dsh-kingdom 0.8.0 → 2.0.0

package/lib/index.js

@@ -1,21 +1,156 @@
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import z from '@deepseek-ai/schemastery';
-import { randomUUID } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
 import { hostname } from 'node:os';
 import { KingdomManager } from './core/kingdom.js';
 import { DshRuntimeAdapter } from './adapter/dsh-backend.js';
 import { runGovernedTask } from './worker/governed-executor.js';
-import { settleAndRelease } from './dispatch/service.js';
-import { bindRole, listBindings, rebindSession, setExecutionProfile, unbindRole } from './core/binding.js';
+import { advanceCollaboration } from './worker/collaboration.js';
+import { proposeCollaborationPlan } from './core/collaboration.js';
+import { settleAndRelease, reconcileGovernedDispatch, discardGovernedRecoveryContexts } from './dispatch/service.js';
+import { submitGovernedClaim } from './core/governed-claim.js';
+import { recordDispatchUsage } from './core/usage.js';
+import { observeDshDispatchUsage } from './adapter/dsh-usage.js';
+import { ToolDisclosureRuntime, DISCOVERY_TOOL_NAME } from './capability/tool-disclosure.js';
+import { installRuntimeCostObservers } from './runtime-cost-observer.js';
+import { setCapabilityCeiling } from './capability/admin.js';
+import { bindRole, listBindings, parseExecutionProfile, rebindSession, resolveBinding, setExecutionProfile, unbindRole, } from './core/binding.js';
+import { createRunnerContextPort } from './core/governed.js';
+import { forgetRunnerContextPort, getRunnerContextPort, revokeRunnerContextBrokerContext, } from './runner-context-broker.js';
+import { asExecutionState, isTerminalExecutionState } from './core/execution.js';
 import { createTerritory, deleteTerritory, listTerritories, setTerritorySupervisor } from './core/territory.js';
-import { abortExecution, assignTask, listTasks, pauseExecution, planTask, reclaimOrphanExecutions, resumeExecution, reviewTask, startTask, } from './core/task-service.js';
+import { abortExecution, assignTask, listTasks, pauseExecution, planTask, reclaimOrphanExecutions, resolveGovernedStartSupervisor, resumeExecution, reviewTask, startTask, } from './core/task-service.js';
 import { buildSnapshot, buildTaskDetail, toEventView } from './gui/snapshot.js';
 import { startGuiServer } from './gui/server.js';
-import { guiWriteGuard } from './gui/contract.js';
+import { DuplicateJsonKeyError, GUI_OWNER_ONLY_HTTP_COMMANDS, GUI_SESSION_COMMANDS, GUI_START_SANDBOX_MODES, parseStrictJsonObject, } from './gui/control-contract.js';
+import { LOCAL_CONTROL_LAUNCH_PATH, LocalControlManager } from './gui/local-control.js';
+import { OwnerLocalControlManager } from './gui/owner-control.js';
+import { OwnerDecisionController } from './core/owner-window.js';
 import { resolveWorkerExecution } from './worker/executor-factory.js';
+import { issueOwnerControlCapability, ownerControlAuth, } from './core/owner-control.js';
+import { draftOwnerBindingIntent, draftOwnerBindingIntentFromRejectedWrite, serializeOwnerBindingIntentDraft, } from './core/owner-binding-intent.js';
 export const name = 'dsh-kingdom';
 export const inject = ['tools', 'commands'];
+function exactRuntimeToken(value) {
+    return typeof value === 'string'
+        && value.length > 0
+        && value === value.trim()
+        && !/[\s\u0000-\u001f\u007f]/u.test(value);
+}
+function agentSession(agent) {
+    if (typeof agent !== 'object' || agent === null)
+        return null;
+    const candidate = agent;
+    if (typeof candidate.session !== 'object' || candidate.session === null)
+        return null;
+    const session = candidate.session;
+    if (!exactRuntimeToken(candidate.id) || !exactRuntimeToken(session.id))
+        return null;
+    return { agent: candidate, session, sessionId: candidate.id };
+}
+function failClassification(classification, sessionId, reason) {
+    return { classification, sessionId, reason };
+}
+/**
+ * Resolve the exact DSH Tool caller.  A non-empty session id is only a target
+ * reference; it becomes an ACTIVE Principal after every public identity/life
+ * check succeeds.  In particular, tool arguments are not accepted here.
+ */
+export function resolveTrustedToolSession(execution, seam) {
+    const target = agentSession(execution?.agent);
+    if (!target)
+        return failClassification('ABSENT', null, '缺少 exact exec.agent.session.id。');
+    const agents = seam.agents;
+    const sessions = seam.sessions;
+    if (!agents || !sessions || typeof agents.currentInitiator !== 'function'
+        || typeof agents.get !== 'function' || typeof sessions.get !== 'function') {
+        return failClassification('UNKNOWN', target.sessionId, 'DSH agents/sessions registry seam 不完整。');
+    }
+    try {
+        const initiator = agents.currentInitiator();
+        if (initiator !== target.agent) {
+            return failClassification('FOREIGN', target.sessionId, 'exec.agent 不是当前 DSH current initiator。');
+        }
+        if (agents.get(target.sessionId) !== target.agent) {
+            return failClassification('FOREIGN', target.sessionId, 'agents.get 未返回同一 live Agent 对象。');
+        }
+        if (typeof agents.list === 'function') {
+            const matches = agents.list().filter(item => agentSession(item)?.sessionId === target.sessionId);
+            if (matches.length !== 1) {
+                return failClassification('MULTIPLE', target.sessionId, 'live Agent registry 未能证明 target 唯一。');
+            }
+        }
+        if (sessions.get(target.sessionId) !== target.session) {
+            return failClassification('FOREIGN', target.sessionId, 'sessions.get 未返回同一 live Session 对象。');
+        }
+        if (target.agent.id !== target.session.id) {
+            return failClassification('FOREIGN', target.sessionId, 'Agent id 与 Session id 不一致。');
+        }
+        if (target.agent.status === 'expired') {
+            return failClassification('EXPIRED', target.sessionId, 'Agent/Session 已过期。');
+        }
+        if (target.agent.status !== 'running') {
+            return failClassification('UNKNOWN', target.sessionId, `Agent status=${String(target.agent.status)} 不是 running。`);
+        }
+        if (execution?.signal?.aborted !== false) {
+            return failClassification(execution?.signal?.aborted === true ? 'ABORTED' : 'UNKNOWN', target.sessionId, execution?.signal?.aborted === true ? 'Tool execution signal 已 aborted。' : '缺少未 aborted 的 Tool execution signal。');
+        }
+        return {
+            classification: 'ACTIVE',
+            sessionId: target.sessionId,
+            agent: target.agent,
+            session: target.session,
+        };
+    }
+    catch (error) {
+        return failClassification('UNKNOWN', target.sessionId, `DSH registry lookup 失败：${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/** Validate a direct Owner Slash target without requiring current-initiator scope. */
+export function validateLiveDirectSession(sessionId, seam) {
+    if (!exactRuntimeToken(sessionId)) {
+        return { ok: false, classification: 'ABSENT', reason: 'session_id 必须是非空 exact token。' };
+    }
+    const agents = seam.agents;
+    const sessions = seam.sessions;
+    if (!agents || !sessions || typeof agents.get !== 'function' || typeof sessions.get !== 'function') {
+        return { ok: false, classification: 'UNKNOWN', reason: 'DSH agents/sessions registry seam 不完整。' };
+    }
+    try {
+        const agent = agents.get(sessionId);
+        const target = agentSession(agent);
+        if (!target || target.sessionId !== sessionId || agent !== target.agent) {
+            return { ok: false, classification: 'ABSENT', reason: 'session_id 不对应 live Agent。' };
+        }
+        if (typeof agents.list === 'function') {
+            const matches = agents.list().filter(item => agentSession(item)?.sessionId === sessionId);
+            if (matches.length !== 1) {
+                return { ok: false, classification: 'MULTIPLE', reason: 'live Agent registry 未能证明 session 唯一。' };
+            }
+        }
+        if (sessions.get(sessionId) !== target.session) {
+            return { ok: false, classification: 'FOREIGN', reason: 'sessions.get 未返回绑定的 live Session 对象。' };
+        }
+        if (target.agent.id !== target.session.id) {
+            return { ok: false, classification: 'FOREIGN', reason: 'Agent id 与 Session id 不一致。' };
+        }
+        if (target.agent.status !== 'idle' && target.agent.status !== 'running') {
+            return { ok: false, classification: 'EXPIRED', reason: `Agent status=${String(target.agent.status)} 不可作为 live session。` };
+        }
+        return { ok: true, sessionId, agent: target.agent, session: target.session };
+    }
+    catch (error) {
+        return { ok: false, classification: 'UNKNOWN', reason: `DSH registry lookup 失败：${error instanceof Error ? error.message : String(error)}` };
+    }
+}
 export const Config = z.object({
+    toolDisclosure: z.object({
+        mode: z.union(['off', 'pilot']).default('off'),
+        residentTools: z.array(z.string()).default([]),
+        phaseTools: z.array(z.string()).default([]),
+        maxResults: z.number().default(3),
+        maxResultBytes: z.number().default(12000),
+    }).default({ mode: 'off', residentTools: [], phaseTools: [], maxResults: 3, maxResultBytes: 12000 }),
     kingdomName: z.string().default('My Kingdom'),
     ownerName: z.string().default(''),
     /** Worker 执行用的 subagent provider（dsh base bundle 默认注册 spawn / fork）。 */
@@ -25,7 +160,7 @@ export const Config = z.object({
      * 设为非零值即启用，只绑定 127.0.0.1。
      */
     guiPort: z.number().default(0),
-    /** 可选 bearer token；设置后 GUI 所有请求都要带 Authorization 头。 */
+    /** Role GUI 可选 bearer；独立 Owner 路由使用其直接激活的短期凭据，不升级 Role 权限。 */
     guiToken: z.string().default(''),
     /** CORS 允许的 Origin 列表；默认放开（服务只绑本机回环）。 */
     guiAllowOrigins: z.array(z.string()).default(['*']),
@@ -43,7 +178,134 @@ export const Config = z.object({
      */
     migrateV4: z.boolean().default(false),
 });
-export function apply(ctx, config) {
+/** Smallest capability fact used by the GUI thin slice's governed path. */
+export const MINIMAL_CAPABILITY_JSON = '{"tool:pwsh":true}';
+// R20 public root surface.  These helpers carry transport bootstrap only;
+// Product registration/settlement helpers remain private to this module.
+export { connectRunnerContextBroker, createRunnerContextBrokerLaunch, createRunnerContextBrokerProductLifecycle, } from './runner-context-broker.js';
+const GUI_OWNER_ONLY_COMMAND_SET = new Set(GUI_OWNER_ONLY_HTTP_COMMANDS);
+/**
+ * Format the direct GUI activation result without accepting any launch secret
+ * as presentation data.  The ticket is handed only to the local URL opener;
+ * command/done persistence, logger output, and domain events receive this
+ * clean result instead.
+ */
+export function formatGuiLaunchCommandResult(origin, expiresAt, browserOpened) {
+    const cleanUrl = `${origin}${LOCAL_CONTROL_LAUNCH_PATH}`;
+    return browserOpened
+        ? {
+            kind: 'success',
+            text: `GUI Control Session 已激活：${cleanUrl}；expiresAt=${expiresAt}。已请求在本机浏览器打开 Console。`,
+        }
+        : {
+            kind: 'error',
+            text: `GUI Control Session 已激活：${cleanUrl}；expiresAt=${expiresAt}。本机浏览器自动打开失败；未输出一次性 launch ticket，请重新执行 /kingdom gui 后重试。`,
+        };
+}
+function throwOnGuiSetupFailure(value) {
+    if (/^(?:错误：|OWNER_CONTROL_REQUIRED|CONFIG_DENIED|UNKNOWN\/)/u.test(value))
+        throw new Error(value);
+}
+/** Reuse an ACTIVE same-name Territory without changing its topology. */
+export function ensureGuiSetupTerritory(store, input, auth) {
+    const name = input.name.trim();
+    const workspacePath = input.workspacePath?.trim() || null;
+    const existing = store.getTerritoryByName(input.kingdomId, name);
+    if (existing) {
+        if (existing.status !== 'ACTIVE') {
+            throw new Error(`错误：setup.basic 不能复用 ${existing.status} 领地「${name}」；不会自动改写拓扑。`);
+        }
+        if (workspacePath !== null && existing.workspace_path !== workspacePath) {
+            throw new Error(`错误：setup.basic 同名领地「${name}」的 workspace 冲突（已有 ${existing.workspace_path ?? '未设置'}，请求 ${workspacePath}）；不会自动改写拓扑。`);
+        }
+        return existing;
+    }
+    try {
+        const result = createTerritory(store, {
+            kingdomId: input.kingdomId,
+            name,
+            workspacePath: workspacePath ?? undefined,
+        }, auth);
+        throwOnGuiSetupFailure(result);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        if (/UNIQUE constraint failed: territories/u.test(detail)) {
+            throw new Error(`错误：setup.basic 同名领地「${name}」已有 DELETED/tombstone 记录；不会自动重建或改写拓扑。`);
+        }
+        throw error;
+    }
+    const created = store.getTerritoryByName(input.kingdomId, name);
+    if (!created)
+        throw new Error('错误：setup.basic 创建后找不到 Territory。');
+    return created;
+}
+/** Ensure setup role identity without ever binding a Worker to the activator. */
+export function ensureGuiSetupBinding(store, input, auth) {
+    const existing = store.getBindingByRole(input.kingdomId, input.roleType);
+    if (!existing) {
+        const result = bindRole(store, {
+            kingdomId: input.kingdomId,
+            roleType: input.roleType,
+            roleName: input.roleName,
+            sessionId: input.sessionId,
+        }, auth);
+        throwOnGuiSetupFailure(result);
+        const created = store.getBindingByRole(input.kingdomId, input.roleType);
+        if (!created)
+            throw new Error(`错误：setup.basic 创建 ${input.roleType} 后找不到 binding。`);
+        return created;
+    }
+    if ((input.roleType === 'CHANCELLOR' || input.roleType === 'SUPERVISOR')
+        && existing.session_id !== input.sessionId) {
+        const result = rebindSession(store, {
+            kingdomId: input.kingdomId,
+            bindingId: existing.binding_id,
+            sessionId: input.sessionId,
+        }, auth);
+        throwOnGuiSetupFailure(result);
+        return store.getBindingById(existing.binding_id) ?? existing;
+    }
+    return existing;
+}
+function sameGuiExecutionProfile(current, desired) {
+    return (current?.model ?? null) === (desired.model ?? null)
+        && (current?.provider ?? null) === (desired.provider ?? null);
+}
+/** Set the requested Worker profile only when its semantic value changes. */
+export function ensureGuiSetupExecutionProfile(store, input, auth) {
+    const binding = store.getBindingById(input.bindingId);
+    if (!binding || binding.kingdom_id !== input.kingdomId) {
+        throw new Error(`错误：找不到当前王国的 Worker binding ${input.bindingId}。`);
+    }
+    if (sameGuiExecutionProfile(parseExecutionProfile(binding.execution_profile_json), input.profile)) {
+        return null;
+    }
+    const result = setExecutionProfile(store, {
+        kingdomId: input.kingdomId,
+        bindingId: input.bindingId,
+        profile: input.profile,
+    }, auth);
+    throwOnGuiSetupFailure(result);
+    return result;
+}
+/** Set Territory scope only when the target Supervisor binding changes. */
+export function ensureGuiSetupTerritorySupervisor(store, input, auth) {
+    const territory = store.getTerritoryById(input.territoryId);
+    if (!territory || territory.kingdom_id !== input.kingdomId) {
+        throw new Error(`错误：领地不存在（id=${input.territoryId}）。`);
+    }
+    if (territory.supervisor_binding_id === input.supervisorBindingId)
+        return null;
+    const result = setTerritorySupervisor(store, {
+        kingdomId: input.kingdomId,
+        territoryId: input.territoryId,
+        supervisorBindingId: input.supervisorBindingId,
+    }, auth);
+    throwOnGuiSetupFailure(result);
+    return result;
+}
+export function apply(ctx, config, dependencies = {}) {
     // 单一王国管理器（自包含 SQLite；KingdomStore 连接生命周期 = 插件生命周期）
     const manager = new KingdomManager({
         kingdomName: config.kingdomName,
@@ -53,6 +315,21 @@ export function apply(ctx, config) {
     // 卸载/重载时关闭 SQLite 连接（disposer 由 fiber 自动收集执行）
     ctx.effect(() => () => manager.close());
     const store = manager.storeHandle;
+    const disclosure = new ToolDisclosureRuntime(config.toolDisclosure ?? { mode: 'off' });
+    ctx.effect(() => () => disclosure.dispose());
+    const costObserver = installRuntimeCostObservers(ctx, store, {
+        runtimeInstanceRef: `dsh-${hostname()}`, mode: disclosure.config.mode, disclosureMeta: assembly => disclosure.metadata(assembly),
+    });
+    ctx.effect(() => () => costObserver.dispose());
+    const costRuntime = { toolDisclosureMode: disclosure.config.mode, observerAvailable: costObserver.available };
+    if (disclosure.config.mode === 'pilot')
+        ctx.effect(() => ctx.tools.register(defineTool({
+            name: DISCOVERY_TOOL_NAME,
+            description: 'Find currently granted tools by a short name or purpose query. Matching native schemas become visible on the next step; discovery grants no permission.',
+            parameters: { query: { type: 'string', required: true, description: 'A short exact tool name or purpose; at most 160 characters.' } },
+            output: { schema: { type: 'string' }, render: (_args, value) => [{ type: 'text', text: String(value) }] },
+            async execute(args, exec) { return JSON.stringify(disclosure.find(args, exec)); },
+        })), 'dsh-kingdom: authorized tool discovery pilot');
     const requireKingdom = () => {
         const kingdom = store.getDefaultKingdom();
         return kingdom ? kingdom.kingdom_id : null;
@@ -71,57 +348,422 @@ export function apply(ctx, config) {
                 + 'GUI 若提供派发/复核/返工按钮，必须显著标注为「本地可信演示权限」。',
         };
     const commandContext = (kingdomId, principal) => ({ kingdomId, auth: authView, ...principal ? { principal } : {} });
+    const dshRegistrySeam = () => ({
+        agents: ctx.get('agents'),
+        sessions: ctx.get('sessions'),
+    });
+    const trustedToolPrincipal = (exec) => {
+        const resolved = resolveTrustedToolSession(exec, dshRegistrySeam());
+        return resolved.classification === 'ACTIVE' ? { sessionId: resolved.sessionId } : undefined;
+    };
+    const targetSessionRef = (exec) => {
+        const target = agentSession(exec.agent);
+        return target?.sessionId ?? null;
+    };
+    const ownerBindingIntentContext = (exec) => {
+        const kingdomId = requireKingdom();
+        const resolved = resolveTrustedToolSession(exec, dshRegistrySeam());
+        return {
+            // This is only the target reference echoed by the runtime context.  The
+            // explicit classification below is the only liveness/authority seam.
