@nelsonlongxiang/dsh-open-a2a-net 0.6.24 → 0.6.26

package/lib/owner-settings.js

@@ -0,0 +1,100 @@
+/**
+ * Owner-settings persistence (gh#34): the three unlock knobs a remote
+ * build-out needs — teamJoinAllowlist / teamScopeInfo / announce — written
+ * into the HOME patch layer (DSH_HOME/cordis.patch.yml), the authoritative
+ * config surface (the 3081 lesson: the home-level patch wins over the
+ * profile layer). A conservative line editor: it locates the a2a entry's
+ * config: block and sets exactly these three keys, never touching anything
+ * else; a missing entry is appended in the canonical short-id form.
+ * @module @nelsonlongxiang/dsh-open-a2a-net/owner-settings
+ */
+/** The exact keys this module may touch, in wire order. */
+const KEYS = ['teamJoinAllowlist', 'teamScopeInfo', 'announce'];
+export function applyOwnerSettings(patchYaml, changes) {
+    const lines = patchYaml.split('\n');
+    // Find the a2a entry: `- id: a2a` / `- id: 'a2a'` variants.
+    let entryStart = -1;
+    for (let i = 0; i < lines.length; i += 1) {
+        const m = /^(\s*)-\s*id:\s*'?(a2a)'?\s*$/.exec(lines[i] ?? '');
+        if (m !== null) {
+            entryStart = i;
+            break;
+        }
+    }
+    let restartNeeded = false;
+    if (changes.announce !== undefined)
+        restartNeeded = true;
+    const writes = [];
+    if (changes.teamJoinAllowlist !== undefined) {
+        writes.push(changes.teamJoinAllowlist.length === 0
+            ? '    teamJoinAllowlist: []'
+            : `    teamJoinAllowlist: [${changes.teamJoinAllowlist.map(name => `'${name.replace(/'/g, "''")}'`).join(', ')}]`);
+    }
+    if (changes.teamScopeInfo !== undefined)
+        writes.push(`    teamScopeInfo: ${changes.teamScopeInfo ? 'true' : 'false'}`);
+    if (changes.announce !== undefined)
+        writes.push(`    announce: ${changes.announce ? 'true' : 'false'}`);
+    if (writes.length === 0)
+        return { yaml: patchYaml, restartNeeded };
+    if (entryStart === -1) {
+        // Append a canonical entry (the home patch is a top-level list).
+        const trailing = patchYaml.endsWith('\n') ? '' : '\n';
+        return { yaml: `${patchYaml}${trailing}- id: a2a\n  config:\n${writes.join('\n')}\n`, restartNeeded };
+    }
+    // Locate the config: block inside the entry (the entry's own indentation
+    // is two spaces under the `- id:` line).
+    let i = entryStart + 1;
+    let configAt = -1;
+    while (i < lines.length) {
+        const line = lines[i] ?? '';
+        if (/^\S/.test(line))
+            break; // next top-level entry
+        if (/^\s{2}config:\s*$/.test(line)) {
+            configAt = i;
+            break;
+        }
+        i += 1;
+    }
+    if (configAt === -1) {
+        // Insert a config: block right after the id line.
+        lines.splice(entryStart + 1, 0, '  config:', ...writes);
+        return { yaml: lines.join('\n'), restartNeeded };
+    }
+    // Rewrite exactly our keys inside the block; keep foreign lines verbatim.
+    const blockIndent = '    ';
+    let insertAt = configAt + 1;
+    for (const key of KEYS) {
+        let found = false;
+        let j = configAt + 1;
+        while (j < lines.length) {
+            const line = lines[j] ?? '';
+            if (/^\S/.test(line) || /^\s{2}\S/.test(line) && !/^\s{4}/.test(line) && !/^\s{2}config:/.test(lines[configAt] ?? '')) {
+                if (!line.startsWith(blockIndent) && !/^\s*$/.test(line) && j > configAt) {
+                    // leaving the block when a line is less indented than the keys
+                    if (!line.startsWith('    '))
+                        break;
+                }
+            }
+            const kv = new RegExp(`^\\s*${key}:`).exec(line);
+            if (kv !== null) {
+                const write = writes.find(w => w.trim().startsWith(`${key}:`));
+                if (write !== undefined) {
+                    lines[j] = write;
+                    found = true;
+                }
+                break;
+            }
+            if (/^\s*-\s*id:/.test(line))
+                break;
+            j += 1;
+        }
+        if (!found) {
+            const write = writes.find(w => w.trim().startsWith(`${key}:`));
+            if (write !== undefined) {
+                lines.splice(insertAt, 0, write);
+                insertAt += 1;
+            }
+        }
+    }
+    return { yaml: lines.join('\n'), restartNeeded };
+}

