@nelsonlongxiang/dsh-open-a2a-net 0.6.42 → 0.7.0

package/lib/faces/wire.js

@@ -7,7 +7,9 @@ import { peerPayloadFingerprint, WIRE_ERROR_IDEMPOTENCY_CONFLICT, WIRE_ERROR_REP
 import { briefOf } from "../task-ledger.js";
 import { parseReceipt, taskIdRefusal } from "../receipt.js";
 import { buildAuthorization, claimCovers, nextOf, refusalOf } from "../task-auth.js";
+import { AdmittedBookkeepingError, ADMITTED_BOOKKEEPING_NOTE } from "../admitted-bookkeeping.js";
 import { isRootOriginUrl } from "../origin-claim.js";
+import { hasOriginClaimFields, completeInboundVerification, verifiedInboundAdmission, WIRE_ERROR_INBOUND_VERIFICATION } from "../inbound-verification.js";
 import { withResponseFields } from "../response-fields.js";
 import { WIRE_ERROR_PAYLOAD_TOO_LARGE, withinRouteBodyCap } from "../transport-caps.js";
 /**
@@ -92,7 +94,7 @@ export class SyncAnswered {
     }
 }
 export function registerWireFaces(webServer, d) {
-    const { ctx, logger, config, cliDeposits, canvasStore, canvasNameReserved, sessionNodes, joinedSessions, idempotencyStore, verifyOriginClaim, remoteCliProof, callerLinkedToThisHost, recordActivity, peerKeyAdmits, a2aCallerRefusal, a2aCallerAdmission, allowlistVersionNow, observeAuthorization, scanSessionLogList, readSessionLogTail, taskLedger, refuseIfFlooded, refuseIfQueueFull, settleAndAnnounce, waitForForwardBirth, session, resolveAgentForTeam, parseCanvasTeamName, canvasLiveAgent, wakeColdTeam, probeConsumption, sessionTeamOf, localSessionOfHandle, steerRelay, fromClause, sanitizeFromClause, armReceiptAutosend, eventCountOf, receiptExpectationOf, armAsyncNudge, liveAgent, callerIsAgent, selfRouteText, noWakeFaceText, archivedColdMatchText, noColdMatchText, nativeTeamsPrepare, nativeTeamsRound, routeIntoAgent, } = d;
+    const { ctx, logger, config, cliDeposits, canvasStore, canvasNameReserved, sessionNodes, joinedSessions, idempotencyStore, verifyOriginClaim, remoteCliProof, callerLinkedToThisHost, recordActivity, peerKeyAdmits, a2aCallerRefusal, a2aCallerAdmission, allowlistVersionNow, observeAuthorization, scanSessionLogList, readSessionLogTail, taskLedger, refuseIfFlooded, refuseIfQueueFull, settleAndAnnounce, waitForForwardBirth, session, resolveAgentForTeam, parseCanvasTeamName, canvasLiveAgent, wakeColdTeam, probeConsumption, sessionTeamOf, localSessionOfHandle, steerRelay, followupRelay, cancelQueuedTask, fromClause, sanitizeFromClause, armReceiptAutosend, eventCountOf, receiptExpectationOf, armAsyncNudge, liveAgent, callerIsAgent, selfRouteText, noWakeFaceText, archivedColdMatchText, noColdMatchText, nativeTeamsPrepare, nativeTeamsRound, routeIntoAgent, } = d;
     const syncAnswered = new SyncAnswered();
     // gh#45 CLI 户口卡面 (peer face, unsigned card serve): the deposited
     // CLI's SIGNED card is served verbatim under its own base URL — an
@@ -182,7 +184,9 @@ export function registerWireFaces(webServer, d) {
                         const name = typeof body.name === 'string' ? body.name : '';
                         const rawId = typeof body.id === 'string' ? body.id : '';
                         // gh#131: a peer names our sessions by handle — the session it names, for removal.
-                        const id = (isRemoteMemberRef(rawId) ? localSessionOfHandle(rawId) : undefined) ?? rawId;
+                        // A bare handle may still infer for routing, never for deleting another stored slot.
+                        const provenOwn = rawId.endsWith('@' + d.ownCanvasFingerprint);
+                        const id = (provenOwn ? localSessionOfHandle(rawId) : undefined) ?? rawId;
                         let payload;
                         if (op === 'create') {
                             const stored = canvasNameReserved(name) ? undefined : canvasStore.create(name);
@@ -201,8 +205,13 @@ export function registerWireFaces(webServer, d) {
                                 if (body.home !== undefined)
                                     payload = { ok: false, error: 'CLI home pins may only be set by this host local control route' };
                                 else {
-                                    canvasStore.create(name);
-                                    payload = { ok: canvasStore.addMember(name, rawId), members: canvasStore.membersOf(name) };
+                                    const proof = await d.canvasMemberForWrite(rawId, undefined, claim.card);
+                                    if (!proof.ok)
+                                        payload = proof;
+                                    else {
+                                        canvasStore.create(name);
+                                        payload = { ok: canvasStore.addMember(name, proof.member, undefined, { ownerKey: proof.ownerKey }), members: canvasStore.membersOf(name) };
+                                    }
                                 }
                             }
                         }
@@ -435,503 +444,594 @@ export function registerWireFaces(webServer, d) {
                     res.end();
                 }
             });
-            req.on('end', async () => {
-                if (overflowed) {
-                    if (!res.writableEnded && !res.headersSent) {
-                        const payload = JSON.stringify({ error: 'payload too large', code: WIRE_ERROR_PAYLOAD_TOO_LARGE });
-                        res.writeHead(413, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+            req.on('end', () => {
+                void (async () => {
+                    if (overflowed) {
+                        if (!res.writableEnded && !res.headersSent) {
+                            const payload = JSON.stringify({ error: 'payload too large', code: WIRE_ERROR_PAYLOAD_TOO_LARGE });
+                            res.writeHead(413, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                            res.end(payload);
+                        }
+                        return;
+                    }
+                    const rawBody = Buffer.concat(chunks);
+                    let body;
+                    try {
+                        body = JSON.parse(rawBody.toString('utf8'));
+                        if (body === null || typeof body !== 'object' || Array.isArray(body))
+                            throw new TypeError('direct body must be a JSON object'); // #168: `null` read body.team in this async 'end' callback → unhandled rejection → host exit
+                    }
+                    catch {
+                        const payload = JSON.stringify({ error: 'malformed body', code: -32000 });
+                        res.writeHead(400, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
                         res.end(payload);
+                        return;
                     }
-                    return;
-                }
-                const rawBody = Buffer.concat(chunks);
-                let body;
-                try {
-                    body = JSON.parse(rawBody.toString('utf8'));
-                    if (body === null || typeof body !== 'object' || Array.isArray(body))
-                        throw new TypeError('direct body must be a JSON object'); // #168: `null` read body.team in this async 'end' callback → unhandled rejection → host exit
-                }
-                catch {
-                    const payload = JSON.stringify({ error: 'malformed body', code: -32000 });
-                    res.writeHead(400, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                    res.end(payload);
-                    return;
-                }
-                // V2 (gh#7, S1): the delivery face honors the apiKey gate exactly
-                // like the control face — a configured key without this header
-                // used to let anyone reachable steer sessions while the control
-                // routes demanded the key, making it decorative for delivery.
-                // Empty-key deployments keep the documented open posture.
-                // #317: a link key admits only its own verified, body-bound peer.
-                if (!await peerKeyAdmits(req, rawBody)) {
-                    const payload = JSON.stringify({ error: 'unauthorized: X-API-Key required on the delivery face (apiKey is configured)', code: -32000 });
-                    res.writeHead(401, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                    res.end(payload);
-                    return;
-                }
-                // #282 S2: our own `<canvas>@<fp8>` is our canvas; a foreign suffix stays for the forward walk.
-                const ownerQualified = splitCanvasOwner(typeof body.team === 'string' ? body.team : '');
-                const team = ownerQualified.owner !== undefined && ownerQualified.owner === d.ownCanvasFingerprint ? ownerQualified.team : typeof body.team === 'string' ? body.team : '';
-                const message = typeof body.message === 'string' ? body.message : '';
-                const caller = typeof body.caller_session === 'string' ? body.caller_session : '';
-                // P2 receipt-callback: where THIS node's receipt should route on
-                // the caller's side — the caller knows its routable address best
-                // (a joined session's node team, e.g. via the transport face's
-                // callbackTarget mapping). Bounded; absent → the caller label
-                // plays its usual role.
-                const callback = typeof body.callback === 'string' && body.callback !== '' && body.callback.length <= 128 ? body.callback : '';
-                const noWait = body.wait === false;
-                const contextId = typeof body.context_id === 'string' && body.context_id !== '' ? body.context_id : `ctx-${Math.random().toString(16).slice(2, 10)}`;
-                // The caller-born task id (idempotency key): echo it when present
-                // so the receipt header correlates with the caller's own result;
-                // pre-0.5.3 callers carry none and this node mints one.
-                const taskId = typeof body.task_id === 'string' && body.task_id !== '' ? body.task_id : `direct-${Math.random().toString(16).slice(2, 10)}`;
-                if (team === '' || message === '') {
-                    const payload = JSON.stringify({ error: 'team and message are required', code: -32000 });
-                    res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                    res.end(payload);
-                    return;
-                }
-                // #114 S5: a caller-born id must be header-safe — refused before
-                // admission, claim or steer, so nothing is booked under it.
