oasis_test_v2 2.2.80 → 2.2.82

package/dist/index.js

@@ -2950,6 +2950,25 @@ async function fetchResultPackage(base, fetchImpl, runId) {
   }));
   return { artifacts, fileCount: body2.project?.fileCount ?? artifacts.length };
 }
+function toEpochMs(v2) {
+  if (typeof v2 === "number" && Number.isFinite(v2)) return v2;
+  if (typeof v2 === "string" && v2.length > 0) {
+    const ms = Date.parse(v2);
+    return Number.isNaN(ms) ? void 0 : ms;
+  }
+  return void 0;
+}
+function runTime(r) {
+  return r.createdAt ?? r.updatedAt ?? Number.NEGATIVE_INFINITY;
+}
+function latestSucceededRun(runs) {
+  let best;
+  for (const r of runs) {
+    if (r.status !== "succeeded") continue;
+    if (best === void 0 || runTime(r) > runTime(best)) best = r;
+  }
+  return best;
+}
 async function fetchBoardStatus(base, fetchImpl, artifactId) {
   const boardKey = deriveBoardKey(artifactId);
   let boardExists = true;
@@ -2975,10 +2994,20 @@ async function fetchBoardStatus(base, fetchImpl, artifactId) {
         "GET",
         `/api/runs?projectId=${encodeURIComponent(boardKey)}`
       );
-      runs = (body2.runs ?? []).map((r) => ({
-        runId: String(r["runId"] ?? r["id"] ?? ""),
-        status: String(r["status"] ?? "unknown")
-      }));
+      runs = (body2.runs ?? []).map((r) => {
+        const run = {
+          runId: String(r["runId"] ?? r["id"] ?? ""),
+          status: String(r["status"] ?? "unknown")
+        };
+        if (typeof r["agentId"] === "string" && r["agentId"].length > 0) run.agentId = r["agentId"];
+        if (typeof r["error"] === "string" && r["error"].trim().length > 0) run.error = r["error"];
+        const createdAt = toEpochMs(r["createdAt"]);
+        if (createdAt !== void 0) run.createdAt = createdAt;
+        const updatedAt = toEpochMs(r["updatedAt"]);
+        if (updatedAt !== void 0) run.updatedAt = updatedAt;
+        return run;
+      });
+      runs.sort((a, b2) => runTime(b2) - runTime(a) || 0);
     } catch {
     }
   }
@@ -218354,13 +218383,22 @@ function cloneOffboarding(op) {
     assignmentDecisions: op.assignmentDecisions.map((d) => ({ ...d, toPrincipal: { ...d.toPrincipal } }))
   };
 }
-var memberKey, scopedKey, bridgeKey, MemoryControlPlaneStore;
+var memberKey, scopedKey, bridgeKey, migrationRow, MemoryControlPlaneStore;
 var init_memory_control_plane_store = __esm({
   "../testkit/src/memory-control-plane-store.ts"() {
     "use strict";
     memberKey = (companyId, accountId) => `${companyId} ${accountId}`;
     scopedKey = (companyId, id) => `${companyId}\0${id}`;
     bridgeKey = (companyId, type, id) => `${companyId}\0${type}\0${id}`;
+    migrationRow = (companyId, accountId, roleBefore, roleAfter, audit2) => ({
+      companyId,
+      accountId,
+      roleBefore,
+      roleAfter,
+      evidence: audit2.evidence,
+      ...audit2.evidence === "manifest" && audit2.manifestVersion !== void 0 ? { manifestVersion: audit2.manifestVersion } : {},
+      appliedAt: audit2.appliedAt
+    });
     MemoryControlPlaneStore = class {
       companies = /* @__PURE__ */ new Map();
       members = /* @__PURE__ */ new Map();
@@ -218387,6 +218425,8 @@ var init_memory_control_plane_store = __esm({
       // key = companyId\0type\0id
       offboardings = /* @__PURE__ */ new Map();
       // key = companyId\0operationId
+      /** 存量身份映射审计（ADR D3.4）：**只追加**的一条数组，插入序即写入序。 */
+      roleMigrations = [];
       // —— 公司 ——
       async createCompany(c) {
         if (this.companies.has(c.id)) throw new Error(`company already exists: ${c.id}`);
@@ -218418,8 +218458,25 @@ var init_memory_control_plane_store = __esm({
         }
         if (patch.status !== void 0) c.status = patch.status;
         if (patch.onboardingVariant !== void 0) c.onboardingVariant = patch.onboardingVariant;
+        if (patch.dissolvedAt !== void 0) {
+          if (patch.dissolvedAt === null) delete c.dissolvedAt;