package/lib/peer-store.js

@@ -48,8 +48,38 @@ export class PeerStore {
             // The config is authoritative for a seed: it is (re)marked as one —
             // immune to eviction — and restarts from the initial score regardless
             // of the persisted one. Replacing the record wholesale keeps PeerRecord
-            // fields readonly.
-            this.peers.set(seed, { url: seed, score: INITIAL_SCORE, seed: true });
+            // fields readonly. The contact stamps are observations, not config:
+            // they carry over, so a restart does not blank a seed's lamp (gh#24).
+            const prior = this.peers.get(seed);
+            this.peers.set(seed, {
+                url: seed,
+                score: INITIAL_SCORE,
+                seed: true,
+                ...(prior?.lastContactAt !== undefined ? { lastContactAt: prior.lastContactAt } : {}),
+                ...(prior?.lastContactOk !== undefined ? { lastContactOk: prior.lastContactOk } : {}),
+            });
+        }
+        // The config is authoritative BOTH ways (board-stale-peer fix, 0.6.26):
+        // a persisted record may carry seed:true from an OLD config generation
+        // whose operator already removed the URL — left alone, a dead URL keeps
+        // its immunity forever and the workbench board shows a peer that can
+        // never evict (owner sighting: `.157:13082` survived its config removal
+        // for days). Downgrade those to referral-learned, keeping the score so
+        // noteFailure can decay and evict them honestly.
+        const current = new Set(seeds.filter(seed => seed !== ''));
+        for (const [url, peer] of this.peers) {
+            if (peer.seed && !current.has(url)) {
+                // Downgrade keeps every learned fact (score, session, contact
+                // stamps) — only the immunity bit changes.
+                this.peers.set(url, {
+                    url,
+                    score: peer.score,
+                    seed: false,
+                    ...(peer.session !== undefined ? { session: peer.session } : {}),
+                    ...(peer.lastContactAt !== undefined ? { lastContactAt: peer.lastContactAt } : {}),
+                    ...(peer.lastContactOk !== undefined ? { lastContactOk: peer.lastContactOk } : {}),
+                });
+            }
         }
     }
     /**
@@ -106,18 +136,24 @@ export class PeerStore {
         this.persist();
     }
     /**
-     * Note a failed fetch of one peer. A non-seed's score drops; an
-     * at-or-below-floor peer is evicted, so a bad referral disappears rather
-     * than degrading forever. Seeds are config-owned and never penalized.
+     * Note a failed fetch of one peer. Every peer records the failed attempt
+     * (the host-rail lamp turns red for a seed and a learned peer alike,
+     * gh#24); only a non-seed's score drops, and an at-or-below-floor peer is
+     * evicted, so a bad referral disappears rather than degrading forever.
+     * Seeds are config-owned and never penalized.
      * @param url - the peer that failed.
      */
     noteFailure(url) {
         const peer = this.peers.get(url);
-        if (peer === undefined || peer.seed)
+        if (peer === undefined)
             return;
-        peer.score -= FAILURE_PENALTY;
-        if (peer.score <= EVICTION_FLOOR)
-            this.peers.delete(url);
+        peer.lastContactAt = Date.now();
+        peer.lastContactOk = false;
+        if (!peer.seed) {
+            peer.score -= FAILURE_PENALTY;
+            if (peer.score <= EVICTION_FLOOR)
+                this.peers.delete(url);
+        }
         this.persist();
     }
     /**
@@ -129,8 +165,24 @@ export class PeerStore {
         if (peer === undefined)
             return;
         peer.score += SUCCESS_REWARD;
+        peer.lastContactAt = Date.now();
+        peer.lastContactOk = true;
         this.persist();
     }
+    /**
+     * The epoch ms of the last contact attempt with one tracked peer (#20 W-C
+     * host-rail health lamp), or undefined when the store never touched it.
+     */
+    lastContact(url) {
+        return this.peers.get(url)?.lastContactAt;
+    }
+    /**
+     * Whether the last contact attempt succeeded (gh#24) — undefined when no
+     * attempt was ever recorded.
+     */
+    lastContactOk(url) {
+        return this.peers.get(url)?.lastContactOk;
+    }
     /**
      * The current quality score of one tracked peer, for state reporting.
      * @param url - the peer URL.
@@ -189,6 +241,10 @@ export class PeerStore {
                     score: typeof peer.score === 'number' && Number.isFinite(peer.score) ? peer.score : INITIAL_SCORE,
                     seed: peer.seed === true,
                     ...(typeof peer.session === 'string' && peer.session !== '' ? { session: peer.session } : {}),
+                    // gh#24: the contact stamp round-trips (a restart must not forget
+                    // when we last reached the peer, nor whether it answered).
+                    ...(typeof peer.lastContactAt === 'number' && Number.isFinite(peer.lastContactAt) ? { lastContactAt: peer.lastContactAt } : {}),
+                    ...(typeof peer.lastContactOk === 'boolean' ? { lastContactOk: peer.lastContactOk } : {}),
                 });
             }
         }

