@nelsonlongxiang/dsh-open-a2a-net 0.6.35 → 0.6.37

package/lib/owner-settings.js

@@ -8,8 +8,39 @@
  * else; a missing entry is appended in the canonical short-id form.
  * @module @nelsonlongxiang/dsh-open-a2a-net/owner-settings
  */
+/** A label shaped like a routable address (`dsh/66abc2cf`, `zone/canvas/x`, `name/<16 hex>`) would pass for another
+ *  session in the directory and in `a2a-net teams <query>`; labels are display-only, so that shape is refused. */
+const ADDRESS_SHAPED = /^[A-Za-z0-9._-]+\/\S+$/;
+/** Shared validation for boot config and owner POST; labels are plain text, never handles or authority. */
+export function parseSeatNames(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length > 1024)
+        return undefined;
+    const entries = Object.entries(value);
+    if (entries.some(([id, name]) => !/^session-[a-zA-Z0-9-]{8,128}$/.test(id) || typeof name !== 'string' || name.trim() === '' || [...name.trim()].length > 64 || /[\p{Cc}\p{Cf}\u2028\u2029\ufffd]/u.test(name) || !/[^\p{Z}\p{C}\p{M}]/u.test(name) || ADDRESS_SHAPED.test(name.trim())))
+        return undefined;
+    return Object.fromEntries(entries.map(([id, name]) => [id, name.trim()]));
+}
+/** Boot config degrades entry-by-entry; owner POST remains all-or-nothing. Never echo label contents in warnings. */
+export function loadSeatNames(value, warn) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        warn('seatNames: ignored invalid map');
+        return {};
+    }
+    const kept = {};
+    let count = 0;
+    for (const [id, name] of Object.entries(value)) {
+        const entry = parseSeatNames({ [id]: name });
+        if (entry === undefined || count >= 1024) {
+            warn('seatNames: ignored invalid or over-cap entry');
+            continue;
+        }
+        Object.assign(kept, entry);
+        count += 1;
+    }
+    return kept;
+}
 /** The exact keys this module may touch, in wire order. */
-const KEYS = ['teamJoinAllowlist', 'teamScopeInfo', 'announce'];
+const KEYS = ['teamJoinAllowlist', 'teamScopeInfo', 'announce', 'seatNames'];
 export function applyOwnerSettings(patchYaml, changes) {
     const lines = patchYaml.split('\n');
     // Find the a2a entry: `- id: a2a` / `- id: 'a2a'` variants.
@@ -34,6 +65,8 @@ export function applyOwnerSettings(patchYaml, changes) {
         writes.push(`    teamScopeInfo: ${changes.teamScopeInfo ? 'true' : 'false'}`);
     if (changes.announce !== undefined)
         writes.push(`    announce: ${changes.announce ? 'true' : 'false'}`);
+    if (changes.seatNames !== undefined)
+        writes.push(`    seatNames: ${JSON.stringify(changes.seatNames)}`);
     if (writes.length === 0)
         return { yaml: patchYaml, restartNeeded };
     if (entryStart === -1) {
@@ -81,6 +114,10 @@ export function applyOwnerSettings(patchYaml, changes) {
                 if (write !== undefined) {
                     lines[j] = write;
                     found = true;
+                    // A map may have been authored as block YAML. Replace its nested rows too, not just the heading.
+                    if (key === 'seatNames')
+                        while (j + 1 < lines.length && (/^ {5,}\S/.test(lines[j + 1] ?? '') || /^\s*$/.test(lines[j + 1] ?? '')))
+                            lines.splice(j + 1, 1);
                 }
                 break;
             }

package/lib/peer-link-display.js

@@ -0,0 +1,15 @@
+export function peerLinkDisplay(peerUrl, d) {
+    const { card } = d;
+    if (card === undefined)
+        return { link: 'stranger', verified: false };
+    const origin = (url) => { try {
+        return new URL(url).origin;
+    }
+    catch {
+        return '';
+    } };
+    const peerOrigin = origin(peerUrl), ownOrigin = origin(d.ownUrl);
+    const bilateral = peerOrigin !== '' && ownOrigin !== '' && d.seeds.some(url => origin(url) === peerOrigin) && (card.peers ?? []).some(url => origin(url) === ownOrigin);
+    const exactMember = d.refs.some(ref => !d.ownHandles.has(ref) && (card.sessionTeams ?? []).some(row => row.team === ref) && !d.cards.some(other => other.publicKey !== card.publicKey && (other.sessionTeams ?? []).some(row => row.team === ref)));
+    return { link: bilateral || exactMember ? 'linked' : 'stranger', verified: true };
+}

