@sleep2agi/commhub-server 0.9.0-preview.7 → 0.9.0-preview.70

package/src/tools.ts

@@ -1,14 +1,25 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { parseDbTimestampMs } from "./db-timestamp.js";
 import { z } from "zod/v4";
-import { db, uuidv4, logTaskEvent, chainReplyToParent, hashToken, generateId, generateNetworkToken } from "./db.js";
-import { pushEvent } from "./push.js";
+import { parseAliasFilter } from "./alias-filter.js";
+import { createHash } from "node:crypto";
+import { db, uuidv4, logTaskEvent, chainReplyToParent, hashToken, generateId, generateNetworkToken, syncScheduledRunForTask } from "./db.js";
+import { getSSEStats, hasSubscribers, hasUserSubscribers, pushEvent, pushNetworkObserverEvent, pushUserEvent } from "./push.js";
+import { assertNodeActive } from "./lifecycle-guard.js";
+import { pendingInboxCount } from "./inbox-count.js";
 import { getUserNetworkRole, createNetworkTokenForNode } from "./auth.js";
+import { addAgentNetworkScope, addNetworkScope, addOwnTrafficScope, canRestWriteNetwork, canRestWriteNetworkAsHuman, getUserNetworkIds, resolveRestNetworkScope, singleNetworkId, type RestNetworkScope } from "./network-scope.js";
+import { canMessageAgent, restrictedNetworkIds, RESTRICTED_MEMBER_TOOLS } from "./agent-access.js";
+import { restrictedMemberAttachmentsDenied } from "./restricted-files.js";
+import { handleRequirementsRequest } from "./requirements.js";
 import {
   buildAnetArgs as _unused_buildAnetArgs,           // ensure module is loaded
   validateName as validateChildName,
   validateRuntime,
   validateModel,
   validateChannelsP1,
+  validateWorkdir,
+  daemonDefaultWorkdirRoot,
   validateEnvRefs,
   FLAG_KEYS,
   validateFlagValue,
@@ -22,12 +33,14 @@ import {
   startPendingEnvGcTimer,
   startSweeperTimer,
   auditCreateNode,
+  auditCreateNodeStrict,
   resolveCallerDaemonTokenBound as _resolveCallerDaemonTokenBound,
 } from "./create-node.js";
 import {
   vaultUpsert, vaultGet, vaultListKeys, vaultDelete,
   VaultError,
 } from "./vault.js";
+import { stripHostLocalPathsForCrossHostSafe, validateAttachments } from "./uploads.js";
 import {
   validateBaseUrl as _validateBaseUrl,
   SUPPORTED_VENDORS,
@@ -44,11 +57,17 @@ import { canonicalAliasExists, cleanupRenamedAliasSession, resolveCanonicalAlias
 import {
   ALLOWED_FLAGS,
   SECURITY_SENSITIVE_FLAGS,
+  EDITABLE_CHANNELS,
   computeApplyMode,
   validatePatch,
+  narrowChannelsPatch,
   isAllowedToChangeFlag,
 } from "./config-apply-validate.js";
 import { sharedSendDedup, buildDuplicateSendPayload } from "./send_dedup.js";
+import { clientRequestIdFromMeta, idempotentTaskId, idempotentTaskMatches, type StoredIdempotentTask } from "./task-idempotency.js";
+import { stampTaskAuthOrigin, type TaskAuthOrigin } from "./task-auth-origin.js";
+import { parseHubTimestamp } from "./hub-timestamp";
+import { noteTerminalResultRead, purgeLogsResultNow, sweepNodeRequestContent } from "./node-request-retention.js";
 
 function ts(): string {
   return new Date().toTimeString().slice(0, 8);
@@ -61,10 +80,93 @@ function parseMetaJson(value: unknown): unknown | null {
 
 function normalizeMetaJson(meta: unknown): string | null {
   if (!meta || typeof meta !== "object") return null;
-  try { return JSON.stringify(meta); } catch { return null; }
+  // #222 cross-host safety — strip `path` from meta.attachments[] when
+  // `file_id` is also present. Shared helper lives in uploads.ts so the
+  // REST handler in index.ts can apply the identical sanitization
+  // (otherwise REST and MCP transports would have different meta_json
+  // shapes for the same send).
+  try { return JSON.stringify(stripHostLocalPathsForCrossHostSafe(meta)); } catch { return null; }
+}
+
+// ── #1281 — 子节点生命周期工具的参数名统一 ────────────────────────────
+//
+// stop_node / start_node / delete_node 历史上用 `child_node_id`（RFC-027），
+// restart_node / update_node_config 用 `node_id`。同一个对象（子节点）两个名字，
+// 调用方按一个工具的习惯给另一个传就吃 -32602。两侧都已是**已发布契约**
+// （start_node 随 #1273 合入），且 hub API 在 RFC-030 混版滚动期老客户端还在
+// 发老名——所以不能硬改名，改为**两个名字都接受**：
+//   · canonical = `node_id`（= DB 列 nodes.node_id、= create_node 的输出、
+//     restart/update 历史用名；「建完节点→再操作它」用同一个名才是傻瓜式）。
+//   · `child_node_id` 作为**兼容 alias 保留** + deprecation 注释；不加运行时
+//     warning（老客户端是设计内兼容，不是错误，别刷屏）。
+// create_node 的 `daemon_node_id` 指宿主 daemon，是另一层语义，不在本次统一内。
+//
+// server.tool 收的是 ZodRawShape（裸对象），挂不了 .refine()，所以「至少一个
+// 必填」+「两个都传须相等」在 handler 侧用 resolveNodeIdArg 兜——返回结构化
+// ok:false 反而比 schema 层的 -32602 更友好。两个名字在 schema 层都做成
+// optional + 宽松 .min(1).max(200)（不带 regex），使命名与校验强度同时统一：
+// 对 restart/update 不变（本就宽松），对 stop/start/delete 是放宽（原 regex 会
+// 在 schema 层挡掉 alias/杂串，放宽后落到查表返回 node_not_found，对合法调用
+// 方无影响，只是错误形态更一致）。
+const NODE_ID_ALIAS_FIELDS = {
+  node_id: z.string().min(1).max(200).optional()
+    .describe("Target child node ID (canonical, #1281). The value create_node returns. Must be in caller's network."),
+  child_node_id: z.string().min(1).max(200).optional()
+    .describe("DEPRECATED alias for node_id (#1281): kept for back-compat with pre-unification clients; prefer node_id."),
+} as const;
+
+/** #1281 — 把 node_id / child_node_id 收敛成单一内部 id。两个都传且不等 ⇒
+ *  node_id_conflict（挡「node_id 填 A、child_node_id 填 B」的手滑，比单纯二选一强）；
+ *  都不传 ⇒ node_id_required。纯函数，模块级导出以便单测直接验解析逻辑。 */
+export function resolveNodeIdArg(a: { node_id?: string; child_node_id?: string }):
+  { ok: true; node_id: string } | { ok: false; error: string; message: string } {
+  const n = a.node_id, c = a.child_node_id;
+  if (n && c && n !== c) {
+    return { ok: false, error: "node_id_conflict", message: "node_id and child_node_id both provided but differ; send only one (they are aliases for the same child node)" };
+  }
+  const id = n ?? c;
+  if (!id) {
+    return { ok: false, error: "node_id_required", message: "one of node_id / child_node_id is required (child_node_id is a deprecated alias; prefer node_id)" };
+  }
+  return { ok: true, node_id: id };
+}
+
+function guardRestrictedMemberTools(server: McpServer, restrictedNets: string[], _userId: string): void {
+  const denied = (tool: string) => ({
+    content: [{
+      type: "text" as const,
+      text: JSON.stringify({
+        ok: false,
+        error: "agent_access_restricted",
+        message: `${tool} is not available to restricted members in this network; pass network_id of a network where you are not restricted, or ask a network admin for access`,
+      }),
+    }],
+  });
+  const wrap = (name: string, handler: (...callArgs: any[]) => any) => async (...callArgs: any[]) => {
+    if (!RESTRICTED_MEMBER_TOOLS.has(name)) {
+      const args = callArgs[0];
+      const raw = args && typeof args === "object" ? (args as Record<string, unknown>).network_id : undefined;
+      const net = typeof raw === "string" && raw.trim() ? raw.trim() : null;
+      if (!net || restrictedNets.includes(net)) return denied(name);
+    }
+    return handler(...callArgs);
+  };
+  const anyServer = server as any;
+  for (const method of ["tool", "registerTool"] as const) {
+    const original = anyServer[method].bind(server);
+    anyServer[method] = (...regArgs: any[]) => {
+      const last = regArgs.length - 1;
+      if (typeof regArgs[0] === "string" && typeof regArgs[last] === "function") regArgs[last] = wrap(regArgs[0], regArgs[last]);
+      return original(...regArgs);
+    };
+  }
 }
 
 export function registerTools(server: McpServer, clientIP?: string, enforceNetworkId?: string | null, enforceUserId?: string | null, callerAlias?: string | null, callerTokenIsNetwork = false, callerTokenId?: string | null) {
+  // 多用户 Agent 权限:用户令牌调用者在哪些网络里是受限成员(只看授权 Agent)。
+  // 网络令牌不会走到这里 —— 受限成员的网络令牌在 resolveToken 就被拒了。
+  const restrictedNets = enforceUserId && !callerTokenIsNetwork && !enforceNetworkId ? restrictedNetworkIds(enforceUserId) : [];
+  if (restrictedNets.length) guardRestrictedMemberTools(server, restrictedNets, enforceUserId!);
   // Default from_session for outbound tools — extracted from the calling
   // token's binding (ntok_ → node alias, utok_ → username). Without this,
   // an agent's send_task call always claimed from='hub' and peer agents
@@ -87,30 +189,238 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }],
     };
   };
-  // If enforceNetworkId is set, override any client-supplied network_id
-  const getNetworkId = (clientNetId?: string | null) => enforceNetworkId ?? clientNetId ?? null;
+  // MCP-side auth context in the shape network-scope.ts helpers take.
+  // null = legacy global-token / open-dev mode (unscoped, allow-all).
+  const mcpAuthCtx = enforceUserId ? { userId: enforceUserId, networkId: enforceNetworkId ?? null } : null;
+
+  // If enforceNetworkId is set (ntok_), override any client-supplied
+  // network_id. #517: for utok_ with no explicit network_id, fall back to
+  // the user's single membership via the SAME singleNetworkId used by REST
+  // POST /api/task (network-scope.ts) — utok_ rows carry network_id=null by
+  // design, so without this fallback single-network nodes could read
+  // everything but write nothing. Multi-network stays null (ambiguous) and
+  // canWrite rejects with network_id_required.
+  const getNetworkId = (clientNetId?: string | null) => {
+    const explicit = enforceNetworkId ?? clientNetId ?? null;
+    if (explicit !== null || !enforceUserId) return explicit;
+    return singleNetworkId({ networkId: null, networkIds: getUserNetworkIds(enforceUserId) });
+  };
 
-  // Check write access. For ntok_ the network is enforced by the token.
-  // For utok_ (no enforced network) we accept the network_id supplied in the
-  // request and verify the user has a write role on it.
+  // Check write access — delegates to the shared canRestWriteNetwork so MCP
+  // and REST cannot drift again (#517). isAdmin=false: MCP has no admin
+  // bypass today; keep behavior identical to before the extraction.
   const canWrite = (effectiveNetworkId?: string | null): boolean => {
-    if (!enforceUserId) return true; // legacy global token mode, allow
     const netId = enforceNetworkId ?? effectiveNetworkId ?? null;
-    if (!netId) return false; // no network resolvable
-    const role = getUserNetworkRole(enforceUserId, netId);
-    return !!role && role !== "viewer"; // owner/admin/member can write
+    return canRestWriteNetwork(mcpAuthCtx, netId, false);
+  };
+  // 人类侧写入(私信):不看 Agent 授权,受限成员也可以。
+  const canWriteHuman = (effectiveNetworkId?: string | null): boolean =>
+    canRestWriteNetworkAsHuman(mcpAuthCtx, enforceNetworkId ?? effectiveNetworkId ?? null, false);
+  // 给 Agent 发任务 / 消息的准入。不受限:原判据。受限网络里:目标必须是授权且 can_message 的 Agent,
+  // 发件人固定为自己的用户名;目标不存在与没授权返回同一个错误,不留 alias 探测差异。
+  const agentSendDenied = (effectiveNetworkId: string | null, alias: string, clientFrom: string | undefined, action: "send_task" | "write", meta?: unknown) => {
+    if (!effectiveNetworkId || !restrictedNets.includes(effectiveNetworkId)) {
+      return canWrite(effectiveNetworkId) ? null : writeDeniedReply(effectiveNetworkId, action);
+    }
+    if (!canWriteHuman(effectiveNetworkId)) return writeDeniedReply(effectiveNetworkId, action);
+    const requestedFrom = clientFrom?.trim();
+    if (requestedFrom && requestedFrom !== callerAlias) {
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "from_session_identity_mismatch", message: "restricted members always send as their own username" }) }] };
+    }
+    const targetAlias = resolveCanonicalAlias(effectiveNetworkId, alias).alias;
+    const session = db.get<{ node_id: string | null }>("SELECT node_id FROM sessions WHERE alias = ?1 AND network_id = ?2", targetAlias, effectiveNetworkId);
+    if (!session || !canMessageAgent(enforceUserId!, effectiveNetworkId, { alias: targetAlias, nodeId: session.node_id })) {
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "agent_not_granted", message: "this agent has not been granted to you; ask a network admin" }) }] };
+    }
+    const rawAttachments = meta && typeof meta === "object" ? (meta as { attachments?: unknown }).attachments : undefined;
+    if (restrictedMemberAttachmentsDenied(enforceUserId!, callerAlias ?? "", effectiveNetworkId, rawAttachments)) {
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "attachment_not_accessible" }) }] };
+    }
+    return null;
   };
 
+  // #517: name the REAL cause. The old catch-all blamed permissions for
+  // what was actually an unresolvable network, sending operators down the
+  // wrong debugging path (roles/membership) for hours.
   const writeDeniedReply = (effectiveNetworkId?: string | null, action = "write") => {
     const netId = enforceNetworkId ?? effectiveNetworkId ?? null;
-    const message = !netId
-      ? "network_id required (utok current_network is null; pass explicit network_id from /api/auth/me networks[0].network_id)"
-      : action === "send_task"
+    let error: string;
+    let message: string;
+    if (!netId) {
+      const memberships = enforceUserId ? getUserNetworkIds(enforceUserId) : [];
+      error = "network_id_required";
+      message = memberships.length === 0
+        ? "user token has no network memberships; join or create a network first"
+        : `user token spans ${memberships.length} networks; pass network_id explicitly (see /api/auth/me networks[].network_id)`;
+    } else if (enforceUserId && !getUserNetworkRole(enforceUserId, netId)) {
+      error = "access_denied";
+      message = "access denied to requested network (not a member)";
+    } else {
+      error = "permission_denied";
+      message = action === "send_task"
         ? "Viewer role cannot send tasks"
         : "Viewer role cannot write to this network";
-    return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "permission_denied", message }) }] };
+    }
+    return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error, message }) }] };
   };
 
+  const skillHubReply = (value: Record<string, unknown>) => ({
+    content: [{ type: "text" as const, text: JSON.stringify(value) }],
+  });
+
+  // SkillHub is a network registry, not a public filesystem. Content is an
+  // immutable SKILL.md snapshot; identity comes only from the authenticated
+  // MCP principal (never from request fields).
+  server.tool(
+    "submit_skill",
+    "Submit an immutable SKILL.md version to the caller's network SkillHub. Node identity is token-bound. New submissions require review.",
+    {
+      slug: z.string().min(2).max(80).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
+      name: z.string().min(1).max(120),
+      description: z.string().max(1000).optional(),
+      version: z.string().min(1).max(40).regex(/^[0-9A-Za-z]+(?:[._-][0-9A-Za-z]+)*$/),
+      content: z.string().min(1).max(128 * 1024).refine(value => !value.includes("\0"), "content must not contain NUL bytes"),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ slug, name, description, version, content, network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, "write");
+      if (!effectiveNetId) return writeDeniedReply(effectiveNetId, "write");
+      const sourceType = callerTokenIsNetwork ? "node" : "user";
+      if (sourceType === "node" && !callerAlias) return skillHubReply({ ok: false, error: "node_identity_unbound" });
+      const contentHash = createHash("sha256").update(content, "utf8").digest("hex");
+      const existing = db.get<any>(
+        `SELECT skill_id, content_hash, status FROM skillhub_skills
+         WHERE network_id = ?1 AND slug = ?2 AND version = ?3`,
+        effectiveNetId, slug, version,
+      );
+      if (existing) {
+        if (existing.content_hash === contentHash) {
+          return skillHubReply({ ok: true, idempotent: true, skill_id: existing.skill_id, status: existing.status });
+        }
+        return skillHubReply({ ok: false, error: "skill_version_conflict", hint: "publish changed content under a new version" });
+      }
+      const skillId = `skill_${uuidv4()}`;
+      try {
+        db.run(
+          `INSERT INTO skillhub_skills
+           (skill_id, network_id, slug, name, description, version, content, content_hash, status, source_type, source_alias, created_by_user)
+           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'pending', ?9, ?10, ?11)`,
+          [skillId, effectiveNetId, slug, name.trim(), description?.trim() || "", version, content, contentHash, sourceType, callerAlias, enforceUserId || null],
+        );
+      } catch (error: any) {
+        // Two submitters may pass the preflight SELECT together. Resolve the
+        // UNIQUE race into the same deterministic idempotent/conflict contract
+        // instead of leaking a storage exception as HTTP/MCP 500.
+        if (!/unique|duplicate key/i.test(error?.message || "")) throw error;
+        const winner = db.get<any>(
+          `SELECT skill_id, content_hash, status FROM skillhub_skills
+           WHERE network_id = ?1 AND slug = ?2 AND version = ?3`,
+          effectiveNetId, slug, version,
+        );
+        if (!winner) throw error;
+        if (winner.content_hash === contentHash) {
+          return skillHubReply({ ok: true, idempotent: true, skill_id: winner.skill_id, status: winner.status });
+        }
+        return skillHubReply({ ok: false, error: "skill_version_conflict", hint: "publish changed content under a new version" });
+      }
+      db.run(
+        `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+         VALUES (?1, ?2, 'skill_submit', 'skill', ?3, ?4, ?5)`,
+        [enforceUserId || null, callerAlias || null, skillId, JSON.stringify({ slug, version, source_type: sourceType }), effectiveNetId],
+      );
+      return skillHubReply({ ok: true, skill_id: skillId, status: "pending", source_type: sourceType, source_alias: callerAlias });
+    },
+  );
+
+  server.tool(
+    "list_skills",
+    "List published skills in a network. Owners/admins may include pending review items.",
+    {
+      network_id: z.string().max(200).optional(),
+      include_pending: z.boolean().optional(),
+      query: z.string().max(120).optional(),
+      limit: z.number().int().min(1).max(200).optional(),
+    },
+    async ({ network_id: clientNetId, include_pending, query, limit }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!effectiveNetId) return writeDeniedReply(effectiveNetId, "read");
+      const role = enforceUserId ? getUserNetworkRole(enforceUserId, effectiveNetId) : null;
+      if (enforceUserId && !role) return writeDeniedReply(effectiveNetId, "read");
+      // An ntok_ belongs to a node even when it was minted by the network
+      // owner. Never inherit the owner's review power through that token.
+      const reviewer = !callerTokenIsNetwork && (role === "owner" || role === "admin");
+      const showPending = !!include_pending && reviewer;
+      const params: unknown[] = [effectiveNetId];
+      let sql = `SELECT skill_id, slug, name, description, version, status, source_type, source_alias,
+                        created_at, updated_at, reviewed_at, review_note
+                   FROM skillhub_skills WHERE network_id = ?1`;
+      if (!showPending) sql += ` AND status = 'published'`;
+      if (query?.trim()) {
+        params.push(`%${query.trim()}%`);
+        sql += ` AND (slug LIKE ?${params.length} OR name LIKE ?${params.length} OR description LIKE ?${params.length})`;
+      }
+      sql += ` ORDER BY updated_at DESC LIMIT ${limit ?? 100}`;
+      return skillHubReply({ ok: true, reviewer, skills: db.all(sql, ...params) });
+    },
+  );
+
+  server.tool(
+    "get_skill",
+    "Read one SkillHub SKILL.md. Pending content is visible only to owners/admins.",
+    { skill_id: z.string().regex(/^skill_[A-Za-z0-9_-]+$/).max(200), network_id: z.string().max(200).optional() },
+    async ({ skill_id, network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!effectiveNetId) return writeDeniedReply(effectiveNetId, "read");
+      const role = enforceUserId ? getUserNetworkRole(enforceUserId, effectiveNetId) : null;
+      if (enforceUserId && !role) return writeDeniedReply(effectiveNetId, "read");
+      const row = db.get<any>(
+        `SELECT skill_id, slug, name, description, version, content, status,
+                source_type, source_alias, created_at, updated_at, reviewed_at, review_note
+           FROM skillhub_skills WHERE skill_id = ?1 AND network_id = ?2`,
+        skill_id, effectiveNetId,
+      );
+      if (!row) return skillHubReply({ ok: false, error: "skill_not_found" });
+      const reviewer = !callerTokenIsNetwork && (role === "owner" || role === "admin");
+      if (row.status !== "published" && !reviewer) {
+        return skillHubReply({ ok: false, error: "skill_not_found" });
+      }
+      return skillHubReply({ ok: true, skill: row });
+    },
+  );
+
+  server.tool(
+    "review_skill",
+    "Publish or reject a pending SkillHub submission. Network owner/admin only.",
+    {
+      skill_id: z.string().regex(/^skill_[A-Za-z0-9_-]+$/).max(200),
+      decision: z.enum(["published", "rejected"]),
+      note: z.string().max(1000).optional(),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ skill_id, decision, note, network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!effectiveNetId) return writeDeniedReply(effectiveNetId, "write");
+      const role = enforceUserId ? getUserNetworkRole(enforceUserId, effectiveNetId) : null;
+      if (callerTokenIsNetwork || (role !== "owner" && role !== "admin")) return skillHubReply({ ok: false, error: "skill_review_admin_required" });
+      const row = db.get<any>(`SELECT status FROM skillhub_skills WHERE skill_id = ?1 AND network_id = ?2`, skill_id, effectiveNetId);
+      if (!row) return skillHubReply({ ok: false, error: "skill_not_found" });
+      if (row.status !== "pending") return skillHubReply({ ok: false, error: "skill_not_pending", status: row.status });
+      const updated = db.run(
+        `UPDATE skillhub_skills SET status = ?1, review_note = ?2, reviewed_by_user = ?3,
+         reviewed_at = datetime('now'), updated_at = datetime('now') WHERE skill_id = ?4 AND network_id = ?5 AND status = 'pending'`,
+        [decision, note?.trim() || null, enforceUserId || null, skill_id, effectiveNetId],
+      );
+      if (updated.changes !== 1) return skillHubReply({ ok: false, error: "skill_not_pending" });
+      db.run(
+        `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+         VALUES (?1, ?2, 'skill_review', 'skill', ?3, ?4, ?5)`,
+        [enforceUserId || null, callerAlias || null, skill_id, JSON.stringify({ decision }), effectiveNetId],
+      );
+      return skillHubReply({ ok: true, skill_id, status: decision });
+    },
+  );
+
   const addScope = (sql: string, params: any[], networkId?: string | null, column = "network_id"): string => {
     if (!networkId) return sql;
     sql += ` AND ${column} = ?${params.length + 1}`;
@@ -118,49 +428,72 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     return sql;
   };
 
-  type ReadScope = { networkId?: string | null; networkIds?: string[] | null; denied?: string };
-
-  const getReadableNetworkIds = (): string[] => {
-    if (!enforceUserId) return [];
-    return db.all<{ network_id: string }>(
-      "SELECT network_id FROM network_members WHERE user_id = ?1",
-      enforceUserId
-    ).map((row) => row.network_id);
+  /** #1548 —— 把一个还标着 blocked 的会话拉回 idle。只在「它刚发出终态回复 / 刚派了任务」这两个活性证据处调用。 */
+  const releaseBlockedSession = (alias: string | null | undefined, networkId: string | null | undefined): void => {
+    if (!alias) return;
+    const params: any[] = [alias];
+    let sql = "UPDATE sessions SET status = 'idle', updated_at = datetime('now') WHERE alias = ?1 AND status = 'blocked'";
+    sql = addScope(sql, params, networkId ?? null);
+    try {
+      db.run(sql, params);
+    } catch {
+      // 展示层的一次修正失败不能影响主路径。
+    }
   };
 
+  type ReadScope = RestNetworkScope;
+
+  // Delegates to the shared membership query (network-scope.ts) — was a
+  // byte-for-byte duplicate of getUserNetworkIds before #517.
+  const getReadableNetworkIds = (): string[] =>
+    enforceUserId ? getUserNetworkIds(enforceUserId) : [];
+
+  // 受限网络挂在 scope.agentRestriction 上:addReadScope(= addNetworkScope)对它们 fail-closed,
+  // 逐条审过的工具改用 addAgentNetworkScope / addOwnTrafficScope 按授权放行。
+  const withRestriction = (scope: ReadScope): ReadScope => {
+    if (!restrictedNets.length || !enforceUserId) return scope;
+    const inScope = scope.networkId ? [scope.networkId] : (scope.networkIds ?? []);
+    const restricted = restrictedNets.filter((id) => inScope.includes(id));
+    return restricted.length ? { ...scope, agentRestriction: { userId: enforceUserId, username: callerAlias ?? "", networkIds: restricted } } : scope;
+  };
   const resolveReadScope = (clientNetId?: string | null): ReadScope => {
     if (!enforceUserId) return { networkId: clientNetId ?? null, networkIds: null };
     if (enforceNetworkId) {
       const role = getUserNetworkRole(enforceUserId, enforceNetworkId);
-      return role ? { networkId: enforceNetworkId, networkIds: null } : { denied: "not a member of token network" };
+      return role ? { networkId: enforceNetworkId, networkIds: null } : { networkId: null, networkIds: [], denied: "not a member of token network" };
     }
     if (clientNetId) {
       const role = getUserNetworkRole(enforceUserId, clientNetId);
-      return role ? { networkId: clientNetId, networkIds: null } : { denied: "access denied to requested network" };
+      return role ? withRestriction({ networkId: clientNetId, networkIds: null }) : { networkId: null, networkIds: [], denied: "access denied to requested network" };
     }
-    return { networkId: null, networkIds: getReadableNetworkIds() };
+    return withRestriction({ networkId: null, networkIds: getReadableNetworkIds() });
   };
 
-  const addReadScope = (sql: string, params: any[], scope: ReadScope, column = "network_id"): string => {
-    if (scope.networkId) {
-      sql += ` AND ${column} = ?${params.length + 1}`;
-      params.push(scope.networkId);
-      return sql;
-    }
-    if (scope.networkIds) {
-      if (scope.networkIds.length === 0) return `${sql} AND 1=0`;
-      const placeholders = scope.networkIds.map((_, i) => `?${params.length + i + 1}`).join(", ");
-      sql += ` AND ${column} IN (${placeholders})`;
-      params.push(...scope.networkIds);
-    }
-    return sql;
-  };
+  // RFC-027 §2.3 race-free invariant — assertNodeActive lives in
+  // server/src/lifecycle-guard.ts so REST handlers in server/src/index.ts
+  // can use the SAME code path. PR1.1 had it inline here; PR1.2a
+  // (#346 review catch) extracted because the closure scope made it
+  // unreachable from REST and left the §2.3 race open on dashboard
+  // Dispatch (POST /api/task + /api/broadcast). Per
+  // per team rule: grep every write site (MCP tools.ts AND REST index.ts) before adding a guard, and extract the helper into a shared module so both transports import it.
+
+  // 默认读作用域:对受限网络 fail-closed(见 network-scope.ts addNetworkScope)。
+  const addReadScope = (sql: string, params: any[], scope: ReadScope, column = "network_id"): string =>
+    addNetworkScope(sql, params, scope, column);
 
   type DeliveryTarget =
     | { state: "online"; alias: string; session: any }
     | { state: "offline"; alias: string; session: any; message: string }
     | { state: "not_found"; alias: string; message: string };
 
