@nelsonlongxiang/dsh-open-a2a-net 0.6.24 → 0.6.26

package/nexus-stage/src/main.ts

@@ -19,10 +19,52 @@ const app = document.getElementById('app')!
 // gh#9 §10: the host injects the control-plane key into the shell when
 // apiKey is configured — stamp it on every /__dsh_a2a write so the GUI
 // survives a keyed host (same-origin disclosure only, see the serve site).
-const CONTROL_KEY = (window as unknown as { __DSH_A2A_KEY__?: string }).__DSH_A2A_KEY__ ?? ''
+// gh#40: a REMOTE face (LAN-bound test host, tunnel) serves the shell
+// WITHOUT the injected key by design — the credential must not leak to any
+// network fetcher. The operator still needs the panel there, so the key
+// can be typed once: sessionStorage is browser-local (never transmitted in
+// the page), stamped on the same X-API-Key header thereafter.
+const storedKey = (() => { try { return window.sessionStorage.getItem('dsh_a2a_key') ?? '' } catch { return '' } })()
+const CONTROL_KEY = (window as unknown as { __DSH_A2A_KEY__?: string }).__DSH_A2A_KEY__ ?? storedKey
 const controlFetch = (path: string, init: RequestInit = {}): Promise<Response> =>
   fetch(path, { ...init, headers: { ...(init.headers as Record<string, string> | undefined ?? {}), ...(CONTROL_KEY !== '' ? { 'X-API-Key': CONTROL_KEY } : {}) } })
 
+// gh#40: key-entry affordance — mounts BEFORE the panel when the shell came
+// keyless (remote face) and the control plane answers 401. One input, one
+// submit; the stored key survives until the tab closes.
+if (CONTROL_KEY === '') {
+  void controlFetch('/__dsh_a2a/owner-settings').then(res => {
+    if (res.status !== 401) return
+    const gate = document.createElement('div')
+    gate.className = 'nexus-keygate'
+    gate.style.cssText = 'position:fixed;inset:0;display:flex;align-items:center;justify-content:center;flex-direction:column;gap:10px;background:#fff;z-index:9999;font:14px/1.5 system-ui,sans-serif;color:#000'
+    const label = document.createElement('div')
+    label.textContent = '此面板经远程面打开（密钥不随页面下发）——输入控制密钥'
+    const input = document.createElement('input')
+    input.type = 'password'
+    input.placeholder = 'X-API-Key'
+    input.setAttribute('aria-label', '控制密钥')
+    const submit = document.createElement('button')
+    submit.type = 'button'
+    submit.textContent = '进入面板'
+    const err = document.createElement('div')
+    err.style.color = '#b00'
+    const tryKey = (): void => {
+      const v = input.value.trim()
+      if (v === '') return
+      void fetch('/__dsh_a2a/owner-settings', { headers: { 'X-API-Key': v } }).then(r => {
+        if (r.status === 401) { err.textContent = '密钥不对，再试一次'; return }
+        try { window.sessionStorage.setItem('dsh_a2a_key', v) } catch { /* blocked site data: keep in-page */ }
+        window.location.reload()
+      })
+    }
+    submit.addEventListener('click', tryKey)
+    input.addEventListener('keydown', ev => { if (ev.key === 'Enter') tryKey() })
+    gate.append(label, input, submit, err)
+    document.body.appendChild(gate)
+  })
+}
+
 const faultBadge = document.createElement('div')
 faultBadge.className = 'nexus-fault'
 app.appendChild(faultBadge)
@@ -113,6 +155,23 @@ const canvasWire = createCanvasWire({
 })
 
