@nelsonlongxiang/dsh-open-a2a-net 0.6.36 → 0.6.38

package/lib/types/task-ledger.d.ts

@@ -18,294 +18,10 @@
  * illusion: settlements vanished while debts piled up).
  * @module @nelsonlongxiang/dsh-open-a2a-net/task-ledger
  */
-import { type AuthProof, type ChainRole, type SettlementReason, type SettlementVerdict, type TaskAuthorization } from './task-auth.ts';
-import { type ReceiptOutcomeV2 } from './receipt.ts';
-import { type ConservationSnapshot, type ConservationVerdict } from './ledger-conservation.ts';
-/** Hard cap on the owed book (pending + dead-lettered rows, most recent first). */
-export declare const TASK_CAP = 64;
-/** Hard cap on the settled archive (most recent kept). */
-export declare const ARCHIVE_CAP = 64;
-/** Longest receipt summary kept on a record (multi-line outcomes collapse). */
-export declare const SUMMARY_CAP = 200;
-/**
- * Longest dispatch brief kept per row. A ledger row without its payload is
- * unreadable to supervision — "direct-8f3a1c2b → dsh/ec4ce7f8, 3h old" says
- * nothing about whether to nudge, abandon, or read the receipt. The brief is
- * the first non-empty line of the message, capped; the full body never enters
- * the ledger (it can be arbitrarily large and may quote another session's log).
- */
-export declare const BRIEF_CAP = 120;
-/** Reduce a dispatch body to one readable line: first non-empty line, collapsed, capped. */
-export declare function briefOf(message: string | undefined): string | undefined;
-/**
- * Age at which an unsettled task auto-dead-letters. A dead row exits the
- * owed view, disarms its async-nudge retry (a cold session cannot consume a
- * re-steer anyway), and still accepts a late receipt from a revived target.
- * Injectable per instance so tests can use short windows; sweeping stays
- * lazy — every read/write entry point sweeps first.
- */
-export declare const TASK_STALE_TTL_MS: number;
-/**
- * The receipt correlation template now lives in `receipt.ts` (shared codec
- * for header + v2 envelope line). This ledger consumes `parseReceipt` so
- * human summaries and machine projections can never drift apart again.
- */
-/** Lifecycle of a tracked outbound task inside the owed book. */
-export type TaskStatus = 'pending' | 'dead';
-/** F5 layer-3: why a dead row aged out (stamped by the sweep at flip time). */
-export type DeadReason = 'fire-forget' | 'unconsumed';
-/** gh#31: which archive path ended a row — a receipt, a content echo, or the caller. */
-export type ArchiveEnd = 'receipt' | 'echo' | 'abandoned' | 'cancelled' | 'evicted';
-/**
- * #114 S3: who really sent one outbound task — the routing session, the
- * agent-less host face, or a native-teams bridge submitter. Before this
- * field every outbound row was attributable only to the host ("home"), so
- * same-host seats could not be told apart.
- */
-export interface Sender {
-    readonly kind: 'session' | 'host' | 'bridge' | 'cli';
-    /**
-     * A session's `<zone>/<id8>` node team, the host process label, or the
-     * bridge submitter. Group senders by `kind:id`, never by `id` alone: a host
-     * label set by hand may look like a session handle.
-     */
-    readonly id: string;
-    /**
-     * Host senders only: the label the call borrowed on the wire when it
-     * differs from {@link id} (quick dispatch rides a live joined session's
-     * team). Display context, never a bucket key.
-     */
-    readonly face?: string;
-}
-/** Longest sender id kept; anything longer is malformed, not truncated. */
-export declare const SENDER_ID_CAP = 256;
-/**
- * Restore-side allowlist for one persisted sender: a well-formed value comes
- * back as a fresh object holding only kind, id and (when present) face; anything else is dropped whole (the row
- * itself survives — a bad sender never costs the debt record).
- * @param raw - the persisted value.
- * @returns the sender, or undefined when absent or malformed.
- */
-export declare function parseSender(raw: unknown): Sender | undefined;
-/** #139: what an outbound row is born with besides its sender. */
-export interface OutboundBirth {