-                const idRefusal = taskIdRefusal(taskId);
-                if (idRefusal !== undefined) {
-                    const payload = JSON.stringify({ error: idRefusal, code: -32000, team, task_status: 'TASK_STATE_FAILED' });
-                    res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                    res.end(payload);
-                    return;
-                }
-                // Phase-3 admission (owner ruling 2026-09-01, decision-seat
-                // filed): an inbound direct delivery must show a SHARED team.
-                // Local-zone callers are judged synchronously and exactly — the
-                // declaration lives in this host's own roster store, so the
-                // Anonymous-delivery refusal (S3 phase-3b, test-seat finding
-                // direct-001649ab): a delivery with NO caller_session field
-                // skips the admission gate entirely (nothing to judge) — that
-                // anonymous hole let any local process or reachable peer inject
-                // into a live session. The protocol contract is caller_session;
-                // its absence is now refused instead of silently waved through.
-                // (0.6.15: the rule now lives in a2aCallerRefusal so the
-                // read-only /a2a/log face admits callers by exactly the same
-                // standard as message delivery.)
-                // F1: only a FOREIGN CLI handle needs a bound host claim and live home card
-                // before admission. Every other caller keeps the existing admission-first order.
-                const foreignCli = config.teamScopeRouting && CLI_HANDLE_RE.test(caller) && cliDeposits.get(caller) === undefined;
-                const earlyClaim = foreignCli ? await verifyOriginClaim(req, { cli: true, rawBody }) : undefined;
-                const cliProof = foreignCli && earlyClaim?.ok ? await remoteCliProof(caller, earlyClaim).catch(() => undefined) : undefined;
-                let admission = a2aCallerAdmission(caller, team, cliProof);
-                // #282 S3 (same team authorizes): a receipt for this host's own forward, to the CLI that sent it, from a
-                // receiver frozen at birth on the selected peer's key — the owner's signed canvas is the return path.
-                const echoed = !admission.ok && cliDeposits.get(team) !== undefined ? parseReceipt(message) : null;
-                if (echoed !== null) {
-                    // Verify first, so an unsigned or Sig2-only caller cannot hold the connection on an in-flight forward (#287 review P3);
-                    // then a body-bound receipt may beat the dispatch's HTTP answer: wait for this forward's row to be born (#287 P2).
-                    const receiptClaim = earlyClaim ?? await verifyOriginClaim(req, { cli: true, rawBody });
-                    if (receiptClaim.ok && receiptClaim.bodyBound === true)
-                        await waitForForwardBirth(message);
-                    const basis = receiptClaim.ok ? d.forwardReceiptBasis(echoed.taskId, caller, team, receiptClaim) : undefined;
-                    if (basis !== undefined)
-                        admission = { ok: true, via: 'peer-org', rule: 'peer-org', basis: [basis] };
-                }
-                const callerRefusal = refusalOf(admission);
-                if (callerRefusal !== undefined || !admission.ok) {
-                    recordActivity('in', team, caller === '' ? 'anonymous' : caller, false);
-                    const next = nextOf(admission);
-                    const payload = JSON.stringify({ error: callerRefusal, code: -32000, team, task_status: 'TASK_STATE_FAILED', ...(next !== undefined ? { next } : {}) });
-                    res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                    res.end(payload);
-                    return;
-                }
-                // #114 S6: a version an inbound record is born under is always in the history.
-                observeAuthorization('lazy');
-                // #114 S2: the version is read at admission time, beside the decision it explains.
-                const admittedAt = { version: allowlistVersionNow(), at: Date.now() };
-                // gh#9+gh#10 OriginClaim on the delivery face (M1): an envelope
-                // that is present but unverifiable rejects untrusted-origin; an
-                // ABSENT envelope during the window walks on with a counted
-                // legacyInbound warn (the operator watches the tail drain), and
-                // after the window closes it rejects like a failed signature —
-                // N3 proves a NAME's linkability, never key possession.
-                // gh#133: the delivery face is where a deposited CLI identity signs its routes.
-                const claim = earlyClaim ?? await verifyOriginClaim(req, { cli: true, rawBody });
-                if (!claim.ok) {
-                    if (claim.reason !== 'absent' || config.originClaimWindow === false) {
+                    // V2 (gh#7, S1): the delivery face honors the apiKey gate exactly
+                    // like the control face — a configured key without this header
+                    // used to let anyone reachable steer sessions while the control
+                    // routes demanded the key, making it decorative for delivery.
+                    // Empty-key deployments keep the documented open posture.
+                    // #317: a link key admits only its own verified, body-bound peer.
+                    if (!await peerKeyAdmits(req, rawBody)) {
+                        const payload = JSON.stringify({ error: 'unauthorized: X-API-Key required on the delivery face (apiKey is configured)', code: -32000 });
+                        res.writeHead(401, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
+                        return;
+                    }
+                    // #282 S2: our own `<canvas>@<fp8>` is our canvas; a foreign suffix stays for the forward walk.
+                    const ownerQualified = splitCanvasOwner(typeof body.team === 'string' ? body.team : '');
+                    const team = ownerQualified.owner !== undefined && ownerQualified.owner === d.ownCanvasFingerprint ? ownerQualified.team : typeof body.team === 'string' ? body.team : '';
+                    const message = typeof body.message === 'string' ? body.message : '';
+                    const caller = typeof body.caller_session === 'string' ? body.caller_session : '';
+                    // P2 receipt-callback: where THIS node's receipt should route on
+                    // the caller's side — the caller knows its routable address best
+                    // (a joined session's node team, e.g. via the transport face's
+                    // callbackTarget mapping). Bounded; absent → the caller label
+                    // plays its usual role.
+                    const callback = typeof body.callback === 'string' && body.callback !== '' && body.callback.length <= 128 ? body.callback : '';
+                    const noWait = body.wait === false;
+                    const contextId = typeof body.context_id === 'string' && body.context_id !== '' ? body.context_id : `ctx-${Math.random().toString(16).slice(2, 10)}`;
+                    // The caller-born task id (idempotency key): echo it when present
+                    // so the receipt header correlates with the caller's own result;
+                    // pre-0.5.3 callers carry none and this node mints one.
+                    const taskId = typeof body.task_id === 'string' && body.task_id !== '' ? body.task_id : `direct-${Math.random().toString(16).slice(2, 10)}`;
+                    if (team === '' || message === '') {
+                        const payload = JSON.stringify({ error: 'team and message are required', code: -32000 });
+                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
+                        return;
+                    }
+                    // #114 S5: a caller-born id must be header-safe — refused before
+                    // admission, claim or steer, so nothing is booked under it.
+                    const idRefusal = taskIdRefusal(taskId);
+                    if (idRefusal !== undefined) {
+                        const payload = JSON.stringify({ error: idRefusal, code: -32000, team, task_status: 'TASK_STATE_FAILED' });
+                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
+                        return;
+                    }
+                    // Phase-3 admission (owner ruling 2026-09-01, decision-seat
+                    // filed): an inbound direct delivery must show a SHARED team.
+                    // Local-zone callers are judged synchronously and exactly — the
+                    // declaration lives in this host's own roster store, so the
+                    // Anonymous-delivery refusal (S3 phase-3b, test-seat finding
+                    // direct-001649ab): a delivery with NO caller_session field
+                    // skips the admission gate entirely (nothing to judge) — that
+                    // anonymous hole let any local process or reachable peer inject
+                    // into a live session. The protocol contract is caller_session;
+                    // its absence is now refused instead of silently waved through.
+                    // (0.6.15: the rule now lives in a2aCallerRefusal so the
+                    // read-only /a2a/log face admits callers by exactly the same
+                    // standard as message delivery.)
+                    // Complete present-envelope validation before evaluating request admission.
+                    // The fully absent-envelope migration policy remains independent.
+                    const foreignCli = config.teamScopeRouting && CLI_HANDLE_RE.test(caller) && cliDeposits.get(caller) === undefined;
+                    const envelopePresent = hasOriginClaimFields(req);
+                    const earlyClaim = envelopePresent ? await completeInboundVerification(() => verifyOriginClaim(req, { cli: true, rawBody })) : { ok: false, reason: 'absent' };
+                    const memberClaim = /^[^/\s]+\/[0-9a-f]{8}(?:@[0-9a-f]{8})?$/.test(caller) || caller === config.team || caller.startsWith(config.team + '/') || canvasStore.list().some(name => canvasStore.rawMembersOf(name).some(ref => ref === caller || ref.startsWith(caller + '@'))) || String(req.headers['x-a2a-caller'] ?? '') === config.team;
+                    const gate = verifiedInboundAdmission(earlyClaim, envelopePresent, memberClaim, key => a2aCallerAdmission(caller, team, undefined, key));
+                    if (!gate.ok) {
                         recordActivity('in', team, caller, false);
-                        const payload = JSON.stringify({ error: `untrusted-origin: OriginClaim verification failed (${claim.reason}) — present a signed envelope (X-A2A-Caller/-Url/-Ts/-Sig with your card key) or upgrade your node`, code: -32000, team, task_status: 'TASK_STATE_FAILED' });
+                        const payload = JSON.stringify({ error: 'untrusted-origin: OriginClaim verification failed (' + gate.reason + ')', code: WIRE_ERROR_INBOUND_VERIFICATION, reason: gate.reason, team, task_status: 'TASK_STATE_FAILED', delivered: false });
                         res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
                         res.end(payload);
                         return;
                     }
-                    d.bumpLegacyInbound();
-                }
-                // A verified claim proves the caller only when its signed zone covers it (review of PR #134 P1),
-                // and the host face only when it was signed from this very host (round 2: a zone name is not an origin).
