@nelsonlongxiang/dsh-open-a2a-net 0.6.36 → 0.6.37

package/lib/types/peer-link-display.d.ts

@@ -0,0 +1,13 @@
+/** Host-specific badge projection only. Never use this to admit callers or choose CLI homes. */
+import type { A2aPeerCard } from './types.ts';
+export declare function peerLinkDisplay(peerUrl: string, d: {
+    readonly card: A2aPeerCard | undefined;
+    readonly ownUrl: string;
+    readonly seeds: readonly string[];
+    readonly refs: readonly string[];
+    readonly ownHandles: ReadonlySet<string>;
+    readonly cards: readonly A2aPeerCard[];
+}): {
+    link: 'linked' | 'stranger';
+    verified: boolean;
+};

package/lib/types/task-ledger-rows.d.ts

@@ -0,0 +1,341 @@
+/** Stateless ledger row types, classifiers and restore projections; moved verbatim for #258. */
+import { type AuthProof, type ChainRole, type SettlementReason, type SettlementVerdict, type TaskAuthorization } from './task-auth.ts';
+import type { ReceiptOutcomeV2 } from './receipt.ts';
+import type { ConservationSnapshot } from './ledger-conservation.ts';
+/**
+ * Caller-ended summaries (abandon / cancel) share one isolation law: late
+ * receipts never rewrite the verdict — they only stamp lateReceiptAt, and
+ * the projected outcome collapses to 'abandoned'.
+ */
+export declare const CALLER_ENDED_PREFIX: RegExp;
+/** Hard cap on the owed book (pending + dead-lettered rows, most recent first). */
+export declare const TASK_CAP = 64;
+/** Hard cap on the settled archive (most recent kept). */
+export declare const ARCHIVE_CAP = 64;
+/** Longest receipt summary kept on a record (multi-line outcomes collapse). */
+export declare const SUMMARY_CAP = 200;
+/**
+ * Longest dispatch brief kept per row. A ledger row without its payload is
+ * unreadable to supervision — "direct-8f3a1c2b → dsh/ec4ce7f8, 3h old" says
+ * nothing about whether to nudge, abandon, or read the receipt. The brief is
+ * the first non-empty line of the message, capped; the full body never enters
+ * the ledger (it can be arbitrarily large and may quote another session's log).
+ */
+export declare const BRIEF_CAP = 120;
+/** Reduce a dispatch body to one readable line: first non-empty line, collapsed, capped. */
+export declare function briefOf(message: string | undefined): string | undefined;
+/**
+ * Age at which an unsettled task auto-dead-letters. A dead row exits the
+ * owed view, disarms its async-nudge retry (a cold session cannot consume a
+ * re-steer anyway), and still accepts a late receipt from a revived target.
+ * Injectable per instance so tests can use short windows; sweeping stays
+ * lazy — every read/write entry point sweeps first.
+ */
+export declare const TASK_STALE_TTL_MS: number;
+/**
+ * The receipt correlation template now lives in `receipt.ts` (shared codec
+ * for header + v2 envelope line). This ledger consumes `parseReceipt` so
+ * human summaries and machine projections can never drift apart again.
+ */
+/** Lifecycle of a tracked outbound task inside the owed book. */
+export type TaskStatus = 'pending' | 'dead';
+/** F5 layer-3: why a dead row aged out (stamped by the sweep at flip time). */
+export type DeadReason = 'fire-forget' | 'unconsumed';
+/** gh#31: which archive path ended a row — a receipt, a content echo, or the caller. */
+export type ArchiveEnd = 'receipt' | 'echo' | 'abandoned' | 'cancelled' | 'evicted';
+export declare const ARCHIVE_ENDS: readonly string[];
+/** Summary marker {@link TaskLedger.resolveEcho} writes on echo-settled rows. */
+export declare const ECHO_SUMMARY = "(settled by content echo)";
+/**
+ * #114 S3: who really sent one outbound task — the routing session, the
+ * agent-less host face, or a native-teams bridge submitter. Before this
+ * field every outbound row was attributable only to the host ("home"), so
+ * same-host seats could not be told apart.
+ */
+export interface Sender {
+    readonly kind: 'session' | 'host' | 'bridge' | 'cli';
+    /**
+     * A session's `<zone>/<id8>` node team, the host process label, or the
+     * bridge submitter. Group senders by `kind:id`, never by `id` alone: a host
+     * label set by hand may look like a session handle.