-    readonly forwarded?: true;
-    /** The local-candidate admission (ingress local); kept only on a row whose peer is 'local'. */
-    readonly auth?: TaskAuthorization;
-    readonly peerKey?: string;
-    readonly peerHost?: string;
-    readonly deliveredTo?: string;
-}
-/** One tracked outbound task still in the owed book (unsettled). */
-export interface TaskRecord {
-    readonly taskId: string;
-    readonly team: string;
-    readonly peer: string;
-    readonly startedAt: number;
-    /**
-     * Which side of the wire this row serves: 'outbound' (this node sent and
-     * awaits a receipt) or 'inbound' (this node received and owes one).
-     * Absent on rows persisted before F2' — those are outbound by birth.
-     */
-    readonly direction?: 'inbound' | 'outbound';
-    /**
-     * F5: whether a receipt is actually owed. Absent ⇒ true (back-compat).
-     * `false` marks fire-and-forget deliveries — the caller's label could not
-     * receive a receipt at dispatch (process-form label), so no debt was born
-     * and supervision must not chase this row.
-     */
-    readonly receiptExpected?: boolean;
-    /** The conversation the delivery steered, for follow-up routes. */
-    readonly contextId?: string;
-    /**
-     * Head of the dispatched message (first non-empty line, {@link BRIEF_CAP}).
-     * What the row is ABOUT — the fact that makes the ledger readable without
-     * replaying the conversation. Absent on rows persisted before this field.
-     */
-    readonly brief?: string;
-    /** #114 S3: the real sender of an outbound row (absent on inbound rows and rows persisted before the field). */
-    readonly sender?: Sender;
-    /** Home host forwarded an online CLI request to a peer. */
-    readonly forwarded?: true;
-    /**
-     * #114 S2: the immutable authorization the row was born with — an inbound
-     * row's wire admission, or (#139) an outbound row's local-candidate
-     * admission (`ingress: 'local'`). Absent on remote outbound and older rows.
-     */
-    readonly auth?: TaskAuthorization;
-    /** #139: the public key of the peer card a remote outbound row was dispatched to. */
-    readonly peerKey?: string;
-    /** #139: that card's session label (the peer host's process label). */
-    readonly peerHost?: string;
-    /** #139: the member that actually received the task (canvas / bare-zone deliveries). */
-    readonly deliveredTo?: string;
-    /** Local target has produced an answer; still owed until receipt delivery/settlement, but no longer queued. */
-    answeredAt?: number;
-    status: TaskStatus;
-    /** When the row was swept to dead-letter (absent while pending). */
-    deadAt?: number;
-    /**
-     * F5 layer-3: why the row aged out. 'fire-forget' — a receiptExpected:false
-     * row expiring is expected bookkeeping, not a failure; 'unconsumed' — a
-     * receipt-owed row never settled, the actionable stale shape. Absent on
-     * dead rows persisted before this field (rendered as 'unspecified').
-     */
-    reason?: DeadReason;
-}
-/** One settled task kept for audit, with its receipt-correlated outcome. */
-export interface ArchivedRecord {
-    readonly taskId: string;
-    readonly team: string;
-    readonly peer: string;
-    readonly startedAt: number;
-    readonly contextId?: string;
-    readonly resolvedAt: number;
-    readonly summary?: string;
-    /** Head of the dispatched message that this row settled (see {@link TaskRecord.brief}). */
-    readonly brief?: string;
-    /** Controlled vocabulary verdict when the settling receipt carried a v2 envelope; forced 'abandoned' for caller-abandoned rows. */
-    readonly outcome?: ReceiptOutcomeV2 | 'abandoned';
-    /** Remote-turn wall-clock cost, when the settling envelope carried it. */
-    readonly elapsedMs?: number;
-    /**
-     * When a receipt arrived for an explicitly abandoned row ({@link TaskLedger.abandon}).
-     * Orphan isolation: the abandonment outcome stays verbatim; the late answer is
-     * recorded as metadata only, never promoted to resolution.
