@nelsonlongxiang/dsh-open-a2a-net 0.6.42 → 0.7.0

package/lib/admitted-bookkeeping.js

@@ -0,0 +1,7 @@
+/** Observation of accepted input whose task birth did not commit; not a task status. */
+import { safeObservationCode } from "./nudge-observability.js";
+export const ADMITTED_BOOKKEEPING_NOTE = '已送达、接收方记账失败，请对账，不要重派。Delivered, but receiver bookkeeping failed; reconcile the original task, do not redispatch.';
+export class AdmittedBookkeepingError extends Error {
+    code;
+    constructor(error) { super(ADMITTED_BOOKKEEPING_NOTE); this.code = safeObservationCode(error, 'LEDGER_WRITE_FAILED'); }
+}

package/lib/canvas-discovery.js

@@ -1,5 +1,6 @@
 /** Read-only canvas ownership projection; never authorizes or selects a dispatch candidate. */
 import { advertisedCanvasTeams } from "./peer-directory.js";
+import { splitQualifiedMember } from "./canvas-member.js";
 export function canvasOwners(local, ownUrl, peers) {
     const rows = local.map(row => ({ ...row, owner: ownUrl, memberCount: row.members.length, local: true }));
     const seen = new Set();
@@ -14,7 +15,16 @@ export function canvasOwners(local, ownUrl, peers) {
     return rows;
 }
 export function canvasMemberships(owners, handle, localId, resolveLocal) {
-    return owners.filter(row => ((row.scopeMembers ?? row.members).includes(handle) && (row.local || resolveLocal === undefined || resolveLocal(handle) === localId)) || (row.local && localId !== undefined && row.members.includes(localId))).map(({ members: _members, scopeMembers: _scopeMembers, ...row }) => row);
+    return owners.flatMap(row => {
+        const matched = (row.scopeMembers ?? row.members).filter(ref => (row.local && localId !== undefined && ref === localId) ||
+            (resolveLocal !== undefined && localId !== undefined && (ref === handle || splitQualifiedMember(ref)?.handle === handle) && resolveLocal(ref) === localId) ||
+            (resolveLocal === undefined && ref === handle));
+        if (!matched.length)
+            return [];
+        const inferred = matched.some(ref => ref === handle && splitQualifiedMember(ref) === undefined);
+        const { members: _members, scopeMembers: _scopeMembers, ...detail } = row;
+        return [{ ...detail, provenance: inferred ? 'unknown' : 'confirmed', ...(inferred ? { compatibilityInference: true } : {}) }];
+    });
 }
 export function canvasFailure(team, owners, reason) {
     if (!new RegExp('^.+/canvas/[^/]+$').test(team))

package/lib/canvas-member.js

@@ -0,0 +1,43 @@
+/** Session-member provenance (#334). fp8 selects an owner; only a full key anchors it. */
+import { createPublicKey } from 'node:crypto';
+import { canvasOwnerFingerprint } from "./canvas-id.js";
+import { CLI_HANDLE_RE } from "./cli-deposit.js";
+/** CLI handles keep their existing home/deposit rules and are never parsed as session members. */
+export function splitQualifiedMember(ref) {
+    if (CLI_HANDLE_RE.test(ref))
+        return undefined;
+    const match = /^([^/\s@]+\/[0-9a-f]{8})@([0-9a-f]{8})$/.exec(ref);
+    return match ? { handle: match[1], fingerprint: match[2] } : undefined;
+}
+export function validMemberOwner(ref, key) {
+    const member = splitQualifiedMember(ref);
+    if (!member || !key || canvasOwnerFingerprint(key) !== member.fingerprint)
+        return false;
+    try {
+        const bytes = Buffer.from(key, 'base64'), publicKey = createPublicKey({ key: bytes, format: 'der', type: 'spki' });
+        return publicKey.asymmetricKeyType === 'ed25519' && publicKey.export({ format: 'der', type: 'spki' }).equals(bytes) && bytes.toString('base64') === key;
+    }
+    catch {
+        return false;
+    }
+}
+export function qualifiedSessionMember(handle, key) {
+    const ref = handle + '@' + canvasOwnerFingerprint(key);
+    return validMemberOwner(ref, key) ? ref : undefined;
+}
