@nelsonlongxiang/dsh-open-a2a-net 0.6.36 → 0.6.37

package/lib/owner-settings.js

@@ -8,8 +8,39 @@
  * else; a missing entry is appended in the canonical short-id form.
  * @module @nelsonlongxiang/dsh-open-a2a-net/owner-settings
  */
+/** A label shaped like a routable address (`dsh/66abc2cf`, `zone/canvas/x`, `name/<16 hex>`) would pass for another
+ *  session in the directory and in `a2a-net teams <query>`; labels are display-only, so that shape is refused. */
+const ADDRESS_SHAPED = /^[A-Za-z0-9._-]+\/\S+$/;
+/** Shared validation for boot config and owner POST; labels are plain text, never handles or authority. */
+export function parseSeatNames(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length > 1024)
+        return undefined;
+    const entries = Object.entries(value);
+    if (entries.some(([id, name]) => !/^session-[a-zA-Z0-9-]{8,128}$/.test(id) || typeof name !== 'string' || name.trim() === '' || [...name.trim()].length > 64 || /[\p{Cc}\p{Cf}\u2028\u2029\ufffd]/u.test(name) || !/[^\p{Z}\p{C}\p{M}]/u.test(name) || ADDRESS_SHAPED.test(name.trim())))
+        return undefined;
+    return Object.fromEntries(entries.map(([id, name]) => [id, name.trim()]));
+}
+/** Boot config degrades entry-by-entry; owner POST remains all-or-nothing. Never echo label contents in warnings. */
+export function loadSeatNames(value, warn) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        warn('seatNames: ignored invalid map');
+        return {};
+    }
+    const kept = {};
+    let count = 0;
+    for (const [id, name] of Object.entries(value)) {
+        const entry = parseSeatNames({ [id]: name });
+        if (entry === undefined || count >= 1024) {
+            warn('seatNames: ignored invalid or over-cap entry');
+            continue;
+        }
+        Object.assign(kept, entry);
+        count += 1;
+    }
+    return kept;
+}
 /** The exact keys this module may touch, in wire order. */
-const KEYS = ['teamJoinAllowlist', 'teamScopeInfo', 'announce'];
+const KEYS = ['teamJoinAllowlist', 'teamScopeInfo', 'announce', 'seatNames'];
 export function applyOwnerSettings(patchYaml, changes) {
     const lines = patchYaml.split('\n');
     // Find the a2a entry: `- id: a2a` / `- id: 'a2a'` variants.
@@ -34,6 +65,8 @@ export function applyOwnerSettings(patchYaml, changes) {
         writes.push(`    teamScopeInfo: ${changes.teamScopeInfo ? 'true' : 'false'}`);
     if (changes.announce !== undefined)
         writes.push(`    announce: ${changes.announce ? 'true' : 'false'}`);
+    if (changes.seatNames !== undefined)
+        writes.push(`    seatNames: ${JSON.stringify(changes.seatNames)}`);
     if (writes.length === 0)
         return { yaml: patchYaml, restartNeeded };
     if (entryStart === -1) {
@@ -81,6 +114,10 @@ export function applyOwnerSettings(patchYaml, changes) {
                 if (write !== undefined) {
                     lines[j] = write;
                     found = true;
+                    // A map may have been authored as block YAML. Replace its nested rows too, not just the heading.
+                    if (key === 'seatNames')
+                        while (j + 1 < lines.length && (/^ {5,}\S/.test(lines[j + 1] ?? '') || /^\s*$/.test(lines[j + 1] ?? '')))
+                            lines.splice(j + 1, 1);
                 }
                 break;
             }

package/lib/peer-link-display.js

@@ -0,0 +1,15 @@
+export function peerLinkDisplay(peerUrl, d) {
+    const { card } = d;
+    if (card === undefined)
+        return { link: 'stranger', verified: false };
+    const origin = (url) => { try {
+        return new URL(url).origin;
+    }
+    catch {
+        return '';
+    } };
+    const peerOrigin = origin(peerUrl), ownOrigin = origin(d.ownUrl);
+    const bilateral = peerOrigin !== '' && ownOrigin !== '' && d.seeds.some(url => origin(url) === peerOrigin) && (card.peers ?? []).some(url => origin(url) === ownOrigin);
+    const exactMember = d.refs.some(ref => !d.ownHandles.has(ref) && (card.sessionTeams ?? []).some(row => row.team === ref) && !d.cards.some(other => other.publicKey !== card.publicKey && (other.sessionTeams ?? []).some(row => row.team === ref)));
+    return { link: bilateral || exactMember ? 'linked' : 'stranger', verified: true };
+}

package/lib/skill/references/cli.md

@@ -42,6 +42,10 @@ model tools.
   405 with an empty body. The fix is a host upgrade, not a retry.
 - `a2a-net revoke` deregisters early.
 