-     */
-    readonly lateReceiptAt?: number;
-    /**
-     * gh#31: which archive path ended the row, recorded at archive time. Absent
-     * on rows archived before the field — {@link archivedEndedBy} derives it.
-     */
-    readonly endedBy?: ArchiveEnd;
-    /** gh#31: which side of the wire the row served, copied from the owed row (absent on rows archived before the field). */
-    readonly direction?: 'inbound' | 'outbound';
-    /**
-     * gh#68: copied from the owed row when it awaited no receipt, so a tidied
-     * fire-forget expiry is not read as a send we gave up on. Only `false` is
-     * ever stored; absent means a receipt was owed (or the row predates the field).
-     */
-    readonly receiptExpected?: false;
-    /** #114 S3: copied from the owed row (absent on inbound rows and rows archived before the field). */
-    readonly sender?: Sender;
-    /** Home host forwarded an online CLI request to a peer. */
-    readonly forwarded?: true;
-    /** #114 S2: carried over from the live row unchanged. */
-    readonly auth?: TaskAuthorization;
-    /** #139: carried over from the live row unchanged (a late receipt is judged against them). */
-    readonly peerKey?: string;
-    readonly peerHost?: string;
-    readonly deliveredTo?: string;
-    /** Local answer time retained as audit metadata, independent of resolution time. */
-    readonly answeredAt?: number;
-    /** #114 S4: who settled the row (receipt and echo ends), and their chain role. */
-    readonly settledBy?: SettledBy;
-}
-/**
- * How one archived row ended (gh#31). The recorded field wins; legacy rows
- * fall back to the summary markers this ledger writes itself. The fallback
- * reads a receipt-settled row's summary, which is the peer's text, so it is
- * only as exact as the legacy data allows.
- * @param row - the archived record.
- * @returns the archive path that ended it.
- */
-export declare function archivedEndedBy(row: ArchivedRecord): ArchiveEnd;
-/** Result of an explicit caller-side abandon. Total and never-thrown. */
-export type AbandonOutcome = 'cleared' | 'already-terminal' | 'unknown';
-/** Structured verdict for one {@link TaskLedger.abandon} call (consumer contract: idempotent). */
-export interface AbandonResult {
-    readonly outcome: AbandonOutcome;
-    readonly taskId: string;
-    /** Settle time: fresh abandonment's clock tick, or the already-settled row's original resolvedAt. */
-    readonly archivedAt?: number;
-}
-/** Result of a cooperative {@link TaskLedger.cancel}; adds routing facts for the notify half. */
-export interface CancelledResult extends AbandonResult {
-    /** Team the ended row addressed — the route layer reaches a live local target through it. */
-    readonly team?: string;
-    readonly contextId?: string;
-}
-/** Per-instance knobs; defaults come from the exported constants. */
-export interface TaskLedgerOptions {
-    /** Stale-TTL override (tests inject short windows); defaults to {@link TASK_STALE_TTL_MS}. */
-    staleTtlMs?: number;
-    /** Archive capacity override; defaults to {@link ARCHIVE_CAP}. */
-    archiveCap?: number;
-    /**
-     * Clock injection for tests: every sweep/TTL decision reads the time from
-     * here. Defaults to Date.now. Injecting a steppable clock makes the stale
-     * transition deterministic - no real sleeps to race under load.
-     */
-    now?: () => number;
-}
-/**
- * What one correlated receipt settled — the payload of the
- * `a2a/receipt-resolved` event, emitted for consumers that react to receipt
- * arrivals (P2: native-teams settles its outstanding async submissions from
- * this seam). `outcome` carries the v2 envelope's controlled-vocabulary
- * verdict when the receipt rode one; `late` marks a receipt answering a
- * dead-lettered row (revival) or an abandoned row (arrival recorded) — a
- * healthy row's duplicate receipt refreshes the archive with NO marker.
- */
-export interface ReceiptResolvedInfo {
-    readonly taskId: string;
-    /** The team the task was routed to (as the dispatcher recorded it). */
-    readonly team: string;