+export function memberProvenance(ref, ownerKey, ownKey) {
+    if (CLI_HANDLE_RE.test(ref))
+        return 'cli';
+    if (!ref.includes('/'))
+        return 'local-id';
+    const qualified = splitQualifiedMember(ref);
+    if (!qualified)
+        return ref.includes('@') ? 'conflict' : 'unknown';
+    if (ownerKey === undefined)
+        return qualified.fingerprint === canvasOwnerFingerprint(ownKey) ? 'confirmed-local' : 'unknown';
+    if (!validMemberOwner(ref, ownerKey))
+        return 'conflict';
+    if (qualified.fingerprint === canvasOwnerFingerprint(ownKey) && ownerKey !== ownKey)
+        return 'conflict';
+    return ownerKey === ownKey ? 'confirmed-local' : 'confirmed-remote';
+}

package/lib/canvas-store.js

@@ -16,9 +16,16 @@
  * read fresh by the state route.
  * @module @nelsonlongxiang/dsh-open-a2a-net/canvas-store
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, rmSync, openSync, closeSync, fsyncSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { hostname } from 'node:os';
 import { dirname } from 'node:path';
 import { CLI_HANDLE_RE } from "./cli-deposit.js";
+import { splitQualifiedMember, validMemberOwner, memberProvenance } from "./canvas-member.js";
+/** A bare session handle is not a CLI identity or a qualified owner selector. */
+export function legacyBareMember(id) {
+    return isRemoteMemberRef(id) && !CLI_HANDLE_RE.test(id) && !/@[0-9a-f]{8}$/.test(id);
+}
 /** Upper bounds: a canvas taxonomy, not a database. */
 export const CANVAS_TEAM_CAP = 64;
 export const CANVAS_MEMBER_CAP = 32;
@@ -67,18 +74,29 @@ function validNewName(raw) {
  * registry knowledge: callers validate join state and resolve members.
  */
 export class CanvasStore {
+    options;
     /** Team entries in creation order; members in add order (routing priority). */
     teams = [];
     cliHome = {};
     cliHomeCleared = new Set();
+    suspended = [];
+    revision = 0;
+    committed = '';
+    memberOwners = {};
+    disk;
+    readOnlyReason = '';
+    lastWriteError = '';
+    failedSuspension = false;
     path;
     listeners = new Set();
     /**
      * @param path - the snapshot file; an empty path keeps the store in memory.
      */
-    constructor(path) {
+    constructor(path, options = {}) {
+        this.options = options;
         this.path = path;
         this.restore();
+        this.committed = this.serialize();
     }
     /**
      * Observe changes: the listener runs after every write that changed the
@@ -95,7 +113,60 @@ export class CanvasStore {
         if (this.path === '' || !existsSync(this.path))
             return;
         try {
-            const snapshot = JSON.parse(readFileSync(this.path, 'utf8'));
+            this.disk = readFileSync(this.path, 'utf8');
+            const snapshot = JSON.parse(this.disk);
+            if (snapshot?.formatVersion !== undefined && snapshot.formatVersion !== 2) {
+                this.readOnlyReason = 'unsupported canvas formatVersion';
+                return;
+            }
+            if (snapshot?.memberOwners && typeof snapshot.memberOwners === 'object' && !Array.isArray(snapshot.memberOwners))
+                this.memberOwners = { ...snapshot.memberOwners };
+            if (snapshot?.formatVersion === 2) {
+                if (!Number.isSafeInteger(snapshot.revision) || snapshot.revision < 0 || !Array.isArray(snapshot.suspendedMembers) || !Array.isArray(snapshot.teams) || snapshot.teams.length > CANVAS_TEAM_CAP)
+                    throw Error('incomplete or oversized canvas v2 snapshot');
+                const names = new Set();
+                for (const entry of snapshot.teams) {
+                    if (!entry || typeof entry !== 'object' || typeof entry.name !== 'string' || validName(entry.name) !== entry.name || names.has(entry.name) || !Array.isArray(entry.members) || entry.members.length > CANVAS_MEMBER_CAP)