+## Team display names
+
+`a2a-net teams <query>` searches the owner-set seat label as well as the route handle; `--json` exposes the effective display name. Local rows prefer `seatName`, then the current title (`name`), then the legacy label. Only the human workbench owner panel/config can set `seatNames`; the CLI has no naming command.
+
 ## Tasks: ledger and host observability
 
 `a2a-net tasks --json` returns the existing `pending`, `dead`, and `archived` arrays plus `settlement` and `conservation` copied unchanged from `/__dsh_a2a/state`. These blocks include the lifetime `settlement.refusalsTotal`, refusal ring and mode, and the host conservation verdict/counters/duplicate ids. Older hosts omit a block they do not expose; the CLI does not manufacture zero counters or a passing verdict. Plain `tasks` appends a conservation line (`conserved`, `delta`) and a settlement line (`mode`, `refusalsTotal`, `offChain`) when the respective block exists.

package/lib/skill/references/setup.md

@@ -21,6 +21,10 @@ presenting the operator's gesture on the operator's behalf is exactly the
 | Version | `/__dsh_a2a/state` `version`, or the workbench header badge | the same version on every host you will link (0.6.28+) |
 | Clock | `date` on each host | NTP-synced: card signatures carry `expiresAt`, and the OriginClaim envelope allows ±5 min |
 
+## Human seat names
+
+The owner can open the workbench header ⚙, select a local session under “会话席位名”, and explicitly save a stable display name (up to 64 characters; a name shaped like a route address such as `dsh/66abc2cf` is refused so it cannot pass for another session). Empty input clears the label. The `seatNames` map is stored in the home patch layer and hot-applies; cards and the board prefer it over the session title, and `a2a_whoami` / `a2a-net teams <name>` expose it. It never changes the route handle, join state or admission. Agents must ask the owner rather than self-name: A2A tool arguments containing `seatName`/`seatNames` are refused; no naming model tool exists. The owner control API keeps its existing apiKey/loopback trust model, not a sandbox against local shell or config-file writers.
+
 ## 1. One host: sessions talking to each other
 