package/lib/queue-guard.js

@@ -1,9 +1,9 @@
 import { parseReceipt } from "./receipt.js";
 export const WIRE_ERROR_QUEUE_FULL = -32009;
 export const DEFAULT_TARGET_QUEUE_CAP = 3;
-/** How many receipt-owing tasks this host holds pending for `team`. */
+/** How many receipt-owing tasks this host holds pending and unanswered for `team`. */
 export function queuedFor(rows, team) {
-    return rows.filter(row => row.status === 'pending' && row.receiptExpected !== false &&
+    return rows.filter(row => row.status === 'pending' && row.receiptExpected !== false && row.answeredAt === undefined &&
         (row.direction === 'inbound' || row.peer === 'local') &&
         (row.team === team || row.deliveredTo === team)).length;
 }
@@ -19,7 +19,7 @@ export function queueFullRefusal(rows, team, message, cap, mailbox, ownTask) {
     const queued = queuedFor(rows, team);
     if (queued < limit)
         return undefined;
-    return `target-queue-full (gh#224): "${team}" already has ${String(queued)} task(s) waiting for a receipt (cap ${String(limit)}) — nothing was delivered. Wait for a receipt from it (a2a inbox / a2a_tasks), or send again later with a NEW task id (this one is recorded as failed); do not resend in a loop. A task that never gets a receipt turns dead after taskStaleTtlMs and stops counting.`;
+    return `target-queue-full (gh#224): "${team}" already has ${String(queued)} task(s) not yet answered by the target (cap ${String(limit)}) — nothing was delivered. Wait for a receipt from it (a2a inbox / a2a_tasks), or send again later with a NEW task id (this one is recorded as failed); do not resend in a loop. A task that never gets a receipt turns dead after taskStaleTtlMs and stops counting.`;
 }
 /** Wire-face adapter in the flood guard's shape: a refused fresh key is FAILED, not stranded pending. */
 export function createQueueGuard(rows, cap, ownTask, outcomes, recordActivity) {

package/lib/skill/references/cli.md

@@ -42,6 +42,10 @@ model tools.
   405 with an empty body. The fix is a host upgrade, not a retry.
 - `a2a-net revoke` deregisters early.
 
+## Team display names
+
+`a2a-net teams <query>` searches the owner-set seat label as well as the route handle; `--json` exposes the effective display name. Local rows prefer `seatName`, then the current title (`name`), then the legacy label. Only the human workbench owner panel/config can set `seatNames`; the CLI has no naming command.
+
 ## Tasks: ledger and host observability
 
 `a2a-net tasks --json` returns the existing `pending`, `dead`, and `archived` arrays plus `settlement` and `conservation` copied unchanged from `/__dsh_a2a/state`. These blocks include the lifetime `settlement.refusalsTotal`, refusal ring and mode, and the host conservation verdict/counters/duplicate ids. Older hosts omit a block they do not expose; the CLI does not manufacture zero counters or a passing verdict. Plain `tasks` appends a conservation line (`conserved`, `delta`) and a settlement line (`mode`, `refusalsTotal`, `offChain`) when the respective block exists.

package/lib/skill/references/routing.md

@@ -40,6 +40,10 @@ polling `a2a_teams` cannot see another host's ledger.
   when known. `archivedCount` and `archivedSplit` (count per outcome) cover
   the whole archive.
 
+## Queue capacity is not receipt debt
+
+A pending row with `answeredAt` records that its actual local target produced a task-attributed final or attempted its own formal receipt. It no longer occupies the `targetQueueCap` limit, even if the caller CLI expired and receipt delivery failed. It is **still pending receipt debt**: do not abandon it just to free capacity, or claim the sender received it. Dead-letter expiry, late receipts and lifetime conservation continue unchanged. State session `queued` and the board both use the same unanswered-row count; unfinished work still counts against the default cap of three. Unrelated agents, unrelated finals and host timeout placeholders cannot mark an answer.
+
 ## Idempotency
 
 A route carries a fingerprint (caller + message + team + wait-mode). Re-

package/lib/skill/references/setup.md

@@ -21,6 +21,10 @@ presenting the operator's gesture on the operator's behalf is exactly the
 | Version | `/__dsh_a2a/state` `version`, or the workbench header badge | the same version on every host you will link (0.6.28+) |
 | Clock | `date` on each host | NTP-synced: card signatures carry `expiresAt`, and the OriginClaim envelope allows ±5 min |
 
+## Human seat names
+
+The owner can open the workbench header ⚙, select a local session under “会话席位名”, and explicitly save a stable display name (up to 64 characters; a name shaped like a route address such as `dsh/66abc2cf` is refused so it cannot pass for another session). Empty input clears the label. The `seatNames` map is stored in the home patch layer and hot-applies; cards and the board prefer it over the session title, and `a2a_whoami` / `a2a-net teams <name>` expose it. It never changes the route handle, join state or admission. Agents must ask the owner rather than self-name: A2A tool arguments containing `seatName`/`seatNames` are refused; no naming model tool exists. The owner control API keeps its existing apiKey/loopback trust model, not a sandbox against local shell or config-file writers.
+
 ## 1. One host: sessions talking to each other
 
