@nelsonlongxiang/dsh-open-a2a-net 0.6.35 → 0.6.37

package/lib/types/task-ledger.d.ts

@@ -18,290 +18,10 @@
  * illusion: settlements vanished while debts piled up).
  * @module @nelsonlongxiang/dsh-open-a2a-net/task-ledger
  */
-import { type AuthProof, type ChainRole, type SettlementReason, type SettlementVerdict, type TaskAuthorization } from './task-auth.ts';
-import { type ReceiptOutcomeV2 } from './receipt.ts';
-import { type ConservationSnapshot, type ConservationVerdict } from './ledger-conservation.ts';
-/** Hard cap on the owed book (pending + dead-lettered rows, most recent first). */
-export declare const TASK_CAP = 64;
-/** Hard cap on the settled archive (most recent kept). */
-export declare const ARCHIVE_CAP = 64;
-/** Longest receipt summary kept on a record (multi-line outcomes collapse). */
-export declare const SUMMARY_CAP = 200;
-/**
- * Longest dispatch brief kept per row. A ledger row without its payload is
- * unreadable to supervision — "direct-8f3a1c2b → dsh/ec4ce7f8, 3h old" says
- * nothing about whether to nudge, abandon, or read the receipt. The brief is
- * the first non-empty line of the message, capped; the full body never enters
- * the ledger (it can be arbitrarily large and may quote another session's log).
- */
-export declare const BRIEF_CAP = 120;
-/** Reduce a dispatch body to one readable line: first non-empty line, collapsed, capped. */
-export declare function briefOf(message: string | undefined): string | undefined;
-/**
- * Age at which an unsettled task auto-dead-letters. A dead row exits the
- * owed view, disarms its async-nudge retry (a cold session cannot consume a
- * re-steer anyway), and still accepts a late receipt from a revived target.
- * Injectable per instance so tests can use short windows; sweeping stays
- * lazy — every read/write entry point sweeps first.
- */
-export declare const TASK_STALE_TTL_MS: number;
-/**
- * The receipt correlation template now lives in `receipt.ts` (shared codec
- * for header + v2 envelope line). This ledger consumes `parseReceipt` so
- * human summaries and machine projections can never drift apart again.
- */
-/** Lifecycle of a tracked outbound task inside the owed book. */
-export type TaskStatus = 'pending' | 'dead';
-/** F5 layer-3: why a dead row aged out (stamped by the sweep at flip time). */
-export type DeadReason = 'fire-forget' | 'unconsumed';
-/** gh#31: which archive path ended a row — a receipt, a content echo, or the caller. */
-export type ArchiveEnd = 'receipt' | 'echo' | 'abandoned' | 'cancelled' | 'evicted';
-/**
- * #114 S3: who really sent one outbound task — the routing session, the
- * agent-less host face, or a native-teams bridge submitter. Before this
- * field every outbound row was attributable only to the host ("home"), so
- * same-host seats could not be told apart.
- */
-export interface Sender {
-    readonly kind: 'session' | 'host' | 'bridge' | 'cli';
-    /**
-     * A session's `<zone>/<id8>` node team, the host process label, or the
-     * bridge submitter. Group senders by `kind:id`, never by `id` alone: a host
-     * label set by hand may look like a session handle.
-     */
-    readonly id: string;
-    /**
-     * Host senders only: the label the call borrowed on the wire when it
-     * differs from {@link id} (quick dispatch rides a live joined session's
-     * team). Display context, never a bucket key.
-     */
-    readonly face?: string;
-}
-/** Longest sender id kept; anything longer is malformed, not truncated. */
-export declare const SENDER_ID_CAP = 256;
-/**
- * Restore-side allowlist for one persisted sender: a well-formed value comes
- * back as a fresh object holding only kind, id and (when present) face; anything else is dropped whole (the row
- * itself survives — a bad sender never costs the debt record).
- * @param raw - the persisted value.
- * @returns the sender, or undefined when absent or malformed.
- */
-export declare function parseSender(raw: unknown): Sender | undefined;
