@nelsonlongxiang/dsh-open-a2a-net 0.6.27 → 0.6.29

package/lib/index.js

@@ -31,19 +31,17 @@ import { GroupStore } from "./group-store.js";
 import { CanvasStore, isRemoteMemberRef, validRemoteMemberRef } from "./canvas-store.js";
 import { decodeSessionLog, extractTranscript, TRANSCRIPT_DEFAULT_LIMIT, TRANSCRIPT_MAX_FILE_BYTES, TRANSCRIPT_MAX_LIMIT } from "./session-transcript.js";
 import { LayoutStore } from "./layout-store.js";
-import { fileURLToPath } from 'node:url';
 import { JoinedSessions } from "./joined-store.js";
 import { ExposureStore } from "./exposure-store.js";
-import { applyOwnerSettings } from "./owner-settings.js";
 import { CliDepositStore } from "./cli-deposit.js";
 import { TeamMembershipStore } from "./team-store.js";
 import { PeerStore } from "./peer-store.js";
 import { SelfReferralFilter } from "./self-suppress.js";
-import { resolveStageMount } from "./stage-mount.js";
-import { TaskLedger, TASK_STALE_TTL_MS, SUMMARY_CAP, ARCHIVE_CAP, archivedEndedBy, briefOf } from "./task-ledger.js";
+import { TaskLedger, TASK_STALE_TTL_MS, SUMMARY_CAP, briefOf } from "./task-ledger.js";
 import { formatReceipt, parseReceipt } from "./receipt.js";
 import { runReceiptLadder } from "./receipt-ladder.js";
 import { IdempotencyStore, WIRE_ERROR_IDEMPOTENCY_CONFLICT, WIRE_ERROR_REPLAY_REJECTED, peerPayloadFingerprint } from "./idempotency-store.js";
+import { refuseIfBudgetExhausted } from "./recursion-guard.js";
 import { resolveZone } from "./zone.js";
 import { registerA2aNetworkSkill } from "./skill-registration.js";
 import s from '@deepseek-ai/schemastery';
@@ -51,7 +49,8 @@ import { defineTool } from '@deepseek-ai/dsh-tools';
 import { MessageId } from '@deepseek-ai/dsh-llm';
 import { SessionId } from '@deepseek-ai/dsh-session';
 import { A2aClient } from "./a2a-client.js";
-import { MAX_LAYOUT_BODY_BYTES, WIRE_ERROR_PAYLOAD_TOO_LARGE, withinRouteBodyCap } from "./transport-caps.js";
+import { WIRE_ERROR_PAYLOAD_TOO_LARGE, withinRouteBodyCap } from "./transport-caps.js";
+import { registerAdminFaces } from "./faces/admin.js";
 import { NATIVE_TEAMS_A2A_FACE_KEY } from "./teams-bridge.js";
 export { A2aClient } from "./a2a-client.js";
 export { NATIVE_TEAMS_A2A_FACE_KEY } from "./teams-bridge.js";
@@ -79,11 +78,13 @@ export const Config = s.object({
     wakeReconcileBackoffBaseMs: s.number().default(5_000),
     wakeReconcileMaxBackoffMs: s.number().default(600_000),
     /**
-     * S4: the joinable-team curation list. A model calling a2a_team_join may
-     * only declare membership in a team matching one of these patterns — an
-     * exact name or a trailing-`*` prefix (`dsh/canvas/*`). Default empty:
-     * the owner's no-self-join ruling, institutionalized as default-deny;
-     * a refused join carries guidance instead of failing silently.
+     * S4 (gh#11 N7): the joinable-team curation list. A model calling
+     * a2a_team_join may only declare membership in a team with an EXACT
+     * entry here — trailing-`*` patterns are readable but authorize nothing
+     * (no mint rights: a pattern pre-authorizing every future name under it
+     * would let a model mint teams nobody created). Default empty: the
+     * owner's no-self-join ruling, institutionalized as default-deny; a
+     * refused join carries guidance instead of failing silently.
      */
     teamJoinAllowlist: s.array(s.string()).default([]),
     /**
@@ -365,10 +366,10 @@ export function apply(ctx, config) {
      * @param res - the response for the malformed-body rejection.
      * @param use - receives the parsed body.
      */
-    // Wire code for boundary-refused corrupted text. -32004 is intentionally
-    // left as a reservation gap for the client-abort telemetry family seen in
-    // the wild; this lands at -32005 (cluster-C error-code registry).
-    const WIRE_ERROR_TEXT_CORRUPTED = -32005;
+    // Wire code for boundary-refused corrupted text (cluster-C error-code
+    // registry): -32004 belongs to the route verdict, -32005 to the client's
+    // DELIVERED-UNSETTLED family, so the corrupted-text guard owns -32006.
+    const WIRE_ERROR_TEXT_CORRUPTED = -32006;
     /**
      * Boundary guard for undecodable text (consumed by the readJsonBody
      * guard): U+FFFD is produced by a lossy decoder upstream of us — the bytes
@@ -586,8 +587,18 @@ export function apply(ctx, config) {
         if (teamAuditRing.length > 32)
             teamAuditRing.splice(0, teamAuditRing.length - 32);
     };
+    /**
+     * Recent routing activity for the network panel: a bounded ring of the
+     * latest inbound and outbound route outcomes, newest last. The state route
+     * serves a copy; the panel derives unread badges from new entries.
+     */
     const ACTIVITY_CAP = 20;
     const recentActivity = [];
+    /**
+     * In-flight outbound routes: a route registers on dial and unregisters on
+     * settlement, so the panel can show collaboration in progress ("who is
+     * waiting on whom") — the state route serves a snapshot.
+     */
     const inFlightRoutes = new Map();
     let inFlightSeq = 0;
     const beginRoute = (team, peer) => {
@@ -755,9 +766,13 @@ export function apply(ctx, config) {
      * the join consented to network reachability, so a route addressed to
      * its team pays the wake rather than failing.
      * @param team - the routed team name.
+     * @param skipId - the dispatching session's id (issue #41): a canvas
+     * team's cold tier skips the initiator — waking the author would loop the
+     * dispatch home. Bare session-team matches ignore it (an exact team match
+     * is the addressed target by definition).
      * @returns the wake outcome: a flight, or the reason none was started.
      */
-    const wakeColdTeam = (team) => {
+    const wakeColdTeam = (team, skipId) => {
         // F7 (wake-intent self-heal): a boot-time transient can prune the
         // in-memory intent while joined.json still holds it (memory/file
         // divergence — the live repro on 0.5.40). The persisted file is the
@@ -770,8 +785,9 @@ export function apply(ctx, config) {
             aliasId = matchJoined();
         }
         // Canvas teams wake their first cold joined member (member order is
-        // the routing priority; an archived member never wakes).
-        const id = aliasId ?? canvasColdMemberId(parseCanvasTeamName(team));
+        // the routing priority; an archived member never wakes; the initiator
+        // itself is skipped — issue #41, the self-route rule on canvas tiers).
+        const id = aliasId ?? canvasColdMemberId(parseCanvasTeamName(team), skipId);
         // An archived session never wakes: archive is closure, not sleep — to
         // the caller the team simply has no wakeable match.
         if (id === undefined)
@@ -920,11 +936,19 @@ export function apply(ctx, config) {
         const name = team.slice(prefix.length);
         return canvasStore.hasTeam(name) ? name : undefined;
     };
-    /** The canvas team's first live member agent (member order = priority). */
-    function canvasLiveAgent(name) {
+    /**
+     * The canvas team's first live member agent (member order = priority).
+     * `skipId` (issue #41, self-route rule on the canvas tiers): the
+     * dispatching session's own id — a live initiator occupying a member slot
+     * must not capture the dispatch, or the message only echoes home. Inbound
+     * faces pass no skip (a remote caller never equals a local member id).
+     */
+    function canvasLiveAgent(name, skipId) {
         if (name === undefined)
             return undefined;
         for (const id of canvasStore.membersOf(name)) {
+            if (id === skipId)
+                continue;
             const agent = sessionNodes.get(id);
             if (agent !== undefined)
                 return agent;
@@ -934,12 +958,15 @@ export function apply(ctx, config) {
     /**
      * The canvas team's first cold joined member id — the wake candidate.