+                        throw Error('invalid canvas v2 team');
+                    names.add(entry.name);
+                    const members = new Set();
+                    for (const member of entry.members) {
+                        if (typeof member !== 'string' || member === '' || /[\x00-\x1f\x7f]/.test(member) || members.has(member))
+                            throw Error('invalid canvas v2 member');
+                        members.add(member);
+                    }
+                }
+                if (snapshot.memberOwners !== undefined && (snapshot.memberOwners === null || typeof snapshot.memberOwners !== 'object' || Array.isArray(snapshot.memberOwners) || Object.entries(snapshot.memberOwners).some(([ref, key]) => typeof key !== 'string' || !validMemberOwner(ref, key))))
+                    throw Error('invalid canvas v2 owners');
+                const fpKeys = new Map();
+                for (const [ref, key] of Object.entries(snapshot.memberOwners ?? {})) {
+                    const fp = splitQualifiedMember(ref).fingerprint;
+                    if (fpKeys.has(fp) && fpKeys.get(fp) !== key)
+                        throw Error('conflicting canvas member fingerprints');
+                    fpKeys.set(fp, key);
+                }
+                if (snapshot.cliHome !== undefined && (snapshot.cliHome === null || typeof snapshot.cliHome !== 'object' || Array.isArray(snapshot.cliHome) || Object.entries(snapshot.cliHome).some(([handle, home]) => !CLI_HANDLE_RE.test(handle) || typeof home !== 'string' || !validHomeOrigin(home) || !snapshot.teams.some(t => t.members.includes(handle)))))
+                    throw Error('invalid canvas v2 CLI homes');
+                if (snapshot.cliHomeCleared !== undefined && (!Array.isArray(snapshot.cliHomeCleared) || new Set(snapshot.cliHomeCleared).size !== snapshot.cliHomeCleared.length || snapshot.cliHomeCleared.some(handle => typeof handle !== 'string' || !CLI_HANDLE_RE.test(handle) || !snapshot.teams.some(t => t.members.includes(handle)))))
+                    throw Error('invalid canvas v2 cleared homes');
+            }
+            this.revision = Number.isSafeInteger(snapshot?.revision) && snapshot.revision >= 0 ? snapshot.revision : 0;
+            if (snapshot?.suspendedMembers !== undefined) {
+                if (!Array.isArray(snapshot.suspendedMembers))
+                    throw Error('invalid suspension records');
+                const seen = new Set();
+                for (const row of snapshot.suspendedMembers) {
+                    if (!row || typeof row.team !== 'string' || typeof row.member !== 'string' || typeof row.localSessionId !== 'string' || !['leave', 'archive', 'remove'].includes(row.reason) || typeof row.at !== 'string' || !Number.isFinite(Date.parse(row.at)) || typeof row.token !== 'string' || !row.token)
+                        throw Error('invalid suspension record');
+                    if (snapshot.formatVersion === 2 && !snapshot.teams?.some(t => t.name === row.team && t.members.includes(row.member)))
+                        throw Error('orphan suspension record');
+                    const key = JSON.stringify([row.team, row.member, row.reason, row.localSessionId]);
+                    if (seen.has(key))
+                        throw Error('duplicate suspension record');
+                    seen.add(key);
+                    this.suspended.push({ ...row });
+                }
+            }
             if (!Array.isArray(snapshot?.teams))
                 return;
             const kept = [];
@@ -125,13 +196,31 @@ export class CanvasStore {
                 }
         }
         catch {
-            // A corrupt store is not fatal: the user re-creates teams; routing
-            // names simply stop resolving until then.