-/** #139: what an outbound row is born with besides its sender. */
-export interface OutboundBirth {
-    readonly forwarded?: true;
-    /** The local-candidate admission (ingress local); kept only on a row whose peer is 'local'. */
-    readonly auth?: TaskAuthorization;
-    readonly peerKey?: string;
-    readonly peerHost?: string;
-    readonly deliveredTo?: string;
-}
-/** One tracked outbound task still in the owed book (unsettled). */
-export interface TaskRecord {
-    readonly taskId: string;
-    readonly team: string;
-    readonly peer: string;
-    readonly startedAt: number;
-    /**
-     * Which side of the wire this row serves: 'outbound' (this node sent and
-     * awaits a receipt) or 'inbound' (this node received and owes one).
-     * Absent on rows persisted before F2' — those are outbound by birth.
-     */
-    readonly direction?: 'inbound' | 'outbound';
-    /**
-     * F5: whether a receipt is actually owed. Absent ⇒ true (back-compat).
-     * `false` marks fire-and-forget deliveries — the caller's label could not
-     * receive a receipt at dispatch (process-form label), so no debt was born
-     * and supervision must not chase this row.
-     */
-    readonly receiptExpected?: boolean;
-    /** The conversation the delivery steered, for follow-up routes. */
-    readonly contextId?: string;
-    /**
-     * Head of the dispatched message (first non-empty line, {@link BRIEF_CAP}).
-     * What the row is ABOUT — the fact that makes the ledger readable without
-     * replaying the conversation. Absent on rows persisted before this field.
-     */
-    readonly brief?: string;
-    /** #114 S3: the real sender of an outbound row (absent on inbound rows and rows persisted before the field). */
-    readonly sender?: Sender;
-    /** Home host forwarded an online CLI request to a peer. */
-    readonly forwarded?: true;
-    /**
-     * #114 S2: the immutable authorization the row was born with — an inbound
-     * row's wire admission, or (#139) an outbound row's local-candidate
-     * admission (`ingress: 'local'`). Absent on remote outbound and older rows.
-     */
-    readonly auth?: TaskAuthorization;
-    /** #139: the public key of the peer card a remote outbound row was dispatched to. */
-    readonly peerKey?: string;
-    /** #139: that card's session label (the peer host's process label). */
-    readonly peerHost?: string;
-    /** #139: the member that actually received the task (canvas / bare-zone deliveries). */
-    readonly deliveredTo?: string;
-    status: TaskStatus;
-    /** When the row was swept to dead-letter (absent while pending). */
-    deadAt?: number;
-    /**
-     * F5 layer-3: why the row aged out. 'fire-forget' — a receiptExpected:false
-     * row expiring is expected bookkeeping, not a failure; 'unconsumed' — a
-     * receipt-owed row never settled, the actionable stale shape. Absent on
-     * dead rows persisted before this field (rendered as 'unspecified').
-     */
-    reason?: DeadReason;
-}
-/** One settled task kept for audit, with its receipt-correlated outcome. */
-export interface ArchivedRecord {
-    readonly taskId: string;
-    readonly team: string;
-    readonly peer: string;
-    readonly startedAt: number;
-    readonly contextId?: string;
-    readonly resolvedAt: number;
-    readonly summary?: string;
-    /** Head of the dispatched message that this row settled (see {@link TaskRecord.brief}). */
-    readonly brief?: string;
-    /** Controlled vocabulary verdict when the settling receipt carried a v2 envelope; forced 'abandoned' for caller-abandoned rows. */
-    readonly outcome?: ReceiptOutcomeV2 | 'abandoned';
-    /** Remote-turn wall-clock cost, when the settling envelope carried it. */
-    readonly elapsedMs?: number;
-    /**
-     * When a receipt arrived for an explicitly abandoned row ({@link TaskLedger.abandon}).
-     * Orphan isolation: the abandonment outcome stays verbatim; the late answer is