 **Owner:**

package/lib/task-ledger-rows.js

@@ -0,0 +1,192 @@
+/** Stateless ledger row types, classifiers and restore projections; moved verbatim for #258. */
+import { parseAuthorization } from "./task-auth.js";
+/**
+ * Caller-ended summaries (abandon / cancel) share one isolation law: late
+ * receipts never rewrite the verdict — they only stamp lateReceiptAt, and
+ * the projected outcome collapses to 'abandoned'.
+ */
+export const CALLER_ENDED_PREFIX = /^caller-(abandoned|cancelled)/;
+/** Hard cap on the owed book (pending + dead-lettered rows, most recent first). */
+export const TASK_CAP = 64;
+/** Hard cap on the settled archive (most recent kept). */
+export const ARCHIVE_CAP = 64;
+/** Longest receipt summary kept on a record (multi-line outcomes collapse). */
+export const SUMMARY_CAP = 200;
+/**
+ * Longest dispatch brief kept per row. A ledger row without its payload is
+ * unreadable to supervision — "direct-8f3a1c2b → dsh/ec4ce7f8, 3h old" says
+ * nothing about whether to nudge, abandon, or read the receipt. The brief is
+ * the first non-empty line of the message, capped; the full body never enters
+ * the ledger (it can be arbitrarily large and may quote another session's log).
+ */
+export const BRIEF_CAP = 120;
+/** Reduce a dispatch body to one readable line: first non-empty line, collapsed, capped. */
+export function briefOf(message) {
+    if (message === undefined)
+        return undefined;
+    for (const raw of message.split('\n')) {
+        const line = raw.trim().replace(/\s+/g, ' ');
+        if (line !== '')
+            return line.length <= BRIEF_CAP ? line : `${line.slice(0, BRIEF_CAP - 1)}…`;
+    }
+    return undefined;
+}
+/**
+ * Age at which an unsettled task auto-dead-letters. A dead row exits the
+ * owed view, disarms its async-nudge retry (a cold session cannot consume a
+ * re-steer anyway), and still accepts a late receipt from a revived target.
+ * Injectable per instance so tests can use short windows; sweeping stays
+ * lazy — every read/write entry point sweeps first.
+ */
+export const TASK_STALE_TTL_MS = 24 * 60 * 60_000;
+export const ARCHIVE_ENDS = ['receipt', 'echo', 'abandoned', 'cancelled', 'evicted'];
+/** Summary marker {@link TaskLedger.resolveEcho} writes on echo-settled rows. */
+export const ECHO_SUMMARY = '(settled by content echo)';
+const SENDER_KINDS = ['session', 'host', 'bridge', 'cli'];
+/** Longest sender id kept; anything longer is malformed, not truncated. */
+export const SENDER_ID_CAP = 256;
+/**
+ * Restore-side allowlist for one persisted sender: a well-formed value comes
+ * back as a fresh object holding only kind, id and (when present) face; anything else is dropped whole (the row
+ * itself survives — a bad sender never costs the debt record).
+ * @param raw - the persisted value.
+ * @returns the sender, or undefined when absent or malformed.
+ */
+export function parseSender(raw) {
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+        return undefined;
+    const { kind, id, face } = raw;
+    if (typeof kind !== 'string' || !SENDER_KINDS.includes(kind))
+        return undefined;
+    if (typeof id !== 'string' || id === '' || id.length > SENDER_ID_CAP)
+        return undefined;
+    if (face !== undefined && (typeof face !== 'string' || face === '' || face.length > SENDER_ID_CAP))
+        return undefined;
+    // `face` belongs to host senders only; on any other kind it is dropped, the sender kept.
+    return { kind: kind, id, ...(face !== undefined && kind === 'host' ? { face } : {}) };
+}
+/**
+ * Spread helper for restore: `{ sender }` when the persisted value parses and
+ * the row is not inbound (an inbound row's originator is its caller, never a
+ * sender this host recorded), else nothing.
+ */
+export function withSender(raw, direction) {
+    if (direction === 'inbound')
+        return {};
+    const sender = parseSender(raw);
+    return sender === undefined ? {} : { sender };
+}
+/**
+ * #114 S2: `{ auth }` when a persisted INBOUND row carries a record that
+ * parses whole (parseAuthorization) and belongs to THIS row — its target is
+ * the row's team and its receipt target the row's peer — else nothing: the
+ * row survives as a pre-S2 row, never with a partially adopted or borrowed
+ * record.
+ */
+export function withAuth(raw, entry, now) {
+    if (entry.direction !== 'inbound' && entry.direction !== 'outbound')
+        return {};
+    const auth = parseAuthorization(raw, now);
+    if (auth === undefined || auth.target !== entry.team)
+        return {};
+    if (entry.direction === 'inbound')
+        return auth.ingress === 'wire' && `local:${auth.receipt_target}` === entry.peer ? { auth } : {};
+    // #139: an outbound row carries only its local-candidate admission.
+    return auth.ingress === 'local' && entry.peer === 'local' ? { auth } : {};
+}
+/** Routing and answer facts copied unchanged between a row and its archive entry. */
+export function routingOf(row) {
+    return {
+        ...(row.answeredAt !== undefined ? { answeredAt: row.answeredAt } : {}),
+        ...(row.forwarded === true ? { forwarded: true } : {}),
+        ...(row.peerKey !== undefined ? { peerKey: row.peerKey } : {}),