      * Cold means: joined intent remembered, no live root, not archived.
+     * `skipId` skips the initiating session for the same self-route reason as
+     * {@link canvasLiveAgent}: waking the initiator would only loop the
+     * dispatch back to its author.
      */
-    function canvasColdMemberId(name) {
+    function canvasColdMemberId(name, skipId) {
         if (name === undefined)
             return undefined;
         const isArchived = archivedSessionFilter();
-        return canvasStore.membersOf(name).find(id => joinedSessions.has(id) && !liveRoots.has(id) && isArchived?.(id) !== true);
+        return canvasStore.membersOf(name).find(id => id !== skipId && joinedSessions.has(id) && !liveRoots.has(id) && isArchived?.(id) !== true);
     }
     /**
      * Human-facing node facts for one session: the session title (fallback:
@@ -1397,715 +1424,21 @@ export function apply(ctx, config) {
             });
         };
         whenWebServerSettled((webServer) => {
-            ctx.effect(() => webServer.register({
-                kind: 'exact',
-                path: '/__dsh_a2a/state',
-                handler: controlRoute((_req, res) => {
-                    void (async () => {
-                        const t0 = Date.now();
-                        // The panel polls this route: pruning here makes a mid-session
-                        // archive leave the network within one poll interval, no restart
-                        // required.
-                        pruneArchivedJoins();
-                        pruneCanvasMemberships();
-                        const tPrune = Date.now();
-                        const assignments = groupStore.all();
-                        const groupOf = (id) => {
-                            const name = assignments[id];
-                            return name === undefined ? undefined : name;
-                        };
-                        // Archived sessions are closed: the GUI hides them everywhere, so
-                        // the panel must not re-list them as join surface rows — joined
-                        // or not. (The prune above already took their join intents; this
-                        // covers never-joined live roots and any intent a restart left.)
-                        const isArchived = archivedSessionFilter();
-                        const tFacts0 = Date.now();
-                        const sessions = [...liveRoots.values()]
-                            .filter(agent => isArchived?.(String(agent.id)) !== true)
-                            .map(agent => ({
-                            id: String(agent.id),
-                            label: sessionLabelOf(agent),
-                            team: sessionTeamOf(agent),
-                            ...nodeMetadataOf(agent),
-                            joined: sessionNodes.has(String(agent.id)),
-                            live: true,
-                            teams: [...teamMemberships.teamsOf(String(agent.id))],
-                            // #19 D3: the session's exposure tier (linked floor /
-                            // fleet opt-up) — readable on the state face.
-                            exposure: exposureStore.tierOf(String(agent.id)),
-                            ...(canvasStore.teamsOf(String(agent.id)).length > 0 ? { canvasTeams: [...canvasStore.teamsOf(String(agent.id))] } : {}),
-                            ...(groupOf(String(agent.id)) !== undefined ? { group: groupOf(String(agent.id)) } : {}),
-                        }));
-                        // Cold joined sessions: a remembered intent whose Agent is not
-                        // back yet (host restarted, session not opened). The row carries
-                        // no facts — the Web client merges the session title from its
-                        // own list — and wakes through the normal session-open path,
-                        // after which the remount above joins it automatically.
-                        // Cold rows only exist when a joined intent lacks a live agent;
-                        // with all intents live (or none) the persistence layer is never
-                        // asked and the handler stays synchronous to its response.
-                        const tFacts1 = Date.now();
-                        const coldCandidates = joinedSessions.list().filter(id => !liveRoots.has(id));
-                        const persistence = ctx.get('sessionPersistence');
-                        const persisted = persistence !== undefined && coldCandidates.length > 0 ? await coldJoinedIds() : new Set();
-                        const tCold = Date.now();
-                        for (const id of coldCandidates) {
-                            // Archived intents are retained on disk (an archived window is
-                            // transient; the 3081 wake defect came from deleting them), so
-                            // the join surface must skip them here instead.
-                            if (!persisted.has(id) || isArchived?.(id) === true)
-                                continue;
-                            sessions.push({
-                                id,
-                                label: `${session}-${id8(id)}`,
-                                team: `${config.team}/${id8(id)}`,
-                                joined: true,
-                                live: false,
-                                teams: [...teamMemberships.teamsOf(id)],
-                                ...(canvasStore.teamsOf(id).length > 0 ? { canvasTeams: [...canvasStore.teamsOf(id)] } : {}),
-                                ...(groupOf(id) !== undefined ? { group: groupOf(id) } : {}),
-                            });
-                        }
-                        const body = JSON.stringify({
-                            nodes: true,
-                            version: PLUGIN_VERSION,
-                            sessions,
-                            groups: groupStore.list(),
-                            canvas: {
-                                teams: canvasStore.list().map(name => ({
-                                    name,
-                                    team: canvasTeamOf(name),
-                                    members: canvasStore.membersOf(name).map(id => {
-                                        // Dual shape: local members report this zone's join/live
-                                        // facts; remote refs are opaque team handles — the state
-                                        // face passes them through with remote:true for the
-                                        // workbench's member chips and pickers.
-                                        if (isRemoteMemberRef(id)) {
-                                            return { id, team: id, remote: true };
-                                        }
-                                        return {
-                                            id,
-                                            team: `${config.team}/${id8(id)}`,
-                                            joined: sessionNodes.has(id) || joinedSessions.has(id),
-                                            live: sessionNodes.has(id),
-                                        };
-                                    }),
-                                })),
-                            },
-                            host: lanIp === '' ? {} : { lanIp },
-                            // gh#20 W-C (host rail): each peer row also carries its display
-                            // name and version from the warm card (absent until a fetch),
-                            // and the last-contact timestamp for the health lamp. W-A's
-                            // link/verified ride along for the badge.
-                            peers: peerStore.list().map(url => {
-                                const card = cardCache.get(url)?.card;
-                                const lastContact = peerStore.lastContact(url);
-                                const lastContactOk = peerStore.lastContactOk(url);
-                                return {
-                                    url,
-                                    score: peerStore.score(url),
-                                    ...(card?.name !== undefined && card.name !== '' ? { name: card.name } : {}),
-                                    ...(typeof card?.version === 'string' && card.version !== '' ? { version: card.version } : {}),
-                                    ...(lastContact !== undefined ? { lastContactAt: lastContact } : {}),
-                                    ...(lastContactOk !== undefined ? { lastContactOk } : {}),
-                                    ...peerLinkState(url),
-                                };
-                            }),
-                            remote: (refreshRemoteRows(), (remoteRowsCache?.rows ?? []).map(row => {
-                                const canvasTeams = canvasStore.teamsOf(row.team);
-                                return canvasTeams.length > 0 ? { ...row, canvasTeams: [...canvasTeams] } : row;
-                            })),
-                            activity: recentActivity.slice(),
-                            inFlight: [...inFlightRoutes.values()].map(route => ({
-                                team: route.team,
-                                peer: route.peer,
-                                startedAt: route.startedAt,
-                            })),
-                            // Owed receipts: pending rows only — the cross-turn waits the
-                            // in-flight ring cannot show. Dead-lettered rows ride their own
-                            // list and settled ones just a count, all additive so the panel
-                            // keeps rendering plain owed rows until it learns the tiers.
-                            tasks: taskLedger.list()
-                                .filter(task => task.status === 'pending')
-                                .map(task => ({
-                                taskId: task.taskId, team: task.team, peer: task.peer, startedAt: task.startedAt, status: task.status,
-                                direction: task.direction ?? 'outbound', receiptExpected: task.receiptExpected !== false,
-                                // The dispatch brief rides every row: a task id and a team
-                                // say nothing about WHAT is owed — supervision cannot tell
-                                // a nudge from an abandon without it.
-                                ...(task.brief !== undefined ? { brief: task.brief } : {}),
-                                // C-ruling bucket split: a pending row is settleable while
-                                // it is young, expected, and answerable; past the stale
-                                // hour it is conversational noise waiting on the dead TTL.
-                                settleable: task.receiptExpected !== false && Date.now() - task.startedAt < 60 * 60_000,
-                            })),
-                            // C face: the stale/conversational tail as a count, so the
-                            // panel can render only truly settleable debt.