+     */
+    readonly id: string;
+    /**
+     * Host senders only: the label the call borrowed on the wire when it
+     * differs from {@link id} (quick dispatch rides a live joined session's
+     * team). Display context, never a bucket key.
+     */
+    readonly face?: string;
+}
+/** Longest sender id kept; anything longer is malformed, not truncated. */
+export declare const SENDER_ID_CAP = 256;
+/**
+ * Restore-side allowlist for one persisted sender: a well-formed value comes
+ * back as a fresh object holding only kind, id and (when present) face; anything else is dropped whole (the row
+ * itself survives — a bad sender never costs the debt record).
+ * @param raw - the persisted value.
+ * @returns the sender, or undefined when absent or malformed.
+ */
+export declare function parseSender(raw: unknown): Sender | undefined;
+/**
+ * Spread helper for restore: `{ sender }` when the persisted value parses and
+ * the row is not inbound (an inbound row's originator is its caller, never a
+ * sender this host recorded), else nothing.
+ */
+export declare function withSender(raw: unknown, direction: unknown): {
+    sender?: Sender;
+};
+/**
+ * #114 S2: `{ auth }` when a persisted INBOUND row carries a record that
+ * parses whole (parseAuthorization) and belongs to THIS row — its target is
+ * the row's team and its receipt target the row's peer — else nothing: the
+ * row survives as a pre-S2 row, never with a partially adopted or borrowed
+ * record.
+ */
+export declare function withAuth(raw: unknown, entry: {
+    direction?: unknown;
+    team?: unknown;
+    peer?: unknown;
+}, now: number): {
+    auth?: TaskAuthorization;
+};
+/** Routing and answer facts copied unchanged between a row and its archive entry. */
+export declare function routingOf(row: Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt'>): Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt'>;
+/** #139: what an outbound row is born with besides its sender. */
+export interface OutboundBirth {
+    readonly forwarded?: true;
+    /** The local-candidate admission (ingress local); kept only on a row whose peer is 'local'. */
+    readonly auth?: TaskAuthorization;
+    readonly peerKey?: string;
+    readonly peerHost?: string;
+    readonly deliveredTo?: string;
+}
+/** The facts of one outbound birth that fit the row (see {@link withRouting} for the same shape on restore). */
+export declare function birthFacts(peer: string, birth: OutboundBirth | undefined): Pick<TaskRecord, 'auth' | 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded'>;
+/** Bound on a persisted routing fact; anything longer (or empty, or not a string) is dropped on restore. */
+export declare const ROUTING_FACT_CAP = 256;
+/**
+ * #139: restore-side allowlist for the routing facts. Each is kept only in
+ * its shape — a non-empty string within the cap — and the peer facts only on
+ * a remote outbound row; anything else is dropped (the row survives as one
+ * born before the fields, judged by current membership and origin).
+ */
+export declare function withRouting(entry: Record<string, unknown>): Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt'>;
+/** One tracked outbound task still in the owed book (unsettled). */
+export interface TaskRecord {
+    readonly taskId: string;
+    readonly team: string;
+    readonly peer: string;
+    readonly startedAt: number;
+    /**
+     * Which side of the wire this row serves: 'outbound' (this node sent and
+     * awaits a receipt) or 'inbound' (this node received and owes one).
+     * Absent on rows persisted before F2' — those are outbound by birth.
+     */
+    readonly direction?: 'inbound' | 'outbound';
+    /**
+     * F5: whether a receipt is actually owed. Absent ⇒ true (back-compat).
+     * `false` marks fire-and-forget deliveries — the caller's label could not
+     * receive a receipt at dispatch (process-form label), so no debt was born
+     * and supervision must not chase this row.
+     */
+    readonly receiptExpected?: boolean;
+    /** The conversation the delivery steered, for follow-up routes. */
+    readonly contextId?: string;
+    /**
+     * Head of the dispatched message (first non-empty line, {@link BRIEF_CAP}).
+     * What the row is ABOUT — the fact that makes the ledger readable without
+     * replaying the conversation. Absent on rows persisted before this field.