 **Owner:**

package/lib/task-ledger-rows.js

@@ -0,0 +1,192 @@
+/** Stateless ledger row types, classifiers and restore projections; moved verbatim for #258. */
+import { parseAuthorization } from "./task-auth.js";
+/**
+ * Caller-ended summaries (abandon / cancel) share one isolation law: late
+ * receipts never rewrite the verdict — they only stamp lateReceiptAt, and
+ * the projected outcome collapses to 'abandoned'.
+ */
+export const CALLER_ENDED_PREFIX = /^caller-(abandoned|cancelled)/;
+/** Hard cap on the owed book (pending + dead-lettered rows, most recent first). */
+export const TASK_CAP = 64;
+/** Hard cap on the settled archive (most recent kept). */
+export const ARCHIVE_CAP = 64;
+/** Longest receipt summary kept on a record (multi-line outcomes collapse). */
+export const SUMMARY_CAP = 200;
+/**
+ * Longest dispatch brief kept per row. A ledger row without its payload is
+ * unreadable to supervision — "direct-8f3a1c2b → dsh/ec4ce7f8, 3h old" says
+ * nothing about whether to nudge, abandon, or read the receipt. The brief is
+ * the first non-empty line of the message, capped; the full body never enters
+ * the ledger (it can be arbitrarily large and may quote another session's log).
+ */
+export const BRIEF_CAP = 120;
+/** Reduce a dispatch body to one readable line: first non-empty line, collapsed, capped. */
+export function briefOf(message) {
+    if (message === undefined)
+        return undefined;
+    for (const raw of message.split('\n')) {
+        const line = raw.trim().replace(/\s+/g, ' ');
+        if (line !== '')
+            return line.length <= BRIEF_CAP ? line : `${line.slice(0, BRIEF_CAP - 1)}…`;
+    }
+    return undefined;
+}
+/**
+ * Age at which an unsettled task auto-dead-letters. A dead row exits the
+ * owed view, disarms its async-nudge retry (a cold session cannot consume a
+ * re-steer anyway), and still accepts a late receipt from a revived target.
+ * Injectable per instance so tests can use short windows; sweeping stays
+ * lazy — every read/write entry point sweeps first.
+ */
+export const TASK_STALE_TTL_MS = 24 * 60 * 60_000;
+export const ARCHIVE_ENDS = ['receipt', 'echo', 'abandoned', 'cancelled', 'evicted'];
+/** Summary marker {@link TaskLedger.resolveEcho} writes on echo-settled rows. */
+export const ECHO_SUMMARY = '(settled by content echo)';
+const SENDER_KINDS = ['session', 'host', 'bridge', 'cli'];
+/** Longest sender id kept; anything longer is malformed, not truncated. */
+export const SENDER_ID_CAP = 256;
+/**
+ * Restore-side allowlist for one persisted sender: a well-formed value comes
+ * back as a fresh object holding only kind, id and (when present) face; anything else is dropped whole (the row
+ * itself survives — a bad sender never costs the debt record).
+ * @param raw - the persisted value.
+ * @returns the sender, or undefined when absent or malformed.
+ */
+export function parseSender(raw) {
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+        return undefined;
+    const { kind, id, face } = raw;
+    if (typeof kind !== 'string' || !SENDER_KINDS.includes(kind))
+        return undefined;
+    if (typeof id !== 'string' || id === '' || id.length > SENDER_ID_CAP)
+        return undefined;
+    if (face !== undefined && (typeof face !== 'string' || face === '' || face.length > SENDER_ID_CAP))
+        return undefined;
+    // `face` belongs to host senders only; on any other kind it is dropped, the sender kept.
+    return { kind: kind, id, ...(face !== undefined && kind === 'host' ? { face } : {}) };
+}
+/**
+ * Spread helper for restore: `{ sender }` when the persisted value parses and
+ * the row is not inbound (an inbound row's originator is its caller, never a
+ * sender this host recorded), else nothing.
+ */
+export function withSender(raw, direction) {
+    if (direction === 'inbound')
+        return {};
+    const sender = parseSender(raw);
+    return sender === undefined ? {} : { sender };
+}
+/**
+ * #114 S2: `{ auth }` when a persisted INBOUND row carries a record that
+ * parses whole (parseAuthorization) and belongs to THIS row — its target is
+ * the row's team and its receipt target the row's peer — else nothing: the
+ * row survives as a pre-S2 row, never with a partially adopted or borrowed
+ * record.
+ */
+export function withAuth(raw, entry, now) {
+    if (entry.direction !== 'inbound' && entry.direction !== 'outbound')
+        return {};
+    const auth = parseAuthorization(raw, now);
+    if (auth === undefined || auth.target !== entry.team)
+        return {};
+    if (entry.direction === 'inbound')
+        return auth.ingress === 'wire' && `local:${auth.receipt_target}` === entry.peer ? { auth } : {};
+    // #139: an outbound row carries only its local-candidate admission.
+    return auth.ingress === 'local' && entry.peer === 'local' ? { auth } : {};
+}
+/** Routing and answer facts copied unchanged between a row and its archive entry. */
+export function routingOf(row) {
+    return {
+        ...(row.answeredAt !== undefined ? { answeredAt: row.answeredAt } : {}),
+        ...(row.forwarded === true ? { forwarded: true } : {}),
+        ...(row.peerKey !== undefined ? { peerKey: row.peerKey } : {}),