 function runCanvasAction(a: CanvasAction): Promise<boolean> {
+  // gh#41: a remote-frame drop forks to the fleet relay — THIS host signs
+  // the envelope and forwards; the peer's link gate authorizes the write.
+  if ((a.type === 'add-member' || a.type === 'remove-member') && a.fleetPeer !== undefined) {
+    return (async () => {
+      for (const id of a.ids) {
+        const r = await controlFetch('/__dsh_a2a/fleet-canvas-op', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ peer: a.fleetPeer, op: a.type === 'add-member' ? 'add-member' : 'remove-member', name: a.team, id }),
+          cache: 'no-store',
+        }).catch(() => undefined)
+        const body = r !== undefined ? await r.json().catch(() => undefined) : undefined
+        if (body?.ok !== true) return false
+      }
+      return true
+    })()
+  }
   switch (a.type) {
     case 'create-team': return canvasWire.createTeam(a.name, a.ids, a.created)
     case 'add-member': return canvasWire.addMembers(a.team, a.ids)
@@ -154,6 +213,27 @@ async function fetchLayout(): Promise<unknown> {
 // ─── The workbench ───
 const bench = createWorkbench({
   now: () => Date.now(),
+  // gh#34: the owner three-key panel rides the control face.
+  async ownerSettingsRead() {
+    try {
+      const res = await controlFetch('/__dsh_a2a/owner-settings')
+      return await res.json()
+    } catch {
+      return { ok: false, error: 'unreachable' }
+    }
+  },
+  async ownerSettingsWrite(changes) {
+    try {
+      const res = await controlFetch('/__dsh_a2a/owner-settings', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(changes),
+      })
+      return await res.json()
+    } catch {
+      return { ok: false, error: 'unreachable' }
+    }
+  },
   async abandon(taskId, reason) {
     try {
       const res = await controlFetch('/__dsh_a2a/tasks/abandon', {
@@ -231,8 +311,10 @@ const bench = createWorkbench({
     // sessions included; the network directory is not the reading gate.
     try {
       const res = await controlFetch('/__dsh_a2a/session-log')
-      const body = (await res.json().catch(() => ({}))) as { ok?: boolean; sessions?: Array<{ id: string; mtimeMs: number; sizeBytes: number }>; error?: string }
-      return { ok: res.ok && body.ok === true, sessions: body.sessions, error: body.error ?? (res.ok ? undefined : `HTTP ${res.status}`) }
+      const body = (await res.json().catch(() => ({}))) as { ok?: boolean; sessions?: Array<{ id: string; mtimeMs: number; sizeBytes: number }>; count?: number; error?: string }
+      // count: how many logs the host holds — the list face caps at 50, so the
+      // directory can say it is showing 50 of N instead of silently truncating.
+      return { ok: res.ok && body.ok === true, sessions: body.sessions, count: typeof body.count === 'number' ? body.count : undefined, error: body.error ?? (res.ok ? undefined : `HTTP ${res.status}`) }
     } catch (error) {
       return { ok: false, error: error instanceof Error ? error.message : String(error) }
     }
@@ -346,7 +428,18 @@ async function poll(): Promise<void> {
         ...(typeof r.origin === 'string' && r.origin !== '' ? { origin: r.origin } : {}),
         ...(Array.isArray(r.teams) && r.teams.length > 0 ? { teams: r.teams.filter((t): t is string => typeof t === 'string' && t !== '') } : {}),
       }))
-    planning.reconcile({ sessions: allSessions, teams, peerCount: peers.length, peers, inFlight, remoteTeams })
+    // gh#41: the peers' published canvas org rides the board (remote frames).
+    const peerOrg = (body.peerOrg as unknown[] ?? [])
+      .filter((r): r is { url?: unknown; org?: unknown } => r !== null && typeof r === 'object')
+      .filter(r => typeof r.url === 'string' && Array.isArray(r.org))
+      .map(r => ({
+        url: r.url as string,
+        org: (r.org as unknown[])
+          .filter((e): e is { name?: unknown; team?: unknown; members?: unknown } => e !== null && typeof e === 'object')
+          .filter(e => typeof e.team === 'string' && e.team !== '')
+          .map(e => ({ name: typeof e.name === 'string' ? e.name : '', team: e.team as string, members: Array.isArray(e.members) ? e.members.filter((m): m is string => typeof m === 'string') : [] })),
+      }))
+    planning.reconcile({ sessions: allSessions, teams, peerCount: peers.length, peers, inFlight, remoteTeams, peerOrg })
   } catch (err) {
     fault(`state 轮询失败：${String(err)}`)
   }