-     * recorded as metadata only, never promoted to resolution.
-     */
-    readonly lateReceiptAt?: number;
-    /**
-     * gh#31: which archive path ended the row, recorded at archive time. Absent
-     * on rows archived before the field — {@link archivedEndedBy} derives it.
-     */
-    readonly endedBy?: ArchiveEnd;
-    /** gh#31: which side of the wire the row served, copied from the owed row (absent on rows archived before the field). */
-    readonly direction?: 'inbound' | 'outbound';
-    /**
-     * gh#68: copied from the owed row when it awaited no receipt, so a tidied
-     * fire-forget expiry is not read as a send we gave up on. Only `false` is
-     * ever stored; absent means a receipt was owed (or the row predates the field).
-     */
-    readonly receiptExpected?: false;
-    /** #114 S3: copied from the owed row (absent on inbound rows and rows archived before the field). */
-    readonly sender?: Sender;
-    /** Home host forwarded an online CLI request to a peer. */
-    readonly forwarded?: true;
-    /** #114 S2: carried over from the live row unchanged. */
-    readonly auth?: TaskAuthorization;
-    /** #139: carried over from the live row unchanged (a late receipt is judged against them). */
-    readonly peerKey?: string;
-    readonly peerHost?: string;
-    readonly deliveredTo?: string;
-    /** #114 S4: who settled the row (receipt and echo ends), and their chain role. */
-    readonly settledBy?: SettledBy;
-}
-/**
- * How one archived row ended (gh#31). The recorded field wins; legacy rows
- * fall back to the summary markers this ledger writes itself. The fallback
- * reads a receipt-settled row's summary, which is the peer's text, so it is
- * only as exact as the legacy data allows.
- * @param row - the archived record.
- * @returns the archive path that ended it.
- */
-export declare function archivedEndedBy(row: ArchivedRecord): ArchiveEnd;
-/** Result of an explicit caller-side abandon. Total and never-thrown. */
-export type AbandonOutcome = 'cleared' | 'already-terminal' | 'unknown';
-/** Structured verdict for one {@link TaskLedger.abandon} call (consumer contract: idempotent). */
-export interface AbandonResult {
-    readonly outcome: AbandonOutcome;
-    readonly taskId: string;
-    /** Settle time: fresh abandonment's clock tick, or the already-settled row's original resolvedAt. */
-    readonly archivedAt?: number;
-}
-/** Result of a cooperative {@link TaskLedger.cancel}; adds routing facts for the notify half. */
-export interface CancelledResult extends AbandonResult {
-    /** Team the ended row addressed — the route layer reaches a live local target through it. */
-    readonly team?: string;
-    readonly contextId?: string;
-}
-/** Per-instance knobs; defaults come from the exported constants. */
-export interface TaskLedgerOptions {
-    /** Stale-TTL override (tests inject short windows); defaults to {@link TASK_STALE_TTL_MS}. */
-    staleTtlMs?: number;
-    /** Archive capacity override; defaults to {@link ARCHIVE_CAP}. */
-    archiveCap?: number;
-    /**
-     * Clock injection for tests: every sweep/TTL decision reads the time from
-     * here. Defaults to Date.now. Injecting a steppable clock makes the stale
-     * transition deterministic - no real sleeps to race under load.
-     */
-    now?: () => number;
-}
-/**
- * What one correlated receipt settled — the payload of the
- * `a2a/receipt-resolved` event, emitted for consumers that react to receipt
- * arrivals (P2: native-teams settles its outstanding async submissions from
- * this seam). `outcome` carries the v2 envelope's controlled-vocabulary
- * verdict when the receipt rode one; `late` marks a receipt answering a
- * dead-lettered row (revival) or an abandoned row (arrival recorded) — a
- * healthy row's duplicate receipt refreshes the archive with NO marker.
- */
-export interface ReceiptResolvedInfo {
-    readonly taskId: string;
-    /** The team the task was routed to (as the dispatcher recorded it). */