-                const callerProof = !claim.ok ? 'legacy-window'
-                    : admission.rule === 'remote-ref-cli' ? 'origin-claim'
-                        : claim.cli === true ? (claimCovers(caller, claim.caller) ? 'cli-identity' : 'claim-mismatch')
-                            : claim.bound !== true ? 'unbound'
-                                : !isRootOriginUrl(claim.callerUrl) ? 'claim-mismatch'
-                                    : admission.rule === 'host-face' && originOf(claim.callerUrl) !== originOf(d.ownCardUrl) ? 'claim-mismatch'
-                                        : claimCovers(caller, claim.caller) ? 'origin-claim' : 'claim-mismatch';
-                const proofClause = callerProof === 'origin-claim' && claim.ok ? `已验证来源 ${originOf(claim.callerUrl)}`
-                    : callerProof === 'cli-identity' ? '未验证（cli-identity）' : `未验证（${callerProof}）`;
-                const directHeader = (from) => `[A2A direct] (task ${taskId}) ${proofClause} ${sanitizeFromClause(from)} (routed to ${team}) sent:`;
-                if (refuseIfBudgetExhausted(req, res, team, caller, taskId, taskLedger))
-                    return;
-                // Server-side idempotency (P3/B3): one key, one execution inside
-                // the window. Same key + same payload ⇒ replay; different payload
-                // ⇒ hard conflict (both 409). A replay must never re-enter the
-                // target session, no matter how it settles.
-                const idemFingerprint = peerPayloadFingerprint({ caller, message, noWait, team });
-                const idemVerdict = idempotencyStore.claim(taskId, idemFingerprint);
-                if (idemVerdict !== 'fresh') {
-                    const replay = idemVerdict === 'replay';
-                    // Conflicts warn (caller key reuse bugs); harmless replays stay silent.
-                    if (!replay)
-                        logger.warn(`a2a: idempotency CONFLICT on task ${taskId.slice(0, 80)} — same key reused with a different payload (caller bug; never auto-retry)`);
-                    const payload = JSON.stringify({
-                        error: replay ? 'duplicate task id within the idempotency window' : 'task id reused with a different payload',
-                        code: replay ? WIRE_ERROR_REPLAY_REJECTED : WIRE_ERROR_IDEMPOTENCY_CONFLICT,
-                        task_id: taskId,
-                        replay,
-                    });
-                    res.writeHead(409, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                    res.end(payload);
-                    return;
-                }
-                if (refuseIfFlooded(caller, message, team, taskId, res))
-                    return;
-                if (refuseIfQueueFull(caller, message, team, taskId, cliDeposits.get(team) !== undefined, res))
-                    return;
-                // The caller-side receipt correlation: a message shaped as a
-                // receipt resolves the task it echoes, whichever wait semantics
-                // carried it here. Correlation is bookkeeping only — the message
-                // steers on exactly as before.
-                // #114 S4: the settler is this delivery's caller, as proven here. A CLI identity's claim URL
-                // is not a host's origin (its origin is unconstrained), so it never vouches for one (review of PR #140 P1-2).
-                // #139: the claim's card key names the host whatever address spelling it signed with.
-                // The response can race a fast peer receipt. Wait for this exact forwarding birth before judging or acknowledging it.
-                await waitForForwardBirth(message);
-                const refusedSettlement = settleAndAnnounce(message, { caller, proof: callerProof, ...settlerClaimFields(claim, originOf), ingress: 'wire' });
-                // #139 (design §4.4): every answer this delivery gets carries the refusal.
-                if (refusedSettlement !== undefined)
-                    withSettlementField(res, refusedSettlement);
-                // gh#45 CLI mailbox (wire face): a delivery targeting a DEPOSITED
-                // CLI handle never resolves a session and never wakes — it lands
-                // in the deposit's mailbox and answers delivered. Placement here
-                // keeps the idempotency claim (above) exactly as for sessions.
-                const cliRow = cliDeposits.get(team);
-                if (cliRow !== undefined) {
-                    const answered = parseReceipt(message);
-                    // #298: only the answering member's own, unrefused receipt is the duplicate of a sync answer.
-                    const duplicate = answered !== null && refusedSettlement === undefined && syncAnswered.take(answered.taskId, team, caller);
-                    cliDeposits.mail(team, caller, `${directHeader(caller)}\n\n${message}`, duplicate ? 'sync-answered' : undefined);
-                    recordActivity('in', team, caller, true);
-                    logger.info(`a2a: cli mailbox delivery for ${team} (from ${caller})`);
-                    const note = `delivered to the mailbox of ${team} — the CLI polls while online`;
-                    // gh#112 review: a mailbox delivery is final from this host's
-                    // side, so a resend of this id reads `completed`. A receipt the
-                    // CLI routes back later still reaches its caller, but does not
-                    // replace this outcome (recordOutcome is first-writer-wins).
-                    idempotencyStore.recordOutcome(taskId, { status: 'completed', reply: note });
-                    const payload = JSON.stringify({ routed: true, delivered: true, receipt: 'mailbox', team, task_id: taskId, task_status: 'TASK_STATE_COMPLETED', note });
-                    res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                    res.end(payload);
-                    return;
-                }
-                // Inbound routing is foreground demand: boot prewarm yields for a
-                // quiet window around it.
-                d.touchWakeDemand();
-                const forwardMiss = async (original) => {
-                    // #282 S2 review P1: forward with the id the caller sent — our own `@fp8` must find no other owner.
-                    const result = await d.forwardDirect({ team: typeof body.team === 'string' && ownerQualified.owner !== undefined ? body.team : team, message, caller, taskId, contextId, noWait,
-                        auth: buildAuthorization(admission, { caller, proof: callerProof, ...(claim.ok ? { claim: { caller: claim.caller, origin: originOf(claim.callerUrl) } } : {}), ingress: 'wire', allowlistVersion: admittedAt.version, target: team, receiptTarget: caller, receivedAt: admittedAt.at }),
-                        localCliProof: claim.ok && claim.cli === true && claim.bound && claim.caller === caller, guarded: req.headers['x-a2a-guard'] !== undefined }).catch((error) => ({ ok: false, error: `forwarding unavailable: ${String(error)}`, code: -32000, task_id: taskId }));
-                    const failure = result.ok ? '' : await d.diagnoseCanvas(team, original + ' — ' + result.error, claim.ok && claim.cli === true && claim.bound && claim.caller === caller ? caller : undefined);
-                    if (!result.ok && result.code !== -32005)
-                        idempotencyStore.recordOutcome(taskId, { status: 'failed', error: failure });
-                    else if (result.ok && result.task_status === 'TASK_STATE_COMPLETED')
-                        idempotencyStore.recordOutcome(taskId, { status: 'completed', reply: result.reply });
-                    const payload = JSON.stringify(result.ok ? { routed: true, ...(result.task_status === 'TASK_STATE_DELIVERED' ? { delivered: true } : { result: { text: result.reply } }), team, task_id: taskId, context_id: contextId, task_status: result.task_status, consumed: result.consumed, bridge: result.bridge, receipt: result.receipt, forwarded: true } : { error: failure, code: result.code ?? -32000, receipt: result.receipt, task_id: taskId, team, task_status: result.code === -32005 ? 'TASK_STATE_DELIVERED' : 'TASK_STATE_FAILED', ...(result.next !== undefined ? { next: result.next } : {}) });
-                    // #298: only a reply the peer itself declares final (`reply_final`; never a host placeholder, review of
-                    // #305 F3), handed to the CLI in full, marks that member's later receipt a duplicate — never a delivered,
-                    // mailbox or bridge shape (F1), and never when the CLI gave up and closed the socket ('finish' does not fire).
-                    const answeredBy = result.ok ? result.deliveredTo : undefined;
-                    if (!noWait && result.ok && result.replyFinal === true && result.task_status === 'TASK_STATE_COMPLETED' && result.receipt === undefined && result.bridge === undefined && answeredBy !== undefined
-                        && claim.ok && claim.cli === true && claim.bound && claim.caller === caller && cliDeposits.get(caller) !== undefined)
-                        res.once('finish', () => syncAnswered.note(taskId, caller, answeredBy));
-                    res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                    res.end(payload);
-                };
-                // wait:false delivers without the final-reply hold: steer resolves
-                // synchronously inside routeIntoAgentFor, so by the time the agent
-                // lookup settles the message is already in — answer delivered and
-                // let the receipt contract carry the reply.
-                if (noWait) {
-                    // gh#112 review P1: a no-wait refusal AFTER the idempotency
-                    // claim records its failed outcome — otherwise a resend of the
-                    // same id reads `pending` from /a2a/query forever and the
-                    // caller is told an undelivered message already landed.