+            this.teams = [];
+            this.suspended = [];
+            // A malformed v2 suspension must never silently reactivate members.
+            if (this.disk?.includes('suspendedMembers') || this.disk?.includes('formatVersion'))
+                this.readOnlyReason = 'invalid canvas v2 snapshot';
         }
     }
     /** Persist the current snapshot (no-op without a path), then tell the listeners. */
     persist() {
-        this.write();
+        try {
+            this.write();
+            this.committed = this.serialize();
+            this.lastWriteError = '';
+        }
+        catch (error) {
+            this.lastWriteError = String(error);
+            const previous = JSON.parse(this.committed);
+            this.teams = previous.teams.map(t => ({ name: t.name, members: [...t.members] }));
+            this.suspended = [...previous.suspendedMembers ?? []];
+            this.memberOwners = { ...previous.memberOwners };
+            this.cliHome = { ...previous.cliHome };
+            this.cliHomeCleared = new Set(previous.cliHomeCleared);
+            this.revision = previous.revision ?? 0;
+            throw error;
+        }
         for (const listener of this.listeners) {
             try {
                 listener();
@@ -139,17 +228,100 @@ export class CanvasStore {
             catch { /* a listener's failure is its own */ }
         }
     }
+    serialize() {
+        return JSON.stringify({ teams: this.teams, memberOwners: this.memberOwners, suspendedMembers: this.suspended, cliHome: this.cliHome, cliHomeCleared: [...this.cliHomeCleared], revision: this.revision });
+    }
     write() {
-        if (this.path === '')
-            return;
-        try {
+        if (this.readOnlyReason)
+            throw Error(this.readOnlyReason);
+        const revision = this.revision + 1;
+        const snapshot = { formatVersion: 2, revision,
+            teams: this.teams.map(t => ({ name: t.name, members: [...t.members] })),
+            suspendedMembers: this.suspended.map(r => ({ ...r })),
+            ...(Object.keys(this.memberOwners).length ? { memberOwners: this.memberOwners } : {}),
+            ...(Object.keys(this.cliHome).length ? { cliHome: { ...this.cliHome } } : {}),
+            ...(this.cliHomeCleared.size ? { cliHomeCleared: [...this.cliHomeCleared] } : {}) };
+        const bytes = JSON.stringify(snapshot);
+        if (this.path !== '') {
             mkdirSync(dirname(this.path), { recursive: true });
-            const snapshot = { teams: this.teams.map(t => ({ name: t.name, members: [...t.members] })), ...(Object.keys(this.cliHome).length > 0 ? { cliHome: { ...this.cliHome } } : {}), ...(this.cliHomeCleared.size > 0 ? { cliHomeCleared: [...this.cliHomeCleared] } : {}) };
-            writeFileSync(this.path, JSON.stringify(snapshot), { mode: 0o600 });
+            const lock = this.path + '.lock';
+            // Never steal another writer's lock. Diagnostics do not authorize removal.
+            try {
+                mkdirSync(lock);
+            }
+            catch (error) {
+                throw Error('canvas lock held at ' + lock + ': ' + JSON.stringify(this.lockInfo()) + ' (' + String(error) + ')');
+            }
+            try {
+                writeFileSync(lock + '/owner.json', JSON.stringify({ pid: process.pid, host: hostname(), at: new Date().toISOString() }), { mode: 0o600, flag: 'wx' });
+                const current = existsSync(this.path) ? readFileSync(this.path, 'utf8') : undefined;
+                if (current !== this.disk)
+                    throw Error('canvas snapshot changed externally; reload before writing');
+                let oldVersion;
+                try {
+                    oldVersion = current === undefined ? undefined : JSON.parse(current)?.formatVersion;
+                }
+                catch { /* back up malformed legacy data too */ }
+                if (current !== undefined && oldVersion !== 2) {
+                    const backup = this.path + '.pre-v2';
+                    if (existsSync(backup)) {
+                        if (readFileSync(backup, 'utf8') !== current)
+                            throw Error('canvas pre-v2 backup differs; inspect before migration: ' + backup);
+                    }
+                    else
+                        this.replaceFile(backup, current);
+                }
+                this.replaceFile(this.path, bytes);
+                this.disk = bytes;
+            }
+            finally {
+                rmSync(lock, { recursive: true });
+            }
         }
-        catch {
-            // An unwritable home must not break the canvas; the store degrades to
-            // memory-only.
