@nelsonlongxiang/dsh-open-a2a-net 0.6.31 → 0.6.33

package/lib/index.js

@@ -5,7 +5,7 @@
  * inbound direct routes into live agent sessions.
  * @module @nelsonlongxiang/dsh-open-a2a-net
  */
-import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign as edSign, timingSafeEqual, verify as edVerify } from 'node:crypto';
+import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, timingSafeEqual } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { networkInterfaces } from 'node:os';
 import { dirname, join } from 'node:path';
@@ -28,30 +28,46 @@ export function resolveCallerLabel(input) {
 }
 import { signCard, verifyCard } from "./card.js";
 import { GroupStore } from "./group-store.js";
-import { CanvasStore, isRemoteMemberRef } from "./canvas-store.js";
-import { decodeSessionLog, extractTranscript, TRANSCRIPT_DEFAULT_LIMIT, TRANSCRIPT_MAX_FILE_BYTES, TRANSCRIPT_MAX_LIMIT } from "./session-transcript.js";
+import { CanvasStore, canvasNameReserved, isRemoteMemberRef } from "./canvas-store.js";
+import { decodeSessionLog, extractTranscript, TRANSCRIPT_MAX_FILE_BYTES } from "./session-transcript.js";
 import { LayoutStore } from "./layout-store.js";
 import { JoinedSessions } from "./joined-store.js";
 import { ExposureStore } from "./exposure-store.js";
-import { CliDepositStore } from "./cli-deposit.js";
+import { CLI_HANDLE_RE, CliDepositStore } from "./cli-deposit.js";
 import { TeamMembershipStore } from "./team-store.js";
 import { PeerStore } from "./peer-store.js";
 import { SelfReferralFilter } from "./self-suppress.js";
 import { TaskLedger, TASK_STALE_TTL_MS, SUMMARY_CAP, briefOf } from "./task-ledger.js";
-import { formatReceipt, parseReceipt } from "./receipt.js";
+import { formatReceipt, parseReceipt, taskIdRefusal } from "./receipt.js";
 import { runReceiptLadder } from "./receipt-ladder.js";
 import { IdempotencyStore, WIRE_ERROR_IDEMPOTENCY_CONFLICT, WIRE_ERROR_REPLAY_REJECTED, peerPayloadFingerprint } from "./idempotency-store.js";
 import { createFloodGuard } from "./flood-guard.js";
 import { resolveZone } from "./zone.js";
 import { registerA2aNetworkSkill } from "./skill-registration.js";
+import { isRootOriginUrl, sameMountedUrl, signOriginClaim, verifyOriginClaim as verifyOriginClaimOf } from "./origin-claim.js";
+import { AuthObserver } from "./auth-observer.js";
+import { allowlistVersion, authorizationRef, buildAuthorization, callerAdmission, localCandidateAdmission, canonicalAllowlist, judgeSettlement, joinedFaceAdmission, refusalOf, sameZoneAdmission } from "./task-auth.js";
 import s from '@deepseek-ai/schemastery';
-import { defineTool } from '@deepseek-ai/dsh-tools';
 import { MessageId } from '@deepseek-ai/dsh-llm';
 import { SessionId } from '@deepseek-ai/dsh-session';
 import { A2aClient } from "./a2a-client.js";
 import { WIRE_ERROR_PAYLOAD_TOO_LARGE } from "./transport-caps.js";
 import { registerAdminFaces } from "./faces/admin.js";
+import { registerNodeFaces } from "./faces/nodes.js";
+import { NodeStore } from "./node-store.js";
+import { createNodeBinder, NodeBindings } from "./node-bind.js";
+import { NodeTasks, settledReminder } from "./node-tasks.js";
+import { githubProbe } from "./node-github.js";
+import { NodeReviewQueue, SessionTaint, localRoute, toolTaint } from "./node-self.js";
 import { registerWireFaces } from "./faces/wire.js";
+import { createInfoTools } from "./tools/info.js";
+import { registerSessionLogFaces } from "./faces/session-log.js";
+import { registerFileFaces } from "./faces/files.js";
+import { createFileTools } from "./tools/files.js";
+import { BlobStore } from "./blob-store.js";
+import { canvasCandidateMatches, canvasTargetAmbiguous, peerDirectoryRows, routableCallerLabel, sessionCandidateMatches, unroutableCallerNote } from "./peer-directory.js";
+import { createTeamsBridgeInbound } from "./legacy/teams-bridge-inbound.js";
+import { createActTools } from "./tools/act.js";
 import { NATIVE_TEAMS_A2A_FACE_KEY } from "./teams-bridge.js";
 export { A2aClient } from "./a2a-client.js";
 export { NATIVE_TEAMS_A2A_FACE_KEY } from "./teams-bridge.js";
@@ -64,7 +80,9 @@ export const Config = s.object({
     team: s.string().default('dsh'),
     /** S4 fix ③: host-side (agent-less) routing calls — audit them (default) or refuse outright. */
     gateAgentLessCalls: s.union(['audit', 'refuse']).default('audit'),
+    settlementAuth: s.union(['off', 'observe', 'enforce']).default('observe'),
     announce: s.boolean().default(false),
+    isolated: s.boolean().default(false),
     agentName: s.string().default('DeepSeek Harness A2A node'),
     peers: s.array(s.string()).default([]),
     delegates: s.array(s.object({ name: s.string(), url: s.string(), publicKey: s.string().default('') })).default([]),
@@ -145,6 +163,14 @@ export const Config = s.object({
      * failed signatures. See docs/protocol/delivery-origin-auth.md §4.
      */
     originClaimWindow: s.boolean().default(true),
+    /**
+     * OriginClaim unbound window: also sign/accept the legacy envelope that
+     * names no audience (counted as unboundInbound); closing it leaves the
+     * audience-bound form only. See docs/protocol/delivery-origin-auth.md §2.1.
+     */
+    originClaimUnboundWindow: s.boolean().default(true),
+    /** Extra OriginClaim audience origins (port-mapped/proxied hosts). */
+    originClaimAudiences: s.array(s.string()).default([]),
     /** OriginClaim callerUrl override for pocket-tunneled hosts; '' = auto. */
     originClaimUrl: s.string().default(''),
     /**
@@ -164,17 +190,6 @@ export const Config = s.object({
     nativeTeamsInbound: s.boolean().default(false),
     nativeRoundWaitMs: s.number().default(180_000),
 });
-/** Model-facing text for one route result. */
-function renderRoute(_args, value) {
-    const result = value;
-    const text = result.ok
-        ? [
-            `Team ${result.team} replied (task ${result.task_id}, status ${result.task_status}, context ${result.context_id}):`,
-            result.reply,
-        ].join('\n')
-        : `A2A route failed${result.code === undefined ? '' : ` (code ${String(result.code)})`}: ${result.error}`;
-    return [{ type: 'text', text }];
-}
 /**
  * Register the outbound peer tools, the direct-route endpoint, and (when
  * composed) the announced card and session-node control surface.
@@ -288,7 +303,9 @@ export function apply(ctx, config) {
             return () => { };
         }
     };
-    const fetchImpl = (url, init) => globalThis.fetch(url, init);
+    // gh#193: the one door to peers — while isolated nothing leaves this host.
+    const peerFetch = (url, init) => config.isolated ? Promise.reject(new Error('isolated: outbound peer traffic is off on this host')) : globalThis.fetch(url, init);
+    const fetchImpl = (url, init) => peerFetch(url, init);
     /** Constant-time secret comparison: hash both sides to equal-length digests. */
     function secretEqual(a, b) {
         const digestA = createHash('sha256').update(a).digest();
@@ -426,6 +443,8 @@ export function apply(ctx, config) {
             let body;
             try {
                 body = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                if (body === null || typeof body !== 'object' || Array.isArray(body))
+                    throw new TypeError('control body must be a JSON object'); // `null` crashed every route reading body.id
             }
             catch {
                 const payload = JSON.stringify({ error: 'malformed body' });
@@ -446,7 +465,18 @@ export function apply(ctx, config) {
                 res.end(payload);
                 return;
             }
-            use(body);
+            try {
+                use(body);
+            }
+            catch (error) {
+                logger.warn('control route failed: %s', String(error));
+                if (!res.headersSent) {
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end('{"error":"internal error"}');
+                }
+                else if (!res.writableEnded)
+                    res.end();
+            } // runs in the reader's 'end' callback, outside the web server's guard: a throw here would exit the host
         });
     }
     /**
@@ -482,6 +512,8 @@ export function apply(ctx, config) {
     // the same home as the node key.
     const home = config.dshHome === '' ? resolveDshHome() : resolveDshHome(config.dshHome);
     const peerStore = new PeerStore(config.peers, join(home, 'a2a', 'peers.json'));
+    // Node identity (docs/design/node-identity.md, N1): human-named nodes and their prompt versions.
+    const nodeStore = new NodeStore(join(home, 'a2a'));
     // Peer boundary model (docs/design/peer-boundary-model.md) — connection
     // layer. referralLearning off freezes the seed set: referrals are neither
     // learned nor offered. A non-empty peerAllowlist admits a referral only
@@ -524,32 +556,23 @@ export function apply(ctx, config) {
     /** Our own card URL once the web server settles — the OriginClaim anchor. */
     let ownCardUrl = '';
     /**
-     * The OriginClaim envelope headers (gh#9+gh#10): canonical form
-     * JSON.stringify([caller, callerUrl, ts]) signed with the node card key.
-     * Shared by the a2a client (every peer request) and verifyOriginClaim's
-     * own verification fetch (REVIEW M2: the cold-cache fetch must carry the
-     * envelope so a zone/id8 caller derives from the FULL card — a bare-zone
-     * caller derives from the minimal card's team either way).
+     * The OriginClaim envelope headers (gh#9+gh#10, src/origin-claim.ts): the
+     * bound form names the target's origin, method and path; the unbound
+     * legacy form rides along only while originClaimUnboundWindow is open.
+     * Signed with the node card key; shared by the a2a client (every peer
+     * request) and the relay/notify faces.
      */
-    function originClaimHeaders() {
-        const ts = Date.now();
-        const signature = edSign(undefined, Buffer.from(JSON.stringify([config.team, ownCardUrl, ts]), 'utf8'), nodePrivateKey).toString('base64');
-        return {
-            'X-A2A-Caller': config.team,
-            'X-A2A-Caller-Url': ownCardUrl,
-            'X-A2A-Caller-Ts': String(ts),
-            'X-A2A-Caller-Sig': signature,
-        };
+    function originClaimHeaders(target) {
+        return signOriginClaim(target, { caller: config.team, callerUrl: ownCardUrl, privateKey: nodePrivateKey, unbound: config.originClaimUnboundWindow !== false, now: Date.now() });
     }
     const client = new A2aClient({
         apiKey: config.apiKey,
         sessionId: session,
         cardCaller: config.team,
         // gh#9+gh#10 OriginClaim (docs/protocol/delivery-origin-auth.md): every
-        // peer request carries a verifiable origin — canonical form is the
-        // ruled JSON.stringify([caller, callerUrl, ts]), signed with the node
-        // card key (single identity anchor). Until the server settles the URL
-        // is unknown; the signer returns plain naming for that brief window.
+        // peer request carries a verifiable origin bound to its target, signed
+        // with the node card key (single identity anchor). Until the server
+        // settles the URL is unknown; receivers read that as an absent claim.
         originClaim: originClaimHeaders,
         schedule,
         fetch: fetchImpl,
@@ -637,6 +660,8 @@ export function apply(ctx, config) {
     // may sit in many teams; routing to <team>/canvas/<name> resolves the
     // first live member or wakes the first cold one (member order = priority).
     const canvasStore = new CanvasStore(join(home, 'a2a', 'canvas.json'));
+    // #91 file channel: the sender host's blob store (docs/design/file-channel.md).
+    const blobStore = new BlobStore(join(home, 'a2a'));
     // Spatial presentation state for the full-page stage (contract v2).
     const layoutStore = new LayoutStore(join(home, 'a2a', 'canvas-layout.json'));
     // The async-task ledger: every route that leaves a task owed a receipt is
@@ -650,13 +675,34 @@ export function apply(ctx, config) {
     // here. It grants no presence: reports land in a bounded ring the state
     // route serves, never in any routable surface.
     const reportRing = [];
-    const reportLastAt = new Map();
     // Quick-dispatch face (0.6.9): the workbench POSTs /__dsh_a2a/dispatch as a
     // human gesture; the window keeps a runaway page (or a stuck autorefresh)
     // from flooding the mesh. Keyed by client address, mirror of reportLastAt.
     const dispatchLastAt = new Map();
-    /** Fix ④ loop circuit-breaker: session+text-hash → accepted-report timestamps (10min window). */
-    const reportLoopRing = new Map();
+    /**
+     * #114 S4: the judge of one settler against each correlated row's
+     * authorization chain (design §4.2). `observe` records what enforce would
+     * refuse and settles as before; `enforce` keeps a refused row owed. No
+     * settler (a path that knows none), or settlementAuth off, judges nothing.
+     */
+    function settlementJudgeFor(settler, parsedForJudge, alwaysEnforce = false) {
+        return settler === undefined || (config.settlementAuth === 'off' && !alwaysEnforce) ? undefined : {
+            enforce: alwaysEnforce || config.settlementAuth === 'enforce',
+            settler: { caller: settler.caller, proof: settler.proof, ingress: settler.ingress },
+            check: (row, echo) => judgeSettlement(row, settler, {
+                hostLabel: session,
+                membersOf: (team) => {
+                    const name = parseCanvasTeamName(team);
+                    if (name === undefined)
+                        return undefined;
+                    // Canvas members by session id and by handle, as the faces store them.
+                    return canvasStore.membersOf(name).flatMap(m => (m.includes('/') ? [m] : [m, `${config.team}/${id8(m)}`]));
+                },
+                ...(parsedForJudge?.envelope?.onBehalfOf !== undefined ? { onBehalfOf: parsedForJudge.envelope.onBehalfOf } : {}),
+                echo,
+            }),
+        };
+    }
     /**
      * Settle one message through the ledger and announce what it correlated
      * on `a2a/receipt-resolved` — the seam peer plugins (native-teams)
@@ -667,7 +713,9 @@ export function apply(ctx, config) {
      * the consumer's own discipline — keep seam listeners synchronous.
      * @param message - the inbound or relayed message text.
      */
-    function settleAndAnnounce(message) {
+    function settleAndAnnounce(message, settler) {
+        const parsedForJudge = parseReceipt(message);
+        const judge = settlementJudgeFor(settler, parsedForJudge);
         // W7 slice-2 hook 3: a receipt that correlates an id THIS node's
         // idempotency ledger claimed records the receipt's human line as that
         // key's outcome. Parsed DIRECTLY off the receipt codec — a claimed key
@@ -677,24 +725,41 @@ export function apply(ctx, config) {
         // the envelope's controlled-vocabulary outcome is never a product and
         // must not be recorded as one. First-write wins inside the store, so a
         // late receipt never overwrites a precise sync-hook record.
-        const parsed = parseReceipt(message);
+        const parsed = parsedForJudge;
         if (parsed !== null && parsed.taskId !== '') {
             const line = parsed.summary.trim();
-            if (line !== '') {
+            // #114 S4 (design §4.2.2): under enforce, the receipt hook writes the
+            // outcome a /a2a/query answers only for a row THIS ledger owes and
+            // whose settler is on the chain — anyone sending a receipt line could
+            // otherwise rewrite another caller's answer.
+            const row = judge?.enforce === true ? taskLedger.find(parsed.taskId) : undefined;
+            const allowed = judge?.enforce !== true || (row !== undefined && judge.check(row, false).ok);
+            if (line !== '' && allowed) {
                 idempotencyStore.recordOutcome(parsed.taskId, { status: 'completed', reply: line.slice(0, SUMMARY_CAP) });
             }
         }
-        const resolved = taskLedger.resolveFromMessage(message);
+        // A header that names an owed row and comes back unresolved was refused
+        // (enforce): that is the verdict — the echo fallback must not judge the
+        // same message a second time.
+        const owedRow = parsed !== null && parsed.taskId !== '' ? taskLedger.find(parsed.taskId) : undefined;
+        const owedByHeader = owedRow !== undefined;
+        // #139 (design §4.4): an enforce refusal of the row the header names is
+        // told to the sender on the wire response, not only in /state.
+        const headerVerdict = judge?.enforce === true && owedRow !== undefined ? judge.check(owedRow, false) : undefined;
+        const resolved = taskLedger.resolveFromMessage(message, judge);
+        if (resolved === undefined && owedByHeader) {
+            return headerVerdict !== undefined && !headerVerdict.ok ? { status: 'refused', reason: headerVerdict.reason, task_id: parsed.taskId } : undefined;
+        }
         if (resolved === undefined) {
             // F5 (settlement integrity): the formal envelope missed — an inbound
             // message that still echoes a pending task id means the peer
             // demonstrably responded to it, which settles the debt even when the
             // receipt formality never rode the reply.
-            const echoed = taskLedger.resolveEcho(message);
+            const echoed = taskLedger.resolveEcho(message, judge);
             if (echoed.length > 0) {
                 logger.info(`a2a: ${String(echoed.length)} pending task(s) settled by content echo (${echoed.join(', ')})`);
             }
-            return;
+            return undefined;
         }
         try {
             ctx.emit('a2a/receipt-resolved', resolved);
@@ -702,6 +767,32 @@ export function apply(ctx, config) {
         catch (error) {
             logger.warn(`a2a: receipt-resolved listener rejected: ${String(error)}`);
         }
+        return undefined;
+    }
+    /**
+     * gh#141: a receipt this node sent across hosts pays its own debt — the
+     * inbound row the answered delivery was born with (F2'). The same-host
+     * path settles in settleAndAnnounce, as the receipt lands in-process; a
+     * receipt that leaves over the wire never passed this ledger, so the row
+     * stayed owed (and kept the async nudge armed) until its dead TTL. Only
+     * an inbound row whose receipt target is the team the receipt reached
+     * settles, and only for an on-chain payer, whatever settlementAuth says:
+     * this path is new, so "observe settles as before" has no before to keep
+     * (review of PR #149 P2-1) — another session on this host never pays a
+     * row it was not delivered. A settled row records the receipt's line as
+     * its claimed key's outcome, as the in-process path does (hook 3).
+     * @param message - the receipt text as delivered.
+     * @param creditor - the team the receipt was delivered to.
+     * @param payer - who sent it on this host.
+     */
+    function settleOwnInbound(message, creditor, payer) {
+        const parsed = parseReceipt(message);
+        if (parsed === null || parsed.taskId === '')
+            return;
+        const settled = taskLedger.resolveFromMessage(message, settlementJudgeFor(payer, parsed, true), row => row.direction === 'inbound' && row.peer === `local:${creditor}`);
+        const line = parsed.summary.trim();
+        if (settled !== undefined && line !== '')
+            idempotencyStore.recordOutcome(parsed.taskId, { status: 'completed', reply: line.slice(0, SUMMARY_CAP) });
     }
     // Server-side idempotency keys (work-order P3): a caller-born task id
     // executes at most once inside the 24h window — same-key replays answer
@@ -721,6 +812,37 @@ export function apply(ctx, config) {
     // Live top-level agents: the join surface's candidates and the cold-row
     // complement (apply scope — the direct-route wake below reads it too).
     const liveRoots = new Map();
+    // Node identity N2+N3: a joined session that carries a node gets that node's layers on its own scope.
+    const nodeBindings = new NodeBindings(join(home, 'a2a'));
+    const nodeReviews = new NodeReviewQueue(join(home, 'a2a'));
+    const nodeTaint = new SessionTaint(join(home, 'a2a'));
+    // N4: a SUBAGENT's mark climbs to every ancestor it reports to (session.header: origin 'subagent' + parentSession). A
+    // fork is not climbed: its source never sees the fork's text, and the fork's inherited log carries its own evidence.
+    const markLineage = (agent, via) => {
+        const seen = new Set();
+        for (let a = agent; a !== undefined && !seen.has(String(a.id));) {
+            seen.add(String(a.id));
+            nodeTaint.mark(String(a.id), via);
+            const header = a.session?.header;
+            if (header?.origin !== 'subagent' || typeof header.parentSession !== 'string' || header.parentSession === '')
+                return;
+            const next = ctx.get('agents')?.get(header.parentSession);
+            if (next === undefined) {
+                nodeTaint.mark(header.parentSession, via);
+                return;
+            }
+            a = next;
+        }
+    };
+    ctx.on('tools/post-execute', (exec, result, next) => { const via = result.isError ? (/^a2a_(route|tasks|teams|status|probe|file_send|file_fetch)$/.test(exec.name) ? `${exec.name}:error` : '') : toolTaint(exec.name, result.value); if (via !== '')
+        markLineage(exec.agent, via); return next(); });
+    const nodeTasks = new NodeTasks(join(home, 'a2a'), { probe: githubProbe(), logger, onSettled: (node, p) => nodeBinder.remind(node, settledReminder(p)) });
+    nodeTasks.schedule(ctx);
+    const nodeBinder = createNodeBinder({ store: nodeStore, bindings: nodeBindings, logger, joined: id => joinedSessions.has(id), joinedList: () => joinedSessions.list(), archived: id => archivedSessionFilter()?.(id) === true, live: id => liveRoots.get(id), tasksText: node => nodeTasks.render(node), pendingReminders: node => nodeTasks.takePending(node).map(settledReminder), selfUpdate: { store: nodeStore, queue: nodeReviews, taint: nodeTaint, events: agent => sessionEventsOf(agent), localSession: id => liveRoots.has(id) || joinedSessions.has(id) } });
+    // No boot reconcile: a joined.json that failed to parse reads as empty, and ending every binding on that
+    // reading would destroy them (the 3081 lesson). A stale row is harmless — mount checks joined itself.
+    ctx.effect(() => joinedSessions.onChange(() => { nodeBinder.reconcile(); }), 'a2a: node bindings follow join');
+    ctx.effect(() => () => { nodeBinder.disposeAll(); }, 'a2a: node mounts');
     // Last foreground wake/route demand (epoch ms): boot prewarm steps yield
     // while demand keeps arriving inside the quiet window. Panel polls never
     // touch this — they are constant and would starve warming forever.
@@ -841,7 +963,10 @@ export function apply(ctx, config) {
         for (const id of joinedSessions.list()) {
             if (!isArchived(id))
                 continue;
+            const ownHandle = ownCanvasHandleOf(id, true);
             sessionNodes.delete(id);
+            // Sections come back at the next mount (re-publish) if this archived reading was transient; the row stays.