-                    const refuseNoWait = (error, activity = true) => {
-                        if (activity)
-                            recordActivity('in', team, caller, false);
-                        idempotencyStore.recordOutcome(taskId, { status: 'failed', error });
-                        const payload = JSON.stringify({ error, code: -32000, team, task_id: taskId, task_status: 'TASK_STATE_FAILED' });
+                    const priorFingerprint = peerPayloadFingerprint({ caller, message, noWait, team });
+                    const priorTransport = idempotencyStore.query(taskId, priorFingerprint);
+                    if (earlyClaim.ok && priorTransport.found && priorTransport.status === 'completed' && d.receiptReplayAllowed(message, caller, team, earlyClaim)) {
+                        const payload = JSON.stringify({ routed: true, delivered: true, receipt: 'none', team, task_id: taskId, task_status: 'TASK_STATE_COMPLETED', note: 'receipt delivery already confirmed' });
                         res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
                         res.end(payload);
-                    };
-                    // Issue #41 companion fix: the no-wait inbound branch resolved
-                    // only bare session teams — a canvas team delivery (wait:false)
-                    // fell through to the cold tier and answered a bogus
-                    // no-match although a live member existed. Same resolution as
-                    // the waiting face (routeIntoAgent), and likewise NO initiator
-                    // skip: the wire face delivers faithfully to the first live
-                    // member, whoever the caller is.
-                    const agent = resolveAgentForTeam(team) ?? canvasLiveAgent(parseCanvasTeamName(team));
-                    const wake = agent !== undefined ? undefined : wakeColdTeam(team);
-                    const deliver = (target) => {
-                        const from = caller === '' ? 'an unknown node' : caller;
-                        // The receipt target: the caller's callback address when it
-                        // supplied one (a session node team — wake-on-route covers a
-                        // cold one), else the caller label as before.
-                        const receiptTarget = callback !== '' ? callback : from;
-                        // gh#112 review: only a failed steer is a refusal. Once the
-                        // message is in the session, a failure in the bookkeeping that
-                        // follows must not record `failed` (a resend would read
-                        // "already ran and failed" and invite a second execution).
-                        let steered = false;
-                        try {
-                            // The receipt header carries the task id: the target echoes
-                            // it verbatim in "[A2A receipt] task <id> ...", closing the
-                            // correlation loop with the caller's own route result.
-                            // F1' (consumed-probe prior-running): capture the pre-steer
-                            // status first — a target that was already running (its own
-                            // turn / a brand-new session's activation window) reads
-                            // `running` after the steer whether or not our wake was
-                            // latched, so the post-steer read alone would answer a false
-                            // consumed:true and strand the message.
-                            const runningBeforeSteer = probeConsumption(target, taskId);
-                            // #114 S5: the receipt's consumption search starts here, so an
-                            // older steer of a reused id in the history never anchors it.
-                            const steerFloor = eventCountOf(target);
-                            const deliveredReceipt = parseReceipt(message) !== null;
-                            // gh#141: a receipt is answered by nobody — its steer asks for no receipt back.
-                            const receiptRequest = deliveredReceipt ? '' : `\n\n(When done, route your outcome back with one call — a2a_route { team: "${receiptTarget}", message: "[A2A receipt] task ${taskId} <one-line outcome>" }.)`;
-                            steerRelay(target, `${directHeader(from)}\n\n${message}${receiptRequest}`, from === 'an unknown node' ? undefined : from);
-                            steered = true;
-                            recordActivity('in', team, caller, true);
-                            armReceiptAutosend(target, taskId, receiptTarget, message, steerFloor);
-                            // v0.5.23 (async-stall): "delivered" only proves the steer call
-                            // returned — not that a turn started. An idle-phase steer wakes
-                            // the driver, but a maintenance/abort window latches the wake for
-                            // replay that may never fire (defect t-mt6nd0sq-hxuhj6: seven
-                            // delivered:true routes with zero log growth). Probe the driver
-                            // shortly after: running means the message is being consumed;
-                            // still-idle means the wake was latched or dropped — surface that
-                            // honestly and arm a delayed nudge retry below.
-                            // F1': a prior-running target never trusts the single
-                            // post-steer read — answer consumed:false conservatively and
-                            // arm the nudge (a false negative costs one harmless nudge; a
-                            // false positive strands the delivered message).
-                            // F2' (receipt-settlement): the delivery is born into the
-                            // ledger — an inbound row owes a receipt only this node can
-                            // produce, and before this row existed the nudge's isPending
-                            // gate no-op'd for exactly the deliveries that stall (08-30:
-                            // zero ledger records for latched activations). Arming is
-                            // unconditional now; settlement evidence disarms in the
-                            // callback.
-                            const consumedProbe = runningBeforeSteer ? false : probeConsumption(target, taskId);
-                            // F5 (settlement integrity): the debt gate — a process-label
-                            // caller cannot receive receipts, so this delivery is born
-                            // fire-and-forget (receiptExpected:false, answered as
-                            // receipt:"none") instead of manufacturing a debt nobody can
-                            // settle. The row itself stays: stall visibility and the
-                            // nudge still apply to the TARGET side.
-                            const receiptExpectation = receiptExpectationOf(receiptTarget);
-                            // #114 S2: the row is born with its immutable authorization record.
-                            const auth = buildAuthorization(admission, {
-                                caller,
-                                proof: callerProof,
-                                ...(claim.ok ? { claim: { caller: claim.caller, origin: originOf(claim.callerUrl) } } : {}),
-                                ...(admission.rule === 'remote-ref-cli' && claim.ok ? { carrierUrl: originOf(claim.callerUrl) } : {}),
-                                ingress: 'wire',
-                                allowlistVersion: admittedAt.version,
-                                target: team,
-                                receiptTarget,
-                                receivedAt: admittedAt.at,
-                                // Audit only: a cold session's activation window also reads as running.
-                                targetBusy: runningBeforeSteer,
-                            });
-                            // #139: the member that actually received it answers for a canvas or bare-zone team.
-                            const deliveredTo = sessionTeamOf(target);
-                            // gh#141: a receipt owes no receipt — it is settlement traffic,
-                            // recorded on the row it settled. Booking it would leave a debt
-                            // nothing can pay, and a nudge chasing an answer nobody owes.
-                            if (!deliveredReceipt) {
-                                taskLedger.trackInbound(taskId, team, receiptTarget, contextId === '' ? undefined : contextId, receiptExpectation !== 'process-label', briefOf(message), auth, deliveredTo === team ? undefined : deliveredTo);
-                                armAsyncNudge(target, team, taskId, config.asyncNudgeDelayMs);
-                            }
-                            const payload = JSON.stringify({
-                                routed: true,
-                                delivered: true,
-                                team,
-                                session,
-                                task_id: taskId,
-                                context_id: contextId,
-                                task_status: 'TASK_STATE_DELIVERED',
-                                artifacts: [],
-                                consumed: consumedProbe,
-                                ...(req.headers['x-a2a-guard'] !== undefined ? { delivered_to: deliveredTo } : {}),
-                                receipt: receiptExpectation === 'process-label' || deliveredReceipt ? 'none' : 'routed',
-                            });
+                        return;
+                    }
+                    const cliProof = foreignCli && earlyClaim?.ok ? await remoteCliProof(caller, earlyClaim).catch(() => undefined) : undefined;
+                    let admission = foreignCli ? a2aCallerAdmission(caller, team, cliProof, earlyClaim?.ok ? earlyClaim.card.publicKey : undefined) : gate.admission;
+                    // #282 S3 (same team authorizes): a receipt for this host's own forward, to the CLI that sent it, from a
+                    // receiver frozen at birth on the selected peer's key — the owner's signed canvas is the return path.
+                    const echoed = !admission.ok && cliDeposits.get(team) !== undefined ? parseReceipt(message) : null;
+                    if (echoed !== null) {
+                        // Verify first, so an unsigned or Sig2-only caller cannot hold the connection on an in-flight forward (#287 review P3);
+                        // then a body-bound receipt may beat the dispatch's HTTP answer: wait for this forward's row to be born (#287 P2).
+                        const receiptClaim = earlyClaim;
+                        if (receiptClaim.ok && receiptClaim.bodyBound === true)
+                            await waitForForwardBirth(message);
+                        const basis = receiptClaim.ok ? d.forwardReceiptBasis(echoed.taskId, caller, team, receiptClaim) : undefined;
+                        if (basis !== undefined)
+                            admission = { ok: true, via: 'peer-org', rule: 'peer-org', basis: [basis] };
+                    }
+                    const callerRefusal = refusalOf(admission);
+                    if (callerRefusal !== undefined || !admission.ok) {
+                        recordActivity('in', team, caller === '' ? 'anonymous' : caller, false);
+                        const next = nextOf(admission);
+                        const payload = JSON.stringify({ error: callerRefusal, code: -32000, team, task_status: 'TASK_STATE_FAILED', ...(next !== undefined ? { next } : {}) });
+                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
+                        return;
+                    }
+                    // #114 S6: a version an inbound record is born under is always in the history.
+                    observeAuthorization('lazy');
+                    // #114 S2: the version is read at admission time, beside the decision it explains.