-                            tasksStaleCount: taskLedger.list().filter(task => task.status === 'pending' && (task.receiptExpected === false || Date.now() - task.startedAt >= 60 * 60_000)).length,
-                            tasksDead: taskLedger.list()
-                                .filter(task => task.status === 'dead')
-                                .map(task => ({ taskId: task.taskId, team: task.team, peer: task.peer, startedAt: task.startedAt, deadAt: task.deadAt ?? task.startedAt, reason: task.reason ?? 'unspecified', ...(task.brief !== undefined ? { brief: task.brief } : {}), ...(task.direction !== undefined ? { direction: task.direction } : {}) })),
-                            // gh#31: per-task outcomes for rows that LEFT the ledger — the
-                            // chat drawer used to guess (settled, abandoned or cancelled).
-                            // Bounded to the archive (≤64), newest first, with the
-                            // controlled-vocabulary verdict each row settled by.
-                            // gh#31 follow-up: archive() is already newest first (settles
-                            // prepend), so the projection keeps that order — the earlier
-                            // .reverse() served it oldest first. Each row also says HOW it
-                            // ended (endedBy: abandon and cancel both record outcome
-                            // 'abandoned', and so does a peer's own 'abandoned' receipt),
-                            // whether a receipt came after the caller ended it (late), and
-                            // its direction when known.
-                            archived: taskLedger.archive().slice(0, ARCHIVE_CAP).map(row => ({
-                                taskId: row.taskId,
-                                team: row.team,
-                                peer: row.peer,
-                                startedAt: row.startedAt,
-                                resolvedAt: row.resolvedAt,
-                                outcome: row.outcome ?? 'unclassified',
-                                endedBy: archivedEndedBy(row),
-                                ...(row.direction !== undefined ? { direction: row.direction } : {}),
-                                ...(row.lateReceiptAt !== undefined ? { late: true } : {}),
-                                ...(row.brief !== undefined ? { brief: row.brief } : {}),
-                                ...(row.summary !== undefined && row.summary !== '' ? { summary: row.summary.slice(0, 160) } : {}),
-                            })),
-                            archivedCount: taskLedger.archive().length,
-                            // Ledger density face: the settled archive split by verdict, so
-                            // the workbench can say WHICH way those rows settled instead of
-                            // just how many. Additive and bounded (outcome vocabulary is a
-                            // closed set); rows without an envelope outcome count as
-                            // 'unclassified' rather than being dropped.
-                            archivedSplit: (() => {
-                                const split = {};
-                                for (const row of taskLedger.archive()) {
-                                    const key = row.outcome ?? 'unclassified';
-                                    split[key] = (split[key] ?? 0) + 1;
-                                }
-                                return split;
-                            })(),
-                            // 0.5.36 observability: the idempotency window aggregate —
-                            // window occupancy, outcome split, and cumulative claim-verdict
-                            // counters (the data the UNIQUE-ization decision waits on).
-                            // Read-only; no fingerprints cross here (they are /a2a/query's
-                            // only auth material).
-                            idempotency: idempotencyStore.stats(),
-                            // gh#41 fleet planning: each tracked peer's published canvas
-                            // org (full-card canvasOrg) from the warm card cache — the
-                            // board renders REMOTE team frames from this. Absent until a
-                            // linked fetch warmed the card.
-                            peerOrg: peerStore.list().map(url => {
-                                const card = cardCache.get(url)?.card;
-                                const org = card?.canvasOrg;
-                                return Array.isArray(org)
-                                    ? { url, org: org.filter((e) => e !== null && typeof e === 'object')
-                                            .map(e => ({ name: typeof e.name === 'string' ? e.name : '', team: typeof e.team === 'string' ? e.team : '', members: Array.isArray(e.members) ? e.members.filter((m) => typeof m === 'string') : [] }))
-                                            .filter(e => e.team !== '') }
-                                    : { url, org: [] };
-                            }),
-                            // gh#9+gh#10 M1: envelope-absent deliveries during the
-                            // OriginClaim window — the operator watches this drain to
-                            // zero before closing the window.
-                            legacyInbound: legacyInboundCount,
-                            // F-observability: the boot prewarm's lifecycle — a dead or
-                            // skipped prewarm is the root shape behind "cold rows pile up
-                            // after restart" and must be readable, not a console rumor.
-                            prewarm: { ...prewarmStatus, failed: [...prewarmStatus.failed] },
-                            // F8 observability: reconciliation cadence, wake outcomes,
-                            // and per-row failure reasons with backoff and the parked
-                            // needs-repair state — the cold row's "why am I still cold".
-                            reconcile: { ...reconcileStatus, rows: [...reconcileStatus.rows] },
-                            // S1: flat node registry — local sessions and remote card
-                            // nodes in one table, zone-qualified team handles as the
-                            // stable cross-host addresses. Local ids are the session
-                            // UUIDs; remote ids are the publishing team handles. (The
-                            // `nodes` boolean above is the capability flag the panel
-                            // already consumes; this face rides its own key.)
-                            registry: {
-                                nodes: [
-                                    ...sessions.map(row => ({
-                                        id: String(row.id),
-                                        label: String(row.label ?? ''),
-                                        team: String(row.team ?? ''),
-                                        zone: config.team,
-                                        live: row.live === true,
-                                        joined: row.joined === true,
-                                        ...(typeof row.workspace === 'string' && row.workspace !== '' ? { workspace: row.workspace } : {}),
-                                        teams: [...teamMemberships.teamsOf(String(row.id))],
-                                    })),
-                                    ...(remoteRowsCache?.rows ?? []).map(row => ({
-                                        id: String(row.team),
-                                        label: String(row.name ?? ''),
-                                        team: String(row.team),
-                                        zone: String(row.team).split('/')[0] ?? config.team,
-                                        host: String(row.origin ?? ''),
-                                        ...(row.workspace !== undefined && row.workspace !== '' ? { workspace: row.workspace } : {}),
-                                        ...(row.legacy === true ? { legacy: true } : {}),
-                                        teams: [...(row.teams ?? [])],
-                                        remote: true,
-                                    })),
-                                ],
-                                // S2: local team rosters rebuilt from member declarations.
-                                teams: (() => {
-                                    const roster = new Map();
-                                    for (const entry of teamMemberships.list()) {
-                                        for (const team of entry.teams) {
-                                            const members = roster.get(team) ?? [];
-                                            members.push(entry.session);
-                                            roster.set(team, members);
-                                        }
-                                    }
-                                    return [...roster.entries()].map(([team, members]) => ({
-                                        team,
-                                        members,
-                                        live: members.filter(member => liveRoots.has(member)).length,
-                                    }));
-                                })(),
-                                // S4 audit face: join/leave attempts with outcomes — the
-                                // queryable half that rotating log lines cannot be.
-                                teamAudit: [...teamAuditRing],
-                            },
-                            // Unjoined-node reports: the one-way signal ring (design:
-                            // docs/design/unjoined-report-ingress.md), newest first.
-                            reports: [...reportRing].reverse(),
-                        });
-                        res.writeHead(200, {
-                            'Content-Type': 'application/json',
-                            'Content-Length': Buffer.byteLength(body),
-                            // Phase timing (ms since request start): prune / live-row facts /
-                            // cold-rows enumeration. Diagnostic for the poll-latency question.
-                            'X-A2A-Timing': `prune=${tPrune - t0};facts=${tFacts1 - tFacts0};cold=${tCold - tFacts1};total=${Date.now() - t0}`,
-                        });
-                        res.end(body);
-                    })();
-                }),
-            }), 'a2a: session-node state route');
-            ctx.effect(() => webServer.register({
-                kind: 'exact',
-                path: '/__dsh_a2a/join',
-                handler: controlRoute((req, res) => {
-                    readJsonBody(req, res, (body) => {
-                        const agent = typeof body.id === 'string' ? liveRoots.get(body.id) : undefined;
-                        if (agent === undefined) {
-                            const payload = JSON.stringify({ error: 'no live session with that id' });
-                            res.writeHead(404, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                            res.end(payload);
-                            return;
-                        }
-                        mountSessionNode(agent);
-                        joinedSessions.add(String(agent.id));
-                        const payload = JSON.stringify({ id: body.id, label: sessionLabelOf(agent), team: sessionTeamOf(agent) });
-                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                        res.end(payload);
-                    });
-                }),
-            }), 'a2a: session-node join route');
-            ctx.effect(() => webServer.register({
-                kind: 'exact',
-                path: '/__dsh_a2a/leave',
-                handler: controlRoute((req, res) => {
-                    readJsonBody(req, res, (body) => {
-                        const id = typeof body.id === 'string' ? body.id : '';
-                        if (id !== '')
-                            sessionNodes.delete(id);
-                        joinedSessions.remove(id);
-                        // Leaving the network leaves every canvas team too: membership
-                        // without join consent would be a routing backdoor. Team
-                        // roster declarations die the same way (S2 consistency).