-    readonly team: string;
-    /** The peer (or `'local'`) the task was dispatched through. */
-    readonly peer: string;
-    /** v2 envelope outcome, when the receipt rode one. */
-    readonly outcome?: string;
-    /** One-line outcome summary, when the receipt carried one. */
-    readonly summary?: string;
-    /** True when the receipt answered a dead-lettered or abandoned row. */
-    readonly late?: boolean;
-}
-/** The persisted ledger document: the owed book plus its settled archive. */
-export interface TaskLedgerSnapshot {
-    readonly tasks: readonly TaskRecord[];
-    readonly archived?: readonly ArchivedRecord[];
-    /** #114 S4: the bounded ring of refused / would-be-refused settlements. */
-    readonly settlementRefusals?: readonly SettlementRefusalRecord[];
-    /** #114 S4: monotonic count of every refusal noted. */
-    readonly settlementRefusalsTotal?: number;
-    /** gh#154: lifetime conservation counters (persisted; absent = pre-#154 legacy) — the module contract, shared by classifier, counters, and this schema (review P3). */
-    readonly conservation?: ConservationSnapshot;
-}
-/** #114 S4: who settled an archived row, and how they stood on its authorization chain. */
-export interface SettledBy {
-    readonly caller: string;
-    readonly chain_role: ChainRole | 'off-chain';
-}
-/** #114 S4: one settlement the judgement refused (enforce) or would have refused (observe). */
-export interface SettlementRefusalRecord {
-    readonly taskId: string;
-    readonly at: number;
-    readonly settler: {
-        readonly caller: string;
-        readonly proof: AuthProof;
-        readonly ingress: 'wire' | 'local';
-    };
-    readonly reason: SettlementReason;
-    /** The receipt's first line, bounded. */
-    readonly head: string;
-    /** true: the settlement was refused (enforce); false: recorded only (observe). */
-    readonly enforced: boolean;
-    /** Repeats of the same (task, settler, reason) folded into this entry, so a flood cannot push older evidence out (review of PR #140 P2-4). */
-    readonly count: number;
-}
-/** Bound of the refusal ring (design §4.4). */
-export declare const SETTLEMENT_REFUSAL_CAP = 64;
-/**
- * #114 S4: how the ledger asks whether a settler may settle a row. `check`
- * is the pure judgement (task-auth.ts judgeSettlement) bound to this
- * receipt's facts; `enforce` decides whether an off-chain verdict blocks
- * the settlement or is only recorded.
- */
-export interface SettlementJudge {
-    readonly enforce: boolean;
-    readonly settler: SettlementRefusalRecord['settler'];
-    check(row: Pick<TaskRecord, 'team' | 'peer' | 'direction' | 'auth' | 'peerKey' | 'peerHost' | 'deliveredTo'>, echo: boolean): SettlementVerdict;
-}
+import type { TaskAuthorization } from './task-auth.ts';
+import { type ConservationVerdict } from './ledger-conservation.ts';
+import type { TaskRecord, ArchivedRecord, Sender, OutboundBirth, TaskLedgerOptions, ReceiptResolvedInfo, SettlementRefusalRecord, SettlementJudge, AbandonResult, CancelledResult } from './task-ledger-rows.ts';
+export * from './task-ledger-rows.ts';
 /**
  * Bounded outbound-task ledger with whole-file persistence. Pure of any
  * routing knowledge: callers {@link track} a task when a route leaves it
@@ -377,6 +97,8 @@ export declare class TaskLedger {
      * @param contextId - the delivery's conversation id, kept for follow-up routes (empty omits it).
      */
     trackInbound(taskId: string, team: string, from: string, contextId?: string, receiptExpected?: boolean, brief?: string, auth?: TaskAuthorization, deliveredTo?: string): void;
+    /** Record an answer only from the local member that actually received this row; never settle or change counters. */
+    markAnswered(taskId: string, target: string): boolean;
     /**
      * v0.5.23 (async-stall): whether a tracked task still owes its receipt.
      * The async nudge consults this — a resolved or dead-lettered task