+            nodeBinder.suspend(id);
             // The archived session's JOIN INTENT is retained: deleting it was the
             // 3081 wake-defect root cause (a transient archived-window reading
             // wiped intents at boot, and cold sessions then never woke — "no cold
@@ -849,6 +974,8 @@ export function apply(ctx, config) {
             // archived intents (:804), card assembly and the state cold rows filter
             // them, the reconciler skips them, and JOIN_CAP bounds the file.
             canvasStore.dropMember(id);
+            if (ownHandle !== undefined)
+                canvasStore.dropMember(ownHandle);
             // S2 consistency: an archived node's roster declarations die with it
             // — a left node keeps no team membership.
             teamMemberships.dropSession(id);
@@ -900,6 +1027,87 @@ export function apply(ctx, config) {
             return `import-${imported[1].slice(0, 8)}`;
         return bare.slice(0, 8);
     }
+    /**
+     * gh#131: the local session one of this host's own handles names — the
+     * `<zone>/<id8>` of a joined or live, unarchived session here — when that
+     * is the only reading. An id8 shared by two local sessions names neither,
+     * and a handle a configured peer's card also publishes (an id8 collision
+     * across hosts: the operator may mean the peer's session) stays remote.
+     * Only the peers the directory resolves through count (seeded and
+     * delegates, review of PR #151 P3-1): a host learned by referral cannot
+     * veto the local reading with an unsigned sessionTeams row.
+     * @param ref - a remote-shaped member ref.
+     * @returns the local session id, or undefined.
+     */
+    function localSessionOfHandle(ref) {
+        return localHandleResolver()(ref);
+    }
+    /**
+     * One snapshot of {@link localSessionOfHandle} for many lookups: the
+     * archived filter, the local id8 index and the seeded peers' cards are
+     * read once (review of PR #151 P3-e).
+     * @param includeArchived - count archived sessions too (the archive prune
+     *   drops an archived session's own handle).
+     */
+    function localHandleResolver(includeArchived = false) {
+        const isArchived = includeArchived ? undefined : archivedSessionFilter();
+        const byHandle = new Map();
+        for (const id of new Set([...joinedSessions.list(), ...sessionNodes.keys()])) {
+            if (isArchived?.(id) === true)
+                continue;
+            const handle = `${config.team}/${id8(id)}`;
+            byHandle.set(handle, [...(byHandle.get(handle) ?? []), id]);
+        }
+        const published = new Set();
+        for (const url of new Set([...peerStore.listSeeded(), ...config.delegates.map(delegate => delegate.url)])) {
+            const card = cardCache.get(url)?.card;
+            if (card !== undefined && card.session !== session)
+                for (const row of card.sessionTeams ?? [])
+                    published.add(row.team);
+        }
+        return (ref) => {
+            const hits = byHandle.get(ref);
+            return hits?.length === 1 && !published.has(ref) ? hits[0] : undefined;
+        };
+    }
+    /**
+     * gh#131: the handle a canvas may hold for one local session — its own
+     * `<zone>/<id8>` when that handle reads as this session — so leave,
+     * archive and removal drop it with the id (review of PR #151 P2: a
+     * handle-stored membership must not outlive the session's consent).
+     * @param id - the local session id (still joined when this is read).
+     */
+    function ownCanvasHandleOf(id, includeArchived = false) {
+        const handle = `${config.team}/${id8(id)}`;
+        return localHandleResolver(includeArchived)(handle) === id ? handle : undefined;
+    }
+    /**
+     * gh#152: a local session's canvas teams as every READ face sees them — the
+     * stored member id, or one of this host's own handles that reads as this
+     * session (a fleet edit stored it by handle; routing has read that shape
+     * through canvasLocalMembersOf since gh#131). Visibility now matches
+     * routability: whoami, the scoped teams listing and the state face show the
+     * canvas a handle-stored membership puts the session in.
+     */
+    function canvasTeamsOfSession(id) {
+        const teams = new Set(canvasStore.teamsOf(id));
+        const own = ownCanvasHandleOf(id);
+        if (own !== undefined)
+            for (const name of canvasStore.teamsOf(own))
+                teams.add(name);
+        return [...teams];
+    }
+    /**
+     * gh#131: a canvas team's members as the local routing tiers read them —
+     * one of this host's own handles stands for the session it names (a fleet
+     * edit stored it by handle). Read at route time, never written back: a
+     * reading that depends on which peer cards are cached must not rewrite
+     * the store (review of PR #151 P2-2).
+     */
+    function canvasLocalMembersOf(name) {
+        const resolve = localHandleResolver();
+        return canvasStore.membersOf(name).map(id => (isRemoteMemberRef(id) ? resolve(id) ?? id : id));
+    }
     /** The 8-char suffix of one agent's id. */
     function agentId8(agent) {
         return id8(String(agent.id));
@@ -948,7 +1156,7 @@ export function apply(ctx, config) {
     function canvasLiveAgent(name, skipId) {
         if (name === undefined)
             return undefined;
-        for (const id of canvasStore.membersOf(name)) {
+        for (const id of canvasLocalMembersOf(name)) {
             if (id === skipId)
                 continue;
             const agent = sessionNodes.get(id);
@@ -968,7 +1176,7 @@ export function apply(ctx, config) {
         if (name === undefined)
             return undefined;
         const isArchived = archivedSessionFilter();
-        return canvasStore.membersOf(name).find(id => id !== skipId && joinedSessions.has(id) && !liveRoots.has(id) && isArchived?.(id) !== true);
+        return canvasLocalMembersOf(name).find(id => id !== skipId && joinedSessions.has(id) && !liveRoots.has(id) && isArchived?.(id) !== true);
     }
     /**
      * Human-facing node facts for one session: the session title (fallback:
@@ -1124,10 +1332,12 @@ export function apply(ctx, config) {
             liveRoots.set(String(agent.id), agent);
             if (joinedSessions.has(String(agent.id)))
                 mountSessionNode(agent);
+            nodeBinder.mount(agent);
             return undefined;
         });
         ctx.on('agent/disposed', ({ agent }) => {
             liveRoots.delete(String(agent.id));
+            nodeBinder.forget(String(agent.id));
             // Disposal unmounts the runtime node; the persisted intent stays for
             // the remount above (leave is the only intent remover).
             sessionNodes.delete(String(agent.id));
@@ -1136,6 +1346,7 @@ export function apply(ctx, config) {
             liveRoots.set(String(agent.id), agent);
             if (joinedSessions.has(String(agent.id)))
                 mountSessionNode(agent);
+            nodeBinder.mount(agent, { atFrozen: true });
         }
         /** F-observability: the boot prewarm's lifecycle, surfaced on the state route (F: prewarm not running was invisible). */
         const prewarmStatus = { state: 'off', attempted: 0, woken: 0, failed: [] };
@@ -1417,7 +1628,7 @@ export function apply(ctx, config) {
                     at: now,
                     rows: all
                         .filter(row => row.local !== true)
-                        .map(row => ({ team: row.team, name: row.name, ...(row.origin !== undefined ? { origin: row.origin } : {}), ...(row.via !== undefined ? { via: row.via } : {}), ...(row.workspace !== undefined ? { workspace: row.workspace } : {}), ...(row.legacy === true ? { legacy: true } : {}), ...(row.teams !== undefined && row.teams.length > 0 ? { teams: [...row.teams] } : {}) })),
+                        .map(row => ({ team: row.team, name: row.name, ...(row.origin !== undefined ? { origin: row.origin } : {}), ...(row.via !== undefined ? { via: row.via } : {}), ...(row.workspace !== undefined ? { workspace: row.workspace } : {}), ...(row.legacy === true ? { legacy: true } : {}), ...(row.unreachable === true ? { unreachable: true } : {}), ...(row.teams !== undefined && row.teams.length > 0 ? { teams: [...row.teams] } : {}) })),
                 };
             })
                 .catch(() => { })
@@ -1428,11 +1639,13 @@ export function apply(ctx, config) {
         whenWebServerSettled((webServer) => {
             // gh#77 B1: the admin faces live in src/faces/admin.ts.
             registerAdminFaces(webServer, {
-                ctx, config, logger, home, session, lanIp, PLUGIN_VERSION, controlRoute, controlTrustedWithoutKey, readJsonBody, peerStore, peerLinkState, originClaimHeaders, refreshRemoteRows, joinedSessions, exposureStore, teamMemberships, cliDeposits, groupStore, canvasStore, layoutStore, taskLedger, idempotencyStore, inFlightRoutes, recentActivity, teamAuditRing, reportRing, sessionNodes, liveRoots, mountSessionNode, coldJoinedIds, prewarmStatus, reconcileStatus, id8, sessionLabelOf, sessionTeamOf, nodeMetadataOf, canvasTeamOf, archivedSessionFilter, pruneArchivedJoins, pruneCanvasMemberships, verifyOriginClaim, callerLinkedToThisHost, cachedCardFetch,
+                ctx, config, logger, home, session, lanIp, PLUGIN_VERSION, controlRoute, controlTrustedWithoutKey, readJsonBody, peerFetch, peerStore, peerLinkState, originClaimHeaders, refreshRemoteRows, joinedSessions, exposureStore, teamMemberships, cliDeposits, groupStore, canvasStore, layoutStore, taskLedger, idempotencyStore, inFlightRoutes, recentActivity, teamAuditRing, reportRing, sessionNodes, liveRoots, mountSessionNode, coldJoinedIds, prewarmStatus, reconcileStatus, id8, sessionLabelOf, sessionTeamOf, ownCanvasHandleOf, localSessionOfHandle, canvasTeamsOfSession, nodeMetadataOf, canvasTeamOf, archivedSessionFilter, pruneArchivedJoins, pruneCanvasMemberships, verifyOriginClaim, callerLinkedToThisHost, cachedCardFetch, authorizationView,
                 indexUrl: import.meta.url,
                 get cardCache() { return cardCache; },
                 get remoteRowsCache() { return remoteRowsCache; },
                 get legacyInboundCount() { return legacyInboundCount; },
+                get unboundInboundCount() { return unboundInboundCount; },
+                get boundMissInboundCount() { return boundMissInboundCount; },
                 get ownCardUrl() { return ownCardUrl; },
                 get ownerAllowlist() { return ownerAllowlist; },
                 set ownerAllowlist(v) { ownerAllowlist = v; },
@@ -1441,6 +1654,7 @@ export function apply(ctx, config) {
                 get ownerAnnounceRestartPending() { return ownerAnnounceRestartPending; },
                 set ownerAnnounceRestartPending(v) { ownerAnnounceRestartPending = v; },
             });
+            registerNodeFaces(webServer, { ctx, logger, nodeStore, bindings: nodeBindings, binder: nodeBinder, tasks: nodeTasks, reviews: nodeReviews, apiKey: () => config.apiKey, secretEqual, controlRoute, readJsonBody });
         });
     }
     if (config.announce) {
@@ -1573,7 +1787,10 @@ export function apply(ctx, config) {
                         // zone/id8 handles (local session ids translate to the node's
                         // session-team handle) — one form on the wire, so readers never
                         // mix id/handle shapes (owner: 数据对不上).
-                        ...(named ? { canvasOrg: canvasStore.list().map(name => ({ name, team: canvasTeamOf(name), members: canvasStore.membersOf(name).map(id => sessionNodes.has(id) || joinedSessions.has(id) ? `${config.team}/${id8(id)}` : id) })) } : {}),
+                        // gh#152: members are read through the local tiers' lens — one of
+                        // this host's own handles resolves to the session it names, and
+                        // the two stored shapes of one session publish as ONE handle.
+                        ...(named ? { canvasOrg: canvasStore.list().map(name => ({ name, team: canvasTeamOf(name), members: [...new Set(canvasLocalMembersOf(name))].map(id => sessionNodes.has(id) || joinedSessions.has(id) ? `${config.team}/${id8(id)}` : id) })) } : {}),
                         ...(named && lanIp !== '' ? { lanIp } : {}),
                         ...(PLUGIN_VERSION !== '' ? { version: PLUGIN_VERSION } : {}),
                         description: `A2A node exposing team ${config.team}${named ? '' : ' (minimal card — OriginClaim envelope required for the full card: X-A2A-Caller/-Url/-Ts/-Sig signed with your card key)'}`,
@@ -1625,12 +1842,15 @@ export function apply(ctx, config) {
      * so ui-chat renders the relay body ("来自 X" + full text) instead of an
      * opaque row; omitted when the sender is not meaningfully addressable.
      */
-    function steerRelay(agent, text, sender) {
+    function steerRelay(agent, text, sender, localFrom) {
+        // N4/gh#198: a relay steer carries content from outside this host — unless it is an in-process delivery from a clean local session (localFrom), whose taint the target then takes.
+        if (localFrom === undefined || nodeTaint.of(localFrom) !== '')
+            markLineage(agent, 'relay');
         agent.steer({
             id: MessageId(`a2a-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`),
             role: 'user',
             content: [{ type: 'text', text }],
-            source: { kind: 'a2a-relay', form: 'relay', ...(sender === undefined ? {} : { senderSessionId: sender }) },
+            source: { kind: 'a2a-relay', form: 'relay', ...(sender === undefined ? {} : { senderSessionId: sender }), ...(localFrom === undefined ? {} : { localSender: localFrom }) },
         });
     }
     /** The cooperative stop-notice text, shared by the tasks/cancel control
@@ -1697,19 +1917,20 @@ export function apply(ctx, config) {
      * visible for /a2a/query follow-ups.
      */
     const nudgeBudget = new Map();
+    const nudgeRef = (taskId) => createHash('sha256').update(taskId, 'utf8').digest('hex').slice(0, 16);
     const escalateQueuePrompt = (agent, team, taskId) => {
-        // Queue-mode prompt seam: the session controller owns prompt admission
-        // (successor of the removed api gateway's prompt face).
+        // Queue-mode prompt seam (the session controller owns prompt admission); #183: it stamps kind:'user', so nudgeRef stands in for the caller's task id.
         const controller = ctx.get('sessionController');
         if (typeof controller?.prompt !== 'function')
             return;
-        logger.info(`a2a: async nudge escalates to queue-mode prompt for ${team} (task ${taskId})`);
+        markLineage(agent, 'nudge');
+        logger.info(`a2a: async nudge escalates to queue-mode prompt for ${team} (task ${taskId}, ref ${nudgeRef(taskId)})`);
         try {
             void controller.prompt({
-                requestId: `a2a-nudge-${taskId}`,
+                requestId: `a2a-nudge-${nudgeRef(taskId)}`,
                 sessionId: agent.id,
                 mode: 'queue',
-                content: [{ type: 'text', text: `[A2A nudge] (task ${taskId}) your earlier routed message was delivered while this session could not start a turn — please consume the inbox backlog now (ignore if there is nothing pending).` }],
+                content: [{ type: 'text', text: `[A2A nudge] (ref ${nudgeRef(taskId)}) an earlier A2A delivery reached this session while it could not start a turn — please consume the inbox backlog now (ignore if there is nothing pending).` }],
             }, new AbortController().signal).catch(() => { });
         }
         catch {
@@ -1749,8 +1970,8 @@ export function apply(ctx, config) {
             // the current live node, or the wake path materializes the session
             // afresh.
             const fresh = resolveAgentForTeam(team) ?? agent;
-            logger.info(`a2a: async nudge re-waking ${team} (task ${taskId} delivered but not consumed)`);
-            steerRelay(fresh, `[A2A nudge] (task ${taskId}) your earlier routed message was delivered while this session could not start a turn — please consume the inbox backlog now.`);
+            logger.info(`a2a: async nudge re-waking ${team} (task ${taskId}, ref ${nudgeRef(taskId)}, delivered but not consumed)`);
+            steerRelay(fresh, `[A2A nudge] (ref ${nudgeRef(taskId)}) an earlier A2A delivery reached this session while it could not start a turn — please consume the inbox backlog now.`);
         }, delayMs);
         ctx.effect(() => () => clearTimeout(timer), `a2a: async nudge ${taskId}`);
     }
@@ -1767,7 +1988,7 @@ export function apply(ctx, config) {
      * receipts themselves are never tracked as new debts.
      */
     const receiptWarnAt = new Map();
-    function armReceiptAutosend(target, taskId, callerTeam, deliveredText) {
+    function armReceiptAutosend(target, taskId, callerTeam, deliveredText, steerFloor) {
         if (!callerTeam || callerTeam === '')
             return;
         // Never synthesize a receipt for a receipt: answering an envelope by mail
@@ -1781,6 +2002,10 @@ export function apply(ctx, config) {
         // even if a future path reopens it.
         if (callerTeam === `${config.team}/${agentId8(target)}`)
             return;
+        // #114 S5: the waiter is tied to THIS task's steer — only a final the
+        // target produced after consuming `[A2A direct] (task <id>)` answers it
+        // (flushFinals). A busy target's other work line can no longer settle
+        // a task it has not read yet (the #61 direct-bb27ec94 shape).
         registerFinalWaiter(target, (finalText, placeholder) => {
             // W7 slice-2: a host-authored placeholder (flush timeout, dead
             // session) must not synthesize a COMPLETION receipt — a wedged
@@ -1798,7 +2023,15 @@ export function apply(ctx, config) {
             const summary = `${finalText.trim().replace(/\s+/g, ' ').slice(0, SUMMARY_CAP) || 'done'} (auto)`;
             // v2 envelope projection: header stays byte-compatible for every
             // legacy correlator; the machine JSON rides exactly one following line.
-            const receipt = formatReceipt(taskId, summary, { outcome: 'completed', idempotencyKey: taskId });
+            // #114 S5 binding: onBehalfOf names the session that did the work (the
+            // host is only its courier); authRef pins the inbound authorization
+            // record the delivery was born with — recorded for audit, judged by S4.
+            const receipt = formatReceipt(taskId, summary, {
+                outcome: 'completed',
+                idempotencyKey: taskId,
+                onBehalfOf: sessionTeamOf(target),
+                ...(row?.auth !== undefined ? { authRef: authorizationRef(row.auth) } : {}),
+            });
             // Three-tier hard order (work-order P2): caller lane first; on failure
             // escalate ONCE to the owner mailbox — the outcome never evaporates
             // just because the original waiter died. Archive holds truth regardless.
@@ -1809,7 +2042,18 @@ export function apply(ctx, config) {
             // settled undefined as tier-1 success, so the receipt would vanish
             // without a log.
             void runReceiptLadder({
-                deliver: (team) => dispatchAnywhere(team, receipt, session, undefined, new AbortController().signal, true),
+                deliver: async (team) => {
+                    // gh#217: across hosts the caller admits a session face it linked, never this host's process label; a
+                    // task for the bare process team keeps the label, the only host face the settlement judge accepts (N1).
+                    const peerCaller = row?.auth?.target.includes('/') === true ? sessionTeamOf(target) : undefined;
+                    const delivered = await dispatchAnywhere(team, receipt, session, undefined, new AbortController().signal, true, undefined, peerCaller);
+                    // gh#141: the caller lane pays this delivery's inbound row across hosts (a
+                    // same-host receipt already settled it in-process), unless the caller
+                    // refused it. The owner tier is no payment here — but an owner mailbox
+                    // on THIS host settles the row in-process, as it always has.
+                    if (team === callerTeam && delivered.settlementRefused !== true)
+                        settleOwnInbound(receipt, callerTeam, { caller: session, proof: 'in-process', ingress: 'local' });
+                },
                 ownerTeam: config.team,
                 log: (stage, error) => {
                     // N2 (observability): throttled per task to avoid ping-pong noise.
@@ -1822,17 +2066,26 @@ export function apply(ctx, config) {
             }, callerTeam).catch(() => {
                 // Ladder exhausted: the throttled breadcrumbs above already said why.
             });
-        });
+        }, { taskId, steerFloor });
     }
     /**
      * Register one final-reply waiter for the agent and arm its flush timeout.
      * @param agent - the agent whose next assistant message answers the waiter.
      * @param answer - how the waiter's reply is delivered.
+     * @param attribution - #114 S5: attribute by consumption — only the turn
+     *   that consumed this task's `[A2A direct] (task <id>)` user message
+     *   answers the waiter; the search starts at `steerFloor`, the log length
+     *   read just before the steer, so an older steer of a reused id never
+     *   anchors it.
      * @returns the registered waiter (for callers that may retract it).
      */
-    function registerFinalWaiter(agent, answer) {
+    function registerFinalWaiter(agent, answer, attribution) {
         const key = String(agent.id);
-        const waiter = { answer, sinceEvents: sessionEventsOf(agent).length };
+        const waiter = {
+            answer,
+            sinceEvents: sessionEventsOf(agent).length,
+            ...(attribution !== undefined && attribution.taskId !== '' ? { taskId: attribution.taskId, scannedTo: attribution.steerFloor } : {}),
+        };
         waiter.timeoutDisposer = armFlushTimeout(key, waiter);
         pendingFinals.set(key, [...(pendingFinals.get(key) ?? []), waiter]);
         return waiter;
@@ -1845,15 +2098,15 @@ export function apply(ctx, config) {
      * marker instead of a (false) completion.
      * @param taskId - the correlation key the steered receipt header carries.
      */
-    async function routeIntoAgent(team, message, caller, taskId) {
+    async function routeIntoAgent(team, message, caller, taskId, proofClause, buildHeader, localFrom) {
         const agent = resolveAgentForTeam(team) ?? canvasLiveAgent(parseCanvasTeamName(team));
         if (agent !== undefined) {
-            return routeIntoAgentFor(agent, team, message, caller, taskId);
+            return routeIntoAgentFor(agent, team, message, caller, taskId, proofClause, buildHeader, localFrom);
         }
         // Wake-on-route: a cold joined team materializes on demand, then steers.
         const wake = wakeColdTeam(team);
         if (wake.kind === 'flight') {
-            return wake.flight.then(agent => routeIntoAgentFor(agent, team, message, caller, taskId), (error) => ({ ok: false, error: `waking the session for team "${team}" failed: ${String(error)}` }));
+            return wake.flight.then(agent => routeIntoAgentFor(agent, team, message, caller, taskId, proofClause, buildHeader, localFrom), (error) => ({ ok: false, error: `waking the session for team "${team}" failed: ${String(error)}` }));
         }
         // Native-teams inbound bridge (opt-in): a registry team claims the
         // handle and dispatches through its authoritative seam. Checked before
@@ -1862,7 +2115,7 @@ export function apply(ctx, config) {
         if (config.nativeTeamsInbound === true) {
             const prepared = await nativeTeamsPrepare(team);
             if (prepared.ok) {
-                const bridged = await nativeTeamsRound(prepared, team, caller, message, taskId);
+                const bridged = await nativeTeamsRound(prepared, team, caller, message, taskId, proofClause ?? '未验证（in-process）', undefined, buildHeader === undefined ? undefined : (_team, _taskId, from) => buildHeader(from));
                 if (bridged.ok) {
                     if (bridged.settled)
                         return { ok: true, reply: bridged.reply };
@@ -1882,7 +2135,7 @@ export function apply(ctx, config) {
             if (live !== undefined) {
                 if (callerIsAgent(live, caller))
                     return { ok: false, error: selfRouteText(team) };
-                return routeIntoAgentFor(live, team, message, caller, taskId);
+                return routeIntoAgentFor(live, team, message, caller, taskId, proofClause, buildHeader);
             }
             return { ok: false, error: 'No live DSH agent is available to accept this message.' };
         }
@@ -1897,7 +2150,7 @@ export function apply(ctx, config) {
      * @param caller - caller label for the steered prefix.