-                        canvasStore.dropMember(id);
-                        teamMemberships.dropSession(id);
-                        const payload = JSON.stringify({ id });
-                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                        res.end(payload);
-                    });
-                }),
-            }), 'a2a: session-node leave route');
-            // gh#45 CLI 户口 control face (loopback/key gated like every write):
-            // publish (deposit a signed CLI card, ≤4h by ruling), revoke, list,
-            // and mailbox readout — the CLI polls this while alive.
-            ctx.effect(() => webServer.register({
-                kind: 'exact',
-                path: '/__dsh_a2a/cli-deposit',
-                handler: controlRoute((req, res) => {
-                    readJsonBody(req, res, (body) => {
-                        const action = body.action;
-                        let payload;
-                        if (action === 'publish') {
-                            const card = typeof body.card === 'string' ? body.card : '';
-                            const out = cliDeposits.deposit(card);
-                            payload = JSON.stringify(out.ok
-                                ? { ok: true, handle: out.handle, expiresAt: out.expiresAt, cardUrl: `${ownCardUrl}/a2a/cli/${encodeURIComponent(out.handle)}` }
-                                : { ok: false, error: out.error });
-                        }
-                        else if (action === 'revoke') {
-                            payload = JSON.stringify({ ok: cliDeposits.revoke(typeof body.handle === 'string' ? body.handle : '') });
-                        }
-                        else if (action === 'inbox') {
-                            const handle = typeof body.handle === 'string' ? body.handle : '';
-                            payload = JSON.stringify({ ok: true, mail: cliDeposits.readMail(handle) });
-                        }
-                        else {
-                            payload = JSON.stringify({ ok: true, deposits: cliDeposits.list().map(row => ({ handle: row.handle, name: row.name, depositedAt: row.depositedAt, expiresAt: row.expiresAt })) });
-                        }
-                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                        res.end(payload);
-                    });
-                }),
-            }), 'a2a: cli-deposit route');
-            // gh#41 fleet planning relay: the GUI asks THIS host to regulate a
-            // REMOTE peer's canvas team. The node key never leaves the server —
-            // the relay stamps the OriginClaim envelope and forwards to the
-            // peer's /a2a/canvas-op face; the peer's link gate authorizes.
-            ctx.effect(() => webServer.register({
-                kind: 'exact',
-                path: '/__dsh_a2a/fleet-canvas-op',
-                handler: controlRoute((req, res) => {
-                    readJsonBody(req, res, async (body) => {
-                        const { peer, op, name, id } = body;
-                        const peerUrl = typeof peer === 'string' ? peer : '';
-                        const opV = typeof op === 'string' ? op : '';
-                        const nameV = typeof name === 'string' ? name : '';
-                        const idV = typeof id === 'string' ? id : '';
-                        const send = (payload) => {
-                            res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                            res.end(payload);
-                        };
-                        if (peerUrl === '' || !/^https?:\/\//.test(peerUrl) || !['create', 'add-member', 'remove-member'].includes(opV) || (opV !== 'create' && nameV === '')) {
-                            send(JSON.stringify({ ok: false, error: 'peer (http url), op (create | add-member | remove-member), and name are required' }));
-                            return;
-                        }
-                        if (!peerStore.list().includes(peerUrl)) {
-                            send(JSON.stringify({ ok: false, error: `peer ${peerUrl} is not tracked — regulate tracked peers only` }));
-                            return;
-                        }
-                        try {
-                            const target = peerUrl.replace(/\/$/, '') + '/a2a/canvas-op';
-                            const reply = await globalThis.fetch(target, {
-                                method: 'POST',
-                                headers: { 'Content-Type': 'application/json', ...originClaimHeaders() },
-                                body: JSON.stringify({ op: opV, name: nameV, ...(opV !== 'create' ? { id: idV } : {}) }),
-                                signal: AbortSignal.timeout(15_000),
-                            });
-                            const raw = await reply.text();
-                            try {
-                                const out = JSON.parse(raw);
-                                send(JSON.stringify(out));
-                            }
-                            catch {
-                                // A non-JSON reply is a peer WITHOUT the canvas-op face (a
-                                // pre-gh41 build) or a proxy page — name the shape honestly.
-                                send(JSON.stringify({ ok: false, error: `peer ${peerUrl} answered HTTP ${String(reply.status)} without JSON — it likely runs a build without the fleet canvas-op face (pre gh#41); upgrade it, or regulate its teams on that host directly` }));
-                            }
-                        }
-                        catch (error) {
-                            send(JSON.stringify({ ok: false, error: `fleet op failed: ${error instanceof Error ? error.message : String(error)}` }));
-                        }
-                    });
-                }),
-            }), 'a2a: fleet-canvas-op relay route');
-            // gh#34 owner three-key panel: the remote build-out unlock knobs,
-            // surfaced as a control face instead of "翻配置文件". GET reads the
-            // effective values; POST writes the HOME patch layer (the
-            // authoritative surface) AND hot-applies the two call-time keys
-            // (teamJoinAllowlist / teamScopeInfo); announce is boot-time
-            // publishing, so its change lands on the next host restart and the
-            // reply says so. Same key gate as every write face.
-            ctx.effect(() => webServer.register({
-                kind: 'exact',
-                path: '/__dsh_a2a/owner-settings',
-                handler: controlRoute((req, res) => {
-                    if (req.method === 'GET') {
-                        const payload = JSON.stringify({
-                            ok: true,
-                            teamJoinAllowlist: [...ownerAllowlist],
-                            teamScopeInfo: ownerTeamScopeInfo,
-                            announce: config.announce === true,
-                            announceRestartPending: ownerAnnounceRestartPending,
-                        });
-                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                        res.end(payload);
-                        return;
-                    }
-                    readJsonBody(req, res, (rawBody) => {
-                        const body = rawBody;
-                        const changes = {};
-                        if (Array.isArray(body.teamJoinAllowlist)) {
-                            const list = body.teamJoinAllowlist.filter((name) => typeof name === 'string' && name !== '' && name.length <= 128);
-                            changes.teamJoinAllowlist = [...new Set(list)];
-                        }
-                        if (typeof body.teamScopeInfo === 'boolean')
-                            changes.teamScopeInfo = body.teamScopeInfo;
-                        if (typeof body.announce === 'boolean')
-                            changes.announce = body.announce;
-                        if (Object.keys(changes).length === 0) {
-                            const payload = JSON.stringify({ ok: false, error: 'no recognized keys: teamJoinAllowlist (string[]), teamScopeInfo (bool), announce (bool)' });
-                            res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                            res.end(payload);
-                            return;
-                        }
-                        try {
-                            const patchPath = join(home, 'cordis.patch.yml');
-                            const current = existsSync(patchPath) ? readFileSync(patchPath, 'utf8') : '';
-                            const { yaml, restartNeeded } = applyOwnerSettings(current, changes);
-                            mkdirSync(home, { recursive: true });
-                            writeFileSync(patchPath, yaml, 'utf8');
-                            // Hot-apply the two call-time keys.