+  // Only call after the authenticated, network-scoped lookup resolved a
+  // concrete target. Error paths intentionally omit this identity object.
+  const actualTo = (target: Exclude<DeliveryTarget, { state: "not_found" }>, networkId?: string | null) => ({
+    alias: target.alias,
+    to_node_id: target.session?.node_id ?? null,
+    network_id: networkId ?? null,
+  });
+
   const scopedSessionStatus = (alias: string, networkId?: string | null) => {
     const params: any[] = [alias];
     let sql = "SELECT status, updated_at, last_seen_at, node_id FROM sessions WHERE alias = ?1";
@@ -261,9 +594,39 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       model: z.string().max(200).optional().describe("AI model name"),
       node_name: z.string().max(200).optional().describe("Stable node display name (may differ from alias)"),
       network_id: z.string().max(200).optional().describe("Network this agent belongs to"),
+      // ╭─ 🔴 往 report_status 里加字段之前先读这一段(#1545 实测,zod 4.3.6)─────────╮
+      // │ **这份 schema 的子对象一半严一半松,而后果完全不同。**
+      // │
+      // │   非 strict:host / process_telemetry / config_snapshot / daemon_capabilities
+      // │   `.strict()`:external_schedules(含其 schedules[] 元素)
+      // │              side_thread_capability(含其 exactBoundary)
+      // │
+      // │ 往**非 strict** 的对象里加一个 hub 还不认识的键 ⇒ zod **静默丢弃**。
+      // │   节点不会掉线,但字段人间蒸发 —— 现场表现为「daemon 明明发了、hub 上没有」,
+      // │   排查起来和 daemon 侧 bug 一模一样。
+      // │ 往**strict** 的对象里加同一个键 ⇒ `unrecognized_keys`,**整份 report_status 被拒**。
+      // │   而 agent-node 的 register() 是 `await` 且无人 catch ⇒ **节点进程当场死掉**
+      // │   (#1225 就是这么全网躺倒的,见下面 host.ip 那段)。
+      // │
+      // │ 所以「新字段能不能 daemon 先发」**没有统一答案,取决于你往哪个子对象里加**:
+      // │   非 strict → 可以先发(会丢,不会死);strict → hub 必须先合,否则升级即失联。
+      // │
+      // │ 🔴 别把这条读成「strict 更危险、都改成非 strict」。两者各有其位:
+      // │   external_schedules / side_thread_capability 是**有界快照**,strict 挡的是
+      // │   「节点往里塞任意键」;daemon_capabilities 是**能力自述**,天然要向前兼容
+      // │   (旧 hub 见到新能力应当忽略而不是拒绝整份上报)。**加字段前先看清你在哪一边。**
+      // ╰──────────────────────────────────────────────────────────────────────────────╯
       host: z.object({
-        hostname: z.string().max(200).optional(),
-        ip: z.string().max(200).optional(),
+        // 🔴 `.nullable()` 不是防御性冗余,是**发送方声明的类型**:agent-node 的
+        //    HostTelemetry 是 `ip: string | null`,`firstNonInternalIPv4()` 在没有
+        //    非回环 IPv4 的机器上返回 null(--network none 的容器、断网的笔记本、
+        //    部分 CI runner)。此前这里只有 `.optional()`,于是那台机器上的
+        //    agent-node 一启动就收到 MCP -32602,而 register() 是 await 且无人 catch
+        //    —— **整个节点进程当场死掉**,和 runtime 无关。
+        //    同一个对象里四个数值字段本来就写着 `.nullable().optional()`,
+        //    两个字符串字段是唯一的例外;正确写法一直在隔壁那一行。
+        hostname: z.string().max(200).nullable().optional(),
+        ip: z.string().max(200).nullable().optional(),
         cpu_load_1min: z.number().nullable().optional(),
         cpu_cores: z.number().nullable().optional(),
         mem_total_gb: z.number().nullable().optional(),
@@ -281,6 +644,26 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         uptime_seconds: z.number().nullable().optional(),
         in_flight_count: z.number().nullable().optional(),
       }).optional().describe("Per-agent process telemetry reported by agent-node"),
+      external_schedules: z.object({
+        observed_at: z.string().datetime({ offset: true }).max(64),
+        schedules: z.array(z.object({
+          id: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/),
+          name: z.string().min(1).max(200),
+          kind: z.enum(["cron", "systemd", "tmux", "playwright", "custom"]),
+          frequency: z.string().min(1).max(120),
+          last_run_at: z.string().datetime({ offset: true }).max(64).nullable(),
+          last_status: z.enum(["success", "failed", "running", "unknown"]),
+          last_error: z.string().max(500).nullable(),
+          next_run_at: z.string().datetime({ offset: true }).max(64).nullable(),
+          log_ref: z.string().min(1).max(255).nullable(),
+          enabled: z.boolean(),
+          // RFC-036 — only agent-node managed cron markers advertise write
+          // capability. Legacy/other kinds omit these fields and stay read-only.
+          editable: z.boolean().optional(),
+          revision: z.number().int().min(0).optional(),
+        }).strict()).max(64),
+        error: z.enum(["invalid_manifest", "unsafe_manifest", "read_failed"]).optional(),
+      }).strict().optional().describe("Bounded node-reported external schedule snapshot; never includes host paths or commands"),
       // RFC-024 B6 — masked snapshot of the node's effective config
       // (model + 6 dashboard-editable flags). Secrets ARE NOT in this
       // shape (env._envRef stays on host); the dashboard reads this
@@ -291,21 +674,126 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // can grey out remote-restart for them.
       config_snapshot: z.object({
         model: z.string().max(200).optional().nullable(),
-        flags: z.record(z.unknown()).optional(),
+        flags: z.record(z.string(), z.unknown()).optional(),
         config_revision: z.number().int().min(0).optional(),
         config_update_capable: z.boolean().optional(),
+        peer_reply_inbox_capable: z.literal(true).optional(),
+        side_thread_capability: z.object({
+          supported: z.boolean(),
+          runtime: z.string().max(64),
+          runtimeVersion: z.string().max(64),
+          topology: z.string().max(64),
+          evidenceRevision: z.string().max(100),
+          mode: z.literal("native-exact-fork").optional(),
+          exactBoundary: z.object({ through: z.boolean(), before: z.boolean() }).strict().optional(),
+          reason: z.enum(["runtime", "version", "topology", "experimental-api", "exact-boundary"]).optional(),
+        }).strict().optional(),
         // RFC-026 P2 / #338 — daemon role surfaced for hub /api/nodes
         // discovery (#337 extracts this field). "host_supervisor" =
         // anet daemon. Default-stripping zod would drop this otherwise.
         role: z.string().max(64).optional().nullable(),
-        // RFC-026 §9.3 — daemon self-declare. Promoted to first-class
-        // columns by PR2 so list_host_supervisors reads them directly
-        // (no per-call snapshot JSON parse). Soft caps avoid abuse.
-        runtimes_supported: z.array(z.string().max(64)).max(16).optional(),
-        allowed_secret_keys: z.array(z.string().max(64)).max(64).optional(),
+        // RFC-026 §9.3 / #338 PR3 — daemon self-declare nested under
+        // `daemon_capabilities` (canonical shape per existing hub reads
+        // at tools.ts:2010/2075 — PR1/PR2 placed these top-level, hub
+        // never saw them, max_concurrent_children stayed default + the
+        // allowlists stayed unenforced. PR3 nit ① per 通信龙).
+        // Soft caps avoid abuse via attacker daemon.
+        // 🔴 这个对象**故意不是 `.strict()`** —— 能力自述必须向前兼容:
+        //    旧 hub 见到新 daemon 报的新能力,应当忽略那一格,而不是拒掉整份 report
+        //    把节点踢下线。代价是新键在 hub 升级前会被**静默丢弃**(所以新字段仍然
+        //    应当 hub 先合)。同一份 schema 里 side_thread_capability / external_schedules
+        //    是 `.strict()` 的,后果不同 —— 见 `host:` 上方那段方框注释。
+        daemon_capabilities: z.object({
+          runtimes_supported: z.array(z.string().max(64)).max(16).optional(),
+          allowed_secret_keys: z.array(z.string().max(64)).max(64).optional(),
+          max_concurrent_children: z.number().int().min(1).max(1000).optional(),
+          // #1353 —— daemon **当下**能不能创建节点。与 runtimes_supported 不是一回事:
+          // 后者是声明(我支持哪些 runtime),这个是实际能力。一个 daemon 可以声明支持
+          // 三种 runtime,同时因为 ANET_BIN pin 解析不出来而一种也创建不了。
+          //
+          // 🔴 为什么 hub 需要看见它:pin 只存在于 /etc/anet-daemon/path.conf 或
+          //    显式开启的环境变量里,**重启不带环境就会丢**。丢了之后 daemon 照常注册、
+          //    在线、收 doorbell,hub 返回 ok:true + request_id —— 而节点永远不出现。
+          //    在此之前 hub 完全看不出区别,Dashboard 的「选服务器」还会把它列为可选。
+          can_create_nodes: z.boolean().optional(),
+          // 只收**代码**,不收原始报错文本 —— 上游 unsafePathHelp() 的消息里带完整机器路径,
+          // 而这个字段会走到 Dashboard。enum 而不是 string:一个自由文本字段等于给
+          // 「把路径塞进来」留了口子。
+          // #1353 —— 四类失败,修法完全不同:
+          //   identity   重装 anet / unset ANET_BIN_ABS
+          //   source     写 /etc/anet-daemon/path.conf（**要 sudo**）
+          //   shape      换成 realpath
+          //   permission **一行 chmod go-w**
+          // 混成一条会让人修错方向 —— 2026-08-28 我一天里撞到其中两类,看到的是同一条错误。
+          //
+          // 🔴 `anet_bin_pin_unresolved` **必须留着**:已经在跑的 agent-node@2.5.0-preview.40
+          //    发的就是这个值。zod 对象里任何一个字段验证失败会让**整个 report_status 被拒**,
+          //    不只是丢掉这一格 —— 那会让所有 .40 daemon 在 hub 上变成失联。
+          //    删一个 enum 值的代价,远大于多留一个。
+          // 🔴 仍然是 enum 不是 string:自由文本字段就是给机器路径留的口子,
+          //    而上游 e.message 里带的正是完整路径。
+          create_nodes_blocked_reason: z.enum([
+            "anet_bin_pin_unresolved",   // 兼容:.40 及更早
+            "anet_bin_identity",
+            "anet_bin_source",
+            "anet_bin_shape",
+            "anet_bin_permission",
+            "anet_bin_unknown",
+          ]).optional(),
+          // #1545 —— 上面那一格**是什么时候测出来的**。
+          //
+          // 🔴 版本号一律带包名 + 完整版本:仓里三个包各自独立编号,裸的 `preview.NN`
+          //    同时是三个不同的时间点。此处曾写成「preview.67」——
+          //    那是 agent-network 的号,agent-node 根本没有 .67(npm 404,最高 .56)。
+          // 🔴 为什么必须有:**agent-node ≤ 2.5.0-preview.54** 的 `daemonCreateCapability()`
+          //    用一个进程级缓存(`_createCapCache`)只算一次。开机时 pin 坏 ⇒ 之后
+          //    永远上报 blocked(哪怕运维已经写好 path.conf);开机时好 ⇒ 之后把二进制
+          //    chmod 掉也**永远上报 ready**。后者是朝「没问题」方向说谎。
+          //    而 hub 这边,一个 3 秒前测的 blocked 和一个三周前测的 blocked,
+          //    在 `last_seen_at` 上长得一模一样 —— 心跳是新的,那一格不是。
+          //
+          // 🔴 为什么是「多久以前」(时长)而不是绝对时间戳:这个值来自**节点自己的钟**。
+          //    时钟偏移下,绝对时间戳会算出一个既可能"永远新鲜"也可能"来自 1970"的年龄,
+          //    而且错的方向不可预测。时长对偏移免疫 —— hub 用自己的钟在收到时换算。
+          //
+          // 🔴 为什么不加 `.min()/.max()/.int()`:**这几个约束都会让整条 report_status 被拒**
+          //    (zod 对象里任何一个已知字段验证失败 = 整份被拒,不是丢掉这一格),
+          //    而这一格是纯诊断信息,不值得拿一台节点的在线状态去换。
+          //    收得宽,**在读取处消毒**(见 /api/host-supervisors)。
+          //    这条不是我新立的:同一个 schema 上方 `anet_bin_pin_unresolved` 那条注释
+          //    记的就是同一次教训 —— 删一个 enum 值会让所有 .40 daemon 失联。
+          //
+          // 🔴 `.catch(null)` 不是装饰:光写 `z.number()` **仍然会拒 NaN**
+          //    (实测:`z.number().nullable().optional()` 对 NaN 抛),而那意味着
+          //    一次算错的时长能让整台节点在 hub 上失联 —— 正是 #1225 里 host.ip
+          //    那个形状。`.catch(null)` 让这一格**在任何输入下都不可能拒掉整份 report**:
+          //    合法数字透传,其余一律变 null(读取侧当作「没报」)。
+          //    类型仍然是 number 而不是 unknown —— 别给一个 attacker daemon
+          //    留下"往快照里塞任意大对象"的口子(同 schema 上方 soft cap 的立场)。
+          //
+          // 不上报这一格 ≠ 0。旧 daemon 压根不发,读的人必须能把
+          // 「刚测的」「很久以前测的」「不知道」分成三件事说。
+          create_capability_observed_ms_ago: z.number().nullable().catch(null).optional(),
+          // app「新建节点」工作目录:daemon 的默认根。出现即表示该 daemon 认 node_spec.workdir。
+          // `.catch(undefined)`:同上一格的立场 —— 一个诊断/展示字段不许拒掉整份 report。
+          // 读取侧再按形状消毒(create-node-validate.ts daemonDefaultWorkdirRoot)。
+          default_workdir_root: z.string().max(1024).optional().catch(undefined),
+        }).optional(),
       }).optional().describe("RFC-024 — masked node config snapshot"),
+      // app#225 follow-up — the reporting process answers the `rules_file`
+      // doorbell (agent-node, and the claude-code channel server node-server).
+      // Top-level instead of config_snapshot: claude-code sessions usually have
+      // no `nodes` row, and config_snapshot is persisted per node_id. Only a
+      // node token bound to this same alias can set it; see the UPDATE below.
+      rules_file_capable: z.literal(true).optional(),
+      // Node skills view — same doorbell, ops skills_list / skill_read.
+      skills_capable: z.literal(true).optional(),
+      // Project folder view — same doorbell, ops files_list / file_read.
+      files_capable: z.literal(true).optional(),
+      // Node run-log view — same doorbell, op logs_tail.
+      logs_capable: z.literal(true).optional(),
     },
-    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, config_snapshot: cfgSnap }) => {
+    async ({ resume_id, alias, status, task, output, score, progress, server: srv, hostname: hn, agent: ag, project_dir: pd, version: ver, tmux_name: tmux, node_id, session_id, config_path, channels, model: mdl, node_name: nn, network_id: netId, host, process_telemetry: proc, external_schedules: externalSchedules, config_snapshot: cfgSnap, rules_file_capable: rulesFileCapable, skills_capable: skillsCapable, files_capable: filesCapable, logs_capable: logsCapable }) => {
       const effectiveNetId = getNetworkId(netId);
       const sessionNetId = effectiveNetId ?? "default";
       if (!callerTokenIsNetwork || !enforceNetworkId) {
@@ -343,6 +831,29 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           };
         }
       }
+      // #203 identity guard — network tokens must not silently rebind their
+      // own name via report_status. Without this, a runtime whose ALIAS
+      // drifted (env leak / wrong --alias / CurrentAliasResolver seeded from
+      // the wrong node_id) could rewrite api_tokens.name and cause every
+      // subsequent send_task from this token to be attributed to the drifted
+      // alias — the observed #203 symptom (grokB's send arriving as
+      // from=grokA). Only the legit rename path (rename.ts) may cross the
+      // token→alias binding. Symmetric to fromIdentityMismatchReply on the
+      // send side (test198).
+      if (callerTokenIsNetwork && callerAlias && !canonical.renamed && effectiveAlias !== callerAlias) {
+        return {
+          content: [{
+            type: "text" as const,
+            text: JSON.stringify({
+              ok: false,
+              error: "alias_identity_mismatch",
+              message: "report_status alias does not match the token-bound node alias; use anet node rename to change identity",
+              token_alias: callerAlias,
+              reported_alias: effectiveAlias,
+            }),
+          }],
+        };
+      }
       console.log(`[${ts()}] ${effectiveAlias} (${resume_id.slice(0, 8)}) → report_status: ${status}${task ? " | " + task.slice(0, 60) : ""}${effectiveNetId ? " [net]" : ""}${canonical.renamed ? ` [renamed from ${alias}]` : ""}`);
       if (callerTokenIsNetwork && callerTokenId) {
         try {
@@ -367,6 +878,15 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       const processCpuPct = typeof proc?.cpu_pct === "number" ? proc.cpu_pct : null;
       const processUptimeSeconds = typeof proc?.uptime_seconds === "number" ? proc.uptime_seconds : null;
       const processInFlightCount = typeof proc?.in_flight_count === "number" ? proc.in_flight_count : null;
+      const externalSchedulesJson = externalSchedules === undefined ? null : JSON.stringify(externalSchedules);
+      const trustedCurrentSnapshot = node_id
+        ? trustedConfigSnapshotForNode(cfgSnap ?? null, callerTokenId ?? null, node_id)
+        : null;
+      const peerReplyInboxCapable = !!(
+        trustedCurrentSnapshot
+        && typeof trustedCurrentSnapshot === "object"
+        && (trustedCurrentSnapshot as Record<string, unknown>).peer_reply_inbox_capable === true
+      );
       const statusHostTelemetry = host ? {
         hostname: hostHostname,
         ip: hostIp,
@@ -389,10 +909,30 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
       db.transaction(() => {
         // Only delete same-alias sessions within the same network
+        // 同一 alias 可以有两个上报者轮流说话(agent-node 自己 `sdk-<node>` +
+        // grok 共存里 TUI 的 MCP `grok-cli-<node>`)。下面这条 DELETE 会把「另一个
+        // resume_id」的那行整行删掉,再 INSERT 一行新的 —— ON CONFLICT 里那一串
+        // COALESCE 在这条路径上一次都不会触发,于是上报里没带的列(version / agent /
+        // hostname / 六个遥测字段 / registered_at …)全部变 NULL。2026-09-04 DEV 真机:
+        // grok-v1 working 时 version=.64,7 秒后 idle 就成了 NULL,registered_at 被改成
+        // 那一秒。先把要被删的那行读出来,INSERT 之后把仍为 NULL 的列从它接手 —— 让「换 resume_id」
+        // 和「同 resume_id 更新」对描述性列的语义一致:上报了就覆盖,没上报就保留。
+        // 状态类列(status / task / output / progress / score)不接手,那是本次上报的事实。
+        const handover = db.get<Record<string, unknown>>(
+          `SELECT tmux_name, server, ip, hostname, agent, project_dir, version, node_id, session_id, config_path,
+                  channels, model, cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb,
+                  disk_used_gb, disk_avail_gb, process_rss_bytes, process_rss_mb, process_cpu_pct,
+                  process_uptime_seconds, process_in_flight_count, external_schedules, registered_at
+             FROM sessions WHERE alias = ?1 AND resume_id != ?2 AND network_id = ?3
+             ORDER BY updated_at DESC LIMIT 1`,
+          effectiveAlias, resume_id, sessionNetId,
+        ) ?? null;
+        const keep = <T,>(fresh: T | null | undefined, column: string): T | null =>
+          (fresh ?? (handover?.[column] as T | null | undefined) ?? null);
         db.run("DELETE FROM sessions WHERE alias = ?1 AND resume_id != ?2 AND network_id = ?3", [effectiveAlias, resume_id, sessionNetId]);
         db.run(
-          `INSERT INTO sessions (resume_id, alias, tmux_name, server, ip, hostname, agent, project_dir, version, status, task, output, progress, score, node_id, session_id, config_path, channels, network_id, model, cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb, process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, last_seen_at, updated_at)
-           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17, ?18, ?19, ?20, ?21, ?22, ?23, ?24, ?25, ?26, ?27, ?28, ?29, ?30, ?31, ?32, ?33, datetime('now'), datetime('now'))
+          `INSERT INTO sessions (resume_id, alias, tmux_name, server, ip, hostname, agent, project_dir, version, status, task, output, progress, score, node_id, session_id, config_path, channels, network_id, model, cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb, process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, external_schedules, peer_reply_inbox_capable, last_seen_at, updated_at)
+           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17, ?18, ?19, ?20, ?21, ?22, ?23, ?24, ?25, ?26, ?27, ?28, ?29, ?30, ?31, ?32, ?33, ?34, ?35, datetime('now'), datetime('now'))
            ON CONFLICT(resume_id) DO UPDATE SET
              alias = COALESCE(?2, sessions.alias), tmux_name = COALESCE(?3, sessions.tmux_name),
              server = COALESCE(?4, sessions.server), ip = COALESCE(?5, sessions.ip),
@@ -417,9 +957,57 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
              process_cpu_pct = COALESCE(?31, sessions.process_cpu_pct),
              process_uptime_seconds = COALESCE(?32, sessions.process_uptime_seconds),
              process_in_flight_count = COALESCE(?33, sessions.process_in_flight_count),
+             external_schedules = COALESCE(?34, sessions.external_schedules),
+             peer_reply_inbox_capable = ?35,
              last_seen_at = datetime('now'), updated_at = datetime('now')`,
-          [resume_id, effectiveAlias, tmux ?? null, srv ?? null, hostIp, hostHostname, ag ?? null, pd ?? null, ver ?? null, status, task ?? null, trimmedOutput ?? null, progress ?? null, score ?? null, node_id ?? null, session_id ?? null, config_path ?? null, channels ?? null, sessionNetId, mdl ?? null, cpuLoad1m, cpuCores, memTotalGb, memUsedGb, memAvailGb, diskTotalGb, diskUsedGb, diskAvailGb, processRssBytes, processRssMb, processCpuPct, processUptimeSeconds, processInFlightCount]
+          [resume_id, effectiveAlias, tmux ?? null, srv ?? null, hostIp, hostHostname, ag ?? null, pd ?? null, ver ?? null, status, task ?? null, trimmedOutput ?? null, progress ?? null, score ?? null, node_id ?? null, session_id ?? null, config_path ?? null, channels ?? null, sessionNetId, mdl ?? null, cpuLoad1m, cpuCores, memTotalGb, memUsedGb, memAvailGb, diskTotalGb, diskUsedGb, diskAvailGb, processRssBytes, processRssMb, processCpuPct, processUptimeSeconds, processInFlightCount, externalSchedulesJson, peerReplyInboxCapable ? 1 : 0]
         );
+        if (handover) {
+          // 换 resume_id 那条路径上 ON CONFLICT 不会触发;INSERT 完再把没上报(仍为 NULL)的
+          // 描述性列从被替换的那行接手。INSERT 语句与参数列表保持原样 —— test698 的变异
+          // 用 sed 钉着它的字节形状。
+          db.run(
+            `UPDATE sessions SET
+               tmux_name = COALESCE(tmux_name, ?2), server = COALESCE(server, ?3), ip = COALESCE(ip, ?4),
+               hostname = COALESCE(hostname, ?5), agent = COALESCE(agent, ?6), project_dir = COALESCE(project_dir, ?7),
+               version = COALESCE(version, ?8), node_id = COALESCE(node_id, ?9), session_id = COALESCE(session_id, ?10),
+               config_path = COALESCE(config_path, ?11), channels = COALESCE(channels, ?12), model = COALESCE(model, ?13),
+               cpu_load_1min = COALESCE(cpu_load_1min, ?14), cpu_cores = COALESCE(cpu_cores, ?15),
+               mem_total_gb = COALESCE(mem_total_gb, ?16), mem_used_gb = COALESCE(mem_used_gb, ?17),
+               mem_avail_gb = COALESCE(mem_avail_gb, ?18), disk_total_gb = COALESCE(disk_total_gb, ?19),
+               disk_used_gb = COALESCE(disk_used_gb, ?20), disk_avail_gb = COALESCE(disk_avail_gb, ?21),
+               process_rss_bytes = COALESCE(process_rss_bytes, ?22), process_rss_mb = COALESCE(process_rss_mb, ?23),
+               process_cpu_pct = COALESCE(process_cpu_pct, ?24), process_uptime_seconds = COALESCE(process_uptime_seconds, ?25),
+               process_in_flight_count = COALESCE(process_in_flight_count, ?26),
+               external_schedules = COALESCE(external_schedules, ?27),
+               registered_at = COALESCE(?28, registered_at)
+             WHERE resume_id = ?1`,
+            [resume_id, handover.tmux_name ?? null, handover.server ?? null, handover.ip ?? null, handover.hostname ?? null,
+             handover.agent ?? null, handover.project_dir ?? null, handover.version ?? null, handover.node_id ?? null,
+             handover.session_id ?? null, handover.config_path ?? null, handover.channels ?? null, handover.model ?? null,
+             handover.cpu_load_1min ?? null, handover.cpu_cores ?? null, handover.mem_total_gb ?? null, handover.mem_used_gb ?? null,
+             handover.mem_avail_gb ?? null, handover.disk_total_gb ?? null, handover.disk_used_gb ?? null, handover.disk_avail_gb ?? null,
+             handover.process_rss_bytes ?? null, handover.process_rss_mb ?? null, handover.process_cpu_pct ?? null,
+             handover.process_uptime_seconds ?? null, handover.process_in_flight_count ?? null, handover.external_schedules ?? null,
+             handover.registered_at ?? null],
+          );
+        }
+        // app#225 follow-up — separate statement on purpose: the INSERT above is
+        // byte-pinned by test698's mutation harness. Sticky: only ever set to 1,
+        // and only by a node token bound to this alias (a user token or another
+        // node cannot mark someone else's session as able to serve its files).
+        if (rulesFileCapable === true && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias) {
+          db.run("UPDATE sessions SET rules_file_capable = 1 WHERE resume_id = ?1", [resume_id]);
+        }
+        if (skillsCapable === true && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias) {
+          db.run("UPDATE sessions SET skills_capable = 1 WHERE resume_id = ?1", [resume_id]);
+        }
+        if (filesCapable === true && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias) {
+          db.run("UPDATE sessions SET files_capable = 1 WHERE resume_id = ?1", [resume_id]);
+        }
+        if (logsCapable === true && callerTokenIsNetwork && callerAlias && callerAlias === effectiveAlias) {
+          db.run("UPDATE sessions SET logs_capable = 1 WHERE resume_id = ?1", [resume_id]);
+        }
         if (host || proc) {
           db.run(
             `INSERT INTO agent_telemetry (id, network_id, resume_id, alias, hostname, ip, cpu_load_1min, cpu_cores, mem_total_gb, mem_used_gb, mem_avail_gb, disk_total_gb, disk_used_gb, disk_avail_gb, process_rss_bytes, process_rss_mb, process_cpu_pct, process_uptime_seconds, process_in_flight_count, created_at)
@@ -468,6 +1056,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           upsertNodeWithSec1Guard({
             node_id,
             callerNetworkId: effectiveNetId ?? null,
+            callerUserId: enforceUserId ?? null,
+            callerTokenId: callerTokenId ?? null,
             node_name: nn || effectiveAlias,
             alias: effectiveAlias,
             runtime: nodeRuntime,
@@ -559,6 +1149,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         } else {
           updatedTaskId = task;
         }
+        if (updatedTaskId) syncScheduledRunForTask(updatedTaskId, effectiveNetId);
       });
       // Log event after transaction
       if (updatedTaskId) logTaskEvent(updatedTaskId, null, "replied", alias, "report_completion");
@@ -619,7 +1210,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       const rows0 = db.get<{ cnt: number }>(countSql, ...countParams);
       console.log(`[${ts()}] ${alias} → get_inbox: ${rows0?.cnt ?? 0} pending messages`);
       const rowsParams: any[] = [alias];
-      let rowsSql = `SELECT id, type, priority, content, context, from_session, created_at, network_id, meta_json
+      let rowsSql = `SELECT id, type, priority, content, context, from_session, created_at, network_id, meta_json,
+         CASE WHEN type = 'task' THEN COALESCE(task_id, id) ELSE task_id END AS task_id
          FROM inbox WHERE session_name = ?1 AND acked = 0`;
       rowsSql = addReadScope(rowsSql, rowsParams, readScope);
       rowsSql += ` ORDER BY CASE priority WHEN 'high' THEN 0 WHEN 'normal' THEN 1 ELSE 2 END, created_at
@@ -643,13 +1235,32 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       alias: z.string().min(1).max(200).describe("Session alias"),
       message_id: z.string().min(1).max(200),
       response: z.string().max(10000).optional(),
+      network_id: z.string().max(200).optional().describe("Network scope (auto-resolved for single-network user tokens)"),
     },
-    async ({ alias, message_id, response }) => {
-      const effectiveNetId = getNetworkId(null);
+    async ({ alias, message_id, response, network_id: netId }) => {
+      const effectiveNetId = getNetworkId(netId);
       if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId);
       console.log(`[${ts()}] ${alias} → ack_inbox: ${message_id.slice(0, 8)}`);
-      const ackParams: any[] = [message_id, alias];
-      let ackSql = "UPDATE inbox SET acked = 1 WHERE id = ?1 AND session_name = ?2";
+      // New task consumers ACK by the logical tasks.task_id exposed by
+      // get_inbox. Keep exact inbox.id support for legacy consumers and for
+      // non-task messages. Restrict the lookup to pending rows: after a retry
+      // the original row can have id == task_id but is already ACKed, while
+      // the current row has a fresh transport id and the same logical task_id.
+      const inboxTaskParams: any[] = [message_id, alias];
+      let inboxTaskSql = `SELECT id, type, COALESCE(task_id, id) AS task_id
+         FROM inbox
+         WHERE session_name = ?2 AND acked = 0
+           AND (id = ?1 OR (type = 'task' AND task_id = ?1))`;
+      inboxTaskSql = addScope(inboxTaskSql, inboxTaskParams, effectiveNetId);
+      inboxTaskSql += " ORDER BY created_at DESC LIMIT 1";
+      const inboxTask = db.get<{ id: string; type: string; task_id: string }>(inboxTaskSql, ...inboxTaskParams);
+      if (!inboxTask) {
+        return {
+          content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "message not found or already acknowledged" }) }],
+        };
+      }
+      const ackParams: any[] = [inboxTask.id, alias];
+      let ackSql = "UPDATE inbox SET acked = 1 WHERE id = ?1 AND session_name = ?2 AND acked = 0";
       ackSql = addScope(ackSql, ackParams, effectiveNetId);
       const result = db.run(ackSql, ackParams);
       if (result.changes === 0) {
@@ -659,11 +1270,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
       // V2: sync tasks table — ack_inbox means delivered→acked
       try {
-        const taskParams: any[] = [message_id];
+        if (inboxTask?.type !== "task") {
+          return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true }) }] };
+        }
+        const taskParams: any[] = [inboxTask.task_id];
         let taskSql = "UPDATE tasks SET status = 'acked' WHERE task_id = ?1 AND status = 'delivered'";
         taskSql = addScope(taskSql, taskParams, effectiveNetId);
         const ackResult = db.run(taskSql, taskParams);
-        if (ackResult.changes > 0) logTaskEvent(message_id, "delivered", "acked", alias);
+        if (ackResult.changes > 0) logTaskEvent(inboxTask.task_id, "delivered", "acked", alias);
       } catch {}
       return {
         content: [{ type: "text" as const, text: JSON.stringify({ ok: true }) }],
@@ -671,44 +1285,252 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     }
   );
 