+                    const admittedAt = { version: allowlistVersionNow(), at: Date.now() };
+                    // gh#9+gh#10 OriginClaim on the delivery face (M1): an envelope
+                    // that is present but unverifiable rejects untrusted-origin; an
+                    // ABSENT envelope during the window walks on with a counted
+                    // legacyInbound warn (the operator watches the tail drain), and
+                    // after the window closes it rejects like a failed signature —
+                    // N3 proves a NAME's linkability, never key possession.
+                    // gh#133: the delivery face is where a deposited CLI identity signs its routes.
+                    const claim = earlyClaim;
+                    if (!claim.ok) {
+                        if (claim.reason !== 'absent' || config.originClaimWindow === false) {
+                            recordActivity('in', team, caller, false);
+                            const payload = JSON.stringify({ error: `untrusted-origin: OriginClaim verification failed (${claim.reason}) — present a signed envelope (X-A2A-Caller/-Url/-Ts/-Sig with your card key) or upgrade your node`, code: -32000, team, task_status: 'TASK_STATE_FAILED' });
                             res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
                             res.end(payload);
+                            return;
+                        }
+                        d.bumpLegacyInbound();
+                    }
+                    // A verified claim proves the caller only when its signed zone covers it (review of PR #134 P1),
+                    // and the host face only when it was signed from this very host (round 2: a zone name is not an origin).
+                    const callerProof = !claim.ok ? 'legacy-window'
+                        : admission.rule === 'remote-ref-cli' ? 'origin-claim'
+                            : claim.cli === true ? (claimCovers(caller, claim.caller) ? 'cli-identity' : 'claim-mismatch')
+                                : claim.bound !== true ? 'unbound'
+                                    : !isRootOriginUrl(claim.callerUrl) ? 'claim-mismatch'
+                                        : admission.rule === 'host-face' && originOf(claim.callerUrl) !== originOf(d.ownCardUrl) ? 'claim-mismatch'
+                                            : claimCovers(caller, claim.caller) ? 'origin-claim' : 'claim-mismatch';
+                    const proofClause = callerProof === 'origin-claim' && claim.ok ? `已验证来源 ${originOf(claim.callerUrl)}`
+                        : callerProof === 'cli-identity' ? '未验证（cli-identity）' : `未验证（${callerProof}）`;
+                    const directHeader = (from) => `[A2A direct] (task ${taskId}) ${proofClause} ${sanitizeFromClause(from)} (routed to ${team}) sent:`;
+                    if (refuseIfBudgetExhausted(req, res, team, caller, taskId, taskLedger))
+                        return;
+                    // Server-side idempotency (P3/B3): one key, one execution inside
+                    // the window. Same key + same payload ⇒ replay; different payload
+                    // ⇒ hard conflict (both 409). A replay must never re-enter the
+                    // target session, no matter how it settles.
+                    const idemFingerprint = peerPayloadFingerprint({ caller, message, noWait, team });
+                    const priorDelivery = taskLedger.deliveryFor(taskId);
+                    if (taskLedger.orphanDelivery(taskId) && priorDelivery?.callerKey === (claim.ok ? claim.card.publicKey : undefined) && idempotencyStore.query(taskId, idemFingerprint).found) {
+                        const payload = JSON.stringify({ routed: true, delivered: true, team, task_id: taskId, context_id: contextId, task_status: 'TASK_STATE_DELIVERED', receipt: 'routed', receiverBookkeeping: 'failed', note: ADMITTED_BOOKKEEPING_NOTE });
+                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
+                        return;
+                    }
+                    const idemVerdict = idempotencyStore.claim(taskId, idemFingerprint);
+                    if (idemVerdict !== 'fresh') {
+                        const replay = idemVerdict === 'replay';
+                        // Conflicts warn (caller key reuse bugs); harmless replays stay silent.
+                        if (!replay)
+                            logger.warn(`a2a: idempotency CONFLICT on task ${taskId.slice(0, 80)} — same key reused with a different payload (caller bug; never auto-retry)`);
+                        const payload = JSON.stringify({
+                            error: replay ? 'duplicate task id within the idempotency window' : 'task id reused with a different payload',
+                            code: replay ? WIRE_ERROR_REPLAY_REJECTED : WIRE_ERROR_IDEMPOTENCY_CONFLICT,
+                            task_id: taskId,
+                            replay,
+                        });
+                        res.writeHead(409, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
+                        return;
+                    }
+                    if (body.cancel_task_id !== undefined) {
+                        const cancelledId = typeof body.cancel_task_id === 'string' ? body.cancel_task_id : '';
+                        const original = taskLedger.find(cancelledId), originalClaim = original?.auth?.claim;
+                        const allowed = claim.ok && claim.bodyBound === true && callerProof === 'origin-claim' && original?.direction === 'inbound' && original.auth?.caller === caller && originalClaim?.caller === claim.caller && originalClaim.origin === originOf(claim.callerUrl) && taskLedger.deliveryFor(cancelledId)?.callerKey === claim.card.publicKey;
+                        if (!allowed) {
+                            res.writeHead(403, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'cancellation does not match the original authenticated caller', task_status: 'TASK_STATE_FAILED' }));
+                            return;
+                        }
+                        taskLedger.cancel(cancelledId, 'authenticated caller stop notice');
+                        let removed = false, steered = false;
+                        try {
+                            const notification = await cancelQueuedTask(cancelledId, message, caller, original);
+                            removed = notification.removed;
+                            steered = notification.steered;
                         }
                         catch (error) {
-                            if (!steered) {
-                                refuseNoWait(`The DSH session rejected the message: ${String(error)}`);
-                                return;
-                            }
-                            logger.warn(`a2a: task ${taskId.slice(0, 80)} was delivered to ${team}, but its bookkeeping failed: ${String(error)}`);
-                            if (!res.headersSent) {
-                                const payload = JSON.stringify({ routed: true, delivered: true, team, task_id: taskId, context_id: contextId, task_status: 'TASK_STATE_DELIVERED', artifacts: [], consumed: false, receipt: 'routed' });
-                                res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                                res.end(payload);
-                            }
+                            logger.warn('a2a: cancellation committed; stop notice was best-effort: %s', String(error));
                         }
-                    };
-                    if (agent !== undefined) {
-                        deliver(agent);
+                        const payload = JSON.stringify({ routed: true, delivered: true, removed, steered, receipt: 'none', team, task_id: taskId, task_status: 'TASK_STATE_COMPLETED', result: { text: 'cancellation admitted for original task' } });
+                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
                         return;
                     }
-                    if (wake?.kind === 'flight') {
-                        void wake.flight.then(deliver, (error) => {
-                            refuseNoWait(`waking the session for team "${team}" failed: ${String(error)}`);
-                        });
+                    if (refuseIfFlooded(caller, message, team, taskId, res))
+                        return;
+                    if (refuseIfQueueFull(caller, message, team, taskId, cliDeposits.get(team) !== undefined, res))
                         return;
+                    // The caller-side receipt correlation: a message shaped as a
+                    // receipt resolves the task it echoes, whichever wait semantics
+                    // carried it here. Correlation is bookkeeping only — the message
+                    // steers on exactly as before.
+                    // #114 S4: the settler is this delivery's caller, as proven here. A CLI identity's claim URL
+                    // is not a host's origin (its origin is unconstrained), so it never vouches for one (review of PR #140 P1-2).
+                    // #139: the claim's card key names the host whatever address spelling it signed with.
+                    // The response can race a fast peer receipt. Wait for this exact forwarding birth before judging or acknowledging it.
+                    await waitForForwardBirth(message);
+                    let refusedSettlement;
+                    try {
+                        refusedSettlement = settleAndAnnounce(message, { caller, proof: callerProof, ...settlerClaimFields(claim, originOf), ingress: 'wire' });
                     }
-                    // Remaining candidates need one async classification (the
-                    // native-teams bridge), so the tail answers inside an IIFE.
-                    void (async () => {
-                        // Native-teams inbound bridge (opt-in): prepare BEFORE answering
-                        // delivered — claim, seam, and parent initiator are everything
-                        // that can fail fast, and a phantom dispatch must never answer
-                        // success. Past prepare, the round fires detached (noWait means
-                        // delivery, not settlement); its late outcome corrects the
-                        // activity ring and the log.
-                        const standardMiss = async () => {
-                            if (team === config.team) {
-                                const live = liveAgent();
-                                if (live !== undefined) {
-                                    // Self-route refusal (mirrors the sync face): a caller
-                                    // naming the very agent the fallback resolves to must
-                                    // get an honest failure, never its own dispatch echoed
-                                    // home plus an auto-receipt for work nobody did.
-                                    if (callerIsAgent(live, caller)) {
-                                        refuseNoWait(selfRouteText(team));
-                                        return;
-                                    }
-                                    deliver(live);
-                                    return;
+                    catch {
+                        // A failed receipt settlement did not deliver: keep its fixed transport identity retryable.
+                        if (parseReceipt(message) !== null)
+                            idempotencyStore.releaseUncompleted(taskId, idemFingerprint);
+                        // Body end runs outside the webServer guard; a failed commit must not escape or steer.