-                            if (changes.teamJoinAllowlist !== undefined)
-                                ownerAllowlist = [...changes.teamJoinAllowlist];
-                            if (changes.teamScopeInfo !== undefined)
-                                ownerTeamScopeInfo = changes.teamScopeInfo;
-                            if (changes.announce !== undefined && changes.announce !== (config.announce === true))
-                                ownerAnnounceRestartPending = true;
-                            if (changes.announce !== undefined && changes.announce === (config.announce === true))
-                                ownerAnnounceRestartPending = false;
-                            logger.info(`a2a: owner settings updated (${Object.keys(changes).join(', ')}${restartNeeded ? ' — restart pending for announce' : ''})`);
-                            const payload = JSON.stringify({ ok: true, restartNeeded, keys: Object.keys(changes) });
-                            res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                            res.end(payload);
-                        }
-                        catch (error) {
-                            const payload = JSON.stringify({ ok: false, error: `patch-layer write failed: ${error instanceof Error ? error.message : String(error)}` });
-                            res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                            res.end(payload);
-                        }
-                    });
-                }),
-            }), 'a2a: owner-settings route');
-            // Groups control: create/remove named groups and assign sessions to
-            // them (an empty name unassigns). Same guard as join/leave — the
-            // group taxonomy enumerates session ids, so it stays behind the key.
-            // Deprecated as of 0.6.6 (canvas teams supersede manual grouping);
-            // kept working for old panels.
-            ctx.effect(() => webServer.register({
-                kind: 'exact',
-                path: '/__dsh_a2a/groups',
-                handler: controlRoute((req, res) => {
-                    readJsonBody(req, res, (body) => {
-                        const action = body.action;
-                        let payload;
-                        if (action === 'create') {
-                            const name = typeof body.name === 'string' ? body.name : '';
-                            const stored = groupStore.create(name);
-                            payload = JSON.stringify(stored === undefined ? { ok: false, error: 'invalid name or group cap reached' } : { ok: true, name: stored, groups: groupStore.list() });
-                        }
-                        else if (action === 'remove') {
-                            const name = typeof body.name === 'string' ? body.name : '';
-                            payload = JSON.stringify({ ok: groupStore.remove(name), groups: groupStore.list() });
-                        }
-                        else if (action === 'assign') {
-                            const id = typeof body.id === 'string' ? body.id : '';
-                            const name = typeof body.name === 'string' ? body.name : undefined;
-                            if (id === '' || name === undefined) {
-                                payload = JSON.stringify({ ok: false, error: 'id and name are required' });
-                            }
-                            else {
-                                payload = JSON.stringify({ ok: groupStore.assign(id, name), groups: groupStore.list() });
-                            }
-                        }
-                        else {
-                            payload = JSON.stringify({ ok: false, error: 'unknown action' });
-                        }
-                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                        res.end(payload);
-                    });
-                }),
-            }), 'a2a: session-group route');
-            // Canvas control: create/remove named multi-member teams and manage
-            // membership. Same key guard as join/leave — membership enumerates
-            // session ids. A member must be a joined session (live node or
-            // remembered intent): canvas routing only reaches sessions the user
-            // put on the network by gesture — no routing backdoor over unjoined
-            // sessions.
-            ctx.effect(() => webServer.register({
-                kind: 'exact',
-                path: '/__dsh_a2a/canvas',
-                handler: controlRoute((req, res) => {
-                    readJsonBody(req, res, (body) => {
-                        const action = body.action;
-                        let payload;
-                        if (action === 'create') {
-                            const name = typeof body.name === 'string' ? body.name : '';
-                            const stored = canvasStore.create(name);
-                            payload = JSON.stringify(stored === undefined ? { ok: false, error: 'invalid name or team cap reached' } : { ok: true, name: stored, teams: canvasStore.list() });
-                        }
-                        else if (action === 'remove') {
-                            const name = typeof body.name === 'string' ? body.name : '';
-                            payload = JSON.stringify({ ok: canvasStore.remove(name), teams: canvasStore.list() });
-                        }
-                        else if (action === 'add-member') {
-                            const name = typeof body.name === 'string' ? body.name : '';
-                            const id = typeof body.id === 'string' ? body.id : '';
-                            // Dual member shape: a local session id must be a joined node;
-                            // a remote ref is a zone-qualified team handle whose shape this
-                            // gate checks and whose existence the UI picker (directory
-                            // rows) vouches for. Humans compose both via the workbench.
-                            const memberValid = isRemoteMemberRef(id)
-                                ? validRemoteMemberRef(id)
-                                : id !== '' && (sessionNodes.has(id) || joinedSessions.has(id));
-                            if (name === '' || !memberValid) {
-                                payload = JSON.stringify({ ok: false, error: 'name and a member (joined session id, or a zone-qualified remote team handle like zone/a1b2c3d4) are required' });
-                            }
-                            else {
-                                canvasStore.create(name);
-                                payload = JSON.stringify({ ok: canvasStore.addMember(name, id), teams: canvasStore.list(), members: canvasStore.membersOf(name) });
-                            }
-                        }
-                        else if (action === 'remove-member') {
-                            const name = typeof body.name === 'string' ? body.name : '';
-                            const id = typeof body.id === 'string' ? body.id : '';
-                            if (name === '' || id === '') {
-                                payload = JSON.stringify({ ok: false, error: 'name and id are required' });
-                            }
-                            else {
-                                payload = JSON.stringify({ ok: canvasStore.removeMember(name, id), teams: canvasStore.list(), members: canvasStore.membersOf(name) });
-                            }
-                        }
-                        else {
-                            payload = JSON.stringify({ ok: false, error: 'unknown action' });
-                        }
-                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                        res.end(payload);
-                    });
-                }),
-            }), 'a2a: session-canvas route');
-            // Layout face (contract v2): whole-document GET + save/reset for the
-            // stage's spatial presentation state. Validated/clamped server-side by
-            // LayoutStore so a buggy client cannot poison persisted geometry.
-            ctx.effect(() => webServer.register({
-                kind: 'exact',
-                path: '/__dsh_a2a/canvas-layout',
-                handler: controlRoute((req, res) => {
-                    if (req.method === 'GET') {
-                        const payload = JSON.stringify({ ok: true, layout: layoutStore.get() });
-                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                        res.end(payload);
-                        return;
-                    }
-                    readJsonBody(req, res, (body) => {
-                        const action = body.action;
-                        if (action === 'reset') {
-                            layoutStore.reset();
-                            const payload = JSON.stringify({ ok: true, layout: null });
-                            res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                            res.end(payload);
-                            return;
-                        }
-                        if (action === 'save') {
-                            const accepted = layoutStore.save(body.layout);
-                            const payload = JSON.stringify(accepted ? { ok: true, layout: layoutStore.get() } : { ok: false, error: 'payload is not a version-1 layout document' });
-                            res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                            res.end(payload);
-                            return;
-                        }
-                        const payload = JSON.stringify({ ok: false, error: 'unknown action' });
-                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                        res.end(payload);
-                    }, MAX_LAYOUT_BODY_BYTES);
-                }),
-            }), 'a2a: canvas-layout route');
-            // The dsh-a2a-munder-difflin floor stage: a same-origin full-page
-            // surface adapted from the Munder Difflin office renderer (stage/,
-            // NOTICE). Serves the built Vite tree with a traversal-guarded map.
-            ctx.effect(() => webServer.register({
-                kind: 'prefix',
-                path: '/__dsh_a2a_canvas',
-                handler: (req, res) => {
-                    const rootDir = fileURLToPath(new URL('../assets/stageDist', import.meta.url));
-                    // Directory-classic resolution: the bare mount 301s onto itself
-                    // with a slash, so the shell's `./assets` references resolve
-                    // inside this tree instead of 404ing against the web root.