+  // #520 — two monotonic runtime-evidence levels for exact tasks.
+  //
+  // runtime_submitted_at means agent-node handed the body to the vendor
+  // runtime. consumed_at is stronger: an attributable turn-start or first
+  // activity event came back. Merely fetching/acking an inbox row sets neither.
+  // Node identity comes exclusively from the ntok; callers cannot self-report
+  // an alias or node_id. A consumed mark also fills runtime_submitted_at because
+  // that stronger fact logically implies submission.
+  const markTaskRuntimeEvidence = (
+    taskIds: string[],
+    level: "submitted" | "consumed",
+    taskContexts: Array<{ task_id: string; thread_id: string; turn_id: string }> = [],
+  ) => {
+    const task_ids = taskIds;
+    if (!callerTokenIsNetwork || !callerAlias || !enforceNetworkId) {
+      return {
+        content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "node_token_required" }) }],
+      };
+    }
+    // PgAdapter.transaction currently opens a fresh subprocess/connection
+    // per statement. The all-or-nothing batch promise cannot be made there;
+    // refuse evidence rather than publish a partially stamped batch.
+    if (db.dialect !== "sqlite") {
+      return {
+        content: [{ type: "text" as const, text: JSON.stringify({
+          ok: false,
+          error: "task_runtime_evidence_backend_unsupported",
+        }) }],
+      };
+    }
+
+      const uniqueTaskIds = [...new Set(task_ids)];
+      if (uniqueTaskIds.length !== task_ids.length) {
+        return {
+          content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "duplicate_task_id" }) }],
+        };
+      }
+
+      if (level !== "consumed" && taskContexts.length > 0) {
+        return {
+          content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "runtime_context_requires_consumed" }) }],
+        };
+      }
+      const contextByTaskId = new Map(taskContexts.map((context) => [context.task_id, context]));
+      if (contextByTaskId.size !== taskContexts.length) {
+        return {
+          content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "duplicate_task_context" }) }],
+        };
+      }
+      const foreignContext = taskContexts.find((context) => !uniqueTaskIds.includes(context.task_id));
+      if (foreignContext) {
+        return {
+          content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "task_context_not_requested", task_id: foreignContext.task_id }) }],
+        };
+      }
+
+      const placeholders = uniqueTaskIds.map((_, i) => `?${i + 2}`).join(", ");
+
+      // Keep ownership preflight and every stamp in one SQLite transaction.
+      // This closes the cross-process preflight→UPDATE race: no other writer
+      // can reassign a task between the identity decision and the write.
+      const outcome = db.transaction(() => {
+        const canonicalCaller = resolveCanonicalAlias(enforceNetworkId, callerAlias).alias;
+        const callerSession = db.get<{ node_id: string | null }>(
+          `SELECT node_id FROM sessions
+           WHERE network_id = ?1 AND alias = ?2
+           ORDER BY updated_at DESC LIMIT 1`,
+          enforceNetworkId,
+          canonicalCaller,
+        );
+        const rows = db.all<{ task_id: string; to_node_id: string | null; to_name: string; thread_id: string | null; turn_id: string | null }>(
+          `SELECT task_id, to_node_id, to_name, thread_id, turn_id FROM tasks
+           WHERE network_id = ?1 AND task_id IN (${placeholders})`,
+          enforceNetworkId,
+          ...uniqueTaskIds,
+        );
+        const owned = new Map(rows.map((row) => [row.task_id, row]));
+        const rejectedTaskId = uniqueTaskIds.find((taskId) => {
+          const row = owned.get(taskId);
+          if (!row) return true;
+          // Prefer immutable node identity whenever the task has one.  Direct
+          // and legacy token-bound sessions legitimately have NULL node_id;
+          // only that shape may fall back to the canonical token alias.
+          if (row.to_node_id) return row.to_node_id !== callerSession?.node_id;
+          return resolveCanonicalAlias(enforceNetworkId, row.to_name).alias !== canonicalCaller;
+        });
+        if (rejectedTaskId) {
+          return { ok: false as const, error: "task_not_owned", task_id: rejectedTaskId };
+        }
+        const conflictingContext = uniqueTaskIds.find((taskId) => {
+          const context = contextByTaskId.get(taskId);
+          if (!context) return false;
+          const row = owned.get(taskId)!;
+          return (row.thread_id !== null && row.thread_id !== context.thread_id)
+            || (row.turn_id !== null && row.turn_id !== context.turn_id);
+        });
+        if (conflictingContext) {
+          return { ok: false as const, error: "task_runtime_context_conflict", task_id: conflictingContext };
+        }
+
+        for (const taskId of uniqueTaskIds) {
+          const row = owned.get(taskId)!;
+          const ownershipSql = row.to_node_id
+            ? "to_node_id = ?3"
+            : "to_node_id IS NULL AND to_name = ?3";
+          const ownerValue = row.to_node_id ?? row.to_name;
+          let updateResult;
+          if (level === "consumed") {
+            const context = contextByTaskId.get(taskId);
+            updateResult = db.run(
+              `UPDATE tasks SET
+                 runtime_submitted_at = COALESCE(runtime_submitted_at, datetime('now')),
+                 consumed_at = COALESCE(consumed_at, datetime('now')),
+                 thread_id = COALESCE(thread_id, ?4),
+                 turn_id = COALESCE(turn_id, ?5)
+               WHERE network_id = ?1 AND task_id = ?2 AND ${ownershipSql}`,
+              [enforceNetworkId, taskId, ownerValue, context?.thread_id ?? null, context?.turn_id ?? null],
+            );
+          } else {
+            updateResult = db.run(
+              `UPDATE tasks SET runtime_submitted_at = COALESCE(runtime_submitted_at, datetime('now'))
+               WHERE network_id = ?1 AND task_id = ?2 AND ${ownershipSql}`,
+              [enforceNetworkId, taskId, ownerValue],
+            );
+          }
+          if (updateResult.changes !== 1) {
+            // A zero-row write after a successful preflight is an invariant
+            // failure, never a successful evidence report.
+            throw new Error(`task_runtime_evidence_write_race:${taskId}`);
+          }
+        }
+        const evidenceRows = db.all<{
+          task_id: string;
+          runtime_submitted_at: string;
+          consumed_at: string | null;
+          thread_id: string | null;
+          turn_id: string | null;
+        }>(
+          `SELECT task_id, runtime_submitted_at, consumed_at, thread_id, turn_id FROM tasks
+           WHERE network_id = ?1 AND task_id IN (${placeholders})`,
+          enforceNetworkId,
+          ...uniqueTaskIds,
+        );
+        return { ok: true as const, tasks: evidenceRows };
+      });
+
+      return {
+        content: [{
+          type: "text" as const,
+          text: JSON.stringify(outcome),
+        }],
+      };
+  };
+
+  const taskRuntimeEvidenceSchema = {
+    task_ids: z.array(z.string().min(1).max(200)).min(1).max(100),
+    task_contexts: z.array(z.object({
+      task_id: z.string().min(1).max(200),
+      thread_id: z.string().min(1).max(500),
+      turn_id: z.string().min(1).max(500),
+    }).strict()).max(100).optional(),
+  };
+
+  server.tool(
+    "mark_tasks_runtime_submitted",
+    "Internal agent-node signal: exact task bodies were submitted to this token-bound node's vendor runtime.",
+    taskRuntimeEvidenceSchema,
+    async ({ task_ids, task_contexts }) => markTaskRuntimeEvidence(task_ids, "submitted", task_contexts),
+  );
+
+  server.tool(
+    "mark_tasks_consumed",
+    "Internal agent-node signal: exact tasks produced attributable turn-start/activity evidence in this token-bound node's runtime.",
+    taskRuntimeEvidenceSchema,
+    async ({ task_ids, task_contexts }) => markTaskRuntimeEvidence(task_ids, "consumed", task_contexts),
+  );
+
   // ═══════════════════════════════════════════
   //  Hub Tools (5)
   // ═══════════════════════════════════════════
 
   server.tool(
     "get_all_status",
-    "Get status of all sessions. Hub uses this for the patrol loop.",
+    "Get status of all sessions. Hub uses this for the patrol loop. " +
+      "Pass filter_alias (comma-separated) when you only care about specific " +
+      "nodes — the unfiltered result is one row per session with 31 columns and " +
+      "is large enough on a real fleet that callers cannot read it.",
     {
       filter_status: z.string().max(50).optional(),
       filter_server: z.string().max(200).optional(),
+      // 2026-08-17: on a 222-session hub the unfiltered response is ~259 KB, past
+      // what an MCP client can take in one result — so the caller that wanted the
+      // status of THREE nodes could not get it from this tool at all. The patrol
+      // loop still wants everything, hence optional rather than required.
+      filter_alias: z.string().max(2000).optional()
+        .describe("One alias, or several separated by commas. Exact matches only."),
       network_id: z.string().max(200).optional().describe("Filter by network"),
     },
-    async ({ filter_status, filter_server, network_id: netId }) => {
+    async ({ filter_status, filter_server, filter_alias, network_id: netId }) => {
       const readScope = resolveReadScope(netId);
       if (readScope.denied) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: readScope.denied }) }] };
-      console.log(`[${ts()}] hub → get_all_status${filter_status ? ": filter=" + filter_status : ""}${readScope.networkId ? " net=" + readScope.networkId.slice(0, 12) : ""}`);
+      console.log(`[${ts()}] hub → get_all_status${filter_status ? ": filter=" + filter_status : ""}${filter_alias ? " alias=" + filter_alias.slice(0, 80) : ""}${readScope.networkId ? " net=" + readScope.networkId.slice(0, 12) : ""}`);
 
       // Round-2/4 review ③: stale-marking moved to startStaleSessionSweeper()
       // (background timer, ~60s cadence). Read path no longer fires UPDATE.
       let sql = "SELECT * FROM sessions WHERE 1=1";
       const params: any[] = [];
-      sql = addReadScope(sql, params, readScope);
+      sql = addAgentNetworkScope(sql, params, readScope, { alias: "alias", nodeId: "node_id" });
       if (filter_status) { sql += " AND status = ?"; params.push(filter_status); }
       if (filter_server) { sql += " AND server = ?"; params.push(filter_server); }
+      const aliasFilter = parseAliasFilter(filter_alias);
+      const aliases = aliasFilter.aliases;
+      if (aliasFilter.sql) {
+        sql += aliasFilter.sql;
+        params.push(...aliases);
+      }
       sql += " ORDER BY updated_at DESC";
       const sessions = db.all(sql, ...params);
 
+      // `summary` has always counted every session in the read scope, ignoring
+      // filter_status / filter_server — and now filter_alias. That is fine for
+      // the patrol loop, but a caller who asked about three aliases and gets
+      // back three rows plus "idle: 96" can easily read the 96 as being about
+      // their three. A count that does not say what it counted invites exactly
+      // that. So the response now says so, rather than the semantics changing
+      // under existing callers.
       const summaryParams: any[] = [];
       let summarySql = "SELECT status, COUNT(*) as count FROM sessions WHERE 1=1";
-      summarySql = addReadScope(summarySql, summaryParams, readScope);
+      summarySql = addAgentNetworkScope(summarySql, summaryParams, readScope, { alias: "alias", nodeId: "node_id" });
       summarySql += " GROUP BY status";
       const summary = db.all(summarySql, ...summaryParams);
 
+      const filtered = !!(filter_status || filter_server || aliases.length > 0);
       return {
         content: [
           {
             type: "text" as const,
-            text: JSON.stringify({ ok: true, sessions, summary }),
+            text: JSON.stringify({
+              ok: true,
+              sessions,
+              summary,
+              summary_scope: filtered
+                ? "every session in the read scope — NOT narrowed by the filters applied to `sessions`"
+                : "every session in the read scope",
+              sessions_returned: sessions.length,
+            }),
           },
         ],
       };
@@ -725,7 +1547,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       console.log(`[${ts()}] hub → get_session_status: ${alias}`);
       const sessionParams: any[] = [alias];
       let sessionSql = "SELECT * FROM sessions WHERE alias = ?1";
-      sessionSql = addReadScope(sessionSql, sessionParams, readScope);
+      sessionSql = addAgentNetworkScope(sessionSql, sessionParams, readScope, { alias: "alias", nodeId: "node_id" });
       const session = db.get(sessionSql, ...sessionParams);
 
       const pendingParams: any[] = [alias];
@@ -766,7 +1588,12 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
     async ({ alias, task, priority, context, from_session: _fromIn, ttl_seconds, network_id: netId, parent_task_id: parentIn, meta }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
       const effectiveNetId = getNetworkId(netId);
-      const metaJson = normalizeMetaJson(meta);
+      const authOrigin: TaskAuthOrigin = callerTokenIsNetwork
+        ? "node"
+        : enforceUserId
+          ? "user"
+          : "legacy";
+      const metaJson = normalizeMetaJson(stampTaskAuthOrigin(meta, authOrigin));
 
       // Role check FIRST — round5 follow-up (通信牛 oracle catch):
       // the explicit-parent verification below distinguishes
@@ -775,8 +1602,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // existence + ownership of foreign parents via the difference in
       // error codes. Run canWrite first so a viewer ALWAYS gets the
       // same `permission_denied` regardless of parent state.
-      if (!canWrite(effectiveNetId)) {
-        return writeDeniedReply(effectiveNetId, "send_task");
+      {
+        const sendDenied = agentSendDenied(effectiveNetId, alias, _fromIn, "send_task", meta);
+        if (sendDenied) return sendDenied;
       }
 
       // Resolve parent_task_id: explicit > inferred (caller's most recent
@@ -841,6 +1669,46 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       const target = resolveDeliveryTarget(targetAlias, effectiveNetId);
       if (target.state === "not_found") return deliveryTargetReply(target)!;
 
+      // Dashboard sends carry a random client_request_id inside meta. Derive
+      // the task primary key from authenticated scope + that request id so a
+      // lost HTTP response can be retried safely, even after a hub restart.
+      // The existing row must match the full request; key reuse with changed
+      // content/target fails closed instead of silently returning another task.
+      const clientRequestId = clientRequestIdFromMeta(meta);
+      const id = clientRequestId
+        ? idempotentTaskId(effectiveNetId ?? null, from_session, clientRequestId)
+        : uuidv4();
+      if (clientRequestId) {
+        const existing = db.get<StoredIdempotentTask & { to_node_id: string | null }>(
+          "SELECT task_id, from_name, to_node_id, to_name, priority, content, network_id, meta_json, status FROM tasks WHERE task_id = ?1",
+          [id],
+        );
+        if (existing) {
+          if (!idempotentTaskMatches(existing, {
+            fromName: from_session, toName: targetAlias, priority, content: task,
+            networkId: effectiveNetId ?? null, metaJson,
+          })) {
+            return { content: [{ type: "text" as const, text: JSON.stringify({
+              ok: false, error: "idempotency_conflict",
+              message: "client_request_id was already used with a different task payload",
+            }) }] };
+          }
+          console.log(`[${ts()}] ${from_session} → send_task → ${targetAlias}: REPLAY (key=request_id, task=${existing.task_id.slice(0, 13)})`);
+          return { content: [{ type: "text" as const, text: JSON.stringify({
+            ok: true, message_id: existing.task_id, task_id: existing.task_id,
+            task_status: existing.status, idempotent_replay: true,
+            // A replay acknowledges the already-persisted dispatch. Use that
+            // row rather than today's session record so alias reuse or a
+            // restarted process cannot rewrite historical recipient identity.
+            actual_to: {
+              alias: existing.to_name,
+              to_node_id: existing.to_node_id ?? null,
+              network_id: existing.network_id ?? null,
+            },
+          }) }] };
+        }
+      }
+
       // #212 dedup guardrail. If this exact (from, to, content) has already
       // been delivered within COMMHUB_SEND_DEDUP_WINDOW_MS (default 5 min)
       // we refuse the call and surface a structured `duplicate_send`
@@ -849,7 +1717,13 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // incident: 50+ identical dispatches across 5 LLM turns ignored
       // three STOP replies — the LLM cannot be trusted to debounce
       // itself, so the runtime layer must.
-      const dedup = sharedSendDedup.check(from_session, targetAlias, task);
+      //
+      // A send carrying a validated client_request_id is keyed on that id
+      // instead of the content hash (send_dedup.ts header): a human typing
+      // the same short text twice sent two messages. Same-id retries were
+      // already answered from the durable row above.
+      const dedupScope = { requestId: clientRequestId, networkId: effectiveNetId ?? null };
+      const dedup = sharedSendDedup.check(from_session, targetAlias, task, undefined, dedupScope);
       if (dedup.duplicate) {
         const payload = buildDuplicateSendPayload({
           from: from_session,
@@ -857,22 +1731,28 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           ageMs: dedup.ageMs,
           windowMs: sharedSendDedup.windowMs,
         });
-        console.log(`[${ts()}] ${from_session} → send_task → ${targetAlias}: DROPPED duplicate (age=${dedup.ageMs}ms, window=${sharedSendDedup.windowMs}ms)`);
+        console.log(`[${ts()}] ${from_session} → send_task → ${targetAlias}: DROPPED duplicate (key=${dedup.kind}, age=${dedup.ageMs}ms, window=${sharedSendDedup.windowMs}ms)`);
         return { content: [{ type: "text" as const, text: JSON.stringify(payload) }] };
       }
 
+      // RFC-027 §2.3 inbox-enqueue lifecycle guard (PR1.1 site 1/6).
+      {
+        const lc = assertNodeActive(targetAlias, effectiveNetId ?? null);
+        if (!lc.ok) return { content: [{ type: "text" as const, text: JSON.stringify(lc) }] };
+      }
+
       console.log(`[${ts()}] ${from_session} → send_task → ${targetAlias}: ${task.slice(0, 60)}${priority === "high" ? " [HIGH]" : ""}${canonical.renamed ? ` [renamed from ${alias}]` : ""}`);
-      const id = uuidv4();
       const fromNodeId = resolveNodeIdForAlias(from_session, effectiveNetId);
       const targetNodeId = target.session?.node_id ?? null;
+      const resolvedActualTo = actualTo(target, effectiveNetId);
       // 事务：inbox + tasks 双写 + 触碰目标 session 的 task/updated_at（让
       // dashboard 在派任务一刻就反映出"任务已下发"，不再等 agent 的
       // report_status 心跳；status 字段交给 agent，避免与 working/idle
       // 报告冲突）。
       db.transaction(() => {
         db.run(
-          `INSERT INTO inbox (id, session_name, node_id, type, priority, content, context, from_session, requires_response, network_id, meta_json)
-           VALUES (?1, ?2, ?3, 'task', ?4, ?5, ?6, ?7, 'reply', ?8, ?9)`,
+          `INSERT INTO inbox (id, task_id, session_name, node_id, type, priority, content, context, from_session, requires_response, network_id, meta_json)
+           VALUES (?1, ?1, ?2, ?3, 'task', ?4, ?5, ?6, ?7, 'reply', ?8, ?9)`,
           [id, targetAlias, targetNodeId, priority, task, context ?? null, from_session, effectiveNetId ?? null, metaJson]
         );
         db.run(
@@ -884,12 +1764,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         let touchSql = "UPDATE sessions SET task = ?1, updated_at = datetime('now') WHERE alias = ?2";
         touchSql = addScope(touchSql, touchParams, effectiveNetId);
         db.run(touchSql, touchParams);
+        // #1548 —— 能派活的发送方不可能真的 blocked;此处出 blocked → idle。
+        releaseBlockedSession(from_session, effectiveNetId);
       });
       logTaskEvent(id, null, "delivered", from_session, parentTaskId ? `→ ${targetAlias} (parent=${parentTaskId.slice(0,8)})` : `→ ${targetAlias}`);
       // Only stamp the dedup index after the inbox/tasks transaction
       // succeeds, so a failed insert never silently shadows a legitimate
       // retry.
-      sharedSendDedup.record(from_session, targetAlias, task);
+      sharedSendDedup.record(from_session, targetAlias, task, undefined, dedupScope);
 
       // SSE push by alias.
       // The SSE channel is keyed by alias (subscribers connected to /events/<alias>),
@@ -902,9 +1784,17 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       let pendingSql = "SELECT COUNT(*) as cnt FROM inbox WHERE session_name = ?1 AND acked = 0";
       pendingSql = addScope(pendingSql, pendingParams, effectiveNetId);
       const pending = db.get<{ cnt: number }>(pendingSql, ...pendingParams);
-      if (target.state === "online") {
-        pushEvent(targetAlias, { type: "new_task", inbox_count: pending?.cnt ?? 1, priority, from: from_session, ...(canonical.renamed ? { renamed_from: alias } : {}) }, effectiveNetId);
-      }
+      // 🔴 不要用 last_seen_at 的时间戳去猜「有没有人在听」——SSE 订阅者注册表
+      // 就是那件事本身。pushEvent 在没有订阅者时已经是 no-op，所以这道闸不提供
+      // 任何保护，只会把**连着但最近没心跳**的会话排除掉；而全网「停发心跳/状态类
+      // 消息」的省额度规则让安静恰恰是常态。上面那段注释早就写着 "Push
+      // unconditionally"，同一类缺陷上次也是打在 Dashboard 任务上（f015d9d6：
+      // 任务标了 delivered，会话却从未收到推送）。
+      pushEvent(targetAlias, { type: "new_task", inbox_count: pending?.cnt ?? 1, priority, from: from_session, ...(canonical.renamed ? { renamed_from: alias } : {}) }, effectiveNetId);
+      const actuallyDelivered = hasSubscribers(targetAlias, effectiveNetId);
+      // #461 network observer summary — unconditional (task row exists
+      // even when the target is offline/queued), metadata only.
+      pushNetworkObserverEvent(effectiveNetId, { type: "new_task", task_id: id, from: from_session, to: targetAlias, status: actuallyDelivered ? "delivered" : "queued", priority });
 
       if (target.state === "offline") {
         return {
@@ -919,6 +1809,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
               task_id: id,
               message_id: id,
               session_status: target.session.status ?? "offline",
+              actual_to: resolvedActualTo,
               ...(canonical.renamed ? { renamed_from: alias, renamed_to: targetAlias } : {}),
             }),
           }],
@@ -932,6 +1823,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             text: JSON.stringify({
               ok: true,
               message_id: id,
+              actual_to: resolvedActualTo,
               ...(canonical.renamed ? { renamed_from: alias, renamed_to: targetAlias } : {}),
               session_status: target.session?.status ?? "unknown",
             }),
@@ -948,14 +1840,20 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       alias: z.string().min(1).max(200).describe("Target session alias"),
       message: z.string().min(1).max(10000).describe("Message content"),
       from_session: z.string().max(200).optional(),
+      network_id: z.string().max(200).optional().describe("Network scope (auto-resolved for single-network user tokens)"),
     },
-    async ({ alias, message, from_session: _fromIn }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
-      const effectiveNetId = getNetworkId(null);
-      if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId);
+    async ({ alias, message, from_session: _fromIn, network_id: netId }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
+      const effectiveNetId = getNetworkId(netId);
+      { const sendDenied = agentSendDenied(effectiveNetId, alias, _fromIn, "write"); if (sendDenied) return sendDenied; }
       const canonical = resolveCanonicalAlias(effectiveNetId, alias);
       const targetAlias = canonical.alias;
       const target = resolveDeliveryTarget(targetAlias, effectiveNetId);
       if (target.state === "not_found") return deliveryTargetReply(target)!;
+      // RFC-027 §2.3 inbox-enqueue lifecycle guard (PR1.1 site 2/6).
+      {
+        const lc = assertNodeActive(targetAlias, effectiveNetId ?? null);
+        if (!lc.ok) return { content: [{ type: "text" as const, text: JSON.stringify(lc) }] };
+      }
       console.log(`[${ts()}] ${from_session} → send_message → ${targetAlias}: ${message.slice(0, 60)}${canonical.renamed ? ` [renamed from ${alias}]` : ""}`);
       const id = uuidv4();
       db.run(
@@ -964,9 +1862,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         [id, targetAlias, target.session?.node_id ?? null, message, from_session, effectiveNetId ?? null]
       );
 
-      if (target.state === "online") {
-        pushEvent(targetAlias, { type: "new_message", from: from_session, message_id: id, ...(canonical.renamed ? { renamed_from: alias } : {}) }, effectiveNetId);
-      }
+      // 同 send_task：可达性用订阅者注册表判，不用心跳时间戳猜。
+      pushEvent(targetAlias, { type: "new_message", inbox_count: pendingInboxCount(targetAlias, effectiveNetId), from: from_session, message_id: id, ...(canonical.renamed ? { renamed_from: alias } : {}) }, effectiveNetId);
 
       const offlineReply = deliveryTargetReply(target, { message_id: id });
       if (offlineReply) {
@@ -994,96 +1891,270 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     }
   );
 
-  // ── V2: send_reply (关联 task_id，不触发 think) ──
-  server.tool(
-    "send_reply",
-    "Send a reply to a task. Linked to task_id via in_reply_to. Does NOT trigger agent processing.",
-    {
-      alias: z.string().min(1).max(200).describe("Target session alias"),
+  // ── V2/V3 reply primitives ──
+  const replyToolSchema = {
+      // #1085 — alias is OPTIONAL: when omitted (or empty) and `in_reply_to`
+      // is set, the hub derives the target from the original task's
+      // `from_name` (it already SELECTs that task by in_reply_to below).
+      // The SDK-runtime bridge (agent-node/src/commhub-mcp.ts) exposes
+      // send_reply as (task_id, text, status) with NO alias, so before this
+      // it always sent alias=undefined → -32602 "expected string, received
+      // undefined at alias". The target was already knowable from the task,
+      // so requiring the caller to pass it was a redundant-param trap.
+      alias: z.string().min(1).max(200).optional().describe("Target session alias — optional; derived from in_reply_to's task sender when omitted"),
       text: z.string().min(1).max(10000).describe("Reply content"),
       in_reply_to: z.string().max(200).optional().describe("Original task/message ID"),
       status: z.enum(["replied", "failed", "cancelled"]).optional().default("replied").describe("Task outcome"),
       from_session: z.string().max(200).optional(),
-    },
-    async ({ alias, text, in_reply_to, status: replyStatus, from_session: _fromIn }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
-      const effectiveNetId = getNetworkId(null);
+      network_id: z.string().max(200).optional().describe("Network scope (auto-resolved for single-network user tokens)"),
+      // #507 — top-level attachments (parity with REST /api/task L506). MCP Zod
+      // otherwise silently strips unknown fields, so a caller passing
+      // `attachments` before this schema entry existed would see `ok:true`
+      // and never learn the attachments were dropped. Validated by
+      // validateAttachments (uploads.ts) — the same helper the REST path uses.
+      attachments: z.any().optional().describe("Optional attachment array; parity with send_task's meta.attachments. Each item: {type:'file', file_id, name?, mime?, size?}. Persisted into tasks.meta_json + inbox.meta_json."),
+      // #507 — optional structured metadata (parity with send_task L837). If
+      // both `attachments` (top-level) and `meta.attachments` are supplied,
+      // top-level wins (same rule as REST /api/task L2101).
+      meta: z.any().optional().describe("Optional structured reply metadata, e.g. { attachments: [...] }."),
+    };
+  const handleReply = async (args: any, peerCapabilityRequired: boolean) => {
+      const { alias, text, in_reply_to, status: replyStatus = "replied", from_session: _fromIn, network_id: netId, attachments, meta } = args;
+      const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
+      const effectiveNetId = getNetworkId(netId);
       if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId);
-      console.log(`[${ts()}] ${from_session} → send_reply (${replyStatus}) → ${alias}: ${text.slice(0, 60)}`);
-      const id = uuidv4();
-      let taskBefore: { status: string } | null = null;
-      if (in_reply_to) {
-        const taskParams: any[] = [in_reply_to];
-        let taskSql = "SELECT status FROM tasks WHERE task_id = ?1";
-        taskSql = addScope(taskSql, taskParams, effectiveNetId);
-        taskBefore = db.get<{ status: string }>(taskSql, ...taskParams) ?? null;
-        if (!taskBefore) {
-          return {
-            content: [{
-              type: "text" as const,
-              text: JSON.stringify({
-                ok: false,
-                error: "reply_task_not_found",
-                message: `cannot apply reply: task not found (${in_reply_to})`,
-                in_reply_to,
-                reply_queued: false,
-              }),
-            }],
-          };
+      if (peerCapabilityRequired && !in_reply_to) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "peer_reply_task_required" }) }] };
+      }
+
+      // #507 — validate attachments BEFORE any DB write. Rejects malformed
+      // input (bad file_id, >20 items, size > cap, non-object item, wrong
+      // type field) with an explicit error the caller can act on. Empty /
+      // absent attachments return { ok: true, attachments: [] } — the
+      // reverse-(e) invariant (no attachments → behavior unchanged) is
+      // pinned by tests that assert byte-identical response shape
+      // before/after this validation runs.
+      const attachmentsResult = validateAttachments(attachments ?? (meta && typeof meta === "object" ? (meta as any).attachments : undefined));
+      if (!attachmentsResult.ok) {
+        return {
+          content: [{
+            type: "text" as const,
+            text: JSON.stringify({
+              ok: false,
+              error: "bad_attachments",
+              message: attachmentsResult.error,
+            }),
+          }],
+        };
+      }
+      const mergedMeta = attachmentsResult.attachments.length
+        ? { ...(meta && typeof meta === "object" ? meta : {}), attachments: attachmentsResult.attachments }
+        : meta;
+      const metaJson = normalizeMetaJson(mergedMeta);
+
+      // #1085 — derive the reply target when the caller omitted `alias`.
+      // The original task's `from_name` IS the reply target; the hub knows
+      // it from `in_reply_to`. Without this, an SDK-runtime send_reply
+      // (schema has no alias) died with -32602 before reaching this handler.
+      let effectiveAlias: string | undefined =
+        (typeof alias === "string" && alias.trim()) ? alias : undefined;
+      if (!effectiveAlias) {
+        if (!in_reply_to) {
+          return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "reply_target_required", message: "alias omitted and no in_reply_to to derive it from" }) }] };
         }
-        if (!["created", "delivered", "acked", "running"].includes(taskBefore.status)) {
-          return {
-            content: [{
-              type: "text" as const,
-              text: JSON.stringify({
-                ok: false,
-                error: "reply_task_terminal",
-                message: `cannot apply reply: task is already terminal (${taskBefore.status})`,
-                in_reply_to,
-                task_status: taskBefore.status,
-                reply_queued: false,
-              }),
-            }],
-          };
+        const derivParams: any[] = [in_reply_to];
+        let derivSql = "SELECT from_name FROM tasks WHERE task_id = ?1";
+        derivSql = addScope(derivSql, derivParams, effectiveNetId);
+        const derived = db.get<{ from_name: string }>(derivSql, ...derivParams);
+        if (!derived?.from_name) {
+          return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "reply_target_unresolved", message: `alias omitted and could not derive target from in_reply_to (${in_reply_to})` }) }] };
         }
+        effectiveAlias = derived.from_name;
       }
-      const replyTargetNodeId = resolveNodeIdForAlias(alias, effectiveNetId);
-      const replyLogged = db.transaction(() => {
+
+      const canonicalReplyTarget = resolveCanonicalAlias(effectiveNetId, effectiveAlias);
+      const replyTargetAlias = canonicalReplyTarget.alias;
+      console.log(`[${ts()}] ${from_session} → send_reply (${replyStatus}) → ${replyTargetAlias}: ${text.slice(0, 60)}${attachmentsResult.attachments.length ? ` [+${attachmentsResult.attachments.length} attachments]` : ""}${canonicalReplyTarget.renamed ? ` [renamed from ${effectiveAlias}]` : ""}`);
+      const id = uuidv4();
+      const replyTargetNodeId = resolveNodeIdForAlias(replyTargetAlias, effectiveNetId);
+      // RFC-027 §2.3 inbox-enqueue lifecycle guard (PR1.1 site 3/6).
+      {
+        const lc = assertNodeActive(replyTargetAlias, effectiveNetId ?? null);
+        if (!lc.ok) return { content: [{ type: "text" as const, text: JSON.stringify(lc) }] };
+      }
+      const replyOutcome = db.transaction(() => {
+        type ReplyTask = {
+          status: string;
+          from_node_id: string | null;
+          from_name: string;
+          to_name: string;
+          to_node_id: string | null;
+        };
+        let taskBefore: ReplyTask | null = null;
+        let callerNodeId: string | null = null;
+        if (in_reply_to) {
+          const taskParams: any[] = [in_reply_to];
+          let taskSql = "SELECT status, from_node_id, from_name, to_name, to_node_id FROM tasks WHERE task_id = ?1";
+          taskSql = addScope(taskSql, taskParams, effectiveNetId);
+          taskBefore = db.get<ReplyTask>(taskSql, ...taskParams) ?? null;
+          if (!taskBefore) return { ok: false as const, error: "reply_task_not_found" as const };
+          if (!["created", "delivered", "acked", "running"].includes(taskBefore.status)) {
+            return { ok: false as const, error: "reply_task_terminal" as const, taskStatus: taskBefore.status };
+          }
+
+          // V3 atomic peer replies are capability-negotiated. Both identity
+          // bindings and the recipient capability are re-read inside this
+          // transaction before any inbox/task/run write. Legacy/unbound rows
+          // fail toward compatibility send_reply, which terminalizes the
+          // original task instead of creating a second response-requiring row.
+          if (peerCapabilityRequired) {
+            if (!taskBefore.from_node_id) {
+              // Origin type is an intrinsic property of the task and must be
+              // decided before caller capability. A Dashboard/human task still
+              // needs the established send_reply terminalization path when the
+              // replying node uses a legacy/unbound token.
+              return { ok: false as const, error: "peer_reply_origin_not_node" as const };
+            }
+            if (!callerTokenIsNetwork || !callerTokenId || !enforceNetworkId) {
+              return { ok: false as const, error: "peer_reply_node_token_required" as const };
+            }
+            const token = db.get<{ bound_node_id: string | null }>(
+              "SELECT bound_node_id FROM api_tokens WHERE token_id = ?1 AND network_id = ?2",
+              callerTokenId,
+              enforceNetworkId,
+            );
+            if (!token?.bound_node_id || !taskBefore.to_node_id) {
+              return { ok: false as const, error: "peer_reply_unsupported" as const };
+            }
+            if (token.bound_node_id !== taskBefore.to_node_id) {
+              return { ok: false as const, error: "reply_task_not_owned" as const };
+            }
+            callerNodeId = token.bound_node_id;
+            const canonicalTarget = replyTargetAlias;
+            const canonicalOrigin = resolveCanonicalAlias(enforceNetworkId, taskBefore.from_name).alias;
+            if (canonicalTarget !== canonicalOrigin) {
+              return { ok: false as const, error: "reply_target_mismatch" as const };
+            }
+            const recipient = db.get<{ peer_reply_inbox_capable: number }>(
+              `SELECT peer_reply_inbox_capable FROM sessions
+               WHERE node_id = ?1 AND network_id = ?2 AND alias = ?3
+               ORDER BY updated_at DESC LIMIT 1`,
+              taskBefore.from_node_id,
+              enforceNetworkId,
+              canonicalOrigin,
+            );
+            if (recipient?.peer_reply_inbox_capable !== 1) {
+              return { ok: false as const, error: "peer_reply_unsupported" as const };
+            }
+          } else if (callerTokenIsNetwork && enforceNetworkId) {
+            // Compatibility send_reply is still an exact task transition for
+            // node callers. Bind it to the token-authenticated assignee alias
+            // and immutable original sender. Alias binding survives a
+            // legitimate node-id rotation without letting another node close
+            // the task.
+            const canonicalCaller = resolveCanonicalAlias(enforceNetworkId, from_session).alias;
+            const canonicalAssignee = resolveCanonicalAlias(enforceNetworkId, taskBefore.to_name).alias;
+            if (canonicalCaller !== canonicalAssignee) {
+              return { ok: false as const, error: "reply_task_not_owned" as const };
+            }
+            const canonicalOrigin = resolveCanonicalAlias(enforceNetworkId, taskBefore.from_name).alias;
+            if (replyTargetAlias !== canonicalOrigin) {
+              return { ok: false as const, error: "reply_target_mismatch" as const };
+            }
+          }
+
+        }
+
+        // #507 — write meta_json on inbox insert (parity with send_task L952).
+        // Prior to this the attachments field on a send_reply call was
+        // silently stripped by MCP Zod, leaving `ok:true` with no persisted
+        // meta.
         db.run(
-          `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, in_reply_to, requires_response, network_id)
-           VALUES (?1, ?2, ?3, 'reply', 'normal', ?4, ?5, ?6, 'none', ?7)`,
-          [id, alias, replyTargetNodeId, text, from_session, in_reply_to ?? null, effectiveNetId ?? null]
+          `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, in_reply_to, requires_response, network_id, meta_json)
+           VALUES (?1, ?2, ?3, 'reply', 'normal', ?4, ?5, ?6, 'none', ?7, ?8)`,
+          [id, replyTargetAlias, replyTargetNodeId, text, from_session, in_reply_to ?? null, effectiveNetId ?? null, metaJson]
         );
 