      * @returns the agent's final reply, or the explicit failure.
      */
-    function routeIntoAgentFor(agent, team, message, caller, taskId) {
+    function routeIntoAgentFor(agent, team, message, caller, taskId, proofClause, buildHeader, localFrom) {
         return new Promise((resolve) => {
             const waiter = registerFinalWaiter(agent, (text, placeholder) => {
                 resolve({ ok: true, reply: text, ...(placeholder === true ? { placeholder: true } : {}) });
@@ -1909,12 +2162,12 @@ export function apply(ctx, config) {
             // the caller supplied one, rides the header so an "[A2A receipt] task
             // <id>" answer correlates with the caller's own route result.
             const from = caller === '' ? 'an unknown node' : caller;
-            const taskPrefix = taskId === undefined ? '' : `(task ${taskId}) `;
-            const text = `[A2A direct] ${taskPrefix}${fromClause(from)} (routed to ${team}) sent:
-
-${message}`;
+            const headerLine = buildHeader !== undefined && taskId !== undefined
+                ? buildHeader(from)
+                : `[A2A direct] ${taskId === undefined ? '' : `(task ${taskId}) `}未验证（in-process） ${sanitizeFromClause(from)} (routed to ${team}) sent:`;
+            const text = `${headerLine}\n\n${message}`;
             try {
-                steerRelay(agent, text, caller === '' ? undefined : caller);
+                steerRelay(agent, text, caller === '' ? undefined : caller, localFrom);
             }
             catch (error) {
                 // The waiter was registered above, so the key always holds it; the
@@ -1931,227 +2184,75 @@ ${message}`;
             }
         });
     }
-    function teamsRegistry() {
-        const candidate = ctx.get('teams');
-        if (candidate === undefined || candidate === null)
-            return undefined;
-        if (typeof candidate.describeTarget !== 'function' || typeof candidate.startRound !== 'function' || typeof candidate.listTeams !== 'function')
-            return undefined;
-        return candidate;
+    // gh#77 G-in (S23 repayment): the native-teams inbound bridge moved verbatim
+    // to src/legacy/teams-bridge-inbound.ts — the registry probe, claim memo,
+    // prepare and the bounded round. The outbound bridgeFace stays here until
+    // the G-out slice (it submits through the dispatch trunk).
+    const { teamsRegistry, nativeTeamsClaims, nativeTeamsPrepare, nativeTeamsRound } = createTeamsBridgeInbound({ ctx, config, liveAgent, fromClause, sanitizeFromClause, proofHeader: hostDirectHeader, taint: agent => { markLineage(agent, 'native-teams'); } });
+    /* ── gh#9+gh#10 OriginClaim (docs/protocol/delivery-origin-auth.md,
+       src/origin-claim.ts): the caller's card key signs the envelope; the
+       bound form must name one of OUR origins and the route it hits. ts skew
+       ±5 min, no receiver-side state. Fail-closed everywhere. */
+    /** legacyInbound warn metric (M1): envelope-absent deliveries during the
+     *  window — the operator watches the tail drain before closing it. */
+    let legacyInboundCount = 0;
+    /** unboundInbound: accepted unbound (v1) envelopes — the drain gauge for
+     *  closing originClaimUnboundWindow; boundMissInbound: those of them whose
+     *  bound form missed (a peer dials us by a name not in our audiences). */
+    let unboundInboundCount = 0, boundMissInboundCount = 0;
+    function verifyOriginClaim(req, options) {
+        return verifyOriginClaimOf(req, {
+            cardCache,
+            fetch: fetchImpl,
+            audiences: [ownCardUrl, ...config.originClaimAudiences ?? []],
+            unboundOpen: config.originClaimUnboundWindow !== false,
+            onUnbound: () => { unboundInboundCount += 1; },
+            onBoundMiss: () => { boundMissInboundCount += 1; },
+            loopbackArrival: (config.originClaimUrl ?? '') === '',
+            now: Date.now(),
+            ...(options?.cli === true ? { cliDeposit: cliDepositCard } : {}),
+        });
     }
-    /** Reply-wait parity with the steer path's 180s deadline: native-teams
-     * rounds settle on their own cadence, but a wedged seam must not park a
-     * caller past a bounded window (config.nativeRoundWaitMs). */
-    /** The claim table changes at registry-edit cadence: a short memo dedupes
-     * the double probe (callers pre-check, the round re-verifies) without
-     * pretending the answer is permanent. */
-    const BRIDGE_CLAIM_TTL_MS = 5_000;
-    const bridgeClaimCache = new Map();
-    const bridgeTimers = new Set();
-    ctx.effect(() => () => {
-        for (const timer of bridgeTimers)
-            clearTimeout(timer);
-    });
     /**
-     * Whether the native-teams registry claims `team` as an unambiguous local
-     * target, memoized for {@link BRIDGE_CLAIM_TTL_MS}. Ordinary misses never
-     * throw (the D2 query contract); anything that does throw is treated as a
-     * miss — the bridge is a guest here. The memo is skipped entirely while
-     * the bridge is off, so the flag gates the probe itself.
+     * gh#133: the deposited card a CLI claim is judged by, or undefined when
+     * the claim URL is not a deposit face of a handle held here (the ordinary
+     * zone path then decides). The URL's last path segments must be
+     * `/a2a/cli/<handle>` (any prefix or origin: the CLI dials its home under
+     * whatever address it can — the deposited key, not the address, is the
+     * proof). origin-claim.ts verifies the signature under that card and the
+     * signed name against the handle's own; the claim's caller is the full
+     * HANDLE, so it covers exactly that handle — never a namesake CLI, a zone
+     * session, or the host face (review of PR #135 P1).
      */
-    async function nativeTeamsClaims(team) {
-        if (config.nativeTeamsInbound !== true)
-            return false;
-        const cached = bridgeClaimCache.get(team);
-        if (cached !== undefined && Date.now() - cached.at < BRIDGE_CLAIM_TTL_MS)
-            return cached.claimed;
-        const teams = teamsRegistry();
-        let claimed = false;
-        if (teams !== undefined) {
-            try {
-                const descriptor = await teams.describeTarget(team);
-                claimed = descriptor.plane === 'local' && descriptor.ambiguous !== true && descriptor.localLabel !== undefined;
-            }
-            catch {
-                claimed = false;
-            }
+    function cliDepositCard(callerUrl) {
+        let path;
+        try {
+            path = new URL(callerUrl).pathname;
         }
-        bridgeClaimCache.set(team, { at: Date.now(), claimed });
-        // Bounded memo: probe-miss names accumulate one tiny row each; past a
-        // generous cap, drop the whole table (a cold re-probe costs one local
-        // describeTarget call).
-        if (bridgeClaimCache.size > 512)
-            bridgeClaimCache.clear();
-        return claimed;
-    }
-    /**
-     * Resolve everything the round needs BEFORE any caller is told the
-     * dispatch happened: the claim, the seam, and a parent initiator. The
-     * `error` variant is the only fast-failure shape — `not-claimed` simply
-     * hands the address back to the standard resolution chain.
-     */
-    async function nativeTeamsPrepare(team) {
-        if (!await nativeTeamsClaims(team))
-            return { ok: false, reason: 'not-claimed' };
-        const teams = teamsRegistry();
-        if (teams === undefined)
-            return { ok: false, reason: 'not-claimed' };
-        const parent = liveAgent();
-        if (parent === undefined)
-            return { ok: false, reason: 'error', error: 'No live DSH initiator is available to parent the native-teams round.' };
-        // The alpha.4 Session face dropped the events member (the widened
-        // BridgeTeamsRegistry accepts it optional) — the raw Agent carries the
-        // ambient Session whose shape no longer overlaps, so project through the
-        // widened structural face explicitly (type-level only; the runtime value
-        // is the same live agent).
-        const parentFace = parent;
-        return { ok: true, teams, parent: parentFace };
-    }
-    /** The A2A envelope rides the round message so the dispatcher sees the network origin. */
-    function bridgeEnvelope(team, caller, message, taskId) {
-        const from = caller === '' ? 'an unknown node' : caller;
-        const taskPrefix = taskId === undefined ? '' : `(task ${taskId}) `;
-        return `[A2A direct] ${taskPrefix}${fromClause(from)} (routed to ${team}) sent:\n\n${message}`;
-    }
-    /** The projection for a round that outlived the reply window: unlike the
-     * steer deadline's text, this must NOT promise a receipt — native-teams
-     * rounds route none in this slice. */
-    function bridgeUnsettledReply(team) {
-        return `The native-teams round for "${team}" is still running past the reply window; it was delivered and keeps going. Native-teams rounds route no A2A receipt in this slice — reconcile with a follow-up route (continuity rides the team's own durable round chain).`;
-    }
-    /**
-     * Fire the round and wait, bounded. The caller's signal (when it has one)
-     * cancels the round itself; the deadline releases the caller with the
-     * unsettled projection while the round keeps running detached.
-     * @param prepared - a ready dispatch (claim, seam, parent) from {@link nativeTeamsPrepare}.
-     */
-    async function nativeTeamsRound(prepared, team, caller, message, taskId, external) {
-        const controller = new AbortController();
-        // One listener, always removed after the race: an external abort cancels
-        // the round through its own controller.
-        const onExternalAbort = () => { controller.abort(); };
-        if (external !== undefined) {
-            if (external.aborted)
-                controller.abort();
-            else
-                external.addEventListener('abort', onExternalAbort);
+        catch {
+            return undefined;
         }
-        if (controller.signal.aborted)
-            return { ok: false, error: 'aborted before the native-teams round was dispatched', phase: 'pre-dispatch' };
-        let roundError;
-        let deadlineTimer;
-        const deadline = new Promise(resolve => {
-            deadlineTimer = setTimeout(() => {
-                if (deadlineTimer !== undefined)
-                    bridgeTimers.delete(deadlineTimer);
-                resolve({ kind: 'deadline' });
-            }, config.nativeRoundWaitMs ?? 180_000);
-            deadlineTimer.unref?.();
-            bridgeTimers.add(deadlineTimer);
-        });
-        const verdict = await Promise.race([
-            prepared.teams.startRound({ team, message: bridgeEnvelope(team, caller, message, taskId) }, prepared.parent, controller.signal).then((reply) => ({ kind: 'settled', reply }), (error) => { roundError = error; return { kind: 'failed' }; }),
-            deadline,
-            new Promise(resolve => {
-                if (controller.signal.aborted)
-                    resolve({ kind: 'aborted' });
-                else
-                    controller.signal.addEventListener('abort', () => resolve({ kind: 'aborted' }), { once: true });
-            }),
-        ]);
-        // Hygiene: the losing deadline timer stops here (not 180s later), and
-        // the external-signal listener does not outlive the round.
-        if (deadlineTimer !== undefined) {
-            clearTimeout(deadlineTimer);
-            bridgeTimers.delete(deadlineTimer);
+        const segment = /\/a2a\/cli\/([^/]+)\/?$/.exec(path)?.[1];
+        if (segment === undefined)
+            return undefined;
+        let handle;
+        try {
+            handle = decodeURIComponent(segment);
         }
-        if (external !== undefined)
-            external.removeEventListener('abort', onExternalAbort);
-        if (verdict.kind === 'settled')
-            return { ok: true, reply: verdict.reply, settled: true };
-        if (verdict.kind === 'deadline')
-            return { ok: true, reply: bridgeUnsettledReply(team), settled: false };
-        if (verdict.kind === 'aborted')
-            return { ok: false, error: `the wait for the native-teams round "${team}" was aborted (the round was cancelled with it)`, aborted: true };
-        return { ok: false, error: `the native-teams round for "${team}" failed: ${String(roundError)}` };
-    }
-    /* ── gh#9+gh#10 OriginClaim (docs/protocol/delivery-origin-auth.md).
-       Envelope: X-A2A-Caller / -Url / -Ts / -Sig — canonical form is
-       JSON.stringify([caller, callerUrl, ts]) (R2), signed with the CALLER'S
-       CARD KEY; verification fetches the caller's card at callerUrl through
-       our own enveloped memoized fetch (R1: our fetches are full-form by
-       construction — the client stamps the envelope on every GET), then
-       verifies the signature against THAT card's key and derives the caller
-       name from the card (team or a published session team). ts skew ±5 min,
-       stateless (no nonce ring — ruling refinement). Fail-closed everywhere. */
-    const ORIGIN_CLAIM_SKEW_MS = 5 * 60_000;
-    /** legacyInbound warn metric (M1): envelope-absent deliveries during the
-     *  window — the operator watches the tail drain before closing it. */
-    let legacyInboundCount = 0;
-    const originClaimCallerShape = /^[a-z0-9-]+$/i;
-    async function verifyOriginClaim(req) {
-        const caller = String(req.headers['x-a2a-caller'] ?? '');
-        const callerUrl = String(req.headers['x-a2a-caller-url'] ?? '');
-        const ts = Number(req.headers['x-a2a-caller-ts'] ?? '');
-        const signature = String(req.headers['x-a2a-caller-sig'] ?? '');
-        if (caller === '' || callerUrl === '' || !Number.isFinite(ts) || ts <= 0 || signature === '')
-            return { ok: false, reason: 'absent' };
-        if (!originClaimCallerShape.test(caller))
-            return { ok: false, reason: 'bad-caller-shape' };
-        if (Math.abs(Date.now() - ts) > ORIGIN_CLAIM_SKEW_MS)
-            return { ok: false, reason: 'bad-ts' };
-        // Fetch the caller's card PLAIN (REVIEW M2 third-round ruling: the
-        // envelope names a BARE ZONE, and derivation is the exact match
-        // card.team === caller below — both ride the minimal card's signed
-        // core, so a single envelope-less fetch suffices). An envelope-less
-        // request returns immediately without recursing (the enveloped variant
-        // re-opened mutual recursion); a warm full-form cache entry (R1)
-        // short-circuits the fetch entirely.
-        let card = cardCache.get(callerUrl)?.card;
-        if (card === undefined) {
-            try {
-                // callerUrl is the caller's BASE URL — the card lives at the
-                // well-known path under it.
-                const cardUrl = callerUrl.endsWith('/') ? `${callerUrl}.well-known/agent-card.json` : `${callerUrl}/.well-known/agent-card.json`;
-                const response = await fetchImpl(cardUrl, { method: 'GET', headers: {} });
-                const text = await response.text();
-                const verdict = verifyCard(JSON.parse(text), Date.now());
-                if (verdict.ok)
-                    card = verdict.card;
-                else
-                    req.__claimDbg = { stage: 'verify', reason: verdict.reason, head: text.slice(0, 100) };
-            }
-            catch (error) {
-                ;
-                req.__claimDbg = { stage: 'fetch', error: error instanceof Error ? error.message : String(error) };
-                card = undefined;
-            }
+        catch {
+            return undefined;
         }
-        if (card === undefined)
-            return { ok: false, reason: 'no-card' };
+        const shape = CLI_HANDLE_RE.exec(handle);
+        const deposit = shape === null ? undefined : cliDeposits.get(handle);
+        if (shape === null || deposit === undefined)
+            return undefined;
         try {
-            const publicKey = createPublicKey({ key: Buffer.from(card.publicKey, 'base64'), format: 'der', type: 'spki' });
-            const valid = edVerify(undefined, Buffer.from(JSON.stringify([caller, callerUrl, ts]), 'utf8'), publicKey, Buffer.from(signature, 'base64'));
-            if (!valid)
-                return { ok: false, reason: 'bad-sig' };
+            const verdict = verifyCard(JSON.parse(deposit.cardJson), Date.now());
+            return { handle, name: shape[1], card: verdict.ok && verdict.card.team === handle ? verdict.card : undefined };
         }
         catch {
-            return { ok: false, reason: 'bad-sig' };
-        }
-        // Derivation (REVIEW M2, third-round ruling — shape narrowed to bare
-        // zone): card.team === caller EXACT match. A zone/id8 envelope is
-        // rejected as bad-caller-shape at the gate — session-level identity
-        // rides the body's caller_session, judged by N3/S3 against the PUBLISHED
-        // roster. (The prefix-derivation variant admitted an impersonation
-        // chain: a same-zone foreign host signs the target's session handle
-        // with its own key — prefix matches, signature verifies, full card
-        // serves, and N3 then judges the body by the impersonated roster.
-        // Fleet senders stamp bare zone only; the narrowed shape kills the
-        // false rejections AND the impersonation vector with zero recursion.)
-        if (card.team !== caller) {
-            return { ok: false, reason: 'not-derivable' };
+            return { handle, name: shape[1], card: undefined };
         }
-        return { ok: true, caller, callerUrl, card };
     }
     /**
      * W3 (#18 half-side): is a VERIFIED caller LINKED to this host? Key
@@ -2177,6 +2278,9 @@ ${message}`;
      *      Our operator's config anchors; the card shadow corroborates.
      */
     function callerLinkedToThisHost(caller, callerUrl, callerCard) {
+        // gh#133 review: a CLI identity's card (team = its handle) is never a host link, whatever face asks.
+        if (callerCard !== undefined && CLI_HANDLE_RE.test(callerCard.team))
+            return false;
         // Basis 1, same-host membership (review second-round M-fix): "self" is
         // an ORIGIN equality, not a zone-name equality. `caller === config.team`
         // granted unconditionally in a single-zone fleet (the deployment
@@ -2184,7 +2288,7 @@ ${message}`;
         // shared zone string was "us". True self is the loopback self-fetch
         // face: the caller's card URL origin equals OUR card URL origin.
         try {
-            if (callerUrl !== '' && new URL(callerUrl).origin === new URL(ownCardUrl).origin)
+            if (callerUrl !== '' && isRootOriginUrl(callerUrl) && new URL(callerUrl).origin === new URL(ownCardUrl).origin)
                 return true;
         }
         catch { /* malformed callerUrl — falls through to the record bases */ }
@@ -2213,12 +2317,13 @@ ${message}`;
         // served-fresh field, exactly the self-description trust class
         // N3/V5 abolished. Our operator's own config anchors; the card
         // shadow only corroborates.
+        // #189: a ROOT claim URL speaks for its origin; a path-prefixed one only for the exact peer URL we seeded (a mounted card).
         if (callerCard !== undefined && ownCardUrl !== '') {
             const ourOrigin = new URL(ownCardUrl).origin;
             const callerOrigin = new URL(callerUrl).origin;
             const weSeedThem = config.peers.some(peer => {
                 try {
-                    return new URL(peer).origin === callerOrigin;
+                    return isRootOriginUrl(callerUrl) ? new URL(peer).origin === callerOrigin : sameMountedUrl(peer, callerUrl);
                 }
                 catch {
                     return false;
@@ -2253,218 +2358,112 @@ ${message}`;
      * sessions' declarations. Used by both the inbound faces and the local
      * dispatch candidate so the two paths can never diverge.
      */
-    function sameZoneSharedTeamRefusal(caller, targetTeam) {
-        const declared = new Set();
-        let callerSessionId;
-        for (const entry of teamMemberships.list()) {
-            if (`${config.team}/${id8(entry.session)}` === caller) {
-                callerSessionId = entry.session;
-                for (const t of entry.teams)
-                    declared.add(t);
-            }
-        }
-        // W2②: canvas membership is a link record too — the caller's session
-        // sitting in a canvas team declares that team as much as a roster line.
-        if (callerSessionId === undefined) {
-            for (const id of joinedSessions.list()) {
-                if (`${config.team}/${id8(id)}` === caller) {
-                    callerSessionId = id;
-                    break;
-                }
-            }
-        }
-        if (callerSessionId !== undefined) {
-            for (const name of canvasStore.teamsOf(callerSessionId))
-                declared.add(canvasTeamOf(name));
-        }
-        else {
-            // Issue #43: a same-zone handle that resolves to NO local session is a
-            // CROSS-HOST member (two nodes sharing one zone name — the fleet's
-            // common `dsh` spelling). The canvas link record exists on this host
-            // as a REMOTE MEMBER REF the operator added; the foreign-zone branch
-            // (a2aCallerRefusal) already honors that basis — the same-zone path
-            // must too, or a linked remote member is refused as teamless. The
-            // trust basis is unchanged: this host's operator-composed canvas,
-            // never the caller's self-description (V5).
-            for (const name of canvasStore.list()) {
-                if (canvasStore.remoteMembersOf(name).includes(caller))
-                    declared.add(canvasTeamOf(name));
-            }
-            // gh#71 fix ②: the warm card cache's peer canvasOrg is the same-zone
-            // cross-host basis too — an org entry naming BOTH the caller's handle
-            // and one of THIS host's own handles is a shared team (双向识别: the
-            // composition gesture happened on the other host's board; both ends
-            // are named). Read-only over the cache; a caller org that never names
-            // an own handle still refuses (V5 preserved).
-            const ownHandles = new Set([config.team, ...joinedSessions.list().map(id => `${config.team}/${id8(id)}`)]);
+    // gh#114 S1: the admission rules live in src/task-auth.ts as one pure
+    // decision over these records; the closures below are thin wrappers, so
+    // the faces' refusal texts and the authorization record (S2) can never
+    // disagree. Records are read at decision time, never copied.
+    const admissionRecords = {
+        zone: config.team,
+        get teamScopeRouting() { return config.teamScopeRouting; },
+        id8,
+        canvasTeamOf,
+        memberships: () => teamMemberships.list(),
+        joined: () => joinedSessions.list(),
+        canvasNames: () => canvasStore.list(),
+        canvasTeamsOf: sessionId => canvasStore.teamsOf(sessionId),
+        canvasMembersOf: name => canvasStore.membersOf(name),
+        canvasRemoteMembersOf: name => canvasStore.remoteMembersOf(name),
+        peerOrgs: function* () {
             for (const cached of cardCache.values()) {
                 const org = cached.card?.canvasOrg;
-                if (!Array.isArray(org))
-                    continue;
-                for (const e of org) {
-                    if (typeof e.team !== 'string' || e.team === '' || !Array.isArray(e.members))
-                        continue;
-                    if (e.members.includes(caller) && e.members.some(m => typeof m === 'string' && ownHandles.has(m)))
-                        declared.add(e.team);
-                }
+                if (Array.isArray(org))
+                    yield org;
             }
-        }
-        const routable = new Set([config.team]);
-        for (const id of joinedSessions.list())
-            routable.add(`${config.team}/${id8(id)}`);
-        for (const name of canvasStore.list())
-            routable.add(canvasTeamOf(name));
-        const otherLocalDeclarations = new Set();
-        for (const entry of teamMemberships.list()) {
-            if (`${config.team}/${id8(entry.session)}` === caller)
-                continue;
-            for (const t of entry.teams)
-                otherLocalDeclarations.add(t);
-        }
-        const shared = [...declared].some(t => routable.has(t) || otherLocalDeclarations.has(t));
-        // F5 (gh#26, attribute-owner ruling): same-host admission needs a
-        // TARGET-level intersection — a canvas member used to reach ANY session
-        // team on this host through a host-level link alone. The target's link
-        // set = its roster declarations ∪ its canvas teams. EXCEPTION (ruling,
-        // 成文): the PROCESS face (target === config.team) is the owner face,
-        // not a member face — any shared team clears it.