+            target_session_ref: targetSessionRef(exec),
+            target_session_classification: resolved.classification,
+            kingdom_id: kingdomId,
+            role_bindings: kingdomId
+                ? store.listBindings(kingdomId).map(binding => ({
+                    binding_id: binding.binding_id,
+                    role_type: binding.role_type,
+                    role_name: binding.role_name,
+                    session_id: binding.session_id,
+                    status: binding.status,
+                    kingdom_id: binding.kingdom_id,
+                }))
+                : [],
+            territories: kingdomId
+                ? store.listTerritories(kingdomId).map(territory => ({
+                    territory_id: territory.territory_id,
+                    name: territory.name,
+                    status: territory.status,
+                    kingdom_id: territory.kingdom_id,
+                    supervisor_binding_id: territory.supervisor_binding_id,
+                }))
+                : [],
+        };
+    };
+    /**
+     * Public governed start 永远不接受 declarative 权限：调用者必须由 DSH Runtime
+     * 提供可验证的 session，再由 Core 将它解析为该领地的 Supervisor binding。
+     */
+    const governedStartCommandContext = (kingdomId, principal) => ({
+        kingdomId,
+        auth: {
+            mode: 'session-bound',
+            trustLevel: 'session-verified',
+            note: 'kingdom_start_task_governed 只接受由 DSH Runtime session 证明的 Supervisor 调用。',
+        },
+        ...principal ? { principal } : {},
+    });
     /**
-     * v0.4：从工具执行上下文提取「调用方会话」注入 principal。
-     * 配合 `authMode: session-bound`（requireRole 校验 principal.sessionId 与
-     * binding.session_id 一致），让角色真正属于某个独立会话可被强制校验；
-     * declarative 模式下 principal 仅是告知属性，不影响放行。
+     * The ticket is a launch-only secret.  It may cross the local process into
+     * the user's browser, but it must never enter CommandResult.text, logger
+     * output, or a Kingdom event.  The host has no browser service in its public
+     * Cordis surface, so use only the platform's existing URL opener seam.
      */
-    const sessionPrincipal = (exec) => {
-        const id = exec?.agent?.session?.id;
-        return typeof id === 'string' && id.length > 0 ? { sessionId: id } : undefined;
+    const openLocalConsole = dependencies.openLocalConsole ?? ((url) => {
+        try {
+            if (process.platform === 'win32') {
+                const result = spawnSync('cmd.exe', ['/d', '/c', 'start', '', url], {
+                    stdio: 'ignore',
+                    windowsHide: true,
+                });
+                return result.error === undefined && result.status === 0;
+            }
+            const command = process.platform === 'darwin' ? 'open' : 'xdg-open';
+            const result = spawnSync(command, [url], { stdio: 'ignore' });
+            return result.error === undefined && result.status === 0;
+        }
+        catch {
+            return false;
+        }
+    });
+    /** Grant 仅表达当前已认证 Supervisor 授予的 capability，绝不承载调用者身份。 */
+    const parseSupervisorGrant = (grantJson) => {
+        try {
+            const parsed = JSON.parse(grantJson);
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+                return { ok: false, message: 'grant_json 必须是非空 JSON 对象。' };
+            }
+            const entries = Object.entries(parsed);
+            if (entries.length === 0 || entries.some(([, allowed]) => typeof allowed !== 'boolean')) {
+                return { ok: false, message: 'grant_json 必须是非空、value 全为 boolean 的 capability Grant 对象。' };
+            }
+            return { ok: true, grant: Object.fromEntries(entries) };
+        }
+        catch {
+            return { ok: false, message: 'grant_json 必须是合法 JSON。' };
+        }
     };
-    // ── init 引导（首次初始化后给出组织方式；重点：角色应绑到独立会话，勿默认代跑）──
-    // 地址语义（问题修复 v0.4.1）：
-    //   · 后端数据网关 = 本插件 HTTP 通道（如 http://127.0.0.1:<guiPort>）——
-    //     这是**填进前端页面连接框的地址**，不是要打开的页面。
-    //   · 前端页面 = GUI 前端（vite dev http://localhost:5173，或部署站点）——
-    //     由 GUI 部署方提供，插件不硬编码也不冒充。
-    const gatewayUrl = config.guiPort > 0 ? `http://127.0.0.1:${config.guiPort}` : '（未开启，可配置 guiPort 后获得）';
-    const guiLine = `后端数据网关：${gatewayUrl} —— 把它填入 GUI 前端的连接框；前端页面地址由 GUI 部署方提供（本地开发如 vite，或已部署站点），不要把网关地址当页面打开`;
-    const initGuidance = '\n\n接下来把王国组织起来。**重要：不要把全部角色默认安在当前会话身上——角色应绑定到各自的独立会话**：\n'
-        + `① 绑定角色到独立会话（推荐）：用 kingdom_bind_session 为 CHANCELLOR / SUPERVISOR / WORKER 分别绑定具名 dsh 会话（可顺带填 model_name / agent_name）；`
-        + `配 authMode=session-bound 后，只有被绑定的那个会话才能行使该角色职权。\n`
-        + '② 快速演示（不推荐长期用）：会话纯文字逐步创建 —— 由当前会话代行各角色（角色席位 sessionId 为空，属本地演示兜底）。\n'
-        + `GUI（可选）：${guiLine}`;
+    const collectDispatchUsage = async (dispatchId, authorized = () => true) => {
+        const dispatch = store.getDispatch(dispatchId);
+        if (!dispatch?.runtime_dispatch_ref)
+            return;
+        // Resolve the persisted exact reference against Runtime-owned agents; do not mint a branded SessionId.
+        const agent = ctx.get('agents')?.list().find(candidate => candidate.id === dispatch.session_ref);
+        const observed = await observeDshDispatchUsage(agent?.session, dispatch.runtime_dispatch_ref);
+        if (!authorized())
+            return;
+        recordDispatchUsage(store, dispatchId, observed);
+    };
+    const runGovernedStart = async (args, caller) => {
+        const requestedSandboxMode = args.sandboxMode ?? 'workspace-write';
+        if (!GUI_START_SANDBOX_MODES.includes(requestedSandboxMode)) {
+            return `INPUT_DENIED [INVALID_SANDBOX_MODE]: sandbox_mode 必须是 ${GUI_START_SANDBOX_MODES.join(' / ')} 之一。`;
+        }
+        const sandboxMode = requestedSandboxMode;
+        const kingdomId = requireKingdom();
+        if (!kingdomId)
+            return '尚未初始化王国。请先 /kingdom init。';
+        const principal = caller.kind === 'tool'
+            ? trustedToolPrincipal(caller.execution)
+            : caller.principal;
+        if (!principal) {
+            return 'AUTHZ_DENIED [UNAUTHORIZED_PRINCIPAL]: 无法从 DSH Runtime 证明当前调用方的唯一活动 session。';
+        }
+        // Public governed start 不随全局 authMode 降级：真实 DSH session → Supervisor
+        // binding → Territory scope 必须在任何 executor/session/lease 准备前全部通过。
+        const supervisor = resolveGovernedStartSupervisor(store, governedStartCommandContext(kingdomId, principal), args.taskId);
+        if (!supervisor.ok) {
+            return `AUTHZ_DENIED [${supervisor.code}]: ${supervisor.message}`;
+        }
+        const parsedGrant = parseSupervisorGrant(args.grantJson);
+        if (!parsedGrant.ok) {
+            return `INPUT_DENIED [INVALID_SUPERVISOR_GRANT]: ${parsedGrant.message}`;
+        }
+        if (!store.isSchemaV4) {
+            return '错误：Schema v4 未迁移（正式 kingdom.db 迁移须经 Formal DB Migration Gate）；governed 执行不可用（fail-closed）。';
+        }
+        const loadedTask = supervisor.task;
+        if (loadedTask.status !== 'ASSIGNED' && loadedTask.status !== 'RUNNING') {
+            return `错误：任务状态 ${loadedTask.status} 不可 governed 启动（仅 ASSIGNED / REWORK 后的 RUNNING）。`;
+        }
+        const unsettledGovernedExecution = store.listExecutions(loadedTask.task_id)
+            .slice()
+            .reverse()
+            .find(execution => execution.execution_contract === 'GOVERNED_PERSISTENT'
+            && !isTerminalExecutionState(asExecutionState(execution.state)));
+        if (unsettledGovernedExecution) {
+            const code = unsettledGovernedExecution.state === 'RECOVERING'
+                ? 'EXISTING_EXECUTION_RECOVERING'
+                : 'EXISTING_EXECUTION_UNSETTLED';
+            return `GOVERNED_EXECUTION_DENIED [${code}]: Task ${loadedTask.task_id} 已有未终结的 governed Execution `
+                + `${unsettledGovernedExecution.execution_id}（${unsettledGovernedExecution.state}）。`
+                + '请先完成 terminal/reconcile 对账；未访问 Runtime/Session/Lease，Task 保持不变且不会自动重试。';
+        }
+        const territory = store.getTerritoryById(loadedTask.territory_id);
+        if (!territory)
+            return '错误：任务领地缺失。';
+        const worker = loadedTask.assigned_binding_id;
+        if (!worker)
+            return '错误：任务未指派 Worker。';
+        const initialCeiling = store.getKingdomCapabilityCeiling(kingdomId);
+        const initialProfile = store.getBindingById(worker)?.execution_profile_json;
+        const stillAuthorized = () => {
+            if (caller.kind === 'gui' && caller.signal?.aborted)
+                return false;
+            const currentPrincipal = caller.kind === 'tool' ? trustedToolPrincipal(caller.execution) : caller.principal;
+            if (!currentPrincipal || currentPrincipal.sessionId !== principal.sessionId)
+                return false;
+            const checked = resolveGovernedStartSupervisor(store, governedStartCommandContext(kingdomId, currentPrincipal), args.taskId);
+            return checked.ok && checked.binding.binding_id === supervisor.binding.binding_id
+                && checked.task.assigned_binding_id === worker && checked.task.territory_id === loadedTask.territory_id
+                && checked.task.title === loadedTask.title && checked.task.description === loadedTask.description
+                && checked.task.acceptance_criteria === loadedTask.acceptance_criteria
+                && checked.task.capability_requirement_json === loadedTask.capability_requirement_json
+                && store.getTerritoryById(loadedTask.territory_id)?.workspace_path === territory.workspace_path
+                && store.getKingdomCapabilityCeiling(kingdomId) === initialCeiling
+                && store.getBindingById(worker)?.execution_profile_json === initialProfile;
+        };
+        const agents = ctx.get('agents');
+        if (!agents) {
+            return '错误：当前 dsh 组合未提供 agents 服务（Persistent Session 不可用）；governed 执行不可用。';
+        }
+        // Owner V0.8 PRODUCTION-PATH CLOSURE（正式入口 E2E seam）：S4 materialize 需要**模块函数** seam
+        // （`setSandboxMode = session.append('sandbox/mode')` / `setApprovalPolicy = session.append('approval/policy')`），
+        // 而非 ctx 服务对象（SandboxPolicyService/ApprovalService 无这些方法，传服务 → MATERIALIZE_FAILED）。
+        // 动态 import（懒解析）：失败 → null → materialize 报「缺失」→ DENIED（fail-closed，不崩溃插件）。
+        const s4Seam = dependencies.loadS4Policy
+            ? await dependencies.loadS4Policy()
+            : await (async () => {
+                try {
+                    // 变量 specifier：运行时经 dsh loader 解析（动态 seam；静态类型不做解析校验）
+                    const sbSpec = '@deepseek-ai/dsh-sandbox-policy';
+                    const apSpec = '@deepseek-ai/dsh-user-approval';
+                    const sandbox = (await import(sbSpec));
+                    const approval = (await import(apSpec));
