@nelsonlongxiang/dsh-open-a2a-net 0.6.42 → 0.7.0

package/lib/index.js

@@ -30,7 +30,8 @@ export function resolveCallerLabel(input) {
 }
 import { encodePublicKey, signCard, verifyCard } from "./card.js";
 import { GroupStore } from "./group-store.js";
-import { CanvasStore, canvasNameReserved, isRemoteMemberRef } from "./canvas-store.js";
+import { CanvasStore, canvasNameReserved, isRemoteMemberRef, legacyBareMember } from "./canvas-store.js";
+import { splitQualifiedMember, memberProvenance, qualifiedSessionMember } from "./canvas-member.js";
 import { decodeSessionLog, extractTranscript, TRANSCRIPT_MAX_FILE_BYTES } from "./session-transcript.js";
 import { LayoutStore } from "./layout-store.js";
 import { peerLinkDisplay } from "./peer-link-display.js";
@@ -47,7 +48,11 @@ import { PeerStore } from "./peer-store.js";
 import { SelfReferralFilter } from "./self-suppress.js";
 import { TaskLedger, SUMMARY_CAP, briefOf } from "./task-ledger.js";
 import { formatReceipt, parseReceipt, taskIdRefusal } from "./receipt.js";
+import { ReconciliationReminders } from "./reconciliation-reminders.js";
+import { REMINDER_SCAN_MS, reminderView } from "./reconciliation-state.js";
+import { AdmittedBookkeepingError, ADMITTED_BOOKKEEPING_NOTE } from "./admitted-bookkeeping.js";
 import { runReceiptLadder } from "./receipt-ladder.js";
+import { receiptFailure, retryReceiptDelivery, transientReceiptFailure, receiptRetryWait } from "./receipt-retry.js";
 import { IdempotencyStore, WIRE_ERROR_IDEMPOTENCY_CONFLICT, WIRE_ERROR_REPLAY_REJECTED, peerPayloadFingerprint } from "./idempotency-store.js";
 import { createFloodGuard } from "./flood-guard.js";
 import { createQueueGuard, queueFullRefusal, QUEUE_FULL_NEXT, WIRE_ERROR_QUEUE_FULL } from "./queue-guard.js";
@@ -55,8 +60,9 @@ import { resolveZone } from "./zone.js";
 import { registerA2aNetworkSkill } from "./skill-registration.js";
 import { isRootOriginUrl, sameMountedUrl, originClaimTeamWarning, signOriginClaim, verifyOriginClaim as verifyOriginClaimOf } from "./origin-claim.js";
 import { AuthObserver } from "./auth-observer.js";
-import { allowlistVersion, authorizationRef, buildAuthorization, callerAdmission, localCandidateAdmission, canonicalAllowlist, judgeSettlement, joinedFaceAdmission, refusalOf, sameZoneAdmission, recheckRemoteCliAuthorization } from "./task-auth.js";
+import { claimCovers, allowlistVersion, authorizationRef, buildAuthorization, callerAdmission, localCandidateAdmission, canonicalAllowlist, judgeSettlement, joinedFaceAdmission, refusalOf, sameZoneAdmission, recheckRemoteCliAuthorization } from "./task-auth.js";
 import { MessageId } from '@deepseek-ai/dsh-llm';
+import { FollowupDelivery } from "./followup-delivery.js";
 import { SessionId } from '@deepseek-ai/dsh-session';
 import { liveRootAgents } from "./live-roots.js";
 import { A2aClient } from "./a2a-client.js";
@@ -85,6 +91,7 @@ export const inject = ['tools', 'timer', 'systemPrompt'];
 import { Config } from "./config.js";
 import { canvasOwnerFingerprint, splitCanvasOwner } from "./canvas-id.js";
 import { forwardReceiptBasis } from "./direct-forward.js";
+import { NudgeObservability } from "./nudge-observability.js";
 export { Config };
 /**
  * Register the outbound peer tools, the direct-route endpoint, and (when
@@ -481,7 +488,7 @@ export function apply(ctx, config) {
     };
     // Graceful disposal lands the debounced peer state on disk before a
     // restart reads it back (fiber teardown awaits effect disposers).
-    ctx.effect(() => () => peerStore.flush());
+    ctx.effect(() => () => peerStore.close());
     // Slice 3: an unset session derives from a per-home node id, and the
     // configured delegations become signed zone records on every card.
     const session = config.session === '' ? deriveSession(home) : config.session;
@@ -505,8 +512,9 @@ export function apply(ctx, config) {
      */
     function originClaimHeaders(target) {
         // No local web/card anchor yet: keep the preexisting absent-envelope migration posture, not a malformed Sig3.
-        const signedTarget = ownCardUrl === '' ? { url: target.url, method: target.method } : target;
-        return signOriginClaim(signedTarget, { caller: config.team, callerUrl: ownCardUrl, privateKey: nodePrivateKey, unbound: config.originClaimUnboundWindow !== false, now: Date.now() });
+        if (ownCardUrl === '')
+            return {};
+        return signOriginClaim(target, { caller: config.team, callerUrl: ownCardUrl, privateKey: nodePrivateKey, unbound: config.originClaimUnboundWindow !== false, now: Date.now() });
     }
     const client = new A2aClient({
         apiKey: config.apiKey,
@@ -597,7 +605,7 @@ export function apply(ctx, config) {
     // Canvas teams: user-composed multi-member routing groups. A session node
     // may sit in many teams; routing to <team>/canvas/<name> resolves the
     // first live member or wakes the first cold one (member order = priority).
-    const canvasStore = new CanvasStore(join(home, 'a2a', 'canvas.json'));
+    const canvasStore = new CanvasStore(join(home, 'a2a', 'canvas.json'), { legacyBareMembers: config.canvasLegacyBareMembers !== false, ownPublicKey: encodePublicKey(createPublicKey(nodePrivateKey)) });
     // #91 file channel: the sender host's blob store (docs/design/file-channel.md).
     const blobStore = new BlobStore(join(home, 'a2a'));
     // Spatial presentation state for the full-page stage (contract v2).
@@ -606,6 +614,7 @@ export function apply(ctx, config) {
     // queryable here, and the correlating `[A2A receipt] task <id>` message
     // resolves it — the caller-side half of the receipt contract, persisted so
     // a restart does not orphan the reconciliation.
+    const nudgeObservations = new NudgeObservability(message => logger.warn(message));
     const taskLedger = new TaskLedger(join(home, 'a2a', 'tasks.json'), { staleTtlMs: config.taskStaleTtlMs, warn: message => logger.warn(message) });
     const enforceBlockers = taskLedger.settlementEnforceBlockers();
     const enforceRefused = config.settlementAuth === 'enforce' && enforceBlockers.length > 0 ? { reason: 'legacy forwarded canvas debts lack receiver facts', blockers: enforceBlockers } : undefined;
@@ -640,7 +649,14 @@ export function apply(ctx, config) {
                     if (name === undefined)
                         return undefined;
                     // Canvas members by session id and by handle, as the faces store them.
-                    return canvasStore.membersOf(name).flatMap(m => (m.includes('/') ? [m] : [m, `${config.team}/${id8(m)}`]));
+                    return canvasStore.membersOf(name).flatMap(m => {
+                        const qualified = splitQualifiedMember(m);
+                        if (qualified) {
+                            const local = localHandleResolver()(m);
+                            return local !== undefined || settler.claimKey === canvasStore.ownerKeyOf(m) ? [m, qualified.handle] : [m];
+                        }
+                        return m.includes('/') ? [m] : [m, `${config.team}/${id8(m)}`];
+                    });
                 },
                 ...(parsedForJudge?.envelope?.onBehalfOf !== undefined ? { onBehalfOf: parsedForJudge.envelope.onBehalfOf } : {}),
                 echo,
@@ -676,18 +692,6 @@ export function apply(ctx, config) {
         // must not be recorded as one. First-write wins inside the store, so a
         // late receipt never overwrites a precise sync-hook record.
         const parsed = parsedForJudge;
-        if (parsed !== null && parsed.taskId !== '') {
-            const line = parsed.summary.trim();
-            // #114 S4 (design §4.2.2): under enforce, the receipt hook writes the
-            // outcome a /a2a/query answers only for a row THIS ledger owes and
-            // whose settler is on the chain — anyone sending a receipt line could
-            // otherwise rewrite another caller's answer.
-            const row = judge?.enforce === true ? taskLedger.find(parsed.taskId) : undefined;
-            const allowed = judge?.enforce !== true || (row !== undefined && judge.check(row, false).ok);
-            if (line !== '' && allowed) {
-                idempotencyStore.recordOutcome(parsed.taskId, { status: 'completed', reply: line.slice(0, SUMMARY_CAP) });
-            }
-        }
         // A header that names an owed row and comes back unresolved was refused
         // (enforce): that is the verdict — the echo fallback must not judge the
         // same message a second time.
@@ -696,7 +700,19 @@ export function apply(ctx, config) {
         // #139 (design §4.4): an enforce refusal of the row the header names is
         // told to the sender on the wire response, not only in /state.
         const headerVerdict = judge?.enforce === true && owedRow !== undefined ? judge.check(owedRow, false) : undefined;
+        // Capture authority while the owed row is still present; successful resolve archives it.
+        const outcomeAllowed = judge?.enforce !== true || (owedRow !== undefined && headerVerdict?.ok === true);
         const resolved = taskLedger.resolveFromMessage(message, judge);
+        if (parsed !== null && parsed.taskId !== '') {
+            const line = parsed.summary.trim();
+            // #114 S4 (design §4.2.2): under enforce, the receipt hook writes the
+            // outcome a /a2a/query answers only for a row THIS ledger owes and
+            // whose settler is on the chain — anyone sending a receipt line could
+            // otherwise rewrite another caller's answer.