+     */
+    readonly brief?: string;
+    /** #114 S3: the real sender of an outbound row (absent on inbound rows and rows persisted before the field). */
+    readonly sender?: Sender;
+    /** Home host forwarded an online CLI request to a peer. */
+    readonly forwarded?: true;
+    /**
+     * #114 S2: the immutable authorization the row was born with — an inbound
+     * row's wire admission, or (#139) an outbound row's local-candidate
+     * admission (`ingress: 'local'`). Absent on remote outbound and older rows.
+     */
+    readonly auth?: TaskAuthorization;
+    /** #139: the public key of the peer card a remote outbound row was dispatched to. */
+    readonly peerKey?: string;
+    /** #139: that card's session label (the peer host's process label). */
+    readonly peerHost?: string;
+    /** #139: the member that actually received the task (canvas / bare-zone deliveries). */
+    readonly deliveredTo?: string;
+    /** Local target has produced an answer; still owed until receipt delivery/settlement, but no longer queued. */
+    answeredAt?: number;
+    status: TaskStatus;
+    /** When the row was swept to dead-letter (absent while pending). */
+    deadAt?: number;
+    /**
+     * F5 layer-3: why the row aged out. 'fire-forget' — a receiptExpected:false
+     * row expiring is expected bookkeeping, not a failure; 'unconsumed' — a
+     * receipt-owed row never settled, the actionable stale shape. Absent on
+     * dead rows persisted before this field (rendered as 'unspecified').
+     */
+    reason?: DeadReason;
+}
+/** One settled task kept for audit, with its receipt-correlated outcome. */
+export interface ArchivedRecord {
+    readonly taskId: string;
+    readonly team: string;
+    readonly peer: string;
+    readonly startedAt: number;
+    readonly contextId?: string;
+    readonly resolvedAt: number;
+    readonly summary?: string;
+    /** Head of the dispatched message that this row settled (see {@link TaskRecord.brief}). */
+    readonly brief?: string;
+    /** Controlled vocabulary verdict when the settling receipt carried a v2 envelope; forced 'abandoned' for caller-abandoned rows. */
+    readonly outcome?: ReceiptOutcomeV2 | 'abandoned';
+    /** Remote-turn wall-clock cost, when the settling envelope carried it. */
+    readonly elapsedMs?: number;
+    /**
+     * When a receipt arrived for an explicitly abandoned row ({@link TaskLedger.abandon}).
+     * Orphan isolation: the abandonment outcome stays verbatim; the late answer is
+     * recorded as metadata only, never promoted to resolution.
+     */
+    readonly lateReceiptAt?: number;
+    /**
+     * gh#31: which archive path ended the row, recorded at archive time. Absent
+     * on rows archived before the field — {@link archivedEndedBy} derives it.
+     */
+    readonly endedBy?: ArchiveEnd;
+    /** gh#31: which side of the wire the row served, copied from the owed row (absent on rows archived before the field). */
+    readonly direction?: 'inbound' | 'outbound';
+    /**
+     * gh#68: copied from the owed row when it awaited no receipt, so a tidied
+     * fire-forget expiry is not read as a send we gave up on. Only `false` is
+     * ever stored; absent means a receipt was owed (or the row predates the field).
+     */
+    readonly receiptExpected?: false;
+    /** #114 S3: copied from the owed row (absent on inbound rows and rows archived before the field). */
+    readonly sender?: Sender;
+    /** Home host forwarded an online CLI request to a peer. */
+    readonly forwarded?: true;
+    /** #114 S2: carried over from the live row unchanged. */
+    readonly auth?: TaskAuthorization;
+    /** #139: carried over from the live row unchanged (a late receipt is judged against them). */
+    readonly peerKey?: string;
+    readonly peerHost?: string;
+    readonly deliveredTo?: string;
+    /** Local answer time retained as audit metadata, independent of resolution time. */
+    readonly answeredAt?: number;
+    /** #114 S4: who settled the row (receipt and echo ends), and their chain role. */
+    readonly settledBy?: SettledBy;
+}
+/**
+ * How one archived row ended (gh#31). The recorded field wins; legacy rows
+ * fall back to the summary markers this ledger writes itself. The fallback
+ * reads a receipt-settled row's summary, which is the peer's text, so it is
+ * only as exact as the legacy data allows.
+ * @param row - the archived record.
+ * @returns the archive path that ended it.