+        ...(row.peerHost !== undefined ? { peerHost: row.peerHost } : {}),
+        ...(row.deliveredTo !== undefined ? { deliveredTo: row.deliveredTo } : {}),
+    };
+}
+/** The facts of one outbound birth that fit the row (see {@link withRouting} for the same shape on restore). */
+export function birthFacts(peer, birth) {
+    if (birth === undefined)
+        return {};
+    const fact = (v) => v !== undefined && v !== '' && v.length <= ROUTING_FACT_CAP;
+    const remote = peer !== 'local' && !peer.startsWith('local:');
+    return {
+        ...(!remote && birth.auth !== undefined && birth.auth.ingress === 'local' ? { auth: birth.auth } : {}),
+        ...(remote && birth.forwarded === true ? { forwarded: true } : {}),
+        ...(remote && fact(birth.peerKey) ? { peerKey: birth.peerKey } : {}),
+        ...(remote && fact(birth.peerHost) ? { peerHost: birth.peerHost } : {}),
+        ...(fact(birth.deliveredTo) ? { deliveredTo: birth.deliveredTo } : {}),
+    };
+}
+/** Bound on a persisted routing fact; anything longer (or empty, or not a string) is dropped on restore. */
+export const ROUTING_FACT_CAP = 256;
+/**
+ * #139: restore-side allowlist for the routing facts. Each is kept only in
+ * its shape — a non-empty string within the cap — and the peer facts only on
+ * a remote outbound row; anything else is dropped (the row survives as one
+ * born before the fields, judged by current membership and origin).
+ */
+export function withRouting(entry) {
+    const fact = (v) => typeof v === 'string' && v !== '' && v.length <= ROUTING_FACT_CAP;
+    const remoteOutbound = entry.direction === 'outbound' && typeof entry.peer === 'string' && entry.peer !== 'local' && !entry.peer.startsWith('local:');
+    return {
+        ...(typeof entry.answeredAt === 'number' && Number.isFinite(entry.answeredAt) && entry.answeredAt >= 0 ? { answeredAt: entry.answeredAt } : {}),
+        ...(remoteOutbound && entry.forwarded === true ? { forwarded: true } : {}),
+        ...(remoteOutbound && fact(entry.peerKey) ? { peerKey: entry.peerKey } : {}),
+        ...(remoteOutbound && fact(entry.peerHost) ? { peerHost: entry.peerHost } : {}),
+        ...(fact(entry.deliveredTo) ? { deliveredTo: entry.deliveredTo } : {}),
+    };
+}
+/**
+ * How one archived row ended (gh#31). The recorded field wins; legacy rows
+ * fall back to the summary markers this ledger writes itself. The fallback
+ * reads a receipt-settled row's summary, which is the peer's text, so it is
+ * only as exact as the legacy data allows.
+ * @param row - the archived record.
+ * @returns the archive path that ended it.
+ */
+export function archivedEndedBy(row) {
+    if (row.endedBy !== undefined)
+        return row.endedBy;
+    const summary = row.summary ?? '';
+    if (summary.startsWith('caller-cancelled'))
+        return 'cancelled';
+    if (summary.startsWith('caller-abandoned'))
+        return 'abandoned';
+    if (summary === ECHO_SUMMARY)
+        return 'echo';
+    return 'receipt';
+}
+/** Bound on ids and callers kept in settlement records; longer values are cut on write and refused on restore. */
+export const SETTLEMENT_ID_CAP = 256;
+/** Bound of the refusal ring (design §4.4). */
+export const SETTLEMENT_REFUSAL_CAP = 64;
+const SETTLEMENT_REASONS = ['settler-off-chain', 'settler-unverified', 'on-behalf-mismatch', 'echo-off-chain'];
+const CHAIN_ROLES = ['target', 'target-member', 'host-face', 'compat', 'legacy', 'off-chain'];
+const PROOF_VALUES = ['origin-claim', 'claim-mismatch', 'legacy-window', 'unbound', 'cli-identity', 'in-process', 'none'];
+/** Restore-side allowlist for settledBy: whole or nothing. */
+export function withSettledBy(raw) {
+    if (raw === null || typeof raw !== 'object')
+        return {};
+    const r = raw;
+    if (typeof r.caller !== 'string' || r.caller.length > SETTLEMENT_ID_CAP || typeof r.chain_role !== 'string' || !CHAIN_ROLES.includes(r.chain_role))
+        return {};
+    return { settledBy: { caller: r.caller, chain_role: r.chain_role } };
+}
+/** Restore-side allowlist for one refusal record: whole or nothing. */
+export function parseRefusal(raw) {
+    if (raw === null || typeof raw !== 'object')
+        return undefined;
+    const r = raw;
+    const st = r.settler;
+    if (typeof r.taskId !== 'string' || r.taskId === '' || r.taskId.length > SETTLEMENT_ID_CAP || typeof r.at !== 'number' || !Number.isFinite(r.at))
+        return undefined;
+    if (typeof r.reason !== 'string' || !SETTLEMENT_REASONS.includes(r.reason) || typeof r.head !== 'string' || typeof r.enforced !== 'boolean')
+        return undefined;
+    if (st === null || typeof st !== 'object' || typeof st.caller !== 'string' || st.caller.length > SETTLEMENT_ID_CAP || typeof st.proof !== 'string' || !PROOF_VALUES.includes(st.proof) || (st.ingress !== 'wire' && st.ingress !== 'local'))
+        return undefined;
+    const count = r.count === undefined ? 1 : r.count;
+    if (typeof count !== 'number' || !Number.isInteger(count) || count < 1)
+        return undefined;
+    return { taskId: r.taskId, at: r.at, settler: { caller: st.caller, proof: st.proof, ingress: st.ingress }, reason: r.reason, head: r.head.slice(0, SUMMARY_CAP), enforced: r.enforced, count };
+}