package/nexus-stage/src/planning-menus.ts

@@ -57,8 +57,15 @@ export function createPlanningMenus(d: MenusDeps): PlanningMenus {
 
   function startCreateFromSelection(): void {
     if (dialog !== null) return
-    // Peer cards are not joinable sessions: they never enter 建队 ids.
-    const ids = selectedByY().filter(id => model.getNode(id)?.remote !== true)
+    // gh#20 W-B: a mixed local+remote selection composes a cross-host team —
+    // peers ride their zone/id8 handle at the server boundary. A peer
+    // without a handle yet (no remote team rows) cannot join; drop it and
+    // let the ≥2 floor judge the rest.
+    const ids = selectedByY().filter(id => {
+      const node = model.getNode(id)
+      if (node === undefined) return false
+      return node.remote !== true || (node.remoteHandle !== undefined && node.remoteHandle !== '')
+    })
     if (ids.length < 2) { d.notice('info', '框选至少 2 个会话节点'); return }
     openNameDialog(ids)
   }
@@ -313,9 +320,14 @@ export function createPlanningMenus(d: MenusDeps): PlanningMenus {
   /** Context menu from a real contextmenu event or the keyboard equivalent. */
   function contextMenuAt(x: number, y: number, target: Element | null): void {
     if (dialog !== null) return
-    // Peer endpoints are read-only entries: no roster menu for them.
+    // gh#20 W-B: a peer WITH a remote handle gets the roster menu (加入团队
+    // composes a cross-host team through the handle boundary); a peer
+    // WITHOUT one stays a read-only entry (nothing the server would accept).
     const probeNode = target?.closest<HTMLElement>('.p-node') ?? null
-    if (probeNode !== null && model.getNode(probeNode.dataset.id ?? '')?.remote === true) return
+    if (probeNode !== null) {
+      const probe = model.getNode(probeNode.dataset.id ?? '')
+      if (probe?.remote === true && (probe.remoteHandle === undefined || probe.remoteHandle === '')) return
+    }
     const nodeEl = probeNode
     const headEl = target?.closest<HTMLElement>('.p-frame-head') ?? null
     if (nodeEl !== null) {

package/nexus-stage/src/planning-types.ts

@@ -24,6 +24,9 @@ export interface PlanningInput {
   inFlight?: ReadonlyArray<InFlightRow>
   /** Remote team directory rows (PR D v1 ruling): grouped under peer cards. */
   remoteTeams?: ReadonlyArray<RemoteTeamRow>
+  /** gh#41 fleet planning: each tracked peer's published canvas org —
+   *  rendered as REMOTE team frames (read + cross-host regulation). */
+  peerOrg?: ReadonlyArray<{ url: string; org: ReadonlyArray<{ name: string; team: string; members: readonly string[] }> }>
 }
 
 /** Screen-width class a viewport is remembered under (window width, not board width — collapsing the rail must not switch buckets). */