package/lib/task-ledger.js

@@ -60,6 +60,29 @@ export function briefOf(message) {
  * lazy — every read/write entry point sweeps first.
  */
 export const TASK_STALE_TTL_MS = 24 * 60 * 60_000;
+const ARCHIVE_ENDS = ['receipt', 'echo', 'abandoned', 'cancelled'];
+/** Summary marker {@link TaskLedger.resolveEcho} writes on echo-settled rows. */
+const ECHO_SUMMARY = '(settled by content echo)';
+/**
+ * How one archived row ended (gh#31). The recorded field wins; legacy rows
+ * fall back to the summary markers this ledger writes itself. The fallback
+ * reads a receipt-settled row's summary, which is the peer's text, so it is
+ * only as exact as the legacy data allows.
+ * @param row - the archived record.
+ * @returns the archive path that ended it.
+ */
+export function archivedEndedBy(row) {
+    if (row.endedBy !== undefined)
+        return row.endedBy;
+    const summary = row.summary ?? '';
+    if (summary.startsWith('caller-cancelled'))
+        return 'cancelled';
+    if (summary.startsWith('caller-abandoned'))
+        return 'abandoned';
+    if (summary === ECHO_SUMMARY)
+        return 'echo';
+    return 'receipt';
+}
 /**
  * Bounded outbound-task ledger with whole-file persistence. Pure of any
  * routing knowledge: callers {@link track} a task when a route leaves it
@@ -247,6 +270,8 @@ export class TaskLedger {
                 resolvedAt,
                 summary: `caller-abandoned${cause}`,
                 outcome: 'abandoned',
+                endedBy: 'abandoned',
+                ...(record.direction !== undefined ? { direction: record.direction } : {}),
             });
             this.persist();
             return { outcome: 'cleared', taskId, archivedAt: resolvedAt };
@@ -286,6 +311,8 @@ export class TaskLedger {
                 resolvedAt,
                 summary: `caller-cancelled${cause}`,
                 outcome: 'abandoned',
+                endedBy: 'cancelled',
+                ...(record.direction !== undefined ? { direction: record.direction } : {}),
             });
             this.persist();
             return {
@@ -334,6 +361,8 @@ export class TaskLedger {
                 ...(summary !== '' ? { summary } : {}),
                 ...(envelopeOutcome !== undefined ? { outcome: envelopeOutcome } : {}),
                 ...(elapsedMs !== undefined ? { elapsedMs } : {}),
+                endedBy: 'receipt',
+                ...(record.direction !== undefined ? { direction: record.direction } : {}),
             });
             this.persist();
             return {
@@ -354,7 +383,11 @@ export class TaskLedger {
         // rewrite the abandonment outcome — the caller stopped waiting by choice.
         // Record that the target did answer later; keep the decision verbatim and
         // pin the projected verdict to 'abandoned'.
-        const callerEnded = CALLER_ENDED_PREFIX.test(settled.summary ?? '');
+        // gh#31: the recorded end wins; the summary prefix only decides legacy
+        // rows (a receipt-settled row's summary is the peer's own text).
+        const callerEnded = settled.endedBy !== undefined
+            ? settled.endedBy === 'abandoned' || settled.endedBy === 'cancelled'
+            : CALLER_ENDED_PREFIX.test(settled.summary ?? '');
         this.archived = [