+          else c.dissolvedAt = patch.dissolvedAt;
+        }
+        if (patch.dissolvedBy !== void 0) {
+          if (patch.dissolvedBy === null) delete c.dissolvedBy;
+          else c.dissolvedBy = patch.dissolvedBy;
+        }
         this.companies.set(id, c);
       }
+      async dissolveCompanyIfOwner(companyId, accountId, at2) {
+        const c = this.companies.get(companyId);
+        if (!c) return { ok: false, reason: "not_found" };
+        const caller = this.members.get(memberKey(companyId, accountId));
+        if (!caller || caller.role !== "owner") return { ok: false, reason: "not_owner" };
+        const next = { ...c, status: "suspended", dissolvedAt: at2, dissolvedBy: accountId };
+        this.companies.set(companyId, next);
+        return { ok: true, company: { ...next } };
+      }
       // —— 成员 ——
       async upsertMember(m2) {
         const key2 = memberKey(m2.companyId, m2.accountId);
@@ -218461,6 +218518,21 @@ var init_memory_control_plane_store = __esm({
         this.members.delete(key2);
         return { ok: true, member: { ...target } };
       }
+      async removeMemberAndReleaseOwnedAgents(companyId, accountId, at2) {
+        const target = this.members.get(memberKey(companyId, accountId));
+        if (!target) return { ok: false, reason: "not_found" };
+        if (target.role === "owner") return { ok: false, reason: "owner_protected" };
+        const releasedAgents = [];
+        for (const [key2, e] of this.digitalEmployees) {
+          if (e.companyId !== companyId || e.ownerAccountId !== accountId) continue;
+          const { ownerAccountId: _cleared, ...rest } = e;
+          this.digitalEmployees.set(key2, { ...rest, updatedAt: at2 });
+          releasedAgents.push(e.id);
+        }
+        this.principalBridges.delete(bridgeKey(companyId, "human", accountId));
+        this.members.delete(memberKey(companyId, accountId));
+        return { ok: true, member: { ...target }, releasedAgents };
+      }
       async updateMemberRoleIfNotLastOwner(companyId, accountId, role) {
         const key2 = memberKey(companyId, accountId);
         const target = this.members.get(key2);
@@ -218476,6 +218548,72 @@ var init_memory_control_plane_store = __esm({
         this.members.set(key2, updated);
         return { ok: true, member: { ...updated } };
       }
+      async setSoleCompanyOwner(companyId, toAccountId, opts) {
+        const target = this.members.get(memberKey(companyId, toAccountId));
+        if (!target) return { ok: false, reason: "not_found" };
+        if (opts?.requireCurrentOwner !== void 0) {
+          const caller = this.members.get(memberKey(companyId, opts.requireCurrentOwner));
+          if (!caller || caller.role !== "owner") return { ok: false, reason: "not_owner" };
+        }
+        if (!target.onboardingCompletedAt && target.role !== "owner") {
+          return { ok: false, reason: "target_not_listed" };
+        }
+        const acc = this.accounts.get(toAccountId);
+        if (!acc || acc.status !== "active") return { ok: false, reason: "target_inactive" };
+        const others = [];
+        for (const m2 of this.members.values()) {
+          if (m2.companyId === companyId && m2.role === "owner" && m2.accountId !== toAccountId) others.push(m2);
+        }
+        if (others.length === 0 && target.role === "owner") {
+          return { ok: true, owner: { ...target }, demoted: [] };
+        }
+        const demoted = others.map((m2) => {
+          const next = { ...m2, role: "admin" };
+          this.members.set(memberKey(companyId, m2.accountId), next);
+          return { ...next };
+        });
+        const owner = { ...target, role: "owner" };
+        this.members.set(memberKey(companyId, toAccountId), owner);
+        return { ok: true, owner: { ...owner }, demoted };
+      }
+      // —— 存量身份映射（ADR D3）——