+                    return {
+                        sandboxPolicy: { setSandboxMode: sandbox.setSandboxMode },
+                        approval: { setApprovalPolicy: approval.setApprovalPolicy },
+                    };
+                }
+                catch {
+                    return { sandboxPolicy: null, approval: null };
+                }
+            })();
+        if (!stillAuthorized())
+            return 'AUTHZ_DENIED [AUTHORITY_CHANGED]: 准备期间身份、任务范围或执行配置变化；未访问 Worker Session。';
+        const adapter = new DshRuntimeAdapter({
+            runtimeInstanceRef: `dsh-${hostname()}`,
+            ...(disclosure.config.mode === 'pilot' ? { toolDisclosure: { install: disclosure.install.bind(disclosure) } } : {}),
+            provider: config.workerProvider || 'spawn',
+            model: null,
+            agents,
+            permission: ctx.get('permission'),
+            sandboxPolicy: s4Seam.sandboxPolicy,
+            approval: s4Seam.approval,
+            presets: ctx.get('agentPresets'),
+        });
+        // attempt 编号必须纳入 Lease Ledger（zero-execution 的 gate 拒绝也会消耗 attempt_no，
+        // 否则重试会撞 UNIQUE(task_id, attempt_no)——正式入口 E2E 实证）
+        const leaseMax = store.listLeases(kingdomId)
+            .filter((l) => l.task_id === loadedTask.task_id)
+            .reduce((m, l) => Math.max(m, l.attempt_no), 0);
+        const attemptNo = Math.max(store.nextAttemptNo(loadedTask.task_id), leaseMax + 1);
+        let result;
+        try {
+            result = await runGovernedTask({
+                store, adapter, kingdomId, workerBindingId: worker,
+                territoryId: loadedTask.territory_id, cwd: territory.workspace_path ?? process.cwd(),
+                taskId: loadedTask.task_id, attemptNo, supervisorBindingId: supervisor.binding.binding_id,
+                grant: parsedGrant.grant, requirementJson: store.getTaskCapabilityRequirement(loadedTask.task_id),
+                sandboxMode,
+                // Owner V0.8 PRODUCTION-PATH CLOSURE A：全局 workerProvider 仅作 provider 回退；
+                // Worker 的 provider/model 权威来源 = execution_profile_json（runGovernedTask 内部解析，
+                // model 缺失 → fail closed configuration error，不创建 Session、不 dispatch）。
+                globalProvider: config.workerProvider || 'spawn',
+                stillAuthorized,
+                // 真实模型 turn 轮询窗口（正式入口 E2E 实证：默认 100ms×40=4s 太短，turn 未及 terminal）：
+                // 1s × 60 = 60s；超窗 → fail-closed 返回（进 RECOVERING，由 reconcile 处理）。
+                pollIntervalMs: dependencies.governedPolling?.intervalMs ?? 1000,
+                maxPolls: dependencies.governedPolling?.maxPolls ?? 60,
+            });
+        }
+        catch (error) {
+            const detail = (error instanceof Error ? error.message : String(error)).slice(0, 256);
+            const terminalDispatch = store.listDispatches(kingdomId).some(dispatch => dispatch.task_id === loadedTask.task_id
+                && dispatch.attempt_no === attemptNo
+                && dispatch.state === 'TERMINAL');
+            if (terminalDispatch) {
+                return `GOVERNED_SETTLEMENT_BLOCKED [UNPROVEN_TERMINAL_RELATION]: ${detail}；未写入 Claim/REVIEW。`;
+            }
+            return `GOVERNED_EXECUTION_DENIED [DISPATCH_EXCEPTION]: ${detail}`;
+        }
+        if (!result.ok) {
+            const observedDispatch = store.listDispatchesForTaskAttempt(loadedTask.task_id, attemptNo)[0];
+            if (observedDispatch)
+                await collectDispatchUsage(observedDispatch.dispatch_id);
+            const prefix = result.reason.startsWith('Capability DENIED') ? 'CAPABILITY_DENIED' : 'GOVERNED_EXECUTION_DENIED';
+            if (observedDispatch && store.getDispatch(observedDispatch.dispatch_id)?.state === 'RECOVERING') {
+                return `${prefix}: ${result.reason}\n（任务保持 ${loadedTask.status}；请由当前 Supervisor 使用 kingdom_reconcile_task 对账原 Dispatch ${observedDispatch.dispatch_id}。对账完成前不得再次启动任务；不会自动降级为 LEGACY_COMPAT。）`;
+            }
+            return `${prefix}: ${result.reason}\n（任务保持 ${loadedTask.status}；请检查 Capability/Runtime 配置后，在同一 governed persistent 入口重试。不会自动降级为 LEGACY_COMPAT。）`;
+        }
+        // R11 settlement-before-Claim：先从已提交的 canonical
+        // Task/Execution/Lease/Dispatch relation 签发 product context，并消费同一
+        // opaque handle + version 完成 settlement。若 exact relation、version 或
+        // incident 记录无法证明，必须在任何 Claim/Task 写入前 fail-closed。
+        const task = store.getTask(loadedTask.task_id);
+        if (!task)
+            return 'GOVERNED_SETTLEMENT_BLOCKED [RELATION_MISSING]: terminal Task 已消失，未写入 Claim。';
+        let settledLease;
+        let runnerContext = null;
+        try {
+            runnerContext = getRunnerContextPort(result.dispatchId)
+                ?? createRunnerContextPort(store, { dispatchId: result.dispatchId });
+            const activeRunnerContext = runnerContext;
+            const terminal = activeRunnerContext.read(activeRunnerContext.handle, activeRunnerContext.initialVersion);
+            const settled = activeRunnerContext.settle(activeRunnerContext.handle, terminal.version, (context) => {
+                // The callback receives the exact product-minted capability.  Do not
+                // substitute result.* IDs: the port's bounded view is the relation
+                // consumed by settlement and the same handle/version is in-flight.
+                if (context.handle !== activeRunnerContext.handle || context.version !== terminal.version) {
+                    throw new Error('R11 RunnerContext settlement handle/version continuity failed');
+                }
+                return settleAndRelease(store, context.view.leaseId, result.cleanupReceipt, 'governed-terminal-settlement', {
+                    adapter,
+                    fence: result.trustFence,
+                    leaseId: context.view.leaseId,
+                    sessionRef: context.view.sessionRef,
+                });
+            });
+            settledLease = settled.value;
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            return `GOVERNED_SETTLEMENT_BLOCKED [UNPROVEN_TERMINAL_RELATION]: ${detail}；未写入 Claim/REVIEW。`;
+        }
+        finally {
+            // Ticket/connection revocation is transport cleanup only.  It cannot
+            // release a Lease or alter Claim/Dispatch governance facts.
+            revokeRunnerContextBrokerContext(runnerContext);
+            forgetRunnerContextPort(result.dispatchId);
+        }
+        // Claim 到达（Claim ≠ Fact）：结算完成或已明确进入 RECOVERING 后，才落
+        // worker_results + Task RUNNING→REVIEW（不是 DONE）。普通 cleanup false/
+        // throw/missing 与 post-TX-4 incident 都保留可信 terminal Claim。
+        // Owner V0.8 FINAL RELEASE BLOCKER：Claim outcome 按已验证 terminalOutcome 收敛
+        // （COMPLETED/FAILED/ABORTED）——禁止 hardcode COMPLETED；FAILED 不得生成 COMPLETED Claim；
+        // summary 仅来自真实 assistant 文本，无文本 → 诚实回退占位（不伪造"任务完成"类摘要）。
+        const outcome = result.terminalOutcome;
+        const summary = result.summary;
+        submitGovernedClaim(store, result.dispatchId, summary);
+        await collectDispatchUsage(result.dispatchId);
+        const recoveryNotice = settledLease?.state === 'RECOVERING'
+            ? result.cleanupReceipt.status === 'CONFIRMED'
+                ? `\n注意：terminal settlement 未能安全释放（${settledLease.release_reason ?? 'integrity recovery'}），Lease=RECOVERING；不得复用该 Session 或发起新 Dispatch，须先完成 reconcile/恢复。`
+                : `\n注意：enforcement cleanup 未确认（${result.cleanupReceipt.status}），Lease=RECOVERING；不得复用该 Session 或发起新 Dispatch，须先完成 reconcile/恢复。`
+            : '';
+        return `Governed Worker 已提交第 ${attemptNo} 次尝试的 Claim（outcome=${outcome}，长期 Session ${result.sessionRef.slice(-8)}${result.created ? ' 新建' : ' 复用'}）。\n`
+            + `摘要：${summary}\n`
+            + `任务「${task.title}」现在处于 **REVIEW**。这是一个待审查的 Claim，尚未成为任务完成事实——请 Supervisor 用 kingdom_review_task 裁定 ACCEPT / REWORK / FAIL。`
+            + recoveryNotice;
+    };
+    // ── init 引导（首次初始化后给出组织方式与内置 GUI 入口）──
+    const guiLine = '直接键入 exact `/kingdom gui` 激活短期本地 control session 并打开内置操作台；不用时执行 `/kingdom gui stop`。';
+    const initGuidance = '\n\nOwner Control 已建立：Owner 是稳定的人类本机 principal，OWNER.session_id 保持 null。\n'
+        + 'Owner-only 初始化、Territory、角色/session、Execution Profile 与 Capability Ceiling 写入必须来自 direct `/kingdom` Slash；GUI/HTTP 只保留 session-bound Role 命令。\n'
+        + 'Agent Role Plane 请为 CHANCELLOR / SUPERVISOR / WORKER 使用真实独立 DSH Session；正常执行入口是 kingdom_start_task_governed。\n'
+        + `GUI：${guiLine}`;
     /** 首次初始化返回带引导文案；再次接入保持简洁。 */
     const initResultText = (result) => result.action === 'initialized' ? `${result.detail}${initGuidance}` : result.detail;
-    // ── 加载期回收：清掉上一个插件生命周期留下的孤儿 Execution ──────
+    const ownerToolDenied = (rejection) => {
+        if (!rejection) {
+            return 'OWNER_CONTROL_REQUIRED: Owner-only 写操作只能通过 direct `/kingdom` Slash 执行；'
+                + 'Agent Tool、未激活的 GUI/HTTP、工具参数和 caller session 不能代表 Owner。';
+        }
+        return serializeOwnerBindingIntentDraft(draftOwnerBindingIntentFromRejectedWrite({
+            code: 'OWNER_CONTROL_REQUIRED',
+            operation: rejection.operation,
+            request: rejection.request,
+            context: ownerBindingIntentContext(rejection.exec),
+        }));
+    };
+    // ── 加载期孤儿处理：按 Execution Contract 保持事实诚实 ──────────
     //
-    // Worker 是 one-shot in-process subagent，生命周期绑在插件 fiber 上，
-    // 不可能跨越重载存活。所以开库时看到的"活跃"执行必然是残骸。
-    // 不回收的话，GUI 会看到骑士永远在工作，且该任务再也无法重新 start。
+    // LEGACY_COMPAT one-shot 随插件生命周期结束，可标记 ABORTED；
+    // GOVERNED_PERSISTENT 的 Runtime outcome 在重启后未知，只能进入
+    // RECOVERING 并等待显式对账，不能声称 Session 已停止或自动重试。
     {
         const kingdomId = requireKingdom();
         if (kingdomId) {
             const reclaimed = reclaimOrphanExecutions(store, kingdomId);
             if (reclaimed > 0) {
-                ctx.logger.info(`dsh-kingdom：已回收 ${reclaimed} 个上次运行残留的 Execution（标记为 ABORTED）`);
+                ctx.logger.info(`dsh-kingdom：已按 Execution Contract 处理 ${reclaimed} 个加载期残留 Execution`);
             }
         }
     }
+    ctx.effect(() => () => discardGovernedRecoveryContexts(store));
+    const runGovernedReconcile = async (args, caller) => {
+        const kingdomId = requireKingdom();
+        if (!kingdomId)
+            return '尚未初始化王国。';
+        const resolveCaller = () => {
+            if (caller.kind === 'tool')
+                return trustedToolPrincipal(caller.execution);
+            if (caller.signal?.aborted)
+                return undefined;
+            if (!caller.principal.sessionId)
+                return undefined;
+            // GUI has a broker-owned activation, not an active Tool/current-initiator scope.