             {
                 ...settled,
@@ -409,7 +442,9 @@ export class TaskLedger {
                 startedAt: record.startedAt,
                 ...(record.contextId !== undefined ? { contextId: record.contextId } : {}),
                 resolvedAt: this.now(),
-                summary: '(settled by content echo)',
+                summary: ECHO_SUMMARY,
+                endedBy: 'echo',
+                ...(record.direction !== undefined ? { direction: record.direction } : {}),
             });
             settled.push(record.taskId);
         }
@@ -468,6 +503,8 @@ export class TaskLedger {
                             ...(typeof entry.summary === 'string' && entry.summary !== '' ? { summary: entry.summary } : {}),
                             ...(typeof entry.outcome === 'string' && RECEIPT_OUTCOMES.includes(entry.outcome) ? { outcome: entry.outcome } : {}),
                             ...(typeof entry.lateReceiptAt === 'number' && Number.isFinite(entry.lateReceiptAt) ? { lateReceiptAt: entry.lateReceiptAt } : {}),
+                            ...(typeof entry.endedBy === 'string' && ARCHIVE_ENDS.includes(entry.endedBy) ? { endedBy: entry.endedBy } : {}),
+                            ...(entry.direction === 'inbound' || entry.direction === 'outbound' ? { direction: entry.direction } : {}),
                         });
                         continue;
                     }
@@ -478,7 +515,9 @@ export class TaskLedger {
                         startedAt: typeof entry.startedAt === 'number' && Number.isFinite(entry.startedAt) ? entry.startedAt : this.now(),
                         ...(typeof entry.contextId === 'string' && entry.contextId !== '' ? { contextId: entry.contextId } : {}),
                         ...(typeof entry.brief === 'string' && entry.brief !== '' ? { brief: entry.brief } : {}),
-                        ...(entry.direction === 'inbound' ? { direction: 'inbound' } : {}),
+                        // gh#31: both sides round-trip — /state omits direction only when
+                        // it is unknown, so a restored outbound row must not lose it.
+                        ...(entry.direction === 'inbound' || entry.direction === 'outbound' ? { direction: entry.direction } : {}),
                         ...(entry.receiptExpected === false ? { receiptExpected: false } : {}),
                         status: entry.status === 'dead' ? 'dead' : 'pending',
                         ...(entry.status === 'dead'
@@ -509,6 +548,8 @@ export class TaskLedger {
                         ...(typeof entry.summary === 'string' && entry.summary !== '' ? { summary: entry.summary } : {}),
                         ...(typeof entry.outcome === 'string' && RECEIPT_OUTCOMES.includes(entry.outcome) ? { outcome: entry.outcome } : {}),
                         ...(typeof entry.lateReceiptAt === 'number' && Number.isFinite(entry.lateReceiptAt) ? { lateReceiptAt: entry.lateReceiptAt } : {}),
+                        ...(typeof entry.endedBy === 'string' && ARCHIVE_ENDS.includes(entry.endedBy) ? { endedBy: entry.endedBy } : {}),
+                        ...(entry.direction === 'inbound' || entry.direction === 'outbound' ? { direction: entry.direction } : {}),
                     });
                 }
             }