         // 更新 tasks 表
         if (in_reply_to) {
-          const updateParams: any[] = [replyStatus, text, in_reply_to];
-          let updateSql = `UPDATE tasks SET status = ?1, result = ?2, completed_at = datetime('now')
-             WHERE task_id = ?3 AND status IN ('created', 'delivered', 'acked', 'running')`;
+          // #507 — persist meta_json onto the tasks row too, so
+          // dashboard's task view sees the reply's attachments alongside
+          // the reply text (parity with send_task L957/959 which writes
+          // meta_json into both inbox and tasks). The COALESCE guards
+          // against clobbering pre-existing meta_json when this reply
+          // brings no attachments (metaJson === null → keep the existing
+          // task meta_json unchanged). Reverse-(e) invariant.
+          // #1823 —— 回复的附件写到 tasks.meta_json.reply_attachments,**不碰** meta_json.attachments:
+          // 那个键是提问者随任务带的附件,客户端把它画在提问者的气泡里。以前这里用回复的 metaJson
+          // 整体 COALESCE 替换,于是 agent 回的图出现在提问者气泡下面、提问者自己带的附件被覆盖
+          // (Vincent 2026-09-06 实测「好像没成功发送给我」)。inbox 行(收件方视角)照旧写 metaJson。
+          const replyTaskMetaJson = (() => {
+            if (!attachmentsResult.attachments.length) return null;
+            const rowParams: any[] = [in_reply_to];
+            let rowSql = "SELECT meta_json FROM tasks WHERE task_id = ?1";
+            rowSql = addScope(rowSql, rowParams, effectiveNetId);
+            const existing = db.get<{ meta_json: string | null }>(rowSql, ...rowParams)?.meta_json ?? null;
+            let base: Record<string, unknown> = {};
+            if (existing) { try { const parsed = JSON.parse(existing); if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) base = parsed; } catch {} }
+            return JSON.stringify({ ...base, reply_attachments: attachmentsResult.attachments });
+          })();
+          const updateParams: any[] = [replyStatus, text, replyTaskMetaJson, in_reply_to];
+          let updateSql = `UPDATE tasks
+             SET status = ?1,
+                 result = ?2,
+                 completed_at = datetime('now'),
+                 meta_json = COALESCE(?3, meta_json)
+             WHERE task_id = ?4 AND status IN ('created', 'delivered', 'acked', 'running')`;
+          if (peerCapabilityRequired && callerTokenIsNetwork && taskBefore) {
+            if (taskBefore.to_node_id) {
+              updateParams.push(callerNodeId);
+              updateSql += ` AND to_node_id = ?${updateParams.length}`;
+            } else {
+              updateParams.push(taskBefore.to_name);
+              updateSql += ` AND to_node_id IS NULL AND to_name = ?${updateParams.length}`;
+            }
+          }
           updateSql = addScope(updateSql, updateParams, effectiveNetId);
           const result = db.run(updateSql, updateParams);
           if (result.changes === 0) {
-            console.log(`[${ts()}] ⚠ send_reply: task ${in_reply_to?.slice(0, 8)} not found or already terminal`);
-            return false;
+            throw new Error(`reply_atomic_cas_failed:${in_reply_to}`);
           }
-          return true;
+          syncScheduledRunForTask(in_reply_to, effectiveNetId);
+          // #1548 —— 终态回复是最强的活性证据:一个还标着 blocked 的发送方在此回到 idle。
+          //   只出 blocked;working 可能真在忙别的任务,不碰。
+          releaseBlockedSession(from_session, effectiveNetId);
+          return { ok: true as const, replyLogged: true };
         }
-        return false;
+        return { ok: true as const, replyLogged: false };
       });
 
-      if (in_reply_to && !replyLogged) {
+      if (!replyOutcome.ok) {
+        const taskStatus = "taskStatus" in replyOutcome ? replyOutcome.taskStatus : undefined;
+        const messages: Record<string, string> = {
+          reply_task_not_found: `cannot apply reply: task not found (${in_reply_to})`,
+          reply_task_terminal: `cannot apply reply: task is already terminal (${taskStatus})`,
+          peer_reply_node_token_required: "atomic peer reply requires a node token",
+          peer_reply_unsupported: "recipient or caller does not support atomic peer replies",
+          peer_reply_origin_not_node: "original task sender is not a node; use send_reply",
+          reply_node_identity_unbound: "cannot apply reply: node identity is not token-bound",
+          reply_task_not_owned: "cannot apply reply: task is not owned by this node",
+          reply_target_mismatch: "cannot apply reply: target is not the original task sender",
+        };
         return {
           content: [{
             type: "text" as const,
             text: JSON.stringify({
               ok: false,
-              error: "reply_not_applied",
-              message: "reply was not applied to task",
+              error: replyOutcome.error,
+              message: messages[replyOutcome.error],
               in_reply_to,
+              ...(taskStatus ? { task_status: taskStatus } : {}),
               reply_queued: false,
             }),
           }],
         };
       }
+      const replyLogged = replyOutcome.replyLogged;
 
       // Log event after commit (outside transaction)
       if (replyLogged && in_reply_to) logTaskEvent(in_reply_to, null, replyStatus, from_session, text.slice(0, 200));
@@ -1120,16 +2191,71 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         }
       }
 
-      const session = scopedSessionStatus(alias, effectiveNetId);
-      pushEvent(alias, { type: "new_reply", from: from_session, message_id: id, in_reply_to, status: replyStatus }, effectiveNetId);
+      const session = scopedSessionStatus(replyTargetAlias, effectiveNetId);
+      pushEvent(replyTargetAlias, { type: "new_reply", inbox_count: pendingInboxCount(replyTargetAlias, effectiveNetId), from: from_session, message_id: id, in_reply_to, status: replyStatus }, effectiveNetId);
+      // #461 network observer summary — ids + routing only, no reply text.
+      pushNetworkObserverEvent(effectiveNetId, { type: "new_reply", task_id: in_reply_to ?? null, message_id: id, from: from_session, to: replyTargetAlias, status: replyStatus });
+
+      // #498 compatibility tripwire. Legacy send_reply is intentionally kept
+      // for old agents and Dashboard callers during rollout, but it is not the
+      // capability-negotiated atomic peer primitive. Warn only for an actual
+      // agent target; Dashboard hub/api replies remain quiet. New agents call
+      // send_peer_reply and never see this warning.
+      const targetIsAgent = replyTargetNodeId !== null
+        && replyTargetAlias !== "hub"
+        && replyTargetAlias !== "api";
+      const warning = !peerCapabilityRequired && targetIsAgent
+        ? `Target "${replyTargetAlias}" is an agent node. Legacy commhub_reply/send_reply terminalized the original task; upgraded peers should prefer commhub_send_peer_reply for capability-negotiated delivery. (RFC-030 mixed-version rollout.)`
+        : undefined;
+
+      // #507 — echo attachments READ BACK FROM DB (lead 2b5f6634): the point
+      // of the echo is to prove attachments actually landed in storage, not
+      // to reflect the in-memory variable we tried to write. Reading
+      // `attachmentsResult.attachments` here would still show `ok:true` +
+      // full echo if the UPDATE failed with `changes=0` (e.g. task moved to
+      // terminal between the pre-check and the transaction). SELECT from
+      // inbox.meta_json (always written, uses the id we just generated) so
+      // the echo means "these attachments are on disk now". Absent field
+      // when the caller sent no attachments — reverse-(e) invariant: a
+      // no-attachment call returns the exact same response shape as before
+      // this PR. Persisted-attachments field is only added when the caller
+      // actually asked for attachments.
+      let attachmentsSaved: unknown[] | null = null;
+      if (attachmentsResult.attachments.length > 0) {
+        const persistedRow = db.get<{ meta_json: string | null }>(
+          "SELECT meta_json FROM inbox WHERE id = ?1", [id]
+        );
+        const persistedMeta = parseMetaJson(persistedRow?.meta_json ?? null);
+        attachmentsSaved = persistedMeta && typeof persistedMeta === "object" && Array.isArray((persistedMeta as any).attachments)
+          ? (persistedMeta as any).attachments
+          : [];
+      }
 
       return {
         content: [{
           type: "text" as const,
-          text: JSON.stringify({ ok: true, message_id: id, session_status: session?.status ?? "unknown" }),
+          text: JSON.stringify({
+            ok: true,
+            message_id: id,
+            session_status: session?.status ?? "unknown",
+            ...(warning ? { warning } : {}),
+            ...(attachmentsSaved !== null ? { attachments_saved: attachmentsSaved } : {}),
+          }),
         }],
       };
-    }
+    };
+
+  server.tool(
+    "send_reply",
+    "Reply to a Dashboard/UI-originated task. Also serves as the terminal legacy fallback when atomic peer reply capability is unavailable.",
+    replyToolSchema,
+    (args) => handleReply(args, false),
+  );
+  server.tool(
+    "send_peer_reply",
+    "Atomically finalize one node-owned task and enqueue one no-response result when the exact recipient advertises peer_reply_inbox_capable. Stored capability survives transient SSE disconnects; legacy peers return peer_reply_unsupported with zero writes.",
+    replyToolSchema,
+    (args) => handleReply(args, true),
   );
 
   // ── V2: send_ack (不入 inbox，仅更新状态) ──
@@ -1139,9 +2265,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     {
       task_id: z.string().min(1).max(200).describe("Task ID to acknowledge"),
       from_session: z.string().max(200).optional(),
+      network_id: z.string().max(200).optional().describe("Network scope (auto-resolved for single-network user tokens)"),
     },
-    async ({ task_id, from_session: _fromIn }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
-      const effectiveNetId = getNetworkId(null);
+    async ({ task_id, from_session: _fromIn, network_id: netId }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
+      const effectiveNetId = getNetworkId(netId);
       if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId);
       console.log(`[${ts()}] ${from_session} → send_ack → task ${task_id.slice(0, 8)}`);
       const updateParams: any[] = [task_id];
@@ -1165,9 +2292,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     {
       task_id: z.string().min(1).max(200).describe("Task ID to retry"),
       from_session: z.string().max(200).optional(),
+      network_id: z.string().max(200).optional().describe("Network scope (auto-resolved for single-network user tokens)"),
     },
-    async ({ task_id, from_session: _fromIn }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
-      const effectiveNetId = getNetworkId(null);
+    async ({ task_id, from_session: _fromIn, network_id: netId }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
+      const effectiveNetId = getNetworkId(netId);
       if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId);
       console.log(`[${ts()}] ${from_session} → retry_task → ${task_id.slice(0, 8)}`);
       // Find the original task
@@ -1181,6 +2309,11 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (!["failed", "expired", "cancelled"].includes(task.status)) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: `task status is ${task.status}, not retryable` }) }] };
       }
+      // RFC-027 §2.3 inbox-enqueue lifecycle guard (PR1.1 site 4/6).
+      {
+        const lc = assertNodeActive(task.to_name, effectiveNetId ?? task.network_id ?? null);
+        if (!lc.ok) return { content: [{ type: "text" as const, text: JSON.stringify(lc) }] };
+      }
       db.transaction(() => {
         // Reset task status
         const updateParams: any[] = [task_id];
@@ -1188,17 +2321,19 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
            WHERE task_id = ?1`;
         updateSql = addScope(updateSql, updateParams, effectiveNetId);
         db.run(updateSql, updateParams);
+        syncScheduledRunForTask(task_id, effectiveNetId ?? task.network_id ?? null);
         // Re-queue in inbox with new ID (original ID may already exist)
         const retryInboxId = uuidv4();
         db.run(
-          `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, requires_response, network_id)
-           VALUES (?1, ?2, ?3, 'task', ?4, ?5, ?6, 'reply', ?7)`,
-          [retryInboxId, task.to_name, task.to_node_id ?? resolveNodeIdForAlias(task.to_name, effectiveNetId ?? task.network_id ?? null), task.priority, task.content, from_session, effectiveNetId ?? task.network_id ?? null]
+          `INSERT INTO inbox (id, task_id, session_name, node_id, type, priority, content, from_session, requires_response, network_id)
+           VALUES (?1, ?2, ?3, ?4, 'task', ?5, ?6, ?7, 'reply', ?8)`,
+          [retryInboxId, task_id, task.to_name, task.to_node_id ?? resolveNodeIdForAlias(task.to_name, effectiveNetId ?? task.network_id ?? null), task.priority, task.content, from_session, effectiveNetId ?? task.network_id ?? null]
         );
       });
       logTaskEvent(task_id, task.status, "delivered", from_session, "retry");
       // SSE push (unconditional — channel is keyed by alias, not network)
-      pushEvent(task.to_name, { type: "new_task", inbox_count: 1, priority: task.priority, from: from_session }, effectiveNetId ?? task.network_id ?? null);
+      pushEvent(task.to_name, { type: "new_task", inbox_count: pendingInboxCount(task.to_name, effectiveNetId ?? task.network_id ?? null), priority: task.priority, from: from_session }, effectiveNetId ?? task.network_id ?? null);
+      pushNetworkObserverEvent(effectiveNetId ?? task.network_id ?? null, { type: "new_task", task_id, from: from_session, to: task.to_name, status: "delivered", priority: task.priority });
       return {
         content: [{ type: "text" as const, text: JSON.stringify({ ok: true, task_id, retried_to: task.to_name }) }],
       };
@@ -1217,7 +2352,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       if (readScope.denied) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: readScope.denied }) }] };
       const params: any[] = [task_id];
       let sql = "SELECT * FROM tasks WHERE task_id = ?1";
-      sql = addReadScope(sql, params, readScope);
+      sql = addOwnTrafficScope(sql, params, readScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
       const task = db.get<any>(sql, ...params);
       return {
         content: [{
@@ -1238,33 +2373,88 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       from_name: z.string().max(200).optional().describe("Filter by sender"),
       from_node_id: z.string().max(200).optional().describe("Filter by immutable sender node_id"),
       network_id: z.string().max(200).optional().describe("Filter by network"),
+      before_created_at: z.string().max(64).optional().describe("Pagination cursor timestamp"),
+      before_task_id: z.string().max(200).optional().describe("Pagination cursor task id"),
+      durable_cursor: z.boolean().optional().describe("Require immutable node-scoped cursor protocol"),
+      durable_terminal_cursor: z.boolean().optional().describe("Read terminal outbound journal in monotonic order"),
+      after_terminal_seq: z.number().int().min(0).optional().describe("Exclusive terminal journal watermark"),
       limit: z.number().min(1).max(100).optional().default(20),
     },
-    async ({ alias, status, from_name, from_node_id, network_id: netId, limit }) => {
+    async ({ alias, status, from_name, from_node_id, network_id: netId, before_created_at, before_task_id, durable_cursor, durable_terminal_cursor, after_terminal_seq, limit }) => {
       const readScope = resolveReadScope(netId);
       if (readScope.denied) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: readScope.denied }) }] };
-      let sql = "SELECT task_id, from_node_id, from_name, to_node_id, to_name, priority, status, content, result, created_at, completed_at FROM tasks WHERE 1=1";
+      if (durable_cursor) {
+        if (!callerTokenIsNetwork) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "node_token_required" }) }] };
+        const boundNodeId = callerTokenId && enforceNetworkId
+          ? db.get<{ bound_node_id: string | null }>(
+              "SELECT bound_node_id FROM api_tokens WHERE token_id = ?1 AND network_id = ?2",
+              callerTokenId,
+              enforceNetworkId,
+            )?.bound_node_id ?? null
+          : null;
+        if (!boundNodeId || from_node_id !== boundNodeId) {
+          return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "from_node_id_identity_mismatch" }) }] };
+        }
+      }
+      if (durable_terminal_cursor) {
+        if (!durable_cursor) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "durable_cursor_required" }) }] };
+        const params: any[] = [enforceNetworkId, from_node_id, after_terminal_seq ?? 0, limit];
+        const tasks = db.all(
+          `SELECT t.task_id, t.from_node_id, t.from_name, t.to_node_id, t.to_name, t.priority,
+                  t.status, t.content, t.result, t.created_at, t.runtime_submitted_at,
+                  t.consumed_at, t.thread_id, t.turn_id, t.completed_at, e.terminal_seq
+             FROM task_terminal_events e
+             JOIN tasks t ON t.task_id = e.task_id
+            WHERE COALESCE(e.network_id, 'default') = COALESCE(?1, 'default')
+              AND e.from_node_id = ?2 AND e.terminal_seq > ?3
+            ORDER BY e.terminal_seq ASC LIMIT ?4`,
+          ...params,
+        );
+        return { content: [{ type: "text" as const, text: JSON.stringify({
+          ok: true,
+          capability: "list_tasks.immutable-terminal-sequence.v2",
+          tasks,
+          count: tasks.length,
+          next_terminal_seq: tasks.length ? tasks[tasks.length - 1]?.terminal_seq : (after_terminal_seq ?? 0),
+          has_more: tasks.length === limit,
+        }) }] };
+      }
+      let sql = "SELECT task_id, from_node_id, from_name, to_node_id, to_name, priority, status, content, result, created_at, runtime_submitted_at, consumed_at, thread_id, turn_id, completed_at FROM tasks WHERE 1=1";
       const params: any[] = [];
-      sql = addReadScope(sql, params, readScope);
+      sql = addOwnTrafficScope(sql, params, readScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
       if (alias) { sql += ` AND to_name = ?${params.length + 1}`; params.push(alias); }
       if (status) { sql += ` AND status = ?${params.length + 1}`; params.push(status); }
       if (from_name) { sql += ` AND from_name = ?${params.length + 1}`; params.push(from_name); }
       if (from_node_id) { sql += ` AND from_node_id = ?${params.length + 1}`; params.push(from_node_id); }
-      sql += ` ORDER BY created_at DESC LIMIT ?${params.length + 1}`;
+      if (before_created_at && before_task_id) {
+        sql += ` AND (created_at < ?${params.length + 1} OR (created_at = ?${params.length + 1} AND task_id < ?${params.length + 2}))`;
+        params.push(before_created_at, before_task_id);
+      }
+      sql += ` ORDER BY created_at DESC, task_id DESC LIMIT ?${params.length + 1}`;
       params.push(limit);
       const tasks = db.all(sql, ...params);
 
       // Stats
       const statsParams: any[] = [];
       let statsSql = "SELECT status, COUNT(*) as count FROM tasks WHERE 1=1";
-      statsSql = addReadScope(statsSql, statsParams, readScope);
+      statsSql = addOwnTrafficScope(statsSql, statsParams, readScope, { from: "from_name", to: "to_name", fromNodeId: "from_node_id", toNodeId: "to_node_id" });
       statsSql += " GROUP BY status";
       const stats = db.all(statsSql, ...statsParams);
 
       return {
         content: [{
           type: "text" as const,
-          text: JSON.stringify({ ok: true, tasks, count: tasks.length, stats }),
+          text: JSON.stringify({
+            ok: true,
+            ...(durable_cursor ? { capability: "list_tasks.immutable-node-cursor.v1" } : {}),
+            tasks,
+            count: tasks.length,
+            next_cursor: tasks.length === limit ? {
+              before_created_at: tasks[tasks.length - 1]?.created_at,
+              before_task_id: tasks[tasks.length - 1]?.task_id,
+            } : null,
+            stats,
+          }),
         }],
       };
     }
@@ -1278,24 +2468,29 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       task_id: z.string().min(1).max(200).describe("Task ID to cancel"),
       reason: z.string().max(1000).optional().describe("Cancellation reason"),
       from_session: z.string().max(200).optional(),
+      network_id: z.string().max(200).optional().describe("Network scope (auto-resolved for single-network user tokens)"),
     },
-    async ({ task_id, reason, from_session: _fromIn }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
-      const effectiveNetId = getNetworkId(null);
+    async ({ task_id, reason, from_session: _fromIn, network_id: netId }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
+      const effectiveNetId = getNetworkId(netId);
       if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId);
       console.log(`[${ts()}] ${from_session} → cancel_task → ${task_id.slice(0, 8)}`);
       const updateParams: any[] = [reason || "cancelled by " + from_session, task_id];
       let updateSql = `UPDATE tasks SET status = 'cancelled', result = ?1, completed_at = datetime('now')
          WHERE task_id = ?2 AND status IN ('created', 'delivered', 'acked', 'running')`;
       updateSql = addScope(updateSql, updateParams, effectiveNetId);
-      const result = db.run(updateSql, updateParams);
-      // Also ack the inbox entry to prevent agent from picking it up
-      if (result.changes > 0) {
-        const inboxParams: any[] = [task_id];
-        let inboxSql = "UPDATE inbox SET acked = 1 WHERE id = ?1 AND acked = 0";
-        inboxSql = addScope(inboxSql, inboxParams, effectiveNetId);
-        db.run(inboxSql, inboxParams);
-        logTaskEvent(task_id, null, "cancelled", from_session, reason || undefined);
-      }
+      const result = db.transaction(() => {
+        const updated = db.run(updateSql, updateParams);
+        // Also ack the inbox entry to prevent agent from picking it up.
+        if (updated.changes > 0) {
+          const inboxParams: any[] = [task_id];
+          let inboxSql = "UPDATE inbox SET acked = 1 WHERE COALESCE(task_id, id) = ?1 AND acked = 0";
+          inboxSql = addScope(inboxSql, inboxParams, effectiveNetId);
+          db.run(inboxSql, inboxParams);
+          syncScheduledRunForTask(task_id, effectiveNetId);
+        }
+        return updated;
+      });
+      if (result.changes > 0) logTaskEvent(task_id, null, "cancelled", from_session, reason || undefined);
       return {
         content: [{ type: "text" as const, text: JSON.stringify({ ok: result.changes > 0, task_id, cancelled: result.changes > 0 }) }],
       };
@@ -1310,9 +2505,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       task_id: z.string().min(1).max(200).describe("Task ID to reassign"),
       new_alias: z.string().min(1).max(200).describe("Target agent alias"),
       from_session: z.string().max(200).optional(),
+      network_id: z.string().max(200).optional().describe("Network scope (auto-resolved for single-network user tokens)"),
     },
-    async ({ task_id, new_alias, from_session: _fromIn }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
-      const effectiveNetId = getNetworkId(null);
+    async ({ task_id, new_alias, from_session: _fromIn, network_id: netId }) => { const fromMismatch = fromIdentityMismatchReply(_fromIn); if (fromMismatch) return fromMismatch; const from_session = defaultFrom(_fromIn);
+      const effectiveNetId = getNetworkId(netId);
       if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId);
       console.log(`[${ts()}] ${from_session} → reassign_task → ${task_id.slice(0, 8)} → ${new_alias}`);
       const taskParams: any[] = [task_id];
@@ -1328,10 +2524,15 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       const reassignedAlias = canonical.alias;
       const target = resolveDeliveryTarget(reassignedAlias, effectiveNetId ?? task.network_id ?? null);
       const newNodeId = target.state === "not_found" ? null : (target.session?.node_id ?? null);
+      // RFC-027 §2.3 inbox-enqueue lifecycle guard (PR1.1 site 5/6).
+      {
+        const lc = assertNodeActive(reassignedAlias, effectiveNetId ?? task.network_id ?? null);
+        if (!lc.ok) return { content: [{ type: "text" as const, text: JSON.stringify(lc) }] };
+      }
       db.transaction(() => {
         // Ack old inbox to prevent original agent from picking it up
         const inboxParams: any[] = [task_id];
-        let inboxSql = "UPDATE inbox SET acked = 1 WHERE id = ?1 AND acked = 0";
+        let inboxSql = "UPDATE inbox SET acked = 1 WHERE COALESCE(task_id, id) = ?1 AND acked = 0";
         inboxSql = addScope(inboxSql, inboxParams, effectiveNetId);
         db.run(inboxSql, inboxParams);
 
@@ -1341,15 +2542,179 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         db.run(updateSql, updateParams);
 
         const newInboxId = uuidv4();
-        db.run("INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, requires_response, network_id) VALUES (?1, ?2, ?3, 'task', ?4, ?5, ?6, 'reply', ?7)",
-          [newInboxId, reassignedAlias, newNodeId, task.priority, task.content, from_session, effectiveNetId ?? task.network_id ?? null]);
+        db.run("INSERT INTO inbox (id, task_id, session_name, node_id, type, priority, content, from_session, requires_response, network_id) VALUES (?1, ?2, ?3, ?4, 'task', ?5, ?6, ?7, 'reply', ?8)",
+          [newInboxId, task_id, reassignedAlias, newNodeId, task.priority, task.content, from_session, effectiveNetId ?? task.network_id ?? null]);
       });
       logTaskEvent(task_id, task.status, "delivered", from_session, `reassign: ${oldAlias} → ${reassignedAlias}`);
-      pushEvent(reassignedAlias, { type: "new_task", inbox_count: 1, priority: task.priority, from: from_session, ...(canonical.renamed ? { renamed_from: new_alias } : {}) }, effectiveNetId ?? task.network_id ?? null);
+      pushEvent(reassignedAlias, { type: "new_task", inbox_count: pendingInboxCount(reassignedAlias, effectiveNetId ?? task.network_id ?? null), priority: task.priority, from: from_session, ...(canonical.renamed ? { renamed_from: new_alias } : {}) }, effectiveNetId ?? task.network_id ?? null);
+      pushNetworkObserverEvent(effectiveNetId ?? task.network_id ?? null, { type: "new_task", task_id, from: from_session, to: reassignedAlias, status: "delivered", priority: task.priority });
       return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, task_id, reassigned_from: oldAlias, reassigned_to: reassignedAlias, ...(canonical.renamed ? { renamed_from: new_alias, renamed_to: reassignedAlias } : {}) }) }] };
     }
   );
 
+  server.tool(
+    "send_desktop_message",
+    "Push a message to a user's active Desktop/web clients in one network. Targets user identity, not node alias.",
+    {
+      to_user_id: z.string().min(1).max(200).optional().describe("Target user_id. Mutually checked with to_username when both are supplied."),
+      to_username: z.string().min(1).max(50).optional().describe("Target username. Mutually checked with to_user_id when both are supplied."),
+      title: z.string().max(200).optional(),
+      message: z.string().min(1).max(10000),
+      severity: z.enum(["info", "success", "warning", "error"]).optional().default("info"),
+      kind: z.string().min(1).max(80).optional().default("agent_message"),
+      meta: z.record(z.string(), z.unknown()).optional(),
+      from_session: z.string().max(200).optional(),
+      network_id: z.string().max(200).optional().describe("Network scope (auto-resolved for single-network user tokens; ntok stays bound to its network)."),
+    },
+    async ({ to_user_id, to_username, title, message, severity, kind, meta, from_session: _fromIn, network_id: netId }) => {
+      const fromMismatch = fromIdentityMismatchReply(_fromIn);
+      if (fromMismatch) return fromMismatch;
+      const from_session = defaultFrom(_fromIn);
+      const effectiveNetId = getNetworkId(netId);
+      // 人类 ↔ 人类私信:受限成员也能发(canWriteHuman 不看 Agent 授权),但发件人固定为自己的用户名。
+      if (!canWriteHuman(effectiveNetId)) return writeDeniedReply(effectiveNetId, "write");
+      if (effectiveNetId && restrictedNets.includes(effectiveNetId) && _fromIn?.trim() && _fromIn.trim() !== callerAlias) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "from_session_identity_mismatch", message: "restricted members always send as their own username" }) }] };
+      }
+      if (!effectiveNetId) return writeDeniedReply(effectiveNetId, "write");
+
+      if (!to_user_id && !to_username) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "desktop_target_required", message: "to_user_id or to_username is required" }) }] };
+      }
+
+      const byId = to_user_id
+        ? db.get<{ user_id: string; username: string }>("SELECT user_id, username FROM users WHERE user_id = ?1", to_user_id)
+        : null;
+      const byName = to_username
+        ? db.get<{ user_id: string; username: string }>("SELECT user_id, username FROM users WHERE username = ?1", to_username)
+        : null;
+
+      if (to_user_id && !byId) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "desktop_target_not_found", field: "to_user_id" }) }] };
+      }
+      if (to_username && !byName) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "desktop_target_not_found", field: "to_username" }) }] };
+      }
+      if (byId && byName && byId.user_id !== byName.user_id) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "desktop_target_mismatch", to_user_id, to_username }) }] };
+      }
+
+      const target = byId ?? byName;
+      if (!target) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "desktop_target_not_found" }) }] };
+      }
+
+      const targetRole = getUserNetworkRole(target.user_id, effectiveNetId);
+      if (!targetRole) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "desktop_target_not_in_network", network_id: effectiveNetId }) }] };
+      }
+
+      const messageId = `dm_${uuidv4()}`;
+      const event = {
+        type: "desktop_message",
+        message_id: messageId,
+        kind,
+        from: from_session,
+        title: title || null,
+        message,
+        severity,
+        created_at: new Date().toISOString(),
+        ...(meta && Object.keys(meta).length ? { meta } : {}),
+      };
+
+      // #1459 ① P2 —— 审计与收件持久化必须同生共死：只落其中一半，就会出现
+      // 「审计说发过、而用户永远收不到」或者反过来。放进同一个事务。
+      db.transaction(() => {
+        db.run(
+          `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+           VALUES (?1, ?2, 'send_desktop_message', 'user', ?3, ?4, ?5)`,
+          [
+            enforceUserId || null,
+            callerAlias || null,
+            target.user_id,
+            JSON.stringify({
+              message_id: messageId,
+              to_username: target.username,
+              from: from_session,
+              severity,
+              kind,
+              title: title || null,
+              meta_keys: meta && typeof meta === "object" ? Object.keys(meta) : [],
+            }),
+            effectiveNetId,
+          ],
+        );
+        // 🔴 `ON CONFLICT(message_id) DO NOTHING`，而不是 `INSERT OR IGNORE`：
+        //   两者对"重投同一个 message_id"效果相同（幂等，不产生重复消息），
+        //   但 OR IGNORE 会**连同其它约束错误一起吞掉** —— 我在实现本段时就
+        //   撞上了：`kind` 为 NULL 触发 NOT NULL，OR IGNORE 静默丢弃整行，
+        //   而工具照样返回 `persisted: true`。**一条消息凭空消失且报告成功**，
+        //   正是本 issue 要消灭的那个形状。
+        //   DO NOTHING 只针对主键冲突，别的约束照常抛出、事务回滚。
+        //
+        //   另：普通 INSERT 会让重试抛主键冲突（无害重试变 500）；
+        //   OR REPLACE 会覆盖旧行、把用户已 ack 的状态冲掉。都不取。
+        db.run(
+          `INSERT INTO user_inbox
+             (message_id, network_id, user_id, from_session, kind, title, content, severity, meta_json, sender_user_id)
+           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)
+           ON CONFLICT(message_id) DO NOTHING`,
+          [
+            messageId,
+            effectiveNetId ?? null,
+            target.user_id,
+            from_session,
+            // 🔴 不依赖 zod 的 .default()：直接调用 handler 的调用方（测试、
+            //    未来的内部调用）拿不到 zod 默认值，会把 NULL 写进 NOT NULL 列。
+            //    列上虽有 DEFAULT，但**显式传 NULL 会覆盖列默认值**。
+            kind ?? "agent_message",
+            title || null,
+            message,
+            severity ?? "info",
+            // 存储侧走与 inbox 一致的跨主机脱敏；读取侧另有一道 token 形状
+            // 脱敏（规格 ③ redact-at-read），两层分别防不同的东西。
+            meta && typeof meta === "object" ? normalizeMetaJson(meta) : null,
+            // 多用户私信:只有人(用户令牌)发的才记发信人 user_id;节点令牌发的是 Agent 消息。
+            !callerTokenIsNetwork && enforceUserId ? enforceUserId : null,
+          ],
+        );
+      });
+      // #1459 / #1563 — pushUserEvent 在没有订阅者时静默 return。
+      // 🔴 这段注释原先写「本工具既不写 inbox、也没有 user 级回读路径 ⇒ dashboard
+      //    关着时消息永久没了」。**那半句已经不成立** —— 上面 20 行就在
+      //    `INSERT INTO user_inbox`，且 `/api/messages?scope=user` 能回读
+      //    （desktop-message-seam.test.ts 有真实 send → 真实 GET 的端到端断言）。
+      //    留着它会把 debug 未读数的人直接带向错误的一层。
+      //
+      // 这里先把**丢失变可见**：`ok` 仍表示「请求被接受、审计已落库」，
+      // 新增 `delivered` 表示「此刻真的有人收到」。判据取自订阅者注册表，
+      // 不是猜的。持久化 + 重连补投是另一条（按 user_id 寻址的新收件表，#1459）。
+      //
+      // 🔴 `reason` 报的是**观测到的事实**（此刻没有活订阅者），不是它的后果。
+      //    今天「没有活订阅者」确实等于「丢了」，但持久化落地之后同一个事实会
+      //    变成「已入库、等重连补投」。把值取成 no_live_subscriber 而不是
+      //    "lost"/"dropped"，就是为了那天不用改写历史含义 —— 届时按需细分
+      //    （如 lost vs queued）即可，现在不预先把语义焊死。
+      // 🔴 push 必须在事务**提交之后**：放进事务里的话，活订阅者可能先收到
+      //    事件、而行还没提交；一旦回滚，用户就看到了一条数据库里不存在的消息。
+      const delivered = hasUserSubscribers(effectiveNetId, target.user_id);
+      pushUserEvent(effectiveNetId, target.user_id, event);
+
+      return { content: [{ type: "text" as const, text: JSON.stringify({
+        ok: true,
+        message_id: messageId,
+        delivered,
+        // #1459 ① P2 —— 有了持久化之后，「此刻没人在听」不再等于「丢了」。
+        // `delivered` 说的是实时投递、`persisted` 说的是它已经入库等重连补投。
+        // `reason` 仍报**观测到的事实**而不是它的后果，所以这个中间态没有说错话。
+        persisted: true,
+        ...(delivered ? {} : { reason: "no_live_subscriber" }),
+        delivered_to_user_id: target.user_id,
+        network_id: effectiveNetId,
+      }) }] };
+    },
+  );
+
   server.tool(
     "broadcast",
     "Send a message to multiple sessions.",
@@ -1371,26 +2736,39 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
       const targets = db.all<{ alias: string; node_id: string | null; network_id: string | null }>(sql, ...params);
       const ids: string[] = [];
+      // #1440 ① — the push loop must walk the recipients that actually
+      // got an inbox row, not every candidate target. Walking `targets`
+      // announced a broadcast to nodes the lifecycle guard had just
+      // skipped, i.e. nodes with nothing to fetch.
+      const delivered: Array<{ alias: string; netId: string | null }> = [];
 
       for (const t of targets) {
+        // RFC-027 §2.3 inbox-enqueue lifecycle guard (PR1.1 site 6/6).
+        // Broadcast skips non-active recipients silently rather than
+        // failing the entire send — broadcast semantics are best-effort
+        // per-recipient and a stopped node simply gets nothing.
+        const netId = effectiveNetId ?? t.network_id ?? null;
+        const lc = assertNodeActive(t.alias, netId);
+        if (!lc.ok) continue;
         const id = uuidv4();
         db.run(
           `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, network_id)
            VALUES (?1, ?2, ?3, 'broadcast', 'normal', ?4, 'hub', ?5)`,
-          [id, t.alias, t.node_id ?? null, message, effectiveNetId ?? t.network_id ?? null]
+          [id, t.alias, t.node_id ?? null, message, netId]
         );
         ids.push(id);
+        delivered.push({ alias: t.alias, netId });
       }
 