+        this.revision = revision;
+    }
+    replaceFile(target, bytes) {
+        const temporary = target + '.tmp-' + randomUUID();
+        try {
+            writeFileSync(temporary, bytes, { mode: 0o600, flag: 'wx' });
+            const fd = openSync(temporary, 'r+');
+            try {
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+            renameSync(temporary, target);
+            if (process.platform !== 'win32') {
+                try {
+                    const dir = openSync(dirname(target), 'r');
+                    try {
+                        fsyncSync(dir);
+                    }
+                    finally {
+                        closeSync(dir);
+                    }
+                }
+                catch (error) {
+                    // Rename already committed: rolled-back memory must not be used as active state.
+                    this.readOnlyReason = 'canvas directory fsync failed after rename: ' + String(error);
+                    throw error;
+                }
+            }
+        }
+        finally {
+            rmSync(temporary, { force: true });
+        }
+    }
+    lockInfo() {
+        const path = this.path + '.lock';
+        if (this.path === '' || !existsSync(path))
+            return undefined;
+        try {
+            return { path, owner: JSON.parse(readFileSync(path + '/owner.json', 'utf8')) };
+        }
+        catch (error) {
+            return { path, error: 'owner metadata unavailable: ' + String(error) };
         }
     }
     /** Every team name, in creation order. */
@@ -163,7 +335,121 @@ export class CanvasStore {
     /** The named team's member ids in routing-priority order (a copy). */
     membersOf(name) {
         const entry = this.teams.find(t => t.name === name);
-        return entry === undefined ? [] : [...entry.members];
+        if (this.readOnlyReason || this.failedSuspension)
+            return [];
+        return entry === undefined ? [] : entry.members.filter(id => {
+            if (this.isSuspended(name, id) || (this.options.legacyBareMembers === false && legacyBareMember(id)))
+                return false;
+            if (this.options.ownPublicKey && id.includes('@') && !CLI_HANDLE_RE.test(id)) {
+                const provenance = memberProvenance(id, this.memberOwners[id], this.options.ownPublicKey);
+                return provenance === 'confirmed-local' || provenance === 'confirmed-remote';
+            }
+            return true;
+        });
+    }
+    /** Inspection only: never use raw rows for routing, authorization or counts. */
+    rawMembersOf(name) { return [...(this.teams.find(t => t.name === name)?.members ?? [])]; }
+    isSuspended(name, member) { return this.suspended.some(r => r.team === name && r.member === member); }
+    suspensionOf(name, member) { return this.suspended.filter(r => r.team === name && r.member === member).map(r => ({ ...r })); }
+    state() {
+        return { revision: this.revision, suspendedMembers: this.suspended.map(r => ({ ...r })),
+            directoryFsync: process.platform === 'win32' ? 'unavailable on Windows; file fsync and atomic rename only' : 'required after rename',
+            ...(this.lockInfo() ? { lock: this.lockInfo() } : {}),
+            ...(this.readOnlyReason || this.failedSuspension || this.lastWriteError ? { error: this.readOnlyReason || (this.failedSuspension ? 'canvas suspension persistence failed; restart after repair' : this.lastWriteError) } : {}) };
+    }
+    ownerKeyOf(member) { return this.memberOwners[member]; }
+    ownerConflict(member, key) {
+        const fp = splitQualifiedMember(member)?.fingerprint;
+        return Object.entries(this.memberOwners).some(([ref, pinned]) => (ref === member || splitQualifiedMember(ref)?.fingerprint === fp) && pinned !== key);
+    }
+    /** Owner control only: CAS the complete slot and preserve suspension plus routing priority. */
+    confirmMember(team, member, replacement, ownerKey, revision, expectedOwner) {
+        if (this.readOnlyReason || this.failedSuspension)
+            return { ok: false, error: this.state().error };
+        const entry = this.teams.find(t => t.name === team), index = entry?.members.indexOf(member) ?? -1;