-        if (targetTeam !== undefined && targetTeam !== config.team) {
-            let targetLinks;
-            const targetId8 = targetTeam.startsWith(`${config.team}/`) ? targetTeam.slice(config.team.length + 1) : undefined;
-            if (targetId8 !== undefined) {
-                // Only a KNOWN local session earns target-level judgement; an
-                // unresolvable handle (archived/foreign spelling) keeps the
-                // host-level basis — an empty target set must not refuse everyone.
-                // The handle carries the id8 SLICE, so resolve it back to the
-                // session id before asking the stores (canvas teamsOf keys by id).
-                const targetSession = joinedSessions.list().find(sessionId => id8(sessionId) === targetId8)
-                    ?? teamMemberships.list().find(entry => id8(entry.session) === targetId8)?.session;
-                if (targetSession !== undefined) {
-                    targetLinks = new Set();
-                    for (const entry of teamMemberships.list()) {
-                        if (entry.session === targetSession)
-                            for (const t of entry.teams)
-                                targetLinks.add(t);
-                    }
-                    for (const name of canvasStore.teamsOf(targetSession))
-                        targetLinks.add(canvasTeamOf(name));
-                    // gh#71 fix ②: the warm cache's org basis at target level too —
-                    // an org entry naming BOTH the caller and the target handle is
-                    // the shared team (same 双向识别 rule as the host-level basis).
-                    for (const cached of cardCache.values()) {
-                        const org = cached.card?.canvasOrg;
-                        if (!Array.isArray(org))
-                            continue;
-                        for (const e of org) {
-                            if (typeof e.team !== 'string' || e.team === '' || !Array.isArray(e.members))
-                                continue;
-                            if (e.members.includes(caller) && e.members.includes(targetTeam))
-                                targetLinks.add(e.team);
-                        }
-                    }
-                }
-            }
-            else {
-                const canvasName = canvasStore.list().find(name => canvasTeamOf(name) === targetTeam);
-                if (canvasName !== undefined) {
-                    targetLinks = new Set([targetTeam]);
-                    for (const memberId of canvasStore.membersOf(canvasName)) {
-                        for (const entry of teamMemberships.list())
-                            if (entry.session === memberId)
-                                for (const t of entry.teams)
-                                    targetLinks.add(t);
-                    }
-                }
-            }
-            if (targetLinks !== undefined) {
-                if ([...declared].some(t => targetLinks.has(t)))
-                    return undefined;
-                return declared.size === 0
-                    ? `caller "${caller}" declares no team membership on this host's roster — a teamless node has no network (S3 phase-3 admission). Declare a shared team on both ends, or route through a teamed member.`
-                    : `caller "${caller}" shares no team with target "${targetTeam}" — declared [${[...declared].join(', ')}], target links [${[...targetLinks].join(', ')}] (F5 target-level admission: a host-level link alone does not open every session team).`;
-            }
-            // Unresolvable target (foreign/zone delegation): host-level basis.
-        }
-        if (shared)
-            return undefined;
-        return declared.size === 0
-            ? `caller "${caller}" declares no team membership on this host's roster — a teamless node has no network (S3 phase-3 admission). Declare a shared team on both ends, or route through a teamed member.`
-            : `caller "${caller}" declares teams [${[...declared].join(', ')}] — none is routable on this node (shared-team admission). Declare a shared team on both ends, or route through a teamed member.`;
+        },
+        liveNodeIds: () => [...sessionNodes.values()].map(agent => String(agent.id)),
+        cliDeposited: handle => cliDeposits.get(handle) !== undefined,
+    };
+    /** W1/W2 shared-team admission (see sameZoneAdmission in src/task-auth.ts). */
+    function sameZoneSharedTeamRefusal(caller, targetTeam) {
+        return refusalOf(sameZoneAdmission(admissionRecords, caller, targetTeam));
     }
-    /**
-     * W1: does a caller label fall under the joined-face admission gate? The
-     * zone/id8 shape with THIS zone names a joined session node — the face
-     * the boundary-hardening wave closes. The initiator face (bare node
-     * team) and foreign-zone labels are judged elsewhere (F1b host-face
-     * rules; the foreign branch below) and stay untouched.
-     */
-    const joinedFaceCallerShape = /^[a-z0-9-]+\/[0-9a-f]{8}$/i;
+    /** W1: the joined-face gate of the local dispatch candidate (see joinedFaceAdmission). */
     function joinedFaceAdmissionRefusal(callerSession, targetTeam) {
-        if (callerSession === undefined || callerSession === '')
-            return undefined;
-        if (!joinedFaceCallerShape.test(callerSession))
-            return undefined;
-        if (callerSession.slice(0, callerSession.indexOf('/')) !== config.team)
-            return undefined;
-        return sameZoneSharedTeamRefusal(callerSession, targetTeam);
+        const verdict = joinedFaceAdmission(admissionRecords, callerSession, targetTeam);
+        return verdict === undefined ? undefined : refusalOf(verdict);
+    }
+    /** Inbound admission with the rule and shared teams that admitted the caller (gh#114 S1). */
+    function a2aCallerAdmission(caller, targetTeam) {
+        return callerAdmission(admissionRecords, caller, targetTeam);
     }
     function a2aCallerRefusal(caller, targetTeam) {
-        if (!config.teamScopeRouting)
-            return undefined;
-        if (caller === '') {
-            return 'caller_session is required — anonymous deliveries are refused (S3 phase-3b). Pass caller_session as <zone>/<id8>.';
-        }
-        // Host face: the node's own bare zone team is a host fact, always
-        // admissible to itself.
-        if (caller === config.team)
-            return undefined;
-        const zoneShaped = /^[a-z0-9-]+\/[0-9a-f]{8}$/i.test(caller);
-        if (zoneShaped) {
-            const callerZone = caller.slice(0, caller.indexOf('/'));
-            if (callerZone === config.team) {
-                // Same-zone handle: the W1/W2 shared admission core — roster
-                // declarations UNION canvas memberships against this host's
-                // records (canvas names are link records too; see the helper).
-                // F5: the routed team rides along so admission can require a
-                // TARGET-level intersection.
-                return sameZoneSharedTeamRefusal(caller, targetTeam);
-            }
-            // Foreign-zone handle (N3/N4): admitted ONLY through this host's
-            // operator-established cross-host links — a canvas remote member ref
-            // the operator added by hand. The card cache used to be a basis; a
-            // card is the CALLER'S own claim about itself (V5: any host could
-            // declare the target's team on its own card and self-serve
-            // admission), so it no longer decides anything here. First-contact
-            // learn-and-admit dies with it.
-            for (const name of canvasStore.list()) {
-                if (canvasStore.remoteMembersOf(name).includes(caller))
-                    return undefined;
+        return refusalOf(a2aCallerAdmission(caller, targetTeam));
+    }
+    /**
+     * #114 S2: the allowlist version over the operator-controlled records the
+     * admission rules read (design §2.3). The peer-card canvasOrg is left out:
+     * a record admitted by it carries `peer-org:<team>` in its basis instead.
+     */
+    function allowlistVersionNow() {
+        return allowlistVersion(allowlistInputsNow());
+    }
+    /** The records allowlistVersionNow hashes (design §2.3), read live. */
+    function allowlistInputsNow() {
+        const handle = (session) => `${config.team}/${id8(session)}`;
+        return {
+            zone: config.team,
+            scope: [config.teamScopeRouting, config.originClaimWindow !== false],
+            joined: joinedSessions.list().map(handle),
+            roster: teamMemberships.list().flatMap(entry => entry.teams.map(team => [handle(entry.session), team])),
+            // Local members by their handle (design §2.3), remote refs as they are stored.
+            canvas: canvasStore.list().map(name => [canvasTeamOf(name), canvasStore.membersOf(name).map(m => (m.includes('/') ? m : handle(m)))]),
+            cli: cliDeposits.list().map(row => row.handle),
+            links: config.peers.map(peer => { try {
+                return new URL(peer).origin;
             }
-            return `caller "${caller}" has no operator-established link on this node — cross-host admission requires a canvas remote membership this host's operator added (N3/N4: the caller's own card claims are self-description, not links). Ask this host's operator to add the member in the A2A workbench, or route through a linked member.`;
-        }
-        // Free-form label (not zone/id8): only THIS host's own node facts — a
-        // joined session id, its zone-qualified pseudo-handle (id8 passes
-        // short ids through, so dsh/agent-1 is a local shape), or a live
-        // node's label. Anything else is an unverifiable self-description
-        // (V3: 'anyone-at-all' used to pass).
-        if (joinedSessions.list().includes(caller))
-            return undefined;
-        for (const id of joinedSessions.list()) {
-            if (`${config.team}/${id8(id)}` === caller)
-                return undefined;
+            catch {
+                return peer;
+            } }),
+        };
+    }
+    /*
+     * #114 S6 (design §5): when the version moves, the unsettled tasks born
+     * under another one are re-judged against today's records and the
+     * affected ones recorded — OBSERVE ONLY: nothing is cancelled, no row's
+     * state changes, no session is nudged, no receipt is blocked. Called
+     * lazily (state/tasks reads, inbound admission) and at the known change
+     * points (the stores' onChange hooks below); never on a timer.
+     */
+    const authObserver = new AuthObserver(join(home, 'a2a', 'auth-versions.json'));
+    function observeAuthorization(cause) {
+        const inputs = allowlistInputsNow();
+        const entry = authObserver.observe({
+            version: allowlistVersion(inputs),
+            inputs: () => JSON.parse(canonicalAllowlist(inputs)),
+            cause,
+            rows: () => taskLedger.list(),
+            // A local-candidate record (#139) is judged as the local candidate admits; every other one by the wire face.
+            judge: (caller, target, ingress) => (ingress === 'local' ? localCandidateAdmission(admissionRecords, caller, target) : callerAdmission(admissionRecords, caller, target)),
+        });
+        if (entry === undefined)
+            return;
+        const revoke = entry.tasks.filter(task => task.verdict === 'would-revoke').length;
+        logger.info(`a2a: allowlist ${entry.from_version ?? '(none)'} → ${entry.to_version} (${entry.cause}): ${String(entry.tasks.length)} affected task(s), ${String(revoke)} would-revoke — observe only, nothing cancelled`);
+        try {
+            ctx.emit('a2a/authorization-affected', entry);
         }
-        for (const agent of sessionNodes.values()) {
-            if (String(agent.id) === caller)
-                return undefined;
+        catch (error) {
+            logger.warn(`a2a: authorization-affected listener rejected: ${String(error)}`);
         }
-        // gh#45: a DEPOSITED CLI handle is a published node fact of this host
-        // (the card's sessionTeams carries it; the envelope's zone derivation
-        // already proved the CLI key on the wire face's own verify). The
-        // handle is <agent-name>/<uuid16> — not zone/id8-shaped, hence this
-        // branch, but it is as much a fact as a joined session.
-        if (cliDeposits.get(caller) !== undefined)
-            return undefined;
-        return `caller_session "${caller}" matches no node fact on this host (joined session id, live node label, or deposited CLI handle) — free-form caller labels are self-description and are not admissible (N3). Pass caller_session as <zone>/<id8> with an operator-established link.`;
+    }
+    /** The /state `authorization` block: the version history (newest first, inputs omitted) and the affected entries. */
+    function authorizationView() {
+        observeAuthorization('lazy');
+        return {
+            version: allowlistVersionNow(),
+            history: authObserver.history().map(({ version, at, cause }) => ({ version, at, cause })),
+            affected: authObserver.entries(),
+        };
     }
     /* ── Session-log read faces (shared by the local control route and the
        peer /a2a/log face): both answer from <dshHome>/sessions with
@@ -2535,15 +2534,19 @@ ${message}`;
             config,
             cliDeposits,
             canvasStore,
+            canvasNameReserved: name => canvasNameReserved(name, config.team, ownerAllowlist, teamMemberships),
             sessionNodes,
             joinedSessions,
             idempotencyStore,
             verifyOriginClaim,
-            callerLinkedToThisHost,
+            callerLinkedToThisHost, get ownCardUrl() { return ownCardUrl; },
             recordActivity,
             bumpLegacyInbound: () => { legacyInboundCount += 1; },
             secretEqual,
             a2aCallerRefusal,
+            a2aCallerAdmission,
+            allowlistVersionNow,
+            observeAuthorization,
             scanSessionLogList,
             readSessionLogTail,
             taskLedger,
@@ -2556,9 +2559,13 @@ ${message}`;
             canvasLiveAgent,
             wakeColdTeam,
             probeConsumption,
+            sessionTeamOf,
+            localSessionOfHandle,
             steerRelay,
             fromClause,
+            sanitizeFromClause,
             armReceiptAutosend,
+            eventCountOf: (agent) => sessionEventsOf(agent).length,
             receiptExpectationOf,
             armAsyncNudge,
             liveAgent,
@@ -2685,160 +2692,9 @@ ${message}`;
                 });
             }),
         }), 'a2a: quick-dispatch route');
-        // Session transcript reader (0.6.11): the workbench inspector shows the
-        // tail of a LOCAL node's own conversation log inline — owner ruling
-        // 2026-10-20 banned navigation, and reading is the need jumps used to
-        // serve. The id gate is artifact existence under this host's sessions
-        // tree — reading is a host-workbench concern, not a network-membership
-        // concern, so archived and never-joined sessions stay readable while the
-        // network faces keep their own visibility rules. Path shape is still
-        // checked (no '/', '\', '..') and the tree never leaves <dshHome>/sessions.
-        // Without an id the same face lists readable sessions (newest activity
-        // first, capped) so the workbench directory can offer log rows even when
-        // the network directory shows none. Caps mirror session-transcript.ts.
-        ctx.effect(() => webServer.register({
-            kind: 'exact',
-            path: '/__dsh_a2a/session-log',
-            handler: controlRoute((req, res) => {
-                const url = new URL(req.url ?? '/', 'http://x');
-                const id = url.searchParams.get('id') ?? '';
-                const limitArg = Number(url.searchParams.get('limit') ?? TRANSCRIPT_DEFAULT_LIMIT);
-                const limit = Number.isFinite(limitArg) ? Math.max(1, Math.min(TRANSCRIPT_MAX_LIMIT, Math.floor(limitArg))) : TRANSCRIPT_DEFAULT_LIMIT;
-                let result;
-                if (id.includes('/') || id.includes('\\') || id.includes('..')) {
-                    result = { ok: false, error: 'id is required' };
-                }
-                else if (id === '') {
-                    // Listing face: every session directory holding a log artifact.
-                    try {
-                        const rows = scanSessionLogList();
-                        result = { ok: true, count: rows.length, sessions: rows.slice(0, 50) };
-                    }
-                    catch (error) {
-                        result = { ok: false, error: `transcript list failed: ${error instanceof Error ? error.message : String(error)}` };
-                    }
-                }
-                else {
-                    try {
-                        const tail = readSessionLogTail(id, limit);
-                        if (!tail.ok)
-                            result = { ok: false, error: tail.error };
-                        else
-                            result = { ok: true, id: tail.id, count: tail.messages.length, messages: tail.messages };
-                    }
-                    catch (error) {
-                        result = { ok: false, error: `transcript failed: ${error instanceof Error ? error.message : String(error)}` };
-                    }
-                }
-                const payload = JSON.stringify(result);
-                res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                res.end(payload);
-            }),
-        }), 'a2a: session-log route');
-        // 0.6.15: the local proxy for REMOTE session logs. The workbench runs
-        // in this host's browser page, so cross-host reads must originate from
-        // this host (no CORS, one trust boundary). ?team=<zone/id8> resolves
-        // directory candidates that publish that team (same walk as routing);
-        // ?peer=<base-url> targets one tracked peer directly and MUST name a
-        // URL already in the peer store — the proxy never fetches an
-        // arbitrary address. The caller label we present is config.team (this
-        // node's own zone handle, the same host face quick-dispatch uses).
-        ctx.effect(() => webServer.register({
-            kind: 'exact',
-            path: '/__dsh_a2a/remote-session-log',
-            handler: controlRoute(async (req, res) => {
-                const url = new URL(req.url ?? '/', 'http://x');
-                const team = url.searchParams.get('team') ?? '';
-                const peer = url.searchParams.get('peer') ?? '';
-                const id = url.searchParams.get('id') ?? '';
-                const limitArg = Number(url.searchParams.get('limit') ?? TRANSCRIPT_DEFAULT_LIMIT);
-                const limit = Number.isFinite(limitArg) ? Math.max(1, Math.min(TRANSCRIPT_MAX_LIMIT, Math.floor(limitArg))) : TRANSCRIPT_DEFAULT_LIMIT;
-                const finish = (body) => {
-                    const payload = JSON.stringify(body);
-                    res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                    res.end(payload);
-                };
-                if (id.includes('/') || id.includes('\\') || id.includes('..')) {
-                    finish({ ok: false, error: 'id is required' });
-                    return;
-                }
-                const trackedPeers = new Set(peerStore.list().map(entry => entry.replace(/\/+$/, '')));
-                let targets;
-                if (peer !== '') {
-                    const normalized = peer.replace(/\/+$/, '');
-                    if (!trackedPeers.has(normalized)) {
-                        finish({ ok: false, error: 'unknown peer on this node — the proxy only reads tracked peers' });
-                        return;
-                    }
-                    targets = [normalized];
-                }
-                else if (team !== '') {
-                    const failures = [];
-                    targets = await directoryPeerCandidates(memoizedCardFetch(), team, failures);
-                    if (targets.length === 0) {
-                        finish({ ok: false, error: `no directory candidate publishes team "${team}"${failures.length > 0 ? ` (${failures.slice(0, 3).join('; ')})` : ''}` });
-                        return;
-                    }
-                }
-                else {
-                    finish({ ok: false, error: 'team or peer is required' });
-                    return;
-                }
-                // 0.6.16: a team-handle read without an explicit id names a NODE, not
-                // a session. The handle suffix (zone/<id8>) is the first 8 hex of the
-                // peer-side session id (sessionTeamOf), so resolve the listing once
-                // and pick that session — bare zone teams fall back to the newest.
-                // An explicit id (peer drill) short-circuits this.
-                let resolvedId = id;
-                if (resolvedId === '' && team !== '') {
-                    const suffix = team.includes('/') ? team.slice(team.lastIndexOf('/') + 1) : '';
-                    for (const base of targets) {
-                        const listUrl = new URL('/a2a/log', base);
-                        listUrl.searchParams.set('caller_session', config.team);
-                        try {
-                            const listResponse = await globalThis.fetch(listUrl, { signal: AbortSignal.timeout(5000), headers: { accept: 'application/json' } });
-                            const listBody = await listResponse.json().catch(() => ({ ok: false, error: `peer answered HTTP ${listResponse.status}` }));
-                            if (listResponse.ok && listBody.ok === true && Array.isArray(listBody.sessions)) {
-                                const picked = suffix !== '' ? listBody.sessions.find(row => row.id.includes(suffix)) : listBody.sessions[0];
-                                if (picked !== undefined) {
-                                    resolvedId = picked.id;
-                                    break;
-                                }
-                            }
-                        }
-                        catch {
-                            // listing failed on this candidate — the tail attempt below
-                            // will surface the honest error for the same base
-                        }
-                    }
-                    if (resolvedId === '') {
-                        finish({ ok: false, error: `no readable session on this peer matches "${team}"` });
-                        return;
-                    }
-                }
-                const attempts = [];
-                for (const base of targets) {
-                    const target = new URL('/a2a/log', base);
-                    target.searchParams.set('caller_session', config.team);
-                    if (resolvedId !== '')
-                        target.searchParams.set('id', resolvedId);
-                    target.searchParams.set('limit', String(limit));
-                    try {
-                        const response = await globalThis.fetch(target, { signal: AbortSignal.timeout(5000), headers: { accept: 'application/json' } });
-                        const body = await response.json().catch(() => ({ ok: false, error: `peer answered HTTP ${response.status}` }));
-                        if (response.ok && body.ok === true) {
-                            finish({ ...body, via: base });
-                            return;
-                        }
-                        attempts.push(`${base}: ${body.error ?? `HTTP ${response.status}`}`);
-                    }
-                    catch (error) {
-                        attempts.push(`${base}: ${error instanceof Error ? error.message : String(error)}`);
-                    }
-                }
-                finish({ ok: false, error: `remote log unavailable — ${attempts.join(' | ')}` });
-            }),
-        }), 'a2a: remote-session-log proxy route');
+        // gh#77: the session-log faces (local transcript reader + remote-log proxy) live in src/faces/session-log.ts.
+        registerSessionLogFaces(webServer, { ctx, config, controlRoute, scanSessionLogList, readSessionLogTail, peerStore, peerFetch, directoryPeerCandidates, memoizedCardFetch });
+        registerFileFaces(webServer, { ctx, config, blobStore, canvasStore, verifyOriginClaim, secretEqual, controlRoute, recordActivity });
     });
     /**
      * Settle one card-fetch outcome into the peer store and the plain card:
@@ -2852,7 +2708,10 @@ ${message}`;
      */
     function settlePeerCard(peer, outcome) {
         if (!outcome.ok) {
-            peerStore.noteFailure(peer);
+            // gh#193: a fetch the isolation switch refused says nothing about the
+            // peer — scoring it would evict learned peers and rewrite peers.json.
+            if (!config.isolated)
+                peerStore.noteFailure(peer);
             return undefined;
         }
         // A self-referral learned from a peer's card (the peer lists this node's
@@ -2919,58 +2778,24 @@ ${message}`;
      */
     const cardCache = new Map();
     const cardCacheInFlight = new Map();
-    /**
-     * The from-line display name (owner ruling, claim 8ea4150f94): a bare
-     * routing handle (`dsh/74555a36`) carries zero semantics for the reader.
-     * Resolve what the handle NAMES, cheaply and read-only:
-     *   1. a local handle — a joined/live session id, its zone/id8 pseudo-team,
-     *      or a live node label → nodeMetadataOf(agent).name (the session-title
-     *      product, exactly what the directory shows);
-     *   2. a remote bare-zone caller → the warmest cached card whose team
-     *      equals the zone (the publisher's own card NAME is the display name);
-     *   3. a remote zone/id8 caller → the cached card whose sessionTeams row
-     *      matches the handle → that row's name;
-     *   4. nothing resolves → '' (the from line stays bare — no false names).