-    /** The peer (or `'local'`) the task was dispatched through. */
-    readonly peer: string;
-    /** v2 envelope outcome, when the receipt rode one. */
-    readonly outcome?: string;
-    /** One-line outcome summary, when the receipt carried one. */
-    readonly summary?: string;
-    /** True when the receipt answered a dead-lettered or abandoned row. */
-    readonly late?: boolean;
-}
-/** The persisted ledger document: the owed book plus its settled archive. */
-export interface TaskLedgerSnapshot {
-    readonly tasks: readonly TaskRecord[];
-    readonly archived?: readonly ArchivedRecord[];
-    /** #114 S4: the bounded ring of refused / would-be-refused settlements. */
-    readonly settlementRefusals?: readonly SettlementRefusalRecord[];
-    /** #114 S4: monotonic count of every refusal noted. */
-    readonly settlementRefusalsTotal?: number;
-    /** gh#154: lifetime conservation counters (persisted; absent = pre-#154 legacy) — the module contract, shared by classifier, counters, and this schema (review P3). */
-    readonly conservation?: ConservationSnapshot;
-}
-/** #114 S4: who settled an archived row, and how they stood on its authorization chain. */
-export interface SettledBy {
-    readonly caller: string;
-    readonly chain_role: ChainRole | 'off-chain';
-}
-/** #114 S4: one settlement the judgement refused (enforce) or would have refused (observe). */
-export interface SettlementRefusalRecord {
-    readonly taskId: string;
-    readonly at: number;
-    readonly settler: {
-        readonly caller: string;
-        readonly proof: AuthProof;
-        readonly ingress: 'wire' | 'local';
-    };
-    readonly reason: SettlementReason;
-    /** The receipt's first line, bounded. */
-    readonly head: string;
-    /** true: the settlement was refused (enforce); false: recorded only (observe). */
-    readonly enforced: boolean;
-    /** Repeats of the same (task, settler, reason) folded into this entry, so a flood cannot push older evidence out (review of PR #140 P2-4). */
-    readonly count: number;
-}
-/** Bound of the refusal ring (design §4.4). */
-export declare const SETTLEMENT_REFUSAL_CAP = 64;
-/**
- * #114 S4: how the ledger asks whether a settler may settle a row. `check`
- * is the pure judgement (task-auth.ts judgeSettlement) bound to this
- * receipt's facts; `enforce` decides whether an off-chain verdict blocks
- * the settlement or is only recorded.
- */
-export interface SettlementJudge {
-    readonly enforce: boolean;
-    readonly settler: SettlementRefusalRecord['settler'];
-    check(row: Pick<TaskRecord, 'team' | 'peer' | 'direction' | 'auth' | 'peerKey' | 'peerHost' | 'deliveredTo'>, echo: boolean): SettlementVerdict;
-}
+import type { TaskAuthorization } from './task-auth.ts';
+import { type ConservationVerdict } from './ledger-conservation.ts';
+import type { TaskRecord, ArchivedRecord, Sender, OutboundBirth, TaskLedgerOptions, ReceiptResolvedInfo, SettlementRefusalRecord, SettlementJudge, AbandonResult, CancelledResult } from './task-ledger-rows.ts';
+export * from './task-ledger-rows.ts';
 /**
  * Bounded outbound-task ledger with whole-file persistence. Pure of any
  * routing knowledge: callers {@link track} a task when a route leaves it
@@ -328,6 +44,7 @@ export declare class TaskLedger {
     private readonly archiveCap;
     /** Injectable clock (option `now`). */
     private readonly now;
+    private readonly warn;
     /**
      * @param path - persistence file (`<dsh-home>/a2a/tasks.json`); empty = no persistence.
      * @param options - TTL/capacity overrides; defaults come from the exported constants.
@@ -339,6 +56,8 @@ export declare class TaskLedger {
      * @returns the owed-book records.
      */
     list(): readonly TaskRecord[];
+    /** #275: old forwarded canvas debts cannot be safely upgraded by inventing receiver authority. */
+    settlementEnforceBlockers(): string[];
     /**
      * The settled archive, most recently resolved first. Rows land here the
      * moment their receipt correlates and stay until the archive cap evicts