package/nexus-stage/src/planning-view.ts

@@ -383,22 +383,41 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
       el.classList.toggle('selected', model.isSelected(n.id))
       el.setAttribute('aria-selected', String(model.isSelected(n.id)))
       const host = n.id.slice('peer-'.length)
-      const nmText = n.remote === true ? host : displayName(n)
+      // gh#38: member cards show their display NAME as the title (the whole
+      // point is picking a person); peer HOST cards keep the host spelling.
+      const nmText = n.id.startsWith('member-')
+        ? (n.name !== undefined && n.name !== '' ? n.name : n.team)
+        : n.remote === true ? host : displayName(n)
       const nmEl = el.querySelector<HTMLElement>('.nm-text')!
       if (nmEl.textContent !== nmText) nmEl.textContent = nmText
       const subEl = el.querySelector<HTMLElement>('.sub')!
       const subBase = n.team + (n.name !== undefined && n.name !== '' ? ' · ' + n.name : '')
       // When the title fell back to the team label the sub line would repeat
       // it verbatim; collapse to the cross-team suffix alone in that case.
-      const subText = n.remote === true
-        ? remoteSubText(host)
-        : (subBase === nmText ? '' : subBase)
-          + (n.memberships.length > 1 ? ` · 跨队×${n.memberships.length}` : '')
-          + (n.teams !== undefined && n.teams.length > 0 ? ` · 网络队×${n.teams.length}` : '')
+      const subText = n.id.startsWith('member-')
+        ? n.team
+        : n.remote === true
+          ? remoteSubText(host)
+          : (subBase === nmText ? '' : subBase)
+            + (n.memberships.length > 1 ? ` · 跨队×${n.memberships.length}` : '')
+            + (n.teams !== undefined && n.teams.length > 0 ? ` · 网络队×${n.teams.length}` : '')
       if (subEl.textContent !== subText) subEl.textContent = subText
       const prioEl = el.querySelector<HTMLElement>('.prio')!
-      const prioText = n.remote === true ? 'peer' : (n.memberships[0] !== undefined ? `P${n.memberships[0]!.index}` : '')
-      if (prioEl.textContent !== prioText) prioEl.textContent = prioText
+      if (n.remote === true) {
+        // gh#20 W-A: the peer badge — link class colors the chip (linked
+        // green / stranger gray), the verified tick/cross rides after it.
+        // An absent link field (older host) renders the neutral 'peer'.
+        const info = peerInfoByHost.get(host)
+        const cls = info?.link === 'linked' ? 'lnk-linked' : info?.link === 'stranger' ? 'lnk-stranger' : ''
+        if (prioEl.className !== `prio mono ${cls}`.trim()) prioEl.className = `prio mono ${cls}`.trim()
+        const mark = info === undefined ? '' : info.verified === true ? '✓' : '✗'
+        const badge = (info?.link ?? 'peer') + mark
+        if (prioEl.textContent !== badge) prioEl.textContent = badge
+      } else {
+        if (prioEl.className !== 'prio mono') prioEl.className = 'prio mono'
+        const prioText = n.memberships[0] !== undefined ? `P${n.memberships[0]!.index}` : ''
+        if (prioEl.textContent !== prioText) prioEl.textContent = prioText
+      }
     }
     for (const [id, el] of [...nodeEls]) {
       if (!seen.has(id)) { el.remove(); nodeEls.delete(id) }
@@ -433,6 +452,8 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
   let lastPeers: ReadonlyArray<PeerRow> = []
   let lastRemoteTeams: ReadonlyMap<string, RemoteTeamRow[]> = new Map()
   const peerScoreByText = new Map<string, number | undefined>()
+  /** gh#20 W-A: per-host link/verified info for the peer badges. */
+  const peerInfoByHost = new Map<string, { link?: 'linked' | 'stranger'; verified?: boolean }>()
   let lastInFlight: ReadonlyArray<InFlightRow> = []
 
   function renderFederation(): void {
@@ -524,8 +545,41 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
     if (n <= 0) pendingTeams.delete(team)
     else pendingTeams.set(team, n)
   }
+  // gh#41: remote-frame registry (frame name → peer URL), refreshed by
+  // reconcile and read by emitAction's serverAction to fork remote drops.
+  let remoteFramesRef = new Map<string, string>()
 