+      async migrateSoleCompanyOwner(companyId, toAccountId, audit2) {
+        const target = this.members.get(memberKey(companyId, toAccountId));
+        if (!target) return { ok: false, reason: "not_found" };
+        const others = [];
+        for (const m2 of this.members.values()) {
+          if (m2.companyId === companyId && m2.role === "owner" && m2.accountId !== toAccountId) others.push(m2);
+        }
+        if (others.length === 0 && target.role === "owner") {
+          return { ok: true, owner: { ...target }, demoted: [], auditRows: [] };
+        }
+        const auditRows = [];
+        const demoted = others.map((m2) => {
+          const next = { ...m2, role: "admin" };
+          this.members.set(memberKey(companyId, m2.accountId), next);
+          auditRows.push(migrationRow(companyId, m2.accountId, "owner", "admin", audit2));
+          return { ...next };
+        });
+        if (target.role !== "owner") auditRows.push(migrationRow(companyId, toAccountId, target.role, "owner", audit2));
+        const owner = { ...target, role: "owner" };
+        this.members.set(memberKey(companyId, toAccountId), owner);
+        for (const r of auditRows) this.roleMigrations.push({ ...r });
+        return { ok: true, owner: { ...owner }, demoted, auditRows };
+      }
+      async setMemberRoleOnly(companyId, accountId, role) {
+        const key2 = memberKey(companyId, accountId);
+        const cur = this.members.get(key2);
+        if (!cur) return false;
+        this.members.set(key2, { ...cur, role });
+        return true;
+      }
+      // —— 存量身份映射审计（ADR D3.4）：只追加 ——
+      async appendMemberRoleMigrations(rows) {
+        for (const r of rows) this.roleMigrations.push({ ...r });
+      }
+      async listMemberRoleMigrations(companyId) {
+        return this.roleMigrations.filter((r) => companyId === void 0 || r.companyId === companyId).map((r) => ({ ...r }));
+      }
       // —— 邀请 ——
       async createInvitation(inv) {
         if (this.invitations.has(inv.id)) throw new Error(`invitation already exists: ${inv.id}`);
@@ -223753,9 +223891,16 @@ var init_control_plane_file_store = __esm({
     MUTATORS2 = [
       "createCompany",
       "updateCompany",
+      "dissolveCompanyIfOwner",
       "upsertMember",
       "removeMember",
       "removeMemberIfNotLastOwner",
+      "updateMemberRoleIfNotLastOwner",
+      "setSoleCompanyOwner",
+      "removeMemberAndReleaseOwnedAgents",
+      "migrateSoleCompanyOwner",
+      "setMemberRoleOnly",
+      "appendMemberRoleMigrations",
       "createInvitation",
       "updateInvitationStatus",
       "updateInvitationStatusIf",
@@ -223807,6 +223952,7 @@ var init_control_plane_file_store = __esm({
           for (const c of snap.agentCredentials ?? []) await MemoryControlPlaneStore.prototype.putAgentCredential.call(store, c);
           for (const b2 of snap.principalBridges ?? []) await MemoryControlPlaneStore.prototype.putPrincipalBridge.call(store, b2);
           for (const op of snap.offboardings ?? []) store.offboardings.set(`${op.companyId}\0${op.operationId}`, op);
+          for (const r of snap.roleMigrations ?? []) store.roleMigrations.push({ ...r });
           if (needsOnboardingBackfill) await store.save();
         } else {
           fs25.mkdirSync(path24.dirname(file), { recursive: true });
@@ -223844,7 +223990,8 @@ var init_control_plane_file_store = __esm({
           agentCredentials,
           principalBridges,
           // 交接操作无按公司列举的读面（按 operationId / accountId 定位），直接读 protected map。
-          offboardings: [...this.offboardings.values()]
+          offboardings: [...this.offboardings.values()],
+          roleMigrations: await this.listMemberRoleMigrations()
         };
         fs25.writeFileSync(this.file, JSON.stringify(snap, null, 2));
       }
@@ -225071,6 +225218,176 @@ var init_org_model_backfill = __esm({
   }
 });
 
+// ../server/src/org-identity-migration.ts