-     * Read-only over warm caches: never fetches, so a cold cache degrades to
-     * the bare handle, never to a stall.
-     */
-    function callerDisplayName(caller) {
-        if (caller === '' || caller === 'an unknown node')
-            return '';
-        // Local: joined/live session facts on THIS host.
-        for (const [id, agent] of sessionNodes) {
-            if (id === caller || sessionLabelOf(agent) === caller || `${config.team}/${id8(id)}` === caller) {
-                return nodeMetadataOf(agent).name;
-            }
-        }
-        for (const [id, agent] of liveRoots) {
-            if (id === caller || sessionLabelOf(agent) === caller || `${config.team}/${id8(id)}` === caller) {
-                return nodeMetadataOf(agent).name;
-            }
-        }
-        // Remote: warm card cache only.
-        const zone = caller.includes('/') ? caller.slice(0, caller.indexOf('/')) : caller;
-        let zoneName = '';
-        for (const entry of cardCache.values()) {
-            const card = entry.card;
-            if (card === undefined)
-                continue;
-            if (card.team === zone && zoneName === '')
-                zoneName = card.name;
-            if (caller.includes('/')) {
-                const row = (card.sessionTeams ?? []).find(item => item.team === caller);
-                if (row !== undefined && row.name !== '')
-                    return row.name;
-            }
-        }
-        if (!caller.includes('/') && zoneName !== '')
-            return zoneName;
-        return '';
-    }
-    /** The from clause with the display name in full-width parens when resolved. */
+    // #114 S6: the change hooks and the boot observation start only once every
+    // record admission reads exists (the peer-org basis reads cardCache above).
+    // The cache is still empty here, so the observer skips cache-resting rows
+    // on 'boot' (#138 R1); the first lazy read rechecks them.
+    ctx.effect(() => canvasStore.onChange(() => observeAuthorization('canvas')), 'a2a: S6 canvas observer');
+    ctx.effect(() => joinedSessions.onChange(() => observeAuthorization('joined')), 'a2a: S6 joined observer');
+    ctx.effect(() => teamMemberships.onChange(() => observeAuthorization('roster')), 'a2a: S6 roster observer');
+    observeAuthorization('boot');
+    /** Security headers omit all unsigned peer display metadata. */
     function fromClause(from) {
-        const display = callerDisplayName(from);
-        return `from "${from}"${display !== '' ? `（${display}）` : ''}`;
+        const caller = from.replace(/[\x00-\x1f\x7f\u200b-\u200f\u2028-\u202e\u2060-\u206f\ufeff\uff08\uff09\ufe59\ufe5a]/g, '');
+        return `from ${JSON.stringify(caller)}`;
+    }
+    function sanitizeFromClause(from) {
+        return fromClause(from);
+    }
+    function hostDirectHeader(team, taskId, from, proofClause) {
+        return `[A2A direct] (task ${taskId}) ${proofClause} ${sanitizeFromClause(from)} (routed to ${team}) sent:`;
     }
     /**
      * gh#20 W-A: THIS host's view of one tracked peer's link state (the
@@ -3143,544 +2968,54 @@ ${message}`;
         // loud, structured, and schema-free (no success shape is produced).
         throw new Error('你被禁止使用 a2a 网络：本会话未加入 A2A 网络（join 是用户手势）。Join via the sidebar control to enable, then retry.');
     };
-    // S4: team-membership tools — node-declared rosters under the owner's
-    // allowlist curation. Joining is a network-visible declaration (the card
-    // publishes it), so the default allowlist denies everything: a refused
-    // join says why and names the curation surface instead of failing
-    // silently. Leaving is always allowed — it only shrinks exposure.
-    // S4 audit: every join/leave attempt — allowed or refused — lands in
-    // a bounded ring the state route serves (the ring itself is declared with
-    // the stores: the boot-settlement prune records before this section
-    // initializes). Refusals are the audit-worthy half (each one is widening
-    // pressure on the allowlist); log lines rotate away, this face is queryable.
-    // gh#11 (N7, operator directive: team creation is a human act): only an
-    // EXACT allowlist entry authorizes a join — each exact name is a
-    // deliberate operator act of creation. Wildcard/prefix patterns match
-    // nothing at join time: a pattern pre-authorizing every future name
-    // under it would let a model mint teams nobody created. Pattern entries
-    // remain readable (whoami shows them) but carry no mint rights.
-    const teamJoinExactAllowed = (team) => ownerAllowlist.includes(team);
-    const teamJoinPatternMatches = (team) => ownerAllowlist.some(pattern => {
-        if (pattern === '*')
-            return true;
-        if (pattern.endsWith('*')) {
-            // Boundary: the wildcard consumes at most the remainder of one
-            // '/'-delimited segment — `dsh*` matches `dsh/agent-1`, never
-            // `dshield`; `dsh/canvas/*` matches the canvas subtree only.
-            const prefix = pattern.slice(0, -1);
-            return team.startsWith(prefix) && (prefix.endsWith('/') || (team.length > prefix.length && team[prefix.length] === '/'));
-        }
-        return team === pattern;
+    const SWEEP_CONCURRENCY = 6;
+    const infoTools = createInfoTools({
+        ctx, config, logger, session, lanIp, ownCardUrl, peerStore, taskLedger,
+        inFlightRoutes, recentActivity, joinedSessions, sessionNodes, canvasStore,
+        teamMemberships, exposureStore, idempotencyStore, cardCache,
+        id8, sessionTeamOf,
+        nodeMetadataOf, canvasTeamOf, memoizedCardFetch, mapBounded,
+        // Hot-applied owner settings: getters keep the tools' call-time read live.
+        // Passing these by value snapshots the apply-scope lets and silently
+        // disables owner-settings hot-apply (whoami allowlist / teams scoping).
+        get ownerAllowlist() { return ownerAllowlist; },
+        get ownerTeamScopeInfo() { return ownerTeamScopeInfo; },
+        teamAuditRing, reportRing, a2aJoinGateRefusal, observeAuthorization,
+        settlePeerCard, client, listDirectoryTeams, canvasTeamsOfSession, localHandleResolver,
+        SWEEP_CONCURRENCY,
     });
-    const joinedNodeOrNone = (id) => joinedSessions.has(id) || sessionNodes.has(id) ? id : undefined;
-    // K3 feedback P0 (2026-10-20): a session could appear in a2a_teams, route
-    // fine, and still be refused by a2a_team_join — with no way to ask "what am
-    // I, actually?". whoami is that one-call answer. Deliberately NOT gated by
-    // a2aJoinGateRefusal: the unjoined session is precisely the caller that
-    // needs it.
-    ctx.tools.register(defineTool({
-        name: 'a2a_whoami',
-        description: 'One-call self-introspection on this host\'s A2A network: the calling session\'s node id, joined/live '
-            + 'state, routable team handle, declared team memberships (roster + canvas), the owner\'s teamJoinAllowlist, '
-            + 'the teamScopeRouting switch, and this node\'s most recent refused join/leave attempts with reasons. '
-            + 'Note: outbound routing never requires join — the originating session is always exempt (initiator face); '
-            + 'join buys presence, discovery, and being routed to.',
-        parameters: {},
-        output: {
-            schema: {
-                type: 'object',
-                additionalProperties: false,
-                properties: {
-                    ok: { type: 'boolean', required: true },
-                    face: { type: 'string', required: true, description: 'session | host' },
-                    node: {
-                        type: 'object',
-                        additionalProperties: true,
-                        description: 'id, joined, live, and the routable team handle (zone/id8) once joined.',
-                    },
-                    teams: {
-                        type: 'object',
-                        additionalProperties: true,
-                        description: 'roster: allowlisted teams declared via a2a_team_join; canvas: workbench-assigned teams.',
-                    },
-                    allowlist: {
-                        type: 'object',
-                        additionalProperties: true,
-                        description: 'The owner-curated teamJoinAllowlist: exact entries (the only join authority, gh#11) plus pattern entries kept readable but carrying no mint rights (deny-all / curated; allow-all only via explicit exact entries).',
-                    },
-                    teamScopeRouting: { type: 'boolean' },
-                    note: { type: 'string', description: 'What join does and does not gate, in one sentence.' },
-                    lastRefusals: {
-                        type: 'array',
-                        description: 'Most recent refused join/leave attempts for this node (newest first, ≤3), with reason codes.',
-                        items: { type: 'object', additionalProperties: true },
-                    },
-                },
-            },
-            render: (_args, value) => [{
-                    type: 'text',
-                    text: value.face === 'host'
-                        ? `Host face on team ${String(value.node?.team ?? '?')}: routing rides the bare node team (能发即能收)`
-                        : `Node ${String(value.node?.id ?? '?')}: joined=${String(value.node?.joined)}, live=${String(value.node?.live)}; roster teams: ${(value.teams?.roster ?? []).join(', ') || 'none'}; canvas: ${(value.teams?.canvas ?? []).join(', ') || 'none'}; allowlist effect: ${String(value.allowlist?.effect ?? '?')}`,
-                }],
-        },
-        presentCall: () => ({ card: 'generic', title: 'A2A whoami', kind: 'other', rawInput: null }),
-        execute: async (_args, exec) => {
-            const agentId = exec?.agent !== undefined ? String(exec.agent.id) : '';
-            if (agentId === '') {
-                return {
-                    ok: true,
-                    face: 'host',
-                    node: { team: config.team },
-                    note: 'host face — routing rides the bare node team (能发即能收); joins are session-node concerns',
-                };
-            }
-            const joined = joinedSessions.has(agentId);
-            const live = sessionNodes.has(agentId);
-            const refusals = teamAuditRing
-                .filter(entry => entry.id === agentId && !entry.ok)
-                .slice(-3)
-                .reverse()
-                .map(entry => ({ at: entry.at, action: entry.action, team: entry.team, reason: entry.reason ?? '' }));
-            const patterns = [...ownerAllowlist];
-            return {
-                ok: true,
-                face: 'session',
-                node: {
-                    id: agentId,
-                    ...(joined ? { team: `${config.team}/${id8(agentId)}` } : {}),
-                    joined,
-                    live,
-                },
-                teams: {
-                    roster: [...teamMemberships.teamsOf(agentId)],
-                    canvas: [...canvasStore.teamsOf(agentId)],
-                },
-                allowlist: {
-                    patterns,
-                    effect: patterns.length === 0 ? 'deny-all (empty allowlist refuses every join)' : patterns.includes('*') ? 'allow-all' : 'curated',
-                },
-                teamScopeRouting: config.teamScopeRouting === true,
-                ...(refusals.length > 0 ? { lastRefusals: refusals } : {}),
-                note: joined
-                    ? 'join buys presence + being routed to; outbound routing needs no join (initiator face is exempt)'
-                    : 'NOT joined: no presence/discovery and cannot be routed to; outbound routing still works (initiator face), and joining is a host-side human control (GUI sidebar A2A panel)',
-            };
-        },
-    }));
-    ctx.tools.register(defineTool({
-        name: 'a2a_team_join',
-        description: 'Declare one of this host\'s joined session nodes a member of a routable team '
-            + '(node-declared roster; the host card publishes it and peers rebuild team rosters as the union of '
-            + 'member declarations). Gated by the owner\'s teamJoinAllowlist — an empty list denies every join; '
-            + 'patterns are exact names or trailing-`*` prefixes. Canvas teams are out of scope here: their '
-            + 'membership is assigned by hand in the A2A workbench, and the tool refuses `/canvas/` names. '
-            + 'Collaboration itself stays within teams (team-scoped routing is the separate teamScopeRouting switch).',
-        parameters: {
-            team: { type: 'string', description: 'The routable team to join (full form, e.g. dsh/review-gate).' },
-            id: { type: 'string', description: 'The joined session node id on this host that declares the membership.' },
-        },
-        output: {
-            schema: {
-                type: 'object',
-                additionalProperties: false,
-                properties: {
-                    ok: { type: 'boolean', required: true },
-                    team: { type: 'string' },
-                    id: { type: 'string' },
-                    teams: { type: 'array', items: { type: 'string' } },
-                    error: { type: 'string', description: 'Refusal reason when ok is false: unknown node or team not allowlisted.' },
-                },
-            },
-            render: (_args, value) => [{
-                    type: 'text',
-                    text: value.ok === true
-                        ? `Node ${String(value.id)} joined team ${String(value.team)}; its teams: ${Array.isArray(value.teams) ? value.teams.join(', ') : String(value.team)}`
-                        : `Join refused: ${String(value.error)}`,
-                }],
-        },
-        presentCall: () => ({ card: 'generic', title: 'A2A team join', kind: 'other', rawInput: null }),
-        execute: async (args, exec) => {
-            a2aJoinGateRefusal(exec);
-            const team = String(args.team ?? '').trim();
-            const id = String(args.id ?? '').trim();
-            if (team === '' || id === '') {
-                const reason = '[BAD_ARGUMENTS] both team and id are required';
-                recordTeamAudit('join', team, id, false, reason);
-                return { ok: false, error: reason };
-            }
-            if (joinedNodeOrNone(id) === undefined) {
-                // K3 feedback (2026-10-20): reason code + a step the MODEL can take.
-                // The old text pointed at a sidebar control and a CLI — neither is
-                // executable by a session agent. Joining is a host-side human
-                // control; the model's executable step is to ask its operator and
-                // to self-check state with a2a_whoami.
-                const reason = `[NOT_JOINED] session ${id} is not a joined node on this host — network joining is a host-side human control (the GUI sidebar A2A panel), so relay the request to your human operator; once the node is joined, retry this declaration. Your current state (joined/live, teams, allowlist) is one a2a_whoami call away`;
-                recordTeamAudit('join', team, id, false, reason);
-                return { ok: false, error: reason };
-            }
-            // V4 (gh#7, N2): a model tool changes membership for the CALLING
-            // session only — agent-1 declaring agent-2 into a team was an agent
-            // creating a link for another node, published to the whole fleet via
-            // the card. The host face (agent-less, operator surface) may still
-            // act for any joined node.
-            if (exec?.agent !== undefined && String(exec.agent.id) !== id) {
-                const reason = `[NOT_SELF] a model tool may only declare membership for its own session node (${String(exec.agent.id)}) — membership for other nodes is your operator's gesture (the workbench or the host face); N2: agents use links, they do not create them for others`;
-                recordTeamAudit('join', team, id, false, reason);
-                return { ok: false, error: reason };
-            }
-            // Unified teaming (0.6.6): canvas teams are the human-composed surface.
-            // A session may not self-join one through the roster tool — membership
-            // there is assigned by hand, so the refusal names the surface where the
-            // assignment happens. Any `/canvas/` name (this zone's or a peer's) is
-            // refused: remote canvas membership is the owning host's store, and a
-            // roster declaration here would neither feed it nor be read by it.
-            if (team.includes('/canvas/')) {
-                const reason = `[CANVAS_TEAM] team "${team}" is a canvas team — canvas membership is assigned by hand in the A2A workbench (open /__dsh_a2a_nexus/, pick the team, add or remove members there); the roster tool manages allowlisted teams only. If this membership must change now, relay the request to your human operator`;
-                recordTeamAudit('join', team, id, false, reason);
-                return { ok: false, error: reason };
-            }
-            if (!teamJoinExactAllowed(team)) {
-                const reason = teamJoinPatternMatches(team)
-                    ? `[PATTERN_NO_MINT] team "${team}" matches only a wildcard/pattern entry of this host's teamJoinAllowlist — patterns carry no mint rights (gh#11/N7: team creation is a human act); ask the owner to add the EXACT team name, which is the act of creating it`
-                    : `[ALLOWLIST_DENY] team "${team}" is not in this host's teamJoinAllowlist — the owner curates joinable teams with exact names (patterns match nothing at join time; human-composed groups live in the workbench's canvas teams); ask them to add the exact name. The live list is visible in a2a_whoami`;
-                recordTeamAudit('join', team, id, false, reason);
-                return { ok: false, error: reason };
-            }
-            teamMemberships.add(id, team);
-            recordTeamAudit('join', team, id, true);
-            logger.info(`a2a: ${id8(id)} declared membership in ${team}`);
-            return { ok: true, team, id, teams: [...teamMemberships.teamsOf(id)] };
-        },
-    }));
-    ctx.tools.register(defineTool({
-        name: 'a2a_team_leave',
-        description: 'Retract one team-membership declaration previously made by a2a_team_join. Always allowed — leaving only '
-            + 'shrinks the node\'s visible collaboration surface.',
-        parameters: {
-            team: { type: 'string', description: 'The routable team to leave.' },
-            id: { type: 'string', description: 'The session node id retracting the membership.' },
-        },
-        output: {
-            schema: {
-                type: 'object',
-                additionalProperties: false,
-                properties: {
-                    ok: { type: 'boolean', required: true },
-                    team: { type: 'string' },
-                    id: { type: 'string' },
-                    teams: { type: 'array', items: { type: 'string' } },
-                    error: { type: 'string', description: 'Refusal reason when ok is false: node unknown or membership absent.' },
-                },
-            },
-            render: (_args, value) => [{
-                    type: 'text',
-                    text: value.ok === true
-                        ? `Node ${String(value.id)} left team ${String(value.team)}; remaining teams: ${Array.isArray(value.teams) && value.teams.length > 0 ? value.teams.join(', ') : 'none'}`
-                        : `Leave refused: ${String(value.error)}`,
-                }],
-        },
-        presentCall: () => ({ card: 'generic', title: 'A2A team leave', kind: 'other', rawInput: null }),
-        execute: async (args, exec) => {
-            a2aJoinGateRefusal(exec);
-            const team = String(args.team ?? '').trim();
-            const id = String(args.id ?? '').trim();
-            if (team === '' || id === '') {
-                recordTeamAudit('leave', team, id, false, 'both team and id are required');
-                return { ok: false, error: 'both team and id are required' };
-            }
-            if (joinedNodeOrNone(id) === undefined) {
-                const reason = `[NOT_JOINED] session ${id} is not a joined node on this host — check current state with a2a_whoami`;
-                recordTeamAudit('leave', team, id, false, reason);
-                return { ok: false, error: reason };
-            }
-            // V4 (gh#7, N2): same self-only rule as join — narrowing another
-            // node's surface is still a link change by a third party.
-            if (exec?.agent !== undefined && String(exec.agent.id) !== id) {
-                const reason = `[NOT_SELF] a model tool may only retract membership for its own session node (${String(exec.agent.id)}); N2 — use links, do not reshape another node's`;
-                recordTeamAudit('leave', team, id, false, reason);
-                return { ok: false, error: reason };
-            }
-            if (!teamMemberships.teamsOf(id).includes(team)) {
-                const reason = `session ${id} declares no membership in "${team}" — nothing to leave`;
-                recordTeamAudit('leave', team, id, false, reason);
-                return { ok: false, error: reason };
-            }
-            teamMemberships.remove(id, team);
-            recordTeamAudit('leave', team, id, true);
-            logger.info(`a2a: ${id8(id)} retracted membership in ${team}`);
-            return { ok: true, team, id, teams: [...teamMemberships.teamsOf(id)] };
-        },
-    }));
-    ctx.tools.register(defineTool({
-        name: 'a2a_exposure',
-        description: '#19 exposure tiers: set THIS session\'s network visibility. \'linked\' (the default '
-            + 'floor) — visible to linked callers per the card-face link gate; \'fleet\' — a voluntary '
-            + 'opt-UP making the session\'s team visible to any fleet peer. Members may raise and lower '
-            + 'their own tier freely; nothing exists below linked (no private tier in v1), and group '
-            + 'visibility always derives from the strictest member (no group knobs). Requires the '
-            + 'session to be joined to the network.',
-        parameters: {
-            tier: { type: 'string', enum: ['linked', 'fleet'], required: true, description: 'The exposure tier to set for this session.' },
-        },
-        output: {
-            schema: {
-                type: 'object',
-                additionalProperties: false,
-                properties: {
-                    ok: { type: 'boolean', required: true },
-                    id: { type: 'string' },
-                    tier: { type: 'string' },
-                    error: { type: 'string', description: 'Refusal reason when ok is false (not joined, or no agent context).' },
-                },
-            },
-            render: (_args, value) => [{
-                    type: 'text',
-                    text: value.ok === true
-                        ? `Session ${String(value.id)} exposure tier set to ${String(value.tier)}`
-                        : `Exposure refused: ${String(value.error)}`,
-                }],
-        },
-        presentCall: () => ({ card: 'generic', title: 'A2A exposure tier', kind: 'other', rawInput: null }),
-        execute: async (args, exec) => {
-            const agent = exec.agent;
-            if (agent === undefined) {
-                return { ok: false, error: 'no agent context — the exposure tier is a per-session fact; call from a session' };
-            }
-            const id = String(agent.id);
-            if (!joinedSessions.has(id)) {
-                return { ok: false, error: 'session is not joined to the A2A network — join first (the sidebar control or the host join route)' };
-            }
-            const tier = args.tier === 'fleet' ? 'fleet' : 'linked';
-            exposureStore.setTier(id, tier);
-            logger.info(`a2a: ${id8(id)} exposure tier -> ${tier}`);
-            return { ok: true, id, tier };
-        },
-    }));
-    ctx.tools.register(defineTool({
-        name: 'a2a_report',
-        description: 'Report a task or status to this host\'s A2A network — the ONE ingress a session WITHOUT network '
-            + 'membership may use (deliberately exempt from the join gate: one-way reporting grants no presence, '
-            + 'no discovery, no routing rights; the report lands in the state face\'s reports ring for '
-            + 'supervision to read and act on, e.g. adopt or re-join the reporter). Use when you are off the '
-            + 'mesh and need to say so. Rate limited to one report per 30s per session; messages cap at 4000 chars.',
-        parameters: {
-            message: { type: 'string', required: true, description: 'The report text (≤4000 chars).' },
-            level: { type: 'string', enum: ['info', 'warning', 'error'], description: 'Severity; error also warns the host log.' },
-            task: { type: 'string', description: 'Optional task reference (id/link).' },
-        },
-        output: {
-            schema: {
-                type: 'object',
-                additionalProperties: false,
-                properties: {
-                    ok: { type: 'boolean', required: true },
-                    reportId: { type: 'string' },
-                    error: { type: 'string', description: 'Refusal reason when ok is false (empty message, over-cap, or rate limited).' },
-                },
-            },
-            render: (_args, value) => [{
-                    type: 'text',
-                    text: value.ok === true ? `Report registered (${String(value.reportId)})` : `Report refused: ${String(value.error)}`,
-                }],
-        },
-        presentCall: () => ({ card: 'generic', title: 'A2A report', kind: 'other', rawInput: null }),
-        execute: async (args, exec) => {
-            // Deliberately NO a2aJoinGateRefusal: reporting is the one thing an
-            // unjoined session may do — that is the tool's entire purpose.