   function emitAction(a: CanvasAction): void {
+    // gh#20 W-B: the SERVER sees zone/id8 remote handles where the model
+    // keeps its peer-<host> node id — the canvas member contract is
+    // session-id-or-remote-ref. Translation happens here, one boundary;
+    // the model action keeps board-local ids so rendering and undo stay
+    // node-keyed. A peer without a known handle (no remote team rows yet)
+    // is filtered out — the server would refuse the raw peer- id.
+    function serverAction(act: CanvasAction): CanvasAction {
+      const mapIds = (ids: readonly string[]): string[] => {
+        const out: string[] = []
+        for (const id of ids) {
+          // Both remote card families translate to their zone/id8 handle
+          // (gh#38: member- cards join teams like peer- cards do).
+          if (!id.startsWith('peer-') && !id.startsWith('member-')) { out.push(id); continue }
+          const handle = model.getNode(id)?.remoteHandle
+          if (handle !== undefined && handle !== '') out.push(handle)
+        }
+        return out
+      }
+      if (act.type === 'add-member' || act.type === 'remove-member' || act.type === 'create-team') {
+        const ids = mapIds(act.ids)
+        // gh#41: a drop into a REMOTE frame carries the peer URL — main.ts
+        // forks it to the fleet relay instead of the local canvas control.
+        const fleetPeer = act.type !== 'create-team' ? remoteFramesRef.get(act.team) : undefined
+        return ids.length > 0 || fleetPeer !== undefined
+          ? { ...act, ids, ...(fleetPeer !== undefined ? { fleetPeer } : {}) }
+          : act
+      }
+      return act
+    }
+
     // Optimistic seats: a write may reference a session the teamed gate
     // keeps OFF the model (no canvas card yet). The write actions read and
     // write memberships through the node table, so materialize those ids
@@ -534,7 +588,7 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
     if (a.type === 'add-member' || a.type === 'remove-member' || a.type === 'reorder' || a.type === 'create-team') {
       const ids = a.type === 'reorder' ? a.ops.map(op => op.id) : [...a.ids]
       for (const id of ids) {
-        if (id === '' || id.startsWith('peer-')) continue
+        if (id === '' || id.startsWith('peer-') || id.startsWith('member-')) continue
         if (model.getNode(id) !== undefined) continue
         const s = lastSessions.find(row => row.id === id)
         if (s === undefined) continue
@@ -551,7 +605,7 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
     const team = actionTeam(a)
     pendingAdd(team)
     render()
-    void deps.onCanvasAction(a).then(
+    void deps.onCanvasAction(serverAction(a)).then(
       ok => {
         pendingRelease(team)
         if (!ok) undo() // host refused: roll this action's optimistic delta back
@@ -627,10 +681,18 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
     const p = localXY(ev)
     const w = screenToWorld(vp, p.x, p.y)
     const f = innermostFrameAt(new Map(model.allFrames()), w)
-    // 契约不变量 1：成员必须 joined session——对等卡永远不进名单写面。
-    const localIds = gesture.ids.filter(id => model.getNode(id)?.remote !== true)
+    // gh#20 W-B: peer cards join canvas teams too — a mixed local+remote
+    // drop composes a cross-host team; the server boundary translates
+    // peer ids to zone/id8 handles (emitAction's serverAction). Reorder
+    // stays local-only (roster priority is a local-session fact).
+    const memberIds = gesture.ids.filter(id => {
+      const node = model.getNode(id)
+      if (node === undefined) return false
+      if (node.remote !== true) return true
+      return node.remoteHandle !== undefined && node.remoteHandle !== ''
+    })
     if (f !== undefined) {
-      const fresh = localIds.filter(id => !(model.getNode(id)?.memberships.some(m => m.team === f)))
+      const fresh = memberIds.filter(id => !(model.getNode(id)?.memberships.some(m => m.team === f)))
       if (fresh.length > 0) {
         emitAction({ type: 'add-member', team: f, ids: fresh }) // 入队：不自动离原队（多对多）
         return
@@ -772,7 +834,12 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
       // Drop-target highlight: the innermost frame under the pointer, but
       // only when the drop would change something (some id not yet member).
       const f = innermostFrameAt(new Map(model.allFrames()), w)
-      const joinables = gesture.ids.filter(id => model.getNode(id)?.remote !== true)
+      // W-B: peers with a remote handle are droppable members too.
+      const joinables = gesture.ids.filter(id => {
+        const node = model.getNode(id)
+        if (node === undefined) return false
+        return node.remote !== true || (node.remoteHandle !== undefined && node.remoteHandle !== '')
+      })
       const relevant = f !== undefined && joinables.length > 0
       for (const [name, el] of frameEls) el.classList.toggle('drop-target', relevant && name === f)
       render()
@@ -1043,6 +1110,7 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
   let lastTeams: ReadonlyArray<PlanningTeam> = []
 