package/lib/types/cli-deposit.d.ts

@@ -0,0 +1,53 @@
+/** Owner ruling ③: the default AND maximum online window. */
+export declare const CLI_DEPOSIT_TTL_MS: number;
+/** Owner ruling ①: <agent-name>/<uuid·8B>. The name is [a-z0-9-]{1,32}. */
+export declare const CLI_HANDLE_RE: RegExp;
+/** One deposited CLI identity. */
+export interface CliDeposit {
+    readonly handle: string;
+    /** The bare agent-name zone (card.team). */
+    readonly name: string;
+    /** The CLI's signed card, verbatim wire JSON (served back as-is). */
+    readonly cardJson: string;
+    readonly depositedAt: number;
+    readonly expiresAt: number;
+}
+/** One mailbox entry for a deposited handle. */
+export interface CliMail {
+    readonly at: number;
+    readonly from: string;
+    readonly text: string;
+}
+export declare class CliDepositStore {
+    private readonly path;
+    private deposits;
+    private mailbox;
+    private now;
+    constructor(path: string, options?: {
+        now?: () => number;
+    });
+    /** Deposit (or refresh) one CLI card. TTL is clamped to the 4h ruling. */
+    deposit(cardJson: string): {
+        ok: true;
+        handle: string;
+        expiresAt: number;
+    } | {
+        ok: false;
+        error: string;
+    };
+    revoke(handle: string): boolean;
+    /** Active deposits (sweeping expired ones — ruling ③ auto-deregister). */
+    list(): readonly CliDeposit[];
+    get(handle: string): CliDeposit | undefined;
+    /** Card-serve rows: the handle + display name, marked cli (no wake). */
+    cardRows(): Array<{
+        team: string;
+        name: string;
+        description: string;
+    }>;
+    mail(handle: string, from: string, text: string): void;
+    readMail(handle: string): readonly CliMail[];
+    private sweep;
+    private persist;
+    private restore;
+}

package/lib/types/exposure-store.d.ts

@@ -0,0 +1,45 @@
+/**
+ * #19 exposure tiers (ruling final, D3/D4): per-session visibility tier on
+ * the A2A network — 'linked' (the default floor: visible to linked callers
+ * per the W3 gate) or 'fleet' (the member's voluntary opt-UP: visible to
+ * any fleet peer). v1 carries exactly these two tiers (D5: no private
+ * residue below linked).
+ *
+ * D3: joins default to linked — existing members transfer automatically
+ * (tier absence IS linked, so no migration is needed); a member may raise
+ * itself to fleet and lower itself back (fleet is an opt-up, linked is the
+ * floor, never a ceiling decision taken from the member).
+ *
+ * D4 (成文, zero group knobs): a GROUP's visibility equals its STRICTEST
+ * member tier — one linked member keeps the group linked-level. The rule
+ * binds every future group surface (canvas listing, fleet feeds); v1 has
+ * no group-level tier API by design, so the rule needs no enforcement
+ * seam yet.
+ * @module @nelsonlongxiang/dsh-open-a2a-net/exposure-store
+ */
+/** The two v1 tiers (D5: nothing below linked exists). */
+export type ExposureTier = 'linked' | 'fleet';
+/** The persisted tier document (whole-file read/write, small by design). */
+export interface ExposureSnapshot {
+    readonly tiers?: Readonly<Record<string, ExposureTier>>;
+}
+export declare class ExposureStore {
+    private readonly path;
+    private tiers;
+    /**
+     * @param path - persistence file (`<dsh-home>/a2a/exposure.json`); empty = no persistence.
+     */
+    constructor(path: string);
+    /**
+     * The session's tier — 'linked' unless explicitly raised to 'fleet'
+     * (D3: existing members transfer as linked automatically).
+     */
+    tierOf(id: string): ExposureTier;
+    /**
+     * Set the session's tier. Members may opt up to fleet and back down to
+     * linked; there is no tier below linked (D5) and no group-level knob
+     * (D4 — group visibility derives from the strictest member).
+     */
+    setTier(id: string, tier: ExposureTier): void;
+    private persist;
+}