-            const message = String(args.message ?? '').trim();
-            if (message === '')
-                return { ok: false, error: 'message is required' };
-            if (message.length > 4000)
-                return { ok: false, error: 'message exceeds the 4000-char cap' };
-            const session = exec?.agent !== undefined ? String(exec.agent.id) : 'host';
-            const now = Date.now();
-            const last = reportLastAt.get(session) ?? 0;
-            if (now - last < 30_000)
-                return { ok: false, error: 'rate limited: one report per 30s per session' };
-            // Fix ④ (loop circuit-breaker, d44efa9f pattern): the SAME session
-            // reporting the SAME text ≥3 times inside a 10-minute window is a
-            // loop, not a situation — refuse with a named reason and audit the
-            // ring (the first copies go through; the bounded ring self-expires).
-            const loopKey = `${session}:${createHash('sha256').update(message).digest('hex').slice(0, 16)}`;
-            const loopWindow = (reportLoopRing.get(loopKey) ?? []).filter(at => now - at < 600_000);
-            if (loopWindow.length >= 3) {
-                recordTeamAudit('agent-less', 'a2a_report', session, false, 'loop detected: 3 identical reports in 10min');
-                return { ok: false, error: '循环检测：同会话同文 10 分钟内已上报 3 次，本 report 熔断拒绝。若确需再报请变更内容或等窗口滑出' };
-            }
-            loopWindow.push(now);
-            reportLoopRing.set(loopKey, loopWindow);
-            reportLastAt.set(session, now);
-            const level = args.level === 'error' || args.level === 'warning' ? args.level : 'info';
-            const reportId = `report-${Math.random().toString(16).slice(2, 10)}`;
-            reportRing.push({
-                at: now,
-                level,
-                message: message.slice(0, 4000),
-                session,
-                ...(typeof args.task === 'string' && args.task.trim() !== '' ? { task: args.task.trim() } : {}),
-            });
-            if (reportRing.length > 64)
-                reportRing.splice(0, reportRing.length - 64);
-            if (level === 'error')
-                logger.warn(`a2a report (${id8(session)}): ${message.slice(0, 200)}`);
-            return { ok: true, reportId };
-        },
-    }));
-    // S5 (owner directive 2026-10-20): information-plane scoping. The host's
-    // joined-team scope is the union of every local node's roster
-    // declarations — a host-level set, not per-session: supervisor seats need
-    // the cross-team overview, and 「加入的团队」 reads as the teams this
-    // host's nodes joined. The information-plane tools (a2a_teams /
-    // a2a_status / a2a_probe) disclose remote facts only inside that scope;
-    // a2a_tasks — this host's own dispatch ledger and receipt-reconciliation
-    // surface, including initiator-exempt dispatches — stays unscoped by
-    // ruling (its rows name teams this host itself routed to, never a fleet
-    // census).
-    const joinedTeamScope = () => {
-        const joined = new Set();
-        for (const entry of teamMemberships.list()) {
-            for (const team of entry.teams)
-                joined.add(team);
-        }
-        // G4 (review artifact 688c0354d3 v2): canvas membership is join intent
-        // too. This host's canvas teams — and every member handle they name
-        // (remote zone-qualified handles as-is, local session ids as their
-        // session-team handle) — belong to the scope, so canvas teammates stay
-        // visible to each other under teamScopeInfo instead of the roster-only
-        // reading splitting them apart.
-        for (const name of canvasStore.list()) {
-            joined.add(canvasTeamOf(name));
-            for (const member of canvasStore.membersOf(name)) {
-                joined.add(member.includes('/') ? member : `${config.team}/${id8(member)}`);
-            }
-        }
-        return joined;
-    };
+    infoTools.registerWhoami();
+    const actTools = createActTools({
+        ctx, config, logger, sessionNodes, joinedSessions,
+        teamMemberships, exposureStore, reportRing, recordTeamAudit,
+        a2aJoinGateRefusal, id8, routeTrunk,
+        // Owner-settings hot-apply REBINDS this let: the getter keeps the tool
+        // module's call-time read live instead of snapshotting at construction.
+        get ownerAllowlist() { return ownerAllowlist; },
+    });
+    actTools.registerTeamJoin();
+    actTools.registerTeamLeave();
+    actTools.registerExposure();
+    actTools.registerReport();
+    infoTools.registerTeams();
     /**
-     * Whether a peer card proves service to any joined team — its own zone
-     * team, a published session team, or any roster declaration. A card that
-     * proves nothing serves nothing: under scoping it is withheld, which is
-     * the legacy-peer cost the directive accepts (pre-roster peers cannot
-     * prove service either way).
+     * The directory's listing: this host's own teams lead (the loopback
+     * candidates a2a_route dials first) — the process team, then every joined
+     * live session node with its title and activity facts; then every tracked
+     * peer card's own team plus its joined session teams. Delegated names are
+     * not listed — only names a tracked zone publishes directly appear;
+     * delegations resolve at route time (a resolvable delegation always
+     * aliases a listed team, so rows for them would repeat).
+     *
+     * Discovery is gossip: each fetch offers the card's referrals to the
+     * store, and mid-iteration offers are normally fetched on the next call.
+     * A search pass chases one extra hop within the call — after the first
+     * sweep, peers that were newly offered get their own card fetched — so a
+     * keyword hunt reaches sessions the previous call had not yet gossiped,
+     * while staying bounded (one extra sweep, still under the store cap).
+     * @param expand - chase one referral hop beyond the current store walk.
      */
-    const cardServesJoined = (card, joined) => joined.has(card.team)
-        || (card.sessionTeams ?? []).some(entry => joined.has(entry.team))
-        || (card.teamMemberships ?? []).some(membership => joined.has(membership.team));
-    ctx.tools.register(defineTool({
-        name: 'a2a_teams',
-        description: 'List or search reachable A2A teams: this host\'s own process team and joined session nodes first (marked [this host], '
-            + 'routable over loopback — same-host collaboration needs no peers), then teams across the tracked peer network '
-            + 'with owner label, a recent-activity excerpt, the publishing host (origin: node label + LAN IP — the natural '
-            + 'grouping when a fleet spans machines), and the session\'s working directory when shared. Pass query to filter '
-            + 'by keyword (case-insensitive substring over team name, title, excerpt, origin, or workspace) — searching '
-            + 'discovers one extra referral hop within the call. Canvas teams (<team>/canvas/<name>, user-composed multi-member groups) '
-            + 'list as local rows; routing to one resolves the first live member or wakes the first cold one — the dispatching session '
-            + 'itself is skipped on the local tiers, falling through to the other members (issue #41: a member routing to its own group '
-            + 'never loops home). '
-            + 'While teamScopeInfo is on (default), the listing follows YOUR collaboration circle: remote rows serve only teams joined by this host\'s nodes, and [this host] session rows show only your own row, your canvas teams, and sessions sharing a team with you — an exposed node id invites mis-routing, so the directory does not advertise strangers. The owner\'s GUI panel keeps the full plane; teamScopeInfo: false opens it for tools too. '
-            + 'Call this before a2a_route to pick a target team.',
-        parameters: {
-            query: { type: 'string', description: 'Optional keyword filter (case-insensitive substring over team/name/description).' },
-        },
-        output: {
-            schema: {
-                type: 'object',
-                additionalProperties: false,
-                properties: {
-                    ok: { type: 'boolean', required: true },
-                    query: { type: 'string', description: 'The filter applied, empty when unfiltered.' },
-                    teams: {
-                        type: 'array',
-                        required: true,
-                        items: {
-                            type: 'object',
-                            additionalProperties: false,
-                            properties: {
-                                team: { type: 'string', required: true },
-                                session: { type: 'string', required: true },
-                                name: { type: 'string', required: true },
-                                description: { type: 'string', required: true },
-                                local: { type: 'boolean', description: 'true when the team is served by this host (loopback candidate).' },
-                                origin: { type: 'string', description: 'The publishing host (node session label, LAN IP when known) — the natural grouping for fleet rows.' },
-                                via: { type: 'string', description: 'The peer URL this row was discovered through (host:port), when it came from a peer card.' },
-                                workspace: { type: 'string', description: 'The session\'s working directory, when shared.' },
-                                legacy: { type: 'boolean', description: 'true when the publishing node advertises no roster capability (pre-roster peer).' },
-                                teams: { type: 'array', items: { type: 'string' }, description: 'Roster teams the node declared for this handle (card teamMemberships).' },
-                            },
-                        },
-                    },
-                    note: { type: 'string', description: 'Present while teamScopeInfo scoping is on: the joined-team scope plus how many rows outside YOUR collaboration circle were withheld (remote/local split; the process team, your own row, and your canvas teams always show).' },
-                },
-            },
-            render: (args, value) => [{
-                    type: 'text',
-                    text: (value.teams.length === 0
-                        ? `No A2A teams${(value.query ?? '') === '' ? '' : ` matching "${String(args.query)}"`} are currently reachable.`
-                        : value.teams.map(team => `- ${team.team}${team.local === true ? ' [this host]' : ''}${team.name === '' ? '' : ` (${team.name})`}${team.description === '' ? '' : ` — ${team.description}`}${typeof team.origin === 'string' && team.origin !== '' && team.local !== true ? ` @ ${team.origin}` : ''}${typeof team.workspace === 'string' && team.workspace !== '' ? ` [${team.workspace}]` : ''}`).join('\n'))
-                        + (value.note === undefined ? '' : `\n${value.note}`),
-                }],
-        },
-        presentCall: args => ({ card: 'generic', title: args.query === undefined || args.query === '' ? 'List reachable A2A teams' : `Search A2A teams: ${args.query}`, kind: 'other', rawInput: args }),
-        execute: async (args, exec) => {
-            a2aJoinGateRefusal(exec);
-            const query = args.query?.trim().toLowerCase() ?? '';
-            let teams = await listDirectoryTeams(query !== '');
-            // S5: remote rows survive only when they serve a joined team (the
-            // row's own name or any roster declaration it carries); local rows
-            // are host-internal facts and always survive. The note keeps the
-            // model from reading a scoped listing as an empty fleet.
-            let note;
-            if (ownerTeamScopeInfo) {
-                const joined = joinedTeamScope();
-                const remoteBefore = teams.filter(row => row.local !== true).length;
-                teams = teams.filter(row => row.local === true || joined.has(row.team) || (row.teams ?? []).some(name => joined.has(name)));
-                const hiddenRemote = remoteBefore - teams.filter(row => row.local !== true).length;
-                // gh#39 (owner ruling: the listing ADVERTISES targets — an exposed
-                // node id invites a session with no collaboration relationship to
-                // route at it): [this host] session rows follow the CALLER's
-                // collaboration circle. The host's own GUI/panel keeps the full
-                // plane (the owner's eyes); the model-tool face is scoped.
-                let hiddenLocal = 0;
-                const callerAgent = exec.agent;
-                if (callerAgent !== undefined) {
-                    const callerId = String(callerAgent.id);
-                    const ownHandle = sessionTeamOf(callerAgent);
-                    const myCanvas = new Set(canvasStore.teamsOf(callerId));
-                    const myRoster = new Set(teamMemberships.teamsOf(callerId));
-                    const before = teams.length;
-                    teams = teams.filter(row => {
-                        if (row.local !== true)
-                            return true;
-                        if (row.team === config.team || row.team === ownHandle)
-                            return true;
-                        if (row.team.startsWith(`${config.team}/canvas/`))
-                            return myCanvas.has(row.name);
-                        // Another session's team row: visible only when we share a
-                        // canvas or a declared team with that session.
-                        const targetId8 = row.team.slice(config.team.length + 1);
-                        const target = [...sessionNodes.values()].find(agent => id8(String(agent.id)) === targetId8);
-                        if (target === undefined)
-                            return true; // unresolvable: keep (host fact)
-                        const targetId = String(target.id);
-                        const shares = [...canvasStore.teamsOf(targetId)].some(name => myCanvas.has(name))
-                            || [...teamMemberships.teamsOf(targetId)].some(name => myRoster.has(name));
-                        return shares;
-                    });
-                    hiddenLocal = before - teams.length;
-                }
-                const hidden = hiddenRemote + hiddenLocal;
-                note = `teamScopeInfo on: ${String(joined.size)} joined team${joined.size === 1 ? '' : 's'} on this host — ${String(hidden)} row${hidden === 1 ? '' : 's'} outside your collaboration circle withheld (${String(hiddenRemote)} remote, ${String(hiddenLocal)} local [this host] session rows; the process team, your own row, and your canvas teams always show). To widen the scope: a human composes the shared canvas team (the board drag), the owner adds the EXACT team name to teamJoinAllowlist (patterns carry no mint rights, gh#11), or the owner sets teamScopeInfo: false for the open plane`;
-            }
-            if (query === '')
-                return { ok: true, query: '', teams, ...(note !== undefined ? { note } : {}) };
-            const matches = (team) => team.team.toLowerCase().includes(query) || team.name.toLowerCase().includes(query) || team.description.toLowerCase().includes(query)
-                || team.session.toLowerCase().includes(query)
-                || (team.origin ?? '').toLowerCase().includes(query) || (team.workspace ?? '').toLowerCase().includes(query) || (team.via ?? '').toLowerCase().includes(query);
-            return { ok: true, query, teams: teams.filter(matches), ...(note !== undefined ? { note } : {}) };
-        },
-    }));
-    async function listDirectoryTeams(expand) {
+    async function listDirectoryTeams(expand, includeCanvas = false) {
         const localOrigin = lanIp === '' ? `${session} [this host]` : `${session} [this host, ${lanIp}]`;
         const teams = [
             { team: config.team, session, name: config.agentName, description: '', local: true, origin: localOrigin },
@@ -3695,7 +3030,10 @@ ${message}`;
             // count are the facts a caller needs before routing — resolution picks
             // the first live member at route time.
             ...canvasStore.list().map(name => {
-                const members = canvasStore.membersOf(name);
+                // gh#152: members as the local tiers read them (gh#131) — a handle
+                // naming one of this host's own sessions counts as that member, and
+                // the two stored shapes of one session collapse to one.
+                const members = [...new Set(canvasLocalMembersOf(name))];
                 const live = members.filter(id => sessionNodes.has(id)).length;
                 return {
                     team: canvasTeamOf(name),
@@ -3728,35 +3066,12 @@ ${message}`;
             const card = await fetch(peer);
             if (card === undefined)
                 return [];
-            // The origin fields (publisher session label + LAN IP) are natural
-            // grouping dimensions: a fleet's rows cluster by the host that owns
-            // them, no manual grouping required.
-            const origin = card.lanIp !== undefined ? `${card.session} (${card.lanIp})` : card.session;
-            // via = the peer URL the card was fetched from: the panel shows which
-            // host:port each remote row came from, so an unknown node is traceable
-            // to its publishing endpoint at a glance.
-            // legacy: the publisher's card carries no roster capability — a
-            // pre-roster node (0.5.43-). Rows from it are marked so the fleet
-            // audit (and the phase-2 teamed-only default flip) knows which peers
-            // never grow the roster face.
-            const legacy = card.capabilities?.roster !== true;
-            const rows = [
-                { team: card.team, session: card.session, name: card.name, description: '', origin, via: peer, ...(legacy ? { legacy } : {}) },
-            ];
-            // Roster reader half: the card's unsigned teamMemberships map each
-            // published session team to its declared roster teams, so a remote
-            // node's teamed/teamless state is visible without visiting its host.
-            const rosterOf = new Map();
-            for (const membership of card.teamMemberships ?? []) {
-                const list = rosterOf.get(membership.node) ?? [];
-                list.push(membership.team);
-                rosterOf.set(membership.node, list);
-            }
-            for (const entry of card.sessionTeams ?? []) {
-                const declared = rosterOf.get(entry.team);
-                rows.push({ team: entry.team, session: card.session, name: entry.name, description: entry.description, origin, via: peer, ...(entry.workspace !== undefined ? { workspace: entry.workspace } : {}), ...(legacy ? { legacy } : {}), ...(declared !== undefined && declared.length > 0 ? { teams: declared } : {}) });
-            }
-            return rows;
+            // Keep the GUI's remote node projection session-only; the model tool
+            // opts into the additional canvas-team rows (#159).
+            const rows = peerDirectoryRows(card, peer, includeCanvas);
+            // gh#106: a card kept through a miss still lists (until its own
+            // expiresAt), but the row says the peer did not answer the last read.
+            return cardCache.get(peer)?.missAt !== undefined ? rows.map(row => ({ ...row, unreachable: true })) : rows;
         };
         // Bounded-concurrency sweep (mapBounded keeps row order by index, so the
         // listing still follows the peer store's preference order): a cold cache
@@ -3777,25 +3092,6 @@ ${message}`;
         }
         return teams;
     }
-    /**
-     * Whether one caller label can receive network traffic back. Composite
-     * `<zone>/<id>` shapes route anywhere (N1); bare zone names resolve to a
-     * live initiator per host, so cross-host they would steer whichever node
-     * shares the name — treated as unroutable everywhere.
-     */
-    function routableCallerLabel(callerSession) {
-        return callerSession !== undefined &&
-            (/[a-z0-9-]+\/[0-9a-f]{8}$/i.test(callerSession) || /[a-z0-9-]+\/[a-z0-9]{4,}$/i.test(callerSession));
-    }
-    /**
-     * Why an async route from such a caller cannot expect its receipt: the
-     * autosend arm skips it and the steered hint is omitted, so the debt has
-     * no paying path — say so at dispatch time instead of silently stranding
-     * a pending row.
-     */
-    function unroutableCallerNote(label) {
-        return `\n(Note: caller label "${label}" is not network-routable, so the target cannot auto-send a receipt back to you — reconcile via context_id follow-ups instead.)`;
-    }
     /**
      * Track one routed task in the ledger when its result leaves it owed a
      * receipt: ONLY an explicitly async dispatch (fire-and-forget) owes one —
@@ -3805,8 +3101,38 @@ ${message}`;
      * decision seat: sync Q&A must not enter pending; only real
      * receipt-awaiting rows stay on the book). A synchronous completion
      * already carries its answer and owes nothing.
+     * #114 S3: `sender` is the real originator the row is attributed to.
+     */
+    /**
+     * #139: what an in-process async delivery learned about its own birth —
+     * the admission it ran under (design §2.4) and the member that received it
+     * — handed from dispatchLocalCandidate to the caller's outbound row, keyed
+     * by task id and taken (deleted) by whoever dispatched.
      */
-    const trackOwedTask = (taskId, team, peer, result, callbackAddress, brief) => {
+    const localBirths = new Map();
+    const localBirthOf = (team, callerSession, receiptTarget, deliveredTo) => {
+        const admission = localCandidateAdmission(admissionRecords, callerSession, team);
+        const caller = callerSession ?? session;
+        const auth = admission.ok && caller !== ''
+            ? buildAuthorization(admission, { caller, proof: 'in-process', ingress: 'local', allowlistVersion: allowlistVersionNow(), target: team, receiptTarget: receiptTarget ?? caller, receivedAt: Date.now() })
+            : undefined;
+        return { ...(auth !== undefined ? { auth } : {}), ...(deliveredTo !== team ? { deliveredTo } : {}) };
+    };
+    /**
+     * #139: the peer facts a remote outbound row is born with — the signed
+     * card's key and session label (the host identity whatever spelling of its
+     * address dialed it) and, for a canvas row, the member handle the request
+     * carried. The memo makes the card read free after the directory walk.
+     */
+    const peerBirth = async (fetch, candidate, member) => {
+        const card = await fetch(candidate).catch(() => undefined);
+        return {
+            ...(card !== undefined && card.publicKey !== '' ? { peerKey: card.publicKey } : {}),
+            ...(card !== undefined && card.session !== '' ? { peerHost: card.session } : {}),
+            ...(member !== undefined ? { deliveredTo: member } : {}),
+        };
+    };
+    const trackOwedTask = (taskId, team, peer, result, callbackAddress, brief, sender, birth) => {
         if (!result.ok)
             return;
         // Native-teams bridge rounds emit no A2A receipt in this slice: booking
@@ -3822,10 +3148,10 @@ ${message}`;
         // row whose only exit was the dead-letter sweep (57 dead letters, half
         // this shape).
         if (callbackAddress === undefined) {
-            taskLedger.trackReceiptless(taskId, team, peer, result.context_id === '' ? undefined : result.context_id, brief);
+            taskLedger.trackReceiptless(taskId, team, peer, result.context_id === '' ? undefined : result.context_id, brief, sender, birth);
             return;
         }
-        taskLedger.track(taskId, team, peer, result.context_id === '' ? undefined : result.context_id, brief);
+        taskLedger.track(taskId, team, peer, result.context_id === '' ? undefined : result.context_id, brief, sender, birth);
     };
     /**
      * Build the -32004 verdict. The error string is the calling model's ONLY
@@ -3844,6 +3170,9 @@ ${message}`;
      * routable; the dispatch registers receiptless per fix 2).
      */
     const routeVerdict = (team, failures, candidateCount) => {
+        const ambiguous = failures.find(failure => failure.startsWith('ambiguous: '));
+        if (candidateCount === 0 && ambiguous !== undefined)
+            return { ok: false, error: ambiguous, code: -32004 };
         if (candidateCount > 0) {
             return {
                 ok: false,
@@ -3872,49 +3201,11 @@ ${message}`;
         ].filter((line) => line !== undefined);
         return { ok: false, error: lines.join(' — '), code: -32004 };
     };
-    ctx.tools.register(defineTool({
-        name: 'a2a_route',
-        description: 'Route a message to a remote A2A team on the peer network and await its reply. '
-            + 'Pick the team with a2a_teams first. Team names also resolve through peers\' signed zone '
-            + 'delegation records (zone-relative, at most 5 hops). Reuse context_id from a previous reply '
-            + 'to continue that conversation. The call blocks until the remote team responds, which may take minutes — '
-            + 'pass async for long-running tasks: delivery returns immediately and the target routes a receipt '
-            + '(message starting "[A2A receipt] task <task_id> <outcome summary>") back to your team.',
-        parameters: {
-            team: { type: 'string', required: true, description: 'Target team name, from a2a_teams.' },
-            message: { type: 'string', required: true, description: 'The request text to send. For long verdict-style payloads, split into parts and label each "1/N", "2/N"… so the receiver can reassemble.' },
-            context_id: { type: 'string', description: 'Context id from a previous a2a_route reply, to continue that conversation.' },
-            async: { type: 'boolean', description: 'Fire-and-forget: deliver and return immediately (delivered:true + task_id) without waiting for the target\'s reply. The target answers by routing a receipt — a message starting "[A2A receipt] task <task_id> <outcome summary>" — back to your team (visible in a2a_status activity), or follow up with the context_id. Prefer async for long-running tasks (minutes to hours).' },
-        },
-        output: {
-            schema: {
-                type: 'object',
-                additionalProperties: true,
-            },
-            render: renderRoute,
-        },
-        timeoutMs: config.routeTimeoutMs,
-        presentCall: args => ({ card: 'generic', title: `A2A route → ${args.team}`, kind: 'other', rawInput: args }),
-        execute: async (args, exec) => {
-            // Owner ruling (tool-layer interception): the PROCESS face (bare
-            // zone === config.team) keeps its host-level EXEMPTION on the network
-            // admission layer — receipts, quick dispatch and host-side routing
-            // still target it internally — but a MODEL TOOL call must not address
-            // it: the machine's own mailbox is not a member face, and letting a
-            // session route there would turn the host entrance into a group-free
-            // hop. Host-face entry (agent-less control routes, receipt ladders)
-            // never passes through this tool and stays untouched.