package/lib/types/tools/info.d.ts

@@ -17,6 +17,7 @@ export type DirectoryTeamRow = {
     team: string;
     session: string;
     name: string;
+    seatName?: string;
     description: string;
     local?: boolean;
     origin?: string;
@@ -67,6 +68,7 @@ export interface InfoToolsDeps {
     readonly sessionTeamOf: (agent: Agent) => string;
     readonly nodeMetadataOf: (agent: Agent) => {
         name: string;
+        seatName?: string;
         description: string;
         workspace?: string;
     };

package/lib/types/types.d.ts

@@ -72,8 +72,9 @@ export interface A2aPeerCard {
 export interface A2aSessionTeamInfo {
     /** Session team name (`<team>/<agentId8>`); the route target. */
     readonly team: string;
-    /** The session's title at read time. */
+    /** Human seatName when configured, otherwise the session title at read time. */
     readonly name: string;
+    readonly seatName?: string;
     /** One-line excerpt of the session's newest user or assistant text. */
     readonly description: string;
     /** CLI deposit status, explicitly online/offline on full host cards; absent on ordinary sessions. */

package/nexus-stage/scripts/mockhost.py

@@ -83,11 +83,16 @@ host_prefix = 'dsh'
 for _t in _BASE.get('canvas', {}).get('teams', []):
     teams[_t['name']] = [m['id'] for m in _t.get('members', [])]
     for _m in _t.get('members', []):
-        member_rows[_m['id']] = _m
+        member_rows[_m['id']] = _m  # every member row, not only the first
         _p = _m.get('team', '').split('/')[0]
-        if _p:
+        if _p and '/' not in _m['id']:
             host_prefix = _p
-            break
+
+
+def valid_remote_ref(mid):
+    """Mirror of canvas-store.validRemoteMemberRef: a '/'-qualified handle, no whitespace, no empty side."""
+    return (isinstance(mid, str) and '/' in mid and mid == mid.strip() and not any(c.isspace() for c in mid)
+            and not mid.startswith('/') and not mid.endswith('/') and '//' not in mid)
 
 
 def valid_name(raw):
@@ -118,7 +123,9 @@ def build_state(demo: bool = False) -> bytes:
         for mid in ids:
             row = member_rows.get(mid)
             if row is None:
-                row = {'id': mid, 'team': f'{host_prefix}/{mid[:8]}', 'joined': True, 'live': True}
+                # A remote ref renders as the real state face does: { id, team: the handle, remote: true }.
+                row = ({'id': mid, 'team': mid, 'remote': True} if '/' in mid
+                       else {'id': mid, 'team': f'{host_prefix}/{mid[8:16] if mid.startswith("session-") else mid[:8]}', 'joined': True, 'live': True})
                 member_rows[mid] = row
             members.append(row)
         team_rows.append({'name': name, 'team': f'{host_prefix}/canvas/{name}', 'members': members})
@@ -208,8 +215,9 @@ class MockHost(SimpleHTTPRequestHandler):
         elif action == 'add-member':
             name = valid_name(body.get('name'))
             mid = body.get('id')
-            if name is None or not isinstance(mid, str) or mid not in joined_ids:
-                self._json(b'{"ok":false,"error":"name and a joined session id are required"}')
+            # Dual member shape, as the real host: a joined local session id, or a remote team handle.
+            if name is None or not isinstance(mid, str) or not (mid in joined_ids or valid_remote_ref(mid)):
+                self._json(b'{"ok":false,"error":"name and a member (joined session id, or a zone-qualified remote team handle like zone/a1b2c3d4) are required"}')
                 return
             roster = teams.setdefault(name, [])
             if mid in roster:

package/nexus-stage/src/planning-card.ts

@@ -43,15 +43,17 @@ export function createCardElement(id: string): HTMLDivElement {
 
 /**
  * The right-hand chip. Peer cards show the link badge (gh#20 W-A: linked green / stranger gray, then the
- * verified tick/cross; an absent link field from an older host renders the neutral 'peer'); session cards show
- * their first membership priority `P<n>`. Writes only on change.
+ * verified tick/cross; an absent link field from an older host renders the neutral 'peer'). A remote MEMBER card
+ * (gh#38) is one session on that host, not the host: it reads 成员, colored and ticked by its host's link
+ * (it used to fall through to 'peer' and looked like a host card). Session cards show their first membership
+ * priority `P<n>`. Writes only on change.
  */
 export function paintPrio(prioEl: HTMLElement, n: WorldNode, info: { link?: 'linked' | 'stranger'; verified?: boolean } | undefined): void {
   if (n.remote === true) {
     const cls = info?.link === 'linked' ? 'lnk-linked' : info?.link === 'stranger' ? 'lnk-stranger' : ''
     if (prioEl.className !== `prio mono ${cls}`.trim()) prioEl.className = `prio mono ${cls}`.trim()
     const mark = info === undefined ? '' : info.verified === true ? '✓' : '✗'
-    const badge = (info?.link ?? 'peer') + mark
+    const badge = (n.id.startsWith('member-') ? '成员' : info?.link ?? 'peer') + mark
     if (prioEl.textContent !== badge) prioEl.textContent = badge
   } else {
     if (prioEl.className !== 'prio mono') prioEl.className = 'prio mono'

package/nexus-stage/src/planning-member-handles.ts

@@ -1,4 +1,4 @@
-/** Pure joined-local-handle projection for remote organization members. */
+/** Pure membership projections: joined-local handles for remote organization members, canvas team indexes, mirror-frame members. */
 import type { RemoteTeamRow } from './federation'
 import type { SessionLite } from './world'
 