+            if (line !== '' && outcomeAllowed) {
+                idempotencyStore.recordOutcome(parsed.taskId, { status: 'completed', reply: line.slice(0, SUMMARY_CAP) });
+            }
+        }
         if (resolved === undefined && owedByHeader) {
             return headerVerdict !== undefined && !headerVerdict.ok ? { status: 'refused', reason: headerVerdict.reason, task_id: parsed.taskId } : undefined;
         }
@@ -741,11 +757,18 @@ export function apply(ctx, config) {
     function settleOwnInbound(message, creditor, payer) {
         const parsed = parseReceipt(message);
         if (parsed === null || parsed.taskId === '')
-            return;
-        const settled = taskLedger.resolveFromMessage(message, settlementJudgeFor(payer, parsed, true), row => row.direction === 'inbound' && row.peer === `local:${creditor}`);
-        const line = parsed.summary.trim();
-        if (settled !== undefined && line !== '')
-            idempotencyStore.recordOutcome(parsed.taskId, { status: 'completed', reply: line.slice(0, SUMMARY_CAP) });
+            return true;
+        try {
+            const settled = taskLedger.resolveFromMessage(message, settlementJudgeFor(payer, parsed, true), row => row.direction === 'inbound' && row.peer === `local:${creditor}`);
+            const line = parsed.summary.trim();
+            if (settled !== undefined && line !== '')
+                idempotencyStore.recordOutcome(parsed.taskId, { status: 'completed', reply: line.slice(0, SUMMARY_CAP) });
+            return true;
+        }
+        catch {
+            logger.warn('a2a: own inbound settlement commit failed; task remains owed');
+            return false;
+        }
     }
     // Server-side idempotency keys (work-order P3): a caller-born task id
     // executes at most once inside the 24h window — same-key replays answer
@@ -753,7 +776,7 @@ export function apply(ctx, config) {
     const idempotencyStore = new IdempotencyStore(join(home, 'a2a', 'idempotency.json'));
     const refuseIfFlooded = createFloodGuard(idempotencyStore, recordActivity);
     const ownTask = (taskId) => taskLedger.list().some(r => r.taskId === taskId) || taskLedger.archive().some(r => r.taskId === taskId);
-    const refuseIfQueueFull = createQueueGuard(() => taskLedger.list(), () => config.targetQueueCap, ownTask, idempotencyStore, recordActivity);
+    const refuseIfQueueFull = createQueueGuard(() => taskLedger.list(), () => config.targetQueueCap, ownTask, idempotencyStore, recordActivity, id => reminderView(taskLedger.reminderState(id)));
     // Unmasked-identity suppression: gossip mirrors peer lists back and forth,
     // so a URL whose fetch just proved it serves this node — or an already
     // tracked node (an alias spelling) — keeps coming home as an inbound
@@ -918,7 +941,13 @@ export function apply(ctx, config) {
         for (const id of joinedSessions.list()) {
             if (!isArchived(id))
                 continue;
-            const ownHandle = ownCanvasHandleOf(id, true);
+            try {
+                revokeCanvasMember(id, 'archive');
+            }
+            catch (error) {
+                logger.error('canvas archive suspension failed: %s', String(error));
+                continue;
+            }
             sessionNodes.delete(id);
             // Sections come back at the next mount (re-publish) if this archived reading was transient; the row stays.
             nodeBinder.suspend(id);
@@ -928,9 +957,6 @@ export function apply(ctx, config) {
             // joined session matches"). Safety without the deletion: wake refuses
             // archived intents (:804), card assembly and the state cold rows filter
             // them, the reconciler skips them, and JOIN_CAP bounds the file.
-            canvasStore.dropMember(id);
-            if (ownHandle !== undefined)
-                canvasStore.dropMember(ownHandle);
             // S2 consistency: an archived node's roster declarations die with it
             // — a left node keeps no team membership.
             teamMemberships.dropSession(id);
@@ -961,7 +987,13 @@ export function apply(ctx, config) {
                     continue;
                 if (sessionNodes.has(id) || joinedSessions.has(id))
                     continue;
-                canvasStore.removeMember(name, id);
+                try {
+                    canvasStore.removeMember(name, id);
+                }
+                catch (error) {
+                    logger.error('canvas stale-member prune failed (%s/%s): %s', name, id, String(error));
+                    continue;
+                }
                 logger.info(`a2a: canvas team "${name}" dropped stale member ${id8(id)} (no live node, no join intent)`);
             }
         }
@@ -1004,7 +1036,7 @@ export function apply(ctx, config) {
      * @param includeArchived - count archived sessions too (the archive prune
      *   drops an archived session's own handle).
      */
-    function localHandleResolver(includeArchived = false) {
+    function localHandleResolver(includeArchived = false, count = false, legacyOverride = false) {
         const isArchived = includeArchived ? undefined : archivedSessionFilter();
         const byHandle = new Map();
         for (const id of new Set([...joinedSessions.list(), ...sessionNodes.keys()])) {
@@ -1021,7 +1053,27 @@ export function apply(ctx, config) {
                     published.add(row.team);
         }
         return (ref) => {
+            const qualified = splitQualifiedMember(ref);
+            if (qualified !== undefined) {
+                const ownKey = encodePublicKey(createPublicKey(nodePrivateKey));
+                if (memberProvenance(ref, canvasStore.ownerKeyOf(ref), ownKey) !== 'confirmed-local')
+                    return undefined;
+                const hits = byHandle.get(qualified.handle);
+                return hits?.length === 1 ? hits[0] : undefined;
+            }
+            if (!legacyOverride && config.canvasLegacyBareMembers === false)
+                return undefined;
             const hits = byHandle.get(ref);
+            const collision = (hits?.length ?? 0) > 1 || (hits?.length === 1 && published.has(ref));
+            if (count && legacyBareMember(ref)) {
+                legacyInferenceResolutions++;
+                if (collision) {
+                    legacyCollisionWarnings++;
+                    if (legacyCollisionRecent.length >= 16)
+                        legacyCollisionRecent.shift();
+                    legacyCollisionRecent.push({ member: ref, at: Date.now() });
+                }
+            }
             return hits?.length === 1 && !published.has(ref) ? hits[0] : undefined;
         };
     }
@@ -1032,6 +1084,34 @@ export function apply(ctx, config) {
      * handle-stored membership must not outlive the session's consent).
      * @param id - the local session id (still joined when this is read).
      */
+    const canvasMigrationEpoch = new Date().toISOString();
+    let legacyInferenceResolutions = 0, legacyCollisionWarnings = 0;
+    const legacyCollisionRecent = [];
+    function revokeCanvasMember(id, reason, name) {
+        if (!joinedSessions.has(id) && !sessionNodes.has(id))
+            return false;
+        const bare = config.team + '/' + id8(id);
+        const inferred = localHandleResolver(true, false, true)(bare) === id ? bare : undefined;
+        const qualified = bare + '@' + ownCanvasFingerprint;
+        const sameId8 = new Set([...joinedSessions.list(), ...sessionNodes.keys()].filter(local => id8(local) === id8(id)));
+        const pinned = canvasStore.ownerKeyOf(qualified);
+        const proof = sameId8.size === 1 && (pinned === undefined || pinned === encodePublicKey(createPublicKey(nodePrivateKey))) ? qualified : undefined;
+        return canvasStore.revokeLocal(id, proof, inferred, reason, name);
+    }
+    function canvasMigrationState() {
+        const raw = canvasStore.list().flatMap(name => canvasStore.rawMembersOf(name).filter(legacyBareMember).map(member => ({ name, member })));
+        const resolve = localHandleResolver(false, false);
+        return { canvasLegacyBareMembers: config.canvasLegacyBareMembers !== false, epoch: canvasMigrationEpoch,
+            legacyBareMembers: raw.length,
+            legacyInferredMembers: raw.filter(r => canvasStore.membersOf(r.name).includes(r.member) && resolve(r.member) !== undefined).length,
+            legacyInferenceResolutions, legacyCollisionWarnings, legacyCollisionRecent: [...legacyCollisionRecent],
+            suspendedMembersCount: new Set(canvasStore.state().suspendedMembers.map(r => JSON.stringify([r.team, r.member]))).size,
+            memberSlots: canvasStore.list().flatMap(name => canvasStore.rawMembersOf(name).map(member => {
+                const provenance = memberProvenance(member, canvasStore.ownerKeyOf(member), encodePublicKey(createPublicKey(nodePrivateKey)));
+                return { name, member, ownerKey: canvasStore.ownerKeyOf(member) ?? null, provenance, suspended: canvasStore.isSuspended(name, member), compatibilityInference: provenance === 'unknown' && canvasStore.membersOf(name).includes(member) && resolve(member) !== undefined };
+            })),
+            ...canvasStore.state() };
+    }
     function ownCanvasHandleOf(id, includeArchived = false) {
         const handle = `${config.team}/${id8(id)}`;
         return localHandleResolver(includeArchived)(handle) === id ? handle : undefined;
@@ -1045,12 +1125,8 @@ export function apply(ctx, config) {
      * canvas a handle-stored membership puts the session in.
      */
     function canvasTeamsOfSession(id) {
-        const teams = new Set(canvasStore.teamsOf(id));
-        const own = ownCanvasHandleOf(id);
-        if (own !== undefined)
-            for (const name of canvasStore.teamsOf(own))
-                teams.add(name);
-        return [...teams];
+        const resolve = localHandleResolver();
+        return canvasStore.list().filter(name => canvasStore.membersOf(name).some(ref => ref === id || resolve(ref) === id));
     }
     /**
      * gh#131: a canvas team's members as the local routing tiers read them —
@@ -1059,8 +1135,8 @@ export function apply(ctx, config) {
      * reading that depends on which peer cards are cached must not rewrite
      * the store (review of PR #151 P2-2).