+ */
+export declare function archivedEndedBy(row: ArchivedRecord): ArchiveEnd;
+/** Result of an explicit caller-side abandon. Total and never-thrown. */
+export type AbandonOutcome = 'cleared' | 'already-terminal' | 'unknown';
+/** Structured verdict for one {@link TaskLedger.abandon} call (consumer contract: idempotent). */
+export interface AbandonResult {
+    readonly outcome: AbandonOutcome;
+    readonly taskId: string;
+    /** Settle time: fresh abandonment's clock tick, or the already-settled row's original resolvedAt. */
+    readonly archivedAt?: number;
+}
+/** Result of a cooperative {@link TaskLedger.cancel}; adds routing facts for the notify half. */
+export interface CancelledResult extends AbandonResult {
+    /** Team the ended row addressed — the route layer reaches a live local target through it. */
+    readonly team?: string;
+    readonly contextId?: string;
+}
+/** Per-instance knobs; defaults come from the exported constants. */
+export interface TaskLedgerOptions {
+    /** Stale-TTL override (tests inject short windows); defaults to {@link TASK_STALE_TTL_MS}. */
+    staleTtlMs?: number;
+    /** Archive capacity override; defaults to {@link ARCHIVE_CAP}. */
+    archiveCap?: number;
+    /**
+     * Clock injection for tests: every sweep/TTL decision reads the time from
+     * here. Defaults to Date.now. Injecting a steppable clock makes the stale
+     * transition deterministic - no real sleeps to race under load.
+     */
+    now?: () => number;
+}
+/**
+ * What one correlated receipt settled — the payload of the
+ * `a2a/receipt-resolved` event, emitted for consumers that react to receipt
+ * arrivals (P2: native-teams settles its outstanding async submissions from
+ * this seam). `outcome` carries the v2 envelope's controlled-vocabulary
+ * verdict when the receipt rode one; `late` marks a receipt answering a
+ * dead-lettered row (revival) or an abandoned row (arrival recorded) — a
+ * healthy row's duplicate receipt refreshes the archive with NO marker.
+ */
+export interface ReceiptResolvedInfo {
+    readonly taskId: string;
+    /** The team the task was routed to (as the dispatcher recorded it). */
+    readonly team: string;
+    /** The peer (or `'local'`) the task was dispatched through. */
+    readonly peer: string;
+    /** v2 envelope outcome, when the receipt rode one. */
+    readonly outcome?: string;
+    /** One-line outcome summary, when the receipt carried one. */
+    readonly summary?: string;
+    /** True when the receipt answered a dead-lettered or abandoned row. */
+    readonly late?: boolean;
+}
+/** The persisted ledger document: the owed book plus its settled archive. */
+export interface TaskLedgerSnapshot {
+    readonly tasks: readonly TaskRecord[];
+    readonly archived?: readonly ArchivedRecord[];
+    /** #114 S4: the bounded ring of refused / would-be-refused settlements. */
+    readonly settlementRefusals?: readonly SettlementRefusalRecord[];
+    /** #114 S4: monotonic count of every refusal noted. */
+    readonly settlementRefusalsTotal?: number;
+    /** gh#154: lifetime conservation counters (persisted; absent = pre-#154 legacy) — the module contract, shared by classifier, counters, and this schema (review P3). */
+    readonly conservation?: ConservationSnapshot;
+}
+/** #114 S4: who settled an archived row, and how they stood on its authorization chain. */
+export interface SettledBy {
+    readonly caller: string;
+    readonly chain_role: ChainRole | 'off-chain';
+}
+/** #114 S4: one settlement the judgement refused (enforce) or would have refused (observe). */
+export interface SettlementRefusalRecord {
+    readonly taskId: string;
+    readonly at: number;
+    readonly settler: {
+        readonly caller: string;
+        readonly proof: AuthProof;
+        readonly ingress: 'wire' | 'local';
+    };
+    readonly reason: SettlementReason;
+    /** The receipt's first line, bounded. */
+    readonly head: string;
+    /** true: the settlement was refused (enforce); false: recorded only (observe). */
+    readonly enforced: boolean;
+    /** Repeats of the same (task, settler, reason) folded into this entry, so a flood cannot push older evidence out (review of PR #140 P2-4). */
+    readonly count: number;
+}
+/** Bound on ids and callers kept in settlement records; longer values are cut on write and refused on restore. */
+export declare const SETTLEMENT_ID_CAP = 256;
+/** Bound of the refusal ring (design §4.4). */
+export declare const SETTLEMENT_REFUSAL_CAP = 64;
+/**
+ * #114 S4: how the ledger asks whether a settler may settle a row. `check`
+ * is the pure judgement (task-auth.ts judgeSettlement) bound to this
+ * receipt's facts; `enforce` decides whether an off-chain verdict blocks
+ * the settlement or is only recorded.