+        if (!entry || index < 0 || revision !== this.revision || expectedOwner !== (this.memberOwners[member] ?? null))
+            return { ok: false, error: 'canvas version, member slot or owner changed; refresh first' };
+        const sameId8 = (value) => value.replace(/^session-/, '').slice(0, 8);
+        const originalHandle = splitQualifiedMember(member)?.handle ?? member;
+        const replacementHandle = splitQualifiedMember(replacement)?.handle ?? replacement;
+        if (member.includes('/') && (replacement.includes('/') ? originalHandle !== replacementHandle : !originalHandle.endsWith('/' + sameId8(replacement))))
+            return { ok: false, error: 'confirmation must identify the same original session handle' };
+        if (!member.includes('/') || !replacement || CLI_HANDLE_RE.test(member) || CLI_HANDLE_RE.test(replacement))
+            return { ok: false, error: 'session provenance confirmation only; CLI homes use their own controls' };
+        const qualified = splitQualifiedMember(replacement);
+        if ((replacement.includes('/') && !qualified) || (qualified && (!ownerKey || !validMemberOwner(replacement, ownerKey) || this.ownerConflict(replacement, ownerKey))))
+            return { ok: false, error: 'owner key/fingerprint conflict or unproved member' };
+        if (this.memberOwners[member] !== undefined && (replacement !== member || ownerKey !== this.memberOwners[member]))
+            return { ok: false, error: 'confirmed owner cannot be silently replaced' };
+        const equivalent = entry.members.indexOf(replacement);
+        if (equivalent >= 0 && equivalent !== index && this.suspensionOf(team, member).some(row => this.suspensionOf(team, replacement).some(other => other.reason === row.reason && other.localSessionId === row.localSessionId)))
+            return { ok: false, error: 'both slots have independent matching suspension reasons; handle them explicitly before merging' };
+        if (equivalent >= 0 && equivalent !== index)
+            entry.members.splice(index, 1);
+        else
+            entry.members[index] = replacement;
+        this.suspended = this.suspended.map(row => row.team === team && row.member === member ? { ...row, member: replacement } : row)
+            .filter((row, i, all) => all.findIndex(other => other.team === row.team && other.member === row.member && other.reason === row.reason && other.localSessionId === row.localSessionId) === i);
+        if (qualified)
+            this.memberOwners[replacement] = ownerKey;
+        try {
+            this.persist();
+            return { ok: true };
+        }
+        catch (error) {
+            return { ok: false, error: String(error) };
+        }
+    }
+    /** Durably revoke canvas consent BEFORE join/agent/roster state is removed. */
+    revokeLocal(id, ownQualified, inferredBare, reason, team) {
+        if (this.readOnlyReason || this.failedSuspension)
+            throw Error(this.state().error);
+        let changed = false;
+        for (const entry of this.teams) {
+            if (team !== undefined && entry.name !== team)
+                continue;
+            if (inferredBare !== undefined && entry.members.includes(inferredBare) && !this.suspended.some(r => r.team === entry.name && r.member === inferredBare && r.localSessionId === id && r.reason === reason)) {
+                this.suspended.push({ team: entry.name, member: inferredBare, localSessionId: id, reason, at: new Date().toISOString(), token: randomUUID() });
+                changed = true;
+            }
+            const kept = entry.members.filter(m => (m !== id && m !== ownQualified) || this.isSuspended(entry.name, m));
+            if (kept.length !== entry.members.length) {
+                entry.members = kept;
+                changed = true;
+            }
+        }
+        if (changed) {
+            try {
+                this.persist();
+            }
+            catch (error) {
+                this.failedSuspension = true;
+                throw error;
+            }
+        }
+        return changed;
+    }