      */
-    function canvasLocalMembersOf(name) {
-        const resolve = localHandleResolver();
+    function canvasLocalMembersOf(name, count = false) {
+        const resolve = localHandleResolver(false, count);
         return canvasStore.membersOf(name).map(id => (isRemoteMemberRef(id) ? resolve(id) ?? id : id));
     }
     /** The 8-char suffix of one agent's id. */
@@ -1111,7 +1187,7 @@ export function apply(ctx, config) {
     function canvasLiveAgent(name, skipId) {
         if (name === undefined)
             return undefined;
-        for (const id of canvasLocalMembersOf(name)) {
+        for (const id of canvasLocalMembersOf(name, true)) {
             if (id === skipId)
                 continue;
             const agent = sessionNodes.get(id);
@@ -1131,7 +1207,7 @@ export function apply(ctx, config) {
         if (name === undefined)
             return undefined;
         const isArchived = archivedSessionFilter();
-        return canvasLocalMembersOf(name).find(id => id !== skipId && joinedSessions.has(id) && !liveRoots.has(id) && isArchived?.(id) !== true);
+        return canvasLocalMembersOf(name, true).find(id => id !== skipId && joinedSessions.has(id) && !liveRoots.has(id) && isArchived?.(id) !== true);
     }
     /**
      * Human-facing node facts for one session: the session title (fallback:
@@ -1585,7 +1661,7 @@ export function apply(ctx, config) {
                     at: now,
                     rows: all
                         .filter(row => row.local !== true)
-                        .map(row => ({ team: row.team, name: row.name, ...(row.origin !== undefined ? { origin: row.origin } : {}), ...(row.via !== undefined ? { via: row.via } : {}), ...(row.workspace !== undefined ? { workspace: row.workspace } : {}), ...(row.legacy === true ? { legacy: true } : {}), ...(row.unreachable === true ? { unreachable: true } : {}), ...(row.teams !== undefined && row.teams.length > 0 ? { teams: [...row.teams] } : {}) })),
+                        .map(row => ({ team: row.team, name: row.name, ...(row.memberRef !== undefined ? { memberRef: row.memberRef } : {}), ...(row.origin !== undefined ? { origin: row.origin } : {}), ...(row.via !== undefined ? { via: row.via } : {}), ...(row.workspace !== undefined ? { workspace: row.workspace } : {}), ...(row.legacy === true ? { legacy: true } : {}), ...(row.unreachable === true ? { unreachable: true } : {}), ...(row.teams !== undefined && row.teams.length > 0 ? { teams: [...row.teams] } : {}) })),
                 };
             })
                 .catch(() => { })
@@ -1596,7 +1672,9 @@ export function apply(ctx, config) {
         whenWebServerSettled((webServer) => {
             // gh#77 B1: the admin faces live in src/faces/admin.ts.
             registerAdminFaces(webServer, {
-                ctx, config, logger, home, session, lanIp, PLUGIN_VERSION, controlRoute, controlTrustedWithoutKey, readJsonBody, peerFetch, peerStore, peerLinkState, originClaimHeaders, refreshRemoteRows, joinedSessions, exposureStore, teamMemberships, cliDeposits, groupStore, canvasStore, cliHomeForAdd, cliHomeOptions, layoutStore, taskLedger, idempotencyStore, inFlightRoutes, recentActivity, teamAuditRing, reportRing, sessionNodes, liveRoots, mountSessionNode, coldJoinedIds, prewarmStatus, reconcileStatus, id8, sessionLabelOf, sessionTeamOf, ownCanvasHandleOf, localSessionOfHandle, canvasTeamsOfSession, nodeMetadataOf, canvasTeamOf, archivedSessionFilter, pruneArchivedJoins, pruneCanvasMemberships, verifyOriginClaim, callerLinkedToThisHost, cachedCardFetch, authorizationView,
+                reminderDiagnostics: () => ({ ...idleReminders.diagnostics }),
+                nudgeEscalations: () => nudgeObservations.snapshot(),
+                ctx, config, logger, home, session, lanIp, PLUGIN_VERSION, controlRoute, controlTrustedWithoutKey, readJsonBody, peerFetch, peerStore, peerLinkState, originClaimHeaders, refreshRemoteRows, joinedSessions, exposureStore, teamMemberships, cliDeposits, groupStore, canvasStore, revokeCanvasMember, canvasMigrationState, canvasMemberForWrite, cliHomeForAdd, cliHomeOptions, layoutStore, taskLedger, idempotencyStore, inFlightRoutes, recentActivity, teamAuditRing, reportRing, sessionNodes, liveRoots, mountSessionNode, coldJoinedIds, prewarmStatus, reconcileStatus, id8, sessionLabelOf, sessionTeamOf, ownCanvasHandleOf, localSessionOfHandle, canvasTeamsOfSession, nodeMetadataOf, canvasTeamOf, archivedSessionFilter, pruneArchivedJoins, pruneCanvasMemberships, verifyOriginClaim, callerLinkedToThisHost, cachedCardFetch, authorizationView,
                 indexUrl: import.meta.url, enforceRefused,
                 get cardCache() { return cardCache; },
                 get remoteRowsCache() { return remoteRowsCache; },
@@ -1604,6 +1682,8 @@ export function apply(ctx, config) {
                 get unboundInboundCount() { return unboundInboundCount; },
                 get boundMissInboundCount() { return boundMissInboundCount; },
                 get boundMissRecent() { return boundMissRecent; },
+                get claimRejectsInboundCount() { return claimRejectsInboundCount; },
+                get claimRejectsRecent() { return claimRejectsRecent; },
                 get ownCardUrl() { return ownCardUrl; }, ownCanvasFingerprint,
                 get ownerSeatNames() { return ownerSeatNames; },
                 set ownerSeatNames(v) { ownerSeatNames = v; },
@@ -1637,7 +1717,7 @@ export function apply(ctx, config) {
                 // roster: the team-roster face (a2a_team_join/leave, card
                 // teamMemberships, team-scope routing admission) ships — peers read
                 // its absence as a pre-roster legacy node (0.5.43 and older).
-                capabilities: { route: true, async: true, roster: true },
+                capabilities: { route: true, async: true, roster: true, canvasMemberProvenance: true, sourcedFollowup: true, queuedTaskCancellation: true },
                 expiresAt: Date.now() + config.cardTtlMs,
                 ...(records.length > 0 ? { records: [...records] } : {}),
             });
@@ -1808,6 +1888,45 @@ export function apply(ctx, config) {
      * so ui-chat renders the relay body ("来自 X" + full text) instead of an
      * opaque row; omitted when the sender is not meaningfully addressable.
      */
+    const followupDelivery = new FollowupDelivery({
+        ledger: taskLedger,
+        taint: (target, localFrom) => { if (localFrom === undefined || nodeTaint.of(localFrom) !== '')
+            markLineage(target, 'relay'); },
+        warn: code => logger.warn('a2a: sourced followup (%s); check ledger persistence and original task', code),
+    });
+    const followupRelay = (agent, text, sender, localFrom, taskId, callerKey, taskExpected = true) => followupDelivery.deliver(agent, text, sender, localFrom, taskId, callerKey, taskExpected);
+    ctx.on('agent/inbox/claimed', ({ agent, message }) => followupDelivery.claimed(agent, String(message.id)));
+    const withdrawQueuedTask = (taskId) => {
+        const controller = ctx.get('sessionController');
+        return followupDelivery.withdraw(taskId, controller, id => ctx.get('agents')?.get(SessionId(id)));
+    };
+    const cancelQueuedTask = async (taskId, text, sender, original) => {
+        let record, withdrawFailed = false, removed = false;
+        try {
+            record = taskLedger.deliveryFor(taskId);
+            removed = await withdrawQueuedTask(taskId) === 'removed';
+        }
+        catch (error) {
+            withdrawFailed = true;
+            logger.warn('a2a: queue withdrawal failed; sending immediate cancellation notice: %s', String(error));
+        }
+        if (removed) {
+            taskLedger.recordWithdrawalResult(taskId, 'removed');
+            return { removed: true, steered: false, withdrawalResult: 'removed' };
+        }
+        const row = original ?? taskLedger.find(taskId);
+        const receiverId = record?.sessionId ?? row?.receiverSessionId;
+        const agent = receiverId ? ctx.get('agents')?.get(SessionId(receiverId)) : row ? (resolveAgentForTeam(row.deliveredTo ?? row.team) ?? canvasLiveAgent(parseCanvasTeamName(row.team))) : undefined;
+        if (!agent) {
+            taskLedger.recordWithdrawalResult(taskId, 'no-agent');
+            return { removed: false, steered: false, withdrawalResult: 'no-agent' };
+        }
+        const notice = cancelNoticeText(taskId);
+        steerRelay(agent, text.includes('If this task reaches you later from the queue, do not execute it.') ? text : notice, sender);
+        const withdrawalResult = withdrawFailed ? 'withdraw-failed-steered' : 'claimed-steered';
+        taskLedger.recordWithdrawalResult(taskId, withdrawalResult);
+        return { removed: false, steered: true, withdrawalResult };
+    };
     function steerRelay(agent, text, sender, localFrom) {
         // N4/gh#198: a relay steer carries content from outside this host — unless it is an in-process delivery from a clean local session (localFrom), whose taint the target then takes.
         if (localFrom === undefined || nodeTaint.of(localFrom) !== '')
@@ -1822,7 +1941,7 @@ export function apply(ctx, config) {
     /** The cooperative stop-notice text, shared by the tasks/cancel control
      * route and the transport face's cancel half (one contract, one wording). */
     function cancelNoticeText(taskId, reason) {
-        return `[A2A cancel] (task ${taskId}) the caller cancelled this task${reason !== undefined && reason !== '' ? `: ${reason}` : ''}. Stop any work tied to it and acknowledge via [A2A receipt] task ${taskId} cancelled.`;
+        return `[A2A cancel] (task ${taskId}) the caller cancelled this task${reason !== undefined && reason !== '' ? `: ${reason}` : ''}. This task has been cancelled. If this task reaches you later from the queue, do not execute it. Stop any work tied to it and acknowledge via [A2A receipt] task ${taskId} cancelled.`;
     }
     /**
      * v0.5.23 (async-stall): whether the steered agent actually left idle. A
@@ -1887,20 +2006,23 @@ export function apply(ctx, config) {
     const escalateQueuePrompt = (agent, team, taskId) => {
         // Queue-mode prompt seam (the session controller owns prompt admission); #183: it stamps kind:'user', so nudgeRef stands in for the caller's task id.
         const controller = ctx.get('sessionController');
-        if (typeof controller?.prompt !== 'function')
+        if (typeof controller?.prompt !== 'function') {
+            nudgeObservations.note('unavailable', team, nudgeRef(taskId));
             return;
+        }
+        idleReminders.noteNudge(String(agent.id));
         markLineage(agent, 'nudge');
-        logger.info(`a2a: async nudge escalates to queue-mode prompt for ${team} (task ${taskId}, ref ${nudgeRef(taskId)})`);
+        logger.info(`a2a: async nudge escalates to queue-mode prompt for ${team} (ref ${nudgeRef(taskId)})`);
         try {
             void controller.prompt({
                 requestId: `a2a-nudge-${nudgeRef(taskId)}`,
                 sessionId: agent.id,
                 mode: 'queue',
                 content: [{ type: 'text', text: `[A2A nudge] (ref ${nudgeRef(taskId)}) an earlier A2A delivery reached this session while it could not start a turn — please consume the inbox backlog now (ignore if there is nothing pending).` }],
-            }, new AbortController().signal).catch(() => { });
+            }, new AbortController().signal).then(result => { const reply = result; nudgeObservations.note(reply?.accepted === false || reply?.ok === false ? 'failed' : 'queued', team, nudgeRef(taskId)); }, error => nudgeObservations.note('failed', team, nudgeRef(taskId), error));
         }
-        catch {
-            /* queueing is best-effort: the ledger row keeps the debt visible */
+        catch (error) {
+            nudgeObservations.note('failed', team, nudgeRef(taskId), error);
         }
     };
     function armAsyncNudge(agent, team, taskId, delayMs) {
@@ -1914,6 +2036,10 @@ export function apply(ctx, config) {
                 nudgeBudget.delete(key);
                 return;
             }
+            if (!idleReminders.nudgeAllowed(key)) {
+                armAsyncNudge(agent, team, taskId, Math.max(delayMs, 120_000));
+                return;
+            }
             if (agent.status !== 'idle') {
                 // Busy on its own turn (or wedged): spend the bounded re-arm, then
                 // climb to the queue-mode seam. Re-resolve on the steer path below
@@ -1937,6 +2063,7 @@ export function apply(ctx, config) {
             // afresh.
             const fresh = resolveAgentForTeam(team) ?? agent;
             logger.info(`a2a: async nudge re-waking ${team} (task ${taskId}, ref ${nudgeRef(taskId)}, delivered but not consumed)`);
+            idleReminders.noteNudge(String(fresh.id));
             steerRelay(fresh, `[A2A nudge] (ref ${nudgeRef(taskId)}) an earlier A2A delivery reached this session while it could not start a turn — please consume the inbox backlog now.`);
         }, delayMs);
         ctx.effect(() => () => clearTimeout(timer), `a2a: async nudge ${taskId}`);
@@ -1954,6 +2081,34 @@ export function apply(ctx, config) {
      * receipts themselves are never tracked as new debts.