package/lib/task-ledger.js

@@ -18,199 +18,12 @@
  * illusion: settlements vanished while debts piled up).
  * @module @nelsonlongxiang/dsh-open-a2a-net/task-ledger
  */
-import { parseAuthorization } from "./task-auth.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { parseReceipt, RECEIPT_OUTCOMES } from "./receipt.js";
 import { classifyConservationBlock, ConservationCounters } from "./ledger-conservation.js";
-/**
- * Caller-ended summaries (abandon / cancel) share one isolation law: late
- * receipts never rewrite the verdict — they only stamp lateReceiptAt, and
- * the projected outcome collapses to 'abandoned'.
- */
-const CALLER_ENDED_PREFIX = /^caller-(abandoned|cancelled)/;
-/** Hard cap on the owed book (pending + dead-lettered rows, most recent first). */
-export const TASK_CAP = 64;
-/** Hard cap on the settled archive (most recent kept). */
-export const ARCHIVE_CAP = 64;
-/** Longest receipt summary kept on a record (multi-line outcomes collapse). */
-export const SUMMARY_CAP = 200;
-/**
- * Longest dispatch brief kept per row. A ledger row without its payload is
- * unreadable to supervision — "direct-8f3a1c2b → dsh/ec4ce7f8, 3h old" says
- * nothing about whether to nudge, abandon, or read the receipt. The brief is
- * the first non-empty line of the message, capped; the full body never enters
- * the ledger (it can be arbitrarily large and may quote another session's log).
- */
-export const BRIEF_CAP = 120;
-/** Reduce a dispatch body to one readable line: first non-empty line, collapsed, capped. */
-export function briefOf(message) {
-    if (message === undefined)
-        return undefined;
-    for (const raw of message.split('\n')) {
-        const line = raw.trim().replace(/\s+/g, ' ');
-        if (line !== '')
-            return line.length <= BRIEF_CAP ? line : `${line.slice(0, BRIEF_CAP - 1)}…`;
-    }
-    return undefined;
-}
-/**
- * Age at which an unsettled task auto-dead-letters. A dead row exits the
- * owed view, disarms its async-nudge retry (a cold session cannot consume a
- * re-steer anyway), and still accepts a late receipt from a revived target.
- * Injectable per instance so tests can use short windows; sweeping stays
- * lazy — every read/write entry point sweeps first.
- */
-export const TASK_STALE_TTL_MS = 24 * 60 * 60_000;
-const ARCHIVE_ENDS = ['receipt', 'echo', 'abandoned', 'cancelled', 'evicted'];
-/** Summary marker {@link TaskLedger.resolveEcho} writes on echo-settled rows. */
-const ECHO_SUMMARY = '(settled by content echo)';
-const SENDER_KINDS = ['session', 'host', 'bridge', 'cli'];
-/** Longest sender id kept; anything longer is malformed, not truncated. */
-export const SENDER_ID_CAP = 256;
-/**
- * Restore-side allowlist for one persisted sender: a well-formed value comes
- * back as a fresh object holding only kind, id and (when present) face; anything else is dropped whole (the row
- * itself survives — a bad sender never costs the debt record).
- * @param raw - the persisted value.
- * @returns the sender, or undefined when absent or malformed.
- */
-export function parseSender(raw) {
-    if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
-        return undefined;
-    const { kind, id, face } = raw;
-    if (typeof kind !== 'string' || !SENDER_KINDS.includes(kind))
-        return undefined;
-    if (typeof id !== 'string' || id === '' || id.length > SENDER_ID_CAP)
-        return undefined;
-    if (face !== undefined && (typeof face !== 'string' || face === '' || face.length > SENDER_ID_CAP))
-        return undefined;
-    // `face` belongs to host senders only; on any other kind it is dropped, the sender kept.
-    return { kind: kind, id, ...(face !== undefined && kind === 'host' ? { face } : {}) };
-}
-/**
- * Spread helper for restore: `{ sender }` when the persisted value parses and
- * the row is not inbound (an inbound row's originator is its caller, never a