package/lib/types/index.d.ts

@@ -103,6 +103,11 @@ export interface Config {
      * self-asserted already-linked name must not pass on shape alone).
      */
     readonly originClaimWindow: boolean;
+    /**
+     * #19 D2: card-face sessionTeams excerpt exposure — 'full' | 'masked'
+     * | 'off' (owner-level; default full). See the schema comment.
+     */
+    readonly exposureExcerpt: 'full' | 'masked' | 'off';
     /**
      * Override for the OriginClaim callerUrl anchor. Loopback-bound hosts
      * behind a pocket tunnel must name the card URL peers can actually

package/lib/types/owner-settings.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Owner-settings persistence (gh#34): the three unlock knobs a remote
+ * build-out needs — teamJoinAllowlist / teamScopeInfo / announce — written
+ * into the HOME patch layer (DSH_HOME/cordis.patch.yml), the authoritative
+ * config surface (the 3081 lesson: the home-level patch wins over the
+ * profile layer). A conservative line editor: it locates the a2a entry's
+ * config: block and sets exactly these three keys, never touching anything
+ * else; a missing entry is appended in the canonical short-id form.
+ * @module @nelsonlongxiang/dsh-open-a2a-net/owner-settings
+ */
+export interface OwnerSettings {
+    teamJoinAllowlist?: string[];
+    teamScopeInfo?: boolean;
+    announce?: boolean;
+}
+export declare function applyOwnerSettings(patchYaml: string, changes: OwnerSettings): {
+    yaml: string;
+    restartNeeded: boolean;
+};

package/lib/types/peer-store.d.ts

@@ -25,6 +25,13 @@ export interface PeerRecord {
     readonly seed: boolean;
     /** The signed-card session the peer served last, when a fetch revealed it. */
     readonly session?: string;
+    /** Epoch ms of the last contact attempt (success or failure) — the host
+     *  rail's health lamp reads the recency of this (#20 W-C). */
+    lastContactAt?: number;
+    /** Whether that last attempt SUCCEEDED (gh#24): the lamp distinguishes a
+     *  fresh success (green) from a fresh failure (red); recency alone made
+     *  a dead peer glow green. */
+    lastContactOk?: boolean;
 }
 /** The persisted store document (whole-file read/write, small by design). */
 export interface PeerStoreSnapshot {
@@ -77,9 +84,11 @@ export declare class PeerStore {
      */
     drop(url: string): void;
     /**
-     * Note a failed fetch of one peer. A non-seed's score drops; an
-     * at-or-below-floor peer is evicted, so a bad referral disappears rather
-     * than degrading forever. Seeds are config-owned and never penalized.
+     * Note a failed fetch of one peer. Every peer records the failed attempt
+     * (the host-rail lamp turns red for a seed and a learned peer alike,
+     * gh#24); only a non-seed's score drops, and an at-or-below-floor peer is
+     * evicted, so a bad referral disappears rather than degrading forever.
+     * Seeds are config-owned and never penalized.
      * @param url - the peer that failed.
      */
     noteFailure(url: string): void;
@@ -88,6 +97,16 @@ export declare class PeerStore {
      * @param url - the peer that answered with a verified card.
      */
     noteSuccess(url: string): void;
+    /**
+     * The epoch ms of the last contact attempt with one tracked peer (#20 W-C
+     * host-rail health lamp), or undefined when the store never touched it.
+     */
+    lastContact(url: string): number | undefined;
+    /**
+     * Whether the last contact attempt succeeded (gh#24) — undefined when no
+     * attempt was ever recorded.
+     */
+    lastContactOk(url: string): boolean | undefined;
     /**
      * The current quality score of one tracked peer, for state reporting.
      * @param url - the peer URL.