      */
     const receiptWarnAt = new Map();
+    const reminderAgents = () => {
+        const service = ctx.get('agents');
+        return service ? liveRootAgents(service).filter(a => archivedSessionFilter()?.(String(a.id)) !== true) : [];
+    };
+    const exactReminderTarget = (row) => {
+        const live = reminderAgents();
+        if (row.receiverSessionId)
+            return live.find(a => String(a.id) === row.receiverSessionId);
+        // Legacy concrete face only; never reassign a canvas/process slot to its current roster.
+        const face = row.deliveredTo ?? row.team;
+        if (face.includes('/canvas/') || face === config.team)
+            return undefined;
+        const matches = live.filter(a => sessionTeamOf(a) === face);
+        return matches.length === 1 ? matches[0] : undefined;
+    };
+    const idleReminders = new ReconciliationReminders({
+        ledger: taskLedger, agents: reminderAgents, resolve: exactReminderTarget,
+        sender: row => {
+            if (row.peer !== 'local' || row.sender?.kind !== 'session')
+                return undefined;
+            const matches = reminderAgents().filter(a => sessionTeamOf(a) === row.sender.id);
+            return matches.length === 1 ? matches[0] : undefined;
+        },
+        followup: (agent, text) => followupRelay(agent, text, config.team),
+        warn: code => logger.warn('a2a: idle reconciliation reminder failed (%s)', code),
+    });
+    const requestReminderScan = () => { queueMicrotask(() => idleReminders.scan()); };
+    ctx.effect(() => { const timer = ctx.timer.interval(() => idleReminders.scan(), REMINDER_SCAN_MS); requestReminderScan(); return () => { idleReminders.stop(); timer(); }; }, 'a2a: persistent idle reconciliation reminders');
     function armReceiptAutosend(target, taskId, callerTeam, deliveredText, steerFloor) {
         if (!callerTeam || callerTeam === '')
             return;
@@ -2008,19 +2163,17 @@ export function apply(ctx, config) {
             // closure would silently no-op there — runReceiptLadder reads a
             // settled undefined as tier-1 success, so the receipt would vanish
             // without a log.
-            void runReceiptLadder({
-                deliver: async (team) => {
-                    // gh#217: across hosts the caller admits a session face it linked, never this host's process label; a
-                    // task for the bare process team keeps the label, the only host face the settlement judge accepts (N1).
-                    const peerCaller = row?.auth?.target.includes('/') === true ? sessionTeamOf(target) : undefined;
-                    const delivered = await dispatchAnywhere(team, receipt, session, undefined, new AbortController().signal, true, undefined, peerCaller);
-                    // gh#141: the caller lane pays this delivery's inbound row across hosts (a
-                    // same-host receipt already settled it in-process), unless the caller
-                    // refused it. The owner tier is no payment here — but an owner mailbox
-                    // on THIS host settles the row in-process, as it always has.
-                    if (team === callerTeam && delivered.settlementRefused !== true)
-                        settleOwnInbound(receipt, callerTeam, { caller: session, proof: 'in-process', ingress: 'local' });
-                },
+            const transportId = 'r-' + createHash('sha256').update(taskId + '\0' + callerTeam + '\0' + receipt).digest('base64url').slice(0, 12);
+            const deliverReceipt = async (team) => {
+                const peerCaller = row?.auth?.target.includes('/') === true ? sessionTeamOf(target) : undefined;
+                const delivered = await dispatchAnywhere(team, receipt, session, undefined, new AbortController().signal, true, transportId, peerCaller);
+                if (team === callerTeam && delivered.settlementRefused !== true && !settleOwnInbound(receipt, callerTeam, { caller: session, proof: 'in-process', ingress: 'local' }))
+                    throw receiptFailure({ error: 'task ledger write failed after receipt delivery', code: -32011 });
+            };
+            /* Legacy permanent-failure ladder remains the owner-settlement policy. */
+            const ladder = () => runReceiptLadder({
+                deliver: deliverReceipt,
+                transient: transientReceiptFailure,
                 ownerTeam: config.team,
                 log: (stage, error) => {
                     // N2 (observability): throttled per task to avoid ping-pong noise.
@@ -2030,9 +2183,13 @@ export function apply(ctx, config) {
                     receiptWarnAt.set(key, Date.now());
                     logger.warn(`a2a: receipt autosend ${stage} for task ${taskId} failed: ${String(error).slice(0, 120)}`);
                 },
-            }, callerTeam).catch(() => {
-                // Ladder exhausted: the throttled breadcrumbs above already said why.
-            });
+            }, callerTeam);
+            const wait = (ms) => receiptRetryWait(ctx, ms);
+            void retryReceiptDelivery({
+                attempt: () => ladder(),
+                notify: async () => { await dispatchAnywhere(config.team, '[A2A receipt delivery notice] ref ' + nudgeRef(taskId) + '; delivery to the original caller is temporarily unconfirmed; host retry is responsible. This notice is not a receipt and does not settle work.', session, undefined, new AbortController().signal, true); },
+                pending: () => row === undefined || taskLedger.isPending(taskId), wait, log: () => { logger.warn('a2a: receipt delivery temporarily unconfirmed ref=%s', nudgeRef(taskId)); },
+            }).catch(() => { });
         }, { taskId, steerFloor });
     }
     /**
@@ -2065,15 +2222,15 @@ export function apply(ctx, config) {
      * marker instead of a (false) completion.
      * @param taskId - the correlation key the steered receipt header carries.
      */
-    async function routeIntoAgent(team, message, caller, taskId, proofClause, buildHeader, localFrom, onSteered) {
+    async function routeIntoAgent(team, message, caller, taskId, proofClause, buildHeader, localFrom, onSteered, callerKey) {
         const agent = resolveAgentForTeam(team) ?? canvasLiveAgent(parseCanvasTeamName(team));
         if (agent !== undefined) {
-            return routeIntoAgentFor(agent, team, message, caller, taskId, proofClause, buildHeader, localFrom, onSteered);
+            return routeIntoAgentFor(agent, team, message, caller, taskId, proofClause, buildHeader, localFrom, onSteered, callerKey);
         }
         // Wake-on-route: a cold joined team materializes on demand, then steers.
         const wake = wakeColdTeam(team);
         if (wake.kind === 'flight') {
-            return wake.flight.then(agent => routeIntoAgentFor(agent, team, message, caller, taskId, proofClause, buildHeader, localFrom, onSteered), (error) => ({ ok: false, error: `waking the session for team "${team}" failed: ${String(error)}` }));
+            return wake.flight.then(agent => routeIntoAgentFor(agent, team, message, caller, taskId, proofClause, buildHeader, localFrom, onSteered, callerKey), (error) => ({ ok: false, error: `waking the session for team "${team}" failed: ${String(error)}` }));
         }
         // Native-teams inbound bridge (opt-in): a registry team claims the
         // handle and dispatches through its authoritative seam. Checked before
@@ -2102,7 +2259,7 @@ export function apply(ctx, config) {
             if (live !== undefined) {
                 if (callerIsAgent(live, caller))
                     return { ok: false, error: selfRouteText(team) };
-                return routeIntoAgentFor(live, team, message, caller, taskId, proofClause, buildHeader, undefined, onSteered);
+                return routeIntoAgentFor(live, team, message, caller, taskId, proofClause, buildHeader, undefined, onSteered, callerKey);
             }
             return { ok: false, error: 'No live DSH agent is available to accept this message.' };
         }
@@ -2117,11 +2274,13 @@ export function apply(ctx, config) {
      * @param caller - caller label for the steered prefix.
      * @returns the agent's final reply, or the explicit failure.
      */
-    function routeIntoAgentFor(agent, team, message, caller, taskId, proofClause, buildHeader, localFrom, onSteered) {
+    function routeIntoAgentFor(agent, team, message, caller, taskId, proofClause, buildHeader, localFrom, onSteered, callerKey) {
         return new Promise((resolve) => {
             // #306: synchronous replies use the same reading-turn attribution as automatic receipts.