- * sender this host recorded), else nothing.
- */
-function withSender(raw, direction) {
-    if (direction === 'inbound')
-        return {};
-    const sender = parseSender(raw);
-    return sender === undefined ? {} : { sender };
-}
-/**
- * #114 S2: `{ auth }` when a persisted INBOUND row carries a record that
- * parses whole (parseAuthorization) and belongs to THIS row — its target is
- * the row's team and its receipt target the row's peer — else nothing: the
- * row survives as a pre-S2 row, never with a partially adopted or borrowed
- * record.
- */
-function withAuth(raw, entry, now) {
-    if (entry.direction !== 'inbound' && entry.direction !== 'outbound')
-        return {};
-    const auth = parseAuthorization(raw, now);
-    if (auth === undefined || auth.target !== entry.team)
-        return {};
-    if (entry.direction === 'inbound')
-        return auth.ingress === 'wire' && `local:${auth.receipt_target}` === entry.peer ? { auth } : {};
-    // #139: an outbound row carries only its local-candidate admission.
-    return auth.ingress === 'local' && entry.peer === 'local' ? { auth } : {};
-}
-/** #139: the routing facts settlement reads, copied between a row and its archive entry. */
-function routingOf(row) {
-    return {
-        ...(row.forwarded === true ? { forwarded: true } : {}),
-        ...(row.peerKey !== undefined ? { peerKey: row.peerKey } : {}),
-        ...(row.peerHost !== undefined ? { peerHost: row.peerHost } : {}),
-        ...(row.deliveredTo !== undefined ? { deliveredTo: row.deliveredTo } : {}),
-    };
-}
-/** The facts of one outbound birth that fit the row (see {@link withRouting} for the same shape on restore). */
-function birthFacts(peer, birth) {
-    if (birth === undefined)
-        return {};
-    const fact = (v) => v !== undefined && v !== '' && v.length <= ROUTING_FACT_CAP;
-    const remote = peer !== 'local' && !peer.startsWith('local:');
-    return {
-        ...(!remote && birth.auth !== undefined && birth.auth.ingress === 'local' ? { auth: birth.auth } : {}),
-        ...(remote && birth.forwarded === true ? { forwarded: true } : {}),
-        ...(remote && fact(birth.peerKey) ? { peerKey: birth.peerKey } : {}),
-        ...(remote && fact(birth.peerHost) ? { peerHost: birth.peerHost } : {}),
-        ...(fact(birth.deliveredTo) ? { deliveredTo: birth.deliveredTo } : {}),
-    };
-}
-/** Bound on a persisted routing fact; anything longer (or empty, or not a string) is dropped on restore. */
-const ROUTING_FACT_CAP = 256;
-/**
- * #139: restore-side allowlist for the routing facts. Each is kept only in
- * its shape — a non-empty string within the cap — and the peer facts only on
- * a remote outbound row; anything else is dropped (the row survives as one
- * born before the fields, judged by current membership and origin).
- */
-function withRouting(entry) {
-    const fact = (v) => typeof v === 'string' && v !== '' && v.length <= ROUTING_FACT_CAP;
-    const remoteOutbound = entry.direction === 'outbound' && typeof entry.peer === 'string' && entry.peer !== 'local' && !entry.peer.startsWith('local:');
-    return {
-        ...(remoteOutbound && entry.forwarded === true ? { forwarded: true } : {}),
-        ...(remoteOutbound && fact(entry.peerKey) ? { peerKey: entry.peerKey } : {}),
-        ...(remoteOutbound && fact(entry.peerHost) ? { peerHost: entry.peerHost } : {}),
-        ...(fact(entry.deliveredTo) ? { deliveredTo: entry.deliveredTo } : {}),
-    };
-}
-/**
- * How one archived row ended (gh#31). The recorded field wins; legacy rows
- * fall back to the summary markers this ledger writes itself. The fallback
- * reads a receipt-settled row's summary, which is the peer's text, so it is
- * only as exact as the legacy data allows.
- * @param row - the archived record.
- * @returns the archive path that ended it.
- */