package/lib/types/tools/info.d.ts

@@ -17,6 +17,10 @@ export type DirectoryTeamRow = {
     team: string;
     session: string;
     name: string;
+    seatName?: string;
+    kind?: 'canvas';
+    owner?: string;
+    memberCount?: number;
     description: string;
     local?: boolean;
     origin?: string;
@@ -67,6 +71,7 @@ export interface InfoToolsDeps {
     readonly sessionTeamOf: (agent: Agent) => string;
     readonly nodeMetadataOf: (agent: Agent) => {
         name: string;
+        seatName?: string;
         description: string;
         workspace?: string;
     };

package/lib/types/types.d.ts

@@ -72,8 +72,9 @@ export interface A2aPeerCard {
 export interface A2aSessionTeamInfo {
     /** Session team name (`<team>/<agentId8>`); the route target. */
     readonly team: string;
-    /** The session's title at read time. */
+    /** Human seatName when configured, otherwise the session title at read time. */
     readonly name: string;
+    readonly seatName?: string;
     /** One-line excerpt of the session's newest user or assistant text. */
     readonly description: string;
     /** CLI deposit status, explicitly online/offline on full host cards; absent on ordinary sessions. */

package/nexus-stage/src/planning-member-handles.ts

@@ -1,4 +1,4 @@
-/** Pure joined-local-handle projection for remote organization members. */
+/** Pure membership projections: joined-local handles for remote organization members, canvas team indexes, mirror-frame members. */
 import type { RemoteTeamRow } from './federation'
 import type { SessionLite } from './world'
 
@@ -32,3 +32,30 @@ export function remoteMemberBoardId(member: string, localIdsByHandle: ReadonlyMa
   const peerZone = remoteTeams?.find(row => row.via === peerUrl)?.team.split('/')[0] ?? 'dsh'
   return `member-${peerZone}-${member.replace(/^session-/, '').slice(0, 8)}`
 }
+
+/** Each member id → the canvas teams it sits in, with its position in that team's member order. */
+export function membershipIndex(teams: ReadonlyArray<{ name: string; members: ReadonlyArray<{ id: string }> }>): Map<string, Array<{ team: string; index: number }>> {
+  const memberships = new Map<string, Array<{ team: string; index: number }>>()
+  for (const team of teams) {
+    for (let i = 0; i < team.members.length; i++) {
+      const id = team.members[i]!.id
+      const list = memberships.get(id) ?? []
+      list.push({ team: team.name, index: i })
+      memberships.set(id, list)
+    }
+  }
+  return memberships
+}
+
+/** Local joined sessions that sit in a peer's org team (a mirror frame): they are teamed even with no local team. */
+export function mirrorMemberIds(peerOrg: ReadonlyArray<{ org: ReadonlyArray<{ members: readonly string[] }> }>, sessions: ReadonlyArray<HandleSession>, remoteTeams: ReadonlyArray<RemoteTeamRow> | undefined): Set<string> {
+  const byHandle = joinedLocalIdsByHandle(sessions, new Set((remoteTeams ?? []).map(session => session.team)))
+  const ids = new Set<string>()
+  for (const row of peerOrg) {
+    for (const team of row.org) for (const member of team.members) {
+      const id = byHandle.get(member)
+      if (id !== undefined) ids.add(id)
+    }
+  }
+  return ids
+}

package/nexus-stage/src/planning-menus.ts

@@ -306,14 +306,13 @@ export function createPlanningMenus(d: MenusDeps): PlanningMenus {
         const create = menuItem('组成团队…', model.selectedIds().length >= 2, () => openNameDialog(selectedByY()))
         create.title = '先框选或 Shift 加选至少 2 个节点'
         items.push(create)
+        const teamsOf = model.getNode(id)?.memberships.map(m => m.team) ?? []
         if (d.teams().length > 0) {
           items.push(menuItem('加入团队 ▸', true, () => openMenu(x, y, target, 'join')))
-          const teamsOf = model.getNode(id)?.memberships.map(m => m.team) ?? []
-          if (teamsOf.length > 0) {
-            items.push(menuItem('置顶路由 ▸', true, () => openMenu(x, y, target, 'promote')))
-            items.push(menuItem('离队 ▸', true, () => openMenu(x, y, target, 'leave')))
-          }
+          if (teamsOf.length > 0) items.push(menuItem('置顶路由 ▸', true, () => openMenu(x, y, target, 'promote')))
         }
+        // A card that is only in mirror frames (a peer's team) still has a team to leave.
+        if (teamsOf.length > 0) items.push(menuItem('离队 ▸', true, () => openMenu(x, y, target, 'leave')))
         // Network-level leave (distinct from canvas-team membership): the
         // panel-slim migration moved the join/leave toggle here. Remote
         // nodes are read-only entries — never a leave target.
@@ -342,6 +341,14 @@ export function createPlanningMenus(d: MenusDeps): PlanningMenus {
             }))
           }
         }
+        // d.teams() is this host's own teams; a mirror frame's membership leaves through
+        // the owner's relay (the view adds fleetPeer), so list those memberships too.
+        if (level === 'leave') {
+          const local = new Set(d.teams().map(t => t.name))
+          for (const m of model.getNode(id)?.memberships ?? []) {
+            if (!local.has(m.team)) items.push(menuItem(titleOf(m.team), true, () => d.emit({ type: 'remove-member', team: m.team, ids: [id] })))
+          }
+        }
       }
     }
     el.append(...items)