             // Registering and steering are synchronous, so this is the exact pre-steer floor.
             const floorAtRegistration = sessionEventsOf(agent).length;
+            let admissionFinished = false;
+            let earlyReply;
             const waiter = registerFinalWaiter(agent, (text, placeholder) => {
                 // Preserve #305's reply_final contract: only this task's own completed reading turn qualifies.
                 let ownTurn = false;
@@ -2131,7 +2290,11 @@ export function apply(ctx, config) {
                     const window = read === undefined ? undefined : readingTurnReply(events, read);
                     ownTurn = window !== undefined && window.completed && window.reply !== '' && window.reply === text;
                 }
-                resolve({ ok: true, reply: text, ...(placeholder === true ? { placeholder: true } : {}), ...(ownTurn ? { ownTurn: true } : {}) });
+                const result = { ok: true, reply: text, ...(placeholder === true ? { placeholder: true } : {}), ...(ownTurn ? { ownTurn: true } : {}) };
+                if (admissionFinished)
+                    resolve(result);
+                else
+                    earlyReply = result;
             }, taskId !== undefined && taskId !== '' ? { taskId, steerFloor: floorAtRegistration } : undefined);
             // The header names the sender first: `caller` is the routing node's
             // own label (the session that issued the route), while `team` is this
@@ -2146,8 +2309,11 @@ export function apply(ctx, config) {
             const text = `${headerLine}\n\n${message}`;
             try {
                 const floor = sessionEventsOf(agent).length;
-                steerRelay(agent, text, caller === '' ? undefined : caller, localFrom);
+                followupRelay(agent, text, caller === '' ? undefined : caller, localFrom, taskId, callerKey, onSteered !== undefined);
                 onSteered?.(agent, floor);
+                admissionFinished = true;
+                if (earlyReply)
+                    resolve(earlyReply);
                 if (onSteered !== undefined && sessionEventsOf(agent).slice(floor).some(event => event?.type === 'assistant/message'))
                     queueMicrotask(() => flushFinals(String(agent.id))); // synchronous final may already have emitted idle
             }
@@ -2155,13 +2321,17 @@ export function apply(ctx, config) {
                 // The waiter was registered above, so the key always holds it; the
                 // map-of-arrays stays a plain read.
                 const key = String(agent.id);
-                const entries = pendingFinals.get(key);
+                const entries = pendingFinals.get(key) ?? [];
                 const kept = entries.filter(entry => entry !== waiter);
                 if (kept.length === 0)
                     pendingFinals.delete(key);
                 else
                     pendingFinals.set(key, kept);
                 waiter.timeoutDisposer?.();
+                if (error instanceof AdmittedBookkeepingError) {
+                    resolve({ ok: true, reply: ADMITTED_BOOKKEEPING_NOTE, receiverBookkeeping: 'failed', placeholder: true });
+                    return;
+                }
                 resolve({ ok: false, error: `The DSH session rejected the message: ${String(error)}` });
             }
         });
@@ -2191,6 +2361,23 @@ export function apply(ctx, config) {
         boundMissRecent.unshift({ ...row, count: row.count + 1, lastAt: Date.now() });
         boundMissRecent.length = Math.min(boundMissRecent.length, 16);
     };
+    /**
+     * Envelopes that were present but failed verification, by claimed caller, claimed URL and reason —
+     * `bad-ts` is a sender clock off by more than ±5 min, `no-card`/`bad-sig` a key or reachability fault.
+     * Observation only: the faces' refusals are unchanged. Caller fields are the sender's unverified
+     * header values (capped), so read them as claims, not identities. Counts verification attempts.
+     */
+    let claimRejectsInboundCount = 0;
+    const claimRejectsRecent = [];
+    const noteClaimReject = (req, reason) => {
+        claimRejectsInboundCount += 1;
+        const header = (name) => String(req.headers[name] ?? '').slice(0, 200);
+        const caller = header('x-a2a-caller'), callerUrl = header('x-a2a-caller-url');
+        const at = claimRejectsRecent.findIndex(row => row.caller === caller && row.callerUrl === callerUrl && row.reason === reason);
+        const row = at >= 0 ? claimRejectsRecent.splice(at, 1)[0] : { caller, callerUrl, reason, count: 0, lastAt: 0 };
+        claimRejectsRecent.unshift({ ...row, count: row.count + 1, lastAt: Date.now() });
+        claimRejectsRecent.length = Math.min(claimRejectsRecent.length, 16);
+    };
     /** Our configured seeds anchor origin claims; mounted claims require exact mount matching. */
     function configuredSeedCaller(callerUrl) {
         return config.peers.some(peer => {
@@ -2208,6 +2395,7 @@ export function apply(ctx, config) {
         const claim = await verifyOriginClaimOf(req, {
             cardCache,
             fetch: fetchImpl,
+            freshCard: true,
             audiences: [ownCardUrl, ...config.originClaimAudiences ?? []],
             unboundOpen: config.originClaimUnboundWindow !== false,
             onUnbound: () => { unboundInboundCount += 1; },
@@ -2217,6 +2405,8 @@ export function apply(ctx, config) {
             ...(options?.cli === true ? { cliDeposit: cliDepositCard } : {}),
             ...(options?.rawBody !== undefined ? { rawBody: options.rawBody } : {}),
         });
+        if (!claim.ok && claim.reason !== 'absent')
+            noteClaimReject(req, claim.reason);
         // #312: recover bilateral seed evidence from a signed, reduction-only card,
         // never from a caller-selected unseeded URL and never recursively.
         const discovery = new URL(req.url ?? '/', 'http://x').searchParams.get('discovery') === '1';
@@ -2336,6 +2526,9 @@ export function apply(ctx, config) {
             for (const ref of canvasStore.remoteMembersOf(name)) {
                 if (ref === caller)
                     return true;
+                const qualified = splitQualifiedMember(ref);
+                if (qualified?.handle === caller && callerCard?.publicKey === canvasStore.ownerKeyOf(ref))
+                    return true;
             }
         }
         // Basis 3, BILATERAL (review M1 fix): OUR config.peers seeds a URL
@@ -2401,14 +2594,14 @@ export function apply(ctx, config) {
         memberships: () => teamMemberships.list(),
         joined: () => joinedSessions.list(),
         canvasNames: () => canvasStore.list(),
-        canvasTeamsOf: sessionId => canvasStore.teamsOf(sessionId),
-        canvasMembersOf: name => canvasStore.membersOf(name),
+        canvasTeamsOf: sessionId => canvasTeamsOfSession(sessionId),
+        canvasMembersOf: name => canvasLocalMembersOf(name),
         canvasRemoteMembersOf: name => canvasStore.remoteMembersOf(name),
         peerOrgs: function* () {
             for (const cached of cardCache.values()) {
                 const org = cached.card?.canvasOrg;
                 if (Array.isArray(org))
-                    yield org;
+                    yield org.map(row => ({ ...row, members: Array.isArray(row.members) ? row.members.map((ref) => splitQualifiedMember(ref) && localHandleResolver()(ref) !== undefined ? splitQualifiedMember(ref).handle : ref) : row.members }));
             }
         },
         liveNodeIds: () => [...sessionNodes.values()].map(agent => String(agent.id)),
@@ -2425,8 +2618,43 @@ export function apply(ctx, config) {
         return verdict === undefined ? undefined : refusalOf(verdict);
     }
     /** Inbound admission with the rule and shared teams that admitted the caller (gh#114 S1). */
-    function a2aCallerAdmission(caller, targetTeam, cliProof) {
-        return callerAdmission(admissionRecords, caller, targetTeam, cliProof);
+    function a2aCallerAdmission(caller, targetTeam, cliProof, signerKey) {
+        const ownKey = encodePublicKey(createPublicKey(nodePrivateKey));
+        const members = (name) => canvasStore.membersOf(name).flatMap(ref => {
+            const qualified = splitQualifiedMember(ref);
+            if (!qualified)
+                return [ref];
+            const provenance = memberProvenance(ref, canvasStore.ownerKeyOf(ref), ownKey);
+            if (provenance === 'confirmed-local') {
+                const local = localHandleResolver()(ref);
+                return local ? [local, qualified.handle] : [];
+            }
+            return provenance === 'confirmed-remote' && signerKey === canvasStore.ownerKeyOf(ref) ? [qualified.handle] : [];
+        });
+        const foreignSigner = signerKey !== undefined && signerKey !== ownKey;
+        const records = { ...admissionRecords,
+            callerJoined: () => admissionRecords.joined().filter(id => !foreignSigner || config.team + '/' + id8(id) !== caller),
+            callerMemberships: () => admissionRecords.memberships().filter(row => !foreignSigner || config.team + '/' + id8(row.session) !== caller),
+            callerCanvasMembersOf: (name) => {
+                const effective = new Set(members(name));
+                return canvasStore.membersOf(name).flatMap(ref => {
+                    const qualified = splitQualifiedMember(ref);
+                    if (qualified?.handle === caller && foreignSigner && canvasStore.ownerKeyOf(ref) !== signerKey)
+                        return [];
+                    if (effective.has(ref))
+                        return [ref];
+                    return qualified && effective.has(qualified.handle) ? [qualified.handle] : [];
+                });
+            },
+            canvasMembersOf: members,
+            canvasRemoteMembersOf: (name) => canvasStore.remoteMembersOf(name).flatMap(ref => {
+                const qualified = splitQualifiedMember(ref);
+                if (!qualified)
+                    return [ref];
+                return canvasStore.ownerKeyOf(ref) === signerKey && memberProvenance(ref, canvasStore.ownerKeyOf(ref), ownKey) === 'confirmed-remote' ? [qualified.handle] : [];
+            }),
+        };
+        return callerAdmission(records, caller, targetTeam, cliProof);
     }
     function a2aCallerRefusal(caller, targetTeam) {
         return refusalOf(a2aCallerAdmission(caller, targetTeam));
@@ -2566,7 +2794,7 @@ export function apply(ctx, config) {
             logger,
             config,
             cliDeposits,
-            canvasStore,
+            canvasStore, canvasMemberForWrite,
             canvasNameReserved: name => canvasNameReserved(name, config.team, ownerAllowlist, teamMemberships),
             sessionNodes,
             joinedSessions,
@@ -2587,6 +2815,18 @@ export function apply(ctx, config) {
             scanSessionLogList,
             readSessionLogTail,
             taskLedger,
+            receiptReplayAllowed: (message, caller, team, claim) => {
+                const parsed = parseReceipt(message);
+                if (!parsed || !claim.bound || claim.bodyBound !== true || !claimCovers(caller, claim.caller) || !isRootOriginUrl(claim.callerUrl))
+                    return false;
+                const row = taskLedger.archive().find(r => r.taskId === parsed.taskId);
+                if (!row || row.endedBy !== 'receipt' || row.peerKey !== claim.card.publicKey)
+                    return false;
+                const creditor = row.auth?.receipt_target ?? row.sender?.id;
+                if (creditor !== team)
+                    return false;
+                return judgeSettlement(row, { caller, proof: 'origin-claim', claimKey: claim.card.publicKey, claimOrigin: originOf(claim.callerUrl), ingress: 'wire' }, { hostLabel: session, membersOf: () => undefined, ...(parsed.envelope?.onBehalfOf ? { onBehalfOf: parsed.envelope.onBehalfOf } : {}) }).ok;
+            },
             refuseIfFlooded,
             refuseIfQueueFull,
             settleAndAnnounce, waitForForwardBirth,
@@ -2599,7 +2839,7 @@ export function apply(ctx, config) {
             probeConsumption,
             sessionTeamOf,
             localSessionOfHandle,
-            steerRelay,
+            steerRelay, followupRelay, cancelQueuedTask,
             fromClause,
             sanitizeFromClause,
             armReceiptAutosend,
@@ -2650,28 +2890,42 @@ export function apply(ctx, config) {
             path: '/__dsh_a2a/tasks/cancel',
             handler: controlRoute((req, res) => {
                 readJsonBody(req, res, (body) => {
-                    const fields = body;
-                    const taskId = typeof fields.task_id === 'string' ? fields.task_id : '';
-                    const reason = typeof fields.reason === 'string' ? fields.reason : undefined;
-                    const result = taskLedger.cancel(taskId, reason);
-                    let steered = false;
-                    if (result.outcome === 'cleared' && result.team !== undefined) {
-                        const live = resolveAgentForTeam(result.team)
-                            ?? canvasLiveAgent(parseCanvasTeamName(result.team))
-                            ?? (result.team === config.team ? liveAgent() : undefined);
-                        if (live !== undefined) {
-                            try {
-                                steerRelay(live, cancelNoticeText(taskId, reason));
-                                steered = true;
-                            }
-                            catch {
-                                // Bookkeeping already settled; steering is best-effort only.