-      for (const t of targets) {
-        pushEvent(t.alias, { type: "broadcast", inbox_count: 1 }, effectiveNetId ?? t.network_id ?? null);
+      for (const d of delivered) {
+        pushEvent(d.alias, { type: "broadcast", inbox_count: pendingInboxCount(d.alias, d.netId) }, d.netId);
       }
 
       return {
         content: [
           {
             type: "text" as const,
-            text: JSON.stringify({ ok: true, recipients: targets.length, message_ids: ids }),
+            text: JSON.stringify({ ok: true, recipients: ids.length, message_ids: ids }),
           },
         ],
       };
@@ -1483,15 +2861,34 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     "update_node_config",
     "Set the desired per-node config (model + flags) and push a doorbell to the node. The node pulls + validates + applies (hot or restart per field tier). RFC-024.",
     {
-      node_id: z.string().min(1).max(200).describe("Target node ID (not alias). Must be in caller's network."),
+      ...NODE_ID_ALIAS_FIELDS,
       base_revision: z.number().int().min(0).describe("Current revision per the dashboard's last GET — 409 if hub's current revision differs."),
       patch: z.object({
         model: z.string().max(200).optional(),
-        flags: z.record(z.unknown()).optional(),
+        flags: z.record(z.string(), z.unknown()).optional(),
+        // #260 P5 — channel enable/disable. Restart-tier field (agent-node
+        // reads config.channels once at boot to fork per-channel workers,
+        // so the swap takes effect via process restart). Not
+        // SECURITY_SENSITIVE — this is a lifecycle op, gated by SEC-1
+        // (network scope) only.
+        //
+        // Deliberately `z.array(z.unknown()).max(16)` (mirrors flags's
+        // `z.record(z.string(), z.unknown())`): trust nothing at the wire boundary,
+        // narrow the same way `narrowChannelsPatch` narrows raw untrusted
+        // JSON (typeof + allowlist + dedup + case-fold). A strict
+        // `z.array(z.string())` would fail-fast on a single non-string
+        // entry, but the wire contract wants junk silently dropped so a
+        // dashboard fat-finger doesn't turn into a 400 the user has to
+        // interpret. validatePatch then re-rejects if the caller bypassed
+        // narrowing.
+        channels: z.array(z.unknown()).max(16).optional(),
       }).describe("Fields to update. Empty patch → no-op (use restart_node for that)."),
       network_id: z.string().max(200).optional(),
     },
-    async ({ node_id: nodeId, base_revision: baseRev, patch, network_id: clientNetId }) => {
+    async ({ node_id, child_node_id, base_revision: baseRev, patch, network_id: clientNetId }) => {
+      const idArg = resolveNodeIdArg({ node_id, child_node_id });
+      if (!idArg.ok) return { content: [{ type: "text" as const, text: JSON.stringify(idArg) }] };
+      const nodeId = idArg.node_id;
       const effectiveNetId = getNetworkId(clientNetId);
       if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, "write");
 
@@ -1505,6 +2902,50 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
       const model = typeof patch.model === "string" ? patch.model : undefined;
       const flags = (patch.flags && typeof patch.flags === "object") ? patch.flags as Record<string, unknown> : {};
+      // Narrow untrusted `channels` at the boundary (typeof + allowlist +
+      // dedup + case-fold), and distinguish two very different cases
+      // that both narrow to `[]`:
+      //   (a) `patch.channels === []` (explicit "disable all editable
+      //       channels"). Downstream must proceed and write channels=[]
+      //       so the node's next restart forks no workers.
+      //   (b) `patch.channels === ["commhub"]` or similar — the caller
+      //       sent items but every single one was invalid (dashboard PR
+      //       #31 still ships commhub, and a typo like "telegarm" would
+      //       hit the same path). Downstream MUST NOT treat this as
+      //       (a) — silently converting to disable-all would nuke the
+      //       user's existing telegram/feishu workers.
+      //
+      // The reject error is `channels_all_invalid` so the dashboard
+      // can surface the mismatch instead of showing a false success.
+      let channels: string[] | undefined = undefined;
+      if (patch.channels !== undefined) {
+        if (!Array.isArray(patch.channels)) {
+          // Zod already permits arrays only; belt+braces if it drifts.
+          return {
+            content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "invalid_patch", field: "channels", reason: "must be an array" }) }],
+          };
+        }
+        const narrowed = narrowChannelsPatch(patch.channels) ?? [];
+        if (patch.channels.length === 0) {
+          channels = []; // (a) explicit disable-all
+        } else if (narrowed.length === 0) {
+          // (b) every entry was invalid — refuse to write. Distinct
+          // error so the dashboard can surface the failure.
+          return {
+            content: [{
+              type: "text" as const,
+              text: JSON.stringify({
+                ok: false,
+                error: "channels_all_invalid",
+                requested: patch.channels,
+                message: "every requested channel is unknown or unsupported; use an explicit empty array to disable-all",
+              }),
+            }],
+          };
+        } else {
+          channels = narrowed;
+        }
+      }
 
       // SEC-2 (final policy 2026-06-28) — security-sensitive flags
       // (permissionMode / dangerouslySkipPermissions / teammateMode)
@@ -1531,7 +2972,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         };
       }
 
-      const validationFail = validatePatch(model, flags);
+      const validationFail = validatePatch(model, flags, channels);
       if (validationFail) {
         return {
           content: [{
@@ -1609,8 +3050,12 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 
       // Compute apply_mode + persist + push doorbell.
       const updateId = `cu_${uuidv4()}`;
-      const applyMode = computeApplyMode(model, flags);
-      const patchJson = JSON.stringify({ ...(model !== undefined ? { model } : {}), flags });
+      const applyMode = computeApplyMode(model, flags, channels);
+      const patchJson = JSON.stringify({
+        ...(model !== undefined ? { model } : {}),
+        flags,
+        ...(channels !== undefined ? { channels } : {}),
+      });
       const networkId = node.network_id || "default";
       db.run(
         `INSERT INTO node_config_updates (update_id, node_id, network_id, patch_json, apply_mode, base_revision, status, created_at, created_by_token) VALUES (?1, ?2, ?3, ?4, ?5, ?6, 'pending', ?7, ?8)`,
@@ -1628,6 +3073,51 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
 
+  // One alias can own several `nodes` rows in a network: re-creating a node
+  // under the same alias leaves the old row behind, and `db.get` on
+  // `WHERE alias = ? AND network_id = ?` then returns whichever row SQLite
+  // happens to yield first. A field report showed the result: the client
+  // queued a rules-file read for the live node, the node pulled with its own
+  // token, the hub resolved its alias to the stale row, found nothing pending
+  // and returned `request: null` until the read timed out.
+  //
+  // resolveNodeByAlias: prefer the row the alias's session points at (sessions
+  // are UNIQUE per network+alias and carry the node_id that last reported),
+  // then the newest row. Used where only an alias is known (a client targeting
+  // by alias; unbound legacy node tokens).
+  const resolveNodeByAlias = (alias: string, networkId: string) =>
+    db.get<{ node_id: string; alias: string; network_id: string | null }>(
+      `SELECT n.node_id, n.alias, n.network_id FROM nodes n
+         LEFT JOIN sessions s ON s.alias = n.alias AND s.network_id = n.network_id AND s.node_id = n.node_id
+        WHERE n.alias = ?1 AND n.network_id = ?2
+        ORDER BY (s.node_id IS NOT NULL) DESC, n.created_at DESC, n.rowid DESC
+        LIMIT 1`,
+      alias,
+      networkId,
+    ) ?? null;
+  // resolveCallerNode: the node a network token pulls/acks for. A token bound
+  // to a node resolves to exactly that node (and never to another row that
+  // shares its alias); only unbound legacy tokens fall back to the alias.
+  // Callers have already required callerTokenIsNetwork + enforceNetworkId +
+  // callerAlias.
+  const resolveCallerNode = (): { node_id: string; network_id: string | null } | null => {
+    const bound = callerTokenId
+      ? db.get<{ bound_node_id: string | null }>(
+          "SELECT bound_node_id FROM api_tokens WHERE token_id = ?1 AND network_id = ?2",
+          callerTokenId,
+          enforceNetworkId,
+        )?.bound_node_id ?? null
+      : null;
+    if (bound) {
+      return db.get<{ node_id: string; network_id: string | null }>(
+        "SELECT node_id, network_id FROM nodes WHERE node_id = ?1 AND network_id = ?2",
+        bound,
+        enforceNetworkId,
+      ) ?? null;
+    }
+    return resolveNodeByAlias(callerAlias!, enforceNetworkId!);
+  };
+
   server.tool(
     "get_config_update",
     "Node pulls its pending config update (called from agent-node when SSE config_update doorbell arrives). RFC-024.",
@@ -1651,11 +3141,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // Unconditional network_id filter (was previously conditional on
       // enforceNetworkId being set; the new ntok guard above guarantees
       // it's non-null so the filter is always applied).
-      const node = db.get<any>(
-        "SELECT node_id, network_id FROM nodes WHERE alias = ?1 AND network_id = ?2",
-        callerAlias,
-        enforceNetworkId,
-      );
+      const node = resolveCallerNode();
       if (!node) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, update: null }) }] };
       }
@@ -1708,11 +3194,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // Cross-tenant guard: the ack-er must own the update being acked.
       // Resolve node by caller's alias under the enforced network.
       // Network filter is unconditional (guard above guarantees non-null).
-      const node = db.get<any>(
-        "SELECT node_id FROM nodes WHERE alias = ?1 AND network_id = ?2",
-        callerAlias,
-        enforceNetworkId,
-      );
+      const node = resolveCallerNode();
       if (!node) {
         // Silently ignore stale ack — return ok so the node doesn't retry forever.
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, ignored: "alias_unknown" }) }] };
@@ -1748,14 +3230,455 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
 
+  // ── app#225 — 节点规则文件（AGENTS.md / CLAUDE.md）远程读写 ──
+  //
+  // 形状照抄 RFC-024 config-apply：客户端调 read_node_rules_file /
+  // write_node_rules_file 落一行 node_rules_requests + 门铃 {type:"rules_file"}；
+  // 节点收到门铃后 get_rules_file_request 拉（和 get_config_update 同一道
+  // F-A 闸：网络 token + alias），做完 ack_rules_file_request 回报；客户端
+  // 轮询 get_rules_file_result。
+  //
+  // 🔴 安全（#225 验收第 5 条）：整条链路**没有路径参数**。文件名由节点按
+  // 自己的 RUNTIME 决定（claude → CLAUDE.md，其余 → AGENTS.md），目录固定是
+  // 节点进程的 cwd（agent-node/src/runtime/rules-file.ts）。hub 只传 op +
+  // content，客户端连文件名都指定不了，所以不存在「借路径参数写任意文件」。
+  // 读和写都要 canWrite：规则文件是节点行为的一部分，读它等于读节点配置。
+  const RULES_FILE_MAX_BYTES = 256 * 1024;
+  const RULES_REQUEST_STALE_MS = 60_000;
+
+  // Node skills view — skills_list / skill_read ride the same queue + doorbell.
+  // `content` carries the skill NAME for skill_read (never a path; the node
+  // validates it again against [A-Za-z0-9._-] and resolves it under its own
+  // runtime's skills roots — node-skills.ts).
+  const SKILL_NAME_RE = /^[A-Za-z0-9._-]{1,64}$/;
+  const isSkillsOp = (op: string) => op === "skills_list" || op === "skill_read";
+
+  // Project folder view — files_list / file_read ride the same queue + doorbell.
+  // `content` carries a path RELATIVE to the node's work dir. The hub refuses
+  // absolute paths, `..` segments, backslashes and NUL before any row exists;
+  // the node re-validates, realpath-contains the result in its work dir and
+  // refuses secret-looking files (node-files.ts). Stricter than skills on the
+  // caller: a node token may not browse another node's disk, and only the token
+  // that asked can read the answer.
+  const NODE_FILE_PATH_MAX = 1024;
+  const NODE_FILES_RESULT_MAX_CHARS = 1024 * 1024;
+  const isFilesOp = (op: string) => op === "files_list" || op === "file_read";
+  const normalizeNodeRelPath = (raw: unknown): string | null => {
+    if (raw === undefined || raw === null) return "";
+    if (typeof raw !== "string" || raw.length > NODE_FILE_PATH_MAX) return null;
+    if (raw.includes("\0") || raw.includes("\\")) return null;
+    if (raw.startsWith("/") || raw.startsWith("~") || /^[A-Za-z]:/.test(raw)) return null;
+    const segs = raw.split("/").filter((s) => s !== "" && s !== ".");
+    if (segs.some((s) => s === "..")) return null;
+    return segs.join("/");
+  };
+
+  // Node run-log view — logs_tail rides the same queue + doorbell. `content`
+  // carries the filter parameters as JSON (lines / level / grep / since_ts) and
+  // never a path: the node reads only its own log directory and redacts before
+  // it answers (agent-node/src/runtime/node-logs.ts). Stricter than the project
+  // folder on the caller: user login only, and only the node's owner or a
+  // network owner/admin — a member who may chat with a node does not get to read
+  // its process log. Log bytes are purged on the first terminal read (see
+  // get_rules_file_result) and by the retention sweep after LOGS_CONTENT_TTL_MS.
+  const isLogsOp = (op: string) => op === "logs_tail";
+  const LOGS_MAX_LINES = 2000;
+  const LOGS_GREP_MAX = 200;
+  const logsParamsJson = (p: { lines?: number; level?: string; grep?: string; since_ts?: number }): string =>
+    JSON.stringify({
+      lines: Math.min(Math.max(Math.floor(p.lines ?? 500), 1), LOGS_MAX_LINES),
+      ...(p.level ? { level: p.level } : {}),
+      ...(p.grep ? { grep: p.grep.slice(0, LOGS_GREP_MAX) } : {}),
+      ...(typeof p.since_ts === "number" && p.since_ts > 0 ? { since_ts: p.since_ts } : {}),
+    });
+  // Owner of the node row, or owner/admin of the network. Legacy open mode (no
+  // user identity on the connection) keeps canWrite's allow-all semantics.
+  const canReadNodeLogs = (nodeId: string, networkId: string): boolean => {
+    if (!enforceUserId) return true;
+    const role = getUserNetworkRole(enforceUserId, networkId);
+    if (role === "owner" || role === "admin") return true;
+    if (nodeId.startsWith("session:")) return false;
+    const row = db.get<{ owner_user_id: string | null }>("SELECT owner_user_id FROM nodes WHERE node_id = ?1", nodeId);
+    return !!row?.owner_user_id && row.owner_user_id === enforceUserId;
+  };
+
+  const enqueueRulesFileRequest = (
+    op: "read" | "write" | "skills_list" | "skill_read" | "files_list" | "file_read" | "logs_tail",
+    a: { node_id?: string; child_node_id?: string; alias?: string; network_id?: string; content?: string },
+  ) => {
+    const effectiveNetId = getNetworkId(a.network_id);
+    if (isLogsOp(op) && callerTokenIsNetwork) {
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "node_token_cannot_read_logs", message: "a node token cannot read another node's run log; use a user login" }) }] };
+    }
+    if (isFilesOp(op)) {
+      if (callerTokenIsNetwork) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "node_token_cannot_browse_files", message: "a node token cannot browse another node's project folder; use a user login" }) }] };
+      }
+      if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, `${op} node files`);
+      const rel = normalizeNodeRelPath(a.content);
+      if (rel === null || (op === "file_read" && rel === "")) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "invalid_path", reason: "path must be relative to the node work dir: no leading / or ~, no .. segment, no backslash or NUL, at most 1024 chars" }) }] };
+      }
+      a = { ...a, content: rel };
+    }
+    if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, isLogsOp(op) ? "read node logs" : isSkillsOp(op) ? `${op} node skills` : `${op} rules file`);
+    if (op === "skill_read" && (typeof a.content !== "string" || !SKILL_NAME_RE.test(a.content) || a.content === "." || a.content === "..")) {
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "invalid_skill_name", reason: "name must match [A-Za-z0-9._-]{1,64} and not be . or .." }) }] };
+    }
+
+    // Target: a `nodes` row by node_id (original path), or — app#225 follow-up —
+    // an alias. An alias resolves to its `nodes` row when there is one; otherwise
+    // to a live session in the caller's network that advertised
+    // rules_file_capable (claude-code sessions mostly have no `nodes` row). The
+    // queue key for such a session is `session:<alias>`, network-scoped.
+    let node: { node_id: string; alias: string; network_id: string | null } | null = null;
+    if (a.node_id || a.child_node_id || !a.alias) {
+      const idArg = resolveNodeIdArg({ node_id: a.node_id, child_node_id: a.child_node_id });
+      if (!idArg.ok) return { content: [{ type: "text" as const, text: JSON.stringify(idArg) }] };
+      const nodeId = idArg.node_id;
+      const resolved = resolveTargetNode(nodeId, effectiveNetId);
+      if (!resolved.row) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "node_not_found", node_id: nodeId }) }] };
+      }
+      if (!resolved.sec1Ok) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "cross_network_node", message: "node belongs to another network" }) }] };
+      }
+      node = resolved.row as any;
+    } else {
+      const scopeNet = effectiveNetId || "default";
+      const byAlias = resolveNodeByAlias(a.alias, scopeNet);
+      if (byAlias) {
+        node = byAlias;
+      } else {
+        const session = db.get<{ alias: string; network_id: string | null }>(
+          isLogsOp(op)
+            ? "SELECT alias, network_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND logs_capable = 1 ORDER BY updated_at DESC LIMIT 1"
+            : isFilesOp(op)
+            ? "SELECT alias, network_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND files_capable = 1 ORDER BY updated_at DESC LIMIT 1"
+            : isSkillsOp(op)
+            ? "SELECT alias, network_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND skills_capable = 1 ORDER BY updated_at DESC LIMIT 1"
+            : "SELECT alias, network_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND rules_file_capable = 1 ORDER BY updated_at DESC LIMIT 1",
+          a.alias,
+          scopeNet,
+        );
+        if (!session) {
+          if (isLogsOp(op)) {
+            return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "logs_target_not_found", alias: a.alias, message: "no node with this alias in the network, and no session with this alias that can serve its run log (its agent-node may be too old)" }) }] };
+          }
+          if (isFilesOp(op)) {
+            return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "files_target_not_found", alias: a.alias, message: "no node with this alias in the network, and no session with this alias that can serve its project folder (its channel server may be too old)" }) }] };
+          }
+          return isSkillsOp(op)
+            ? { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "skills_target_not_found", alias: a.alias, message: "no node with this alias in the network, and no session with this alias that can serve its skills (its channel server may be too old)" }) }] }
+            : { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "rules_file_target_not_found", alias: a.alias, message: "no node with this alias in the network, and no session with this alias that can serve rules files (its channel server may be too old)" }) }] };
+        }
+        node = { node_id: `session:${session.alias}`, alias: session.alias, network_id: session.network_id };
+      }
+    }
+    const nodeId = node.node_id;
+    if (isLogsOp(op) && !canReadNodeLogs(nodeId, node.network_id || "default")) {
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "logs_permission_denied", message: "only the node's owner or a network owner/admin can read its run log" }) }] };
+    }
+    if (op === "write") {
+      if (typeof a.content !== "string") {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "invalid_content", reason: "content must be a string" }) }] };
+      }
+      const bytes = Buffer.byteLength(a.content, "utf8");
+      if (bytes > RULES_FILE_MAX_BYTES) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "content_too_large", bytes, max_bytes: RULES_FILE_MAX_BYTES }) }] };
+      }
+    }
+
+    // 单飞 + 陈旧回收，同 update_node_config 的 F-B：节点掉线时旧行永远
+    // 非终态，不回收就把这个节点锁死。
+    // Separate single-flight lanes: the client opens the rules file and the
+    // skills list together; one must not block the other.
+    const inFlight = db.get<{ request_id: string; created_at: number; pulled_at: number | null }>(
+      isLogsOp(op)
+        ? "SELECT request_id, created_at, pulled_at FROM node_rules_requests WHERE node_id = ?1 AND status IN ('pending', 'in_progress') AND op = 'logs_tail' ORDER BY created_at DESC LIMIT 1"
+        : isFilesOp(op)
+        ? "SELECT request_id, created_at, pulled_at FROM node_rules_requests WHERE node_id = ?1 AND status IN ('pending', 'in_progress') AND op IN ('files_list', 'file_read') ORDER BY created_at DESC LIMIT 1"
+        : isSkillsOp(op)
+        ? "SELECT request_id, created_at, pulled_at FROM node_rules_requests WHERE node_id = ?1 AND status IN ('pending', 'in_progress') AND op IN ('skills_list', 'skill_read') ORDER BY created_at DESC LIMIT 1"
+        : "SELECT request_id, created_at, pulled_at FROM node_rules_requests WHERE node_id = ?1 AND status IN ('pending', 'in_progress') AND op IN ('read', 'write') ORDER BY created_at DESC LIMIT 1",
+      nodeId,
+    );
+    if (inFlight) {
+      const age = Date.now() - (inFlight.pulled_at ?? inFlight.created_at);
+      if (age <= RULES_REQUEST_STALE_MS) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "request_in_flight", existing_request_id: inFlight.request_id, age_ms: age }) }] };
+      }
+      db.run(
+        "UPDATE node_rules_requests SET status = 'timeout', acked_at = ?1, error = ?2 WHERE request_id = ?3",
+        [Date.now(), `superseded after ${age}ms (> ${RULES_REQUEST_STALE_MS}ms) — node did not answer`, inFlight.request_id],
+      );
+    }
+
+    // Opportunistic content retention (bounded, indexed) — node-request-retention.ts.
+    sweepNodeRequestContent();
+    const requestId = `rf_${uuidv4()}`;
+    const networkId = node.network_id || "default";
+    db.run(
+      `INSERT INTO node_rules_requests (request_id, node_id, network_id, op, content, status, created_at, created_by_token) VALUES (?1, ?2, ?3, ?4, ?5, 'pending', ?6, ?7)`,
+      [requestId, nodeId, networkId, op, op === "write" || op === "skill_read" || isFilesOp(op) || isLogsOp(op) ? a.content! : null, Date.now(), callerTokenId || "unknown"],
+    );
+    pushEvent(node.alias, { type: "rules_file", request_id: requestId }, networkId);
+    return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, request_id: requestId, op }) }] };
+  };
+
+  server.tool(
+    "read_node_rules_file",
+    "Ask a node to send back its rules file (CLAUDE.md for claude nodes, AGENTS.md otherwise) from its working directory. No path argument by design. Poll get_rules_file_result with the returned request_id. app#225.",
+    {
+      ...NODE_ID_ALIAS_FIELDS,
+      alias: z.string().min(1).max(200).optional().describe("Target by alias instead of node_id — resolves to the node row, or to a session that reported rules_file_capable (claude-code sessions)."),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ node_id, child_node_id, alias, network_id }) => enqueueRulesFileRequest("read", { node_id, child_node_id, alias, network_id }),
+  );
+
+  server.tool(
+    "write_node_rules_file",
+    "Ask a node to overwrite its rules file (CLAUDE.md for claude nodes, AGENTS.md otherwise) in its working directory with `content`. No path argument by design. Poll get_rules_file_result with the returned request_id. app#225.",
+    {
+      ...NODE_ID_ALIAS_FIELDS,
+      alias: z.string().min(1).max(200).optional().describe("Target by alias instead of node_id — resolves to the node row, or to a session that reported rules_file_capable (claude-code sessions)."),
+      content: z.string().max(RULES_FILE_MAX_BYTES).describe("Full new file content (UTF-8). The node writes it atomically."),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ node_id, child_node_id, alias, content, network_id }) => enqueueRulesFileRequest("write", { node_id, child_node_id, alias, content, network_id }),
+  );
+
+  server.tool(
+    "list_node_skills",
+    "Ask a node to list the skills its runtime loads (name, scope project|user|system, display path, frontmatter description). Read-only; no path argument. Poll get_rules_file_result — content is JSON {skills:[…]}.",
+    {
+      ...NODE_ID_ALIAS_FIELDS,
+      alias: z.string().min(1).max(200).optional().describe("Target by alias instead of node_id — resolves to the node row, or to a session that reported skills_capable."),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ node_id, child_node_id, alias, network_id }) => enqueueRulesFileRequest("skills_list", { node_id, child_node_id, alias, network_id }),
+  );
+
+  server.tool(
+    "read_node_skill",
+    "Ask a node for one skill's SKILL.md by name. Read-only; the node resolves the name under its own runtime's skills roots — no path argument. Poll get_rules_file_result — content is JSON {name, scope, path_rel, description, content}.",
+    {
+      ...NODE_ID_ALIAS_FIELDS,
+      alias: z.string().min(1).max(200).optional().describe("Target by alias instead of node_id — resolves to the node row, or to a session that reported skills_capable."),
+      name: z.string().min(1).max(64).describe("Skill directory name, [A-Za-z0-9._-]."),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ node_id, child_node_id, alias, name, network_id }) => enqueueRulesFileRequest("skill_read", { node_id, child_node_id, alias, content: name, network_id }),
+  );
+
+  server.tool(
+    "list_node_files",
+    "Ask a node to list one directory level of its work dir (project folder view, read-only). `path` is relative to the work dir (default: the root); absolute paths and .. are refused. Poll get_rules_file_result — content is JSON {path, entries:[{name,type,size?,mtime?,hidden_reason?,no_descend?}], truncated, total}. User logins only.",
+    {
+      ...NODE_ID_ALIAS_FIELDS,
+      alias: z.string().min(1).max(200).optional().describe("Target by alias instead of node_id — resolves to the node row, or to a session that reported files_capable."),
+      path: z.string().max(NODE_FILE_PATH_MAX).optional().describe("Directory relative to the node's work dir; omit or \"\" for the root."),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ node_id, child_node_id, alias, path: relPath, network_id }) => enqueueRulesFileRequest("files_list", { node_id, child_node_id, alias, content: relPath ?? "", network_id }),
+  );
+
+  server.tool(
+    "read_node_file",
+    "Ask a node for one text file under its work dir (project folder view, read-only, 256 KiB cap; binary / too large → size only; secret-looking files → name only). `path` is relative to the work dir. Poll get_rules_file_result — content is JSON {path, name, kind, size?, mtime?, content?, hidden_reason?}. User logins only.",
+    {
+      ...NODE_ID_ALIAS_FIELDS,
+      alias: z.string().min(1).max(200).optional().describe("Target by alias instead of node_id — resolves to the node row, or to a session that reported files_capable."),
+      path: z.string().min(1).max(NODE_FILE_PATH_MAX).describe("File path relative to the node's work dir."),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ node_id, child_node_id, alias, path: relPath, network_id }) => enqueueRulesFileRequest("file_read", { node_id, child_node_id, alias, content: relPath, network_id }),
+  );
+
+  server.tool(
+    "tail_node_logs",
+    "Ask a node for the tail of its own agent-node run log (read-only, redacted on the node before it leaves). No path argument: the node reads only its own log directory. User logins only; the node's owner or a network owner/admin. Poll get_rules_file_result — content is JSON {files, lines:[{ts, level, text, key}], truncated, matched, now_ts}; it is handed out once and then purged.",
+    {
+      ...NODE_ID_ALIAS_FIELDS,
+      alias: z.string().min(1).max(200).optional().describe("Target by alias instead of node_id — resolves to the node row, or to a session that reported logs_capable."),
+      lines: z.number().int().min(1).max(LOGS_MAX_LINES).optional().describe("How many of the newest matching lines (default 500, max 2000)."),
+      level: z.enum(["info", "warn", "error"]).optional().describe("Only lines of exactly this level."),
+      grep: z.string().min(1).max(LOGS_GREP_MAX).optional().describe("Case-insensitive substring, matched after redaction."),
+      since_ts: z.number().int().min(0).optional().describe("Only lines at or after this epoch-ms timestamp (follow mode; the client de-duplicates by line key)."),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ node_id, child_node_id, alias, lines, level, grep, since_ts, network_id }) =>
+      enqueueRulesFileRequest("logs_tail", { node_id, child_node_id, alias, content: logsParamsJson({ lines, level, grep, since_ts }), network_id }),
+  );
+
+  server.tool(
+    "get_rules_file_request",
+    "Node pulls its oldest pending rules-file request (called from agent-node when the SSE rules_file doorbell arrives). app#225.",
+    {},
+    async () => {
+      // 同 get_config_update 的 F-A 闸：必须是网络 token + alias。
+      if (!callerTokenIsNetwork || !enforceNetworkId) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "network_token_required" }) }] };
+      }
+      if (!callerAlias) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "alias_required" }) }] };
+      }
+      const node = resolveCallerNode();
+      // app#225 follow-up — no `nodes` row: this is a session-only target
+      // (claude-code). Its queue key is `session:<alias>`, always paired with the
+      // caller's network so a same-named alias in another network never matches.
+      const queueKey: string = node ? node.node_id : `session:${callerAlias}`;
+      const req = db.get<any>(
+        "SELECT request_id, op, content FROM node_rules_requests WHERE node_id = ?1 AND network_id = ?2 AND status = 'pending' ORDER BY created_at ASC LIMIT 1",
+        queueKey,
+        enforceNetworkId,
+      );
+      if (!req) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, request: null }) }] };
+      }
+      db.run(
+        "UPDATE node_rules_requests SET status = 'in_progress', pulled_at = ?1 WHERE request_id = ?2 AND status = 'pending'",
+        [Date.now(), req.request_id],
+      );
+      return {
+        content: [{
+          type: "text" as const,
+          text: JSON.stringify({
+            ok: true,
+            request: {
+              request_id: req.request_id,
+              op: req.op,
+              ...(req.op === "write" || req.op === "skill_read" || isFilesOp(req.op) || isLogsOp(req.op) ? { content: req.content ?? "" } : {}),
+            },
+          }),
+        }],
+      };
+    },
+  );
+
+  server.tool(
+    "ack_rules_file_request",
+    "Node reports the outcome of a rules-file request — done (with content for reads) or failed (with error). app#225.",
+    {
+      request_id: z.string().min(1).max(200),
+      status: z.enum(["done", "failed"]),
+      file_name: z.string().max(64).optional(),
+      exists: z.boolean().optional(),
+      // Files results (JSON listing / a 256 KiB file, escaped) may exceed the rules
+      // cap; the per-op cap is enforced below once the row's op is known.
+      content: z.string().max(NODE_FILES_RESULT_MAX_CHARS).optional(),
+      error: z.string().max(2000).optional(),
+    },
+    async ({ request_id: requestId, status, file_name: fileName, exists, content, error: ackError }) => {
+      if (!callerTokenIsNetwork || !enforceNetworkId) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "network_token_required" }) }] };
+      }
+      if (!callerAlias) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "alias_required" }) }] };
+      }
+      const node = resolveCallerNode();
+      const queueKey: string = node ? node.node_id : `session:${callerAlias}`;
+      const req = db.get<any>(
+        "SELECT request_id, node_id, network_id, status, op FROM node_rules_requests WHERE request_id = ?1",
+        requestId,
+      );
+      // 跨租户闸：只能 ack 自己的请求；别人的当不存在处理。session 键另外核网络。
+      if (!req || req.node_id !== queueKey || req.network_id !== enforceNetworkId) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, ignored: "unknown_or_foreign_request" }) }] };
+      }
+      if (req.status === "done" || req.status === "failed" || req.status === "timeout") {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, ignored: "already_terminal", current_status: req.status }) }] };
+      }
+      if (typeof content === "string" && !isFilesOp(req.op) && !isLogsOp(req.op) && content.length > RULES_FILE_MAX_BYTES) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "content_too_large", max: RULES_FILE_MAX_BYTES }) }] };
+      }
+      db.run(
+        `UPDATE node_rules_requests SET status = ?1, acked_at = ?2, file_name = ?3, file_exists = ?4, result_content = ?5, error = ?6 WHERE request_id = ?7`,
+        [
+          status,
+          Date.now(),
+          fileName ?? null,
+          typeof exists === "boolean" ? (exists ? 1 : 0) : null,
+          status === "done" ? (content ?? null) : null,
+          status === "failed" ? (ackError || "node reported failure without a reason") : null,
+          requestId,
+        ],
+      );
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, request_id: requestId, status }) }] };
+    },
+  );
+
+  server.tool(
+    "get_rules_file_result",
+    "Poll the outcome of a read_node_rules_file / write_node_rules_file request. Returns status pending|in_progress|done|failed|timeout, the file name the node used, and (for reads) the content. app#225.",
+    { request_id: z.string().min(1).max(200), network_id: z.string().max(200).optional() },
+    async ({ request_id: requestId, network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, "read rules file result");
+      const row = db.get<any>(
+        "SELECT request_id, node_id, network_id, op, status, file_name, file_exists, result_content, error, created_at, pulled_at, acked_at, created_by_token FROM node_rules_requests WHERE request_id = ?1",
+        requestId,
+      );
+      // SEC-1：结果行的网络必须等于调用方作用域，否则当不存在。
+      // Project folder results: only the (user) token that asked may read them.
+      // Run-log results: same rule — only the token that asked.
+      const foreignFilesRow = !!row && (isFilesOp(row.op) || isLogsOp(row.op)) && (callerTokenIsNetwork || row.created_by_token !== (callerTokenId || "unknown"));
+      if (!row || row.network_id !== (effectiveNetId || "default") || foreignFilesRow) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "request_not_found", request_id: requestId }) }] };
+      }
+      let status: string = row.status;
+      const ageMs = Date.now() - (row.pulled_at ?? row.created_at);
+      if ((status === "pending" || status === "in_progress") && ageMs > RULES_REQUEST_STALE_MS) {
+        status = "timeout";
+        db.run(
+          "UPDATE node_rules_requests SET status = 'timeout', acked_at = ?1, error = ?2 WHERE request_id = ?3 AND status IN ('pending', 'in_progress')",
+          [Date.now(), `node did not answer within ${RULES_REQUEST_STALE_MS}ms (offline, or running an agent-node without app#225 support)`, requestId],
+        );
+        row.error = `node did not answer within ${RULES_REQUEST_STALE_MS}ms (offline, or running an agent-node without app#225 support)`;
+      }
+      // Privacy: node file bytes are handed out for a short grace window after the
+      // first terminal read, then purged (node-request-retention.ts). Only reached
+      // after the SEC-1 scope check above — a foreign caller can't stamp/purge.
+      const terminal = status === "done" || status === "failed" || status === "timeout";
+      const purged = terminal ? noteTerminalResultRead(requestId).purged : false;
+      // Run-log bytes are read-once: purge them in the same call that hands them
+      // out (no grace window — the app never follows someone else's logs request,
+      // it re-asks; see node-request-retention.ts).
+      if (terminal && isLogsOp(row.op) && !purged) purgeLogsResultNow(requestId);
+      return {
+        content: [{
+          type: "text" as const,
+          text: JSON.stringify({
+            ok: true,
+            request_id: row.request_id,
+            node_id: row.node_id,
+            op: row.op,
+            status,
+            file_name: row.file_name ?? null,
+            exists: row.file_exists === null || row.file_exists === undefined ? null : row.file_exists === 1,
+            ...(status === "done" && row.op !== "write" && !purged ? { content: row.result_content ?? "" } : {}),
+            ...(purged ? { content_purged: true } : {}),
+            error: row.error ?? null,
+            age_ms: ageMs,
+          }),
+        }],
+      };
+    },
+  );
+
+
   server.tool(
     "restart_node",
     "Trigger a node restart without changing config. RFC-024 Vincent 2026-06-28 increment. Network-scoped (SEC-1); member+ role suffices (lifecycle ops are not privilege elevation).",
     {
-      node_id: z.string().min(1).max(200),
+      ...NODE_ID_ALIAS_FIELDS,
       network_id: z.string().max(200).optional(),
     },
-    async ({ node_id: nodeId, network_id: clientNetId }) => {
+    async ({ node_id, child_node_id, network_id: clientNetId }) => {
+      const idArg = resolveNodeIdArg({ node_id, child_node_id });
+      if (!idArg.ok) return { content: [{ type: "text" as const, text: JSON.stringify(idArg) }] };
+      const nodeId = idArg.node_id;
       const effectiveNetId = getNetworkId(clientNetId);
       if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, "write");
 