-                    const MOUNT = '/__dsh_a2a_canvas';
-                    const resolved = resolveStageMount(req.url ?? '/', MOUNT);
-                    if (resolved.redirectTo !== undefined) {
-                        res.writeHead(301, { Location: resolved.redirectTo, 'Cache-Control': 'no-store', 'X-A2A-Stage': 'redirect' });
-                        res.end();
-                        return;
-                    }
-                    const rel = decodeURIComponent(resolved.rel).replace(/\\/g, '/');
-                    if (rel.includes('..')) {
-                        res.writeHead(403, { 'Content-Type': 'text/plain', 'X-A2A-Stage': 'traversal' });
-                        res.end();
-                        return;
-                    }
-                    try {
-                        const file = readFileSync(join(rootDir, rel));
-                        const ext = rel.slice(rel.lastIndexOf('.') + 1);
-                        const types = {
-                            html: 'text/html; charset=utf-8',
-                            js: 'text/javascript; charset=utf-8',
-                            mjs: 'text/javascript; charset=utf-8',
-                            css: 'text/css; charset=utf-8',
-                            png: 'image/png',
-                            json: 'application/json; charset=utf-8',
-                            svg: 'image/svg+xml',
-                        };
-                        res.writeHead(200, { 'Content-Type': types[ext] ?? 'application/octet-stream', 'Cache-Control': 'no-store', 'X-A2A-Stage': 'ok:' + ext });
-                        res.end(file);
-                    }
-                    catch (err) {
-                        res.writeHead(404, { 'Content-Type': 'text/plain', 'X-A2A-Stage': 'miss' });
-                        res.end('stage-miss rel=' + rel + ' rootDir=' + rootDir + ' err=' + String(err));
-                    }
-                },
-            }), 'a2a: canvas-stage page');
-            // The dsh-a2a-nexus stage: Three.js infinite-canvas topology viewer.
-            // Serves the built Vite tree from assets/nexusDist with a traversal-
-            // guarded file map (same discipline as canvas-stage).
-            ctx.effect(() => webServer.register({
-                kind: 'prefix',
-                path: '/__dsh_a2a_nexus',
-                handler: (req, res) => {
-                    const rootDirNexus = fileURLToPath(new URL('../assets/nexusDist', import.meta.url));
-                    // Same directory-classic resolution as the canvas mount: the bare
-                    // `/__dsh_a2a_nexus` form used to serve the shell verbatim, whose
-                    // `./assets` then 404'd at the web root — a silent black viewer.
-                    const MOUNT = '/__dsh_a2a_nexus';
-                    const resolved = resolveStageMount(req.url ?? '/', MOUNT);
-                    if (resolved.redirectTo !== undefined) {
-                        res.writeHead(301, { Location: resolved.redirectTo, 'Cache-Control': 'no-store' });
-                        res.end();
-                        return;
-                    }
-                    const rel = decodeURIComponent(resolved.rel).replace(/\\/g, '/');
-                    if (rel.includes('..')) {
-                        res.writeHead(403, { 'Content-Type': 'text/plain' });
-                        res.end();
-                        return;
-                    }
-                    try {
-                        const file = readFileSync(join(rootDirNexus, rel));
-                        const ext = rel.slice(rel.lastIndexOf('.') + 1);
-                        const types = {
-                            html: 'text/html; charset=utf-8',
-                            js: 'text/javascript; charset=utf-8',
-                            mjs: 'text/javascript; charset=utf-8',
-                            css: 'text/css; charset=utf-8',
-                            png: 'image/png',
-                            json: 'application/json; charset=utf-8',
-                            svg: 'image/svg+xml',
-                        };
-                        res.writeHead(200, { 'Content-Type': types[ext] ?? 'application/octet-stream', 'Cache-Control': 'no-store' });
-                        // gh#9 §10 GUI key plumbing (REVIEW M3 fix): the shell learns
-                        // the control-plane key ONLY on the loopback leniency face —
-                        // a remote bare GET of the page serves the shell WITHOUT the
-                        // key (the reviewer proved the pre-fix shape leaked the
-                        // credential to any network-reachable fetcher on a
-                        // 0.0.0.0-bound host, contradicting §10's purpose). Loopback
-                        // localhost is exactly §10.2's stated leniency posture; keyed
-                        // hosts behind tunnels use originClaimUrl-style operator
-                        // plumbing instead.
-                        if (ext === 'html' && config.apiKey !== '' && controlTrustedWithoutKey(req)) {
-                            const injected = file.toString('utf8').replace('</head>', `<script>window.__DSH_A2A_KEY__=${JSON.stringify(config.apiKey)};</script></head>`);
-                            res.end(Buffer.from(injected, 'utf8'));
-                            return;
-                        }
-                        res.end(file);
-                    }
-                    catch {
-                        res.writeHead(404, { 'Content-Type': 'text/plain' });
-                        res.end();
-                    }
-                },
-            }), 'a2a: nexus-stage page');
+            // gh#77 B1: the admin faces live in src/faces/admin.ts.
+            registerAdminFaces(webServer, {
+                ctx, config, logger, home, session, lanIp, PLUGIN_VERSION, controlRoute, controlTrustedWithoutKey, readJsonBody, peerStore, peerLinkState, originClaimHeaders, refreshRemoteRows, joinedSessions, exposureStore, teamMemberships, cliDeposits, groupStore, canvasStore, layoutStore, taskLedger, idempotencyStore, inFlightRoutes, recentActivity, teamAuditRing, reportRing, sessionNodes, liveRoots, mountSessionNode, coldJoinedIds, prewarmStatus, reconcileStatus, id8, sessionLabelOf, sessionTeamOf, nodeMetadataOf, canvasTeamOf, archivedSessionFilter, pruneArchivedJoins, pruneCanvasMemberships,
+                indexUrl: import.meta.url,
+                get cardCache() { return cardCache; },
+                get remoteRowsCache() { return remoteRowsCache; },
+                get legacyInboundCount() { return legacyInboundCount; },
+                get ownCardUrl() { return ownCardUrl; },
+                get ownerAllowlist() { return ownerAllowlist; },
+                set ownerAllowlist(v) { ownerAllowlist = v; },
+                get ownerTeamScopeInfo() { return ownerTeamScopeInfo; },
+                set ownerTeamScopeInfo(v) { ownerTeamScopeInfo = v; },
+                get ownerAnnounceRestartPending() { return ownerAnnounceRestartPending; },
+                set ownerAnnounceRestartPending(v) { ownerAnnounceRestartPending = v; },
+            });
         });
     }
     if (config.announce) {
@@ -2216,10 +1549,13 @@ export function apply(ctx, config) {
                         ...joinedSessions.list()
                             .filter(id => !liveRoots.has(id) && isArchived?.(id) !== true)
                             .map(id => exposureRow(`${config.team}/${id8(id)}`, { name: `${session}-${id8(id)}`, description: 'cold — not loaded; routing here wakes the session' })),
-                        // gh#45: deposited CLI identities publish as directory rows —
+                        // gh#45/47: deposited CLI identities publish as directory rows —
                         // the fleet sees them as member cards (draggable = the operator
-                        // link). Their "zone" is the agent-name; expiry drops the row.
-                        ...cliDeposits.cardRows().map(row => exposureRow(row.team, { name: row.name, description: row.description })),
+                        // link). Their "zone" is the agent-name. gh#47: an EXPIRED
+                        // deposit stays as an OFFLINE row (tombstone) so the board keeps
+                        // the member card grayed-but-present and canvas refs never
+                        // dangle silently; re-publish (same handle) un-tombstones.
+                        ...cliDeposits.directoryRows().map(row => exposureRow(row.team, { name: row.name, description: row.description })),
                     ];
                     const memberships = teamMemberships.list().flatMap(entry => entry.teams.map(team => ({ node: `${config.team}/${id8(entry.session)}`, team })));
                     const body = JSON.stringify({
@@ -2939,6 +2275,38 @@ ${message}`;
             for (const name of canvasStore.teamsOf(callerSessionId))
                 declared.add(canvasTeamOf(name));
         }
+        else {
+            // Issue #43: a same-zone handle that resolves to NO local session is a
+            // CROSS-HOST member (two nodes sharing one zone name — the fleet's
+            // common `dsh` spelling). The canvas link record exists on this host
+            // as a REMOTE MEMBER REF the operator added; the foreign-zone branch
+            // (a2aCallerRefusal) already honors that basis — the same-zone path
+            // must too, or a linked remote member is refused as teamless. The
+            // trust basis is unchanged: this host's operator-composed canvas,
+            // never the caller's self-description (V5).
+            for (const name of canvasStore.list()) {
+                if (canvasStore.remoteMembersOf(name).includes(caller))
+                    declared.add(canvasTeamOf(name));
+            }
+            // gh#71 fix ②: the warm card cache's peer canvasOrg is the same-zone
+            // cross-host basis too — an org entry naming BOTH the caller's handle
+            // and one of THIS host's own handles is a shared team (双向识别: the
+            // composition gesture happened on the other host's board; both ends
+            // are named). Read-only over the cache; a caller org that never names
+            // an own handle still refuses (V5 preserved).