+            const live = validateLiveDirectSession(caller.principal.sessionId, dshRegistrySeam());
+            return live.ok && live.agent === caller.agent ? caller.principal : undefined;
+        };
+        const initialPrincipal = resolveCaller();
+        if (!initialPrincipal)
+            return 'AUTHZ_DENIED [UNAUTHORIZED_PRINCIPAL]: 无法证明当前 DSH Session。';
+        const authorized = resolveGovernedStartSupervisor(store, governedStartCommandContext(kingdomId, initialPrincipal), args.taskId);
+        if (!authorized.ok)
+            return `AUTHZ_DENIED [${authorized.code}]: ${authorized.message}`;
+        const execution = store.latestExecution(args.taskId);
+        const dispatch = args.dispatchId ? store.getDispatch(args.dispatchId) : execution && store.listDispatchesForTaskAttempt(args.taskId, execution.attempt_no)
+            .find(row => row.execution_id === execution.execution_id);
+        if (!dispatch || dispatch.task_id !== args.taskId || dispatch.kingdom_id !== kingdomId)
+            return 'RECOVERY_REQUIRED [DISPATCH_MISSING]: 未找到该任务的执行凭据。';
+        const stillAuthorized = () => {
+            const principal = resolveCaller();
+            if (!principal || principal.sessionId !== initialPrincipal.sessionId)
+                return false;
+            const current = resolveGovernedStartSupervisor(store, governedStartCommandContext(kingdomId, principal), args.taskId);
+            return current.ok && current.binding.binding_id === authorized.binding.binding_id;
+        };
+        const reconciled = await reconcileGovernedDispatch(store, dispatch.dispatch_id, stillAuthorized);
+        if (!stillAuthorized())
+            return 'AUTHZ_DENIED [AUTHORITY_REVOKED]: 对账期间授权已失效，请重新确认当前任务。';
+        await collectDispatchUsage(dispatch.dispatch_id, stillAuthorized);
+        if (!stillAuthorized())
+            return 'AUTHZ_DENIED [AUTHORITY_REVOKED]: 对账期间授权已失效。';
+        if (reconciled.status !== 'TERMINAL')
+            return `RECOVERY_REQUIRED [${reconciled.status}]: ${reconciled.reason}；未重新派发任务，未释放 Lease。`;
+        try {
+            const claim = submitGovernedClaim(store, dispatch.dispatch_id, reconciled.summary ?? '(终态证据已确认；最终消息文本当前不可恢复)');
+            const lease = store.getLease(dispatch.lease_id);
+            const task = store.getTask(args.taskId);
+            return `${claim.created ? '对账已补齐' : '已存在'}第 ${dispatch.attempt_no} 次 Claim（${claim.outcome}）。\n摘要：${claim.summary}\n任务状态 ${task?.status ?? 'UNKNOWN'}；Lease=${lease?.state ?? 'UNKNOWN'}。${lease?.state === 'RECOVERING' ? '清理或结算证据不足，不重试清理、不复用 Session。' : ''}任务完成仍由 Supervisor 审查裁定。`;
+        }
+        catch (error) {
+            return `RECOVERY_REQUIRED [CLAIM_BLOCKED]: ${error instanceof Error ? error.message : String(error)}`;
+        }
+    };
     // ── 工具注册（全部挂 ctx.effect）────────────────────────────
     ctx.effect(() => ctx.tools.register(defineTool({
         name: 'kingdom_init',
-        description: '初始化或接入本地王国（幂等：无则新建 kingdom.db，有则接入）',
+        description: 'Owner-only 写操作已关闭：请由用户直接键入 `/kingdom init`（Agent Tool 调用确定性 OWNER_CONTROL_REQUIRED）',
         parameters: {},
         output: {
             schema: { type: 'string' },
             render: (_args, value) => [{ type: 'text', text: String(value) }],
         },
         async execute() {
-            const result = manager.init();
-            return initResultText(result);
+            return ownerToolDenied();
         },
     })), 'dsh-kingdom: init tool');
     ctx.effect(() => ctx.tools.register(defineTool({
@@ -138,7 +780,7 @@ export function apply(ctx, config) {
     })), 'dsh-kingdom: status tool');
     ctx.effect(() => ctx.tools.register(defineTool({
         name: 'kingdom_create_territory',
-        description: '在当前王国创建一个领地（Territory），绑定工作区路径',
+        description: 'Owner-only：Agent Tool 不代行；请使用 `/kingdom territory.create <JSON>`',
         parameters: {
             name: { type: 'string', required: true, description: '领地名，如 RAG 研发领' },
             workspace_path: { type: 'string', description: '工作区绝对路径，默认当前目录' },
@@ -149,18 +791,7 @@ export function apply(ctx, config) {
             render: (_args, value) => [{ type: 'text', text: String(value) }],
         },
         async execute(args, exec) {
-            const kingdomId = requireKingdom();
-            if (!kingdomId)
-                return '尚未初始化王国。请先 /kingdom init 或说“初始化王国”。';
-            return createTerritory(store, {
-                kingdomId,
-                name: args.name,
-                workspacePath: args.workspace_path,
-                summary: args.summary,
-            }, {
-                mode: config.authMode,
-                principalSessionId: sessionPrincipal(exec)?.sessionId,
-            });
+            return ownerToolDenied();
         },
     })), 'dsh-kingdom: create-territory tool');
     ctx.effect(() => ctx.tools.register(defineTool({
@@ -180,7 +811,7 @@ export function apply(ctx, config) {
     })), 'dsh-kingdom: list-territories tool');
     ctx.effect(() => ctx.tools.register(defineTool({
         name: 'kingdom_delete_territory',
-        description: '删除领地（真实用户反馈 #1）。治理语义：领地下存在任务（任意状态）时默认拒绝；确认级联删除请传 force=true（未终态任务统一标记 FAILED、活跃执行终止、TERRITORY_DELETED 事件留痕；DONE/FAILED 终态任务不篡改）',
+        description: 'Owner-only：Agent Tool 不代行；请使用 `/kingdom territory.delete <JSON>`（任务级联语义保持）',
         parameters: {
             territory_id: { type: 'string', description: '领地 id（与 name 二选一，优先）' },
             name: { type: 'string', description: '领地名（与 territory_id 二选一）' },
@@ -192,26 +823,12 @@ export function apply(ctx, config) {
             render: (_args, value) => [{ type: 'text', text: String(value) }],
         },
         async execute(args, exec) {
-            const kingdomId = requireKingdom();
-            if (!kingdomId)
-                return '尚未初始化王国。请先 /kingdom init。';
-            if (!args.territory_id && !args.name)
-                return '错误：请提供 territory_id 或 name 指定要删除的领地。';
-            return deleteTerritory(store, {
-                kingdomId,
-                territoryId: args.territory_id,
-                name: args.name,
-                force: args.force,
-                reason: args.reason,
-            }, {
-                mode: config.authMode,
-                principalSessionId: sessionPrincipal(exec)?.sessionId,
-            });
+            return ownerToolDenied();
         },
     })), 'dsh-kingdom: delete-territory tool');
     ctx.effect(() => ctx.tools.register(defineTool({
         name: 'kingdom_set_territory_supervisor',
-        description: '设置/解除领地主理 Supervisor（Topology Administration，session-bound 下仅 OWNER 可执行）。null 解除主理 → fail-closed（无 Supervisor 可治理该领地）；指派必须是 ACTIVE SUPERVISOR 绑定',
+        description: 'Owner-only：Agent Tool 不代行；请使用 `/kingdom territory.supervisor <JSON>`',
         parameters: {
             territory_id: { type: 'string', required: true, description: '领地 id' },
             supervisor_binding_id: { type: 'string', description: 'ACTIVE SUPERVISOR 绑定 id；传 null 解除主理' },
@@ -221,22 +838,12 @@ export function apply(ctx, config) {
             render: (_args, value) => [{ type: 'text', text: String(value) }],
         },
         async execute(args, exec) {
-            const kingdomId = requireKingdom();
-            if (!kingdomId)
-                return '尚未初始化王国。请先 /kingdom init。';
-            return setTerritorySupervisor(store, {
-                kingdomId,
-                territoryId: args.territory_id,
-                supervisorBindingId: args.supervisor_binding_id === undefined ? null : args.supervisor_binding_id,
-            }, {
-                mode: config.authMode,
-                principalSessionId: sessionPrincipal(exec)?.sessionId,
-            });
+            return ownerToolDenied();
         },
     })), 'dsh-kingdom: set-territory-supervisor tool');
     ctx.effect(() => ctx.tools.register(defineTool({
         name: 'kingdom_bind_role',
-        description: '绑定一个角色（OWNER/CHANCELLOR/SUPERVISOR/WORKER）到 DSH 会话，Role 与 Session 解耦；可携带会话身份预留字段（模型名/agent 名/扩展元数据，可不填）',
+        description: 'Owner-only：Agent Tool 不代行；请使用 `/kingdom role.bind <JSON>`（OWNER 不得绑定 Session）',
         parameters: {
             role_type: { type: 'string', required: true, description: '角色：OWNER/CHANCELLOR/SUPERVISOR/WORKER' },
             role_name: { type: 'string', description: '角色名，如 Worker-01' },
@@ -250,26 +857,20 @@ export function apply(ctx, config) {
             render: (_args, value) => [{ type: 'text', text: String(value) }],
         },
         async execute(args, exec) {
-            const kingdomId = requireKingdom();
-            if (!kingdomId)
-                return '尚未初始化王国。请先 /kingdom init。';
-            return bindRole(store, {
-                kingdomId,
-                roleType: args.role_type,
-                roleName: args.role_name,
-                sessionId: args.session_id,
-                modelName: args.model_name,
-                agentName: args.agent_name,
-                sessionMeta: args.session_meta,
-            }, {
-                mode: config.authMode,
-                principalSessionId: sessionPrincipal(exec)?.sessionId,
+            return ownerToolDenied({
+                operation: 'kingdom_bind_role',
+                request: {
+                    role_type: args.role_type,
+                    role_name: args.role_name,
+                    session_id: args.session_id,
+                },
+                exec,
             });
         },
     })), 'dsh-kingdom: bind-role tool');
     ctx.effect(() => ctx.tools.register(defineTool({
         name: 'kingdom_unbind_role',
-        description: '解绑一个角色（换届通道）：按 role_type 或 binding_id 移除绑定。OWNER 受保护不可解绑。解绑后该角色空缺，可重新绑定',
+        description: 'Owner-only：Agent Tool 不代行；请使用 `/kingdom role.unbind <JSON>`（OWNER 受保护）',
         parameters: {
             role_type: { type: 'string', description: '角色：CHANCELLOR/SUPERVISOR/WORKER（与 binding_id 二选一）' },
             binding_id: { type: 'string', description: '绑定 id（与 role_type 二选一）' },
@@ -280,23 +881,12 @@ export function apply(ctx, config) {
             render: (_args, value) => [{ type: 'text', text: String(value) }],
         },
         async execute(args, exec) {
-            const kingdomId = requireKingdom();
-            if (!kingdomId)
-                return '尚未初始化王国。请先 /kingdom init。';
-            return unbindRole(store, {
-                kingdomId,
-                roleType: args.role_type,
-                bindingId: args.binding_id,
-                reason: args.reason,
-            }, {
-                mode: config.authMode,
-                principalSessionId: sessionPrincipal(exec)?.sessionId,
-            });
+            return ownerToolDenied();
         },
     })), 'dsh-kingdom: unbind-role tool');
     ctx.effect(() => ctx.tools.register(defineTool({
         name: 'kingdom_bind_session',
-        description: '把角色绑定到（或改绑到）某个独立 DSH 会话，并更新会话身份预留字段（模型名/agent 名/扩展元数据）。null 清空、缺省不变。配合 authMode=session-bound 时按调用方会话校验身份',
+        description: 'Owner-only：Agent Tool 不代行；请使用 `/kingdom role.session <JSON>`（OWNER.session_id 永远不是 Authority）',
         parameters: {
             role_type: { type: 'string', description: '角色：OWNER/CHANCELLOR/SUPERVISOR/WORKER（与 binding_id 二选一）' },
             binding_id: { type: 'string', description: '绑定 id（与 role_type 二选一）' },
@@ -310,23 +900,35 @@ export function apply(ctx, config) {
             render: (_args, value) => [{ type: 'text', text: String(value) }],
         },
         async execute(args, exec) {
-            const kingdomId = requireKingdom();
-            if (!kingdomId)
-                return '尚未初始化王国。请先 /kingdom init。';
-            return rebindSession(store, {
-                kingdomId,
-                roleType: args.role_type,
-                bindingId: args.binding_id,
-                sessionId: args.session_id === undefined ? undefined : args.session_id,
-                modelName: args.model_name === undefined ? undefined : args.model_name,
-                agentName: args.agent_name === undefined ? undefined : args.agent_name,
-                sessionMeta: args.session_meta === undefined ? undefined : args.session_meta,
-            }, {
-                mode: config.authMode,
-                principalSessionId: sessionPrincipal(exec)?.sessionId,
+            return ownerToolDenied({
+                operation: 'kingdom_bind_session',
+                request: {
+                    role_type: args.role_type,
+                    binding_id: args.binding_id,
+                    session_id: args.session_id,
+                },
+                exec,
             });
         },
     })), 'dsh-kingdom: bind-session tool');
+    ctx.effect(() => ctx.tools.register(defineTool({
+        name: 'kingdom_draft_owner_binding_intent',
+        description: '解析 bounded 自然语言 Owner 绑定意图；只返回 zero-write Draft，不执行绑定、不 mint Owner authority，最终须 direct /kingdom Slash 确认',
+        parameters: {
+            text: { type: 'string', required: true, description: '自然语言意图，例如“把当前会话设为宰相”或“让该会话主管 RAG 研发辖区”' },
+        },
+        output: {
+            schema: { type: 'string' },
+            render: (_args, value) => [{ type: 'text', text: String(value) }],
+        },
+        async execute(args, exec) {
+            const draft = draftOwnerBindingIntent({
+                text: args.text,
+                context: ownerBindingIntentContext(exec),
+            });
+            return serializeOwnerBindingIntentDraft(draft);
+        },
+    })), 'dsh-kingdom: owner-binding-intent draft tool');
     ctx.effect(() => ctx.tools.register(defineTool({
         name: 'kingdom_list_bindings',
         description: '列出当前王国的全部角色绑定',
@@ -344,7 +946,7 @@ export function apply(ctx, config) {
     })), 'dsh-kingdom: list-bindings tool');
     ctx.effect(() => ctx.tools.register(defineTool({
         name: 'kingdom_set_execution_profile',
-        description: '设置/清空角色（通常 WORKER）的执行配置 ExecutionProfile {provider, model}——组织资源配置，治理对象：session-bound 下仅真实 OWNER 会话可执行。provider 缺省回退全局 workerProvider；model 缺省继承父 Agent（均留证据）。传空对象或 null 清空配置',
+        description: 'Owner-only：Agent Tool 不代行；请使用 `/kingdom execution-profile <JSON>`',
         parameters: {
             role_type: { type: 'string', description: '角色：OWNER/CHANCELLOR/SUPERVISOR/WORKER（与 binding_id 二选一）' },
             binding_id: { type: 'string', description: '绑定 id（与 role_type 二选一）' },
@@ -357,34 +959,24 @@ export function apply(ctx, config) {
             render: (_args, value) => [{ type: 'text', text: String(value) }],
         },
         async execute(args, exec) {
-            const kingdomId = requireKingdom();
-            if (!kingdomId)
-                return '尚未初始化王国。请先 /kingdom init。';
-            if (!args.role_type && !args.binding_id)
-                return '错误：请提供 role_type 或 binding_id 指定要配置的绑定。';
-            if (args.clear) {
-                return setExecutionProfile(store, { kingdomId, roleType: args.role_type, bindingId: args.binding_id, profile: null }, {
-                    mode: config.authMode,
-                    principalSessionId: sessionPrincipal(exec)?.sessionId,
-                });
-            }
-            if (!args.provider && !args.model) {
-                return '错误：请至少提供 provider 或 model 之一（或传 clear=true 清空配置）。';
-            }
-            return setExecutionProfile(store, {
-                kingdomId,
-                roleType: args.role_type,
-                bindingId: args.binding_id,
-                profile: {
-                    ...args.provider ? { provider: args.provider } : {},
-                    ...args.model ? { model: args.model } : {},
-                },
-            }, {
-                mode: config.authMode,