+                    void (async () => {
+                        const fields = body;
+                        const taskId = typeof fields.task_id === 'string' ? fields.task_id : '';
+                        const reason = typeof fields.reason === 'string' ? fields.reason : undefined;
+                        const row = taskLedger.find(taskId);
+                        const result = taskLedger.cancel(taskId, reason);
+                        let removed = false, steered = false;
+                        try {
+                            if (row && result.outcome === 'cleared') {
+                                const notice = cancelNoticeText(taskId, reason);
+                                if (row.peer === 'local' || row.direction === 'inbound') {
+                                    const notification = await cancelQueuedTask(taskId, notice, session, row);
+                                    removed = notification.removed;
+                                    steered = notification.steered;
+                                }
+                                else {
+                                    const card = await cachedCardFetch(row.peer);
+                                    const supportsQueuedCancel = card?.capabilities?.queuedTaskCancellation === true;
+                                    const result = await client.routeDirect(row.peer, row.team, notice, undefined, undefined, supportsQueuedCancel ? (row.sender?.kind === 'session' ? row.sender.id : row.auth?.caller ?? session) : session, true, undefined, undefined, undefined, supportsQueuedCancel ? taskId : undefined);
+                                    if (!result.ok)
+                                        throw Error('remote queued cancellation was not confirmed');
+                                }
                             }
                         }
+                        catch (error) {
+                            logger.warn('a2a: cancellation committed; stop notice was best-effort: %s', String(error));
+                        }
+                        const payload = JSON.stringify({ ...result, steered, removed });
+                        res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
+                        res.end(payload);
+                    })().catch(() => { if (!res.headersSent) {
+                        res.writeHead(503, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'queued task cancellation could not be committed' }));
                     }
-                    const payload = JSON.stringify({ ...result, steered });
-                    res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) });
-                    res.end(payload);
+                    else if (!res.writableEnded)
+                        res.end(); });
                 });
             }),
         }), 'a2a: task cancel route');
@@ -2909,6 +3163,14 @@ export function apply(ctx, config) {
         if (!linked && handles.size > 0 && zone !== '') {
             outer: for (const name of canvasStore.list()) {
                 for (const ref of canvasStore.remoteMembersOf(name)) {
+                    const qualified = splitQualifiedMember(ref);
+                    if (qualified) {
+                        if (cached?.publicKey === canvasStore.ownerKeyOf(ref) && handles.has(qualified.handle)) {
+                            linked = true;
+                            break outer;
+                        }
+                        continue;
+                    }
                     if (handles.has(ref)) {
                         linked = true;
                         break outer;
@@ -2933,6 +3195,51 @@ export function apply(ctx, config) {
             return { url, card, linked: card === undefined || peerAdmissionLinkState(url).link === 'linked' };
         });
     }
+    async function canvasMemberForWrite(ref, requestedPeer, editorCard) {
+        if (CLI_HANDLE_RE.test(ref))
+            return { ok: true, member: ref };
+        const selected = splitQualifiedMember(ref), handle = selected?.handle ?? ref;
+        if (!ref.includes('/')) {
+            if (editorCard)
+                return { ok: false, error: 'peer writes must use owner-qualified session members; upgrade the editor' };
+            return (joinedSessions.has(ref) || sessionNodes.has(ref)) && archivedSessionFilter()?.(ref) !== true ? { ok: true, member: ref } : { ok: false, error: 'local session must be joined and not archived' };
+        }
+        if (editorCard && !selected)
+            return { ok: false, error: 'new bare session member refused; upgrade or confirm locally' };
+        const ownKey = encodePublicKey(createPublicKey(nodePrivateKey));
+        if (selected && memberProvenance(ref, canvasStore.ownerKeyOf(ref), ownKey) === 'confirmed-local') {
+            const locals = [...new Set([...joinedSessions.list(), ...sessionNodes.keys()])].filter(id => config.team + '/' + id8(id) === handle && archivedSessionFilter()?.(id) !== true);
+            if (locals.length === 1)
+                return { ok: true, member: ref, ownerKey: ownKey };
+            return { ok: false, error: 'local qualified member is not uniquely joined' };
+        }
+        const peers = [...new Set([...peerStore.listSeeded(), ...config.delegates.map(row => row.url)])];
+        if (requestedPeer !== undefined && (typeof requestedPeer !== 'string' || !peers.includes(requestedPeer)))
+            return { ok: false, error: 'select an existing linked seed/delegate owner' };
+        const cards = [];
+        for (const peer of peers) {
+            const card = await fetchPeerCard(peer);
+            if (!card || !verifyCard(card, Date.now()).ok)
+                continue;
+            cardCache.set(peer, { at: Date.now(), card });
+            if (requestedPeer !== undefined && peer !== requestedPeer)
+                continue;
+            if (peerAdmissionLinkState(peer).link === 'linked')
+                cards.push(card);
+        }
+        if (editorCard && verifyCard(editorCard, Date.now()).ok)
+            cards.push(editorCard);
+        if (selected && new Set(cards.filter(card => canvasOwnerFingerprint(card.publicKey) === selected.fingerprint).map(card => card.publicKey)).size > 1)
+            return { ok: false, error: 'owner fingerprint collision; no member written' };
+        const matching = cards.filter(card => handle.startsWith(card.team + '/') && /^[0-9a-f]{8}$/.test(handle.slice(card.team.length + 1)) && card.sessionTeams?.some(row => row.team === handle) && (!selected || canvasOwnerFingerprint(card.publicKey) === selected.fingerprint));
+        const keys = [...new Set(matching.map(card => card.publicKey))];
+        if (keys.length !== 1)
+            return { ok: false, error: 'member owner is unconfirmed, hidden, offline or ambiguous; select a verifiable host' };
+        const member = qualifiedSessionMember(handle, keys[0]);
+        if (!member || (selected && member !== ref))
+            return { ok: false, error: 'member fingerprint/key mismatch' };
+        return { ok: true, member, ownerKey: keys[0] };
+    }
     async function cliHomeForAdd(handle, requested) {
         const localHousehold = () => cliDeposits.directoryRows().some(row => row.team === handle);
         if (localHousehold())
@@ -3066,6 +3373,7 @@ export function apply(ctx, config) {
     };
     const SWEEP_CONCURRENCY = 6;
     const infoTools = createInfoTools({
+        nudgeEscalations: () => nudgeObservations.snapshot(),
         ctx, config, logger, session, lanIp, get ownCardUrl() { return ownCardUrl; }, peerStore, taskLedger,
         inFlightRoutes, recentActivity, joinedSessions, sessionNodes, canvasStore,
         teamMemberships, exposureStore, idempotencyStore, cardCache,
@@ -3077,7 +3385,7 @@ export function apply(ctx, config) {
         get ownerAllowlist() { return ownerAllowlist; },
         get ownerTeamScopeInfo() { return ownerTeamScopeInfo; },
         teamAuditRing, reportRing, a2aJoinGateRefusal, observeAuthorization,
-        settlePeerCard, client, listDirectoryTeams, canvasTeamsOfSession, localHandleResolver,
+        settlePeerCard, client, listDirectoryTeams, canvasTeamsOfSession, localHandleResolver, canvasMigrationState,
         SWEEP_CONCURRENCY,
     });
     infoTools.registerWhoami();
@@ -3207,13 +3515,13 @@ export function apply(ctx, config) {
      * by task id and taken (deleted) by whoever dispatched.
      */
     const localBirths = new Map();
-    const localBirthOf = (team, callerSession, receiptTarget, deliveredTo) => {
+    const localBirthOf = (team, callerSession, receiptTarget, deliveredTo, receiverSessionId) => {
         const admission = localCandidateAdmission(admissionRecords, callerSession, team);
         const caller = callerSession ?? session;
         const auth = admission.ok && caller !== ''
             ? buildAuthorization(admission, { caller, proof: 'in-process', ingress: 'local', allowlistVersion: allowlistVersionNow(), target: team, receiptTarget: receiptTarget ?? caller, receivedAt: Date.now() })
             : undefined;
-        return { ...(auth !== undefined ? { auth } : {}), ...(deliveredTo !== team ? { deliveredTo } : {}) };
+        return { receiverSessionId, ...(auth !== undefined ? { auth } : {}), ...(deliveredTo !== team ? { deliveredTo } : {}) };
     };
     /**
      * #139: the peer facts a remote outbound row is born with — the signed
@@ -3232,12 +3540,13 @@ export function apply(ctx, config) {
     const trackOwedTask = (taskId, team, peer, result, callbackAddress, brief, sender, birth) => {
         if (!result.ok)
             return;
+        birth = { ...birth, ...(typeof result.consumed === 'boolean' ? { consumed: result.consumed } : {}) };
         // Native-teams bridge rounds emit no A2A receipt in this slice: booking
         // them as receipt-owed would fill the owed book with rows no receipt can
         // ever settle (evicting genuinely receivable peer rows past TASK_CAP).
         if (result.bridge !== undefined)
             return;
-        if (result.task_status !== 'TASK_STATE_DELIVERED')
+        if (result.task_status !== 'TASK_STATE_DELIVERED' && result.receiverBookkeeping !== 'failed')
             return;
         // Fix ② (ghost-debt stop): a delivered async dispatch with no routable
         // callback address can never be settled — register it receiptless
@@ -3359,9 +3668,10 @@ export function apply(ctx, config) {
     const senderScopeRecords = {
         zone: config.team, id8, teamsOf: id => teamMemberships.teamsOf(id), membersOf: team => teamMemberships.membersOf(team),
         canvasNames: () => canvasStore.list(), canvasMembers: name => canvasStore.membersOf(name), canvasTeam: canvasTeamOf,
+        memberHandle: ref => splitQualifiedMember(ref)?.handle ?? ref,
         peerOrgs: function* () { for (const hit of cardCache.values())
             if (hit.card?.canvasOrg)
-                yield hit.card.canvasOrg; },
+                yield hit.card.canvasOrg.map(row => ({ ...row, members: row.members.map(ref => splitQualifiedMember(ref) && localHandleResolver()(ref) !== undefined ? splitQualifiedMember(ref).handle : ref) })); },
         warmPeers: () => mapBounded(resolutionPeers(), SWEEP_CONCURRENCY, cachedCardFetch),
     };
     async function routeTrunk(args, agent, signal, hostCaller) {
@@ -3384,14 +3694,35 @@ export function apply(ctx, config) {
         a2aJoinGateRefusal(agent === undefined ? undefined : { agent });
         // #282 S2: an owner-qualified canvas id. Our own fingerprint is our canvas; a foreign one never
         // lands on a same-named local canvas, and the directory walk keeps only that owner.