@@ -32,3 +32,30 @@ export function remoteMemberBoardId(member: string, localIdsByHandle: ReadonlyMa
   const peerZone = remoteTeams?.find(row => row.via === peerUrl)?.team.split('/')[0] ?? 'dsh'
   return `member-${peerZone}-${member.replace(/^session-/, '').slice(0, 8)}`
 }
+
+/** Each member id → the canvas teams it sits in, with its position in that team's member order. */
+export function membershipIndex(teams: ReadonlyArray<{ name: string; members: ReadonlyArray<{ id: string }> }>): Map<string, Array<{ team: string; index: number }>> {
+  const memberships = new Map<string, Array<{ team: string; index: number }>>()
+  for (const team of teams) {
+    for (let i = 0; i < team.members.length; i++) {
+      const id = team.members[i]!.id
+      const list = memberships.get(id) ?? []
+      list.push({ team: team.name, index: i })
+      memberships.set(id, list)
+    }
+  }
+  return memberships
+}
+
+/** Local joined sessions that sit in a peer's org team (a mirror frame): they are teamed even with no local team. */
+export function mirrorMemberIds(peerOrg: ReadonlyArray<{ org: ReadonlyArray<{ members: readonly string[] }> }>, sessions: ReadonlyArray<HandleSession>, remoteTeams: ReadonlyArray<RemoteTeamRow> | undefined): Set<string> {
+  const byHandle = joinedLocalIdsByHandle(sessions, new Set((remoteTeams ?? []).map(session => session.team)))
+  const ids = new Set<string>()
+  for (const row of peerOrg) {
+    for (const team of row.org) for (const member of team.members) {
+      const id = byHandle.get(member)
+      if (id !== undefined) ids.add(id)
+    }
+  }
+  return ids
+}

package/nexus-stage/src/planning-menus.ts

@@ -306,14 +306,13 @@ export function createPlanningMenus(d: MenusDeps): PlanningMenus {
         const create = menuItem('组成团队…', model.selectedIds().length >= 2, () => openNameDialog(selectedByY()))
         create.title = '先框选或 Shift 加选至少 2 个节点'
         items.push(create)
+        const teamsOf = model.getNode(id)?.memberships.map(m => m.team) ?? []
         if (d.teams().length > 0) {
           items.push(menuItem('加入团队 ▸', true, () => openMenu(x, y, target, 'join')))
-          const teamsOf = model.getNode(id)?.memberships.map(m => m.team) ?? []
-          if (teamsOf.length > 0) {
-            items.push(menuItem('置顶路由 ▸', true, () => openMenu(x, y, target, 'promote')))
-            items.push(menuItem('离队 ▸', true, () => openMenu(x, y, target, 'leave')))
-          }
+          if (teamsOf.length > 0) items.push(menuItem('置顶路由 ▸', true, () => openMenu(x, y, target, 'promote')))
         }
+        // A card that is only in mirror frames (a peer's team) still has a team to leave.
+        if (teamsOf.length > 0) items.push(menuItem('离队 ▸', true, () => openMenu(x, y, target, 'leave')))
         // Network-level leave (distinct from canvas-team membership): the
         // panel-slim migration moved the join/leave toggle here. Remote
         // nodes are read-only entries — never a leave target.
@@ -342,6 +341,14 @@ export function createPlanningMenus(d: MenusDeps): PlanningMenus {
             }))
           }
         }
+        // d.teams() is this host's own teams; a mirror frame's membership leaves through
+        // the owner's relay (the view adds fleetPeer), so list those memberships too.
+        if (level === 'leave') {
+          const local = new Set(d.teams().map(t => t.name))
+          for (const m of model.getNode(id)?.memberships ?? []) {
+            if (!local.has(m.team)) items.push(menuItem(titleOf(m.team), true, () => d.emit({ type: 'remove-member', team: m.team, ids: [id] })))
+          }
+        }
       }
     }
     el.append(...items)