+    /** Owner-only CAS. The caller supplies the exact slot and the complete current suspension records. */
+    regulateSuspended(action, team, member, revision, expected) {
+        if (this.readOnlyReason || this.failedSuspension)
+            return { ok: false, error: this.state().error };
+        const records = this.suspensionOf(team, member);
+        if (revision !== this.revision || !records.length || !this.rawMembersOf(team).includes(member) || JSON.stringify(expected) !== JSON.stringify(records))
+            return { ok: false, error: 'canvas version, member slot or suspension records changed; refresh first' };
+        const old = this.suspended;
+        const entry = this.teams.find(t => t.name === team), members = entry.members;
+        this.suspended = this.suspended.filter(r => r.team !== team || r.member !== member);
+        if (action === 'delete')
+            entry.members = entry.members.filter(m => m !== member);
+        try {
+            this.persist();
+            return { ok: true };
+        }
+        catch (error) {
+            this.suspended = old;
+            entry.members = members;
+            return { ok: false, error: String(error) };
+        }
     }
     /** Frozen, operator-linked CLI home; undefined means unknown or ambiguous. */
     cliHomeOf(handle) { return this.cliHome[handle]; }
@@ -188,7 +474,7 @@ export class CanvasStore {
     }
     /** Every team name the id is a member of, in team creation order. */
     teamsOf(id) {
-        return this.teams.filter(t => t.members.includes(id)).map(t => t.name);
+        return this.teams.filter(t => this.membersOf(t.name).includes(id)).map(t => t.name);
     }
     /**
      * Create a named team; whitespace trims, duplicates are idempotent, and
@@ -216,6 +502,8 @@ export class CanvasStore {
         const index = this.teams.findIndex(t => t.name === name);
         if (index < 0)
             return false;
+        if (this.suspended.some(r => r.team === name))
+            return false;
         const [removed] = this.teams.splice(index, 1);
         for (const id of removed.members)
             this.forgetUnusedHome(id);
@@ -233,10 +521,15 @@ export class CanvasStore {
             return false;
         if (home !== undefined && this.cliHome[id] !== undefined && this.cliHome[id] !== home && options.replaceHome !== true)
             return false;
+        const qualified = splitQualifiedMember(id);
+        if (qualified && (!options.ownerKey || !validMemberOwner(id, options.ownerKey) || this.ownerConflict(id, options.ownerKey)))
+            return false;
         const entry = this.teams.find(t => t.name === name);
         if (entry === undefined)
             return false;
         if (entry.members.includes(id)) {
+            if (qualified && this.memberOwners[id] === undefined)
+                return false; // Existing unknown slots require explicit confirmation, not re-add.
             if (home !== undefined && this.cliHome[id] !== home) {
                 this.cliHome[id] = home;
                 this.cliHomeCleared.delete(id);
@@ -247,6 +540,8 @@ export class CanvasStore {
         if (entry.members.length >= CANVAS_MEMBER_CAP)
             return false;
         entry.members.push(id);
+        if (qualified)
+            this.memberOwners[id] = options.ownerKey;
         if (home !== undefined) {
             this.cliHome[id] = home;
             this.cliHomeCleared.delete(id);
@@ -261,6 +556,9 @@ export class CanvasStore {
         const entry = this.teams.find(t => t.name === name);
         if (entry === undefined)
             return false;
+        // Suspended slots require owner CAS, never a peer remove/readd round trip.
+        if (this.isSuspended(name, id))
+            return false;
         const index = entry.members.indexOf(id);
         if (index < 0)
             return false;
@@ -284,7 +582,7 @@ export class CanvasStore {
         let dirty = false;
         for (const entry of this.teams) {
             const index = entry.members.indexOf(id);
-            if (index >= 0) {
+            if (index >= 0 && !this.isSuspended(entry.name, id)) {
                 entry.members.splice(index, 1);
                 dirty = true;
             }