+ */
+export interface SettlementJudge {
+    readonly enforce: boolean;
+    readonly settler: SettlementRefusalRecord['settler'];
+    check(row: Pick<TaskRecord, 'team' | 'peer' | 'direction' | 'auth' | 'peerKey' | 'peerHost' | 'deliveredTo'>, echo: boolean): SettlementVerdict;
+}
+/** Restore-side allowlist for settledBy: whole or nothing. */
+export declare function withSettledBy(raw: unknown): {
+    settledBy?: SettledBy;
+};
+/** Restore-side allowlist for one refusal record: whole or nothing. */
+export declare function parseRefusal(raw: unknown): SettlementRefusalRecord | undefined;

package/lib/types/task-ledger.d.ts

@@ -18,294 +18,10 @@
  * illusion: settlements vanished while debts piled up).
  * @module @nelsonlongxiang/dsh-open-a2a-net/task-ledger
  */
-import { type AuthProof, type ChainRole, type SettlementReason, type SettlementVerdict, type TaskAuthorization } from './task-auth.ts';
-import { type ReceiptOutcomeV2 } from './receipt.ts';
-import { type ConservationSnapshot, type ConservationVerdict } from './ledger-conservation.ts';
-/** Hard cap on the owed book (pending + dead-lettered rows, most recent first). */
-export declare const TASK_CAP = 64;
-/** Hard cap on the settled archive (most recent kept). */
-export declare const ARCHIVE_CAP = 64;
-/** Longest receipt summary kept on a record (multi-line outcomes collapse). */
-export declare const SUMMARY_CAP = 200;
-/**
- * Longest dispatch brief kept per row. A ledger row without its payload is
- * unreadable to supervision — "direct-8f3a1c2b → dsh/ec4ce7f8, 3h old" says
- * nothing about whether to nudge, abandon, or read the receipt. The brief is
- * the first non-empty line of the message, capped; the full body never enters
- * the ledger (it can be arbitrarily large and may quote another session's log).
- */
-export declare const BRIEF_CAP = 120;
-/** Reduce a dispatch body to one readable line: first non-empty line, collapsed, capped. */
-export declare function briefOf(message: string | undefined): string | undefined;
-/**
- * Age at which an unsettled task auto-dead-letters. A dead row exits the
- * owed view, disarms its async-nudge retry (a cold session cannot consume a
- * re-steer anyway), and still accepts a late receipt from a revived target.
- * Injectable per instance so tests can use short windows; sweeping stays
- * lazy — every read/write entry point sweeps first.
- */
-export declare const TASK_STALE_TTL_MS: number;
-/**
- * The receipt correlation template now lives in `receipt.ts` (shared codec
- * for header + v2 envelope line). This ledger consumes `parseReceipt` so
- * human summaries and machine projections can never drift apart again.
- */
-/** Lifecycle of a tracked outbound task inside the owed book. */
-export type TaskStatus = 'pending' | 'dead';
-/** F5 layer-3: why a dead row aged out (stamped by the sweep at flip time). */
-export type DeadReason = 'fire-forget' | 'unconsumed';
-/** gh#31: which archive path ended a row — a receipt, a content echo, or the caller. */
-export type ArchiveEnd = 'receipt' | 'echo' | 'abandoned' | 'cancelled' | 'evicted';
-/**
- * #114 S3: who really sent one outbound task — the routing session, the
- * agent-less host face, or a native-teams bridge submitter. Before this
- * field every outbound row was attributable only to the host ("home"), so
- * same-host seats could not be told apart.
- */
-export interface Sender {
-    readonly kind: 'session' | 'host' | 'bridge' | 'cli';
-    /**
-     * A session's `<zone>/<id8>` node team, the host process label, or the
-     * bridge submitter. Group senders by `kind:id`, never by `id` alone: a host
-     * label set by hand may look like a session handle.