+                        const payload = JSON.stringify({ error: 'task ledger write failed; settlement was not committed', code: -32000, task_id: taskId, task_status: 'TASK_STATE_FAILED', delivered: false });
+                        res.writeHead(503, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
+                        return;
+                    }
+                    // #139 (design §4.4): every answer this delivery gets carries the refusal.
+                    if (refusedSettlement !== undefined)
+                        withSettlementField(res, refusedSettlement);
+                    // gh#45 CLI mailbox (wire face): a delivery targeting a DEPOSITED
+                    // CLI handle never resolves a session and never wakes — it lands
+                    // in the deposit's mailbox and answers delivered. Placement here
+                    // keeps the idempotency claim (above) exactly as for sessions.
+                    const cliRow = cliDeposits.get(team);
+                    if (cliRow !== undefined) {
+                        const answered = parseReceipt(message);
+                        // #298: only the answering member's own, unrefused receipt is the duplicate of a sync answer.
+                        const duplicate = answered !== null && refusedSettlement === undefined && syncAnswered.take(answered.taskId, team, caller);
+                        cliDeposits.mail(team, caller, `${directHeader(caller)}\n\n${message}`, duplicate ? 'sync-answered' : undefined);
+                        recordActivity('in', team, caller, true);
+                        logger.info(`a2a: cli mailbox delivery for ${team} (from ${caller})`);
+                        const note = `delivered to the mailbox of ${team} — the CLI polls while online`;
+                        // gh#112 review: a mailbox delivery is final from this host's
+                        // side, so a resend of this id reads `completed`. A receipt the
+                        // CLI routes back later still reaches its caller, but does not
+                        // replace this outcome (recordOutcome is first-writer-wins).
+                        idempotencyStore.recordOutcome(taskId, { status: 'completed', reply: note });
+                        const payload = JSON.stringify({ routed: true, delivered: true, receipt: 'mailbox', team, task_id: taskId, task_status: 'TASK_STATE_COMPLETED', note });
+                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
+                        return;
+                    }
+                    // Inbound routing is foreground demand: boot prewarm yields for a
+                    // quiet window around it.
+                    d.touchWakeDemand();
+                    const forwardMiss = async (original) => {
+                        // #282 S2 review P1: forward with the id the caller sent — our own `@fp8` must find no other owner.
+                        const result = await d.forwardDirect({ team: typeof body.team === 'string' && ownerQualified.owner !== undefined ? body.team : team, message, caller, taskId, contextId, noWait,
+                            auth: buildAuthorization(admission, { caller, proof: callerProof, ...(claim.ok ? { claim: { caller: claim.caller, origin: originOf(claim.callerUrl) } } : {}), ingress: 'wire', allowlistVersion: admittedAt.version, target: team, receiptTarget: caller, receivedAt: admittedAt.at }),
+                            localCliProof: claim.ok && claim.cli === true && claim.bound && claim.caller === caller, guarded: req.headers['x-a2a-guard'] !== undefined }).catch((error) => ({ ok: false, error: `forwarding unavailable: ${String(error)}`, code: -32000, task_id: taskId }));
+                        const failure = result.ok ? '' : await d.diagnoseCanvas(team, original + ' — ' + result.error, claim.ok && claim.cli === true && claim.bound && claim.caller === caller ? caller : undefined);
+                        if (!result.ok && result.code !== -32005)
+                            idempotencyStore.recordOutcome(taskId, { status: 'failed', error: failure });
+                        else if (result.ok && result.task_status === 'TASK_STATE_COMPLETED')
+                            idempotencyStore.recordOutcome(taskId, { status: 'completed', reply: result.reply });
+                        const payload = JSON.stringify(result.ok ? { routed: true, ...(result.task_status === 'TASK_STATE_DELIVERED' ? { delivered: true } : { result: { text: result.reply } }), team, task_id: taskId, context_id: contextId, task_status: result.task_status, consumed: result.consumed, bridge: result.bridge, receipt: result.receipt, ...(result.receiverBookkeeping === 'failed' ? { receiverBookkeeping: 'failed', note: ADMITTED_BOOKKEEPING_NOTE } : {}), forwarded: true } : { error: failure, code: result.code ?? -32000, receipt: result.receipt, task_id: taskId, team, task_status: result.code === -32005 ? 'TASK_STATE_DELIVERED' : 'TASK_STATE_FAILED', ...(result.next !== undefined ? { next: result.next } : {}) });
+                        // #298: only a reply the peer itself declares final (`reply_final`; never a host placeholder, review of
+                        // #305 F3), handed to the CLI in full, marks that member's later receipt a duplicate — never a delivered,
+                        // mailbox or bridge shape (F1), and never when the CLI gave up and closed the socket ('finish' does not fire).
+                        const answeredBy = result.ok ? result.deliveredTo : undefined;
+                        if (!noWait && result.ok && result.replyFinal === true && result.task_status === 'TASK_STATE_COMPLETED' && result.receipt === undefined && result.bridge === undefined && answeredBy !== undefined
+                            && claim.ok && claim.cli === true && claim.bound && claim.caller === caller && cliDeposits.get(caller) !== undefined)
+                            res.once('finish', () => syncAnswered.note(taskId, caller, answeredBy));
+                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
+                    };
+                    // wait:false delivers without the final-reply hold: steer resolves
+                    // synchronously inside routeIntoAgentFor, so by the time the agent
+                    // lookup settles the message is already in — answer delivered and
+                    // let the receipt contract carry the reply.
+                    if (noWait) {
+                        // gh#112 review P1: a no-wait refusal AFTER the idempotency
+                        // claim records its failed outcome — otherwise a resend of the
+                        // same id reads `pending` from /a2a/query forever and the
+                        // caller is told an undelivered message already landed.
+                        const refuseNoWait = (error, activity = true) => {
+                            if (activity)
+                                recordActivity('in', team, caller, false);
+                            idempotencyStore.recordOutcome(taskId, { status: 'failed', error });
+                            const payload = JSON.stringify({ error, code: -32000, team, task_id: taskId, task_status: 'TASK_STATE_FAILED' });
+                            res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                            res.end(payload);
+                        };
+                        // Issue #41 companion fix: the no-wait inbound branch resolved
+                        // only bare session teams — a canvas team delivery (wait:false)
+                        // fell through to the cold tier and answered a bogus
+                        // no-match although a live member existed. Same resolution as
+                        // the waiting face (routeIntoAgent), and likewise NO initiator
+                        // skip: the wire face delivers faithfully to the first live
+                        // member, whoever the caller is.
+                        const agent = resolveAgentForTeam(team) ?? canvasLiveAgent(parseCanvasTeamName(team));
+                        const wake = agent !== undefined ? undefined : wakeColdTeam(team);
+                        const deliver = (target) => {
+                            const from = caller === '' ? 'an unknown node' : caller;
+                            // The receipt target: the caller's callback address when it
+                            // supplied one (a session node team — wake-on-route covers a
+                            // cold one), else the caller label as before.
+                            const receiptTarget = callback !== '' ? callback : from;
+                            // gh#112 review: only a failed steer is a refusal. Once the
+                            // message is in the session, a failure in the bookkeeping that
+                            // follows must not record `failed` (a resend would read
+                            // "already ran and failed" and invite a second execution).
+                            let steered = false;
+                            try {
+                                // The receipt header carries the task id: the target echoes
+                                // it verbatim in "[A2A receipt] task <id> ...", closing the
+                                // correlation loop with the caller's own route result.
+                                // F1' (consumed-probe prior-running): capture the pre-steer
+                                // status first — a target that was already running (its own
+                                // turn / a brand-new session's activation window) reads
+                                // `running` after the steer whether or not our wake was
+                                // latched, so the post-steer read alone would answer a false
+                                // consumed:true and strand the message.
+                                const runningBeforeSteer = probeConsumption(target, taskId);
+                                // #114 S5: the receipt's consumption search starts here, so an
+                                // older steer of a reused id in the history never anchors it.
+                                const steerFloor = eventCountOf(target);
+                                const deliveredReceipt = parseReceipt(message) !== null;
+                                // gh#141: a receipt is answered by nobody — its steer asks for no receipt back.
+                                const receiptRequest = deliveredReceipt ? '' : `\n\n(When done, route your outcome back with one call — a2a_route { team: "${receiptTarget}", message: "[A2A receipt] task ${taskId} <one-line outcome>" }.)`;
+                                followupRelay(target, `${directHeader(from)}\n\n${message}${receiptRequest}`, from === 'an unknown node' ? undefined : from, undefined, taskId, claim.ok ? claim.card.publicKey : undefined, !deliveredReceipt);
+                                steered = true;
+                                if (deliveredReceipt && refusedSettlement === undefined)
+                                    idempotencyStore.recordOutcome(taskId, { status: 'completed', reply: 'receipt delivered' });
+                                recordActivity('in', team, caller, true);
+                                // v0.5.23 (async-stall): "delivered" only proves the steer call
+                                // returned — not that a turn started. An idle-phase steer wakes
+                                // the driver, but a maintenance/abort window latches the wake for
+                                // replay that may never fire (defect t-mt6nd0sq-hxuhj6: seven
+                                // delivered:true routes with zero log growth). Probe the driver
+                                // shortly after: running means the message is being consumed;
+                                // still-idle means the wake was latched or dropped — surface that
+                                // honestly and arm a delayed nudge retry below.