-export function archivedEndedBy(row) {
-    if (row.endedBy !== undefined)
-        return row.endedBy;
-    const summary = row.summary ?? '';
-    if (summary.startsWith('caller-cancelled'))
-        return 'cancelled';
-    if (summary.startsWith('caller-abandoned'))
-        return 'abandoned';
-    if (summary === ECHO_SUMMARY)
-        return 'echo';
-    return 'receipt';
-}
-/** Bound on ids and callers kept in settlement records; longer values are cut on write and refused on restore. */
-const SETTLEMENT_ID_CAP = 256;
-/** Bound of the refusal ring (design §4.4). */
-export const SETTLEMENT_REFUSAL_CAP = 64;
-const SETTLEMENT_REASONS = ['settler-off-chain', 'settler-unverified', 'on-behalf-mismatch', 'echo-off-chain'];
-const CHAIN_ROLES = ['target', 'target-member', 'host-face', 'compat', 'legacy', 'off-chain'];
-const PROOF_VALUES = ['origin-claim', 'claim-mismatch', 'legacy-window', 'unbound', 'cli-identity', 'in-process', 'none'];
-/** Restore-side allowlist for settledBy: whole or nothing. */
-function withSettledBy(raw) {
-    if (raw === null || typeof raw !== 'object')
-        return {};
-    const r = raw;
-    if (typeof r.caller !== 'string' || r.caller.length > SETTLEMENT_ID_CAP || typeof r.chain_role !== 'string' || !CHAIN_ROLES.includes(r.chain_role))
-        return {};
-    return { settledBy: { caller: r.caller, chain_role: r.chain_role } };
-}
-/** Restore-side allowlist for one refusal record: whole or nothing. */
-function parseRefusal(raw) {
-    if (raw === null || typeof raw !== 'object')
-        return undefined;
-    const r = raw;
-    const st = r.settler;
-    if (typeof r.taskId !== 'string' || r.taskId === '' || r.taskId.length > SETTLEMENT_ID_CAP || typeof r.at !== 'number' || !Number.isFinite(r.at))
-        return undefined;
-    if (typeof r.reason !== 'string' || !SETTLEMENT_REASONS.includes(r.reason) || typeof r.head !== 'string' || typeof r.enforced !== 'boolean')
-        return undefined;
-    if (st === null || typeof st !== 'object' || typeof st.caller !== 'string' || st.caller.length > SETTLEMENT_ID_CAP || typeof st.proof !== 'string' || !PROOF_VALUES.includes(st.proof) || (st.ingress !== 'wire' && st.ingress !== 'local'))
-        return undefined;
-    const count = r.count === undefined ? 1 : r.count;
-    if (typeof count !== 'number' || !Number.isInteger(count) || count < 1)
-        return undefined;
-    return { taskId: r.taskId, at: r.at, settler: { caller: st.caller, proof: st.proof, ingress: st.ingress }, reason: r.reason, head: r.head.slice(0, SUMMARY_CAP), enforced: r.enforced, count };
-}
+import { CALLER_ENDED_PREFIX, TASK_CAP, ARCHIVE_CAP, SUMMARY_CAP, TASK_STALE_TTL_MS, ARCHIVE_ENDS, ECHO_SUMMARY, ROUTING_FACT_CAP, SETTLEMENT_ID_CAP, SETTLEMENT_REFUSAL_CAP, withSender, withAuth, routingOf, birthFacts, withRouting, withSettledBy, parseRefusal, archivedEndedBy } from "./task-ledger-rows.js";
+export * from "./task-ledger-rows.js";
 /**
  * Bounded outbound-task ledger with whole-file persistence. Pure of any
  * routing knowledge: callers {@link track} a task when a route leaves it
@@ -369,6 +182,15 @@ export class TaskLedger {
         this.trimOwed();
         this.persist();
     }
+    /** Record an answer only from the local member that actually received this row; never settle or change counters. */
+    markAnswered(taskId, target) {
+        const row = this.tasks.find(entry => entry.taskId === taskId);
+        if (row === undefined || !(row.direction === 'inbound' || row.peer === 'local') || (row.deliveredTo ?? row.team) !== target || row.answeredAt !== undefined)
+            return false;
+        row.answeredAt = this.now();
+        this.persist();
+        return true;
+    }
     /**
      * v0.5.23 (async-stall): whether a tracked task still owes its receipt.
      * The async nudge consults this — a resolved or dead-lettered task