+        ...(row.peerHost !== undefined ? { peerHost: row.peerHost } : {}),
+        ...(row.deliveredTo !== undefined ? { deliveredTo: row.deliveredTo } : {}),
+    };
+}
+/** The facts of one outbound birth that fit the row (see {@link withRouting} for the same shape on restore). */
+export function birthFacts(peer, birth) {
+    if (birth === undefined)
+        return {};
+    const fact = (v) => v !== undefined && v !== '' && v.length <= ROUTING_FACT_CAP;
+    const remote = peer !== 'local' && !peer.startsWith('local:');
+    return {
+        ...(!remote && birth.auth !== undefined && birth.auth.ingress === 'local' ? { auth: birth.auth } : {}),
+        ...(remote && birth.forwarded === true ? { forwarded: true } : {}),
+        ...(remote && fact(birth.peerKey) ? { peerKey: birth.peerKey } : {}),
+        ...(remote && fact(birth.peerHost) ? { peerHost: birth.peerHost } : {}),
+        ...(fact(birth.deliveredTo) ? { deliveredTo: birth.deliveredTo } : {}),
+    };
+}
+/** Bound on a persisted routing fact; anything longer (or empty, or not a string) is dropped on restore. */
+export const ROUTING_FACT_CAP = 256;
+/**
+ * #139: restore-side allowlist for the routing facts. Each is kept only in
+ * its shape — a non-empty string within the cap — and the peer facts only on
+ * a remote outbound row; anything else is dropped (the row survives as one
+ * born before the fields, judged by current membership and origin).
+ */
+export function withRouting(entry) {
+    const fact = (v) => typeof v === 'string' && v !== '' && v.length <= ROUTING_FACT_CAP;
+    const remoteOutbound = entry.direction === 'outbound' && typeof entry.peer === 'string' && entry.peer !== 'local' && !entry.peer.startsWith('local:');
+    return {
+        ...(typeof entry.answeredAt === 'number' && Number.isFinite(entry.answeredAt) && entry.answeredAt >= 0 ? { answeredAt: entry.answeredAt } : {}),
+        ...(remoteOutbound && entry.forwarded === true ? { forwarded: true } : {}),
+        ...(remoteOutbound && fact(entry.peerKey) ? { peerKey: entry.peerKey } : {}),
+        ...(remoteOutbound && fact(entry.peerHost) ? { peerHost: entry.peerHost } : {}),
+        ...(fact(entry.deliveredTo) ? { deliveredTo: entry.deliveredTo } : {}),
+    };
+}
+/**
+ * How one archived row ended (gh#31). The recorded field wins; legacy rows
+ * fall back to the summary markers this ledger writes itself. The fallback
+ * reads a receipt-settled row's summary, which is the peer's text, so it is
+ * only as exact as the legacy data allows.
+ * @param row - the archived record.
+ * @returns the archive path that ended it.
+ */
+export function archivedEndedBy(row) {
+    if (row.endedBy !== undefined)
+        return row.endedBy;
+    const summary = row.summary ?? '';
+    if (summary.startsWith('caller-cancelled'))
+        return 'cancelled';
+    if (summary.startsWith('caller-abandoned'))
+        return 'abandoned';
+    if (summary === ECHO_SUMMARY)
+        return 'echo';
+    return 'receipt';
+}
+/** Bound on ids and callers kept in settlement records; longer values are cut on write and refused on restore. */
+export const SETTLEMENT_ID_CAP = 256;
+/** Bound of the refusal ring (design §4.4). */
+export const SETTLEMENT_REFUSAL_CAP = 64;
+const SETTLEMENT_REASONS = ['settler-off-chain', 'settler-unverified', 'on-behalf-mismatch', 'echo-off-chain'];
+const CHAIN_ROLES = ['target', 'target-member', 'host-face', 'compat', 'legacy', 'off-chain'];
+const PROOF_VALUES = ['origin-claim', 'claim-mismatch', 'legacy-window', 'unbound', 'cli-identity', 'in-process', 'none'];
+/** Restore-side allowlist for settledBy: whole or nothing. */
+export function withSettledBy(raw) {
+    if (raw === null || typeof raw !== 'object')
+        return {};
+    const r = raw;
+    if (typeof r.caller !== 'string' || r.caller.length > SETTLEMENT_ID_CAP || typeof r.chain_role !== 'string' || !CHAIN_ROLES.includes(r.chain_role))
+        return {};
+    return { settledBy: { caller: r.caller, chain_role: r.chain_role } };
+}
+/** Restore-side allowlist for one refusal record: whole or nothing. */
+export function parseRefusal(raw) {
+    if (raw === null || typeof raw !== 'object')
+        return undefined;
+    const r = raw;
+    const st = r.settler;
+    if (typeof r.taskId !== 'string' || r.taskId === '' || r.taskId.length > SETTLEMENT_ID_CAP || typeof r.at !== 'number' || !Number.isFinite(r.at))
+        return undefined;
+    if (typeof r.reason !== 'string' || !SETTLEMENT_REASONS.includes(r.reason) || typeof r.head !== 'string' || typeof r.enforced !== 'boolean')
+        return undefined;
+    if (st === null || typeof st !== 'object' || typeof st.caller !== 'string' || st.caller.length > SETTLEMENT_ID_CAP || typeof st.proof !== 'string' || !PROOF_VALUES.includes(st.proof) || (st.ingress !== 'wire' && st.ingress !== 'local'))
+        return undefined;
+    const count = r.count === undefined ? 1 : r.count;
+    if (typeof count !== 'number' || !Number.isInteger(count) || count < 1)
+        return undefined;
+    return { taskId: r.taskId, at: r.at, settler: { caller: st.caller, proof: st.proof, ingress: st.ingress }, reason: r.reason, head: r.head.slice(0, SUMMARY_CAP), enforced: r.enforced, count };
+}