+                                // F1': a prior-running target never trusts the single
+                                // post-steer read — answer consumed:false conservatively and
+                                // arm the nudge (a false negative costs one harmless nudge; a
+                                // false positive strands the delivered message).
+                                // F2' (receipt-settlement): the delivery is born into the
+                                // ledger — an inbound row owes a receipt only this node can
+                                // produce, and before this row existed the nudge's isPending
+                                // gate no-op'd for exactly the deliveries that stall (08-30:
+                                // zero ledger records for latched activations). Arming is
+                                // unconditional now; settlement evidence disarms in the
+                                // callback.
+                                const consumedProbe = taskLedger.deliveryFor(taskId)?.state === 'claimed';
+                                // F5 (settlement integrity): the debt gate — a process-label
+                                // caller cannot receive receipts, so this delivery is born
+                                // fire-and-forget (receiptExpected:false, answered as
+                                // receipt:"none") instead of manufacturing a debt nobody can
+                                // settle. The row itself stays: stall visibility and the
+                                // nudge still apply to the TARGET side.
+                                const receiptExpectation = receiptExpectationOf(receiptTarget);
+                                // #114 S2: the row is born with its immutable authorization record.
+                                const auth = buildAuthorization(admission, {
+                                    caller,
+                                    proof: callerProof,
+                                    ...(claim.ok ? { claim: { caller: claim.caller, origin: originOf(claim.callerUrl) } } : {}),
+                                    ...(admission.rule === 'remote-ref-cli' && claim.ok ? { carrierUrl: originOf(claim.callerUrl) } : {}),
+                                    ingress: 'wire',
+                                    allowlistVersion: admittedAt.version,
+                                    target: team,
+                                    receiptTarget,
+                                    receivedAt: admittedAt.at,
+                                    // Audit only: a cold session's activation window also reads as running.
+                                    targetBusy: runningBeforeSteer,
+                                });
+                                // #139: the member that actually received it answers for a canvas or bare-zone team.
+                                const deliveredTo = sessionTeamOf(target);
+                                // gh#141: a receipt owes no receipt — it is settlement traffic,
+                                // recorded on the row it settled. Booking it would leave a debt
+                                // nothing can pay, and a nudge chasing an answer nobody owes.
+                                if (!deliveredReceipt) {
+                                    taskLedger.trackInbound(taskId, team, receiptTarget, contextId === '' ? undefined : contextId, receiptExpectation !== 'process-label', briefOf(message), auth, deliveredTo === team ? undefined : deliveredTo, String(target.id), consumedProbe);
+                                    armReceiptAutosend(target, taskId, receiptTarget, message, steerFloor);
+                                    armAsyncNudge(target, team, taskId, config.asyncNudgeDelayMs);
                                 }
+                                const payload = JSON.stringify({
+                                    routed: true,
+                                    delivered: true,
+                                    team,
+                                    session,
+                                    task_id: taskId,
+                                    context_id: contextId,
+                                    task_status: 'TASK_STATE_DELIVERED',
+                                    artifacts: [],
+                                    consumed: consumedProbe,
+                                    ...(req.headers['x-a2a-guard'] !== undefined ? { delivered_to: deliveredTo } : {}),
+                                    receipt: receiptExpectation === 'process-label' || deliveredReceipt ? 'none' : 'routed',
+                                });
+                                res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                                res.end(payload);
                             }
-                            if (wake?.kind === 'no-match') {
-                                await forwardMiss(noColdMatchText(team));
-                                return;
+                            catch (error) {
+                                if (error instanceof AdmittedBookkeepingError)
+                                    steered = true;
+                                if (!steered) {
+                                    refuseNoWait(`The DSH session rejected the message: ${String(error)}`);
+                                    return;
+                                }
+                                if (!(error instanceof AdmittedBookkeepingError))
+                                    taskLedger.noteAdmittedBookkeepingFailure(error);
+                                logger.warn('a2a: admitted task bookkeeping failed; reconcile original delivery');
+                                if (!res.headersSent) {
+                                    const payload = JSON.stringify({ routed: true, delivered: true, team, task_id: taskId, context_id: contextId, task_status: 'TASK_STATE_DELIVERED', artifacts: [], consumed: false, receipt: 'routed', receiverBookkeeping: 'failed', note: ADMITTED_BOOKKEEPING_NOTE });
+                                    res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                                    res.end(payload);
+                                }
                             }
-                            refuseNoWait(wake?.kind === 'no-face' ? noWakeFaceText(team) : wake?.kind === 'archived' ? archivedColdMatchText(team) : noColdMatchText(team), false);
                         };
-                        const prepared = await nativeTeamsPrepare(team);
-                        if (!prepared.ok) {
-                            if (prepared.reason === 'error') {
-                                refuseNoWait(prepared.error);
+                        if (agent !== undefined) {
+                            deliver(agent);
+                            return;
+                        }
+                        if (wake?.kind === 'flight') {
+                            void wake.flight.then(deliver, (error) => {
+                                refuseNoWait(`waking the session for team "${team}" failed: ${String(error)}`);
+                            });
+                            return;
+                        }
+                        // Remaining candidates need one async classification (the
+                        // native-teams bridge), so the tail answers inside an IIFE.
+                        await (async () => {
+                            // Native-teams inbound bridge (opt-in): prepare BEFORE answering
+                            // delivered — claim, seam, and parent initiator are everything
+                            // that can fail fast, and a phantom dispatch must never answer
+                            // success. Past prepare, the round fires detached (noWait means
+                            // delivery, not settlement); its late outcome corrects the
+                            // activity ring and the log.
+                            const standardMiss = async () => {
+                                if (team === config.team) {
+                                    const live = liveAgent();
+                                    if (live !== undefined) {
+                                        // Self-route refusal (mirrors the sync face): a caller
+                                        // naming the very agent the fallback resolves to must
+                                        // get an honest failure, never its own dispatch echoed
+                                        // home plus an auto-receipt for work nobody did.
+                                        if (callerIsAgent(live, caller)) {
+                                            refuseNoWait(selfRouteText(team));
+                                            return;
+                                        }
+                                        deliver(live);
+                                        return;
+                                    }
+                                }
+                                if (wake?.kind === 'no-match') {
+                                    await forwardMiss(noColdMatchText(team));
+                                    return;
+                                }
+                                refuseNoWait(wake?.kind === 'no-face' ? noWakeFaceText(team) : wake?.kind === 'archived' ? archivedColdMatchText(team) : noColdMatchText(team), false);
+                            };
+                            const prepared = await nativeTeamsPrepare(team);
+                            if (!prepared.ok) {
+                                if (prepared.reason === 'error') {
+                                    refuseNoWait(prepared.error);
+                                    return;
+                                }
+                                await standardMiss();
                                 return;
                             }
-                            await standardMiss();
+                            recordActivity('in', team, caller, true);
+                            void nativeTeamsRound(prepared, team, caller, message, taskId, proofClause, undefined, (_team, _taskId, from) => directHeader(from))
+                                .then(outcome => {
+                                if (!outcome.ok) {
+                                    recordActivity('in', team, caller, false);
+                                    logger.warn(`a2a: detached native-teams round for "${team}" failed: ${outcome.error}`);
+                                }
+                                // W7 slice-2 hook 2: only a genuinely settled detached round
+                                // records an outcome. The deadline's settled:false
+                                // projection is a placeholder, not a product — the same
+                                // ruling as hook 1's DELIVERED skip; placeholder prose never
+                                // enters the ledger a replay could adopt from.
+                                if (taskId !== '') {
+                                    if (!outcome.ok)
+                                        idempotencyStore.recordOutcome(taskId, { status: 'failed', error: outcome.error });
+                                    else if (outcome.settled)
+                                        idempotencyStore.recordOutcome(taskId, { status: 'completed', reply: outcome.reply });
+                                }
+                            });
+                            const payload = JSON.stringify({ routed: true, delivered: true, team, session, task_id: taskId, context_id: contextId, task_status: 'TASK_STATE_DELIVERED', artifacts: [], consumed: false, bridge: 'native-teams' });
+                            res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                            res.end(payload);
+                        })();
+                        return;
+                    }
+                    let syncTarget;
+                    // A forwarded synchronous delivery still owes its automatic receipt after the HTTP waiter expires.