@@ -1787,10 +3710,24 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
       const updateId = `cu_${uuidv4()}`;
       const networkId = node.network_id || "default";
-      db.run(
-        `INSERT INTO node_config_updates (update_id, node_id, network_id, patch_json, apply_mode, base_revision, status, created_at, created_by_token) VALUES (?1, ?2, ?3, '{}', 'restart_only', ?4, 'pending', ?5, ?6)`,
-        [updateId, nodeId, networkId, node.config_revision || 0, Date.now(), callerTokenId || "unknown"],
-      );
+      // RFC-027 PR1.2a latent fix (#346 ack): restart_node must reset
+      // lifecycle_state to 'active'. Otherwise a node that was previously
+      // stop_node'd → 'stopped' would, after restart, stay marked
+      // 'stopped' in the nodes table → the 6 MCP + 2 REST inbox guards
+      // would refuse every routing attempt → node silently unreachable
+      // (no error to operator, just no traffic). Pair the schema flip
+      // with the config_updates INSERT inside one tx so we don't
+      // half-commit if the dispatch INSERT throws.
+      db.transaction(() => {
+        db.run(
+          `INSERT INTO node_config_updates (update_id, node_id, network_id, patch_json, apply_mode, base_revision, status, created_at, created_by_token) VALUES (?1, ?2, ?3, '{}', 'restart_only', ?4, 'pending', ?5, ?6)`,
+          [updateId, nodeId, networkId, node.config_revision || 0, Date.now(), callerTokenId || "unknown"],
+        );
+        db.run(
+          `UPDATE nodes SET lifecycle_state = 'active' WHERE node_id = ?1`,
+          [nodeId],
+        );
+      });
       pushEvent(node.alias, { type: "restart", update_id: updateId }, networkId);
       return {
         content: [{ type: "text" as const, text: JSON.stringify({ ok: true, update_id: updateId, apply_mode: "restart_only" }) }],
@@ -1895,7 +3832,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // schema-promoted columns runtimes_supported/allowed_secret_keys
       // are pre-extracted but role isn't a first-class column).
       const nowMs = Date.now();
-      const ONLINE_MS = 60_000;
+      // 心跳周期是 3 分钟（agent-node/src/cli.ts 的 report_status 定时器），
+      // 窗口必须大于它，否则每次心跳后的 60s~180s 之间必然抖成 offline
+      // （通信评审牛 #1279 独审④）。取 5min，与仓内既有 stale 口径一致。
+      const ONLINE_MS = 5 * 60_000;
       const daemons = rows
         .map(r => {
           let snapRole: string | null = null;
@@ -1914,7 +3854,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           let lastSeenAt: string | null = null;
           if (r.session_last_seen) {
             lastSeenAt = r.session_last_seen;
-            const t = Date.parse(r.session_last_seen);
+            const t = parseDbTimestampMs(r.session_last_seen);
             if (!isNaN(t)) online = (nowMs - t) <= ONLINE_MS;
           }
           // Parse self-declare arrays (default to [] for pre-PR2 daemons)
@@ -1941,6 +3881,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             telemetry.mem_gb = r.session_mem_total_gb ?? null;
             telemetry.ip_internal = r.session_ip ?? null;
           }
+          // 工作目录默认根会暴露那台机器的家目录路径 —— 与 IP 同级,只给 admin/owner
+          // (也只有他们能 create_node)。见 create-node-validate.ts daemonDefaultWorkdirRoot。
+          const workdirRoot = isPrivileged ? daemonDefaultWorkdirRoot(r.config_snapshot) : null;
           return {
             daemon_node_id: r.node_id,
             alias: r.alias,
@@ -1950,6 +3893,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             runtimes_supported: runtimes,
             allowed_secret_keys: secrets,
             host_telemetry: telemetry,
+            ...(workdirRoot ? { default_workdir_root: workdirRoot } : {}),
           };
         });
 
@@ -1968,10 +3912,13 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       node_spec: z.object({
         name: z.string().min(1).max(64),
         runtime: z.string().min(1).max(64),
-        model: z.string().min(1).max(100),
-        flags: z.record(z.unknown()).optional(),
+        model: z.string().min(1).max(100).optional().nullable(),
+        flags: z.record(z.string(), z.unknown()).optional(),
         env_refs: z.array(z.string().max(64)).optional(),
         channels: z.array(z.unknown()).optional(),
+        // app「新建节点」确认页的工作目录(绝对路径或 ~/…,daemon 侧展开并校验)。
+        // 缺席 = 老行为:落 daemon 的 cwd。
+        workdir: z.string().max(1024).optional().nullable(),
       }),
       network_id: z.string().max(200).optional(),
     },
@@ -1998,23 +3945,116 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "cross_network_node" }) }] };
       }
 
-      // Read daemon's host_supervisor capability + allowlist from its
-      // last reported config_snapshot. P1 simplification: we accept
-      // (allowed_runtimes empty / allowed_secret_keys absent) as
-      // "accept any in the global enum"; P2 will tighten when daemon
-      // self-publishes its own allowlist via daemon_capabilities.
-      let daemonAllowList = new Set<string>();
-      let daemonAllowedRuntimes: string[] | null = null;
+      // #1353 Fix ① — daemon self-declared "I can't create nodes right now"
+      // is now a dispatch-time gate, not just a stored fact. Before this,
+      // daemon reported `daemon_capabilities.can_create_nodes=false` (via
+      // #1371 + #1377), hub stored it in config_snapshot, and then no
+      // consumer read it — dispatch still returned `{ok:true, request_id}`
+      // and pushed an SSE doorbell to the broken daemon. That's the exact
+      // "在线但静默失败" case the issue title reports.
+      //
+      // Vincent's own 2026-08-28 comment on #1353 authorizes this shape:
+      // "daemon 侧确知不可用时,hub 应当**拒绝派发**并返回可操作的错误,
+      //  而不是发一个注定失败的 doorbell".
+      //
+      // 🔴 Pre-#1371 compat: a daemon that has NOT reported
+      // `can_create_nodes` at all leaves the field UNDEFINED in the
+      // snapshot. Do NOT fail-closed on undefined — that would silently
+      // start rejecting every daemon on the old (preview.10 through .55
+      // roughly) shape. Only `=== false` gates; `=== true` and `undefined`
+      // both pass through (new-guard-matches-existing-stance).
       try {
         const snap = daemon.config_snapshot ? JSON.parse(daemon.config_snapshot) : null;
-        if (snap?.daemon_capabilities?.allowed_secret_keys) {
-          daemonAllowList = new Set(snap.daemon_capabilities.allowed_secret_keys);
-        }
-        if (Array.isArray(snap?.daemon_capabilities?.allowed_runtimes)) {
-          daemonAllowedRuntimes = snap.daemon_capabilities.allowed_runtimes;
-        }
-      } catch { /* permissive P1 fallback */ }
-
+        const caps = snap?.daemon_capabilities;
+        if (caps && caps.can_create_nodes === false) {
+          const reason: string = (typeof caps.create_nodes_blocked_reason === "string"
+            && caps.create_nodes_blocked_reason.length > 0)
+            ? caps.create_nodes_blocked_reason
+            : "anet_bin_unknown";
+          // #1545 —— 光说 `blocked_reason` 不够:**那个判断是什么时候做出来的**
+          // 决定了下一步完全不同的两件事。
+          //   刚测的 blocked      ⇒ 去那台机器按 reason 修
+          //   三周前测的 blocked  ⇒ 那台 daemon 是**开机算一次就永久缓存**的旧版本
+          //                        (agent-node ≤ 2.5.0-preview.54),它可能早就好了 ——
+          //                        先重启/升级它,再谈修 pin
+          // 而在拒绝这一刻,用户正好在决定"去修哪台机器"。
+          //
+          // 🔴 年龄未知时给的是**显式 null + 一个说明为什么的枚举**,不是省略这两个键。
+          //    省略读起来像"没有这个问题",而调用方(常常是个 agent)会默认它是刚测的
+          //    —— 那是朝「更可信」方向撒谎,比不给更糟。
+          const rawAge = caps.create_capability_observed_ms_ago;
+          const reportedAgeOk = typeof rawAge === "number" && Number.isFinite(rawAge)
+            && rawAge >= 0 && rawAge <= 365 * 24 * 60 * 60 * 1000;
+          // 🔴 daemon 报的是「测完到**这份 report 发出**之间隔了多久」,不是「到现在」。
+          //    两者差一个心跳间隔(3 分钟),而对一个已经失联的 daemon 差多少都可能。
+          //    直接把它当成"多久以前测的"渲染,会**朝更新鲜的方向**低报 ——
+          //    正是这一格要防的那个方向。所以在这里补上心跳那一段:
+          //      绝对年龄 = (now − last_seen_at) + daemon 报的时长
+          //    hub 的钟出绝对时间,daemon 只提供时长(它自己的钟偏移污染不了这个数)。
+          //
+          //    这是冷路径(只有被拒时才走),多一次小查询不影响心跳路径。
+          let heartbeatAgeMs: number | null = null;
+          try {
+            const sess = db.get<{ last_seen_at: string | null }>(
+              "SELECT last_seen_at FROM sessions WHERE node_id = ?1 ORDER BY last_seen_at DESC LIMIT 1",
+              daemon_node_id,
+            );
+            // #1650 — 这一列是 TEXT(`datetime('now')`),UTC 但不带时区标记。
+            //   Date.parse 会按**本机时区**解析,误差 = 主机偏移(生产 hub 在 UTC+8
+            //   时这个诊断数字整整偏 8 小时)。走 parseHubTimestamp 显式按 UTC 解。
+            const t = parseHubTimestamp(sess?.last_seen_at);
+            if (t !== null) heartbeatAgeMs = Math.max(0, Date.now() - t);
+          } catch { /* 取不到就是取不到 —— 下面如实说 unknown,不猜 0 */ }
+
+          // 🔴 三种取值,不能塌成两种:
+          //    known                      两半都有,可以给绝对年龄
+          //    unknown_legacy_daemon      那台 daemon 根本没报这一格(旧版本)
+          //    unknown_no_heartbeat_time  它报了,但 hub 这边没有可用的心跳时间
+          //                               ⇒ **补不出绝对年龄**,而不是"年龄是 0"
+          const ageKnown = reportedAgeOk && heartbeatAgeMs !== null;
+          return { content: [{ type: "text" as const, text: JSON.stringify({
+            ok: false,
+            error: "daemon_cannot_create_nodes",
+            blocked_reason: reason,
+            // 到**现在**为止,这个判断做出来有多久了(毫秒)。null = 补不出来。
+            capability_observed_ms_ago: ageKnown ? heartbeatAgeMs! + (rawAge as number) : null,
+            capability_age: ageKnown
+              ? "known"
+              : (reportedAgeOk ? "unknown_no_heartbeat_time" : "unknown_legacy_daemon"),
+            // 🔴 这里**不复制那张 code → 修法命令 的表**。它只有一个作者,在
+            //    `@sleep2agi/agent-network` 的 daemon-capability-display —— 抄一份到 hub,
+            //    两份就会各自漂移,而「hub 教的修法」和「CLI 教的修法」不一致时,
+            //    没有任何东西会红。这里只把人指到那一份。
+            //    (同 `blocked_reason` 是 z.enum 而不是自由文本的立场:hub 出**代码**,
+            //     渲染留给客户端。)
+            remediation_hint: "run `anet daemon list` where that daemon is configured — it prints the exact, paste-able fix command for this blocked_reason",
+            daemon_node_id,
+          }) }] };
+        }
+      } catch { /* malformed snapshot: permissive, mirrors L3230 fallthrough */ }
+
+      // Read daemon's host_supervisor capability + allowlist from its
+      // last reported config_snapshot. PR3 (#338) canonical path is
+      // `daemon_capabilities.runtimes_supported` (RFC-026 §9.3).
+      // Pre-PR3 daemons (preview.10 and earlier) place these at the
+      // TOP level of the snapshot rather than nested — those reads
+      // return undefined here and `daemonAllowedRuntimes` stays null
+      // (permissive — no allowlist enforcement); they fall back to
+      // §4.2.2 structural validation only, identical to pre-PR3
+      // behavior. No regression on in-flight daemons.
+      let daemonAllowList = new Set<string>();
+      let daemonAllowedRuntimes: string[] | null = null;
+      try {
+        const snap = daemon.config_snapshot ? JSON.parse(daemon.config_snapshot) : null;
+        const caps = snap?.daemon_capabilities;
+        if (Array.isArray(caps?.allowed_secret_keys)) {
+          daemonAllowList = new Set(caps.allowed_secret_keys);
+        }
+        if (Array.isArray(caps?.runtimes_supported)) {
+          daemonAllowedRuntimes = caps.runtimes_supported;
+        }
+      } catch { /* permissive fallback */ }
+
       // §4.2.2 — structural validation (catches name/runtime/model/
       // flag injection at the hub edge). Daemon repeats this; double
       // layer per RFC §4.2.2.
@@ -2023,6 +4063,7 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         validateRuntime(node_spec.runtime);
         validateModel(node_spec.model);
         validateChannelsP1((node_spec as any).channels);
+        validateWorkdir(node_spec.workdir);
         for (const [k, v] of Object.entries(node_spec.flags || {})) {
           if (!(FLAG_KEYS as readonly string[]).includes(k)) throw new ValidationError("flag_key_unknown", { field: k });
           validateFlagValue(k, v);
@@ -2030,6 +4071,18 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       } catch (e) {
         return validationFailReply(e);
       }
+      // 🔴 老 daemon 会**静默忽略** node_spec.workdir,把节点建在它自己的 cwd 里 ——
+      //    用户以为指定了目录,实际落到了别处(常常就是 $HOME)。所以没自报支持的 daemon
+      //    直接拒,而不是派一个会被悄悄改写的请求。app 在这种 daemon 上本就不显示那一行。
+      const requestedWorkdir = typeof node_spec.workdir === "string" ? node_spec.workdir.trim() : null;
+      if (requestedWorkdir && !daemonDefaultWorkdirRoot(daemon.config_snapshot)) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({
+          ok: false,
+          error: "workdir_not_supported_by_daemon",
+          hint: "this daemon's agent-node predates create-node workdir support; upgrade it, or omit workdir to use its current directory",
+          daemon_node_id,
+        }) }] };
+      }
 
       // P1 daemon-side allowlist: if daemon publishes allowed_runtimes,
       // enforce at hub for fast-fail; daemon repeats.
@@ -2115,12 +4168,13 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       const envKeys = Object.keys(envBlob);
       db.run(
         `INSERT INTO node_create_requests
-           (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, child_token_id, created_at, created_by_token)
-         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'pending', ?9, ?10, ?11)`,
+           (request_id, daemon_node_id, child_name, network_id, runtime, model, flags_json, env_keys, status, child_token_id, created_at, created_by_token, workdir)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'pending', ?9, ?10, ?11, ?12)`,
         [
           requestId, daemon_node_id, node_spec.name, networkIdForChild,
-          node_spec.runtime, node_spec.model, JSON.stringify(node_spec.flags || {}),
+          node_spec.runtime, node_spec.model ?? null, JSON.stringify(node_spec.flags || {}),
           JSON.stringify(envKeys), childTokenId, Date.now(), callerTokenId || "unknown",
+          requestedWorkdir,
         ],
       );
 
@@ -2129,9 +4183,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       // SSE handler resolves the rest via MCP call.
       pushEvent(daemon.alias, { type: "create_node", request_id: requestId }, networkIdForChild);
 
-      // §4.5 audit — dispatch succeeded
+      // §4.5 audit — request queued and doorbell attempted. pushEvent is
+      // fire-and-forget, so actual SSE delivery is intentionally not claimed.
       auditCreateNode({
-        action: "create_node_dispatched",
+        action: "create_node_dispatch_attempted",
         user_id: enforceUserId,
         network_id: networkIdForChild,
         target_id: requestId,
@@ -2139,9 +4194,10 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           daemon_node_id,
           child_name: node_spec.name,
           runtime: node_spec.runtime,
-          model: node_spec.model,
+          model: node_spec.model ?? null,
           flag_keys: Object.keys(node_spec.flags || {}),
           env_keys: envKeys,
+          workdir: requestedWorkdir,
         },
       });
 
@@ -2151,6 +4207,78 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
 
+  // #1362 — daemon-side compensation for missed SSE doorbells. pushEvent is
+  // intentionally best-effort; after a daemon connects or reconnects, it pulls
+  // any still-pending requests bound to its own daemon token.
+  server.tool(
+    "list_my_pending_create_requests",
+    "Daemon lists pending create-node requests bound to itself for SSE reconnect compensation. RFC-026/#1362.",
+    {},
+    async () => {
+      const callerDaemon = resolveCallerDaemonTokenBound();
+      if (!callerDaemon.ok) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      }
+      const rows = db.all<{ request_id: string; child_name: string; created_at: number }>(
+        `SELECT request_id, child_name, created_at
+           FROM node_create_requests
+          WHERE daemon_node_id = ?1
+            AND network_id = ?2
+            AND status = 'pending'
+          ORDER BY created_at ASC`,
+        callerDaemon.daemonNodeId, callerDaemon.networkId,
+      );
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, count: rows.length, requests: rows }) }] };
+    },
+  );
+
+  // #1448 — stop/delete/start 门铃的 SSE 重连补偿，镜像 create 的
+  // list_my_pending_create_requests(#1394)。pushEvent(push.ts) 是纯内存
+  // fan-out：派发门铃那刻若 daemon 无 live SSE 订阅者(hub 重启/网络抖/boot
+  // 窗口)就静默丢弃、不入队，于是 node_stop_requests/node_start_requests 的行
+  // 永远停在 pending、节点卡死 stopping/deleting/starting。daemon 每次 SSE
+  // connected 调本工具把漏掉的门铃拉回来重放(reconcilePendingLifecycleRequestsOnConnect)。
+  //
+  // 统一一个工具返回两张表的 pending 行(stop 表用 action 区分 stop/delete)，
+  // 省一次往返。鉴权同 create：token-bound daemon 身份(alias 不是安全边界)，
+  // 只返回绑定到本 daemon + 本网络的 pending 行。
+  server.tool(
+    "list_my_pending_lifecycle_requests",
+    "Daemon lists pending stop/delete/start requests bound to itself for SSE reconnect compensation. Mirrors list_my_pending_create_requests (#1394/#1448).",
+    {},
+    async () => {
+      const callerDaemon = resolveCallerDaemonTokenBound();
+      if (!callerDaemon.ok) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      }
+      const stop_requests = db.all<{ request_id: string; action: string; child_node_id: string; child_alias: string; created_at: number }>(
+        `SELECT request_id, action, child_node_id, child_alias, created_at
+           FROM node_stop_requests
+          WHERE daemon_node_id = ?1
+            AND network_id = ?2
+            AND status = 'pending'
+          ORDER BY created_at ASC`,
+        callerDaemon.daemonNodeId, callerDaemon.networkId,
+      );
+      const start_requests = db.all<{ request_id: string; child_node_id: string; child_alias: string; created_at: number }>(
+        `SELECT request_id, child_node_id, child_alias, created_at
+           FROM node_start_requests
+          WHERE daemon_node_id = ?1
+            AND network_id = ?2
+            AND status = 'pending'
+          ORDER BY created_at ASC`,
+        callerDaemon.daemonNodeId, callerDaemon.networkId,
+      );
+      return { content: [{ type: "text" as const, text: JSON.stringify({
+        ok: true,
+        stop_count: stop_requests.length,
+        start_count: start_requests.length,
+        stop_requests,
+        start_requests,
+      }) }] };
+    },
+  );
+
   // §2.5 step 3 — daemon-facing pull. Returns full spec + env_blob +
   // child_ntok in one shot. Map evicted on take (one-shot consume).
   //
@@ -2203,8 +4331,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "env_blob_unavailable" }) }] };
       }
       // Hydrate spec from row.
-      const specRow = db.get<{ child_name: string; runtime: string; model: string; flags_json: string }>(
-        `SELECT child_name, runtime, model, flags_json FROM node_create_requests WHERE request_id = ?1`,
+      const specRow = db.get<{ child_name: string; runtime: string; model: string | null; flags_json: string; workdir: string | null }>(
+        `SELECT child_name, runtime, model, flags_json, workdir FROM node_create_requests WHERE request_id = ?1`,
         request_id,
       );
       if (!specRow) {
@@ -2227,6 +4355,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
             model: specRow.model,
             flags: JSON.parse(specRow.flags_json),
             channels: [],
+            // 只在请求真带了时出现:老 daemon 看不到多余的键,新 daemon 缺席即走老布局。
+            ...(specRow.workdir ? { workdir: specRow.workdir } : {}),
           },
           child_token: blob.child_token,
           env_blob: blob.env_blob,
@@ -2243,14 +4373,22 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
   // record fork-side info.
   server.tool(
     "ack_create_request",
-    "Daemon acks a create-node request (called after fork). status='started' or 'failed'. RFC-026.",
+    "Daemon acks a create-node request (called after fork). status='started' | 'failed' | 'rejected' | 'runtime_capability_check_failed'. RFC-026 §9.3 D2.",
     {
       request_id: z.string().min(1).max(200),
-      status: z.enum(["started", "failed", "rejected"]),
+      // RFC-026 §9.3 D2 — runtime_capability_check_failed signals the
+      // daemon spawned the child OK but it died within FAIL_FAST_MS
+      // (5s in agent-node v2.5.0-preview.11+), indicating a
+      // declaration↔reality gap on this daemon's runtimes_supported.
+      // Treated terminal like 'failed' but fires a distinct audit_log
+      // action so dashboards can highlight "lying daemons" separately
+      // from generic spawn failures.
+      status: z.enum(["started", "failed", "rejected", "runtime_capability_check_failed"]),
       error: z.string().max(1000).optional(),
       child_pid: z.number().int().optional(),
+      runtime: z.string().max(64).optional(),   // populated by daemon when status=runtime_capability_check_failed
     },
-    async ({ request_id, status, error: ackError, child_pid: _pid }) => {
+    async ({ request_id, status, error: ackError, child_pid: _pid, runtime: ackRuntime }) => {
       const callerDaemon = resolveCallerDaemonTokenBound();
       if (!callerDaemon.ok) {
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
@@ -2276,7 +4414,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         );
         return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, status: "awaiting_register" }) }] };
       }
-      // failed / rejected — revoke child-ntok + mark request terminal
+      // failed / rejected / runtime_capability_check_failed — revoke
+      // child-ntok + mark request terminal.
       if (row.child_token_id) {
         db.run(`UPDATE api_tokens SET revoked_at = datetime('now') WHERE token_id = ?1 AND revoked_at IS NULL`, [row.child_token_id]);
       }
@@ -2284,10 +4423,857 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         `UPDATE node_create_requests SET status = ?1, error = ?2, acked_at = ?3 WHERE request_id = ?4 AND status IN ('pending', 'delivered')`,
         [status, ackError || null, ackedAt, request_id],
       );
+      // RFC-026 §9.3 D2 — surface declaration↔reality gap on a
+      // distinct audit_log action so dashboards / operators can spot
+      // chronically-lying daemons separate from generic spawn-failed.
+      if (status === "runtime_capability_check_failed") {
+        auditCreateNode({
+          action: "daemon_capability_lied",
+          user_id: null,
+          network_id: row.network_id,
+          target_id: request_id,
+          detail: {
+            daemon_node_id: row.daemon_node_id,
+            runtime: ackRuntime || null,
+            error: ackError ? ackError.slice(0, 500) : null,
+            acked_at: ackedAt,
+          },
+        });
+      }
       return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, status }) }] };
     },
   );
 