package/nexus-stage/src/planning-view.ts

@@ -30,7 +30,8 @@ import { buildLayoutDoc, clampDoc, type LayoutDoc, type LayoutRect } from './lay
 import { FRAME_HEAD_LIFT } from './edges'
 import { drawMemberEdges } from './planning-edges'
 import { createFederationOverlay } from './federation-overlay'
-import { joinedLocalIdsByHandle, remoteMemberBoardId } from './planning-member-handles'
+import { joinedLocalIdsByHandle, membershipIndex, mirrorMemberIds, remoteMemberBoardId } from './planning-member-handles'
+import { attachSessionDrop } from './session-drag'
 import { displayName } from './stage-name'
 import {
   activityEdges, federalEdges, flyBounds, groupRemoteTeams, peerNodeId, peerHostOf, placePeers,
@@ -625,6 +626,12 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
     openNameDialog: menus.openNameDialog,
     locate: locateNode,
   })
+  // A rail 本机会话 row dropped on a frame joins that team, like a card drop (session-drag).
+  attachSessionDrop(root, {
+    signal, frames: () => frameEls,
+    frameAt: (clientX, clientY) => { const p = localXY({ clientX, clientY }); return innermostFrameAt(new Map(model.allFrames()), screenToWorld(vp, p.x, p.y)) },
+    drop: (team, id) => model.getNode(id)?.memberships.some(m => m.team === team) === true ? notice('info', '该会话已在这个队里') : emitAction({ type: 'add-member', team, ids: [id] }),
+  })
 
   /** Center the viewport on one canvas node (the 已组队 row's 定位). */
   function locateNode(id: string): void {
@@ -1119,15 +1126,7 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
     // toolbar chip instead of vanishing entirely.
     lastSessions = input.sessions
     menus.setUnjoined(input.sessions.filter(s => s.joined !== true && !s.id.startsWith('peer-')))
-    const memberships = new Map<string, Array<{ team: string; index: number }>>()
-    for (const team of input.teams) {
-      for (let i = 0; i < team.members.length; i++) {
-        const id = team.members[i]!.id
-        const list = memberships.get(id) ?? []
-        list.push({ team: team.name, index: i })
-        memberships.set(id, list)
-      }
-    }
+    const memberships = membershipIndex(input.teams)
     lastCanvasMemberIds = new Set(memberships.keys())
     const seen = new Set<string>()
     // In-flight write guard: membership entries of teams with unsettled
@@ -1161,15 +1160,20 @@ export function createPlanningView(deps: PlanningDeps): PlanningView {
       syncViewSize()
       clusterSeats = planTeamClusters(input.teams, seatIds, viewW > 0 ? viewW : undefined)
     }
+    // A joined session whose only team is a peer's (a mirror frame) is teamed too: without its
+    // card the mirror frame cannot show it, and 离队 has nothing to reach (owner report 2026-11-04).
+    const mirrorMembers = input.peerOrg !== undefined ? mirrorMemberIds(input.peerOrg, input.sessions, input.remoteTeams) : new Set<string>()
+    // The node list reads the same fact: such a session is teamed, not 未组队.
+    if (input.peerOrg !== undefined) lastCanvasMemberIds = new Set([...lastCanvasMemberIds, ...mirrorMembers])
     for (const s of input.sessions) {
       if (s.joined !== true) continue
       // Teamed-only canvas (network-membership-display ruling): a joined
       // session earns a canvas node only with a team — canvas membership
-      // (optimistic-aware) or a declared roster team. Teamless joined
-      // sessions ride the node list's 未组队 group instead; sessions absent
-      // from `seen` are swept from the model below.
+      // (optimistic-aware), a declared roster team, or a mirror frame's
+      // membership. Teamless joined sessions ride the node list's 未组队
+      // group instead; sessions absent from `seen` are swept from the model below.
       const effective = resolveMemberships(s.id)
-      if (effective.length === 0 && (s.teams === undefined || s.teams.length === 0)) continue
+      if (effective.length === 0 && (s.teams === undefined || s.teams.length === 0) && !mirrorMembers.has(s.id)) continue
       seen.add(s.id)
       if (model.getNode(s.id) !== undefined) {
         model.upsertNode({