-                principalSessionId: sessionPrincipal(exec)?.sessionId,
-            });
+            return ownerToolDenied();
         },
     })), 'dsh-kingdom: set-execution-profile tool');
+    ctx.effect(() => ctx.tools.register(defineTool({
+        name: 'kingdom_set_capability_ceiling',
+        description: 'Owner-only：Agent Tool 不代行；请使用 `/kingdom ceiling <JSON>`；这是 governed persistent 的必要前置。',
+        parameters: {
+            ceiling_json: { type: 'string', description: 'capability allow-list JSON 对象，例如 {"filesystem.write":true,"tool:pwsh":true}；value 必须全为 boolean' },
+            clear: { type: 'boolean', description: 'true = 清空 Ceiling（保持 governed execution fail-closed，直到重新配置）' },
+        },
+        output: {
+            schema: { type: 'string' },
+            render: (_args, value) => [{ type: 'text', text: String(value) }],
+        },
+        async execute(args, exec) {
+            return ownerToolDenied();
+        },
+    })), 'dsh-kingdom: set-capability-ceiling tool');
     // ── Phase 2：Task 治理闭环（5 个工具）──────────────────────────
     //
     // 注意这里**没有** kingdom_report_result 工具。Worker 是 one-shot subagent，
@@ -399,6 +991,7 @@ export function apply(ctx, config) {
             description: { type: 'string', description: '任务详细描述' },
             acceptance_criteria: { type: 'string', description: '验收标准（Supervisor 审查的客观依据，强烈建议填写）' },
             territory_id: { type: 'string', description: '领地 id；王国只有一个领地时可省略' },
+            capability_requirement_json: { type: 'string', description: '可选 Capability Requirement JSON；默认使用最小 governed requirement，并与 Task 同事务写入' },
         },
         output: {
             schema: { type: 'string' },
@@ -408,14 +1001,77 @@ export function apply(ctx, config) {
             const kingdomId = requireKingdom();
             if (!kingdomId)
                 return '尚未初始化王国。请先 /kingdom init。';
-            return planTask(store, commandContext(kingdomId, sessionPrincipal(exec)), {
+            const capabilityRequirementJson = args.capability_requirement_json === undefined
+                ? MINIMAL_CAPABILITY_JSON
+                : args.capability_requirement_json;
+            if (capabilityRequirementJson.trim() && !store.isSchemaV4) {
+                return '错误：Schema v4 未迁移；PlanTask capability requirement 不可安全写入，命令拒绝（fail-closed）。';
+            }
+            return planTask(store, commandContext(kingdomId, trustedToolPrincipal(exec)), {
                 title: args.title,
                 description: args.description,
                 acceptanceCriteria: args.acceptance_criteria,
                 territoryId: args.territory_id,
+                capabilityRequirementJson,
             }).message;
         },
     })), 'dsh-kingdom: plan-task tool');
+    ctx.effect(() => ctx.tools.register(defineTool({
+        name: 'kingdom_propose_collaboration',
+        description: '宰相提议一层协作计划：含主整合者最多3位Worker，先由人类按准确版本采纳。小任务仍默认单执行者。',
+        parameters: { plan_json: { type: 'string', required: true, description: 'JSON: parentTaskId,expectedVersion?,mode(EXPERT|TEAM),reason,integratorBindingId,budgetTokens,reserveTokens,items(1..2)。每项key/title/description/acceptanceCriteria/territoryId/workerBindingId/access(READ_ONLY|WRITE)/dependsOn/expectedArtifact；EXPERT只读。' } },
+        output: { schema: { type: 'string' }, render: (_args, value) => [{ type: 'text', text: String(value) }] },
+        async execute(args, exec) {
+            const kingdomId = requireKingdom(), principal = trustedToolPrincipal(exec);
+            if (!kingdomId || !principal)
+                return 'AUTHZ_DENIED: 需要当前王国的真实宰相 Session。';
+            try {
+                if (typeof args.plan_json !== 'string' || args.plan_json.length > 24000)
+                    return 'INPUT_DENIED: 计划过长。';
+                return JSON.stringify(proposeCollaborationPlan(store, governedStartCommandContext(kingdomId, principal), parseStrictJsonObject(args.plan_json)));
+            }
+            catch (error) {
+                return `PLAN_REJECTED: ${error instanceof Error ? error.message : String(error)}`;
+            }
+        },
+    })), 'dsh-kingdom: propose-collaboration tool');
+    ctx.effect(() => ctx.tools.register(defineTool({
+        name: 'kingdom_advance_collaboration',
+        description: '当前主管推进已获人类采纳的准确计划；串行单项或并行至多两个独立项，自动完成正常指派，沿原Gate/执行/Claim链，仍须主管审查，不自动ACCEPT。',
+        parameters: { plan_id: { type: 'string', required: true, description: '已采纳计划ID' },
+            version: { type: 'number', required: true, description: '准确版本' }, digest: { type: 'string', required: true, description: '完整计划摘要' },
+            strategy: { type: 'string', required: true, description: 'SERIAL单项等待已有结算 / PARALLEL独立子项至多两个' },
+            items_json: { type: 'string', required: true, description: 'JSON数组，每项{taskId,grant:{能力名:boolean}}；不携带身份，不自动扩大权限。' } },
+        output: { schema: { type: 'string' }, render: (_args, value) => [{ type: 'text', text: String(value) }] },
+        async execute(args, exec) {
+            const kingdomId = requireKingdom();
+            if (!kingdomId)
+                return '尚未初始化王国。';
+            try {
+                if (typeof args.items_json !== 'string' || args.items_json.length > 20000)
+                    return 'INPUT_DENIED: 批次过长。';
+                const items = parseStrictJsonObject(`{"items":${args.items_json}}`).items;
+                const result = await advanceCollaboration(store, () => {
+                    const principal = trustedToolPrincipal(exec);
+                    return principal ? governedStartCommandContext(kingdomId, principal) : null;
+                }, { planId: args.plan_id, version: args.version, digest: args.digest, strategy: args.strategy, items }, async (input) => {
+                    const previous = store.latestWorkerResult(input.taskId)?.result_id;
+                    const message = await runGovernedStart(input, { kind: 'tool', execution: exec });
+                    const task = store.getTask(input.taskId), claim = store.latestWorkerResult(input.taskId), execution = store.latestExecution(input.taskId);
+                    const dispatch = execution ? store.listDispatchesForTaskAttempt(input.taskId, execution.attempt_no).find(row => row.execution_id === execution.execution_id) : null;
+                    const lease = dispatch ? store.getLease(dispatch.lease_id) : null;
+                    const ok = task?.status === 'REVIEW' && !!claim && claim.result_id !== previous && claim.outcome === 'COMPLETED'
+                        && execution?.state === 'COMPLETED' && execution.attempt_no === claim.attempt_no && execution.worker_binding_id === claim.worker_binding_id
+                        && dispatch?.state === 'TERMINAL' && dispatch.session_ref === claim.session_id && lease?.state === 'RELEASED';
+                    return { ok, message };
+                });
+                return JSON.stringify(result);
+            }
+            catch (error) {
+                return `ADVANCE_REJECTED: ${error instanceof Error ? error.message : String(error)}`;
+            }
+        },
+    })), 'dsh-kingdom: advance-collaboration tool');
     ctx.effect(() => ctx.tools.register(defineTool({
         name: 'kingdom_assign_task',
         description: '把任务派给 Worker 绑定（Supervisor 职权），CREATED → ASSIGNED',
@@ -431,7 +1087,7 @@ export function apply(ctx, config) {
             const kingdomId = requireKingdom();
             if (!kingdomId)
                 return '尚未初始化王国。请先 /kingdom init。';
-            return assignTask(store, commandContext(kingdomId, sessionPrincipal(exec)), {
+            return assignTask(store, commandContext(kingdomId, trustedToolPrincipal(exec)), {
                 taskId: args.task_id,
                 workerBindingId: args.worker_binding_id,
             }).message;
@@ -439,15 +1095,19 @@ export function apply(ctx, config) {
     })), 'dsh-kingdom: assign-task tool');
     ctx.effect(() => ctx.tools.register(defineTool({
         name: 'kingdom_start_task',
-        description: '触发 Worker 执行任务并等待其结果（Supervisor 职权）。结果只会让任务进入 REVIEW，不会直接完成任务',
+        description: 'LEGACY_COMPAT（仅显式选择）：用旧 one-shot Worker 执行任务并等待结果；不会自动作为 governed persistent 的 fallback。结果只会让任务进入 REVIEW，不会直接完成任务',
         parameters: {
             task_id: { type: 'string', required: true, description: '任务 id（状态需为 ASSIGNED，或 REWORK 后的 RUNNING）' },
+            legacy_opt_in: { type: 'boolean', description: '必须显式传 true 选择 LEGACY_COMPAT；省略/false 永远拒绝，persistent 失败不会自动 fallback' },
         },
         output: {
             schema: { type: 'string' },
             render: (_args, value) => [{ type: 'text', text: String(value) }],
         },
         async execute(args, exec) {
+            if (args.legacy_opt_in !== true) {
+                return 'LEGACY_COMPAT_REQUIRED: kingdom_start_task 是旧 one-shot 兼容入口；必须显式传 legacy_opt_in=true。persistent governed 失败不会自动降级。';
+            }
             const kingdomId = requireKingdom();
             if (!kingdomId)
                 return '尚未初始化王国。请先 /kingdom init。';
@@ -472,16 +1132,16 @@ export function apply(ctx, config) {
             });
             if (!resolved.ok)
                 return resolved.error;
-            const result = await startTask(store, resolved.executor, commandContext(kingdomId, sessionPrincipal(exec)), { taskId: args.task_id });
+            const result = await startTask(store, resolved.executor, commandContext(kingdomId, trustedToolPrincipal(exec)), { taskId: args.task_id });
             return result.message;
         },
     })), 'dsh-kingdom: start-task tool');
     ctx.effect(() => ctx.tools.register(defineTool({
         name: 'kingdom_start_task_governed',
-        description: '以 Governed Persistent Worker 执行任务（v0.8）：Worker 长期 DSH Session + Capability Gate（仅 GRANTED+ENFORCED 才 dispatch）+ Lease/Dispatch/Receipt/Evidence 全链；DENIED/CANNOT_ENFORCE → zero execution。需王国已迁移 Schema v4；Worker 获得并复用长期 Session（REWORK 唤醒同一 Worker）',
+        description: 'CANONICAL HEADLESS：以 Governed Persistent Worker 执行任务（v0.8）：真实 DSH caller session 中的 Supervisor + Territory scope 授权后，Worker 长期 DSH Session + Capability Gate（仅 GRANTED+ENFORCED 才 dispatch）+ Lease/Dispatch/Receipt/Evidence 全链；DENIED/CANNOT_ENFORCE → zero execution。需王国已迁移 Schema v4；Worker 获得并复用长期 Session（REWORK 唤醒同一 Worker）。失败只 fail-closed，不自动降级 LEGACY_COMPAT',
         parameters: {
             task_id: { type: 'string', required: true, description: '任务 id（状态需为 ASSIGNED，或 REWORK 后的 RUNNING）' },
-            grant_json: { type: 'string', required: true, description: 'Supervisor 本次 Attempt 的权威授权 JSON（如 {"tool:pwsh": true, "filesystem.write": true}；与任务 capability requirement 求交集）' },
+            grant_json: { type: 'string', required: true, description: '当前已认证 Supervisor 的本次 capability Grant JSON（仅表达能力，不代表身份；如 {"tool:pwsh": true, "filesystem.write": true}）' },
             sandbox_mode: { type: 'string', description: 'workspace-write（默认，领地写边界）/ read-only' },
         },
         output: {
@@ -489,135 +1149,25 @@ export function apply(ctx, config) {
             render: (_args, value) => [{ type: 'text', text: String(value) }],
         },
         async execute(args, exec) {
-            const kingdomId = requireKingdom();
-            if (!kingdomId)
-                return '尚未初始化王国。请先 /kingdom init。';
-            if (!store.isSchemaV4) {
-                return '错误：Schema v4 未迁移（正式 kingdom.db 迁移须经 Formal DB Migration Gate）；governed 执行不可用（fail-closed）。';
-            }
-            const loadedTask = store.getTask(args.task_id);
-            if (!loadedTask)
-                return `错误：找不到任务 ${args.task_id}。`;
-            if (loadedTask.status !== 'ASSIGNED' && loadedTask.status !== 'RUNNING') {
-                return `错误：任务状态 ${loadedTask.status} 不可 governed 启动（仅 ASSIGNED / REWORK 后的 RUNNING）。`;
-            }
-            const territory = store.getTerritoryById(loadedTask.territory_id);
-            if (!territory)
-                return '错误：任务领地缺失。';
-            const worker = loadedTask.assigned_binding_id;
-            if (!worker)
-                return '错误：任务未指派 Worker。';
-            const agents = ctx.get('agents');
-            if (!agents) {
-                return '错误：当前 dsh 组合未提供 agents 服务（Persistent Session 不可用）；governed 执行不可用。';
-            }
-            let grant;
-            try {
-                const parsed = JSON.parse(args.grant_json);
-                if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
-                    throw new Error('shape');
-                grant = parsed;
-            }
-            catch {
-                return '错误：grant_json 必须是非空 JSON 对象（Supervisor 权威授权）。';
-            }
-            const sup = territory.supervisor_binding_id ?? store.getBindingsByRole(kingdomId, 'SUPERVISOR')[0]?.binding_id ?? null;
-            // Owner V0.8 PRODUCTION-PATH CLOSURE（正式入口 E2E seam）：S4 materialize 需要**模块函数** seam
-            // （`setSandboxMode = session.append('sandbox/mode')` / `setApprovalPolicy = session.append('approval/policy')`），
-            // 而非 ctx 服务对象（SandboxPolicyService/ApprovalService 无这些方法，传服务 → MATERIALIZE_FAILED）。
-            // 动态 import（懒解析）：失败 → null → materialize 报「缺失」→ DENIED（fail-closed，不崩溃插件）。
-            const s4Seam = await (async () => {
-                try {
-                    // 变量 specifier：运行时经 dsh loader 解析（动态 seam；静态类型不做解析校验）
-                    const sbSpec = '@deepseek-ai/dsh-sandbox-policy';
-                    const apSpec = '@deepseek-ai/dsh-user-approval';
-                    const sandbox = (await import(sbSpec));
-                    const approval = (await import(apSpec));
-                    return {
-                        sandboxPolicy: { setSandboxMode: sandbox.setSandboxMode },
-                        approval: { setApprovalPolicy: approval.setApprovalPolicy },
-                    };
-                }
-                catch {
-                    return { sandboxPolicy: null, approval: null };
-                }
-            })();
-            const adapter = new DshRuntimeAdapter({
-                runtimeInstanceRef: `dsh-${hostname()}`,
-                provider: config.workerProvider || 'spawn',
-                model: null,
-                agents,
-                permission: ctx.get('permission'),
-                sandboxPolicy: s4Seam.sandboxPolicy,
-                approval: s4Seam.approval,
-                presets: ctx.get('agentPresets'),
-            });
-            // attempt 编号必须纳入 Lease Ledger（zero-execution 的 gate 拒绝也会消耗 attempt_no，
-            // 否则重试会撞 UNIQUE(task_id, attempt_no)——正式入口 E2E 实证）
-            const leaseMax = store.listLeases(kingdomId)
-                .filter((l) => l.task_id === loadedTask.task_id)
-                .reduce((m, l) => Math.max(m, l.attempt_no), 0);
-            const attemptNo = Math.max(store.nextAttemptNo(loadedTask.task_id), leaseMax + 1);
-            const result = await runGovernedTask({
-                store, adapter, kingdomId, workerBindingId: worker,
-                territoryId: loadedTask.territory_id, cwd: territory.workspace_path ?? process.cwd(),
-                taskId: loadedTask.task_id, attemptNo, supervisorBindingId: sup,
-                grant, requirementJson: store.getTaskCapabilityRequirement(loadedTask.task_id),
-                sandboxMode: args.sandbox_mode === 'read-only' ? 'read-only' : 'workspace-write',
-                // Owner V0.8 PRODUCTION-PATH CLOSURE A：全局 workerProvider 仅作 provider 回退；
-                // Worker 的 provider/model 权威来源 = execution_profile_json（runGovernedTask 内部解析，
-                // model 缺失 → fail closed configuration error，不创建 Session、不 dispatch）。
-                globalProvider: config.workerProvider || 'spawn',
-                // 真实模型 turn 轮询窗口（正式入口 E2E 实证：默认 100ms×40=4s 太短，turn 未及 terminal）：