package/lib/task-ledger.js

@@ -18,201 +18,12 @@
  * illusion: settlements vanished while debts piled up).
  * @module @nelsonlongxiang/dsh-open-a2a-net/task-ledger
  */
-import { parseAuthorization } from "./task-auth.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { parseReceipt, RECEIPT_OUTCOMES } from "./receipt.js";
 import { classifyConservationBlock, ConservationCounters } from "./ledger-conservation.js";
-/**
- * Caller-ended summaries (abandon / cancel) share one isolation law: late
- * receipts never rewrite the verdict — they only stamp lateReceiptAt, and
- * the projected outcome collapses to 'abandoned'.
- */
-const CALLER_ENDED_PREFIX = /^caller-(abandoned|cancelled)/;
-/** Hard cap on the owed book (pending + dead-lettered rows, most recent first). */
-export const TASK_CAP = 64;
-/** Hard cap on the settled archive (most recent kept). */
-export const ARCHIVE_CAP = 64;
-/** Longest receipt summary kept on a record (multi-line outcomes collapse). */
-export const SUMMARY_CAP = 200;
-/**
- * Longest dispatch brief kept per row. A ledger row without its payload is
- * unreadable to supervision — "direct-8f3a1c2b → dsh/ec4ce7f8, 3h old" says
- * nothing about whether to nudge, abandon, or read the receipt. The brief is
- * the first non-empty line of the message, capped; the full body never enters
- * the ledger (it can be arbitrarily large and may quote another session's log).
- */
-export const BRIEF_CAP = 120;
-/** Reduce a dispatch body to one readable line: first non-empty line, collapsed, capped. */
-export function briefOf(message) {
-    if (message === undefined)
-        return undefined;
-    for (const raw of message.split('\n')) {
-        const line = raw.trim().replace(/\s+/g, ' ');
-        if (line !== '')
-            return line.length <= BRIEF_CAP ? line : `${line.slice(0, BRIEF_CAP - 1)}…`;
-    }
-    return undefined;
-}
-/**
- * Age at which an unsettled task auto-dead-letters. A dead row exits the
- * owed view, disarms its async-nudge retry (a cold session cannot consume a
- * re-steer anyway), and still accepts a late receipt from a revived target.
- * Injectable per instance so tests can use short windows; sweeping stays
- * lazy — every read/write entry point sweeps first.
- */
-export const TASK_STALE_TTL_MS = 24 * 60 * 60_000;
-const ARCHIVE_ENDS = ['receipt', 'echo', 'abandoned', 'cancelled', 'evicted'];
-/** Summary marker {@link TaskLedger.resolveEcho} writes on echo-settled rows. */
-const ECHO_SUMMARY = '(settled by content echo)';
-const SENDER_KINDS = ['session', 'host', 'bridge', 'cli'];
-/** Longest sender id kept; anything longer is malformed, not truncated. */
-export const SENDER_ID_CAP = 256;
-/**
- * Restore-side allowlist for one persisted sender: a well-formed value comes
- * back as a fresh object holding only kind, id and (when present) face; anything else is dropped whole (the row
- * itself survives — a bad sender never costs the debt record).
- * @param raw - the persisted value.
- * @returns the sender, or undefined when absent or malformed.
- */
-export function parseSender(raw) {
-    if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
-        return undefined;
-    const { kind, id, face } = raw;
-    if (typeof kind !== 'string' || !SENDER_KINDS.includes(kind))
-        return undefined;
-    if (typeof id !== 'string' || id === '' || id.length > SENDER_ID_CAP)
-        return undefined;
-    if (face !== undefined && (typeof face !== 'string' || face === '' || face.length > SENDER_ID_CAP))
-        return undefined;
-    // `face` belongs to host senders only; on any other kind it is dropped, the sender kept.
-    return { kind: kind, id, ...(face !== undefined && kind === 'host' ? { face } : {}) };
-}
-/**
- * Spread helper for restore: `{ sender }` when the persisted value parses and
- * the row is not inbound (an inbound row's originator is its caller, never a
- * sender this host recorded), else nothing.
- */
-function withSender(raw, direction) {
-    if (direction === 'inbound')
-        return {};
-    const sender = parseSender(raw);
-    return sender === undefined ? {} : { sender };
-}
-/**
- * #114 S2: `{ auth }` when a persisted INBOUND row carries a record that
- * parses whole (parseAuthorization) and belongs to THIS row — its target is
- * the row's team and its receipt target the row's peer — else nothing: the
- * row survives as a pre-S2 row, never with a partially adopted or borrowed
- * record.
- */
-function withAuth(raw, entry, now) {
-    if (entry.direction !== 'inbound' && entry.direction !== 'outbound')
-        return {};
-    const auth = parseAuthorization(raw, now);
-    if (auth === undefined || auth.target !== entry.team)
-        return {};
-    if (entry.direction === 'inbound')
-        return auth.ingress === 'wire' && `local:${auth.receipt_target}` === entry.peer ? { auth } : {};
-    // #139: an outbound row carries only its local-candidate admission.
-    return auth.ingress === 'local' && entry.peer === 'local' ? { auth } : {};
-}
-/** Routing and answer facts copied unchanged between a row and its archive entry. */
-function routingOf(row) {
-    return {
-        ...(row.answeredAt !== undefined ? { answeredAt: row.answeredAt } : {}),
-        ...(row.forwarded === true ? { forwarded: true } : {}),
-        ...(row.peerKey !== undefined ? { peerKey: row.peerKey } : {}),
-        ...(row.peerHost !== undefined ? { peerHost: row.peerHost } : {}),
-        ...(row.deliveredTo !== undefined ? { deliveredTo: row.deliveredTo } : {}),