+        const requestedMember = splitQualifiedMember(String(args.team ?? '').trim());
+        if (requestedMember && localHandleResolver()(String(args.team).trim()) !== undefined)
+            args = { ...args, team: requestedMember.handle };
         const ownerQualified = splitCanvasOwner(String(args.team ?? '').trim());
         const foreignOwner = ownerQualified.owner !== undefined && ownerQualified.owner !== ownCanvasFingerprint ? ownerQualified.owner : undefined;
         if (ownerQualified.owner !== undefined)
             args = { ...args, team: ownerQualified.team };
-        // A target-authored receipt attempt answers its own work even if scope/transport later refuses delivery.
+        // A receipt may use only its own frozen return lane; local answer state is not delivery proof.
         const answer = parseReceipt(args.message);
-        if (agent !== undefined && answer !== null)
-            taskLedger.markAnswered(answer.taskId, sessionTeamOf(agent));
+        const receiptRow = answer === null ? undefined : taskLedger.find(answer.taskId);
+        if (agent !== undefined && answer !== null) {
+            try {
+                taskLedger.markAnswered(answer.taskId, sessionTeamOf(agent));
+            }
+            catch {
+                return { ok: false, error: 'task ledger write failed; receipt was not sent', code: -32000, peer_content: false };
+            }
+        }
+        const ownReceipt = agent !== undefined && receiptRow?.status === 'pending' && receiptRow.direction === 'inbound' && receiptRow.receiptExpected !== false && receiptRow.auth?.receipt_target === args.team && (receiptRow.deliveredTo ?? receiptRow.team) === sessionTeamOf(agent) && (receiptRow.receiverSessionId === undefined || receiptRow.receiverSessionId === String(agent.id));
+        if (ownReceipt && receiptRow.auth?.proof === 'origin-claim' && receiptRow.auth.claim !== undefined) {
+            const birthHome = receiptRow.auth.carrier_url ?? receiptRow.auth.claim.origin;
+            const home = CLI_HANDLE_RE.test(args.team) ? canvasStore.cliHomeOf(args.team) ?? birthHome : birthHome;
+            if (originOf(home) !== originOf(birthHome))
+                return { ok: false, error: 'receipt return home no longer matches the task birth', code: -32000, receipt: 'none' };
+            const result = await dispatchPeerCandidate(home, args.team, args.message, args.context_id, signal, sessionTeamOf(agent), true);
+            if (result.ok && result.settlementRefused !== true && !settleOwnInbound(args.message, args.team, { caller: sessionTeamOf(agent), proof: 'in-process', ingress: 'local' }))
+                return { ok: false, error: 'receipt reached the peer but local settlement commit failed; task remains owed', code: -32000, receipt: 'none' };
+            return result;
+        }
         // S3 (team-scoped routing, phase-2 default ON per the 2026-09-01 owner
         // ruling; set false to restore the open outbound seam): a session
         // caller must have declared membership in the target team before it
@@ -3483,7 +3814,7 @@ export function apply(ctx, config) {
         // named; the peer request carries the member handle it must resolve.
         const canvasName = foreignOwner !== undefined ? undefined : parseCanvasTeamName(args.team);
         // gh#131: one of this host's own handles is a local member, never a directory target.
-        const remoteTargets = canvasName !== undefined ? ((resolve) => canvasStore.remoteMembersOf(canvasName).filter(ref => resolve(ref) === undefined))(localHandleResolver()) : [];
+        const remoteTargets = canvasName !== undefined ? ((resolve) => canvasStore.remoteMembersOf(canvasName).filter(ref => resolve(ref) === undefined && (memberProvenance(ref, canvasStore.ownerKeyOf(ref), encodePublicKey(createPublicKey(nodePrivateKey))) !== 'conflict')))(localHandleResolver()) : [];
         const targets = remoteTargets.length > 0 ? [...remoteTargets] : [args.team];
         if (remoteTargets.length > 0) {
             failures.push(`local: canvas team "${args.team}" has no live or wakeable local member`);
@@ -3498,7 +3829,7 @@ export function apply(ctx, config) {
         const candidatePool = [];
         for (const target of targets) {
             for (const candidate of await directoryPeerCandidates(fetch, ownerQualified.owner !== undefined && target === args.team ? `${target}@${ownerQualified.owner}` : target, failures, scopedCanvasCaller)) {
-                candidatePool.push({ candidate, target });
+                candidatePool.push({ candidate, target: splitQualifiedMember(target)?.handle ?? target });
             }
         }
         // Failover: try every candidate in order — an offline path falls back
@@ -3520,8 +3851,8 @@ export function apply(ctx, config) {
             if (result.ok || signal.aborted) {
                 // A receipt the creditor refused (its enforce verdict) pays nothing here either (review of PR #149 P2-2).
                 if (result.ok && routedReceipt) {
-                    if (result.settlementRefused !== true)
-                        settleOwnInbound(args.message, args.team, { caller: callerSession ?? '', proof: 'in-process', ingress: 'local' });
+                    if (result.settlementRefused !== true && !settleOwnInbound(args.message, args.team, { caller: callerSession ?? '', proof: 'in-process', ingress: 'local' }))
+                        return { ok: false, error: 'receipt reached the peer but local settlement commit failed; task remains owed', code: -32000, receipt: 'none' };
                 }
                 else if (result.ok)
                     trackOwedTask(taskId, args.team, candidate, result, callbackAddress, briefOf(args.message), sender, await peerBirth(fetch, candidate, target === args.team ? undefined : target));
@@ -3704,11 +4035,11 @@ export function apply(ctx, config) {
                 const receiptHint = callerTeam === undefined ? '' : `\n\n(When done, route your outcome back with one call — a2a_route { team: "${callerTeam}", message: "[A2A receipt] task ${taskId} <one-line outcome>" }.)`;
                 // #114 S5: the consumption search starts at the pre-steer log length.
                 const steerFloor = sessionEventsOf(target).length;
-                steerRelay(target, `[A2A direct] (task ${taskId}) 未验证（in-process） ${sanitizeFromClause(callerSession ?? session)} (routed to ${team}) sent:\n\n${message}${receiptHint}`, callerTeam, originAgentId);
+                followupRelay(target, `[A2A direct] (task ${taskId}) 未验证（in-process） ${sanitizeFromClause(callerSession ?? session)} (routed to ${team}) sent:\n\n${message}${receiptHint}`, callerTeam, originAgentId, taskId, undefined, parseReceipt(message) === null);
                 armReceiptAutosend(target, taskId, callerTeam, message, steerFloor);
                 // #139: the caller's outbound row is born with this admission and the member that received it.
                 if (taskIdFromCaller !== undefined)
-                    localBirths.set(taskIdFromCaller, localBirthOf(team, callerSession, callerTeam, sessionTeamOf(target)));
+                    localBirths.set(taskIdFromCaller, localBirthOf(team, callerSession, callerTeam, sessionTeamOf(target), String(target.id)));
                 endRoute(flight);
                 recordActivity('out', team, 'local', true);
                 return {
@@ -3718,6 +4049,7 @@ export function apply(ctx, config) {
                     task_id: taskId,
                     context_id: contextId ?? `ctx-${Math.random().toString(16).slice(2, 10)}`,
                     task_status: 'TASK_STATE_DELIVERED',
+                    consumed: taskLedger.deliveryFor(taskId)?.state === 'claimed',
                 };
             }
             catch (error) {
@@ -3900,7 +4232,7 @@ export function apply(ctx, config) {
                 throw new Error(`CLI receipt home is not pinned for ${team}`);
             const delivered = await dispatchPeerCandidate(home, team, message, contextId, signal, peerCaller ?? callerSession, asyncMode, taskId);
             if (!delivered.ok)
-                throw new Error(`CLI receipt to pinned home failed: ${delivered.error}`);
+                throw receiptFailure(delivered);
             return delivered;
         }
         const local = await dispatchLocalCandidate(team, message, callerSession, contextId, signal, asyncMode, taskId);
@@ -3909,7 +4241,7 @@ export function apply(ctx, config) {
             localBirths.delete(taskId);
         if (local !== undefined) {
             if (!local.ok)
-                throw new Error(local.error);
+                throw receiptFailure(local);
             return local;
         }
         if (cliReceipt)
@@ -3920,15 +4252,19 @@ export function apply(ctx, config) {
             throw new Error(`no route to "${team}": not a local team and not published by any tracked peer`);
         }
         let lastError = 'no candidate delivered';
+        let receiptError;
         for (const candidate of candidates) {
             const result = await dispatchPeerCandidate(candidate, team, message, contextId, signal, peerCaller ?? callerSession, asyncMode, taskId);
             if (result.ok)
                 return result;
             lastError = result.error;
+            const failure = receiptFailure(result);
+            if (receiptError === undefined || failure.transient)
+                receiptError = failure;
             if (signal.aborted)
                 break;
         }
-        throw new Error(`delivery to "${team}" failed on every candidate: ${lastError}`);
+        throw receiptError ?? new Error(`delivery to "${team}" failed on every candidate: ${lastError}`);
     }
     /**
      * The directory's candidate walk for one team: direct publishers first,
@@ -3967,12 +4303,34 @@ export function apply(ctx, config) {
         // itself after the target). referralTeamResolution restores the legacy
         // whole-store basis for fleets mid-migration.