+function e1Candidate(members) {
+  if (members.length === 0) return void 0;
+  if (members.some((m2) => !m2.createdAt)) return void 0;
+  return [...members].sort((a, b2) => {
+    const ta = a.createdAt;
+    const tb = b2.createdAt;
+    if (ta !== tb) return ta < tb ? -1 : 1;
+    return a.accountId < b2.accountId ? -1 : a.accountId > b2.accountId ? 1 : 0;
+  })[0];
+}
+async function inventoryOrgIdentity(deps, opts = {}) {
+  const listMembers = deps.listMembersWithCreatedAt ?? ((cid) => deps.store.listMembers(cid));
+  const companies = (await deps.store.listCompanies()).filter((c) => opts.companyId === void 0 || c.id === opts.companyId);
+  const rows = [];
+  for (const c of companies) {
+    const members = await listMembers(c.id);
+    rows.push(decide(c, members, opts.manifest));
+  }
+  return {
+    rows,
+    blocked: rows.filter((r) => r.decision.startsWith("blocked")).length,
+    pending: rows.filter((r) => (r.decision === "remap" || r.decision === "manifest") && r.changes.length > 0).length
+  };
+}
+function decide(company, members, manifest) {
+  const owners = members.filter((m2) => m2.role === "owner");
+  const base = {
+    companyId: company.id,
+    companyName: company.name,
+    status: company.status,
+    members: members.length,
+    owners: owners.length,
+    admins: members.filter((m2) => m2.role === "admin").length,
+    plainMembers: members.filter((m2) => m2.role === "member").length,
+    rowsWithoutCreatedAt: members.filter((m2) => !m2.createdAt).length,
+    changes: []
+  };
+  if (members.length === 0) {
+    return { ...base, decision: "blocked:empty", reason: "\u7EC4\u7EC7\u6CA1\u6709\u4EFB\u4F55\u6210\u5458\u884C\u2014\u2014\u5220\u8FD8\u662F\u7559\u7531\u4EBA\u51B3\u5B9A\uFF0C\u811A\u672C\u4E0D\u78B0" };
+  }
+  const pinned = manifest?.owners[company.id];
+  if (pinned !== void 0) {
+    if (!members.some((m2) => m2.accountId === pinned)) {
+      return {
+        ...base,
+        decision: "blocked:no-owner",
+        reason: `manifest \u6307\u5B9A\u7684 ${pinned} \u4E0D\u662F\u8BE5\u7EC4\u7EC7\u73B0\u5B58\u6210\u5458\u884C\u2014\u2014\u6307\u9519\u4EBA\u6BD4\u4E0D\u6307\u66F4\u7CDF\uFF0C\u62D2\u7EDD\u6267\u884C`
+      };
+    }
+    return {
+      ...base,
+      decision: "manifest",
+      targetOwnerAccountId: pinned,
+      changes: plannedChanges(members, pinned),
+      reason: `\u6309\u51BB\u7ED3 manifest\uFF08${manifest.manifestVersion}\uFF09\u6307\u5B9A ${pinned} \u4E3A\u7EC4\u7EC7\u7BA1\u7406\u5458`
+    };
+  }
+  const e1 = e1Candidate(members);
+  if (!e1) {
+    return {
+      ...base,
+      decision: "blocked:no-created-at",
+      reason: `\u6709 ${base.rowsWithoutCreatedAt} \u884C\u6210\u5458\u6CA1\u6709 created_at\uFF08\u8BE5\u5217\u662F expand \u671F\u624D\u52A0\u7684\uFF09\uFF0CE1 \u4E0D\u6210\u7ACB \u2192 \u5199\u8FDB manifest \u7531\u4EBA\u6307\u5B9A\u521B\u5EFA\u8005`
+    };
+  }
+  if (e1.role === "member") {
+    return {
+      ...base,
+      decision: "blocked:e1-is-plain-member",
+      e1AccountId: e1.accountId,
+      reason: `\u6700\u65E9\u52A0\u5165\u7684 ${e1.accountId} \u5F53\u524D\u662F\u666E\u901A\u6210\u5458\uFF08\u53EF\u80FD\u88AB\u964D\u7EA7\u8FC7\uFF0C\u6216\u6570\u636E\u6765\u81EA\u8FC1\u79FB\u6307\u6D3E\uFF09\u2192 \u7531\u4EBA\u6307\u5B9A`
+    };
+  }
+  if (owners.length === 0) {
+    return {
+      ...base,
+      decision: "blocked:no-owner",
+      e1AccountId: e1.accountId,
+      reason: "\u4E00\u4E2A owner \u90FD\u6CA1\u6709 \u2192 \u7531\u4EBA\u6307\u5B9A\uFF08\u8C01\u5F53\u552F\u4E00\u6301\u6709\u4EBA\u662F\u4E0D\u53EF\u9006\u7684\u4EBA\u4E8B\u51B3\u5B9A\uFF09"
+    };
+  }
+  const changes = plannedChanges(members, e1.accountId);
+  if (changes.length === 0) {
+    return {
+      ...base,
+      decision: "ok",
+      e1AccountId: e1.accountId,
+      targetOwnerAccountId: e1.accountId,