-    };
-}
-/** The facts of one outbound birth that fit the row (see {@link withRouting} for the same shape on restore). */
-function birthFacts(peer, birth) {
-    if (birth === undefined)
-        return {};
-    const fact = (v) => v !== undefined && v !== '' && v.length <= ROUTING_FACT_CAP;
-    const remote = peer !== 'local' && !peer.startsWith('local:');
-    return {
-        ...(!remote && birth.auth !== undefined && birth.auth.ingress === 'local' ? { auth: birth.auth } : {}),
-        ...(remote && birth.forwarded === true ? { forwarded: true } : {}),
-        ...(remote && fact(birth.peerKey) ? { peerKey: birth.peerKey } : {}),
-        ...(remote && fact(birth.peerHost) ? { peerHost: birth.peerHost } : {}),
-        ...(fact(birth.deliveredTo) ? { deliveredTo: birth.deliveredTo } : {}),
-    };
-}
-/** Bound on a persisted routing fact; anything longer (or empty, or not a string) is dropped on restore. */
-const ROUTING_FACT_CAP = 256;
-/**
- * #139: restore-side allowlist for the routing facts. Each is kept only in
- * its shape — a non-empty string within the cap — and the peer facts only on
- * a remote outbound row; anything else is dropped (the row survives as one
- * born before the fields, judged by current membership and origin).
- */
-function withRouting(entry) {
-    const fact = (v) => typeof v === 'string' && v !== '' && v.length <= ROUTING_FACT_CAP;
-    const remoteOutbound = entry.direction === 'outbound' && typeof entry.peer === 'string' && entry.peer !== 'local' && !entry.peer.startsWith('local:');
-    return {
-        ...(typeof entry.answeredAt === 'number' && Number.isFinite(entry.answeredAt) && entry.answeredAt >= 0 ? { answeredAt: entry.answeredAt } : {}),
-        ...(remoteOutbound && entry.forwarded === true ? { forwarded: true } : {}),
-        ...(remoteOutbound && fact(entry.peerKey) ? { peerKey: entry.peerKey } : {}),
-        ...(remoteOutbound && fact(entry.peerHost) ? { peerHost: entry.peerHost } : {}),
-        ...(fact(entry.deliveredTo) ? { deliveredTo: entry.deliveredTo } : {}),
-    };
-}
-/**
- * How one archived row ended (gh#31). The recorded field wins; legacy rows
- * fall back to the summary markers this ledger writes itself. The fallback
- * reads a receipt-settled row's summary, which is the peer's text, so it is
- * only as exact as the legacy data allows.
- * @param row - the archived record.
- * @returns the archive path that ended it.
- */
-export function archivedEndedBy(row) {
-    if (row.endedBy !== undefined)
-        return row.endedBy;
-    const summary = row.summary ?? '';
-    if (summary.startsWith('caller-cancelled'))
-        return 'cancelled';
-    if (summary.startsWith('caller-abandoned'))
-        return 'abandoned';
-    if (summary === ECHO_SUMMARY)
-        return 'echo';
-    return 'receipt';
-}
-/** Bound on ids and callers kept in settlement records; longer values are cut on write and refused on restore. */
-const SETTLEMENT_ID_CAP = 256;
-/** Bound of the refusal ring (design §4.4). */
-export const SETTLEMENT_REFUSAL_CAP = 64;
-const SETTLEMENT_REASONS = ['settler-off-chain', 'settler-unverified', 'on-behalf-mismatch', 'echo-off-chain'];
-const CHAIN_ROLES = ['target', 'target-member', 'host-face', 'compat', 'legacy', 'off-chain'];
-const PROOF_VALUES = ['origin-claim', 'claim-mismatch', 'legacy-window', 'unbound', 'cli-identity', 'in-process', 'none'];
-/** Restore-side allowlist for settledBy: whole or nothing. */
-function withSettledBy(raw) {
-    if (raw === null || typeof raw !== 'object')
-        return {};
-    const r = raw;
-    if (typeof r.caller !== 'string' || r.caller.length > SETTLEMENT_ID_CAP || typeof r.chain_role !== 'string' || !CHAIN_ROLES.includes(r.chain_role))
-        return {};
-    return { settledBy: { caller: r.caller, chain_role: r.chain_role } };
-}
-/** Restore-side allowlist for one refusal record: whole or nothing. */
-function parseRefusal(raw) {
-    if (raw === null || typeof raw !== 'object')
-        return undefined;
-    const r = raw;
-    const st = r.settler;
-    if (typeof r.taskId !== 'string' || r.taskId === '' || r.taskId.length > SETTLEMENT_ID_CAP || typeof r.at !== 'number' || !Number.isFinite(r.at))
-        return undefined;
-    if (typeof r.reason !== 'string' || !SETTLEMENT_REASONS.includes(r.reason) || typeof r.head !== 'string' || typeof r.enforced !== 'boolean')
-        return undefined;
-    if (st === null || typeof st !== 'object' || typeof st.caller !== 'string' || st.caller.length > SETTLEMENT_ID_CAP || typeof st.proof !== 'string' || !PROOF_VALUES.includes(st.proof) || (st.ingress !== 'wire' && st.ingress !== 'local'))
-        return undefined;
-    const count = r.count === undefined ? 1 : r.count;
-    if (typeof count !== 'number' || !Number.isInteger(count) || count < 1)
-        return undefined;
-    return { taskId: r.taskId, at: r.at, settler: { caller: st.caller, proof: st.proof, ingress: st.ingress }, reason: r.reason, head: r.head.slice(0, SUMMARY_CAP), enforced: r.enforced, count };
-}
+import { CALLER_ENDED_PREFIX, TASK_CAP, ARCHIVE_CAP, SUMMARY_CAP, TASK_STALE_TTL_MS, ARCHIVE_ENDS, ECHO_SUMMARY, ROUTING_FACT_CAP, SETTLEMENT_ID_CAP, SETTLEMENT_REFUSAL_CAP, withSender, withAuth, routingOf, birthFacts, withRouting, withSettledBy, parseRefusal, archivedEndedBy } from "./task-ledger-rows.js";
+export * from "./task-ledger-rows.js";
 /**
  * Bounded outbound-task ledger with whole-file persistence. Pure of any
  * routing knowledge: callers {@link track} a task when a route leaves it