-                // 1s × 60 = 60s；超窗 → fail-closed 返回（进 RECOVERING，由 reconcile 处理）。
-                pollIntervalMs: 1000,
-                maxPolls: 60,
-            });
-            if (!result.ok) {
-                return `Governed 执行未发生（zero execution）：${result.reason}\n（任务保持 ${loadedTask.status}；请检查 Capability 配置后重试或改用 kingdom_start_task legacy 路径。）`;
-            }
-            // Claim 到达（Claim ≠ Fact）：落 worker_results + Task RUNNING→REVIEW（不是 DONE）。
-            // Owner V0.8 FINAL RELEASE BLOCKER：Claim outcome 按已验证 terminalOutcome 收敛
-            // （COMPLETED/FAILED/ABORTED）——禁止 hardcode COMPLETED；FAILED 不得生成 COMPLETED Claim；
-            // summary 仅来自真实 assistant 文本，无文本 → 诚实回退占位（不伪造"任务完成"类摘要）。
-            const task = store.getTask(loadedTask.task_id);
-            const running = task.status === 'ASSIGNED' ? store.transitionTask(task, 'RUNNING') : task;
-            const outcome = result.terminalOutcome;
-            const summary = result.summary;
-            store.insertWorkerResult({
-                result_id: randomUUID(),
-                task_id: task.task_id,
-                attempt_no: attemptNo,
-                worker_binding_id: worker,
-                session_id: result.sessionRef,
-                outcome,
-                result_json: JSON.stringify({ outcome, summary }),
-                created_at: new Date().toISOString(),
-            });
-            store.transitionTask(running, 'REVIEW', { result_summary: summary });
-            // settlement：cleanup 确认 → release lease
-            const lease = store.getLease(result.leaseId);
-            if (lease && lease.state !== 'RELEASED') {
-                settleAndRelease(store, result.leaseId, true, 'settled-cleanup-ok');
-            }
-            const nowIso = new Date().toISOString();
-            store.appendEvent({
-                event_id: randomUUID(), kingdom_id: kingdomId, event_type: 'WORKER_RESULT_SUBMITTED',
-                actor_role: 'WORKER', actor_id: worker, target_type: 'task', target_id: task.task_id,
-                payload_json: JSON.stringify({ attempt_no: attemptNo, claimed_outcome: outcome, session_id: result.sessionRef, executor: 'dsh-governed:persistent' }),
-                created_at: nowIso,
-            });
-            store.appendEvent({
-                event_id: randomUUID(), kingdom_id: kingdomId, event_type: 'SESSION_STOPPED',
-                actor_role: 'WORKER', actor_id: worker, target_type: 'execution', target_id: result.executionId,
-                payload_json: JSON.stringify({ task_id: task.task_id, attempt_no: attemptNo, reason: outcome === 'COMPLETED' ? 'completed' : outcome.toLowerCase() }),
-                created_at: nowIso,
-            });
-            return `Governed Worker 已提交第 ${attemptNo} 次尝试的 Claim（outcome=${outcome}，长期 Session ${result.sessionRef.slice(-8)}${result.created ? ' 新建' : ' 复用'}）。\n`
-                + `摘要：${summary}\n`
-                + `任务「${task.title}」现在处于 **REVIEW**。这是一个待审查的 Claim，尚未成为任务完成事实——请 Supervisor 用 kingdom_review_task 裁定 ACCEPT / REWORK / FAIL。`;
+            return runGovernedStart({
+                taskId: args.task_id,
+                grantJson: args.grant_json,
+                sandboxMode: args.sandbox_mode,
+            }, { kind: 'tool', execution: exec });
         },
     })), 'dsh-kingdom: governed start-task tool');
+    ctx.effect(() => ctx.tools.register(defineTool({
+        name: 'kingdom_reconcile_task',
+        description: '对账已有任务的 governed Dispatch：仅原进程保留的可信上下文可补齐迟到 Claim；缺凭据或清理证据保持 RECOVERING。不会重发任务或自动 ACCEPT。',
+        parameters: {
+            task_id: { type: 'string', required: true, description: '当前 Supervisor 管辖的任务 id' },
+            dispatch_id: { type: 'string', description: '可选；默认选任务最新 Execution 的原 Dispatch' },
+        },
+        output: { schema: { type: 'string' }, render: (_args, value) => [{ type: 'text', text: String(value) }] },
+        async execute(args, exec) {
+            return runGovernedReconcile({ taskId: args.task_id, dispatchId: args.dispatch_id }, { kind: 'tool', execution: exec });
+        },
+    })), 'dsh-kingdom: governed reconcile-task tool');
     ctx.effect(() => ctx.tools.register(defineTool({
         name: 'kingdom_review_task',
         description: '审查 Worker 提交的结果并裁定（Supervisor 职权，须在任务领地的主理范围内）。这是任务能变成 DONE 的唯一路径：ACCEPT（→DONE）/ REWORK（→RUNNING 同 Worker）/ FAIL（→FAILED）/ HANDOFF（→RUNNING 转交新 Worker，需 to_binding_id + reason）',
@@ -635,7 +1185,7 @@ export function apply(ctx, config) {
             const kingdomId = requireKingdom();
             if (!kingdomId)
                 return '尚未初始化王国。请先 /kingdom init。';
-            return reviewTask(store, commandContext(kingdomId, sessionPrincipal(exec)), {
+            return reviewTask(store, commandContext(kingdomId, trustedToolPrincipal(exec)), {
                 taskId: args.task_id,
                 decision: args.decision,
                 reason: args.reason,
@@ -685,7 +1235,7 @@ export function apply(ctx, config) {
         const kingdomId = requireKingdom();
         if (!kingdomId)
             return { error: 'KINGDOM_NOT_INITIALIZED', message: '尚未初始化王国。请先 /kingdom init。' };
-        return buildSnapshot(store, { auth: authView });
+        return buildSnapshot(store, { auth: authView, costRuntime });
     }), 'dsh-kingdom: snapshot tool');
     ctx.effect(() => jsonTool('kingdom_task_detail', '返回单个任务的结构化详情 JSON：验收标准、尝试历史、全部 Claim、Supervisor 决策、执行记录、关联事件与允许的下一步动作', { task_id: { type: 'string', required: true, description: '任务 id' } }, (args) => {
         const kingdomId = requireKingdom();
@@ -711,7 +1261,7 @@ export function apply(ctx, config) {
             if (!kingdomId)
                 return '尚未初始化王国。请先 /kingdom init。';
             const input = { executionId: args.execution_id, reason: args.reason };
-            const cmd = commandContext(kingdomId, sessionPrincipal(exec));
+            const cmd = commandContext(kingdomId, trustedToolPrincipal(exec));
             switch (args.action.trim().toLowerCase()) {
                 case 'pause': return pauseExecution(store, cmd, input).message;
                 case 'resume': return resumeExecution(store, cmd, input).message;
@@ -720,30 +1270,200 @@ export function apply(ctx, config) {
             }
         },
     })), 'dsh-kingdom: execution-control tool');
-    // ── 本地 GUI 通道（默认关闭；配置 guiPort 后启用）────────────────
-    if (config.guiPort > 0) {
-        ctx.effect(() => startGuiServer({
-            snapshot: () => buildSnapshot(store, { auth: authView }),
-            taskDetail: (taskId) => {
-                const kingdomId = requireKingdom();
-                return kingdomId ? buildTaskDetail(store, kingdomId, taskId) : null;
-            },
-            eventsSince: (afterSeq, limit) => {
-                const kingdomId = requireKingdom();
-                if (!kingdomId)
-                    return { revision: 0, events: [] };
-                return {
-                    revision: store.revision(kingdomId),
-                    events: store.listEventsSince(kingdomId, afterSeq, limit).map(toEventView),
+    // ── 本地 GUI 通道（direct `/kingdom gui` 激活；配置端口可预启动）────
+    const GUI_HOST = '127.0.0.1';
+    let guiRuntime = null;
+    let guiStartPromise = null;
+    let guiStopRequested = false;
+    const projectionSecurityFor = (readContext) => {
+        const principalSessionId = readContext?.principalSessionId;
+        if (typeof principalSessionId !== 'string' || principalSessionId.length === 0)
+            return {};
+        const kingdomId = requireKingdom();
+        const supervisorBindingIds = new Set(kingdomId
+            ? store.getBindingsByRole(kingdomId, 'SUPERVISOR')
+                .filter(binding => binding.status === 'ACTIVE' && binding.session_id === principalSessionId)
+                .map(binding => binding.binding_id)
+            : []);
+        const scope = kingdomId
+            ? store.listTerritories(kingdomId)
+                .filter(territory => territory.supervisor_binding_id !== null
+                && supervisorBindingIds.has(territory.supervisor_binding_id))
+                .map(territory => `territory:${territory.territory_id}`)
+            : [];
+        return {
+            sessionVerified: true,
+            principalSessionId,
+            hostContext: true,
+            commandCoverage: [...GUI_SESSION_COMMANDS],
+            scope,
+        };
+    };
+    const closeGuiRuntime = (runtime) => {
+        runtime.control.revokeAllSessions();
+        runtime.ownerControl.dispose();
+        try {
+            runtime.close();
+        }
+        catch { /* server may already be unavailable */ }
+        if (guiRuntime === runtime)
+            guiRuntime = null;
+    };
+    const ensureGuiServer = () => {
+        if (guiRuntime)
+            return Promise.resolve(guiRuntime);
+        if (guiStartPromise)
+            return guiStartPromise;
+        guiStopRequested = false;
+        let closeServer = null;
+        const pending = new Promise((resolve, reject) => {
+            let listeningAddress = null;
+            let settled = false;
+            const control = new LocalControlManager({
+                host: GUI_HOST,
+                // This remains empty until startGuiServer reports the actual port.
+                // In particular, port=0 can never activate against a guessed origin.
+                expectedOrigin: () => listeningAddress?.origin ?? '',
+            });
+            const ownerController = new OwnerDecisionController(store, {
+                validateTargetSession: async ({ sessionId, signal }) => {
+                    if (signal.aborted)
+                        return { ok: false, code: 'OWNER_VALIDATION_ABORTED', message: '管理窗口已撤销或校验超时。' };
+                    const checked = validateLiveDirectSession(sessionId, dshRegistrySeam());
+                    return checked.ok ? { ok: true } : { ok: false, code: 'OWNER_SESSION_UNAVAILABLE', message: '目标会话不是当前唯一、有效的 DSH 会话；请刷新后重新选择。' };
+                },
+                listTargetSessions: async ({ sessionIds, signal }) => {
+                    const seam = dshRegistrySeam();
+                    return signal.aborted ? [] : sessionIds.filter(id => validateLiveDirectSession(id, seam).ok)
+                        .map(id => ({ id, label: `DSH 会话 ${id}` }));
+                },
+                validateExecutionProfile: async ({ profile, signal }) => {
+                    const provider = profile?.provider?.trim() || config.workerProvider;
+                    const model = profile?.model?.trim();
+                    if (!model)
+                        return { ok: false, code: 'OWNER_MODEL_REQUIRED', message: '请明确选择模型；保存配置不会证明模型已运行成功。' };
+                    const llm = ctx.get('llm');
+                    if (!llm || typeof llm.resolveModelInfo !== 'function')
+                        return { ok: false, code: 'OWNER_MODEL_VALIDATION_UNAVAILABLE', message: '当前宿主无法核对模型配置，未写入变更。' };
+                    try {
+                        await llm.resolveModelInfo(provider, model, signal);
+                        return signal.aborted ? { ok: false, code: 'OWNER_VALIDATION_ABORTED', message: '管理窗口已撤销或校验超时。' } : { ok: true };
+                    }
+                    catch {
+                        return { ok: false, code: 'OWNER_MODEL_UNAVAILABLE', message: '宿主未能确认该提供方与模型路由，请核对现有模型配置。' };
+                    }
+                },
+            });
+            const ownerControl = new OwnerLocalControlManager({ controller: ownerController, expectedOrigin: () => listeningAddress?.origin ?? '' });
+            const safeClose = () => {
+                try {
+                    closeServer?.();
+                }
+                catch { /* startup failure is already reported */ }
+            };
+            closeServer = () => {
+                try {
+                    serverClose();
+                }
+                catch { /* server may not have reached listen */ }
+            };
+            // The returned close function is assigned after startGuiServer creates
+            // its Server.  Keep the indirection local so callbacks never expose the
+            // ticket or depend on a second launch protocol.
+            let serverClose = () => undefined;
+            const onListening = (address) => {
+                listeningAddress = address;
+                const runtime = {
+                    address,
+                    control,
+                    ownerControl,
+                    close: safeClose,
                 };
-            },
-            command: (name, payload) => runGuiCommand(name, payload),
-        }, {
-            port: config.guiPort,
-            ...config.guiToken ? { token: config.guiToken } : {},
-            allowOrigins: config.guiAllowOrigins,
-            logger: ctx.logger,
-        }), 'dsh-kingdom: GUI channel');
+                if (guiStopRequested) {
+                    control.revokeAllSessions();
+                    ownerControl.dispose();
+                    safeClose();
+                    settled = true;
+                    reject(new Error('GUI_STOPPED_DURING_START'));
+                    return;
+                }
+                guiRuntime = runtime;
+                settled = true;
+                resolve(runtime);
+            };
+            const onUnavailable = (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                control.dispose();
+                ownerControl.dispose();
+                reject(error);
+            };
+            serverClose = startGuiServer({
+                snapshot: (readContext) => buildSnapshot(store, {
+                    auth: authView,
+                    costRuntime,
+                    security: projectionSecurityFor(readContext),
+                }),
+                taskDetail: (taskId, readContext) => {
+                    const kingdomId = requireKingdom();
+                    return kingdomId
+                        ? buildTaskDetail(store, kingdomId, taskId, {
+                            security: projectionSecurityFor(readContext),
+                        })
+                        : null;
+                },
+                eventsSince: (afterSeq, limit) => {
+                    const kingdomId = requireKingdom();
+                    if (!kingdomId)
+                        return { revision: 0, events: [] };
+                    return {
+                        revision: store.revision(kingdomId),
+                        events: store.listEventsSince(kingdomId, afterSeq, limit).map(toEventView),
+                    };
+                },
+                command: (name, payload, context) => runGuiCommand(name, payload, context),
+            }, {
+                port: config.guiPort,
+                host: GUI_HOST,
+                ...config.guiToken ? { token: config.guiToken } : {},
+                allowOrigins: config.guiAllowOrigins,
+                control,
+                ownerControl,
+                onListening,
+                onUnavailable,
+                logger: ctx.logger,
+            });
+        });
+        guiStartPromise = pending;
+        void pending.catch(() => {
+            if (guiStartPromise === pending)
+                guiStartPromise = null;
+        });
+        return pending;
+    };
+    const stopGuiServer = async () => {
+        guiStopRequested = true;
+        const pending = guiStartPromise;
+        if (pending && !guiRuntime) {
+            try {
+                const runtime = await pending;
+                closeGuiRuntime(runtime);
+            }
+            catch {
+                // onUnavailable already failed closed and disposed the broker.