+            const ownHandles = new Set([config.team, ...joinedSessions.list().map(id => `${config.team}/${id8(id)}`)]);
+            for (const cached of cardCache.values()) {
+                const org = cached.card?.canvasOrg;
+                if (!Array.isArray(org))
+                    continue;
+                for (const e of org) {
+                    if (typeof e.team !== 'string' || e.team === '' || !Array.isArray(e.members))
+                        continue;
+                    if (e.members.includes(caller) && e.members.some(m => typeof m === 'string' && ownHandles.has(m)))
+                        declared.add(e.team);
+                }
+            }
+        }
         const routable = new Set([config.team]);
         for (const id of joinedSessions.list())
             routable.add(`${config.team}/${id8(id)}`);
@@ -2978,6 +2346,20 @@ ${message}`;
                     }
                     for (const name of canvasStore.teamsOf(targetSession))
                         targetLinks.add(canvasTeamOf(name));
+                    // gh#71 fix ②: the warm cache's org basis at target level too —
+                    // an org entry naming BOTH the caller and the target handle is
+                    // the shared team (same 双向识别 rule as the host-level basis).
+                    for (const cached of cardCache.values()) {
+                        const org = cached.card?.canvasOrg;
+                        if (!Array.isArray(org))
+                            continue;
+                        for (const e of org) {
+                            if (typeof e.team !== 'string' || e.team === '' || !Array.isArray(e.members))
+                                continue;
+                            if (e.members.includes(caller) && e.members.includes(targetTeam))
+                                targetLinks.add(e.team);
+                        }
+                    }
                 }
             }
             else {
@@ -3373,12 +2755,12 @@ ${message}`;
                         }
                         legacyInboundCount += 1;
                     }
+                    if (refuseIfBudgetExhausted(req, res, team, caller, taskId, taskLedger))
+                        return;
                     // Server-side idempotency (P3/B3): one key, one execution inside
-                    // the window. Same key + same payload fingerprint ⇒ replay (409,
-                    // -32003, replay:true — the prior attempt stays authoritative);
-                    // same key + different payload ⇒ hard conflict (409, -32002).
-                    // Checked BEFORE any steering or ledger correlation: a replay must
-                    // never re-enter the target session, no matter how it settles.
+                    // the window. Same key + same payload ⇒ replay; different payload
+                    // ⇒ hard conflict (both 409). A replay must never re-enter the
+                    // target session, no matter how it settles.
                     const idemFingerprint = peerPayloadFingerprint({ caller, message, noWait, team });
                     const idemVerdict = idempotencyStore.claim(taskId, idemFingerprint);
                     if (idemVerdict !== 'fresh') {
@@ -3426,7 +2808,14 @@ ${message}`;
                     // lookup settles the message is already in — answer delivered and
                     // let the receipt contract carry the reply.
                     if (noWait) {
-                        const agent = resolveAgentForTeam(team);
+                        // Issue #41 companion fix: the no-wait inbound branch resolved
+                        // only bare session teams — a canvas team delivery (wait:false)
+                        // fell through to the cold tier and answered a bogus
+                        // no-match although a live member existed. Same resolution as
+                        // the waiting face (routeIntoAgent), and likewise NO initiator
+                        // skip: the wire face delivers faithfully to the first live
+                        // member, whoever the caller is.
+                        const agent = resolveAgentForTeam(team) ?? canvasLiveAgent(parseCanvasTeamName(team));
                         const wake = agent !== undefined ? undefined : wakeColdTeam(team);
                         const deliver = (target) => {
                             const from = caller === '' ? 'an unknown node' : caller;
@@ -4130,6 +3519,18 @@ ${message}`;
     async function fetchPeerCard(peer) {
         return settlePeerCard(peer, await client.fetchCardDetail(peer));
     }
+    /**
+     * Apply-scope shared card cache: every caller (teams listing, route
+     * candidate walks, panel sweeps) shares one TTL window per URL, so a
+     * poll-happy consumer cannot re-fetch a peer's card — or re-punish a dead
+     * one — more than once per window. Cards live for days and re-sign at
+     * TTL/4, so a 60s serve window is semantically safe. Negative results
+     * (unreachable/invalid) cache for a shorter window so a restarting peer
+     * reappears quickly. Scoring stays with the real network fetch only: a
+     * cache hit never re-scores, which is what keeps the debounced peer-store
+     * writes rare. Concurrent callers for one URL join a single in-flight
+     * fetch (single-flight) instead of racing N requests.
+     */
     const cardCache = new Map();
     const cardCacheInFlight = new Map();
     /**
@@ -4399,7 +3800,7 @@ ${message}`;
                     allowlist: {
                         type: 'object',
                         additionalProperties: true,
-                        description: 'The owner-curated teamJoinAllowlist patterns and their net effect (deny-all / curated / allow-all).',
+                        description: 'The owner-curated teamJoinAllowlist: exact entries (the only join authority, gh#11) plus pattern entries kept readable but carrying no mint rights (deny-all / curated; allow-all only via explicit exact entries).',
                     },
                     teamScopeRouting: { type: 'boolean' },
                     note: { type: 'string', description: 'What join does and does not gate, in one sentence.' },
@@ -4768,7 +4169,9 @@ ${message}`;
             + 'grouping when a fleet spans machines), and the session\'s working directory when shared. Pass query to filter '
             + 'by keyword (case-insensitive substring over team name, title, excerpt, origin, or workspace) — searching '
             + 'discovers one extra referral hop within the call. Canvas teams (<team>/canvas/<name>, user-composed multi-member groups) '
-            + 'list as local rows; routing to one resolves the first live member or wakes the first cold one. '
+            + 'list as local rows; routing to one resolves the first live member or wakes the first cold one — the dispatching session '
+            + 'itself is skipped on the local tiers, falling through to the other members (issue #41: a member routing to its own group '
+            + 'never loops home). '
             + 'While teamScopeInfo is on (default), the listing follows YOUR collaboration circle: remote rows serve only teams joined by this host\'s nodes, and [this host] session rows show only your own row, your canvas teams, and sessions sharing a team with you — an exposed node id invites mis-routing, so the directory does not advertise strangers. The owner\'s GUI panel keeps the full plane; teamScopeInfo: false opens it for tools too. '
             + 'Call this before a2a_route to pick a target team.',
         parameters: {
@@ -5135,11 +4538,12 @@ ${message}`;
         // node team when it has joined, else the node label), so the receiver
         // can answer with one a2a_route instead of an unroutable display label.
         a2aJoinGateRefusal(agent === undefined ? undefined : { agent });
-        // S3 (team-scoped routing, off by default): when the owner turns it
-        // on, collaboration happens inside teams. A session caller must have
-        // declared membership in the target team before it may address it,
-        // and a caller with no teams at all has no network — a teamless node
-        // is, by the same ruling, an unjoined one. Host-side calls (no agent)
+        // S3 (team-scoped routing, phase-2 default ON per the 2026-09-01 owner
+        // ruling; set false to restore the open outbound seam): a session
+        // caller must have declared membership in the target team before it
+        // may address it, and a caller with no teams at all has no network —
+        // a teamless node is, by the same ruling, an unjoined one. Host-side
+        // calls (no agent)
         // and the initiator face stay exempt, like the join gate; discovery
         // (a2a_teams) stays open so a teamless node can still see what to join.
         if (config.teamScopeRouting && agent !== undefined) {
@@ -5152,13 +4556,48 @@ ${message}`;
             if (!initiator) {
                 const callerTeams = teamMemberships.teamsOf(scopeCaller);
                 const team = String(args.team ?? '').trim();
-                if (callerTeams.length === 0) {
+                // gh#71: the SHARED-CANVAS basis and the warm cache's peer-org
+                // basis (an org entry naming BOTH the caller and the target
+                // handle) count as declared here too — the same link the
+                // admission core honors on the receiving side; without this the
+                // tool face refused routes the canvas itself had authorized.
+                // Canvas members mix two shapes: LOCAL sessions sit by session
+                // id, cross-host members by zone/id8 handle — match either.