         // #282 S2: `<canvas>@<fp8>` selects only the owner whose signed card key matches; no delegation walk.
-        const qualified = splitCanvasOwner(team);
+        if (!splitQualifiedMember(team)) {
+            const qualifiedRefs = [...new Set(canvasStore.list().flatMap(name => canvasStore.membersOf(name)).filter(ref => splitQualifiedMember(ref)?.handle === team))];
+            const keys = new Set(qualifiedRefs.map(ref => canvasStore.ownerKeyOf(ref)).filter(Boolean));
+            if (keys.size > 1) {
+                failures.push('ambiguous member owners; select an owner-qualified handle');
+                return [];
+            }
+            if (qualifiedRefs.length === 1)
+                team = qualifiedRefs[0];
+        }
+        const member = splitQualifiedMember(team);
+        const storedMember = team;
+        const qualified = member ? { team: member.handle, owner: member.fingerprint } : splitCanvasOwner(team);
+        const ownerKey = member ? canvasStore.ownerKeyOf(storedMember) : undefined;
+        if (member && !ownerKey) {
+            failures.push('member provenance is unconfirmed; owner must confirm the full key first');
+            return [];
+        }
         team = qualified.team;
-        const ownerOk = (card) => qualified.owner === undefined || canvasOwnerFingerprint(card?.publicKey) === qualified.owner;
+        const ownerOk = (card) => (qualified.owner === undefined || canvasOwnerFingerprint(card?.publicKey) === qualified.owner) && (member === undefined || card?.publicKey === ownerKey);
         const peers = resolutionPeers();
         const candidates = [];
-        const cards = (await mapBounded(peers, CANDIDATE_CONCURRENCY, async (peer) => ({ peer, card: await fetch(peer) }))).map(entry => ownerOk(entry.card) ? entry : { peer: entry.peer, card: undefined });
+        const fetched = await mapBounded(peers, CANDIDATE_CONCURRENCY, async (peer) => ({ peer, card: await fetch(peer) }));
+        if (member && fetched.some(entry => entry.card && canvasOwnerFingerprint(entry.card.publicKey) === member.fingerprint && entry.card.publicKey !== ownerKey)) {
+            failures.push('member owner fingerprint collision or key change; no payload sent');
+            return [];
+        }
+        const cards = fetched.map(entry => ownerOk(entry.card) ? entry : { peer: entry.peer, card: undefined });
         // Check after fetching all cards: a seeded peer publishing the same id8
         // makes the caller handle ambiguous, so do not send a canvas payload.
         const sessions = scopedCanvasCaller === undefined ? undefined : localHandleResolver();
@@ -3985,6 +4343,10 @@ export function apply(ctx, config) {
         for (const entry of cards) {
             if (entry.card === undefined)
                 continue;
+            if (member && entry.card.capabilities?.canvasMemberProvenance !== true) {
+                failures.push('selected member host needs a provenance-capable upgrade');
+                continue;
+            }
             if (entry.card.team === team || sessionCandidateMatches(entry.card, team) || canvasCandidateMatches(entry.card, team, scopedCanvasCaller, resolveLocal))
                 candidates.push(entry.peer);
         }
@@ -4066,7 +4428,7 @@ export function apply(ctx, config) {
                     const card = await fetch(candidate);
                     peerAsync = card?.capabilities?.async === true;
                 }
-                const result = await dispatchPeerCandidate(candidate, splitCanvasOwner(request.handle).team, request.message, request.contextId, abort, session, request.delivery === 'async' && peerAsync, taskId, callbackAddress);
+                const result = await dispatchPeerCandidate(candidate, splitQualifiedMember(request.handle)?.handle ?? splitCanvasOwner(request.handle).team, request.message, request.contextId, abort, session, request.delivery === 'async' && peerAsync, taskId, callbackAddress);
                 if (!result.ok) {
                     // Idempotency verdicts (B3) are terminal, not failover: a replay
                     // says the prior attempt at THIS peer stays authoritative —
@@ -4162,45 +4524,31 @@ export function apply(ctx, config) {
         },
         cancel: async (ref, reason) => {
             const taskId = ref.taskId;
-            if (taskId === undefined || taskId === '')
+            if (!taskId)
                 return false;
             const row = taskLedger.list().find(entry => entry.taskId === taskId);
-            if (row === undefined)
+            if (!row)
                 return false;
-            const notice = cancelNoticeText(taskId, reason);
-            if (row.peer === 'local') {
-                // Mirror the tasks/cancel control route: the cooperative stop-notice
-                // steers the live local target, not just the ledger row. The target
-                // resolution spans every kind the dispatcher can book — session
-                // node, canvas team, bare process team — a row's team is whatever
-                // the dispatch accepted, so the cancel must accept the same set.
-                const live = resolveAgentForTeam(row.team)
-                    ?? canvasLiveAgent(parseCanvasTeamName(row.team))
-                    ?? (row.team === config.team ? liveAgent() : undefined);
-                if (live !== undefined) {
-                    try {
-                        steerRelay(live, notice);
-                    }
-                    catch {
-                        // Bookkeeping below settles regardless; steering is best-effort.
-                    }
+            // Caller bookkeeping has priority. Notification compatibility never gates cancellation.
+            const cleared = taskLedger.cancel(taskId, reason).outcome === 'cleared';
+            if (!cleared)
+                return false;
+            try {
+                const notice = cancelNoticeText(taskId, reason);
+                if (row.peer === 'local' || row.direction === 'inbound')
+                    await cancelQueuedTask(taskId, notice, session, row);
+                else {
+                    const card = await cachedCardFetch(row.peer);
+                    const supportsQueuedCancel = card?.capabilities?.queuedTaskCancellation === true;
+                    const result = await client.routeDirect(row.peer, row.team, notice, undefined, undefined, supportsQueuedCancel ? (row.sender?.kind === 'session' ? row.sender.id : row.auth?.caller ?? session) : session, true, undefined, undefined, undefined, supportsQueuedCancel ? taskId : undefined);
+                    if (!result.ok)
+                        throw Error(result.error);
                 }
             }
-            else {
-                // Peers do NOT track inbound task ids (the owed ledger's writer runs
-                // on the dispatcher side), so the peer's ledger-cancel route would
-                // deterministically answer 'unknown'. Drive the stop-notice through
-                // the wire to the team itself instead. The notice deliberately
-                // carries NO task_id: the original id is already claimed at the
-                // peer's idempotency ledger with a different payload, so reusing it
-                // would 409-conflict before any steer happens (a bodyless key is
-                // always fresh there). The original id rides the notice text.
-                const result = await client.routeDirect(row.peer, row.team, notice, undefined, undefined, session, true);
-                if (!result.ok) {
-                    logger.warn(`a2a: cancel stop-notice for task ${taskId} failed to deliver to ${row.team}: ${result.error}`);
-                }
+            catch (error) {
+                logger.warn('a2a: cancellation committed; stop notice was best-effort: %s', String(error));
             }
-            return taskLedger.cancel(taskId, reason).outcome === 'cleared';
+            return true;
         },
     };
     ctx.reflect.provide(NATIVE_TEAMS_A2A_FACE_KEY, bridgeFace);
@@ -4208,6 +4556,16 @@ export function apply(ctx, config) {
     infoTools.registerTasks();
     infoTools.registerProbe();
     const pendingFinals = new Map();
+    function answerFinalSafely(entry, text, placeholder) {
+        try {
+            entry.answer(text, placeholder);
+            return true;
+        }
+        catch (error) {
+            logger.warn('a2a: final callback failed; task remains owed: %s', String(error));
+            return false;
+        }
+    }
     const armFlushTimeout = (agentId, waiter) => {
         return ctx.timer.timeout(() => {
             const entries = pendingFinals.get(agentId);
@@ -4219,7 +4577,7 @@ export function apply(ctx, config) {
                 pendingFinals.delete(agentId);
             else
                 pendingFinals.set(agentId, kept);
-            waiter.answer('The DSH session produced no final reply within the configured window.', true);
+            answerFinalSafely(waiter, 'The DSH session produced no final reply within the configured window.', true);
         }, config.flushTimeoutMs);
     };
     function flushFinals(agentId) {
@@ -4230,7 +4588,7 @@ export function apply(ctx, config) {
         if (agent === undefined) {
             for (const entry of entries) {
                 entry.timeoutDisposer?.();
-                entry.answer('The target DSH session is no longer live.', true);
+                answerFinalSafely(entry, 'The target DSH session is no longer live.', true);
             }
             pendingFinals.delete(agentId);
             return;
@@ -4269,17 +4627,25 @@ export function apply(ctx, config) {
         }
         if (answered.length === 0)
             return;
-        const kept = entries.filter(entry => !answered.some(done => done.entry === entry));
-        if (kept.length === 0)
-            pendingFinals.delete(agentId);
-        else
-            pendingFinals.set(agentId, kept);
         for (const { entry, reply, placeholder } of answered) {
-            entry.timeoutDisposer?.();
-            if (placeholder === true)
-                entry.answer('The consuming turn produced no completed reply.', true);
+            // Remove one callback before invoking (it may synchronously re-enter), never the whole batch.
+            const current = pendingFinals.get(agentId) ?? [];
+            if (!current.includes(entry))
+                continue;
+            const kept = current.filter(other => other !== entry);
+            if (kept.length)
+                pendingFinals.set(agentId, kept);
             else
-                entry.answer(reply);
+                pendingFinals.delete(agentId);
+            if (answerFinalSafely(entry, placeholder ? 'The consuming turn produced no completed reply.' : reply, placeholder)) {
+                entry.timeoutDisposer?.();
+            }
+            else {
+                // A failed commit is still owed. Keep its original floor/consuming turn for a later idle retry.
+                const now = pendingFinals.get(agentId) ?? [];
+                if (!now.includes(entry))
+                    pendingFinals.set(agentId, [entry, ...now]);
+            }
         }
     }
     /**
@@ -4353,8 +4719,10 @@ export function apply(ctx, config) {
     // no-op. Node facts need no refresh here: the card serves them fresh at
     // read time.
     ctx.on('agent/status', (payload) => {
-        if (payload.status === 'idle')
+        if (payload.status === 'idle') {
             flushFinals(String(payload.agent.id));
+            requestReminderScan();
+        }
     });
 }
 /**