   function reconcile(input: PlanningInput): void {
+    // gh#41: remote-frame registry shared with serverAction (drop fork).
     lastTeams = input.teams
     lastPeers = input.peers ?? []
     lastInFlight = input.inFlight ?? []
@@ -1127,7 +1195,8 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
       }
     }
     for (const id of model.nodeIds()) {
-      if (!seen.has(id) && !id.startsWith('peer-')) model.removeNode(id)
+      // peer- and member- cards are reconciled by their own blocks below.
+      if (!seen.has(id) && !id.startsWith('peer-') && !id.startsWith('member-')) model.removeNode(id)
     }
 
     // Peer nodes (v1 ruling): same model pipeline as sessions, `remote` flag
@@ -1139,6 +1208,7 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
     peerScoreByText.clear()
     for (const p of input.peers ?? []) {
       peerScoreByText.set(peerHostOf(p.url), p.score)
+      peerInfoByHost.set(peerHostOf(p.url), { link: p.link, verified: p.verified })
     }
     if (input.peers !== undefined) {
       const localBounds = model.contentBounds()
@@ -1153,9 +1223,15 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
           : saved !== undefined
             ? { x: saved.x, y: saved.y }
             : { x: placements[i]?.x ?? 200, y: placements[i]?.y ?? 0 }
+        // gh#20 W-B: the peer's server-side member form — its first remote
+        // team row's zone/id8 handle (canvas remote refs are exact handles
+        // per the D1 ruling). Absent until the first remote team row lands.
+        const host = peerHostOf(p.url)
+        const handle = lastRemoteTeams.get(host)?.[0]?.team
         model.upsertNode({
           id, x: base.x, y: base.y,
           label: p.url, team: '', name: p.url, peerUrl: p.url,
+          remoteHandle: handle,
           live: true, remote: true, memberships: [],
         })
         model.upsertScore(id, p.score)
@@ -1164,6 +1240,118 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
     for (const id of model.nodeIds()) {
       if (id.startsWith('peer-') && !peerSeen.has(id)) model.removeNode(id)
     }
+    // gh#38 (owner ruling 「统一到画布里面拖拽」): every remote session-team
+    // HANDLE renders as its own draggable card, stacked beside its host's
+    // peer card — pulling a specific remote member into a local team is a
+    // plain drag (no picker, no hand-typed handle). Host cards stay for
+    // federation context; the member cards carry the actual join gesture.
+    const memberSeen = new Set<string>()
+    for (const [host, rows] of lastRemoteTeams) {
+      const hostNode = model.allNodes().find(n => n.remote === true && peerHostOf(n.peerUrl ?? '') === host && !n.id.startsWith('member-'))
+      const baseX = (hostNode?.x ?? 400) + 190
+      let y = hostNode?.y ?? 0
+      for (const row of rows) {
+        if (!row.team.includes('/')) continue
+        const id = `member-${row.team.replace(/[^a-z0-9-]/gi, '-')}`
+        if (memberSeen.has(id)) continue
+        memberSeen.add(id)
+        const saved = layoutDoc?.nodes[id]
+        const existing = model.getNode(id)
+        const pos = existing !== undefined ? { x: existing.x, y: existing.y } : saved !== undefined ? { x: saved.x, y: saved.y } : { x: baseX, y }
+        y += 92
+        model.upsertNode({
+          id, x: pos.x, y: pos.y,
+          label: row.team, team: row.team, name: row.name !== undefined && row.name !== '' ? row.name : row.team,
+          remoteHandle: row.team,
+          live: true, remote: true, memberships: [],
+        })
+      }
+    }
+    for (const id of model.nodeIds()) {