package/lib/tools/info.js

@@ -124,7 +124,7 @@ export function createInfoTools(deps) {
                         type: 'text',
                         text: value.face === 'host'
                             ? `Host face on team ${String(value.node?.team ?? '?')}: routing rides the bare node team (能发即能收)`
-                            : `Node ${String(value.node?.id ?? '?')}: joined=${String(value.node?.joined)}, live=${String(value.node?.live)}; roster teams: ${(value.teams?.roster ?? []).join(', ') || 'none'}; canvas: ${(value.teams?.canvas ?? []).join(', ') || 'none'}; allowlist effect: ${String(value.allowlist?.effect ?? '?')}`,
+                            : `Node ${String(value.node?.name ?? '')} ${String(value.node?.id ?? '?')}: joined=${String(value.node?.joined)}, live=${String(value.node?.live)}; roster teams: ${(value.teams?.roster ?? []).join(', ') || 'none'}; canvas: ${(value.teams?.canvas ?? []).join(', ') || 'none'}; allowlist effect: ${String(value.allowlist?.effect ?? '?')}`,
                     }],
             },
             presentCall: () => ({ card: 'generic', title: 'A2A whoami', kind: 'other', rawInput: null }),
@@ -151,6 +151,7 @@ export function createInfoTools(deps) {
                     face: 'session',
                     node: {
                         id: agentId,
+                        ...(exec.agent !== undefined ? { name: nodeMetadataOf(exec.agent).name, ...(nodeMetadataOf(exec.agent).seatName !== undefined ? { seatName: nodeMetadataOf(exec.agent).seatName } : {}) } : {}),
                         ...(joined ? { team: `${config.team}/${id8(agentId)}` } : {}),
                         joined,
                         live,
@@ -209,6 +210,7 @@ export function createInfoTools(deps) {
                                     team: { type: 'string', required: true },
                                     session: { type: 'string', required: true },
                                     name: { type: 'string', required: true },
+                                    seatName: { type: 'string', description: 'Human-owned stable display label, never a route identity.' },
                                     description: { type: 'string', required: true },
                                     local: { type: 'boolean', description: 'true when the team is served by this host (loopback candidate).' },
                                     origin: { type: 'string', description: 'The publishing host (node session label, LAN IP when known) — the natural grouping for fleet rows.' },
@@ -453,7 +455,7 @@ export function createInfoTools(deps) {
             description: 'Read-only three-tier ledger of routed A2A tasks: pending rows still owed a receipt, rows '
                 + 'auto-dead-lettered past the stale TTL, and the bounded archive of correlated '
                 + '`[A2A receipt] task <task_id>` outcomes. Use it to reconcile dispatched async work instead of '
-                + 're-routing to ask for progress.',
+                + 're-routing to ask for progress. answeredAt means the local target answered, not that the receipt arrived; that row stays owed but no longer occupies target queue capacity.',
             parameters: {},
             output: {
                 // gh#198: the host's own verdict on whether this result came from outside this host, persisted on tool/result.
@@ -478,6 +480,7 @@ export function createInfoTools(deps) {
                                     brief: { type: 'string' },
                                     status: { type: 'string', required: true },
                                     deadAt: { type: 'number' },
+                                    answeredAt: { type: 'number' },
                                     direction: { type: 'string', enum: ['inbound', 'outbound'] },
                                     receiptExpected: { type: 'boolean' },
                                     forwarded: { type: 'boolean' },
@@ -571,11 +574,12 @@ export function createInfoTools(deps) {
                     ok: true,
                     // Project the declared fields only: ledger rows also carry internal audit facts (the #114 auth record,
                     // #139 peerKey/peerHost) the output schema does not admit — spreading the row failed every call (0.6.32+).
-                    tasks: taskLedger.list().map(({ taskId, team, peer, startedAt, contextId, brief, status, deadAt, direction, receiptExpected, forwarded, deliveredTo, reason, sender }) => ({
+                    tasks: taskLedger.list().map(({ taskId, team, peer, startedAt, contextId, brief, status, deadAt, answeredAt, direction, receiptExpected, forwarded, deliveredTo, reason, sender }) => ({
                         taskId, team, peer, startedAt, status,
                         ...(contextId !== undefined ? { contextId } : {}),
                         ...(brief !== undefined ? { brief } : {}),
                         ...(deadAt !== undefined ? { deadAt } : {}),
+                        ...(answeredAt !== undefined ? { answeredAt } : {}),
                         ...(direction !== undefined ? { direction } : {}),
                         ...(receiptExpected !== undefined ? { receiptExpected } : {}),
                         ...(forwarded !== undefined ? { forwarded } : {}),

package/lib/types/a2a-client.d.ts

@@ -45,6 +45,7 @@ export interface A2aClientOptions {
     readonly originClaim?: (target: {
         readonly url: string;
         readonly method: string;
+        readonly body?: string;
     }) => Record<string, string>;
     /** Delayed-callback seam (HTTP timeouts). */
     readonly schedule: A2aSchedule;

package/lib/types/faces/admin.d.ts

@@ -141,6 +141,7 @@ export interface AdminFaceDeps extends Pick<CanvasNotifyDeps, 'verifyOriginClaim
     readonly unboundInboundCount: number;
     readonly boundMissInboundCount: number;
     readonly ownCardUrl: string;
+    ownerSeatNames: Record<string, string>;
     ownerAllowlist: string[];
     ownerTeamScopeInfo: boolean;
     ownerAnnounceRestartPending: boolean;

package/lib/types/faces/canvas-notify.d.ts

@@ -44,7 +44,9 @@ export interface CanvasNotifyDeps {
     readonly canvasStore: CanvasStore;
     readonly cardCache: Map<string, CardCacheEntry>;
     readonly originClaimHeaders: (target: OriginClaimTarget) => Record<string, string>;
-    readonly verifyOriginClaim: (req: IncomingMessage) => Promise<{
+    readonly verifyOriginClaim: (req: IncomingMessage, options?: {
+        readonly rawBody?: Uint8Array;
+    }) => Promise<{
         ok: true;
         caller: string;
         callerUrl: string;

package/lib/types/faces/wire.d.ts

@@ -128,6 +128,7 @@ export interface WireDeps {
     readonly idempotencyStore: IdempotencyStore;
     readonly verifyOriginClaim: (req: IncomingMessage, options?: {
         readonly cli?: boolean;
+        readonly rawBody?: Uint8Array;
     }) => Promise<OriginClaimResult>;
     readonly forwardDirect: (request: ForwardRequest) => Promise<A2aRouteResult>;
     readonly remoteCliProof: (handle: string, claim: Extract<OriginClaimResult, {