+            }
+        }
+        else if (guiRuntime) {
+            closeGuiRuntime(guiRuntime);
+        }
+        guiStartPromise = null;
+    };
+    ctx.effect(() => () => { void stopGuiServer(); });
+    if (config.guiPort > 0) {
+        void ensureGuiServer().catch((error) => {
+            ctx.logger.warn(`dsh-kingdom GUI 通道启动失败（${error instanceof Error ? error.message : String(error)}）`);
+        });
     }
     const guiFailure = (errorCode, message) => ({
         ok: false,
@@ -757,10 +1477,17 @@ export function apply(ctx, config) {
     });
     /** 把 Phase-1 风格（返回字符串）的领地/角色操作包装成 CommandResultView（M2：GUI 写层）。 */
     const plainResult = (text, kId) => {
-        const failed = text.startsWith('错误：');
+        const failed = /^(?:错误：|OWNER_CONTROL_REQUIRED|CONFIG_DENIED|UNKNOWN\/|INPUT_DENIED|AUTHZ_DENIED|CAPABILITY_DENIED|GOVERNED_EXECUTION_DENIED|GOVERNED_SETTLEMENT_BLOCKED|RECOVERY_REQUIRED)/u.test(text);
+        const errorCode = !failed
+            ? null
+            : text.startsWith('RECOVERY_REQUIRED') || text.startsWith('GOVERNED_SETTLEMENT_BLOCKED') ? 'RECOVERY_REQUIRED'
+                : text.startsWith('AUTHZ_DENIED') ? 'SESSION_AUTH_REQUIRED'
+                    : text.startsWith('INPUT_DENIED') || text.startsWith('错误：') ? 'INVALID_INPUT'
+                        : text.startsWith('OWNER_CONTROL_REQUIRED') || text.startsWith('CONFIG_DENIED') ? 'SESSION_AUTH_REQUIRED'
+                            : 'WORKER_EXECUTION_FAILED';
         return {
             ok: !failed,
-            errorCode: failed ? 'INVALID_INPUT' : null,
+            errorCode,
             message: text,
             task: null,
             execution: null,
@@ -770,28 +1497,24 @@ export function apply(ctx, config) {
         };
     };
     /** GUI 写命令的分发。GUI 仍然经插件执行命令，绝不直接写 SQLite。 */
-    async function runGuiCommand(name, payload) {
-        // `init` 是唯一允许在王国未初始化时执行的命令（幂等，本地建库）。
-        if (name === 'init') {
-            const result = manager.init();
-            return plainResult(result.detail, result.kingdomId);
-        }
-        const kingdomId = requireKingdom();
-        if (!kingdomId) {
-            return guiFailure('KINGDOM_NOT_INITIALIZED', '尚未初始化王国。请先 /kingdom init。');
+    async function runGuiCommand(name, payload, control) {
+        if (GUI_OWNER_ONLY_COMMAND_SET.has(name)) {
+            return guiFailure('SESSION_AUTH_REQUIRED', `DIRECT_SLASH_REQUIRED: Owner-only action "${name}" 不能由 GUI/HTTP 执行；请由人类 Owner 直接使用 /kingdom Slash。`);
         }
         const str = (key) => typeof payload[key] === 'string' ? payload[key] : '';
         const opt = (key) => typeof payload[key] === 'string' ? payload[key] : undefined;
-        // v0.5.2（M1-B/P0-B）：GUI 写命令**不再信任 HTTP payload 里的 session_id**——
-        // principal 只能来自 DSH Runtime 证明（工具面 sessionPrincipal），
-        // 网关面永远无 principal。session-bound 下所有写命令 fail-closed（SESSION_AUTH_REQUIRED）。
-        const cmd = commandContext(kingdomId, undefined);
-        const guard = guiWriteGuard(authView.mode);
-        if (!guard.allowed) {
-            return guiFailure(guard.code, '该操作需要由已绑定角色的真实 DSH Session 发起。'
-                + 'GUI 当前没有可信 DSH Principal，因此拒绝代行。'
-                + '请在 DSH 会话中调用对应 kingdom_* 工具完成此操作。');
+        if (!control || control.signal.aborted) {
+            return guiFailure('SESSION_AUTH_REQUIRED', 'GUI Control Session 不存在或已撤销；命令未进入 Core。');
         }
+        const kingdomId = requireKingdom();
+        if (!kingdomId) {
+            return guiFailure('KINGDOM_NOT_INITIALIZED', '尚未初始化王国。请由人类 Owner 先直接执行 `/kingdom init` 与所需 Owner-only 配置。');
+        }
+        // GUI role actions use the exact activation-time session, never a browser
+        // field and never the configured declarative demo mode.
+        const cmd = governedStartCommandContext(kingdomId, {
+            sessionId: control.principalSessionId,
+        });
         switch (name) {
             case 'territory.create':
                 return plainResult(createTerritory(store, {
@@ -836,12 +1559,18 @@ export function apply(ctx, config) {
                     sessionMeta: opt('session_meta'),
                 }), kingdomId);
             case 'plan':
-                return planTask(store, cmd, {
+                if (!store.isSchemaV4) {
+                    return guiFailure('EXECUTOR_UNAVAILABLE', 'Schema v4 未迁移；GUI governed plan capability requirement 不可安全写入，命令拒绝。');
+                }
+                const capabilityRequirementJson = opt('capability_requirement_json') ?? MINIMAL_CAPABILITY_JSON;
+                const planned = planTask(store, cmd, {
                     title: str('title'),
                     description: opt('description'),
                     acceptanceCriteria: opt('acceptance_criteria'),
                     territoryId: opt('territory_id'),
+                    capabilityRequirementJson,
                 });
+                return planned;
             case 'assign':
                 return assignTask(store, cmd, { taskId: str('task_id'), workerBindingId: opt('worker_binding_id') });
             case 'review':
@@ -849,6 +1578,7 @@ export function apply(ctx, config) {
                     taskId: str('task_id'),
                     decision: str('decision'),
                     reason: opt('reason'),
+                    to_binding_id: opt('to_binding_id'),
                 });
             case 'execution.pause':
                 return pauseExecution(store, cmd, { executionId: str('execution_id'), reason: opt('reason') });
@@ -856,61 +1586,354 @@ export function apply(ctx, config) {
                 return resumeExecution(store, cmd, { executionId: str('execution_id'), reason: opt('reason') });
             case 'execution.abort':
                 return abortExecution(store, cmd, { executionId: str('execution_id'), reason: opt('reason') });
+            case 'reconcile': {
+                if (control.signal.aborted)
+                    return guiFailure('UNAUTHORIZED_PRINCIPAL', '本地控制已关闭。');
+                const reconciled = await runGovernedReconcile({ taskId: str('task_id') }, {
+                    kind: 'gui', principal: { sessionId: control.principalSessionId }, agent: control.agent,
+                    signal: control.signal,
+                });
+                return plainResult(reconciled, kingdomId);
+            }
             case 'start':
-                // 诚实的 Beta 边界：启动 Worker 需要一个**活的委派父 Agent**
-                // （in-process provider 从它派生 workspace / 血缘 / 委派深度）。
-                // HTTP 请求没有 Agent 上下文，所以这条命令只能从 DSH 会话里
-                // 经 kingdom_start_task 触发。这里明确报错，而不是伪造一次执行。
-                return guiFailure('EXECUTOR_UNAVAILABLE', 'kingdom_start_task 需要由 DSH 会话中的 Agent 触发（Worker subagent 需要委派父 Agent）。'
-                    + 'GUI 请引导用户在 DSH 会话中说“开始执行这个任务”，或调用 kingdom_start_task 工具。');
+                if (!control.principalSessionId.trim()) {
+                    return guiFailure('UNAUTHORIZED_PRINCIPAL', '激活时没有 exact agent.session.id；governed start 拒绝执行。');
+                }
+                const callerAgent = control.agent;
+                if (!callerAgent) {
+                    return guiFailure('EXECUTOR_UNAVAILABLE', '激活时没有 exact DSH Agent reference；GUI 不伪造 Worker 父 Agent。');
+                }
+                try {
+                    const started = await runGovernedStart({
+                        taskId: str('task_id'),
+                        grantJson: str('grant_json'),
+                        sandboxMode: opt('sandbox_mode'),
+                    }, {
+                        kind: 'gui',
+                        principal: { sessionId: control.principalSessionId },
+                        agent: callerAgent,
+                    });
+                    if (control.signal.aborted) {
+                        return plainResult('UNKNOWN/RECOVERY_REQUIRED: GUI Control Session 在 governed start 期间被撤销；请先刷新并对账，不自动重试。', kingdomId);
+                    }
+                    return plainResult(started, kingdomId);
+                }
+                catch (error) {
+                    const detail = error instanceof Error ? error.message : String(error);
+                    return plainResult(`UNKNOWN/RECOVERY_REQUIRED: governed start 结果不确定，请先刷新 Projection 对账；不自动重试。(${detail})`, kingdomId);
+                }
             default:
                 return guiFailure('INVALID_INPUT', `未知命令 "${name}"。`);
         }
     }
-    // ── Slash 命令（确定性管理入口）──────────────────────────────
+    const parseJsonEnvelope = (rest, allowed, required = []) => {
+        if (!rest)
+            return { ok: false, message: '需要一个 JSON object envelope；不得省略参数。' };
+        let parsed;
+        try {
+            parsed = parseStrictJsonObject(rest);
+        }
+        catch (error) {
+            if (error instanceof DuplicateJsonKeyError) {
+                return { ok: false, message: `JSON envelope 不得包含重复字段 "${error.key}"。` };
+            }
+            return { ok: false, message: 'JSON envelope 非法；必须是单个 JSON object。' };
+        }
+        const value = parsed;
+        const allowedSet = new Set(allowed);
+        const unknown = Object.keys(value).filter(key => !allowedSet.has(key));
+        if (unknown.length > 0)
+            return { ok: false, message: `不允许的字段：${unknown.join(', ')}。` };
+        const missing = required.filter(key => !Object.prototype.hasOwnProperty.call(value, key));
+        if (missing.length > 0)
+            return { ok: false, message: `缺少字段：${missing.join(', ')}。` };
+        return { ok: true, value };
+    };
+    const directCommandParts = (rawInput) => {
+        let line = rawInput.trim();
+        if (line.startsWith('/kingdom'))
+            line = line.slice('/kingdom'.length).trim();
+        const match = line.match(/^(\S+)(?:\s+([\s\S]*))?$/u);
+        return { sub: match?.[1] ?? '', rest: match?.[2] ?? '' };
+    };
+    const ownerWrite = (operation, fn) => {
+        const kingdomId = requireKingdom();
+        if (!kingdomId)
+            return 'OWNER_CONTROL_REQUIRED: 请先直接执行 `/kingdom init` 建立 Owner principal。';
+        try {
+            // Each direct operation gets one IMMEDIATE boundary.  Core helpers may
+            // append events inside it; failure rolls back all domain writes.
+            return store.withImmediateTransaction(fn);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            return `UNKNOWN/RECOVERY_REQUIRED: Owner operation ${operation} 的写结果不确定；请先 /kingdom status 对账。(${detail})`;
+        }
+    };
+    const validateDirectSessionPayload = (operation, value) => {
+        if (value === undefined || value === null)
+            return null;
+        if (typeof value !== 'string')
+            return `INPUT_DENIED [${operation}]: session_id 必须是 string 或 null。`;
+        const seam = dshRegistrySeam();
+        const live = validateLiveDirectSession(value, seam);
+        if (live.ok)
+            return null;
+        return `INPUT_DENIED [SESSION_${live.classification}]: ${live.reason}；direct /kingdom ${operation} 未写入。`;
+    };
+    const ownerAuth = () => ownerControlAuth(issueOwnerControlCapability());
     ctx.effect(() => ctx.commands.register({
         name: 'kingdom',
-        description: '初始化/接入本地王国，查看王国状态',
-        input: { hint: 'init | status | reset | help' },
+        description: 'direct Owner Control：初始化、状态、内置 GUI 与精确 JSON 配置；独立 Agent Tool/HTTP payload 不得代行 Owner 写入',
+        input: { hint: 'gui [start|stop] | owner.gui <json> | init | status | ceiling <json> | territory.* <json> | role.* <json> | execution-profile <json> | help' },
         handler: async (invocation) => {
-            const line = invocation.rawInput.trim();
-            const [sub] = line.split(/[\s]+/u).filter(Boolean);
-            switch (sub ?? '') {
-                case 'init': {
-                    const result = manager.init();
-                    return { kind: 'success', text: initResultText(result) };
+            const { sub, rest } = directCommandParts(invocation.rawInput);
+            const auth = ownerAuth();
+            switch (sub) {
+                case 'owner.gui': {
+                    const parsed = parseJsonEnvelope(rest, ['kingdomId', 'actions', 'scope', 'ttlMs']);
+                    if (!parsed.ok)
+                        return { kind: 'error', text: `INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: ${parsed.message}` };
+                    try {
+                        const runtime = await ensureGuiServer();
+                        const activation = runtime.ownerControl.activate(issueOwnerControlCapability(), parsed.value);
+                        const opened = openLocalConsole(`${runtime.address.origin}${activation.launchPath}?ticket=${encodeURIComponent(activation.launchTicket)}`);
+                        return {
+                            kind: opened ? 'success' : 'error',
+                            text: opened
+                                ? `人类管理窗口已激活：${runtime.address.origin}/owner；有效期至 ${activation.expiresAt}。网页仅可操作本次授权范围。`
+                                : '管理窗口已建立，但浏览器未能打开；未输出一次性票据，请重新直接激活。',
+                        };
+                    }
+                    catch {
+                        return { kind: 'error', text: 'OWNER_GUI_ACTIVATION_DENIED: 管理窗口未能激活。请核对严格 JSON 中的王国、动作、具体范围及期限；没有输出控制凭据。' };
+                    }
                 }
-                case 'status': {
+                case 'gui': {
+                    const action = rest.trim().toLowerCase();
+                    if (action === 'stop') {
+                        await stopGuiServer();
+                        return {
+                            kind: 'success',
+                            text: 'GUI Control Session 已停止；活动控制会话已撤销，本地 GUI server 已关闭（如曾启动）。',
+                        };
+                    }
+                    if (action !== '' && action !== 'start') {
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: `/kingdom gui` 只接受 start、stop 或无参数。' };
+                    }
+                    try {
+                        // ensureGuiServer resolves only from the server's onListening
+                        // callback, so port=0 uses the actual bound origin.
+                        const runtime = await ensureGuiServer();
+                        const activation = runtime.control.activate(invocation.agent);
+                        const launchUrl = `${runtime.address.origin}${activation.launchPath}?ticket=${encodeURIComponent(activation.launchTicket)}`;
+                        const browserOpened = openLocalConsole(launchUrl);
+                        return formatGuiLaunchCommandResult(runtime.address.origin, activation.expiresAt, browserOpened);
+                    }
+                    catch {
+                        // Never reflect an exception into command/done if it could contain
+                        // a transport value.  The launch ticket is intentionally absent.