+      if (id.startsWith('member-') && !memberSeen.has(id)) model.removeNode(id)
+    }
+    // gh#42 (owner report: dragged a remote peer into base, no edge): team
+    // edges derive from NODE memberships, but remote cards carried hardcoded
+    // empty memberships — the server truth (base contains dsh/d659a8f9)
+    // never re-attached after a poll or reload. Re-attach here: every local
+    // team's remote member handles resolve onto their cards (member- card
+    // preferred, the peer HOST card as fallback), in-flight teams excluded.
+    const handleToNode = new Map<string, string>()
+    for (const n of model.allNodes()) {
+      if (n.remote !== true || n.remoteHandle === undefined || n.remoteHandle === '') continue
+      if (!handleToNode.has(n.remoteHandle) || n.id.startsWith('member-')) handleToNode.set(n.remoteHandle, n.id)
+    }
+    for (const team of input.teams) {
+      if (pendingTeams.has(team.name)) continue
+      const resolved: string[] = []
+      for (const m of team.members) {
+        const id = handleToNode.get(m.id) ?? m.id
+        if (model.getNode(id) !== undefined) resolved.push(id)
+      }
+      const current = [...model.teamMemberIds(team.name)].sort().join('|')
+      const next = [...resolved].sort().join('|')
+      if (current !== next) model.setTeamMembers(team.name, resolved)
+    }
+    // gh#41 fleet planning: the peers' published canvas org renders as
+    // REMOTE team frames — the owner reads the other side's grouping from
+    // ANY node and regulates it in place. Members attach as board
+    // memberships; drops into a remote frame fork to the host relay (see
+    // serverAction: the action carries fleetPeer, and main.ts routes it to
+    // /__dsh_a2a/fleet-canvas-op instead of the local canvas control).
+    const remoteFrames = new Map<string, string>()
+    const prevRemoteFrames = remoteFramesRef
+    remoteFramesRef = remoteFrames
+    if (input.peerOrg !== undefined) {
+      let slot = 0
+      const localNames = new Set(input.teams.map(t => t.name))
+      for (const row of input.peerOrg) {
+        // The peer's zone comes from its directory rows ('dsh/xxxx' →
+        // 'dsh'); the org's members are stored verbatim — LOCAL members as
+        // session ids, remote members as zone/id8 handles. Both must
+        // resolve onto that host's session cards: id-form members become
+        // `member-<zone>-<id8>` (id8 = strip 'session-' prefix, first 8
+        // chars — the repo's id8 derivation), handle members sanitize
+        // directly. The old sanitize-only pass misresolved every local
+        // member (owner: 数据对不上).
+        const peerZone = input.remoteTeams?.find(r => r.via === row.url)?.team.split('/')[0] ?? 'dsh'
+        const id8of = (id: string): string => id.replace(/^session-/, '').slice(0, 8)
+        // The server now canonicalizes org members to handles (gh#41 wire
+        // form); the id-form branch stays as the defensive path for peers
+        // on an older build that still publish raw session ids.
+        const memberBoardId = (m: string): string =>
+          m.includes('/') ? `member-${m.replace(/[^a-z0-9-]/gi, '-')}` : `member-${peerZone}-${id8of(m)}`
+        for (const team of row.org) {
+          if (team.name === '' || localNames.has(team.name)) continue
+          const memberIds = team.members.map(memberBoardId).filter(id => model.getNode(id) !== undefined)
+          const saved = layoutDoc?.frames?.[team.name]
+          // gh#44 (owner: frame position/size never sticks): the LOCAL-team