package/nexus-stage/src/seat-name-editor.ts

@@ -0,0 +1,31 @@
+/** Human owner form only: labels never grant membership or become routing ids. */
+export function createSeatNameEditor(sessions: readonly { id: string; name?: string; label?: string }[], names: Record<string, string>, save: (names: Record<string, string>) => Promise<{ ok: boolean; error?: string }>): HTMLElement {
+  const box = document.createElement('section')
+  const heading = document.createElement('h4'); heading.textContent = '会话席位名（仅人工设定）'; box.appendChild(heading)
+  const note = document.createElement('p'); note.className = 'wb-hint'; note.textContent = '稳定展示名，不改变会话标题、路由句柄或准入。留空并保存可清除。'; box.appendChild(note)
+  const select = document.createElement('select'); select.setAttribute('aria-label', '选择命名的本机会话')
+  for (const id of new Set([...sessions.map(row => row.id), ...Object.keys(names)])) {
+    const row = sessions.find(row => row.id === id), option = document.createElement('option')
+    option.value = id; option.textContent = (names[id] ?? row?.name ?? row?.label ?? id) + ' · ' + id; select.appendChild(option)
+  }
+  const input = document.createElement('input'); input.type = 'text'; input.maxLength = 64; input.setAttribute('aria-label', '人工席位名'); input.placeholder = '例如：开发席'
+  const button = document.createElement('button'); button.type = 'submit'; button.textContent = '保存席位名'; button.className = 'wb-member-submit'
+  const form = document.createElement('form'); form.className = 'wb-member-add'; form.append(select, input, button)
+  const status = document.createElement('p'); status.className = 'wb-hint'; status.setAttribute('role', 'status'); status.setAttribute('aria-live', 'polite')
+  let pending = false
+  const load = () => { input.value = names[select.value] ?? ''; button.disabled = pending || select.value === '' }
+  select.addEventListener('change', load); load()
+  form.addEventListener('submit', async event => {
+    event.preventDefault(); if (pending || select.value === '') return
+    const id = select.value, value = input.value.trim(), next = { ...names }
+    if (value === '') delete next[id]; else next[id] = value
+    pending = true; button.disabled = true; select.disabled = true; input.disabled = true
+    try {
+      const result = await save(next)
+      if (result.ok) { delete names[id]; if (value !== '') names[id] = value; status.textContent = '席位名已保存；目录将随状态刷新。' }
+      else status.textContent = result.error ?? '保存失败'
+    } catch (error) { status.textContent = '保存失败：' + String(error) }
+    finally { pending = false; select.disabled = false; input.disabled = false; load() }
+  })
+  box.append(form, status); return box
+}