package/lib/tools/info.js

@@ -124,7 +124,7 @@ export function createInfoTools(deps) {
                         type: 'text',
                         text: value.face === 'host'
                             ? `Host face on team ${String(value.node?.team ?? '?')}: routing rides the bare node team (能发即能收)`
-                            : `Node ${String(value.node?.id ?? '?')}: joined=${String(value.node?.joined)}, live=${String(value.node?.live)}; roster teams: ${(value.teams?.roster ?? []).join(', ') || 'none'}; canvas: ${(value.teams?.canvas ?? []).join(', ') || 'none'}; allowlist effect: ${String(value.allowlist?.effect ?? '?')}`,
+                            : `Node ${String(value.node?.name ?? '')} ${String(value.node?.id ?? '?')}: joined=${String(value.node?.joined)}, live=${String(value.node?.live)}; roster teams: ${(value.teams?.roster ?? []).join(', ') || 'none'}; canvas: ${(value.teams?.canvas ?? []).join(', ') || 'none'}; allowlist effect: ${String(value.allowlist?.effect ?? '?')}`,
                     }],
             },
             presentCall: () => ({ card: 'generic', title: 'A2A whoami', kind: 'other', rawInput: null }),
@@ -151,6 +151,7 @@ export function createInfoTools(deps) {
                     face: 'session',
                     node: {
                         id: agentId,
+                        ...(exec.agent !== undefined ? { name: nodeMetadataOf(exec.agent).name, ...(nodeMetadataOf(exec.agent).seatName !== undefined ? { seatName: nodeMetadataOf(exec.agent).seatName } : {}) } : {}),
                         ...(joined ? { team: `${config.team}/${id8(agentId)}` } : {}),
                         joined,
                         live,
@@ -209,6 +210,7 @@ export function createInfoTools(deps) {
                                     team: { type: 'string', required: true },
                                     session: { type: 'string', required: true },
                                     name: { type: 'string', required: true },
+                                    seatName: { type: 'string', description: 'Human-owned stable display label, never a route identity.' },
                                     description: { type: 'string', required: true },
                                     local: { type: 'boolean', description: 'true when the team is served by this host (loopback candidate).' },
                                     origin: { type: 'string', description: 'The publishing host (node session label, LAN IP when known) — the natural grouping for fleet rows.' },

package/lib/types/a2a-client.d.ts

@@ -45,6 +45,7 @@ export interface A2aClientOptions {
     readonly originClaim?: (target: {
         readonly url: string;
         readonly method: string;
+        readonly body?: string;
     }) => Record<string, string>;
     /** Delayed-callback seam (HTTP timeouts). */
     readonly schedule: A2aSchedule;

package/lib/types/faces/admin.d.ts

@@ -141,6 +141,7 @@ export interface AdminFaceDeps extends Pick<CanvasNotifyDeps, 'verifyOriginClaim
     readonly unboundInboundCount: number;
     readonly boundMissInboundCount: number;
     readonly ownCardUrl: string;
+    ownerSeatNames: Record<string, string>;
     ownerAllowlist: string[];
     ownerTeamScopeInfo: boolean;
     ownerAnnounceRestartPending: boolean;

package/lib/types/faces/canvas-notify.d.ts

@@ -44,7 +44,9 @@ export interface CanvasNotifyDeps {
     readonly canvasStore: CanvasStore;
     readonly cardCache: Map<string, CardCacheEntry>;
     readonly originClaimHeaders: (target: OriginClaimTarget) => Record<string, string>;
-    readonly verifyOriginClaim: (req: IncomingMessage) => Promise<{
+    readonly verifyOriginClaim: (req: IncomingMessage, options?: {
+        readonly rawBody?: Uint8Array;
+    }) => Promise<{
         ok: true;
         caller: string;
         callerUrl: string;

package/lib/types/faces/wire.d.ts

@@ -128,6 +128,7 @@ export interface WireDeps {
     readonly idempotencyStore: IdempotencyStore;
     readonly verifyOriginClaim: (req: IncomingMessage, options?: {
         readonly cli?: boolean;
+        readonly rawBody?: Uint8Array;
     }) => Promise<OriginClaimResult>;
     readonly forwardDirect: (request: ForwardRequest) => Promise<A2aRouteResult>;
     readonly remoteCliProof: (handle: string, claim: Extract<OriginClaimResult, {

package/lib/types/index.d.ts

@@ -228,6 +228,8 @@ export interface Config {
      * nobody created. Empty list denies every join (default).
      */
     readonly teamJoinAllowlist: string[];
+    /** Human-owned stable display labels keyed by full local session id; never a routing identity. */
+    readonly seatNames: Record<string, unknown>;
     /**
      * S3 (phase-2 default-ON, owner ruling 2026-09-01): route dispatch checks
      * caller↔target shared team membership before addressing; set false to