+          // path keeps an existing frame's live rect ("live rect wins" — a
+          // poll must not snap a frame the user just dragged, the save loop
+          // persists it a beat later). Remote frames re-set unconditionally
+          // every poll, so every drag snapped back before the save landed.
+          // Same contract here: only place the frame when it is absent.
+          if (model.getFrame(team.name) === undefined) {
+            model.setFrame(team.name, saved !== undefined ? { x: saved.x, y: saved.y, w: saved.w, h: saved.h } : { x: 200 + (slot % 4) * 280, y: 940 + Math.floor(slot / 4) * 160, w: 250, h: 130 })
+          }
+          model.setTeamMembers(team.name, memberIds)
+          remoteFrames.set(team.name, row.url)
+          slot += 1
+        }
+      }
+    }
+    for (const [name, url] of prevRemoteFrames) {
+      if (!remoteFrames.has(name)) {
+        model.removeFrame(name)
+        void url
+      }
+    }
+    // gh#20 W-B: the server echoes cross-host members as zone/id8 handles —
+    // map each handle back onto the peer node that carries it, so the
+    // reconcile keeps remote memberships instead of dropping them.
+    const handleToPeer = new Map<string, string>()
+    for (const n of model.allNodes()) {
+      if (n.remote === true && n.remoteHandle !== undefined && n.remoteHandle !== '') handleToPeer.set(n.remoteHandle, n.id)
+    }
     const homes = homeTeams(input.teams)
     for (const team of input.teams) {
       if (model.getFrame(team.name) !== undefined) continue // live rect wins
@@ -1177,17 +1365,19 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
       const rects: LayoutRect[] = []
       const all: LayoutRect[] = []
       for (const m of team.members) {
-        const n = model.getNode(m.id)
+        const n = model.getNode(handleToPeer.get(m.id) ?? m.id)
         if (n === undefined) continue
         all.push(nodeRect(n))
-        if (homes.get(m.id) === team.name) rects.push(nodeRect(n))
+        if (homes.get(n.id) === team.name) rects.push(nodeRect(n))
       }
       const wrap = rects.length > 0 ? rects : all
       if (wrap.length > 0) model.setFrame(team.name, deriveInitialFrame(wrap))
     }
     for (const [name] of model.allFrames()) {
       if (pendingTeams.has(name)) continue // an in-flight create/remove owns this name
-      if (!input.teams.some(t => t.name === name)) model.removeFrame(name)
+      // gh#41: remote org frames are reconciled by the peerOrg block above —
+      // the local-team cleanup must not remove them.
+      if (!input.teams.some(t => t.name === name) && !remoteFrames.has(name)) model.removeFrame(name)
     }
     // An open node panel follows the poll: facts (joins, leaves, team
     // declarations, peer arrivals) land within one cadence.

package/nexus-stage/src/planning.css

@@ -176,6 +176,10 @@
 #dsh-plan .p-node.remote{border-left-color:var(--federal); padding-right:46px}
 #dsh-plan .p-node.remote .dot{background:var(--federal)}
 #dsh-plan .p-node.remote .prio{color:var(--ink)}
+/* gh#20 W-A link badge: linked green / stranger gray (fleet reserved);
+   the ✓/✗ verified mark rides inside the same chip. */
+#dsh-plan .p-node .prio.lnk-linked{color:var(--live, #2e9e5b); border-color:var(--live, #2e9e5b)}
+#dsh-plan .p-node .prio.lnk-stranger{color:var(--ink-muted); border-color:var(--card-line)}
 #dsh-plan .e-activity{stroke:var(--accent); stroke-width:2; stroke-dasharray:8 6; stroke-opacity:.9}
 #dsh-plan .e-federal{stroke:var(--federal); stroke-width:1.5; stroke-dasharray:6 5; stroke-opacity:.5}
 #dsh-plan .edge-label{font-size:10.5px; fill:var(--ink-muted)}