-     */
-    readonly id: string;
-    /**
-     * Host senders only: the label the call borrowed on the wire when it
-     * differs from {@link id} (quick dispatch rides a live joined session's
-     * team). Display context, never a bucket key.
-     */
-    readonly face?: string;
-}
-/** Longest sender id kept; anything longer is malformed, not truncated. */
-export declare const SENDER_ID_CAP = 256;
-/**
- * Restore-side allowlist for one persisted sender: a well-formed value comes
- * back as a fresh object holding only kind, id and (when present) face; anything else is dropped whole (the row
- * itself survives — a bad sender never costs the debt record).
- * @param raw - the persisted value.
- * @returns the sender, or undefined when absent or malformed.
- */
-export declare function parseSender(raw: unknown): Sender | undefined;
-/** #139: what an outbound row is born with besides its sender. */
-export interface OutboundBirth {
-    readonly forwarded?: true;
-    /** The local-candidate admission (ingress local); kept only on a row whose peer is 'local'. */
-    readonly auth?: TaskAuthorization;
-    readonly peerKey?: string;
-    readonly peerHost?: string;
-    readonly deliveredTo?: string;
-}
-/** One tracked outbound task still in the owed book (unsettled). */
-export interface TaskRecord {
-    readonly taskId: string;
-    readonly team: string;
-    readonly peer: string;
-    readonly startedAt: number;
-    /**
-     * Which side of the wire this row serves: 'outbound' (this node sent and
-     * awaits a receipt) or 'inbound' (this node received and owes one).
-     * Absent on rows persisted before F2' — those are outbound by birth.
-     */
-    readonly direction?: 'inbound' | 'outbound';
-    /**
-     * F5: whether a receipt is actually owed. Absent ⇒ true (back-compat).
-     * `false` marks fire-and-forget deliveries — the caller's label could not
-     * receive a receipt at dispatch (process-form label), so no debt was born
-     * and supervision must not chase this row.
-     */
-    readonly receiptExpected?: boolean;
-    /** The conversation the delivery steered, for follow-up routes. */
-    readonly contextId?: string;
-    /**
-     * Head of the dispatched message (first non-empty line, {@link BRIEF_CAP}).
-     * What the row is ABOUT — the fact that makes the ledger readable without
-     * replaying the conversation. Absent on rows persisted before this field.
-     */
-    readonly brief?: string;
-    /** #114 S3: the real sender of an outbound row (absent on inbound rows and rows persisted before the field). */
-    readonly sender?: Sender;
-    /** Home host forwarded an online CLI request to a peer. */
-    readonly forwarded?: true;
-    /**
-     * #114 S2: the immutable authorization the row was born with — an inbound
-     * row's wire admission, or (#139) an outbound row's local-candidate
-     * admission (`ingress: 'local'`). Absent on remote outbound and older rows.
-     */
-    readonly auth?: TaskAuthorization;
-    /** #139: the public key of the peer card a remote outbound row was dispatched to. */
-    readonly peerKey?: string;
-    /** #139: that card's session label (the peer host's process label). */
-    readonly peerHost?: string;
-    /** #139: the member that actually received the task (canvas / bare-zone deliveries). */
-    readonly deliveredTo?: string;
-    /** Local target has produced an answer; still owed until receipt delivery/settlement, but no longer queued. */
-    answeredAt?: number;
-    status: TaskStatus;
-    /** When the row was swept to dead-letter (absent while pending). */
-    deadAt?: number;
-    /**
-     * F5 layer-3: why the row aged out. 'fire-forget' — a receiptExpected:false
-     * row expiring is expected bookkeeping, not a failure; 'unconsumed' — a
-     * receipt-owed row never settled, the actionable stale shape. Absent on
-     * dead rows persisted before this field (rendered as 'unspecified').
