row: visible only when we share a
+                        // canvas or a declared team with that session.
+                        const targetId8 = row.team.slice(config.team.length + 1);
+                        const target = [...sessionNodes.values()].find(agent => id8(String(agent.id)) === targetId8);
+                        if (target === undefined)
+                            return true; // unresolvable: keep (host fact)
+                        const targetId = String(target.id);
+                        const shares = [...canvasStore.teamsOf(targetId)].some(name => myCanvas.has(name))
+                            || [...teamMemberships.teamsOf(targetId)].some(name => myRoster.has(name));
+                        return shares;
+                    });
+                    hiddenLocal = before - teams.length;
+                }
+                const hidden = hiddenRemote + hiddenLocal;
+                note = `teamScopeInfo on: ${String(joined.size)} joined team${joined.size === 1 ? '' : 's'} on this host — ${String(hidden)} row${hidden === 1 ? '' : 's'} outside your collaboration circle withheld (${String(hiddenRemote)} remote, ${String(hiddenLocal)} local [this host] session rows; the process team, your own row, and your canvas teams always show). To widen the scope: a human composes the shared canvas team (the board drag), the owner adds the EXACT team name to teamJoinAllowlist (patterns carry no mint rights, gh#11), or the owner sets teamScopeInfo: false for the open plane`;
             }
             if (query === '')
                 return { ok: true, query: '', teams, ...(note !== undefined ? { note } : {}) };
@@ -4279,7 +5086,25 @@ ${message}`;
         },
         timeoutMs: config.routeTimeoutMs,
         presentCall: args => ({ card: 'generic', title: `A2A route → ${args.team}`, kind: 'other', rawInput: args }),
-        execute: async (args, exec) => routeTrunk(args, exec.agent, exec.signal),
+        execute: async (args, exec) => {
+            // Owner ruling (tool-layer interception): the PROCESS face (bare
+            // zone === config.team) keeps its host-level EXEMPTION on the network
+            // admission layer — receipts, quick dispatch and host-side routing
+            // still target it internally — but a MODEL TOOL call must not address
+            // it: the machine's own mailbox is not a member face, and letting a
+            // session route there would turn the host entrance into a group-free
+            // hop. Host-face entry (agent-less control routes, receipt ladders)
+            // never passes through this tool and stays untouched.
+            const requestedTeam = String(args.team ?? '').trim();
+            if (exec.agent !== undefined && requestedTeam === config.team) {
+                return {
+                    ok: false,
+                    error: `the process face "${config.team}" is the host's own mailbox — model tools must target a member face. Route to a session team handle ("${config.team}/<id8>" from a2a_teams) or a canvas team; receipts and quick dispatch reach the host face on their own paths.`,
+                    code: -32000,
+                };
+            }
+            return routeTrunk(args, exec.agent, exec.signal);
+        },
     }));
     /**
      * The routing trunk (0.6.9): the one failover sequence behind both the
@@ -4452,11 +5277,33 @@ ${message}`;
      */
     async function dispatchLocalCandidate(team, message, callerSession, contextId, signal, asyncMode = false, taskIdFromCaller, callbackAddress) {
         const webServer = ctx.get('webServer');
+        // W1 (boundary hardening): the local in-process candidate is an
+        // admission seam like any other — a JOINED session (zone/id8 caller
+        // face) must clear the same shared-team admission /a2a/direct applies,
+        // or a teamless local node could route to any session team by riding
+        // the cheapest path. The initiator face (bare node team) and
+        // foreign-zone labels are NOT gated here (F1b host-face rules, R-C
+        // pending) — only the joined face closes.
+        const joinedRefusal = joinedFaceAdmissionRefusal(callerSession, team);
+        if (joinedRefusal !== undefined) {
+            recordActivity('out', team, callerSession ?? 'local', false);
+            return { ok: false, error: joinedRefusal, code: -32000 };
+        }
         const canvasName = parseCanvasTeamName(team);
         let teamIsLocal = team === config.team
             || resolveAgentForTeam(team) !== undefined
             || joinedSessions.list().some(id => `${config.team}/${id8(id)}` === team)
             || (canvasName !== undefined && (canvasLiveAgent(canvasName) !== undefined || canvasColdMemberId(canvasName) !== undefined));
+        // gh#45 CLI mailbox: a delivery targeting a DEPOSITED CLI handle is
+        // local by definition — it lands in the deposit's mailbox (the CLI
+        // polls while alive; receipts and messages never wake anything).
+        const cliRow = cliDeposits.get(team);
+        if (cliRow !== undefined) {
+            cliDeposits.mail(team, callerSession ?? 'unknown', message);
+            recordActivity('in', team, callerSession ?? 'peer', true);
+            logger.info(`a2a: cli mailbox delivery for ${team} (from ${callerSession ?? 'unknown'})`);
+            return { ok: true, team, reply: `delivered to the mailbox of ${team} — the CLI polls while online`, task_id: taskIdFromCaller ?? '', context_id: contextId ?? '', task_status: 'TASK_STATE_COMPLETED' };
+        }
         // The native-teams claim probe is an await: pay it only when the four
         // cheap synchronous locality checks missed (a registry team is a local
         // candidate even though no session node backs it).
@@ -4543,7 +5390,7 @@ ${message}`;
                     ? callbackAddress
                     : routable ? callerSession : undefined;
                 const receiptHint = callerTeam === undefined ? '' : `\n\n(When done, route your outcome back with one call — a2a_route { team: "${callerTeam}", message: "[A2A receipt] task ${taskId} <one-line outcome>" }.)`;
-                steerRelay(target, `[A2A direct] (task ${taskId}) from "${callerSession ?? session}" (routed to ${team}) sent:\n\n${message}${receiptHint}`, callerTeam);
+                steerRelay(target, `[A2A direct] (task ${taskId}) ${fromClause(callerSession ?? session)} (routed to ${team}) sent:\n\n${message}${receiptHint}`, callerTeam);
                 armReceiptAutosend(target, taskId, callerTeam, message);
                 endRoute(flight);
                 recordActivity('out', team, 'local', true);