package/nexus-stage/src/planning-view.ts

@@ -30,7 +30,8 @@ import { buildLayoutDoc, clampDoc, type LayoutDoc, type LayoutRect } from './lay
 import { FRAME_HEAD_LIFT } from './edges'
 import { drawMemberEdges } from './planning-edges'
 import { createFederationOverlay } from './federation-overlay'
-import { joinedLocalIdsByHandle, remoteMemberBoardId } from './planning-member-handles'
+import { joinedLocalIdsByHandle, membershipIndex, mirrorMemberIds, remoteMemberBoardId } from './planning-member-handles'
+import { attachSessionDrop } from './session-drag'
 import { displayName } from './stage-name'
 import {
   activityEdges, federalEdges, flyBounds, groupRemoteTeams, peerNodeId, peerHostOf, placePeers,
@@ -431,7 +432,9 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
       if (subEl.textContent !== subText) subEl.textContent = subText
       const tip = unavailable ? `${txt.tip} · ${UNREACHABLE_HINT}` : txt.tip
       if (el.title !== tip) el.title = tip
-      paintPrio(el.querySelector<HTMLElement>('.prio')!, n, n.remote === true ? peerInfoByHost.get(host) : undefined)
+      // A member card's chip follows the link of the host that publishes its handle.
+      const linkHost = n.id.startsWith('member-') ? memberHostByHandle.get(n.remoteHandle ?? '') : host
+      paintPrio(el.querySelector<HTMLElement>('.prio')!, n, n.remote === true && linkHost !== undefined ? peerInfoByHost.get(linkHost) : undefined)
     }
     for (const [id, el] of [...nodeEls]) {
       if (!seen.has(id)) { el.remove(); nodeEls.delete(id) }
@@ -454,6 +457,7 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
   const peerScoreByText = new Map<string, number | undefined>()
   /** gh#20 W-A: per-host link/verified info for the peer badges. */
   const peerInfoByHost = new Map<string, { link?: 'linked' | 'stranger'; verified?: boolean }>()
+  let memberHostByHandle: ReadonlyMap<string, string> = new Map()
 
   function renderFederation(): void {
     federation.render(clock())
@@ -622,6 +626,12 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
     openNameDialog: menus.openNameDialog,
     locate: locateNode,
   })
+  // A rail 本机会话 row dropped on a frame joins that team, like a card drop (session-drag).
+  attachSessionDrop(root, {
+    signal, frames: () => frameEls,
+    frameAt: (clientX, clientY) => { const p = localXY({ clientX, clientY }); return innermostFrameAt(new Map(model.allFrames()), screenToWorld(vp, p.x, p.y)) },
+    drop: (team, id) => model.getNode(id)?.memberships.some(m => m.team === team) === true ? notice('info', '该会话已在这个队里') : emitAction({ type: 'add-member', team, ids: [id] }),
+  })
 
   /** Center the viewport on one canvas node (the 已组队 row's 定位). */
   function locateNode(id: string): void {
@@ -1116,15 +1126,7 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
     // toolbar chip instead of vanishing entirely.
     lastSessions = input.sessions
     menus.setUnjoined(input.sessions.filter(s => s.joined !== true && !s.id.startsWith('peer-')))
-    const memberships = new Map<string, Array<{ team: string; index: number }>>()
-    for (const team of input.teams) {
-      for (let i = 0; i < team.members.length; i++) {
-        const id = team.members[i]!.id
-        const list = memberships.get(id) ?? []
-        list.push({ team: team.name, index: i })
-        memberships.set(id, list)
-      }
-    }
+    const memberships = membershipIndex(input.teams)
     lastCanvasMemberIds = new Set(memberships.keys())
     const seen = new Set<string>()
     // In-flight write guard: membership entries of teams with unsettled
@@ -1158,15 +1160,20 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
       syncViewSize()
       clusterSeats = planTeamClusters(input.teams, seatIds, viewW > 0 ? viewW : undefined)
     }
+    // A joined session whose only team is a peer's (a mirror frame) is teamed too: without its
+    // card the mirror frame cannot show it, and 离队 has nothing to reach (owner report 2026-11-04).
+    const mirrorMembers = input.peerOrg !== undefined ? mirrorMemberIds(input.peerOrg, input.sessions, input.remoteTeams) : new Set<string>()
+    // The node list reads the same fact: such a session is teamed, not 未组队.
+    if (input.peerOrg !== undefined) lastCanvasMemberIds = new Set([...lastCanvasMemberIds, ...mirrorMembers])
     for (const s of input.sessions) {
       if (s.joined !== true) continue
       // Teamed-only canvas (network-membership-display ruling): a joined
       // session earns a canvas node only with a team — canvas membership
-      // (optimistic-aware) or a declared roster team. Teamless joined
-      // sessions ride the node list's 未组队 group instead; sessions absent
-      // from `seen` are swept from the model below.
+      // (optimistic-aware), a declared roster team, or a mirror frame's
+      // membership. Teamless joined sessions ride the node list's 未组队
+      // group instead; sessions absent from `seen` are swept from the model below.
       const effective = resolveMemberships(s.id)
-      if (effective.length === 0 && (s.teams === undefined || s.teams.length === 0)) continue
+      if (effective.length === 0 && (s.teams === undefined || s.teams.length === 0) && !mirrorMembers.has(s.id)) continue
       seen.add(s.id)
       if (model.getNode(s.id) !== undefined) {
         model.upsertNode({
@@ -1202,6 +1209,7 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
     // excluded from bounds, so the column cannot feed back into itself).
     const peerSeen = new Set<string>()
     lastRemoteTeams = groupRemoteTeams(input.remoteTeams ?? [])
+    memberHostByHandle = new Map([...lastRemoteTeams].flatMap(([h, rows]) => rows.map(row => [row.team, h] as const)))
     lastWork = new Map(input.sessions.map(s => [s.id, { status: s.status, queued: s.queued }]))
     reachability = unreachableRefs(input)
     peerScoreByText.clear()
@@ -1226,7 +1234,9 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
         // team row's zone/id8 handle (canvas remote refs are exact handles
         // per the D1 ruling). Absent until the first remote team row lands.
         const host = peerHostOf(p.url)
-        const handle = lastRemoteTeams.get(host)?.[0]?.team
+        // Owner report 2026-11-04: the host's rows now lead with its bare process team (e.g. 'dsh'), which the
+        // server reads as a local session id and refuses — take the first zone/id8 SESSION handle instead.
+        const handle = lastRemoteTeams.get(host)?.find(row => row.team.includes('/'))?.team
         model.upsertNode({
           id, x: base.x, y: base.y,
           label: p.url, team: '', name: p.url, peerUrl: p.url,