-     */
-    reason?: DeadReason;
-}
-/** One settled task kept for audit, with its receipt-correlated outcome. */
-export interface ArchivedRecord {
-    readonly taskId: string;
-    readonly team: string;
-    readonly peer: string;
-    readonly startedAt: number;
-    readonly contextId?: string;
-    readonly resolvedAt: number;
-    readonly summary?: string;
-    /** Head of the dispatched message that this row settled (see {@link TaskRecord.brief}). */
-    readonly brief?: string;
-    /** Controlled vocabulary verdict when the settling receipt carried a v2 envelope; forced 'abandoned' for caller-abandoned rows. */
-    readonly outcome?: ReceiptOutcomeV2 | 'abandoned';
-    /** Remote-turn wall-clock cost, when the settling envelope carried it. */
-    readonly elapsedMs?: number;
-    /**
-     * When a receipt arrived for an explicitly abandoned row ({@link TaskLedger.abandon}).
-     * Orphan isolation: the abandonment outcome stays verbatim; the late answer is
-     * recorded as metadata only, never promoted to resolution.
-     */
-    readonly lateReceiptAt?: number;
-    /**
-     * gh#31: which archive path ended the row, recorded at archive time. Absent
-     * on rows archived before the field — {@link archivedEndedBy} derives it.
-     */
-    readonly endedBy?: ArchiveEnd;
-    /** gh#31: which side of the wire the row served, copied from the owed row (absent on rows archived before the field). */
-    readonly direction?: 'inbound' | 'outbound';
-    /**
-     * gh#68: copied from the owed row when it awaited no receipt, so a tidied
-     * fire-forget expiry is not read as a send we gave up on. Only `false` is
-     * ever stored; absent means a receipt was owed (or the row predates the field).
-     */
-    readonly receiptExpected?: false;
-    /** #114 S3: copied from the owed row (absent on inbound rows and rows archived before the field). */
-    readonly sender?: Sender;
-    /** Home host forwarded an online CLI request to a peer. */
-    readonly forwarded?: true;
-    /** #114 S2: carried over from the live row unchanged. */
-    readonly auth?: TaskAuthorization;
-    /** #139: carried over from the live row unchanged (a late receipt is judged against them). */
-    readonly peerKey?: string;
-    readonly peerHost?: string;
-    readonly deliveredTo?: string;
-    /** Local answer time retained as audit metadata, independent of resolution time. */
-    readonly answeredAt?: number;
-    /** #114 S4: who settled the row (receipt and echo ends), and their chain role. */
-    readonly settledBy?: SettledBy;
-}
-/**
- * How one archived row ended (gh#31). The recorded field wins; legacy rows
- * fall back to the summary markers this ledger writes itself. The fallback
- * reads a receipt-settled row's summary, which is the peer's text, so it is
- * only as exact as the legacy data allows.
- * @param row - the archived record.
- * @returns the archive path that ended it.
- */
-export declare function archivedEndedBy(row: ArchivedRecord): ArchiveEnd;
-/** Result of an explicit caller-side abandon. Total and never-thrown. */
-export type AbandonOutcome = 'cleared' | 'already-terminal' | 'unknown';
-/** Structured verdict for one {@link TaskLedger.abandon} call (consumer contract: idempotent). */
-export interface AbandonResult {
-    readonly outcome: AbandonOutcome;
-    readonly taskId: string;
-    /** Settle time: fresh abandonment's clock tick, or the already-settled row's original resolvedAt. */
-    readonly archivedAt?: number;
-}
-/** Result of a cooperative {@link TaskLedger.cancel}; adds routing facts for the notify half. */
-export interface CancelledResult extends AbandonResult {
-    /** Team the ended row addressed — the route layer reaches a live local target through it. */
-    readonly team?: string;
-    readonly contextId?: string;
-}
-/** Per-instance knobs; defaults come from the exported constants. */
-export interface TaskLedgerOptions {
-    /** Stale-TTL override (tests inject short windows); defaults to {@link TASK_STALE_TTL_MS}. */
-    staleTtlMs?: number;
-    /** Archive capacity override; defaults to {@link ARCHIVE_CAP}. */
-    archiveCap?: number;
-    /**
-     * Clock injection for tests: every sweep/TTL decision reads the time from
-     * here. Defaults to Date.now. Injecting a steppable clock makes the stale
-     * transition deterministic - no real sleeps to race under load.
-     */
-    now?: () => number;
-}
-/**
- * What one correlated receipt settled — the payload of the
- * `a2a/receipt-resolved` event, emitted for consumers that react to receipt
- * arrivals (P2: native-teams settles its outstanding async submissions from
- * this seam). `outcome` carries the v2 envelope's controlled-vocabulary
- * verdict when the receipt rode one; `late` marks a receipt answering a
- * dead-lettered row (revival) or an abandoned row (arrival recorded) — a
- * healthy row's duplicate receipt refreshes the archive with NO marker.