+  // ─── RFC-027 §2 — stop/delete node lifecycle ───────────────────────
+  //
+  // Two user-facing MCP tools (stop_node, delete_node) + two daemon-
+  // facing tools (get_stop_request, ack_stop_request). State machine
+  // per §2.3 — nodes.lifecycle_state ∈ {active, stopping, stopped,
+  // deleting}. row-gone implies deleted. Security per §4:
+  //   §4.1 SEC-1: trust-root SQL join, not getNetworkId
+  //   §4.2 D6:    delete_node refuses target.role==host_supervisor
+  //   §4.3 D4:    in-flight inbox default-refuse + force+audit
+  //   §4.4 D7:    daemon writes backup chmod 700, sweeper真删
+  //   §4.5 D8:    audit_log in same SQLite tx as state UPDATE
+  //
+  // The dispatcher logic shared by stop_node + delete_node lives in
+  // dispatchStopOrDelete; the two tool handlers thin-wrap it with
+  // their respective action discriminator.
+  type DispatchAction = "stop" | "delete";
+  type DispatchArgs = {
+    action: DispatchAction;
+    child_node_id: string;
+    daemon_node_id: string;
+    force: boolean;
+    grace_seconds: number;
+    delete_config: boolean;
+    confirm_alias?: string;
+  };
+  // RFC-027 PR2 prereq — auto-resolve daemon_node_id from child_node_id.
+  // The dashboard (and most callers of stop_node / delete_node) shouldn't
+  // need to track the daemon→child mapping themselves; the hub has it on
+  // node_create_requests at child creation time. Returns null when no
+  // creation record exists (orphan node row OR pre-RFC-026 node) — caller
+  // must then pass daemon_node_id explicitly. node_id derivation:
+  // `node_${request_id.replace(/^cr_/,"")}` (see create-node-daemon.ts
+  // and PR1 BLOCKER-1 fix), so we reverse it: `cr_${node_id.slice(5)}`.
+  const resolveDaemonForChild = (child_node_id: string): string | null => {
+    if (!child_node_id.startsWith("node_")) return null;
+    const requestId = `cr_${child_node_id.slice(5)}`;
+    const row = db.get<{ daemon_node_id: string }>(
+      `SELECT daemon_node_id FROM node_create_requests WHERE request_id = ?1`,
+      requestId,
+    );
+    return row?.daemon_node_id ?? null;
+  };
+
+  /**
+   * 为什么这里要分两种「解析不到 daemon」(#196 / app 仓)。
+   *
+   * `resolveDaemonForChild` 对两件完全不同的事都返回 `null`:
+   *   ① id 不以 `node_` 开头 —— 这个节点**根本不是 daemon 创建的**,
+   *      是有人在某台机器上直接 `anet node start` 起来的。hub 上没有任何
+   *      daemon 可以代它执行停止,**这条路径对它在概念上就不成立**。
+   *   ② id 以 `node_` 开头,但 `node_create_requests` 里查不到那一行 ——
+   *      它可能确实是 daemon 建的,只是记录缺失,这时「显式传 daemon_node_id」
+   *      是一条真的走得通的路。
+   *
+   * 🔴 原先两种情况打印同一句 `pass daemon_node_id explicitly`。对 ① 来说
+   *    **这句建议的前提是假的** —— 没有 daemon 可传,用户按它做只会走进死路。
+   *    2026-08-28 对生产 hub 实测:218 个节点里 **207 个**是 ① 这种。
+   *
+   * 信息在源头就存在(那个 `startsWith("node_")` 判断),只是被丢在了返回值里。
+   */
+  const explainUnresolvableDaemon = (child_node_id: string) =>
+    child_node_id.startsWith("node_")
+      ? {
+          ok: false, error: "daemon_not_resolvable",
+          message: "no node_create_requests row found for this child_node_id; pass daemon_node_id explicitly",
+        }
+      : {
+          ok: false, error: "not_daemon_managed",
+          message:
+            `node ${child_node_id} was not created by a daemon (it was started by hand with ` +
+            `\`anet node start\` on some machine), so no daemon on the Hub can stop it. ` +
+            `Run \`anet node stop <alias>\` on that machine instead. ` +
+            `Daemon-created children have ids beginning with \`node_\`; this one does not.`,
+        };
+
+  const dispatchStopOrDelete = (args: DispatchArgs, clientNetId?: string | null) => {
+    // §4.1 — SEC-1 trust-root join: resolve target node row WITHIN the
+    // caller's scope. resolveReadScope returns 'denied' if the caller
+    // doesn't belong to clientNetId; for the row-existence test we
+    // re-join with member's networks so an attacker can't probe by
+    // node_id from a network they don't belong to.
+    const scope = resolveReadScope(clientNetId);
+    if (scope.denied) {
+      return { ok: false, error: "forbidden_cross_tenant", message: scope.denied };
+    }
+    const nodeQ: any[] = [args.child_node_id];
+    let nodeSql = `SELECT node_id, alias, network_id, lifecycle_state, config_snapshot, runtimes_supported
+      FROM nodes WHERE node_id = ?1`;
+    nodeSql = addReadScope(nodeSql, nodeQ, scope);
+    const node = db.get<{
+      node_id: string;
+      alias: string;
+      network_id: string;
+      lifecycle_state: string | null;
+      config_snapshot: string | null;
+    }>(nodeSql, ...nodeQ);
+    if (!node) return { ok: false, error: "forbidden_cross_tenant", message: "node not found in your networks" };
+
+    // Caller must hold a write-capable role on the resolved network
+    // (admin/owner/member; viewer denied). canWrite walks getUserNetworkRole.
+    if (!canWrite(node.network_id)) {
+      return { ok: false, error: "permission_denied", message: "viewer role cannot stop/delete nodes" };
+    }
+
+    // §4.2 D6 — delete refuses targets whose role is host_supervisor.
+    // Stop is allowed against any node per RFC table (host_supervisor's
+    // stop is functionally a no-op anyway: the daemon's children_map
+    // only tracks its child nodes, never the daemon itself).
+    //
+    // PR1 SF-4 (#345 review) — fail-CLOSED on role read. The first cut
+    // parsed config_snapshot and treated parse-fail / missing-field as
+    // role=null which slipped through the gate. A daemon row with a
+    // corrupt snapshot would then be deletable via delete_node. Fix:
+    // - read role via two independent paths (snapshot.role + the
+    //   indexed `runtimes_supported` column whose presence ≈ daemon)
+    // - if EITHER path indicates host_supervisor → refuse
+    // - if snapshot parsed but role missing AND the node has any
+    //   daemon-shape evidence (non-null runtimes_supported column,
+    //   present in any node_create_requests as daemon_node_id) →
+    //   refuse defensively. The defense-in-depth daemon-side
+    //   children_map miss is the second layer; the hub gate must
+    //   itself fail-closed when role is ambiguous.
+    if (args.action === "delete") {
+      let role: string | null = null;
+      let snapshotParseFailed = false;
+      try {
+        const snap = node.config_snapshot ? JSON.parse(node.config_snapshot) : null;
+        role = typeof snap?.role === "string" ? snap.role : null;
+      } catch { snapshotParseFailed = true; }
+      const ambiguous = snapshotParseFailed || (role == null);
+      // Independent corroborating check: nodes flagged as daemons by
+      // create_node dispatchers will show up as daemon_node_id in
+      // node_create_requests. Costs one indexed query.
+      let looksLikeDaemon = false;
+      if (ambiguous) {
+        const m = db.get<{ n: number }>(
+          `SELECT COUNT(*) AS n FROM node_create_requests WHERE daemon_node_id = ?1`,
+          node.node_id,
+        );
+        if ((m?.n ?? 0) > 0) looksLikeDaemon = true;
+      }
+      if (role === "host_supervisor" || (ambiguous && looksLikeDaemon)) {
+        return {
+          ok: false, error: "cannot_delete_daemon_via_delete_node",
+          message: snapshotParseFailed
+            ? "node config_snapshot unreadable; node is referenced as a daemon — refuse delete defensively (use delete_daemon path)"
+            : "host_supervisor daemons must be removed via the dedicated delete_daemon path (RFC-027.5)",
+        };
+      }
+    }
+
+    // delete_node confirm_alias gate: dashboard's二次确认 input must
+    // match the actual alias byte-for-byte. Hub rejects mismatched
+    // input even if dashboard UI claims it's disabled.
+    if (args.action === "delete") {
+      if (typeof args.confirm_alias !== "string" || args.confirm_alias !== node.alias) {
+        return { ok: false, error: "confirm_alias_mismatch", message: "confirm_alias must equal the node's alias" };
+      }
+    }
+
+    // Daemon must exist + be in the same network. We do NOT enforce
+    // daemon.role==host_supervisor here: a child whose creator daemon
+    // got demoted should still be stoppable. The daemon will refuse
+    // with noop_not_my_child if children_map doesn't know it.
+    //
+    // PR1.2 e2e catch (BLOCKER): pushEvent keys SSE by clientKey ≈
+    // `${networkId}:${sessionName}`, and agent-node registers its SSE
+    // connection under its ALIAS (not its node_id). The create_node
+    // doorbell at line ~2197 correctly pushes via `daemon.alias`;
+    // stop_node was pushing via `daemon_node_id` so every doorbell
+    // missed every SSE client → daemon never woke up → request_id
+    // stayed 'pending' forever → child never reaped. The 24 unit tests
+    // in stop-delete-node.test.ts all mock pushEvent and inject the
+    // post-doorbell handler call directly, so single-unit coverage
+    // couldn't surface this — exactly the failure class 通信龙 said
+    // the docker e2e gate exists to catch (BLOCKER-1 同源). Load the
+    // alias along with node_id + network_id and dispatch to the alias.
+    const daemon = db.get<{ node_id: string; alias: string; network_id: string }>(
+      `SELECT node_id, alias, network_id FROM nodes WHERE node_id = ?1`, args.daemon_node_id,
+    );
+    if (!daemon) return { ok: false, error: "daemon_not_found" };
+    if (daemon.network_id !== node.network_id) {
+      // Cross-tenant child↔daemon mismatch shouldn't be possible in
+      // normal flow but is a SEC-1 hardening — refuse loud.
+      return { ok: false, error: "daemon_cross_tenant", message: "daemon and child are in different networks" };
+    }
+
+    // #1448 finding-4 — daemon 必须是该 child 的**权威创建者**,镜像 start_node 的
+    // daemon_child_mismatch。此前 stop/delete 接受调用方传入的 daemon_node_id,只校验
+    // 它存在 + 同网,不验它真的创建了这个 child。同网调用方传错 daemon_node_id → 门铃
+    // 路由到错 daemon。🔴 f3(#1453) 合入后更糟:错 daemon 无该 child 的 map entry → 走
+    // 收敛分支 sweep(错机器 pgrep 空) + ack stopped → hub 假收敛 stopped、child 仍在
+    // 正确机器上跑(旧 noop 至少留下可见的卡死态)。网络 scope 只挡跨租户,网内是 footgun。
+    //
+    // 用「确定性不匹配」判据:authority 已知(child 有 create 记录)且不等 → 拒。不对
+    // authority==null(create 记录被裁剪的旧 child)加拒,避免给它们的 stop/delete 引入
+    // 新失败面——handler 的 daemon_node_id??resolveDaemonForChild 已兜住无法解析的情形。
+    const authoritativeDaemonId = resolveDaemonForChild(args.child_node_id);
+    if (authoritativeDaemonId && authoritativeDaemonId !== args.daemon_node_id) {
+      return { ok: false, error: "daemon_child_mismatch", message: "daemon_node_id is not this child's authoritative creator daemon" };
+    }
+
+    // State machine gate.
+    const state = node.lifecycle_state ?? "active";
+    if (args.action === "stop" && state !== "active") {
+      return { ok: false, error: state === "stopping" ? "node_already_stopping" : "node_not_active", current_state: state };
+    }
+    if (args.action === "delete" && state === "deleting") {
+      // #1286 —— stale-deleting 重派出口。
+      //
+      // 在 .40 埋点修复之前,daemon 丢失 ack 会让行**永远**停在 deleting:
+      // 重发 delete 被这里挡住,force=true 也一样 —— 状态机没有出口,
+      // 2026-08-28 实测两行卡死(acc-…-3373 / probe-tl2),API 层面无解。
+      //
+      // 出口的三个条件,缺一不放行:
+      //   ① 调用方显式 force=true(不改默认行为 —— 正常并发的重复 delete 仍被拒)
+      //   ② 该 child 最近一条 delete 请求不是终态(pending/dispatched)
+      //      —— 终态说明 daemon 刚 ack 过,行马上会转移,不该重派
+      //   ③ 那条请求已经晾了超过 STALE_DELETING_MS —— 🔴 不是"刚派发就能 force":
+      //      给正常的 doorbell→ack 往返留时间,否则 force 变成竞态放大器。
+      const STALE_DELETING_MS = 5 * 60_000;
+      const last = db.get<{ request_id: string; status: string; created_at: number }>(
+        `SELECT request_id, status, created_at FROM node_stop_requests
+          WHERE child_node_id = ?1 AND action = 'delete'
+          ORDER BY created_at DESC LIMIT 1`, node.node_id,
+      );
+      const lastIsStale = !!last
+        && (last.status === "pending" || last.status === "dispatched")
+        && (Date.now() - last.created_at) > STALE_DELETING_MS;
+      if (!(args.force === true && (lastIsStale || !last))) {
+        return {
+          ok: false, error: "node_already_deleting", current_state: state,
+          // 🔴 告诉调用方出口在哪,而不是让他反复撞同一面墙。
+          ...(last ? { last_request_id: last.request_id, last_request_status: last.status } : {}),
+          hint: last && (last.status === "pending" || last.status === "dispatched")
+            ? `再等一下;若超过 ${STALE_DELETING_MS / 60000} 分钟仍未收敛,带 force=true 重试可重新派发`
+            : "上一条请求已终态,行应即将转移;稍后重查",
+        };
+      }
+      // 放行:走正常派发路径,生成新 request_id。旧请求行保留(审计线索),
+      // daemon 侧对未知 request 的 get_stop_request 会拿到 request_not_found,无副作用。
+    }
+    if (args.action === "delete" && state === "stopping") {
+      // Can't start delete while a stop is mid-flight — race-prone.
+      return { ok: false, error: "node_stopping_in_progress", current_state: state };
+    }
+
+    // §4.3 D4 — in-flight inbox check. Count unacked tasks routed to
+    // this node's alias (inbox routing uses session_name == alias).
+    // Default refuse with the count surfaced; force=true overrides
+    // and triggers the forced_stop_with_in_flight audit row.
+    // SF-5 (#345 review): legacy inbox rows may have network_id=NULL
+    // and would silently miss a network_id=?2 strict equality match.
+    // Use COALESCE so a NULL inbox row is counted against the same
+    // network as the target node (which is the only safe default
+    // — pre-multi-network rows existed in single-network mode).
+    //
+    // #2022 — "unacked" alone is not "in flight". Nothing acks a row
+    // whose task already reached a terminal state (report_completion,
+    // send_reply, send_ack, the TTL patrol all leave inbox alone) and
+    // retention sweeps only acked=1 rows, so those rows were counted
+    // forever: one dead row pinned this gate to node_busy_in_flight
+    // and force=true was the only way past it.
+    //
+    // Counting rule (#2029 review): a row counts while it can still be
+    // work this node is doing — and the age ceiling must NOT be applied
+    // to a task row whose tasks row we can see. agent-node acks the
+    // inbox row only once the task is done, so a 90-minute (or 3-hour,
+    // or ttl_seconds>3600) task keeps acked=0 for its whole run;
+    // capping it by age would open this gate mid-run, which is exactly
+    // what the gate exists to prevent. So:
+    //   1. type='task' row with a matching tasks row — LEFT JOIN on
+    //      COALESCE(task_id, id), the key cancel_task / ack_inbox use
+    //      (first deliveries set id == task_id; retry/reassign write a
+    //      fresh transport id). Status alone decides: terminal
+    //      (replied / failed / cancelled / expired) → not counted;
+    //      anything else → counted, no age ceiling. Expiry belongs to
+    //      patrolExpiredTasks, which now acks the inbox row in the same
+    //      transaction, so an expired task leaves this count together
+    //      with its rows.
+    //   2. every other row — a task row whose tasks row is gone
+    //      (reaped by retention, or a legacy row whose id resolves to
+    //      nothing) and non-task rows (reply / broadcast / message):
+    //      these carry no status of their own and nothing else will
+    //      ever retire them, so they get the age ceiling
+    //      IN_FLIGHT_MAX_AGE_MINUTES on inbox.created_at.
+    // The count stays a per-alias inbox count: one PK join per row.
+    const IN_FLIGHT_MAX_AGE_MINUTES = 60;
+    const inFlightRow = db.get<{ n: number }>(
+      `SELECT COUNT(*) AS n FROM inbox i
+         LEFT JOIN tasks t
+           ON i.type = 'task'
+          AND t.task_id = COALESCE(i.task_id, i.id)
+        WHERE i.session_name = ?1 AND i.acked = 0
+          AND COALESCE(i.network_id, ?2) = ?2
+          AND ((t.task_id IS NOT NULL
+                AND t.status NOT IN ('replied', 'failed', 'cancelled', 'expired'))
+            OR (t.task_id IS NULL
+                AND i.created_at >= datetime('now', ?3)))`,
+      node.alias, node.network_id, `-${IN_FLIGHT_MAX_AGE_MINUTES} minutes`,
+    );
+    const inFlight = inFlightRow?.n ?? 0;
+    if (inFlight > 0 && !args.force) {
+      return { ok: false, error: "node_busy_in_flight", in_flight_count: inFlight, hint: "set force=true to override (audit logged)" };
+    }
+
+    // ── all gates passed; create request + transition state + push doorbell, transactionally ──
+    const requestId = generateId("sr");
+    const now = Date.now();
+    const newState = args.action === "stop" ? "stopping" : "deleting";
+
+    // #1448 finding-5 — 记下该 child **当前活着的** ntok 的 token_id,让 ack 精确按
+    // token_id 撤销,而非按 name='node:<alias>' 广撤。后者会在「同 alias 节点在这次
+    // delete 未收敛的窗口内被重建(拿到同名新 token)」时,把新 token 一并误撤。这里
+    // 在派发时刻定住身份;若此刻没有活 token(异常),存 null,ack 退回按 name 撤(旧语义)。
+    const childTokenRow = db.get<{ token_id: string }>(
+      `SELECT token_id FROM api_tokens WHERE network_id = ?1 AND name = ?2 AND revoked_at IS NULL`,
+      node.network_id, `node:${node.alias}`,
+    );
+    const childTokenId = childTokenRow?.token_id ?? null;
+
+    // §4.5 D8 — lifecycle UPDATE + audit INSERTs + request INSERT atomic.
+    // PR1.1: use db.transaction() (SQLiteAdapter wraps better-sqlite3's
+    // native transaction; PgAdapter ships a real BEGIN/COMMIT/ROLLBACK
+    // shim). Lets us drop the open-coded BEGIN/COMMIT + makes the
+    // SF-2 failure-injection test (mock db.run throw inside callback)
+    // reliable across both backends.
+    try {
+      db.transaction(() => {
+      db.run(
+        `INSERT INTO node_stop_requests
+           (request_id, network_id, daemon_node_id, child_node_id, child_alias, child_token_id, action,
+            delete_config, grace_seconds, force, in_flight_at_dispatch, created_by_token,
+            status, created_at)
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, 'pending', ?13)`,
+        [
+          requestId, node.network_id, args.daemon_node_id, node.node_id, node.alias, childTokenId, args.action,
+          args.delete_config ? 1 : 0, args.grace_seconds, args.force ? 1 : 0, inFlight,
+          callerTokenId || "unknown", now,
+        ],
+      );
+      db.run(
+        `UPDATE nodes SET lifecycle_state = ?1 WHERE node_id = ?2`,
+        [newState, node.node_id],
+      );
+      // §4.5 D8 — audit dispatch action. Uses the STRICT variant so a
+      // failed audit INSERT propagates and triggers ROLLBACK (PR1 SF-2
+      // review catch — auditCreateNode's swallow-and-warn would have
+      // committed the lifecycle UPDATE without an audit row, leaving
+      // exactly the "deleted but no audit" window §4.5 closes).
+      auditCreateNodeStrict({
+        action: args.action === "stop" ? "stop_node_dispatched" : "delete_node_dispatched",
+        user_id: enforceUserId, network_id: node.network_id, target_id: requestId,
+        detail: {
+          child_node_id: node.node_id, child_alias: node.alias,
+          daemon_node_id: args.daemon_node_id, action: args.action,
+          force: args.force, delete_config: args.delete_config,
+          grace_seconds: args.grace_seconds, in_flight_at_dispatch: inFlight,
+          lifecycle_state_before: state, lifecycle_state_after: newState,
+          ts_request: now,
+        },
+      });
+      if (args.force && inFlight > 0) {
+        auditCreateNodeStrict({
+          action: "forced_stop_with_in_flight",
+          user_id: enforceUserId, network_id: node.network_id, target_id: requestId,
+          detail: { in_flight_count: inFlight, child_alias: node.alias },
+        });
+      }
+      });   // end db.transaction
+    } catch (e: any) {
+      return { ok: false, error: "dispatch_tx_failed", message: e?.message || String(e) };
+    }
+
+    // SSE doorbell — daemon will pull via get_stop_request.
+    // PR1.2 e2e fix: route by daemon.alias (see SELECT above for the
+    // BLOCKER explanation). Mirrors create_node's pushEvent target at
+    // line ~2197.
+    pushEvent(daemon.alias, { type: "stop_node", request_id: requestId }, node.network_id);
+    return {
+      ok: true, request_id: requestId, action: args.action,
+      lifecycle_state: newState, in_flight_at_dispatch: inFlight,
+    };
+  };
+
+  server.tool(
+    "stop_node",
+    "Stop the agent-node child process; keep config dir intact. Reversible via restart_node. RFC-027 §2.2. daemon_node_id is auto-resolved from child_node_id when omitted (looked up in node_create_requests).",
+    {
+      ...NODE_ID_ALIAS_FIELDS,
+      // PR2 prereq: dashboard rarely knows daemon_node_id directly.
+      // When omitted, hub resolves from the original creation record
+      // (node_create_requests.daemon_node_id keyed by this child).
+      daemon_node_id: z.string().min(1).max(200).regex(/^node_[a-z0-9_-]+$/).optional(),
+      force: z.boolean().optional().default(false),
+      grace_seconds: z.number().int().min(5).max(60).optional().default(10),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ node_id, child_node_id: child_node_id_arg, daemon_node_id, force, grace_seconds, network_id: clientNetId }) => {
+      const idArg = resolveNodeIdArg({ node_id, child_node_id: child_node_id_arg });
+      if (!idArg.ok) return { content: [{ type: "text" as const, text: JSON.stringify(idArg) }] };
+      const child_node_id = idArg.node_id;
+      const resolved = daemon_node_id ?? resolveDaemonForChild(child_node_id);
+      if (!resolved) {
+        return { content: [{ type: "text" as const,
+          text: JSON.stringify(explainUnresolvableDaemon(child_node_id)) }] };
+      }
+      const r = dispatchStopOrDelete(
+        { action: "stop", child_node_id, daemon_node_id: resolved, force: force ?? false,
+          grace_seconds: grace_seconds ?? 10, delete_config: false },
+        clientNetId,
+      );
+      return { content: [{ type: "text" as const, text: JSON.stringify(r) }] };
+    },
+  );
+
+  server.tool(
+    "delete_node",
+    "Stop child + revoke ntok + delete hub row + (default) backup config to ~/.anet/deleted/<ts>-<alias>/ for 30d. confirm_alias must equal the node's alias. daemon_node_id is auto-resolved when omitted. RFC-027 §2.2.",
+    {
+      ...NODE_ID_ALIAS_FIELDS,
+      daemon_node_id: z.string().min(1).max(200).regex(/^node_[a-z0-9_-]+$/).optional(),
+      confirm_alias: z.string().min(1).max(200),
+      force: z.boolean().optional().default(false),
+      grace_seconds: z.number().int().min(5).max(60).optional().default(10),
+      delete_config: z.boolean().optional().default(true),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ node_id, child_node_id: child_node_id_arg, daemon_node_id, confirm_alias, force, grace_seconds, delete_config, network_id: clientNetId }) => {
+      const idArg = resolveNodeIdArg({ node_id, child_node_id: child_node_id_arg });
+      if (!idArg.ok) return { content: [{ type: "text" as const, text: JSON.stringify(idArg) }] };
+      const child_node_id = idArg.node_id;
+      const resolved = daemon_node_id ?? resolveDaemonForChild(child_node_id);
+      if (!resolved) {
+        return { content: [{ type: "text" as const,
+          text: JSON.stringify(explainUnresolvableDaemon(child_node_id)) }] };
+      }
+      const r = dispatchStopOrDelete(
+        { action: "delete", child_node_id, daemon_node_id: resolved, force: force ?? false,
+          grace_seconds: grace_seconds ?? 10, delete_config: delete_config ?? true, confirm_alias },
+        clientNetId,
+      );
+      return { content: [{ type: "text" as const, text: JSON.stringify(r) }] };
+    },
+  );
+
+  server.tool(
+    "get_stop_request",
+    "Daemon pulls a pending stop/delete request (called when SSE stop_node doorbell arrives). RFC-027 §2.4.",
+    {
+      request_id: z.string().min(1).max(200),
+    },
+    async ({ request_id }) => {
+      const callerDaemon = resolveCallerDaemonTokenBound();
+      if (!callerDaemon.ok) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      }
+      const row = db.get<{
+        daemon_node_id: string; status: string; network_id: string;
+        child_node_id: string; child_alias: string; action: string;
+        delete_config: number; grace_seconds: number; force: number;
+      }>(`SELECT daemon_node_id, status, network_id, child_node_id, child_alias, action,
+                 delete_config, grace_seconds, force
+            FROM node_stop_requests WHERE request_id = ?1`, request_id);
+      if (!row) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "request_not_found" }) }] };
+      if (row.daemon_node_id !== callerDaemon.daemonNodeId) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "not_your_request" }) }] };
+      }
+      if (row.network_id !== callerDaemon.networkId) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "cross_network_request" }) }] };
+      }
+      // Stamp delivered_at on first pull (idempotent — only if still pending).
+      db.run(
+        `UPDATE node_stop_requests SET status = 'delivered', delivered_at = ?1
+           WHERE request_id = ?2 AND status = 'pending'`,
+        [Date.now(), request_id],
+      );
+      return { content: [{ type: "text" as const, text: JSON.stringify({
+        ok: true,
+        request_id,
+        child_node_id: row.child_node_id,
+        child_alias: row.child_alias,
+        action: row.action,
+        delete_config: row.delete_config === 1,
+        grace_seconds: row.grace_seconds,
+        force: row.force === 1,
+      }) }] };
+    },
+  );
+
+  server.tool(
+    "ack_stop_request",
+    "Daemon reports stop/delete completion (or per-status failure). On 'stopped' status finalizes the lifecycle: stop→stopped + keep config; delete→DB row gone + revoke ntok. RFC-027 §2.3 + §4.5.",
+    {
+      request_id: z.string().min(1).max(200),
+      status: z.enum(["stopped", "stop_failed", "noop_not_my_child"]),
+      exit_signal: z.string().max(16).optional(),
+      backup_path: z.string().max(500).optional(),
+      error: z.string().max(1000).optional(),
+    },
+    async ({ request_id, status, exit_signal, backup_path, error: ackError }) => {
+      // #1358 —— 🔴 在此之前,这个工具的**每一条出口都是静默的**:到达不记、
+      // 三条拒绝不记、成功收尾也不记。而隔壁 create-node 的收尾**是记的**
+      // (`✓ create-node finalize`)。这种不对称最坑人:读日志的人看到 create 有、
+      // delete 没有,第一反应是「delete 没发生」—— 但两者的日志覆盖面本来就不同,
+      // 那条推论没有依据。排查 #1286 时我自己就差点这样读。
+      console.log(`[commhub] ← ack_stop_request request=${request_id} status=${status}${exit_signal ? ` exit_signal=${exit_signal}` : ""}`);
+      const callerDaemon = resolveCallerDaemonTokenBound();
+      if (!callerDaemon.ok) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      }
+      const row = db.get<{
+        daemon_node_id: string; status: string; network_id: string;
+        child_node_id: string; child_alias: string; child_token_id: string | null; action: string;
+        in_flight_at_dispatch: number; force: number;
+      }>(`SELECT daemon_node_id, status, network_id, child_node_id, child_alias, child_token_id, action,
+                 in_flight_at_dispatch, force
+            FROM node_stop_requests WHERE request_id = ?1`, request_id);
+      if (!row) {
+        console.warn(`[commhub] ✕ ack_stop_request rejected: request_not_found request=${request_id}`);
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "request_not_found" }) }] };
+      }
+      if (row.daemon_node_id !== callerDaemon.daemonNodeId) {
+        console.warn(`[commhub] ✕ ack_stop_request rejected: not_your_request request=${request_id} row_daemon=${row.daemon_node_id} caller=${callerDaemon.daemonNodeId}`);
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "not_your_request" }) }] };
+      }
+      if (row.network_id !== callerDaemon.networkId) {
+        console.warn(`[commhub] ✕ ack_stop_request rejected: cross_network_request request=${request_id} row_net=${row.network_id} caller_net=${callerDaemon.networkId}`);
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "cross_network_request" }) }] };
+      }
+      const now = Date.now();
+
+      // §4.5 D8 — lifecycle UPDATE + request UPDATE + audit INSERT
+      // (+ DELETE for delete action) atomic via db.transaction().
+      // PR1.1: replaces hand-rolled BEGIN..COMMIT so PG adapter and
+      // SQLite both get correct rollback semantics from one code path.
+      try {
+        db.transaction(() => {
+          db.run(
+            `UPDATE node_stop_requests SET status = ?1, error = ?2, exit_signal = ?3,
+                                            backup_path = ?4, acked_at = ?5
+               WHERE request_id = ?6`,
+            [status, ackError || null, exit_signal || null, backup_path || null, now, request_id],
+          );
+          if (status === "stopped" && row.action === "stop") {
+            db.run(`UPDATE nodes SET lifecycle_state = 'stopped' WHERE node_id = ?1`, [row.child_node_id]);
+            auditCreateNodeStrict({
+              action: "stop_node_completed",
+              user_id: null, network_id: row.network_id, target_id: request_id,
+              detail: {
+                child_node_id: row.child_node_id, child_alias: row.child_alias,
+                exit_signal: exit_signal || null, ts_daemon_ack: now,
+                lifecycle_state_after: "stopped",
+              },
+            });
+          } else if (status === "stopped" && row.action === "delete") {
+            // Revoke the child's ntok, then DELETE the nodes row.
+            // #1448 finding-5 — 精确按派发时定住的 child_token_id 撤(镜像
+            // ack_create_request 的 token_id 精撤)。旧行(升级前派发,child_token_id
+            // 为 NULL)fallback 回按 name='node:<alias>' 撤——旧语义,不引入回归。
+            // 按 token_id 撤避免了「同 alias 在本次 delete 窗口内被重建、拿到同名新
+            // token」时把新 token 一并误撤。
+            if (row.child_token_id) {
+              db.run(
+                `UPDATE api_tokens SET revoked_at = datetime('now')
+                   WHERE token_id = ?1 AND revoked_at IS NULL`,
+                [row.child_token_id],
+              );
+            } else {
+              db.run(
+                `UPDATE api_tokens SET revoked_at = datetime('now')
+                   WHERE network_id = ?1 AND name = ?2 AND revoked_at IS NULL`,
+                [row.network_id, `node:${row.child_alias}`],
+              );
+            }
+            db.run(`DELETE FROM nodes WHERE node_id = ?1`, [row.child_node_id]);
+            auditCreateNodeStrict({
+              action: "delete_node_completed",
+              user_id: null, network_id: row.network_id, target_id: request_id,
+              detail: {
+                child_node_id: row.child_node_id, child_alias: row.child_alias,
+                exit_signal: exit_signal || null, backup_path: backup_path || null,
+                ts_daemon_ack: now, lifecycle_state_after: "deleted",
+              },
+            });
+          } else if (status === "stop_failed") {
+            db.run(`UPDATE nodes SET lifecycle_state = 'stop_failed' WHERE node_id = ?1`, [row.child_node_id]);
+            // No completion audit; the failure error is on the request row.
+          }
+          // noop_not_my_child: leave lifecycle_state as-is; the hub-side
+          // sweeper / next reconciliation will pick it up. Don't transition.
+        });
+      } catch (e: any) {
+        console.warn(`[commhub] ✕ ack_stop_request finalize_tx_failed request=${request_id} action=${row.action} child=${row.child_alias}: ${e?.message || e}`);
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "finalize_tx_failed", message: e?.message || String(e) }) }] };
+      }
+
+      // 🔴 关键的是最后那半句「据此做了什么」。#1286 里 hub 的代码路径经核对是
+      // 正确的,缺的正是「它到底走没走那条分支」—— 只说「收到了 ack」回答不了。
+      const did = status === "stopped" && row.action === "delete"
+        ? "revoked ntok + DELETE FROM nodes"
+        : status === "stopped" && row.action === "stop"
+        ? "lifecycle_state=stopped"
+        : status === "stop_failed"
+        ? "lifecycle_state=stop_failed"
+        : "no lifecycle transition (noop_not_my_child)";
+      console.log(`[commhub] ✓ ${row.action}-node finalize: request=${request_id} child=${row.child_alias} (${row.child_node_id}) status=${status} → ${did}`);
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, status }) }] };
+    },
+  );
+
+  // start_node is deliberately daemon-mediated. A stopped child has no SSE
+  // consumer of its own, so restart_node's self-doorbell cannot revive it.
+  server.tool(
+    "start_node",
+    "Start a stopped child through its host supervisor daemon. daemon_node_id is auto-resolved from the original create request.",
+    {
+      ...NODE_ID_ALIAS_FIELDS,
+      daemon_node_id: z.string().min(1).max(200).regex(/^node_[a-z0-9_-]+$/).optional(),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ node_id, child_node_id: child_node_id_arg, daemon_node_id, network_id: clientNetId }) => {
+      const idArg = resolveNodeIdArg({ node_id, child_node_id: child_node_id_arg });
+      if (!idArg.ok) return { content: [{ type: "text" as const, text: JSON.stringify(idArg) }] };
+      const child_node_id = idArg.node_id;
+      const resolvedDaemonId = daemon_node_id ?? resolveDaemonForChild(child_node_id);
+      if (!resolvedDaemonId) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({
+          ok: false, error: "daemon_not_resolvable",
+          message: "no create request maps this child to a daemon",
+        }) }] };
+      }
+      const scope = resolveReadScope(clientNetId);
+      if (scope.denied) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "forbidden_cross_tenant" }) }] };
+      const q: any[] = [child_node_id];
+      const child = db.get<{ node_id: string; alias: string; network_id: string; lifecycle_state: string | null }>(
+        addReadScope(`SELECT node_id, alias, network_id, lifecycle_state FROM nodes WHERE node_id = ?1`, q, scope), ...q,
+      );
+      if (!child) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "forbidden_cross_tenant" }) }] };
+      if (!canWrite(child.network_id)) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "permission_denied" }) }] };
+      // #1448 finding-2 — stale-starting reaper，对齐 update_node_config / restart_node
+      // 的 60s single-flight stale-supersede。start 只受理 'stopped';一旦卡 'starting'
+      // (门铃丢 / daemon 在 UPDATE 'starting' 后死),config/restart 有 reaper、delete 有
+      // 5min force,唯独 start 裸奔 → 下面的 gate 永远拦、也无人把节点拉回 stopped →
+      // 永久卡 'starting'。出口:'starting' 且最近一条 in-flight start 请求晾过阈值 → 标
+      // 旧请求 timeout 超越、放行重派;未过阈值则拒 node_already_starting(带 age)。
+      const priorState = child.lifecycle_state ?? "active";
+      if (priorState !== "stopped") {
+        if (priorState !== "starting") {
+          return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "node_not_stopped", current_state: priorState }) }] };
+        }
+        const STALE_STARTING_MS = 60_000;
+        const inFlight = db.get<{ request_id: string; created_at: number; delivered_at: number | null; acked_at: number | null }>(
+          `SELECT request_id, created_at, delivered_at, acked_at FROM node_start_requests
+             WHERE child_node_id = ?1 AND status IN ('pending', 'delivered')
+             ORDER BY created_at DESC LIMIT 1`, child.node_id,
+        );
+        if (inFlight) {
+          // Age anchor = COALESCE(acked_at, delivered_at, created_at)，同 config reaper:
+          // 已 pull/已 ack 的活着但慢的 start 会刷新存活时钟,不被误 reap。
+          const ageAnchor = inFlight.acked_at ?? inFlight.delivered_at ?? inFlight.created_at;
+          const age = Date.now() - ageAnchor;
+          if (age <= STALE_STARTING_MS) {
+            return { content: [{ type: "text" as const, text: JSON.stringify({
+              ok: false, error: "node_already_starting",
+              existing_request_id: inFlight.request_id, age_ms: age,
+              hint: `再等一下;超过 ${STALE_STARTING_MS / 1000}s 仍卡 starting,重试 start 会重新派发`,
+            }) }] };
+          }
+          // Stale — 标旧请求 timeout(autocommit,先于下面 tx 的新 INSERT,解除
+          // node_start_requests 对 pending/delivered 的 child 唯一约束),放行重派。
+          db.run(
+            `UPDATE node_start_requests SET status = 'timeout', acked_at = ?1, error = ?2 WHERE request_id = ?3`,
+            [Date.now(), `superseded by new start after ${age}ms stale (> ${STALE_STARTING_MS}ms threshold)`, inFlight.request_id],
+          );
+        }
+        // else: 'starting' 但无 in-flight 行(异常残留态)——照样放行重派以自愈。
+      }
+      // The caller may provide daemon_node_id, but it cannot override the
+      // authoritative child->daemon relationship recorded at creation.
+      const authoritativeDaemonId = resolveDaemonForChild(child_node_id);
+      if (!authoritativeDaemonId || authoritativeDaemonId !== resolvedDaemonId) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "daemon_child_mismatch" }) }] };
+      }
+      const daemon = db.get<{ node_id: string; alias: string; network_id: string }>(
+        `SELECT node_id, alias, network_id FROM nodes WHERE node_id = ?1`, resolvedDaemonId,
+      );
+      if (!daemon) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "daemon_not_found" }) }] };
+      if (daemon.network_id !== child.network_id) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "daemon_cross_tenant" }) }] };
+      }
+      const requestId = generateId("str");
+      const now = Date.now();
+      try {
+        db.transaction(() => {
+          db.run(
+            `INSERT INTO node_start_requests
+               (request_id, network_id, daemon_node_id, child_node_id, child_alias,
+                created_by_token, status, created_at)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, 'pending', ?7)`,
+            [requestId, child.network_id, daemon.node_id, child.node_id, child.alias, callerTokenId || "unknown", now],
+          );
+          // #1448 finding-2 — 也接受从 'starting' 重派(stale-supersede 后原态仍是
+          // starting);两种入态都合法地转/留到 'starting'。
+          db.run(`UPDATE nodes SET lifecycle_state = 'starting' WHERE node_id = ?1 AND lifecycle_state IN ('stopped', 'starting')`, [child.node_id]);
+          auditCreateNodeStrict({
+            action: "start_node_dispatched", user_id: enforceUserId,
+            network_id: child.network_id, target_id: requestId,
+            detail: { child_node_id: child.node_id, child_alias: child.alias, daemon_node_id: daemon.node_id,
+              lifecycle_state_before: priorState, lifecycle_state_after: "starting", ts_request: now },
+          });
+        });
+      } catch (e: any) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "dispatch_tx_failed", message: e?.message || String(e) }) }] };
+      }
+      pushEvent(daemon.alias, { type: "start_node", request_id: requestId }, child.network_id);
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, request_id: requestId, lifecycle_state: "starting" }) }] };
+    },
+  );
+
+  server.tool(
+    "get_start_request",
+    "Host supervisor pulls an authenticated pending start request.",
+    { request_id: z.string().min(1).max(200) },
+    async ({ request_id }) => {
+      const callerDaemon = resolveCallerDaemonTokenBound();
+      if (!callerDaemon.ok) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      const row = db.get<{ daemon_node_id: string; network_id: string; child_node_id: string; child_alias: string; status: string }>(
+        `SELECT daemon_node_id, network_id, child_node_id, child_alias, status FROM node_start_requests WHERE request_id = ?1`, request_id,
+      );
+      if (!row) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "request_not_found" }) }] };
+      if (row.daemon_node_id !== callerDaemon.daemonNodeId) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "not_your_request" }) }] };
+      if (row.network_id !== callerDaemon.networkId) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "cross_network_request" }) }] };
+      if (!['pending', 'delivered'].includes(row.status)) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "request_not_startable", status: row.status }) }] };
+      db.run(`UPDATE node_start_requests SET status='delivered', delivered_at=?1 WHERE request_id=?2 AND status='pending'`, [Date.now(), request_id]);
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, request_id, child_node_id: row.child_node_id, child_alias: row.child_alias }) }] };
+    },
+  );
+
+  server.tool(
+    "ack_start_request",
+    "Host supervisor reports start completion or failure.",
+    {
+      request_id: z.string().min(1).max(200),
+      status: z.enum(["started", "start_failed"]),
+      child_pid: z.number().int().positive().optional(),
+      error: z.string().max(1000).optional(),
+    },
+    async ({ request_id, status, child_pid, error: ackError }) => {
+      const callerDaemon = resolveCallerDaemonTokenBound();
+      if (!callerDaemon.ok) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      const row = db.get<{ daemon_node_id: string; network_id: string; child_node_id: string; child_alias: string; status: string }>(
+        `SELECT daemon_node_id, network_id, child_node_id, child_alias, status FROM node_start_requests WHERE request_id=?1`, request_id,
+      );
+      if (!row) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "request_not_found" }) }] };
+      if (row.daemon_node_id !== callerDaemon.daemonNodeId) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "not_your_request" }) }] };
+      if (row.network_id !== callerDaemon.networkId) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "cross_network_request" }) }] };
+      if (row.status === "started" || row.status === "start_failed") {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, status: row.status, idempotent: true }) }] };
+      }
+      if (!['pending', 'delivered'].includes(row.status)) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "request_not_ackable", status: row.status }) }] };
+      }
+      if (status === "started" && !child_pid) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "child_pid_required" }) }] };
+      }
+      const now = Date.now();
+      try {
+        db.transaction(() => {
+          db.run(`UPDATE node_start_requests SET status=?1,error=?2,child_pid=?3,acked_at=?4 WHERE request_id=?5`, [status, ackError || null, child_pid || null, now, request_id]);
+          db.run(`UPDATE nodes SET lifecycle_state=?1 WHERE node_id=?2`, [status === "started" ? "active" : "stopped", row.child_node_id]);
+          if (status === "started") auditCreateNodeStrict({
+            action: "start_node_completed", network_id: row.network_id, target_id: request_id,
+            detail: { child_node_id: row.child_node_id, child_alias: row.child_alias, child_pid, lifecycle_state_after: "active", ts_daemon_ack: now },
+          });
+        });
+      } catch (e: any) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "finalize_tx_failed", message: e?.message || String(e) }) }] };
+      }
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, status }) }] };
+    },
+  );
+
+  // RFC-027 PR1.1 — list_my_children: daemon-only query. Returns the
+  // {child_node_id, alias, lifecycle_state} tuples for nodes whose
+  // active create-request has this daemon as daemon_node_id. Used at
+  // daemon boot to rebuild the in-memory childrenMap (PR1 dropped
+  // every entry on daemon restart → stop/delete silently no-op'd).
+  //
+  // Network-scope is the daemon's own (resolveCallerDaemonTokenBound
+  // already binds tokenIsNetwork to a single network). No SEC-1 leak:
+  // returns ONLY children whose request landed under this daemon's
+  // token + network.
+  server.tool(
+    "list_my_children",
+    "Daemon pulls the alias + node_id list of children it spawned (for childrenMap rebuild after restart). RFC-027 PR1.1.",
+    {},
+    async () => {
+      const callerDaemon = resolveCallerDaemonTokenBound();
+      if (!callerDaemon.ok) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      }
+      // node_create_requests carries the canonical authoritative
+      // child→daemon mapping (the row id IS the request, and the
+      // child node_id derives from it deterministically via
+      // `node_${request_id.replace(/^cr_/, "")}`). Filter to children
+      // that completed registration (have a nodes row) so we don't
+      // ask the daemon to pgrep for children that never came up.
+      const rows = db.all<{ request_id: string; child_name: string; child_node_id: string; lifecycle_state: string | null }>(
+        `SELECT ncr.request_id, ncr.child_name,
+                ('node_' || substr(ncr.request_id, 4)) AS child_node_id,
+                n.lifecycle_state
+           FROM node_create_requests ncr
+           LEFT JOIN nodes n ON n.node_id = ('node_' || substr(ncr.request_id, 4))
+          WHERE ncr.daemon_node_id = ?1
+            AND ncr.network_id = ?2
+            AND ncr.status IN ('succeeded', 'delivered')
+            AND n.node_id IS NOT NULL
+            AND COALESCE(n.lifecycle_state, 'active') NOT IN ('stopped', 'stop_failed')`,
+        callerDaemon.daemonNodeId, callerDaemon.networkId,
+      );
+      const children = rows.map(r => ({
+        child_node_id: r.child_node_id,
+        alias: r.child_name,
+        lifecycle_state: r.lifecycle_state ?? "active",
+      }));
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, count: children.length, children }) }] };
+    },
+  );
+
   // ── RFC-028 P1 — Provider & Model Registry + connectivity probe ──
   // Background timers (probe GC + sweeper) idempotent; safe to call
   // per registerTools.
@@ -2516,6 +5502,15 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       const willReplaceModels = patch.models !== undefined;
       const newModelIds: string[] = [];
 