+                    const syncSteered = req.headers['x-a2a-guard'] === undefined || parseReceipt(message) !== null ? undefined : (target, floor) => {
+                        syncTarget = sessionTeamOf(target);
+                        const receiptTarget = callback !== '' ? callback : caller;
+                        const auth = buildAuthorization(admission, { caller, proof: callerProof, ...(claim.ok ? { claim: { caller: claim.caller, origin: originOf(claim.callerUrl) } } : {}), ...(admission.rule === 'remote-ref-cli' && claim.ok ? { carrierUrl: originOf(claim.callerUrl) } : {}), ingress: 'wire', allowlistVersion: admittedAt.version, target: team, receiptTarget, receivedAt: admittedAt.at });
+                        try {
+                            taskLedger.trackInbound(taskId, team, receiptTarget, contextId, receiptExpectationOf(receiptTarget) !== 'process-label', briefOf(message), auth, syncTarget === team ? undefined : syncTarget, String(target.id), taskLedger.deliveryFor(taskId)?.state === 'claimed');
+                        }
+                        catch (error) {
+                            taskLedger.noteAdmittedBookkeepingFailure(error);
+                            throw new AdmittedBookkeepingError(error);
+                        }
+                        armReceiptAutosend(target, taskId, receiptTarget, message, floor);
+                    };
+                    await routeIntoAgent(team, message, caller, taskId, proofClause, directHeader, undefined, syncSteered, claim.ok ? claim.card.publicKey : undefined).then(async (outcome) => {
+                        if (outcome.ok && outcome.receiverBookkeeping === 'failed') {
+                            const payload = JSON.stringify({ routed: true, delivered: true, team, task_id: taskId, context_id: contextId, task_status: 'TASK_STATE_DELIVERED', receipt: 'routed', receiverBookkeeping: 'failed', note: ADMITTED_BOOKKEEPING_NOTE });
+                            res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                            res.end(payload);
                             return;
                         }
-                        recordActivity('in', team, caller, true);
-                        void nativeTeamsRound(prepared, team, caller, message, taskId, proofClause, undefined, (_team, _taskId, from) => directHeader(from))
-                            .then(outcome => {
+                        if (!outcome.ok && outcome.localMiss) {
+                            await forwardMiss(outcome.error);
+                            return;
+                        }
+                        recordActivity('in', team, caller, outcome.ok);
+                        // W7 slice-2 hook 1: record the settled outcome on the claim row.
+                        // Ruling: a non-COMPLETED status (TASK_STATE_DELIVERED — the
+                        // bridge-round deadline placeholder, ABORTED_WAIT likewise) is
+                        // NOT a settled outcome, and neither is a host-authored
+                        // placeholder on the reply channel (flush timeout, dead session)
+                        // — the row stays pending, because an adopted replay must never
+                        // settle a node on placeholder text (the exact hazard W7 gap B
+                        // closed, barred from resurrecting through the outcome ledger).
+                        if (taskId !== '') {
                             if (!outcome.ok) {
-                                recordActivity('in', team, caller, false);
-                                logger.warn(`a2a: detached native-teams round for "${team}" failed: ${outcome.error}`);
+                                idempotencyStore.recordOutcome(taskId, { status: 'failed', error: outcome.error });
                             }
-                            // W7 slice-2 hook 2: only a genuinely settled detached round
-                            // records an outcome. The deadline's settled:false
-                            // projection is a placeholder, not a product — the same
-                            // ruling as hook 1's DELIVERED skip; placeholder prose never
-                            // enters the ledger a replay could adopt from.
-                            if (taskId !== '') {
-                                if (!outcome.ok)
-                                    idempotencyStore.recordOutcome(taskId, { status: 'failed', error: outcome.error });
-                                else if (outcome.settled)
-                                    idempotencyStore.recordOutcome(taskId, { status: 'completed', reply: outcome.reply });
+                            else if (outcome.placeholder === true) {
+                                // placeholder prose never enters the ledger
                             }
-                        });
-                        const payload = JSON.stringify({ routed: true, delivered: true, team, session, task_id: taskId, context_id: contextId, task_status: 'TASK_STATE_DELIVERED', artifacts: [], consumed: false, bridge: 'native-teams' });
+                            else if (outcome.status === undefined || outcome.status === 'TASK_STATE_COMPLETED') {
+                                idempotencyStore.recordOutcome(taskId, { status: 'completed', reply: outcome.reply });
+                            }
+                        }
+                        const payload = outcome.ok
+                            ? JSON.stringify({
+                                routed: true,
+                                team,
+                                session,
+                                result: { text: outcome.reply },
+                                ...(syncTarget !== undefined ? { delivered_to: syncTarget } : {}),
+                                // #298: a positive, cross-host statement that this text is the member's own final reply — the turn
+                                // that read this task's steer (`ownTurn`), never a placeholder, a bridge round or another turn (#305 F3/F4).
+                                ...(outcome.ownTurn === true && outcome.placeholder !== true && outcome.bridge === undefined && (outcome.status ?? 'TASK_STATE_COMPLETED') === 'TASK_STATE_COMPLETED' ? { reply_final: true } : {}),
+                                task_id: taskId,
+                                context_id: contextId,
+                                task_status: outcome.status ?? 'TASK_STATE_COMPLETED',
+                                artifacts: [],
+                                // The bridge marker rides the wire so the caller's
+                                // trackOwedTask skips a receipt-less native round — without
+                                // it, a cross-node unsettled round books an unpayable owed
+                                // row and re-creates the TASK_CAP backlog.
+                                ...(outcome.bridge !== undefined ? { bridge: outcome.bridge } : {}),
+                            })
+                            : JSON.stringify({ error: outcome.error, code: -32000, team, task_id: taskId, task_status: 'TASK_STATE_FAILED' });
                         res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
                         res.end(payload);
-                    })();
-                    return;
-                }
-                let syncTarget;
-                // A forwarded synchronous delivery still owes its automatic receipt after the HTTP waiter expires.
-                const syncSteered = req.headers['x-a2a-guard'] === undefined || parseReceipt(message) !== null ? undefined : (target, floor) => {
-                    syncTarget = sessionTeamOf(target);
-                    const receiptTarget = callback !== '' ? callback : caller;
-                    const auth = buildAuthorization(admission, { caller, proof: callerProof, ...(claim.ok ? { claim: { caller: claim.caller, origin: originOf(claim.callerUrl) } } : {}), ...(admission.rule === 'remote-ref-cli' && claim.ok ? { carrierUrl: originOf(claim.callerUrl) } : {}), ingress: 'wire', allowlistVersion: admittedAt.version, target: team, receiptTarget, receivedAt: admittedAt.at });
-                    taskLedger.trackInbound(taskId, team, receiptTarget, contextId, receiptExpectationOf(receiptTarget) !== 'process-label', briefOf(message), auth, syncTarget === team ? undefined : syncTarget);
-                    armReceiptAutosend(target, taskId, receiptTarget, message, floor);
-                };
-                void routeIntoAgent(team, message, caller, taskId, proofClause, directHeader, undefined, syncSteered).then(async (outcome) => {
-                    if (!outcome.ok && outcome.localMiss) {
-                        await forwardMiss(outcome.error);
-                        return;
-                    }
-                    recordActivity('in', team, caller, outcome.ok);
-                    // W7 slice-2 hook 1: record the settled outcome on the claim row.
-                    // Ruling: a non-COMPLETED status (TASK_STATE_DELIVERED — the
-                    // bridge-round deadline placeholder, ABORTED_WAIT likewise) is
-                    // NOT a settled outcome, and neither is a host-authored
-                    // placeholder on the reply channel (flush timeout, dead session)
-                    // — the row stays pending, because an adopted replay must never
-                    // settle a node on placeholder text (the exact hazard W7 gap B
-                    // closed, barred from resurrecting through the outcome ledger).
-                    if (taskId !== '') {
-                        if (!outcome.ok) {
-                            idempotencyStore.recordOutcome(taskId, { status: 'failed', error: outcome.error });
-                        }
-                        else if (outcome.placeholder === true) {
-                            // placeholder prose never enters the ledger
-                        }
-                        else if (outcome.status === undefined || outcome.status === 'TASK_STATE_COMPLETED') {
-                            idempotencyStore.recordOutcome(taskId, { status: 'completed', reply: outcome.reply });
-                        }
+                    });
+                })().catch(error => {
+                    // EventEmitter ignores promises returned from body-end callbacks. Own this boundary.
+                    logger.warn('a2a: direct request callback failed: %s', String(error));
+                    if (!res.headersSent) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'direct request failed before confirmation', code: -32000, task_status: 'TASK_STATE_FAILED' }));
                     }
-                    const payload = outcome.ok
-                        ? JSON.stringify({
-                            routed: true,
-                            team,
-                            session,
-                            result: { text: outcome.reply },
-                            ...(syncTarget !== undefined ? { delivered_to: syncTarget } : {}),
-                            // #298: a positive, cross-host statement that this text is the member's own final reply — the turn
-                            // that read this task's steer (`ownTurn`), never a placeholder, a bridge round or another turn (#305 F3/F4).
-                            ...(outcome.ownTurn === true && outcome.placeholder !== true && outcome.bridge === undefined && (outcome.status ?? 'TASK_STATE_COMPLETED') === 'TASK_STATE_COMPLETED' ? { reply_final: true } : {}),
-                            task_id: taskId,
-                            context_id: contextId,
-                            task_status: outcome.status ?? 'TASK_STATE_COMPLETED',
-                            artifacts: [],
-                            // The bridge marker rides the wire so the caller's
-                            // trackOwedTask skips a receipt-less native round — without
-                            // it, a cross-node unsettled round books an unpayable owed
-                            // row and re-creates the TASK_CAP backlog.
-                            ...(outcome.bridge !== undefined ? { bridge: outcome.bridge } : {}),
-                        })
-                        : JSON.stringify({ error: outcome.error, code: -32000, team, task_id: taskId, task_status: 'TASK_STATE_FAILED' });
-                    res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                    res.end(payload);
+                    else if (!res.writableEnded)
+                        res.end();
                 });
             });
         },