package/nexus-stage/src/session-drag.ts

@@ -0,0 +1,64 @@
+/**
+ * Drag a local session from the workbench rail (目录 · 本机会话) straight into
+ * a canvas team frame on the board (owner request 2026-11-04). The rail row
+ * carries the session id in a private drag type; the board accepts it only
+ * over a frame and turns the drop into the same add-member action a card drop
+ * makes, so roster frames, mirror frames (fleet relay) and the host's own
+ * refusals all behave exactly as for an on-board drag.
+ * @module nexus-stage/session-drag
+ */
+
+/** Private drag type: an arbitrary page or file dropped on the board is ignored. */
+export const SESSION_DRAG_TYPE = 'application/x-dsh-session'
+
+/** Make one rail row draggable as a local session. */
+export function makeSessionDraggable(item: HTMLElement, sessionId: string): void {
+  item.draggable = true
+  item.classList.add('is-draggable')
+  item.title = `${item.title === '' ? sessionId : item.title} · 可拖入画布队`
+  item.addEventListener('dragstart', ev => {
+    if (ev.dataTransfer === null) return
+    ev.dataTransfer.setData(SESSION_DRAG_TYPE, sessionId)
+    ev.dataTransfer.effectAllowed = 'copy'
+  })
+}
+
+export interface SessionDropDeps {
+  /** The innermost team frame under a client point, if any. */
+  frameAt(clientX: number, clientY: number): string | undefined
+  /** Frame elements by team name, for the drop-target highlight. */
+  frames(): ReadonlyMap<string, HTMLElement>
+  /** A session dropped on a frame. */
+  drop(team: string, sessionId: string): void
+  readonly signal: AddEventListenerOptions
+}
+
+/** Accept rail session drags on the board root. */
+export function attachSessionDrop(root: HTMLElement, d: SessionDropDeps): void {
+  const carries = (ev: DragEvent): boolean => ev.dataTransfer !== null && [...ev.dataTransfer.types].includes(SESSION_DRAG_TYPE)
+  const highlight = (team: string | undefined): void => {
+    for (const [name, el] of d.frames()) el.classList.toggle('drop-target', name === team)
+  }
+  root.addEventListener('dragover', ev => {
+    if (!carries(ev)) return
+    const team = d.frameAt(ev.clientX, ev.clientY)
+    highlight(team)
+    if (team === undefined) return
+    ev.preventDefault() // only a frame is a drop target
+    ev.dataTransfer!.dropEffect = 'copy'
+  }, d.signal)
+  root.addEventListener('dragleave', ev => {
+    if (carries(ev) && (ev.relatedTarget === null || !root.contains(ev.relatedTarget as Node))) highlight(undefined)
+  }, d.signal)
+  // A drag cancelled with Esc over a frame fires no dragleave on the board: the source's dragend clears it.
+  root.ownerDocument.addEventListener('dragend', () => highlight(undefined), d.signal)
+  root.addEventListener('drop', ev => {
+    if (!carries(ev)) return
+    highlight(undefined)
+    const team = d.frameAt(ev.clientX, ev.clientY)
+    const id = ev.dataTransfer!.getData(SESSION_DRAG_TYPE)
+    if (team === undefined || id === '') return
+    ev.preventDefault()
+    d.drop(team, id)
+  }, d.signal)
+}

package/nexus-stage/src/wb-directory.ts

@@ -15,6 +15,7 @@
 import type { CanvasTeamRow, StateBody } from './workbench'
 import type { ChatTarget } from './wb-chat'
 import { displayName } from './stage-name'
+import { makeSessionDraggable } from './session-drag'
 
 export type DirFilter = 'all' | 'local' | 'canvas' | 'remote' | 'logs'
 
@@ -140,6 +141,7 @@ export function renderDirectory(box: HTMLElement, ctx: DirectoryContext): string
         item.querySelector('.wb-item-text')?.appendChild(note)
       }
       badges(item, s.canvasTeams)
+      makeSessionDraggable(item, s.id)
     }
   }
 

package/nexus-stage/src/workbench.css

@@ -49,6 +49,7 @@ body{background:var(--n-bg);color:var(--n-ink);font:13px/1.45 system-ui,"Segoe U
   width:30px;height:30px;display:none;align-items:center;justify-content:center;font:inherit;font-size:14px;
   cursor:pointer;flex:none}
 .wb-icon-btn:hover{border-color:var(--n-accent)}
+.wb-owner-btn{display:inline-flex}
 .wb-menu{margin-left:0}
 .wb-rail-toggle{margin-left:auto}
 .wb.is-rail-collapsed .wb-rail{display:none}
@@ -320,6 +321,7 @@ body{background:var(--n-bg);color:var(--n-ink);font:13px/1.45 system-ui,"Segoe U
 .wb-dir-day{padding:6px 6px 2px;font-size:10.5px;color:var(--n-ink-muted)}
 .wb-dir-empty{padding:24px 8px;text-align:center;font-size:12px;color:var(--n-ink-muted)}
 .wb-directory .wb-item{gap:9px;padding:5px 6px;border-radius:8px}
+.wb-directory .wb-item.is-draggable{cursor:grab}
 .wb-directory .wb-item:focus-visible{outline:2px solid var(--n-accent);outline-offset:-2px}
 .wb-item-text{display:flex;flex-direction:column;flex:1 1 auto;min-width:0;line-height:1.35}
 .wb-item-sub{font:11px/1.35 ui-monospace,Consolas,monospace;color:var(--n-ink-muted);