- */
-export interface ReceiptResolvedInfo {
-    readonly taskId: string;
-    /** The team the task was routed to (as the dispatcher recorded it). */
-    readonly team: string;
-    /** The peer (or `'local'`) the task was dispatched through. */
-    readonly peer: string;
-    /** v2 envelope outcome, when the receipt rode one. */
-    readonly outcome?: string;
-    /** One-line outcome summary, when the receipt carried one. */
-    readonly summary?: string;
-    /** True when the receipt answered a dead-lettered or abandoned row. */
-    readonly late?: boolean;
-}
-/** The persisted ledger document: the owed book plus its settled archive. */
-export interface TaskLedgerSnapshot {
-    readonly tasks: readonly TaskRecord[];
-    readonly archived?: readonly ArchivedRecord[];
-    /** #114 S4: the bounded ring of refused / would-be-refused settlements. */
-    readonly settlementRefusals?: readonly SettlementRefusalRecord[];
-    /** #114 S4: monotonic count of every refusal noted. */
-    readonly settlementRefusalsTotal?: number;
-    /** gh#154: lifetime conservation counters (persisted; absent = pre-#154 legacy) — the module contract, shared by classifier, counters, and this schema (review P3). */
-    readonly conservation?: ConservationSnapshot;
-}
-/** #114 S4: who settled an archived row, and how they stood on its authorization chain. */
-export interface SettledBy {
-    readonly caller: string;
-    readonly chain_role: ChainRole | 'off-chain';
-}
-/** #114 S4: one settlement the judgement refused (enforce) or would have refused (observe). */
-export interface SettlementRefusalRecord {
-    readonly taskId: string;
-    readonly at: number;
-    readonly settler: {
-        readonly caller: string;
-        readonly proof: AuthProof;
-        readonly ingress: 'wire' | 'local';
-    };
-    readonly reason: SettlementReason;
-    /** The receipt's first line, bounded. */
-    readonly head: string;
-    /** true: the settlement was refused (enforce); false: recorded only (observe). */
-    readonly enforced: boolean;
-    /** Repeats of the same (task, settler, reason) folded into this entry, so a flood cannot push older evidence out (review of PR #140 P2-4). */
-    readonly count: number;
-}
-/** Bound of the refusal ring (design §4.4). */
-export declare const SETTLEMENT_REFUSAL_CAP = 64;
-/**
- * #114 S4: how the ledger asks whether a settler may settle a row. `check`
- * is the pure judgement (task-auth.ts judgeSettlement) bound to this
- * receipt's facts; `enforce` decides whether an off-chain verdict blocks
- * the settlement or is only recorded.
- */
-export interface SettlementJudge {
-    readonly enforce: boolean;
-    readonly settler: SettlementRefusalRecord['settler'];
-    check(row: Pick<TaskRecord, 'team' | 'peer' | 'direction' | 'auth' | 'peerKey' | 'peerHost' | 'deliveredTo'>, echo: boolean): SettlementVerdict;
-}
+import type { TaskAuthorization } from './task-auth.ts';
+import { type ConservationVerdict } from './ledger-conservation.ts';
+import type { TaskRecord, ArchivedRecord, Sender, OutboundBirth, TaskLedgerOptions, ReceiptResolvedInfo, SettlementRefusalRecord, SettlementJudge, AbandonResult, CancelledResult } from './task-ledger-rows.ts';
+export * from './task-ledger-rows.ts';
 /**
  * Bounded outbound-task ledger with whole-file persistence. Pure of any
  * routing knowledge: callers {@link track} a task when a route leaves it

package/lib/types/tools/info.d.ts

@@ -17,6 +17,7 @@ export type DirectoryTeamRow = {
     team: string;
     session: string;
     name: string;
+    seatName?: string;
     description: string;
     local?: boolean;
     origin?: string;
@@ -67,6 +68,7 @@ export interface InfoToolsDeps {
     readonly sessionTeamOf: (agent: Agent) => string;
     readonly nodeMetadataOf: (agent: Agent) => {
         name: string;
+        seatName?: string;
         description: string;
         workspace?: string;
     };