package/lib/types/task-ledger.d.ts

@@ -52,6 +52,8 @@ export declare const TASK_STALE_TTL_MS: number;
 export type TaskStatus = 'pending' | 'dead';
 /** F5 layer-3: why a dead row aged out (stamped by the sweep at flip time). */
 export type DeadReason = 'fire-forget' | 'unconsumed';
+/** gh#31: which archive path ended a row — a receipt, a content echo, or the caller. */
+export type ArchiveEnd = 'receipt' | 'echo' | 'abandoned' | 'cancelled';
 /** One tracked outbound task still in the owed book (unsettled). */
 export interface TaskRecord {
     readonly taskId: string;
@@ -111,7 +113,23 @@ export interface ArchivedRecord {
      * recorded as metadata only, never promoted to resolution.
      */
     readonly lateReceiptAt?: number;
+    /**
+     * gh#31: which archive path ended the row, recorded at archive time. Absent
+     * on rows archived before the field — {@link archivedEndedBy} derives it.
+     */
+    readonly endedBy?: ArchiveEnd;
+    /** gh#31: which side of the wire the row served, copied from the owed row (absent on rows archived before the field). */
+    readonly direction?: 'inbound' | 'outbound';
 }
+/**
+ * How one archived row ended (gh#31). The recorded field wins; legacy rows
+ * fall back to the summary markers this ledger writes itself. The fallback
+ * reads a receipt-settled row's summary, which is the peer's text, so it is
+ * only as exact as the legacy data allows.
+ * @param row - the archived record.
+ * @returns the archive path that ended it.
+ */
+export declare function archivedEndedBy(row: ArchivedRecord): ArchiveEnd;
 /** Result of an explicit caller-side abandon. Total and never-thrown. */
 export type AbandonOutcome = 'cleared' | 'already-terminal' | 'unknown';
 /** Structured verdict for one {@link TaskLedger.abandon} call (consumer contract: idempotent). */

package/lib/types/types.d.ts

@@ -21,6 +21,16 @@ export interface A2aPeerCard {
      * not by this card's signature.
      */
     readonly peers?: readonly string[];
+    /**
+     * gh#41 fleet planning: this host's own canvas-team organization, served
+     * fresh on the FULL card (linked callers only) — each entry names a team
+     * and its member handles so any linked peer's board can render the org.
+     */
+    readonly canvasOrg?: ReadonlyArray<{
+        name: string;
+        team: string;
+        members: readonly string[];
+    }>;
     /**
      * Joined session teams this peer currently dispatches. Unsigned and
      * optional: served fresh at read time, each entry is a team name the

package/nexus-stage/src/canvas-ops.ts

@@ -20,8 +20,8 @@ export type RosterOp = { op: 'remove' | 'add'; id: string }
 /** The five user-facing write actions (one per design.md §3.3 row), plus the two network join/leave actions the panel-slim migration moved into the planning view. */
 export type CanvasAction =
   | { type: 'create-team'; name: string; ids: readonly string[]; /** true when the model had no such team before this action (a serial failure then leaves a ghost EMPTY team on the host — the wire compensates with a remove). */ created?: boolean }
-  | { type: 'add-member'; team: string; ids: readonly string[] }
-  | { type: 'remove-member'; team: string; ids: readonly string[] }
+  | { type: 'add-member'; team: string; ids: readonly string[]; /** gh#41: set when the target frame is a REMOTE peer's team — the wire routes the op through the host fleet relay. */ fleetPeer?: string }
+  | { type: 'remove-member'; team: string; ids: readonly string[]; /** gh#41: see add-member. */ fleetPeer?: string }
   | { type: 'remove-team'; name: string }
   /** `ops` comes from reorderOps() at emit time; the wire stays model-free. */
   | { type: 'reorder'; team: string; ops: ReadonlyArray<RosterOp> }

package/nexus-stage/src/federation.ts

@@ -26,6 +26,12 @@ export interface InFlightRow {
 export interface PeerRow {
   url: string
   score?: number
+  /** gh#20 W-A: this host's link view — 'linked' (operator-established
+   * basis holds) | 'stranger' (no link); absent = the host predates the
+   * field (render neutral). */
+  link?: 'linked' | 'stranger'
+  /** Signature-valid cached card held (the badge tick/cross). */
+  verified?: boolean
 }
 
 /** A team frame's titlebar anchor {fx + fw/2, fy + 11} (edges.ts lockstep). */