+      // No-op early return (通信牛 nit): all patch fields matched the
+      // existing row values + no models supplied → no real change to
+      // persist. Returning here means we don't write an empty-diff
+      // audit row (audit noise). Audit_log INSERT must only fire when
+      // something actually changed.
+      if (sets.length === 0 && !willReplaceModels) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, provider_id, no_changes: true, hint: "patch fields matched existing row, no-op" }) }] };
+      }
+
       try {
         db.exec("BEGIN");
         if (sets.length > 0) {
@@ -2554,10 +5549,6 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
         throw e;
       }
 
-      if (Object.keys(diff).length === 0 && !willReplaceModels) {
-        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, provider_id, no_changes: true, hint: "patch fields matched existing row, no-op" }) }] };
-      }
-
       return { content: [{ type: "text" as const, text: JSON.stringify({
         ok: true, provider_id,
         fields_changed: Object.keys(diff),
@@ -2750,6 +5741,110 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
     },
   );
+
+  // ── 需求池 / 任务看板(Agent 读写任务,例如把 GitHub issue 同步成任务) ──
+  // 全部走 REST 同一个处理函数(requirements.ts handleRequirementsRequest):权限、校验、谁做的记录只有一份。
+  // 节点令牌只在它绑定的网络里读 / 建 / 改 / 勾子任务 / upsert / 读项目;删除和管理项目只给人。
+  const requirementsCall = async (method: string, path: string, clientNetId?: string | null, body?: Record<string, unknown>) => {
+    const scope = resolveRestNetworkScope(enforceNetworkId ? null : (clientNetId ?? null), mcpAuthCtx, false);
+    if (scope.denied) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "access_denied", message: scope.denied }) }] };
+    const url = new URL(`http://mcp.internal${path}`);
+    const req = new Request(url, { method, headers: { "content-type": "application/json" }, body: body ? JSON.stringify(body) : undefined });
+    const res = await handleRequirementsRequest({
+      req, url,
+      auth: mcpAuthCtx ? { ...mcpAuthCtx, username: "", tokenId: callerTokenId ?? null, tokenName: callerTokenIsNetwork && callerAlias ? `node:${callerAlias}` : null } : null,
+      isAdmin: false,
+      isNodeToken: callerTokenIsNetwork,
+      scope,
+    });
+    const data = res ? await res.json() : { ok: false, error: "not_found" };
+    return { content: [{ type: "text" as const, text: JSON.stringify(res && !res.ok && data && typeof data === "object" ? { ...data, status: res.status } : data) }] };
+  };
+  const reqPerson = z.object({ kind: z.enum(["user", "node"]), id: z.string().min(1).max(200) });
+  const reqChecklistItem = z.object({ id: z.string().regex(/^[A-Za-z0-9_-]{1,40}$/).optional(), text: z.string().min(1).max(500), done: z.boolean().optional() });
+  const reqFields = {
+    tags: z.array(z.string()).max(10).optional().describe("Task labels; each 1–20 Unicode characters. Omit to preserve, [] to clear."),
+    name: z.string().min(1).max(80).optional(),
+    priority: z.enum(["high", "normal", "low", "lowest"]).optional().describe("high = P0 最高, normal = P1 普通, low = P2 低, lowest = P3 极低"),
+    column: z.enum(["pool", "doing", "done"]).optional(),
+    due: z.string().max(40).optional().describe("YYYY-MM-DD (all day) or ISO 8601 with Z / ±HH:MM (stored as UTC seconds); \"\" clears"),
+    description: z.string().max(20_000).optional().describe("markdown"),
+    checklist: z.array(reqChecklistItem).max(100).optional().describe("replaces the whole list"),
+    project_id: z.string().max(200).nullable().optional(),
+    owner: reqPerson.nullable().optional().describe("负责人: must be {kind:'user'}"),
+    agent_owner: reqPerson.nullable().optional().describe("负责 Agent: must be {kind:'node'}"),
+    participants: z.array(reqPerson).max(100).optional(),
+    external_url: z.string().max(500).nullable().optional(),
+    parent_id: z.string().regex(/^[A-Za-z0-9_-]{1,200}$/).nullable().optional().describe("parent requirement (same network, no cycles, ≤ 5 levels); null detaches"),
+  };
+  const pick = (args: Record<string, unknown>, keys: string[]) => Object.fromEntries(keys.filter(k => args[k] !== undefined).map(k => [k, args[k]]));
+  const REQ_WRITE_KEYS = [...Object.keys(reqFields), "external_ref", "archived"];
+
+  server.tool(
+    "requirements_list",
+    "List requirement tasks in your network. Filters: status (pool/doing/done), project_id ('none' = no project), owner / agent_owner ('user:<id>' / 'node:<id>' / 'none'), updated_since (ISO), external_ref, parent_id / top_level, include_archived. Newest first, max 500. Each task carries children {total, done}.",
+    {
+      network_id: z.string().max(200).optional(),
+      status: z.enum(["pool", "doing", "done"]).optional(),
+      project_id: z.string().max(200).optional(),
+      owner: z.string().max(210).optional(),
+      agent_owner: z.string().max(210).optional(),
+      updated_since: z.string().max(40).optional(),
+      external_ref: z.string().max(200).optional(),
+      include_archived: z.boolean().optional(),
+      parent_id: z.string().max(200).optional().describe("children of this requirement ('none' = top level)"),
+      top_level: z.boolean().optional(),
+    },
+    async (args) => {
+      const q = new URLSearchParams();
+      for (const k of ["status", "project_id", "owner", "agent_owner", "updated_since", "external_ref", "parent_id"] as const) if (args[k] !== undefined) q.set(k, String(args[k]));
+      if (args.include_archived) q.set("include_archived", "1");
+      if (args.top_level) q.set("top_level", "1");
+      return requirementsCall("GET", `/api/requirements${q.size ? `?${q}` : ""}`, args.network_id);
+    },
+  );
+
+  server.tool(
+    "requirements_get",
+    "Get one requirement task by id (with description, checklist, owners, project, external_ref).",
+    { id: z.string().min(1).max(200), network_id: z.string().max(200).optional() },
+    async ({ id, network_id }) => requirementsCall("GET", `/api/requirements/${encodeURIComponent(id)}`, network_id),
+  );
+
+  server.tool(
+    "requirements_create",
+    "Create a requirement task. name is required. A duplicate external_ref in the network returns 409 external_ref_exists with existing_id — use requirements_upsert_by_external_ref for syncing.",
+    { network_id: z.string().max(200).optional(), ...reqFields, name: z.string().min(1).max(80), external_ref: z.string().max(200).optional() },
+    async (args) => requirementsCall("POST", "/api/requirements", args.network_id, pick(args, REQ_WRITE_KEYS)),
+  );
+
+  server.tool(
+    "requirements_update",
+    "Patch a requirement task; omitted fields keep their value. archived=true hides it from the default list (agents cannot delete).",
+    { id: z.string().min(1).max(200), network_id: z.string().max(200).optional(), ...reqFields, external_ref: z.string().max(200).nullable().optional(), archived: z.boolean().optional() },
+    async (args) => requirementsCall("PATCH", `/api/requirements/${encodeURIComponent(args.id)}`, args.network_id, pick(args, REQ_WRITE_KEYS)),
+  );
+
+  server.tool(
+    "requirements_checklist_toggle",
+    "Set one checklist item done / not done (only that item is written, so concurrent edits of other items are kept).",
+    { id: z.string().min(1).max(200), item_id: z.string().regex(/^[A-Za-z0-9_-]{1,40}$/), done: z.boolean(), network_id: z.string().max(200).optional() },
+    async ({ id, item_id, done, network_id }) => requirementsCall("PATCH", `/api/requirements/${encodeURIComponent(id)}/checklist/${encodeURIComponent(item_id)}`, network_id, { done }),
+  );
+
+  server.tool(
+    "requirements_upsert_by_external_ref",
+    "Idempotent sync: create the task for external_ref (e.g. github:owner/repo#123) or, if it already exists in the network, patch it (omitted fields — including status — are kept). Returns { requirement, created }.",
+    { network_id: z.string().max(200).optional(), external_ref: z.string().min(1).max(200), ...reqFields, archived: z.boolean().optional() },
+    async (args) => requirementsCall("POST", "/api/requirements/upsert", args.network_id, pick(args, REQ_WRITE_KEYS)),
+  );
+
+  server.tool(
+    "projects_list",
+    "List requirement projects in your network (id, name, color, sort, archived).",
+    { network_id: z.string().max(200).optional() },
+    async ({ network_id }) => requirementsCall("GET", "/api/requirements/projects", network_id),
+  );
 }
 
 // ────────────────────────────────────────────────────────────────────
@@ -2767,6 +5862,8 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
 export interface UpsertNodeWithSec1GuardInput {
   node_id: string;
   callerNetworkId: string | null;
+  callerUserId?: string | null;
+  callerTokenId?: string | null;
   node_name?: string | null;
   alias?: string | null;
   runtime?: string | null;
@@ -2779,19 +5876,60 @@ export interface UpsertNodeWithSec1GuardInput {
 }
 export type UpsertNodeOutcome =
   | { result: "inserted" | "updated"; node_id: string }
-  | { result: "refused"; reason: "cross_network"; existingNet: string | null; callerNet: string | null }
+  | { result: "refused"; reason: "cross_network" | "token_node_mismatch" | "owner_mismatch"; existingNet: string | null; callerNet: string | null }
   | { result: "skipped"; reason: "missing_node_id" };
 
 const _norm = (x: string | null | undefined) => (x === null || x === undefined ? "default" : x);
 
+/**
+ * A capability that changes peer delivery semantics is trusted only when the
+ * authenticating ntok is immutably bound to the exact reported node. Legacy
+ * alias-only tokens may still heartbeat, but cannot opt a node into #698.
+ */
+export function trustedConfigSnapshotForNode(
+  snapshot: unknown | null | undefined,
+  callerTokenId: string | null | undefined,
+  nodeId: string,
+): unknown | null | undefined {
+  if (!snapshot || typeof snapshot !== "object") return snapshot;
+  const copy = { ...(snapshot as Record<string, unknown>) };
+  const token = callerTokenId
+    ? db.get<{ bound_node_id: string | null }>(
+      "SELECT bound_node_id FROM api_tokens WHERE token_id = ?1",
+      callerTokenId,
+    )
+    : null;
+  if (token?.bound_node_id !== nodeId) delete copy.peer_reply_inbox_capable;
+  return copy;
+}
+
 export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): UpsertNodeOutcome {
   if (!input.node_id) return { result: "skipped", reason: "missing_node_id" };
-  const existing = db.get<{ network_id: string | null }>(
-    "SELECT network_id FROM nodes WHERE node_id = ?1",
+  const existing = db.get<{ network_id: string | null; owner_user_id: string | null }>(
+    "SELECT network_id, owner_user_id FROM nodes WHERE node_id = ?1",
     input.node_id,
   );
   const callerNet = input.callerNetworkId;
 
+  // RFC-036 — when a token was minted with a node_id binding, a heartbeat may
+  // report only that exact node. Legacy unbound ntok rows remain compatible,
+  // but they can never consume owner-gated schedule intents.
+  if (input.callerTokenId) {
+    const token = db.get<{ bound_node_id: string | null; user_id: string; network_id: string | null }>(
+      "SELECT bound_node_id, user_id, network_id FROM api_tokens WHERE token_id = ?1",
+      input.callerTokenId,
+    );
+    if (token?.bound_node_id && token.bound_node_id !== input.node_id) {
+      return { result: "refused", reason: "token_node_mismatch", existingNet: existing?.network_id ?? null, callerNet };
+    }
+    if (token?.network_id && _norm(token.network_id) !== _norm(callerNet)) {
+      return { result: "refused", reason: "cross_network", existingNet: existing?.network_id ?? null, callerNet };
+    }
+  }
+  if (existing?.owner_user_id && input.callerUserId !== existing.owner_user_id) {
+    return { result: "refused", reason: "owner_mismatch", existingNet: existing.network_id, callerNet };
+  }
+
   // Legacy / first-write paths: row missing OR network_id NULL → claim.
   const isLegacy = !existing
     || existing.network_id === null
@@ -2837,17 +5975,29 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
       callerNet ?? null,
     ],
   );
-  if (input.config_snapshot) {
-    // RFC-026 §9.3 / #338 PR2 — promote daemon self-declare fields to
-    // first-class indexable columns alongside the snapshot blob. The
-    // snapshot stays the source of truth for non-list reads; the columns
-    // exist so `list_host_supervisors` doesn't JSON.parse on every call.
-    // typeof-narrow the array fields (don't trust shape per
-    // [[feedback_typeof_narrow_extracted_fields]]; zod has already
-    // narrowed, but the input.config_snapshot type is `unknown` here).
-    const snap = input.config_snapshot as Record<string, unknown> | null;
-    const runtimesRaw = snap?.runtimes_supported;
-    const allowedRaw = snap?.allowed_secret_keys;
+  const trustedSnapshot = trustedConfigSnapshotForNode(
+    input.config_snapshot,
+    input.callerTokenId,
+    input.node_id,
+  );
+  if (trustedSnapshot) {
+    // RFC-026 §9.3 / #338 PR2+PR3 — promote daemon self-declare fields
+    // to first-class indexable columns alongside the snapshot blob.
+    // The snapshot stays the source of truth for non-list reads; the
+    // columns exist so `list_host_supervisors` doesn't JSON.parse on
+    // every call. typeof-narrow per
+    // per team rule (typeof-narrow extracted JSON fields at the boundary) — zod narrowed but
+    // input.config_snapshot is typed `unknown` here.
+    //
+    // PR3 nit ①: read from nested `daemon_capabilities.*` (canonical
+    // per RFC §9.3 + matches existing hub create_node reads at
+    // tools.ts:2010/2075). PR2 ate from top-level keys, which the
+    // hub create_node path never read → max_concurrent_children
+    // backpressure was dead config + allowlist enforcement bypassed.
+    const snap = trustedSnapshot as Record<string, unknown> | null;
+    const caps = (snap?.daemon_capabilities ?? null) as Record<string, unknown> | null;
+    const runtimesRaw = caps?.runtimes_supported;
+    const allowedRaw = caps?.allowed_secret_keys;
     const runtimesJson = Array.isArray(runtimesRaw) && runtimesRaw.every(s => typeof s === "string")
       ? JSON.stringify(runtimesRaw)
       : null;
@@ -2856,7 +6006,7 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
       : null;
     db.run(
       `UPDATE nodes SET config_snapshot = ?1, runtimes_supported = ?2, allowed_secret_keys = ?3 WHERE node_id = ?4`,
-      [JSON.stringify(input.config_snapshot), runtimesJson, allowedJson, input.node_id],
+      [JSON.stringify(trustedSnapshot), runtimesJson, allowedJson, input.node_id],
     );
     // RFC-024 — finalize any pending/restarting update whose target
     // patch is now reflected in the snapshot. Closes the
@@ -2866,7 +6016,7 @@ export function upsertNodeWithSec1Guard(input: UpsertNodeWithSec1GuardInput): Up
     // update_id to call ack_config_update(applied) itself. Hub does
     // it on the new child's behalf by content-matching the patch
     // against the reported snapshot.
-    finalizePendingMatchingUpdates(input.node_id, input.config_snapshot);
+    finalizePendingMatchingUpdates(input.node_id, trustedSnapshot);
   }
   // RFC-026 §2.5 step 4 — on every register/report_status, opportunistically
   // close out any pending create_node request whose child_name matches
@@ -2926,6 +6076,15 @@ export function finalizePendingMatchingUpdates(
 
   const snapModel: string | null | undefined = snapshot?.model;
   const snapFlags: Record<string, unknown> = (snapshot?.flags && typeof snapshot.flags === "object") ? snapshot.flags : {};
+  // #260 P5 — snapshot.channels is the (sorted, bare-type) channel set
+  // the node currently has forked. agent-node's buildConfigSnapshot
+  // always emits it (even as []), so the "absent field" case here means
+  // an older pre-#260-P5 agent-node — for those, don't finalize a
+  // channels-carrying patch (would false-positive on the OTHER fields).
+  const snapChannelsPresent = Array.isArray(snapshot?.channels);
+  const snapChannels: string[] = snapChannelsPresent
+    ? (snapshot.channels as unknown[]).filter((c): c is string => typeof c === "string")
+    : [];
 
   const finalizedIds: string[] = [];
 
@@ -2950,6 +6109,35 @@ export function finalizePendingMatchingUpdates(
           if (snapFlags[k] !== v) { matches = false; break; }
         }
       }
+      // #260 P5 — channels field content-match. Without this the
+      // node's very first startup report_status matches (patch.flags
+      // is `{}` for a channels-only update, so the flags loop is
+      // trivially satisfied) and hub prematurely marks the update
+      // applied, deleting the pending row + bumping config_revision
+      // BEFORE the doorbell reaches the child. Codex catch on PR #411.
+      //
+      // Set-equality is enough because the patch side comes from
+      // narrowChannelsPatch → already deduped + case-folded + in
+      // EDITABLE_CHANNELS iteration order; the snapshot side comes
+      // from buildConfigSnapshot which mirrors the same shape.
+      if (matches && Array.isArray(patch.channels)) {
+        if (!snapChannelsPresent) {
+          // Pre-#260-P5 agent-node — no channels field in snapshot,
+          // so we can't prove the apply landed. Skip finalize; hub's
+          // F-B reaper still supersedes this eventually.
+          matches = false;
+        } else {
+          const wanted = new Set<string>(patch.channels);
+          const have = new Set<string>(snapChannels);
+          if (wanted.size !== have.size) {
+            matches = false;
+          } else {
+            for (const w of wanted) {
+              if (!have.has(w)) { matches = false; break; }
+            }
+          }
+        }
+      }
     }
 
     if (!matches) continue;