+                const callerHandle = `${config.team}/${id8(scopeCaller)}`;
+                // gh#45 末修 (66abc2cf defect): a CANVAS GROUP NAME target
+                // (`<team>/canvas/<name>`) never matches member handles — a
+                // whole-group dispatch from a group member was refused. The
+                // group's own team handle (canvasTeamOf(name)) is the match
+                // (the caller sits in the very group being addressed).
+                const sharedCanvas = canvasStore.list().some(name => {
+                    const members = canvasStore.membersOf(name);
+                    const inGroup = members.includes(scopeCaller) || members.includes(callerHandle);
+                    return inGroup ? members.includes(team) || canvasTeamOf(name) === team : false;
+                });
+                let orgShared = false;
+                for (const cached of cardCache.values()) {
+                    const org = cached.card?.canvasOrg;
+                    if (!Array.isArray(org))
+                        continue;
+                    for (const e of org) {
+                        if (typeof e.team !== 'string' || e.team === '' || !Array.isArray(e.members))
+                            continue;
+                        const inOrg = e.members.includes(scopeCaller) || e.members.includes(callerHandle);
+                        if (inOrg && (e.members.includes(team) || e.team === team)) {
+                            orgShared = true;
+                            break;
+                        }
+                    }
+                    if (orgShared)
+                        break;
+                }
+                if (callerTeams.length === 0 && !sharedCanvas && !orgShared) {
                     return {
                         ok: false,
                         error: `team-scoped routing is on and this session (${id8(scopeCaller)}) has declared no team membership — a teamless node has no network. Declare one with a2a_team_join (subject to the owner's teamJoinAllowlist)`,
                     };
                 }
-                if (!callerTeams.includes(team)) {
+                if (!callerTeams.includes(team) && !sharedCanvas && !orgShared) {
                     return {
                         ok: false,
                         error: `team-scoped routing is on: routing to "${team}" requires declared membership. This session's teams: ${callerTeams.join(', ')}. a2a_team_join can declare it (subject to the owner's teamJoinAllowlist)`,
@@ -5197,7 +4636,7 @@ ${message}`;
         // cheapest possible and immune to nested-signal aborts), then direct
         // publishers, then zone delegations, deduplicated by URL.
         const failures = [];
-        const outcome = await dispatchLocalCandidate(args.team, args.message, callerSession, args.context_id, signal, args.async === true, taskId, callbackAddress);
+        const outcome = await dispatchLocalCandidate(args.team, args.message, callerSession, args.context_id, signal, args.async === true, taskId, callbackAddress, agent === undefined ? undefined : String(agent.id));
         if (outcome !== undefined) {
             if (outcome.ok) {
                 trackOwedTask(taskId, args.team, 'local', outcome, callbackAddress, briefOf(args.message));
@@ -5219,6 +4658,13 @@ ${message}`;
         if (remoteTargets.length > 0) {
             failures.push(`local: canvas team "${args.team}" has no live or wakeable local member`);
         }
+        else if (canvasName !== undefined && canvasStore.hasTeam(canvasName)) {
+            // Issue #41: no remote members and no usable local tier — the only
+            // remaining candidate shape is the initiator itself, and routing
+            // there would loop. Name it instead of letting the directory walk
+            // report an unrelated miss.
+            failures.push(`local: canvas team "${args.team}" has no live or wakeable member besides the initiating session — routing to a canvas team whose only member is the caller itself would loop; target another member's team handle directly`);
+        }
         const candidatePool = [];
         for (const target of targets) {
             for (const candidate of await directoryPeerCandidates(fetch, target, failures)) {
@@ -5275,7 +4721,7 @@ ${message}`;
      * and the caller gets the delivered shape with the receipt contract.
      * @returns the canonical result, or undefined when the team is not local.
      */
-    async function dispatchLocalCandidate(team, message, callerSession, contextId, signal, asyncMode = false, taskIdFromCaller, callbackAddress) {
+    async function dispatchLocalCandidate(team, message, callerSession, contextId, signal, asyncMode = false, taskIdFromCaller, callbackAddress, originAgentId) {
         const webServer = ctx.get('webServer');
         // W1 (boundary hardening): the local in-process candidate is an
         // admission seam like any other — a JOINED session (zone/id8 caller
@@ -5290,10 +4736,20 @@ ${message}`;
             return { ok: false, error: joinedRefusal, code: -32000 };
         }
         const canvasName = parseCanvasTeamName(team);
+        // Issue #41 shape note: the caller label is the WIRE form (<zone>/<id8>
+        // or a session label) and quick-dispatch BORROWS a live session's team
+        // as its host face — so the label alone cannot tell an initiating agent
+        // from a borrowed one. The exemption keys on the ORIGINATING agent's id
+        // (same shape as a member slot) passed down by routeTrunk; the host face
+        // passes none and never exempts.
+        const callerNodeId = originAgentId;
         let teamIsLocal = team === config.team
             || resolveAgentForTeam(team) !== undefined
             || joinedSessions.list().some(id => `${config.team}/${id8(id)}` === team)
-            || (canvasName !== undefined && (canvasLiveAgent(canvasName) !== undefined || canvasColdMemberId(canvasName) !== undefined));
+            // Issue #41 (self-route rule on canvas tiers): the initiator's own
+            // member slot never makes the team local — an exempt local tier must
+            // fall through to the remote members instead of echoing home.
+            || (canvasName !== undefined && (canvasLiveAgent(canvasName, callerNodeId) !== undefined || canvasColdMemberId(canvasName, callerNodeId) !== undefined));
         // gh#45 CLI mailbox: a delivery targeting a DEPOSITED CLI handle is
         // local by definition — it lands in the deposit's mailbox (the CLI
         // polls while alive; receipts and messages never wake anything).
@@ -5322,8 +4778,10 @@ ${message}`;
             // materializes first (the wake settles, or fails honestly), then the
             // steer fires, then delivered answers. The receipt header carries the
             // task id so the target can echo it back verbatim.
-            const agent = resolveAgentForTeam(team) ?? canvasLiveAgent(canvasName);
-            const wake = agent !== undefined ? undefined : wakeColdTeam(team);
+            // Issue #41: the canvas live tier skips the initiating session, so a
+            // dispatch from a member never resolves back to its author.
+            const agent = resolveAgentForTeam(team) ?? canvasLiveAgent(canvasName, callerNodeId);
+            const wake = agent !== undefined ? undefined : wakeColdTeam(team, callerNodeId);
             let woken = agent !== undefined
                 ? Promise.resolve(agent)
                 : wake?.kind === 'flight' ? wake.flight : undefined;
@@ -5415,10 +4873,13 @@ ${message}`;
             // registry claim must never shadow a live local session team. The
             // caller's abort cancels the round through its own signal; the 180s
             // deadline restores the bound the steer machinery observes.
+            // Issue #41: same initiator exemption on the sync path — the canvas
+            // live/cold tiers skip the dispatching session before steerable is
+            // decided, so a self-member falls through to remote members.
             const steerable = resolveAgentForTeam(team) !== undefined
-                || canvasLiveAgent(canvasName) !== undefined
+                || canvasLiveAgent(canvasName, callerNodeId) !== undefined
                 || joinedSessions.list().some(id => `${config.team}/${id8(id)}` === team)
-                || wakeColdTeam(team).kind === 'flight';
+                || wakeColdTeam(team, callerNodeId).kind === 'flight';
             if (!steerable && team !== config.team) {
                 const prepared = await nativeTeamsPrepare(team);
                 if (prepared.ok) {
@@ -6154,8 +5615,13 @@ ${message}`;
                 // and learns its referrals, exactly like a discovery sweep would,
                 // while the outcome's stage names the failure for the report.
                 const card = settlePeerCard(url, outcome);
-                if (card !== undefined)
+                if (card !== undefined) {
+                    // gh#71 fix ①: a successful full-face fetch persists into the warm
+                    // cache — the probe is often the FIRST contact (no directory sweep
+                    // has run), and the state face's peerOrg reads exactly this cache.
+                    cardCache.set(url, { at: Date.now(), card });
                     return { url, reachable: true, ms, team: card.team };
+                }
                 if (outcome.ok)
                     return { url, reachable: false, ms, error: 'dropped: the card lists this node back as its own referral' };
                 return outcome.stage === 'unreachable'