package/lib/types/origin-claim.d.ts

@@ -4,7 +4,7 @@
  * face (card, /a2a/direct, /a2a/log, /a2a/canvas-op, /a2a/canvas-changed)
  * runs.
  *
- * Two canonical forms ride the same four base headers
+ * Three canonical forms share the base caller headers
  * (X-A2A-Caller / -Url / -Ts):
  *   · bound (v2, §2.1): JSON.stringify([tag, caller, callerUrl, ts,
  *     audience, METHOD, path]) in X-A2A-Caller-Sig2, the audience origin in
@@ -14,7 +14,8 @@
  *   · unbound (v1, legacy): JSON.stringify([caller, callerUrl, ts]) in
  *     X-A2A-Caller-Sig. Emitted and accepted only while the unbound window
  *     is open (originClaimUnboundWindow); accepted ones are counted.
- * Once the window closes a present Sig2 is the only thing verified. While
+ * A present Sig3 requires the exact raw body and v3 signature, with no downgrade.
+ * Without Sig3, once the window closes a present Sig2 is the only thing verified. While
  * it is open, a Sig2 that misses (audience or signature) falls back to the
  * Sig the envelope also carries — no more than stripping Sig2 would give —
  * and the miss is counted, so a peer dialled by an unlisted name keeps
@@ -29,12 +30,16 @@ import type { A2aPeerCard } from './types.ts';
 export declare const ORIGIN_CLAIM_SKEW_MS: number;
 /** Domain tag of the bound form: a v1 signature can never verify as v2. */
 export declare const ORIGIN_CLAIM_BOUND_TAG = "a2a-origin-claim/2";
+export declare const ORIGIN_CLAIM_BODY_TAG = "a2a-origin-claim/3";
+/** Digest the exact UTF-8 string/bytes passed to transport, never reserialized JSON. */
+export declare const originBodySha256: (body: string | Uint8Array) => string;
 /** Where an outbound request goes: the bound form signs both. */
 export interface OriginClaimTarget {
     readonly url: string;
     readonly method: string;
+    readonly body?: string | Uint8Array;
 }
-export type OriginClaimRefusal = 'absent' | 'bad-caller-shape' | 'bad-ts' | 'no-card' | 'bad-sig' | 'not-derivable' | 'wrong-audience' | 'unbound-closed';
+export type OriginClaimRefusal = 'absent' | 'bad-caller-shape' | 'bad-ts' | 'no-card' | 'bad-sig' | 'not-derivable' | 'wrong-audience' | 'unbound-closed' | 'body-mismatch';
 /** Only the canonical origin root can claim that origin's identity. */
 export declare function isRootOriginUrl(value: string): boolean;
 /**
@@ -59,6 +64,8 @@ export type OriginClaimVerdict = {
 export declare function unboundCanonical(caller: string, callerUrl: string, ts: number): string;
 /** The bound (v2) canonical form; method upper-cased, path without query. */
 export declare function boundCanonical(caller: string, callerUrl: string, ts: number, audience: string, method: string, path: string): string;
+/** The body-bound v3 form is domain-separated from v1/v2, with the digest appended. */
+export declare function bodyBoundCanonical(caller: string, callerUrl: string, ts: number, audience: string, method: string, path: string, bodySha256: string): string;
 /** An origin in URL's normal form, or '' when the text is not an http(s) URL. */
 export declare function originOf(url: string): string;
 /** The path a request names, without its query (the bound form signs this). */
@@ -114,6 +121,8 @@ export declare function verifyOriginClaim(req: IncomingMessage, d: {
     /** A loopback arrival is an audience of its own (default); off when originClaimUrl declares a tunnel or proxy. */
     readonly loopbackArrival?: boolean;
     readonly now: number;
+    /** Exact received bytes, supplied by the bounded body reader. Missing bytes cannot verify Sig3. */
+    readonly rawBody?: Uint8Array;
     /** On the faces that admit CLI identities: the deposit a claim URL names. */
     readonly cliDeposit?: (callerUrl: string) => CliDepositCard | undefined;
 }): Promise<OriginClaimVerdict>;

package/lib/types/owner-settings.d.ts

@@ -12,7 +12,12 @@ export interface OwnerSettings {
     teamJoinAllowlist?: string[];
     teamScopeInfo?: boolean;
     announce?: boolean;
+    seatNames?: Record<string, string>;
 }
+/** Shared validation for boot config and owner POST; labels are plain text, never handles or authority. */
+export declare function parseSeatNames(value: unknown): Record<string, string> | undefined;
+/** Boot config degrades entry-by-entry; owner POST remains all-or-nothing. Never echo label contents in warnings. */
+export declare function loadSeatNames(value: unknown, warn: (reason: string) => void): Record<string, string>;
 export declare function applyOwnerSettings(patchYaml: string, changes: OwnerSettings): {
     yaml: string;
     restartNeeded: boolean;