-            const requestedTeam = String(args.team ?? '').trim();
-            if (exec.agent !== undefined && requestedTeam === config.team) {
-                return {
-                    ok: false,
-                    error: `the process face "${config.team}" is the host's own mailbox — model tools must target a member face. Route to a session team handle ("${config.team}/<id8>" from a2a_teams) or a canvas team; receipts and quick dispatch reach the host face on their own paths.`,
-                    code: -32000,
-                };
-            }
-            return routeTrunk(args, exec.agent, exec.signal);
-        },
-    }));
+    actTools.registerRoute();
+    // #91 file channel F2: a2a_file_send / a2a_file_fetch (src/tools/files.ts).
+    const fileTools = createFileTools({ ctx, config, blobStore, canvasMembersOf: name => canvasStore.membersOf(name), ownCardUrl: () => ownCardUrl, sessionTeamOf, a2aJoinGateRefusal, routeTrunk, peerFetch, originClaimHeaders });
+    fileTools.registerFileSend();
+    fileTools.registerFileFetch();
     /**
      * The routing trunk (0.6.9): the one failover sequence behind both the
      * a2a_route tool (agent face) and the quick-dispatch control route (host
@@ -3952,6 +3243,7 @@ ${message}`;
         // calls (no agent)
         // and the initiator face stay exempt, like the join gate; discovery
         // (a2a_teams) stays open so a teamless node can still see what to join.
+        let scopedCanvasCaller;
         if (config.teamScopeRouting && agent !== undefined) {
             const scopeCaller = String(agent.id);
             let initiator = false;
@@ -3962,6 +3254,7 @@ ${message}`;
             if (!initiator) {
                 const callerTeams = teamMemberships.teamsOf(scopeCaller);
                 const team = String(args.team ?? '').trim();
+                const sharedRoster = callerTeams.some(roster => teamMemberships.membersOf(roster).some(id => `${config.team}/${id8(id)}` === team));
                 // gh#71: the SHARED-CANVAS basis and the warm cache's peer-org
                 // basis (an org entry naming BOTH the caller and the target
                 // handle) count as declared here too — the same link the
@@ -3970,6 +3263,7 @@ ${message}`;
                 // Canvas members mix two shapes: LOCAL sessions sit by session
                 // id, cross-host members by zone/id8 handle — match either.
                 const callerHandle = `${config.team}/${id8(scopeCaller)}`;
+                scopedCanvasCaller = { id: scopeCaller, handle: callerHandle };
                 // gh#45 末修 (66abc2cf defect): a CANVAS GROUP NAME target
                 // (`<team>/canvas/<name>`) never matches member handles — a
                 // whole-group dispatch from a group member was refused. The
@@ -3980,6 +3274,11 @@ ${message}`;
                     const inGroup = members.includes(scopeCaller) || members.includes(callerHandle);
                     return inGroup ? members.includes(team) || canvasTeamOf(name) === team : false;
                 });
+                // A direct group route must not require a prior directory call. Fetch
+                // only the same eligible peers as resolution; then apply the
+                // unchanged sender/receiver admission rules to their verified cards.
+                if (team.includes('/canvas/') && !sharedCanvas && !callerTeams.includes(team))
+                    await mapBounded(resolutionPeers(), SWEEP_CONCURRENCY, cachedCardFetch);
                 let orgShared = false;
                 for (const cached of cardCache.values()) {
                     const org = cached.card?.canvasOrg;
@@ -3997,17 +3296,17 @@ ${message}`;
                     if (orgShared)
                         break;
                 }
-                if (callerTeams.length === 0 && !sharedCanvas && !orgShared) {
-                    return {
+                if (callerTeams.length === 0 && !sharedRoster && !sharedCanvas && !orgShared) {
+                    return localRoute({
                         ok: false,
                         error: `team-scoped routing is on and this session (${id8(scopeCaller)}) has declared no team membership — a teamless node has no network. Declare one with a2a_team_join (subject to the owner's teamJoinAllowlist)`,
-                    };
+                    });
                 }
-                if (!callerTeams.includes(team) && !sharedCanvas && !orgShared) {
-                    return {
+                if (!callerTeams.includes(team) && !sharedRoster && !sharedCanvas && !orgShared) {
+                    return localRoute({
                         ok: false,
                         error: `team-scoped routing is on: routing to "${team}" requires declared membership. This session's teams: ${callerTeams.join(', ')}. a2a_team_join can declare it (subject to the owner's teamJoinAllowlist)`,
-                    };
+                    });
                 }
             }
         }
@@ -4032,21 +3331,39 @@ ${message}`;
         const callbackAddress = routableCallerLabel(callerSession) || callerSession === config.team
             ? callerSession
             : undefined;
+        // #114 S3: the outbound row records who really sent it instead of
+        // every row reading as "home". A session is always its own node team
+        // (<zone>/<id8>) — joined or not, initiator or not — so one seat keeps
+        // one bucket. An agent-less call is the host process itself; the label
+        // it borrowed on the wire (quick dispatch rides a live joined session's
+        // team) is kept apart as `face`, so a human's workbench gesture never
+        // lands in that session's seat.
+        const sender = agent !== undefined
+            ? { kind: 'session', id: sessionTeamOf(agent) }
+            : { kind: 'host', id: session, ...(callerSession !== undefined && callerSession !== session ? { face: callerSession } : {}) };
         const fetch = memoizedCardFetch();
         // The task id is born at the caller (idempotency key semantics): both
         // dispatchers carry the one id, the peer request echoes it, and the
         // steered receipt header names it — so "[A2A receipt] task <id>" from
         // the target correlates with the route's own result verbatim.
         const taskId = `direct-${Math.random().toString(16).slice(2, 10)}`;
+        const routedReceipt = parseReceipt(args.message) !== null;
         // Candidate order: this host's own teams first (an in-process steer —
         // cheapest possible and immune to nested-signal aborts), then direct
         // publishers, then zone delegations, deduplicated by URL.
         const failures = [];
+        if (signal?.aborted)
+            return localRoute({ ok: false, error: 'route aborted before dispatch', code: -32000 });
         const outcome = await dispatchLocalCandidate(args.team, args.message, callerSession, args.context_id, signal, args.async === true, taskId, callbackAddress, agent === undefined ? undefined : String(agent.id));
+        const localBirth = localBirths.get(taskId);
+        localBirths.delete(taskId);
         if (outcome !== undefined) {
             if (outcome.ok) {
-                trackOwedTask(taskId, args.team, 'local', outcome, callbackAddress, briefOf(args.message));
-                return outcome;
+                // gh#141: a receipt owes no receipt — booking it would strand a row nothing settles.
+                if (!routedReceipt)
+                    trackOwedTask(taskId, args.team, 'local', outcome, callbackAddress, briefOf(args.message), sender, localBirth);
+                // gh#198: host-built delivery notes, or a reply from a clean local session (resolved as routeIntoAgent does), are this host's alone.
+                return ((outcome.bridge === undefined && (outcome.task_status === 'TASK_STATE_DELIVERED' || outcome.task_status === 'TASK_STATE_ABORTED_WAIT' || (t => t !== undefined && nodeTaint.of(String(t.id)) === '')(resolveAgentForTeam(args.team) ?? canvasLiveAgent(parseCanvasTeamName(args.team))))) ? localRoute(outcome) : outcome);
             }
             failures.push(`local: ${outcome.error}`);
         }
@@ -4059,7 +3376,8 @@ ${message}`;
         // unchanged. The ledger stays keyed to the canvas team the caller
         // named; the peer request carries the member handle it must resolve.
         const canvasName = parseCanvasTeamName(args.team);
-        const remoteTargets = canvasName !== undefined ? canvasStore.remoteMembersOf(canvasName) : [];
+        // gh#131: one of this host's own handles is a local member, never a directory target.
+        const remoteTargets = canvasName !== undefined ? ((resolve) => canvasStore.remoteMembersOf(canvasName).filter(ref => resolve(ref) === undefined))(localHandleResolver()) : [];
         const targets = remoteTargets.length > 0 ? [...remoteTargets] : [args.team];
         if (remoteTargets.length > 0) {
             failures.push(`local: canvas team "${args.team}" has no live or wakeable local member`);
@@ -4073,7 +3391,7 @@ ${message}`;
         }
         const candidatePool = [];
         for (const target of targets) {
-            for (const candidate of await directoryPeerCandidates(fetch, target, failures)) {
+            for (const candidate of await directoryPeerCandidates(fetch, target, failures, scopedCanvasCaller)) {
                 candidatePool.push({ candidate, target });
             }
         }
@@ -4094,8 +3412,13 @@ ${message}`;
             }
             const result = await dispatchPeerCandidate(candidate, target, args.message, args.context_id, signal, callerSession, peerAsync, taskId, callbackAddress);
             if (result.ok || signal.aborted) {
-                if (result.ok)
-                    trackOwedTask(taskId, args.team, candidate, result, callbackAddress, briefOf(args.message));
+                // A receipt the creditor refused (its enforce verdict) pays nothing here either (review of PR #149 P2-2).
+                if (result.ok && routedReceipt) {
+                    if (result.settlementRefused !== true)
+                        settleOwnInbound(args.message, args.team, { caller: callerSession ?? '', proof: 'in-process', ingress: 'local' });
+                }
+                else if (result.ok)
+                    trackOwedTask(taskId, args.team, candidate, result, callbackAddress, briefOf(args.message), sender, await peerBirth(fetch, candidate, target === args.team ? undefined : target));
                 const notes = [];
                 if (result.ok && args.async === true && result.task_status === 'TASK_STATE_DELIVERED' && !routableCallerLabel(callerSession)) {
                     notes.push(unroutableCallerNote(String(callerSession ?? session)));
@@ -4141,6 +3464,12 @@ ${message}`;
             recordActivity('out', team, callerSession ?? 'local', false);
             return { ok: false, error: joinedRefusal, code: -32000 };
         }
+        // #114 S5: the same header-safe id rule the wire face enforces.
+        const idRefusal = taskIdFromCaller === undefined ? undefined : taskIdRefusal(taskIdFromCaller);
+        if (idRefusal !== undefined) {
+            recordActivity('out', team, callerSession ?? 'local', false);
+            return { ok: false, error: idRefusal, code: -32000 };
+        }
         const canvasName = parseCanvasTeamName(team);
         // Issue #41 shape note: the caller label is the WIRE form (<zone>/<id8>
         // or a session label) and quick-dispatch BORROWS a live session's team
@@ -4159,8 +3488,14 @@ ${message}`;
         // gh#45 CLI mailbox: a delivery targeting a DEPOSITED CLI handle is
         // local by definition — it lands in the deposit's mailbox (the CLI
         // polls while alive; receipts and messages never wake anything).
+        // The settler of any receipt on this path: this host's own caller (in-process).
+        const localSettler = { caller: callerSession ?? '', proof: 'in-process', ingress: 'local' };
         const cliRow = cliDeposits.get(team);
         if (cliRow !== undefined) {
+            // #114 S4 (design §4.5): a receipt dropped into a local CLI mailbox is
+            // exactly the settlement a CLI-originated task waits for — settle it,
+            // as the wire face settles before ITS mailbox split.
+            settleAndAnnounce(message, localSettler);
             cliDeposits.mail(team, callerSession ?? 'unknown', message);
             recordActivity('in', team, callerSession ?? 'peer', true);
             logger.info(`a2a: cli mailbox delivery for ${team} (from ${callerSession ?? 'unknown'})`);
@@ -4176,7 +3511,7 @@ ${message}`;
         // A receipt relayed between same-host sessions (the answering session
         // routing its `[A2A receipt]` back over the in-process candidate)
         // correlates here too — same contract, no HTTP on the path.
-        settleAndAnnounce(message);
+        settleAndAnnounce(message, localSettler);
         const taskId = taskIdFromCaller ?? `direct-${Math.random().toString(16).slice(2, 10)}`;
         const flight = beginRoute(team, 'local');
         if (asyncMode) {
@@ -4205,7 +3540,7 @@ ${message}`;
                 if (prepared.ok) {
                     endRoute(flight);
                     recordActivity('out', team, 'local', true);
-                    void nativeTeamsRound(prepared, team, callerSession ?? session, message, taskId)
+                    void nativeTeamsRound(prepared, team, callerSession ?? session, message, taskId, '未验证（in-process）', undefined, hostDirectHeader)
                         .then(outcome => {
                         if (!outcome.ok) {
                             recordActivity('out', team, 'local', false);
@@ -4254,8 +3589,13 @@ ${message}`;
                     ? callbackAddress
                     : routable ? callerSession : undefined;
                 const receiptHint = callerTeam === undefined ? '' : `\n\n(When done, route your outcome back with one call — a2a_route { team: "${callerTeam}", message: "[A2A receipt] task ${taskId} <one-line outcome>" }.)`;
-                steerRelay(target, `[A2A direct] (task ${taskId}) ${fromClause(callerSession ?? session)} (routed to ${team}) sent:\n\n${message}${receiptHint}`, callerTeam);
-                armReceiptAutosend(target, taskId, callerTeam, message);
+                // #114 S5: the consumption search starts at the pre-steer log length.
+                const steerFloor = sessionEventsOf(target).length;
+                steerRelay(target, `[A2A direct] (task ${taskId}) 未验证（in-process） ${sanitizeFromClause(callerSession ?? session)} (routed to ${team}) sent:\n\n${message}${receiptHint}`, callerTeam, originAgentId);
+                armReceiptAutosend(target, taskId, callerTeam, message, steerFloor);
+                // #139: the caller's outbound row is born with this admission and the member that received it.
+                if (taskIdFromCaller !== undefined)
+                    localBirths.set(taskIdFromCaller, localBirthOf(team, callerSession, callerTeam, sessionTeamOf(target)));
                 endRoute(flight);
                 recordActivity('out', team, 'local', true);
                 return {
@@ -4289,7 +3629,7 @@ ${message}`;
             if (!steerable && team !== config.team) {
                 const prepared = await nativeTeamsPrepare(team);
                 if (prepared.ok) {
-                    const outcome = await nativeTeamsRound(prepared, team, callerSession ?? session, message, taskId, signal);
+                    const outcome = await nativeTeamsRound(prepared, team, callerSession ?? session, message, taskId, '未验证（in-process）', signal, hostDirectHeader);
                     endRoute(flight);
                     if (!outcome.ok) {
                         // The aborted-wait shape is earned only by an actual round
@@ -4330,7 +3670,7 @@ ${message}`;
                 }
             }
         }
-        const wait = routeIntoAgent(team, message, callerSession ?? session, taskId);
+        const wait = routeIntoAgent(team, message, callerSession ?? session, taskId, undefined, undefined, originAgentId);
         const aborted = new Promise((_, reject) => {
             signal.addEventListener('abort', () => { reject(new Error('aborted')); }, { once: true });
         });
@@ -4437,12 +3777,15 @@ ${message}`;
      * receipt ladder can distinguish "delivered" from "no route" and its
      * owner escalation actually fires for cross-node callback addresses.
      */
-    async function dispatchAnywhere(team, message, callerSession, contextId, signal, asyncMode, taskId) {
+    async function dispatchAnywhere(team, message, callerSession, contextId, signal, asyncMode, taskId, peerCaller) {
         const local = await dispatchLocalCandidate(team, message, callerSession, contextId, signal, asyncMode, taskId);
+        // A background send books no outbound row: its birth facts have no row to go on.
+        if (taskId !== undefined)
+            localBirths.delete(taskId);
         if (local !== undefined) {
             if (!local.ok)
                 throw new Error(local.error);
-            return;
+            return local;
         }
         const failures = [];
         const candidates = await directoryPeerCandidates(memoizedCardFetch(), team, failures);
@@ -4451,9 +3794,9 @@ ${message}`;
         }
         let lastError = 'no candidate delivered';
         for (const candidate of candidates) {
-            const result = await dispatchPeerCandidate(candidate, team, message, contextId, signal, callerSession, asyncMode, taskId);
+            const result = await dispatchPeerCandidate(candidate, team, message, contextId, signal, peerCaller ?? callerSession, asyncMode, taskId);
             if (result.ok)
-                return;
+                return result;
             lastError = result.error;
             if (signal.aborted)
                 break;
@@ -4471,7 +3814,6 @@ ${message}`;
      */
     const CANDIDATE_CONCURRENCY = 6;
     /** Concurrent card fetches in one directory sweep (cold-cache burst bound). */
-    const SWEEP_CONCURRENCY = 6;
     async function mapBounded(items, limit, task) {
         const results = new Array(items.length);
         let next = 0;
@@ -4485,7 +3827,10 @@ ${message}`;
         await Promise.all(workers);
         return results;
     }
-    async function directoryPeerCandidates(fetch, team, failures) {
+    function resolutionPeers() {
+        return config.referralTeamResolution === true ? peerStore.list() : [...new Set([...peerStore.listSeeded(), ...config.delegates.map(delegate => delegate.url)])];
+    }
+    async function directoryPeerCandidates(fetch, team, failures, scopedCanvasCaller) {
         // gh#8 (N9): a team name resolves only to hosts an operator linked —
         // the seeded subset of the peer store (config seeds, eviction-immune)
         // plus the delegate records (config-time operator acts). The
@@ -4494,16 +3839,23 @@ ${message}`;
         // (gh#8: a squatter two gossip hops away captured routes by naming
         // itself after the target). referralTeamResolution restores the legacy
         // whole-store basis for fleets mid-migration.
-        const peers = config.referralTeamResolution === true ? peerStore.list() : [...new Set([...peerStore.listSeeded(), ...config.delegates.map(delegate => delegate.url)])];
+        const peers = resolutionPeers();
         const candidates = [];
         const cards = await mapBounded(peers, CANDIDATE_CONCURRENCY, async (peer) => ({ peer, card: await fetch(peer) }));
+        // Check after fetching all cards: a seeded peer publishing the same id8
+        // makes the caller handle ambiguous, so do not send a canvas payload.
+        const resolveLocal = scopedCanvasCaller === undefined ? undefined : localHandleResolver();
+        const resolutions = await mapBounded(peers, CANDIDATE_CONCURRENCY, async (peer) => ({ peer, outcome: await resolveZone(fetch, peer, team) }));
+        if (canvasTargetAmbiguous(cards.map(entry => entry.card), team, scopedCanvasCaller, resolveLocal, resolutions.some(entry => entry.outcome.ok))) {
+            failures.push(`ambiguous: team "${team}" has conflicting owners, identities, or a colliding caller; no payload sent`);
+            return [];
+        }
         for (const entry of cards) {
             if (entry.card === undefined)
                 continue;
-            if (entry.card.team === team || (entry.card.sessionTeams ?? []).some(item => item.team === team))
+            if (entry.card.team === team || sessionCandidateMatches(entry.card, team) || canvasCandidateMatches(entry.card, team, scopedCanvasCaller, resolveLocal))
                 candidates.push(entry.peer);
         }
-        const resolutions = await mapBounded(peers, CANDIDATE_CONCURRENCY, async (peer) => ({ peer, outcome: await resolveZone(fetch, peer, team) }));
         for (const { peer, outcome } of resolutions) {
             if (outcome.ok) {
                 if (!candidates.includes(outcome.url))
@@ -4564,6 +3916,14 @@ ${message}`;
                 if (sessionNodes.has(parent) || joinedSessions.has(parent))
                     callbackAddress = `${config.team}/${id8(parent)}`;
             }
+            // #114 S3: the submitting session's node team, but only when the
+            // transport names a session this host knows (a node, a join, or a live
+            // root) — an unchecked id would let any submitter mint a seat. Anything
+            // else (absent, unknown, non-string) is attributed to the host label.