package/nexus-stage/src/seat-name-editor.ts

@@ -0,0 +1,31 @@
+/** Human owner form only: labels never grant membership or become routing ids. */
+export function createSeatNameEditor(sessions: readonly { id: string; name?: string; label?: string }[], names: Record<string, string>, save: (names: Record<string, string>) => Promise<{ ok: boolean; error?: string }>): HTMLElement {
+  const box = document.createElement('section')
+  const heading = document.createElement('h4'); heading.textContent = '会话席位名（仅人工设定）'; box.appendChild(heading)
+  const note = document.createElement('p'); note.className = 'wb-hint'; note.textContent = '稳定展示名，不改变会话标题、路由句柄或准入。留空并保存可清除。'; box.appendChild(note)
+  const select = document.createElement('select'); select.setAttribute('aria-label', '选择命名的本机会话')
+  for (const id of new Set([...sessions.map(row => row.id), ...Object.keys(names)])) {
+    const row = sessions.find(row => row.id === id), option = document.createElement('option')
+    option.value = id; option.textContent = (names[id] ?? row?.name ?? row?.label ?? id) + ' · ' + id; select.appendChild(option)
+  }
+  const input = document.createElement('input'); input.type = 'text'; input.maxLength = 64; input.setAttribute('aria-label', '人工席位名'); input.placeholder = '例如：开发席'
+  const button = document.createElement('button'); button.type = 'submit'; button.textContent = '保存席位名'; button.className = 'wb-member-submit'
+  const form = document.createElement('form'); form.className = 'wb-member-add'; form.append(select, input, button)
+  const status = document.createElement('p'); status.className = 'wb-hint'; status.setAttribute('role', 'status'); status.setAttribute('aria-live', 'polite')
+  let pending = false
+  const load = () => { input.value = names[select.value] ?? ''; button.disabled = pending || select.value === '' }
+  select.addEventListener('change', load); load()
+  form.addEventListener('submit', async event => {
+    event.preventDefault(); if (pending || select.value === '') return
+    const id = select.value, value = input.value.trim(), next = { ...names }
+    if (value === '') delete next[id]; else next[id] = value
+    pending = true; button.disabled = true; select.disabled = true; input.disabled = true
+    try {
+      const result = await save(next)
+      if (result.ok) { delete names[id]; if (value !== '') names[id] = value; status.textContent = '席位名已保存；目录将随状态刷新。' }
+      else status.textContent = result.error ?? '保存失败'
+    } catch (error) { status.textContent = '保存失败：' + String(error) }
+    finally { pending = false; select.disabled = false; input.disabled = false; load() }
+  })
+  box.append(form, status); return box
+}