+                        return {
+                            kind: 'error',
+                            text: 'UNKNOWN/RECOVERY_REQUIRED: GUI Control Session 启动失败；未输出 launch ticket，请检查本地 GUI server 后重试。',
+                        };
+                    }
+                }
+                case 'init':
+                    if (rest)
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: `/kingdom init` 不接受额外 token。' };
+                    try {
+                        return { kind: 'success', text: initResultText(manager.init()) };
+                    }
+                    catch (error) {
+                        const detail = error instanceof Error ? error.message : String(error);
+                        return { kind: 'error', text: `UNKNOWN/RECOVERY_REQUIRED: init 写结果不确定，请先对账。(${detail})` };
+                    }
+                case 'status':
+                    if (rest)
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: `/kingdom status` 不接受额外 token。' };
                     return { kind: 'success', text: store.statusSummary() };
+                case 'reset':
+                    if (rest)
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: `/kingdom reset` 不接受额外 token。' };
+                    try {
+                        return { kind: 'success', text: `已重新接入。${manager.rescan().detail}` };
+                    }
+                    catch (error) {
+                        const detail = error instanceof Error ? error.message : String(error);
+                        return { kind: 'error', text: `UNKNOWN/RECOVERY_REQUIRED: reset 读结果不确定，请先对账。(${detail})` };
+                    }
+                case 'ceiling': {
+                    const parsed = parseJsonEnvelope(rest, ['ceiling', 'ceiling_json', 'clear']);
+                    if (!parsed.ok)
+                        return { kind: 'error', text: `INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: ${parsed.message}` };
+                    const value = parsed.value;
+                    if (value.clear !== undefined && typeof value.clear !== 'boolean')
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: clear 必须是 boolean。' };
+                    if (value.clear === true && (value.ceiling !== undefined || value.ceiling_json !== undefined))
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: clear=true 不得同时提供 ceiling。' };
+                    let ceilingJson;
+                    if (value.clear === true)
+                        ceilingJson = null;
+                    else if (typeof value.ceiling_json === 'string')
+                        ceilingJson = value.ceiling_json;
+                    else if (value.ceiling !== undefined) {
+                        if (typeof value.ceiling !== 'object' || value.ceiling === null || Array.isArray(value.ceiling))
+                            return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: ceiling 必须是 capability→boolean object。' };
+                        ceilingJson = JSON.stringify(value.ceiling);
+                    }
+                    else
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: 请提供 ceiling object、ceiling_json 或 clear=true。' };
+                    const text = ownerWrite('ceiling', () => setCapabilityCeiling(store, { kingdomId: requireKingdom(), ceilingJson }, auth));
+                    return { kind: text.startsWith('UNKNOWN/') || text.startsWith('CONFIG_DENIED') ? 'error' : 'success', text };
+                }
+                case 'territory.create': {
+                    const parsed = parseJsonEnvelope(rest, ['name', 'workspace_path', 'summary'], ['name']);
+                    if (!parsed.ok || typeof parsed.value.name !== 'string')
+                        return { kind: 'error', text: `INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: ${parsed.ok ? 'name 必须是 string。' : parsed.message}` };
+                    const value = parsed.value;
+                    if (value.workspace_path !== undefined && typeof value.workspace_path !== 'string')
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: workspace_path 必须是 string。' };
+                    if (value.summary !== undefined && typeof value.summary !== 'string')
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: summary 必须是 string。' };
+                    const text = ownerWrite('territory.create', () => createTerritory(store, { kingdomId: requireKingdom(), name: value.name, workspacePath: value.workspace_path, summary: value.summary }, auth));
+                    return { kind: text.startsWith('UNKNOWN/') || text.startsWith('错误：') ? 'error' : 'success', text };
+                }
+                case 'territory.delete': {
+                    const parsed = parseJsonEnvelope(rest, ['territory_id', 'name', 'force', 'reason']);
+                    if (!parsed.ok)
+                        return { kind: 'error', text: `INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: ${parsed.message}` };
+                    const value = parsed.value;
+                    if (typeof value.territory_id !== 'string' && typeof value.name !== 'string')
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: territory_id/name 二选一。' };
+                    if (value.force !== undefined && typeof value.force !== 'boolean')
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: force 必须是 boolean。' };
+                    if (value.reason !== undefined && typeof value.reason !== 'string')
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: reason 必须是 string。' };
+                    const text = ownerWrite('territory.delete', () => deleteTerritory(store, { kingdomId: requireKingdom(), territoryId: value.territory_id, name: value.name, force: value.force, reason: value.reason }, auth));
+                    return { kind: text.startsWith('UNKNOWN/') || text.startsWith('错误：') ? 'error' : 'success', text };
+                }
+                case 'territory.supervisor': {
+                    const parsed = parseJsonEnvelope(rest, ['territory_id', 'supervisor_binding_id'], ['territory_id', 'supervisor_binding_id']);
+                    if (!parsed.ok)
+                        return { kind: 'error', text: `INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: ${parsed.message}` };
+                    const value = parsed.value;
+                    if (typeof value.territory_id !== 'string' || (value.supervisor_binding_id !== null && typeof value.supervisor_binding_id !== 'string'))
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: territory_id/supervisor_binding_id 类型错误。' };
+                    const text = ownerWrite('territory.supervisor', () => setTerritorySupervisor(store, { kingdomId: requireKingdom(), territoryId: value.territory_id, supervisorBindingId: value.supervisor_binding_id }, auth));
+                    return { kind: text.startsWith('UNKNOWN/') || text.startsWith('错误：') ? 'error' : 'success', text };
+                }
+                case 'role.bind': {
+                    const parsed = parseJsonEnvelope(rest, ['role_type', 'role_name', 'session_id', 'model_name', 'agent_name', 'session_meta'], ['role_type']);
+                    if (!parsed.ok || typeof parsed.value.role_type !== 'string')
+                        return { kind: 'error', text: `INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: ${parsed.ok ? 'role_type 必须是 string。' : parsed.message}` };
+                    const value = parsed.value;
+                    if (value.role_type.toUpperCase() === 'OWNER')
+                        return { kind: 'error', text: 'OWNER_CONTROL_REQUIRED: OWNER projection 不得通过 role.bind 改绑为 Session。' };
+                    for (const key of ['role_name', 'session_id', 'model_name', 'agent_name', 'session_meta']) {
+                        if (value[key] !== undefined && typeof value[key] !== 'string')
+                            return { kind: 'error', text: `INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: ${key} 必须是 string。` };
+                    }
+                    const liveSessionError = validateDirectSessionPayload('role.bind', value.session_id);
+                    if (liveSessionError)
+                        return { kind: 'error', text: liveSessionError };
+                    const text = ownerWrite('role.bind', () => bindRole(store, { kingdomId: requireKingdom(), roleType: value.role_type, roleName: value.role_name, sessionId: value.session_id, modelName: value.model_name, agentName: value.agent_name, sessionMeta: value.session_meta }, auth));
+                    return { kind: text.startsWith('UNKNOWN/') || text.startsWith('错误：') || text.startsWith('角色 ') && text.includes('已有绑定') ? 'error' : 'success', text };
+                }
+                case 'role.unbind': {
+                    const parsed = parseJsonEnvelope(rest, ['role_type', 'binding_id', 'reason']);
+                    if (!parsed.ok)
+                        return { kind: 'error', text: `INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: ${parsed.message}` };
+                    const value = parsed.value;
+                    if (value.role_type !== undefined && typeof value.role_type !== 'string')
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: role_type 必须是 string。' };
+                    if (value.binding_id !== undefined && typeof value.binding_id !== 'string')
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: binding_id 必须是 string。' };
+                    if (value.reason !== undefined && typeof value.reason !== 'string')
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: reason 必须是 string。' };
+                    if ((value.role_type === undefined) === (value.binding_id === undefined))
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: role_type/binding_id 必须二选一。' };
+                    if (String(value.role_type ?? '').toUpperCase() === 'OWNER')
+                        return { kind: 'error', text: 'OWNER_CONTROL_REQUIRED: OWNER projection 不得退任。' };
+                    const text = ownerWrite('role.unbind', () => unbindRole(store, { kingdomId: requireKingdom(), roleType: value.role_type, bindingId: value.binding_id, reason: value.reason }, auth));
+                    return { kind: text.startsWith('UNKNOWN/') || text.startsWith('错误：') ? 'error' : 'success', text };
+                }
+                case 'role.session': {
+                    const parsed = parseJsonEnvelope(rest, ['role_type', 'binding_id', 'session_id', 'model_name', 'agent_name', 'session_meta']);
+                    if (!parsed.ok)
+                        return { kind: 'error', text: `INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: ${parsed.message}` };
+                    const value = parsed.value;
+                    // parseJsonEnvelope has already enforced the strict object,
+                    // duplicate-key, and unknown-field boundary.  For this valid
+                    // envelope, Owner is a projection rather than a runtime-session
+                    // target: resolve explicit role/binding Owner before the remaining
+                    // xor/type/live-session proof so mixed requests fail closed alike.
+                    const directKingdomId = requireKingdom();
+                    const directBinding = directKingdomId && typeof value.binding_id === 'string'
+                        ? resolveBinding(store, directKingdomId, undefined, value.binding_id)
+                        : null;
+                    const explicitOwner = typeof value.role_type === 'string'
+                        && value.role_type.trim().toUpperCase() === 'OWNER';
+                    if (explicitOwner || directBinding?.role_type.trim().toUpperCase() === 'OWNER') {
+                        return { kind: 'error', text: 'OWNER_CONTROL_REQUIRED: OWNER.session_id 永远不作为 Owner Authority。' };
+                    }
+                    if ((value.role_type === undefined) === (value.binding_id === undefined))
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: role_type/binding_id 必须二选一。' };
+                    for (const key of ['role_type', 'binding_id', 'session_id', 'model_name', 'agent_name', 'session_meta']) {
+                        if (value[key] !== undefined && value[key] !== null && typeof value[key] !== 'string')
+                            return { kind: 'error', text: `INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: ${key} 必须是 string 或 null。` };
+                    }
+                    const liveSessionError = validateDirectSessionPayload('role.session', value.session_id);
+                    if (liveSessionError)
+                        return { kind: 'error', text: liveSessionError };
+                    const text = ownerWrite('role.session', () => rebindSession(store, { kingdomId: requireKingdom(), roleType: value.role_type, bindingId: value.binding_id, sessionId: value.session_id, modelName: value.model_name, agentName: value.agent_name, sessionMeta: value.session_meta }, auth));
+                    return { kind: text.startsWith('UNKNOWN/') || text.startsWith('错误：') ? 'error' : 'success', text };
                 }
-                case 'reset': {
-                    const result = manager.rescan();
-                    return { kind: 'success', text: `已重新接入。${result.detail}` };
+                case 'execution-profile': {
+                    const parsed = parseJsonEnvelope(rest, ['role_type', 'binding_id', 'provider', 'model', 'clear']);
+                    if (!parsed.ok)
+                        return { kind: 'error', text: `INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: ${parsed.message}` };
+                    const value = parsed.value;
+                    if ((value.role_type === undefined) === (value.binding_id === undefined))
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: role_type/binding_id 必须二选一。' };
+                    if (value.clear !== undefined && typeof value.clear !== 'boolean')
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: clear 必须是 boolean。' };
+                    for (const key of ['role_type', 'binding_id', 'provider', 'model']) {
+                        if (value[key] !== undefined && typeof value[key] !== 'string')
+                            return { kind: 'error', text: `INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: ${key} 必须是 string。` };
+                    }
+                    if (value.clear !== true && typeof value.provider !== 'string' && typeof value.model !== 'string')
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: 至少提供 provider/model，或 clear=true。' };
+                    const text = ownerWrite('execution-profile', () => setExecutionProfile(store, { kingdomId: requireKingdom(), roleType: value.role_type, bindingId: value.binding_id, profile: value.clear === true ? null : { ...(typeof value.provider === 'string' ? { provider: value.provider } : {}), ...(typeof value.model === 'string' ? { model: value.model } : {}) } }, auth));
+                    return { kind: text.startsWith('UNKNOWN/') || text.startsWith('错误：') ? 'error' : 'success', text };
                 }
                 case 'help':
                 case '':
+                    if (rest)
+                        return { kind: 'error', text: 'INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: help 不接受额外 token。' };
                     return {
                         kind: 'success',
                         text: [
-                            'dsh-Kingdom v0.4（换届 + 会话归属）',
-                            '/kingdom init    初始化或接入本地王国（幂等；首次初始化后会给出创建方式二选一）',
-                            '/kingdom status  查看王国真实状态',
-                            '/kingdom reset   重新扫描接入（不删除数据）',
-                            '组织王国：先为角色绑定独立会话（kingdom_bind_session），不要默认由当前会话代跑全部角色',
-                            '换届与归属：kingdom_unbind_role 解绑；kingdom_bind_session 绑定/更换角色会话（含 model/agent 预留字段）',
-                            'GUI：前端页面由 GUI 部署方提供；后端网关 http://127.0.0.1:<guiPort> 填入前端连接框（默认关闭，配置 guiPort 开启）',
-                            '也可用自然语言：初始化王国 / 创建领地 / 绑定角色 / 规划任务 / 派发任务 / 审查结果',
-                            '',
-                            '任务闭环：plan → assign → start（Worker 执行）→ review（ACCEPT/REWORK/FAIL）',
-                            'Worker 交回的结果只是待审查的 Claim（任务进入 REVIEW），',
-                            '只有 Supervisor 的 ACCEPT 才能让任务成为 DONE。',
-                            '',
-                            'GUI：kingdom_snapshot / kingdom_task_detail 返回结构化 JSON；',
-                            '配置 guiPort 可开本地 HTTP 通道（默认关闭，只绑 127.0.0.1）。',
+                            'dsh-Kingdom Owner Control Plane（Owner ≠ Agent ≠ Session）',
+                            '/kingdom init    原子初始化/接入；OWNER.session_id 永远为 null',
+                            '/kingdom status  查看真实状态（只读）',
+                            '/kingdom owner.gui <严格 JSON>  激活具体动作/资源范围的短期人类管理窗口；/owner 页面提供激活格式说明',
+                            '/kingdom ceiling {"ceiling":{"tool:pwsh":true}} | {"clear":true}',
+                            '/kingdom territory.create {"name":"研发领","workspace_path":"C:/work"}',
+                            '/kingdom territory.delete {"territory_id":"...","force":false}',
+                            '/kingdom territory.supervisor {"territory_id":"...","supervisor_binding_id":"..."}',
+                            '/kingdom role.bind {"role_type":"SUPERVISOR","role_name":"主理","session_id":"真实 DSH session"}',
+                            '/kingdom role.unbind {"binding_id":"...","reason":"换届"}',
+                            '/kingdom role.session {"binding_id":"...","session_id":"真实 DSH session"}',
+                            '/kingdom execution-profile {"binding_id":"...","provider":"spawn","model":"..."}',
+                            '以上写命令只接受一个 JSON object；unknown key、额外 token、Owner Session 均拒绝。',
+                            'Agent Role Plane：plan → assign → kingdom_start_task_governed（CANONICAL HEADLESS，Persistent Worker） → Claim(REVIEW) → Supervisor ACCEPT/REWORK/FAIL。',
+                            'LEGACY_COMPAT：kingdom_start_task 仅在用户明确选择旧 one-shot 兼容模式时显式调用；persistent 失败不会自动 fallback。',
+                            'GUI 需先由 direct `/kingdom gui` 激活；HTTP 只作无权 transport，命令仍经同一 Core/Role/Capability gates。',
                         ].join('\n'),
                     };
                 default:
-                    return { kind: 'error', text: `未知子命令 "${sub}"。可用：init / status / reset / help` };
+                    return { kind: 'error', text: `INPUT_DENIED [OWNER_COMMAND_GRAMMAR]: 未知子命令 "${sub}"。请使用 /kingdom help。` };
             }
         },
     }), 'dsh-kingdom: /kingdom command');