+            const parentSession = request.callbackTarget?.parentSessionId;
+            const knownParent = typeof parentSession === 'string' && parentSession !== ''
+                && (sessionNodes.has(parentSession) || joinedSessions.has(parentSession) || liveRoots.has(parentSession));
+            const sender = { kind: 'bridge', id: knownParent ? `${config.team}/${id8(parentSession)}` : session };
             for (const candidate of candidates) {
                 // Capability gate per candidate, like a2a_route's loop: a
                 // delivery:async submit never dials a peer whose signed card does
@@ -4607,7 +3967,7 @@ ${message}`;
                         break;
                     continue;
                 }
-                trackOwedTask(taskId, request.handle, candidate, result, callbackAddress, briefOf(request.message));
+                trackOwedTask(taskId, request.handle, candidate, result, callbackAddress, briefOf(request.message), sender, await peerBirth(fetch, candidate, undefined));
                 const contextId = request.contextId ?? (result.context_id !== '' ? result.context_id : `ctx-${Math.random().toString(16).slice(2, 10)}`);
                 if (result.task_status === 'TASK_STATE_COMPLETED') {
                     return { kind: 'completed', text: result.reply, taskId, contextId };
@@ -4712,368 +4072,15 @@ ${message}`;
         },
     };
     ctx.reflect.provide(NATIVE_TEAMS_A2A_FACE_KEY, bridgeFace);
-    ctx.tools.register(defineTool({
-        name: 'a2a_status',
-        description: 'Read-only A2A network health: the tracked peer fleet with quality scores, routes currently in flight '
-            + '(who is waiting on whom), and the recent routing activity ring (inbound and outbound outcomes). '
-            + 'Includes the idempotency window occupancy (claims, replays, conflicts) behind the UNIQUE-ization '
-            + 'traffic watch. '
-            + 'While teamScopeInfo is on (default), peers / in-flight / activity narrow to the joined-team scope — local traffic and idempotency aggregates stay. '
-            + 'Use it to observe an ongoing collaboration or diagnose delivery instead of re-routing.',
-        parameters: {},
-        output: {
-            schema: {
-                type: 'object',
-                additionalProperties: false,
-                properties: {
-                    ok: { type: 'boolean', required: true },
-                    peers: {
-                        type: 'array',
-                        required: true,
-                        items: {
-                            type: 'object',
-                            additionalProperties: false,
-                            properties: {
-                                url: { type: 'string', required: true },
-                                score: { type: 'number' },
-                            },
-                        },
-                    },
-                    inFlight: {
-                        type: 'array',
-                        required: true,
-                        items: {
-                            type: 'object',
-                            additionalProperties: false,
-                            properties: {
-                                team: { type: 'string', required: true },
-                                peer: { type: 'string', required: true },
-                                startedAt: { type: 'number', required: true },
-                            },
-                        },
-                    },
-                    activity: {
-                        type: 'array',
-                        required: true,
-                        items: {
-                            type: 'object',
-                            additionalProperties: false,
-                            properties: {
-                                ts: { type: 'number', required: true },
-                                dir: { type: 'string', required: true },
-                                team: { type: 'string', required: true },
-                                peer: { type: 'string', required: true },
-                                ok: { type: 'boolean', required: true },
-                            },
-                        },
-                    },
-                    idempotency: {
-                        type: 'object',
-                        additionalProperties: false,
-                        required: true,
-                        properties: {
-                            window: { type: 'number', required: true },
-                            cap: { type: 'number', required: true },
-                            pending: { type: 'number', required: true },
-                            settled: { type: 'number', required: true },
-                            claimsFresh: { type: 'number', required: true },
-                            replays: { type: 'number', required: true },
-                            conflicts: { type: 'number', required: true },
-                        },
-                    },
-                },
-            },
-            render: (_args, value) => [{
-                    type: 'text',
-                    text: [
-                        ...(value.inFlight.length === 0 ? [] : ['In flight:']),
-                        ...value.inFlight.map((route) => `  → ${route.team} via ${route.peer === 'local' ? 'this host' : route.peer}`),
-                        `Peers (${String(value.peers.length)}):`,
-                        ...value.peers.map((peer) => `  ${peer.url}${typeof peer.score === 'number' ? ` (score ${String(Math.round(peer.score))})` : ''}`),
-                        `Idempotency window: ${String(value.idempotency.window)}/${String(value.idempotency.cap)} (pending ${String(value.idempotency.pending)}, settled ${String(value.idempotency.settled)}) — claims ${String(value.idempotency.claimsFresh)}, replays ${String(value.idempotency.replays)}, conflicts ${String(value.idempotency.conflicts)}`,
-                        ...(value.activity.length === 0 ? [] : ['Recent routes:']),
-                        ...[...value.activity].reverse().slice(0, 10).map((entry) => `  ${entry.dir === 'in' ? '←' : '→'} ${entry.team} ${entry.ok ? 'ok' : 'failed'}`),
-                    ].join('\n'),
-                }],
-        },
-        presentCall: () => ({ card: 'generic', title: 'A2A network status', kind: 'other', rawInput: null }),
-        execute: async (_args, exec) => {
-            a2aJoinGateRefusal(exec);
-            // S5 open plane: the unscoped snapshot, as before.
-            if (!config.teamScopeInfo) {
-                return {
-                    ok: true,
-                    peers: peerStore.list().map(url => ({ url, score: peerStore.score(url) })),
-                    inFlight: [...inFlightRoutes.values()].map(route => ({ team: route.team, peer: route.peer, startedAt: route.startedAt })),
-                    activity: recentActivity.slice(),
-                    idempotency: idempotencyStore.stats(),
-                };
-            }
-            // S5 scoped plane: the tracked fleet narrows to peers whose verified
-            // card serves a joined team (bounded-concurrency memoized fetch — a
-            // warm sweep costs no extra round trips); routing facts keep
-            // host-internal traffic (peer 'local') and drop remote rows whose
-            // team is outside the scope, so cross-fleet collaborations stay
-            // unread here. The idempotency aggregate is host machinery, not
-            // attribution — it stays unscoped like the ledger it serves.
-            const joined = joinedTeamScope();
-            const visibleTeams = new Set(joined);
-            for (const agent of sessionNodes.values()) {
-                if (teamMemberships.teamsOf(String(agent.id)).some(team => joined.has(team)))
-                    visibleTeams.add(sessionTeamOf(agent));
-            }
-            // The host's own process-team face is host-internal ALWAYS — a
-            // zero-roster host must still see inbound deliveries and outbound
-            // attempts addressed to itself (review M2: gating this on
-            // joined.size > 0 self-blinded exactly that traffic).
-            visibleTeams.add(config.team);
-            // G2 (review artifact 688c0354d3 v2): the host-synthetic face rows —
-            // the /a2a/log telemetry records under the synthetic team label
-            // 'log' (recordActivity('in', 'log', caller) on both admission
-            // outcomes) — are THIS host's own face facts, not fleet observation.
-            // Scoping filtered them like foreign traffic and hid the host's own
-            // inbound log-face telemetry from its own supervisor; they pass.
-            visibleTeams.add('log');
-            const fetch = memoizedCardFetch();
-            const peerRows = await mapBounded(peerStore.list(), SWEEP_CONCURRENCY, async (url) => {
-                const card = await fetch(url);
-                return card !== undefined && cardServesJoined(card, joined) ? { url, score: peerStore.score(url) } : undefined;
-            });
-            const peers = peerRows.filter((row) => row !== undefined);
-            const inScope = (entry) => entry.peer === 'local' || visibleTeams.has(entry.team);
-            return {
-                ok: true,
-                peers,
-                inFlight: [...inFlightRoutes.values()].map(route => ({ team: route.team, peer: route.peer, startedAt: route.startedAt })).filter(inScope),
-                activity: recentActivity.filter(inScope),
-                idempotency: idempotencyStore.stats(),
-            };
-        },
-    }));
-    /** Human duration for a ledger row: how long a task has been owed or took. */
-    const describeAge = (ms) => {
-        const minutes = Math.floor(ms / 60_000);
-        if (minutes < 1)
-            return 'under a minute';
-        if (minutes < 60)
-            return `${String(minutes)}m`;
-        return `${String(Math.floor(minutes / 60))}h${minutes % 60 === 0 ? '' : `${String(minutes % 60)}m`}`;
-    };
-    // S5 ruling: a2a_tasks stays unscoped — it is this host's own dispatch
-    // ledger (pending / dead / archived), the receipt-reconciliation surface
-    // for work this host itself routed, initiator-exempt dispatches included.
-    // Its rows name teams this host already talked to; reading them back is
-    // bookkeeping, not fleet disclosure.
-    ctx.tools.register(defineTool({
-        name: 'a2a_tasks',
-        description: 'Read-only three-tier ledger of routed A2A tasks: pending rows still owed a receipt, rows '
-            + 'auto-dead-lettered past the stale TTL, and the bounded archive of correlated '
-            + '`[A2A receipt] task <task_id>` outcomes. Use it to reconcile dispatched async work instead of '
-            + 're-routing to ask for progress.',
-        parameters: {},
-        output: {
-            schema: {
-                type: 'object',
-                additionalProperties: false,
-                properties: {
-                    ok: { type: 'boolean', required: true },
-                    tasks: {
-                        type: 'array',
-                        required: true,
-                        items: {
-                            type: 'object',
-                            additionalProperties: false,
-                            properties: {
-                                taskId: { type: 'string', required: true },
-                                team: { type: 'string', required: true },
-                                peer: { type: 'string', required: true },
-                                startedAt: { type: 'number', required: true },
-                                contextId: { type: 'string' },
-                                brief: { type: 'string' },
-                                status: { type: 'string', required: true },
-                                deadAt: { type: 'number' },
-                                direction: { type: 'string', enum: ['inbound', 'outbound'] },
-                                receiptExpected: { type: 'boolean' },
-                                reason: { type: 'string', enum: ['fire-forget', 'unconsumed'] },
-                            },
-                        },
-                    },
-                    archive: {
-                        type: 'array',
-                        required: true,
-                        items: {
-                            type: 'object',
-                            additionalProperties: false,
-                            properties: {
-                                taskId: { type: 'string', required: true },
-                                team: { type: 'string', required: true },
-                                startedAt: { type: 'number', required: true },
-                                resolvedAt: { type: 'number', required: true },
-                                summary: { type: 'string' },
-                                brief: { type: 'string' },
-                            },
-                        },
-                    },
-                    archivedTotal: { type: 'number', required: true },
-                },
-            },
-            render: (_args, value) => [{
-                    type: 'text',
-                    text: value.tasks.length === 0 && value.archivedTotal === 0
-                        ? 'No routed tasks are owed a receipt.'
-                        : [
-                            ...(() => {
-                                // C-ruling split (2026-09-01 decision seat): only young,
-                                // receipt-expected pending rows are settleable debt — the
-                                // stale tail is conversational noise waiting on the dead
-                                // TTL; count it, don't list it.
-                                const pending = value.tasks.filter((task) => task.status === 'pending');
-                                const settleable = pending.filter((task) => task.receiptExpected !== false && Date.now() - task.startedAt < 60 * 60_000);
-                                const staleCount = pending.length - settleable.length;
-                                return [
-                                    ...(settleable.length > 0 ? ['Owed receipts:'] : []),
-                                    ...settleable.map((task) => {
-                                        const context = task.contextId === undefined || task.contextId === '' ? '' : `, follow-up context ${task.contextId}`;
-                                        const brief = task.brief === undefined || task.brief === '' ? '' : ` — "${task.brief}"`;
-                                        return `  - ${task.taskId}${brief} → ${task.team} (via ${task.peer === 'local' ? 'this host' : task.peer}), waiting ${describeAge(Date.now() - task.startedAt)}${context}`;
-                                    }),
-                                    ...(staleCount > 0 ? [`Delivered conversationally without a formal receipt (${String(staleCount)}) — not debts; they auto-dead-letter at the stale TTL.`] : []),
-                                ];
-                            })(),
-                            ...(value.tasks.some((task) => task.status === 'dead') ? ['Dead-lettered (auto-flagged past the stale TTL; a revived target can still settle with a late receipt):'] : []),
-                            ...value.tasks.filter((task) => task.status === 'dead').map((task) => {
-                                const context = task.contextId === undefined || task.contextId === '' ? '' : `, follow-up context ${task.contextId}`;
-                                const brief = task.brief === undefined || task.brief === '' ? '' : ` — "${task.brief}"`;
-                                return `  - ${task.taskId}${brief} → ${task.team} (via ${task.peer === 'local' ? 'this host' : task.peer}), dispatched ${describeAge(Date.now() - task.startedAt)} ago${context}`;
-                            }),
-                            ...(value.archivedTotal > 0 ? [`Archived (${String(value.archivedTotal)}), most recent first:`] : []),
-                            ...value.archive.map((entry) => {
-                                const brief = entry.brief === undefined || entry.brief === '' ? '' : ` — "${entry.brief}"`;
-                                return `  - ${entry.taskId}${brief} → ${entry.team}: after ${describeAge(entry.resolvedAt - entry.startedAt)}, ${entry.summary === undefined || entry.summary === '' ? 'resolved' : entry.summary}`;
-                            }),
-                            ...(value.archivedTotal > value.archive.length ? [`  (+${String(value.archivedTotal - value.archive.length)} older not shown)`] : []),
-                        ].join('\n'),
-                }],
-        },
-        presentCall: () => ({ card: 'generic', title: 'A2A task ledger', kind: 'other', rawInput: null }),
-        execute: async (_args, exec) => {
-            a2aJoinGateRefusal(exec);
-            const archiveAll = taskLedger.archive();
-            return {
-                ok: true,
-                tasks: taskLedger.list().map(task => ({ ...task })),
-                archive: archiveAll.slice(0, 5).map(({ taskId, team, startedAt, resolvedAt, summary, brief }) => ({ taskId, team, startedAt, resolvedAt, ...(summary !== undefined && summary !== '' ? { summary } : {}), ...(brief !== undefined ? { brief } : {}) })),
-                archivedTotal: archiveAll.length,
-            };
-        },
-    }));
-    ctx.tools.register(defineTool({
-        name: 'a2a_probe',
-        description: 'Probe the tracked peer fleet for reachability and round-trip latency: one verified-card fetch per peer '
-            + '(the same fetch discovery uses), reporting reachable peers with their team and latency and unreachable '
-            + 'ones with the failure reason. Pass url to probe one target instead of the whole fleet. '
-            + 'While teamScopeInfo is on (default), the sweep covers only peers serving a joined team, and a single URL is refused unless its verified card proves service. '
-            + 'Use it before dispatching verification work or when routes fail over, instead of guessing which node is down.',
-        parameters: {
-            url: { type: 'string', description: 'Optional single peer base URL to probe; empty probes every tracked peer.' },
-        },
-        output: {
-            schema: {
-                type: 'object',
-                additionalProperties: false,
-                properties: {
-                    ok: { type: 'boolean', required: true },
-                    results: {
-                        type: 'array',
-                        required: true,
-                        items: {
-                            type: 'object',
-                            additionalProperties: false,
-                            properties: {
-                                url: { type: 'string', required: true },
-                                reachable: { type: 'boolean', required: true },
-                                ms: { type: 'number', description: 'Round-trip of the card fetch, reachable or not.' },
-                                team: { type: 'string', description: 'The team the peer publishes, when reachable.' },
-                                error: { type: 'string', description: 'Why the peer is unreachable.' },
-                            },
-                        },
-                    },
-                },
-            },
-            render: (_args, value) => [{
-                    type: 'text',
-                    text: value.results.length === 0
-                        ? 'No peers are tracked; add seeds or let referrals arrive.'
-                        : [
-                            `Fleet probe (${String(value.results.length)}): ${String(value.results.filter((row) => row.reachable).length)} reachable, ${String(value.results.filter((row) => !row.reachable).length)} down`,
-                            ...value.results.map((row) => `  ${row.reachable ? '✓' : '✗'} ${row.url}${row.reachable ? ` (team ${String(row.team)}, ${String(row.ms)}ms)` : ` (${String(row.error)})`}`),
-                        ].join('\n'),
-                }],
-        },
-        presentCall: args => ({ card: 'generic', title: args.url === undefined || args.url === '' ? 'Probe the A2A fleet' : `Probe A2A peer: ${args.url}`, kind: 'other', rawInput: args }),
-        execute: async (args, exec) => {
-            a2aJoinGateRefusal(exec);
-            const probeOne = async (url) => {
-                const startedAt = Date.now();
-                const outcome = await client.fetchCardDetail(url);
-                const ms = Date.now() - startedAt;
-                // The fetch is the probe: settling it moves the peer's quality score
-                // and learns its referrals, exactly like a discovery sweep would,
-                // while the outcome's stage names the failure for the report.
-                const card = settlePeerCard(url, outcome);
-                if (card !== undefined) {
-                    // gh#71 fix ①: a successful full-face fetch persists into the warm
-                    // cache — the probe is often the FIRST contact (no directory sweep
-                    // has run), and the state face's peerOrg reads exactly this cache.
-                    cardCache.set(url, { at: Date.now(), card });
-                    return { url, reachable: true, ms, team: card.team };
-                }
-                if (outcome.ok)
-                    return { url, reachable: false, ms, error: 'dropped: the card lists this node back as its own referral' };
-                return outcome.stage === 'unreachable'
-                    ? { url, reachable: false, ms, error: `unreachable: ${outcome.detail}` }
-                    : { url, reachable: false, ms, error: `rejected: ${outcome.reason} card` };
-            };
-            // S5: a reachability report is fleet disclosure too. The sweep probes
-            // only peers whose verified card serves a joined team (memoized —
-            // warm cards cost nothing); a single-URL probe needs proof of service
-            // — a FRESH card, or a stale cached one: a peer that once served a
-            // joined team and is now down gets the normal down report (that
-            // reachability fact belongs to the team), while a URL that never
-            // proved service is refused without a probe (its reachability is
-            // exactly the fact scoping withholds).
-            const joined = joinedTeamScope();
-            const fetch = memoizedCardFetch();
-            const serves = async (url) => {
-                const card = await fetch(url);
-                return card !== undefined && cardServesJoined(card, joined);
-            };
-            if (args.url !== undefined && args.url !== '') {
-                if (config.teamScopeInfo && !(await serves(args.url))) {
-                    const stale = cardCache.get(args.url)?.card;
-                    if (stale !== undefined && cardServesJoined(stale, joined)) {
-                        // Was serving, now unverifiable fresh — probe and report the
-                        // down state through the normal path.
-                        return { ok: true, results: await Promise.all([args.url].map(probeOne)) };
-                    }
-                    return { ok: true, results: [{ url: args.url, reachable: false, ms: 0, error: stale === undefined
-                                    ? 'refused (not probed): teamScopeInfo on — no verified card for this URL proves service to a joined team'
-                                    : 'refused (not probed): teamScopeInfo on — this URL\'s verified card shows no team joined by this host\'s nodes' }] };
-                }
-                return { ok: true, results: await Promise.all([args.url].map(probeOne)) };
-            }
-            const targets = config.teamScopeInfo
-                ? await mapBounded(peerStore.list(), SWEEP_CONCURRENCY, async (url) => await serves(url) ? url : undefined).then(rows => rows.filter((url) => url !== undefined))
-                : peerStore.list();
-            // Promise.all keeps the report in the store's preference order.
-            return { ok: true, results: await Promise.all(targets.map(probeOne)) };
-        },
-    }));
+    infoTools.registerStatus();
+    infoTools.registerTasks();
+    infoTools.registerProbe();
     const pendingFinals = new Map();
     const armFlushTimeout = (agentId, waiter) => {
         return ctx.timer.timeout(() => {
             const entries = pendingFinals.get(agentId);
-            if (entries === undefined)
+            // An already-answered waiter is gone from the list: never answer twice.
+            if (entries === undefined || !entries.includes(waiter))
                 return;
             const kept = entries.filter(entry => entry !== waiter);
             if (kept.length === 0)
@@ -5096,27 +4103,114 @@ ${message}`;
             pendingFinals.delete(agentId);
             return;
         }
+        // #114 S5: each waiter is answered from its OWN floor. The old shared
+        // floor (the minimum sinceEvents) answered every waiter with one text, so
+        // a busy target's other work line settled tasks it had not read yet.
         const events = sessionEventsOf(agent);
-        const floor = Math.min(...entries.map(entry => entry.sinceEvents));
-        let reply = '';
-        for (let index = events.length - 1; index >= floor; index--) {
+        const answered = [];
+        // Logs that record turn boundaries bound each waiter to its consuming
+        // turn; a log without any marker falls back to "this idle ends it".
+        const turnMarked = events.some(event => event?.type === 'turn/start' || event?.type === 'turn/end');
+        for (const entry of entries) {
+            if (entry.taskId !== undefined) {
+                entry.consumedAt ??= consumptionIndex(events, entry.taskId, entry.scannedTo ?? entry.sinceEvents);
+                if (entry.consumedAt === undefined) {
+                    // Not consumed yet (the steer waits for the running turn's next
+                    // step, or the next turn): no final belongs to it — keep waiting.
+                    entry.scannedTo = events.length;
+                    continue;
+                }
+                // The consuming turn's window: up to its own `turn/end`, never into a
+                // following turn (back-to-back turns can run with no idle between).
+                // Without turn markers, this idle is the turn's end.
+                let end = events.length;
+                let completed = true;
+                if (turnMarked) {
+                    const close = turnEndIndex(events, entry.consumedAt + 1);
+                    if (close === undefined) {
+                        // The consuming turn is still open: wait for its turn/end.
+                        continue;
+                    }
+                    end = close;
+                    completed = events[close]?.data?.reason?.kind === 'completed';
+                }
+                // The waiter closes HERE with that turn's last text. A turn that said
+                // nothing, or ended aborted/failed/blocked, did no work this host can
+                // vouch for: close as a placeholder — no receipt, the row stays owed.
+                const reply = latestAssistantText(events, entry.consumedAt + 1, end);
+                answered.push(reply !== '' && completed ? { entry, reply } : { entry, reply: '', placeholder: true });
+                continue;
+            }
+            const reply = latestAssistantText(events, entry.sinceEvents);
+            if (reply !== '')
+                answered.push({ entry, reply });
+        }
+        if (answered.length === 0)
+            return;
+        const kept = entries.filter(entry => !answered.some(done => done.entry === entry));
+        if (kept.length === 0)
+            pendingFinals.delete(agentId);
+        else
+            pendingFinals.set(agentId, kept);
+        for (const { entry, reply, placeholder } of answered) {
+            entry.timeoutDisposer?.();
+            if (placeholder === true)
+                entry.answer('The consuming turn produced no completed reply.', true);
+            else
+                entry.answer(reply);
+        }
+    }
+    /** #114 S5: the index of the first `turn/end` at or after `from`, or undefined while the turn is open. */
+    function turnEndIndex(events, from) {
+        for (let index = from; index < events.length; index++) {
+            if (events[index]?.type === 'turn/end')
+                return index;
+        }
+        return undefined;
+    }
+    /** #114 S5: the steer header both delivery paths write; the id is captured whole, never prefix-matched. */
+    const STEER_HEADER = /^\[A2A direct\] \(task ([^\s)]+)\) /;
+    /**
+     * #114 S5: the index of the user/message that consumed one task's steer —
+     * the first at or after `from` whose first text block opens with the
+     * `[A2A direct] (task <id>)` header for exactly this id.
+     * @param from - first index not yet searched (starts at the pre-steer log length).
+     * @returns the index, or undefined while the steer is still unconsumed.
+     */
+    function consumptionIndex(events, taskId, from) {
+        for (let index = from; index < events.length; index++) {
+            const event = events[index];
+            if (event?.type !== 'user/message')
+                continue;
+            const first = event.data?.content?.find(block => block.type === 'text' && typeof block.text === 'string');
+            if (STEER_HEADER.exec(first?.text ?? '')?.[1] === taskId)
+                return index;
+        }
+        return undefined;
+    }
+    /**
+     * The newest assistant text at or after `floor`: at an idle flush that is
+     * the final of the turn that just ended. Textless messages (tool-only, or
+     * empty/whitespace text) are skipped, so a turn ending on a tool call still
+     * answers with the last thing it said. '' when no message has text.
+     * @param end - exclusive upper bound (default: the whole log).
+     */
+    function latestAssistantText(events, floor, end = events.length) {
+        for (let index = end - 1; index >= floor; index--) {
             const event = events[index];
             if (event === undefined || event.type !== 'assistant/message')
                 continue;
             const content = event.data?.message?.content;
             if (content === undefined)
                 continue;
-            reply = content
+            const text = content
                 .filter((block) => block.type === 'text' && typeof block.text === 'string')
                 .map(block => block.text)
                 .join('\n');
-            break;
-        }
-        if (reply !== '') {
-            for (const entry of entries)
-                entry.answer(reply);
-            pendingFinals.delete(agentId);
+            if (text.trim() !== '')
+                return text;
         }
+        return '';
     }
     // Every inbound route is a direct route (final semantics), so the idle
     // flush listens unconditionally — an empty pendingFinals map makes it a