+      reason: "\u5DF2\u7ECF\u6070\u6709\u4E00\u4F4D\u7EC4\u7EC7\u7BA1\u7406\u5458\u3001\u4E14\u5C31\u662F\u6700\u65E9\u52A0\u5165\u7684\u90A3\u4F4D\u2014\u2014\u65E0\u9700\u6539\u52A8"
+    };
+  }
+  return {
+    ...base,
+    decision: "remap",
+    e1AccountId: e1.accountId,
+    targetOwnerAccountId: e1.accountId,
+    changes,
+    reason: `E1\uFF1A\u6700\u65E9\u52A0\u5165\u7684 ${e1.accountId}\uFF08\u5F53\u524D ${e1.role}\uFF09\u2192 \u7EC4\u7EC7\u7BA1\u7406\u5458\uFF0C\u5176\u4F59\u539F owner \u964D\u4E3A\u7BA1\u7406\u5458`
+  };
+}
+function plannedChanges(members, targetOwner) {
+  const out = [];
+  for (const m2 of members) {
+    if (m2.accountId === targetOwner) {
+      if (m2.role !== "owner") out.push({ accountId: m2.accountId, roleBefore: m2.role, roleAfter: "owner" });
+      continue;
+    }
+    if (m2.role === "owner") out.push({ accountId: m2.accountId, roleBefore: "owner", roleAfter: "admin" });
+  }
+  return out;
+}
+async function backfillOrgIdentity(deps, opts = {}) {
+  const log3 = opts.log ?? (() => {
+  });
+  const now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+  const inv = await inventoryOrgIdentity(deps, opts);
+  let applied = 0;
+  let auditRows = 0;
+  for (const row of inv.rows) {
+    if (row.decision !== "remap" && row.decision !== "manifest") {
+      if (row.decision.startsWith("blocked")) log3(`  \u26D4 ${row.companyId} ${row.decision}\uFF1A${row.reason}`);
+      continue;
+    }
+    if (row.changes.length === 0) continue;
+    const target = row.targetOwnerAccountId;
+    const desc = row.changes.map((c) => `${c.accountId} ${c.roleBefore}\u2192${c.roleAfter}`).join("\uFF0C");
+    log3(`  ${row.companyId}\uFF1A${desc}${opts.apply ? "" : "\uFF08dry-run\uFF09"}`);
+    if (!opts.apply) continue;
+    const evidence = row.decision === "manifest" ? "manifest" : "E1";
+    const res = await deps.store.migrateSoleCompanyOwner(row.companyId, target, {
+      evidence,
+      ...opts.manifest?.manifestVersion !== void 0 ? { manifestVersion: opts.manifest.manifestVersion } : {},
+      appliedAt: now()
+    });
+    if (!res.ok) {
+      throw new Error(`${row.companyId} \u6536\u655B\u5230 ${target} \u5931\u8D25\uFF1A${res.reason}\uFF08\u90A3\u4E00\u884C\u4E0D\u5728\u8BE5\u7EC4\u7EC7\u7684\u6210\u5458\u8868\u91CC\uFF09`);
+    }
+    applied += 1;
+    auditRows += res.auditRows.length;
+  }
+  return { ...inv, applied, auditRows };
+}
+async function rollbackOrgIdentity(deps, opts) {
+  const log3 = opts.log ?? (() => {
+  });
+  const audit2 = await deps.store.listMemberRoleMigrations(opts.companyId);
+  const plan = [];
+  let reverted = 0;
+  for (const r of [...audit2].reverse()) {
+    const member = await deps.store.getMember(r.companyId, r.accountId);
+    if (!member) {
+      log3(`  \u8DF3\u8FC7 ${r.accountId}\uFF1A\u6210\u5458\u884C\u5DF2\u4E0D\u5B58\u5728\uFF08\u88AB\u79FB\u9664\u8FC7\uFF09`);
+      continue;
+    }
+    if (member.role === r.roleBefore) continue;
+    plan.push({ companyId: r.companyId, accountId: r.accountId, from: member.role, to: r.roleBefore });
+    log3(`  ${r.companyId} ${r.accountId} ${member.role}\u2192${r.roleBefore}${opts.apply ? "" : "\uFF08dry-run\uFF09"}`);
+    if (!opts.apply) continue;
+    await deps.store.setMemberRoleOnly(r.companyId, r.accountId, r.roleBefore);
+    reverted += 1;
+  }
+  return { plan, reverted };
+}
+var init_org_identity_migration = __esm({
+  "../server/src/org-identity-migration.ts"() {
+    "use strict";
+  }
+});
+
 // ../server/src/config-audit.ts
 function shallowDiff(before, after) {
   const out = {};
@@ -232382,6 +232699,68 @@ var init_runtime_tenancy = __esm({
   }
 });
 
+// ../server/src/governance/agent-manage-guard.ts
+function isCompanyManager(role) {
+  return role === "owner" || role === "admin";
+}
+function isAssistantAgent(subject) {
+  return subject.positions.includes(ASSISTANT_POSITION);
+}
+function mayManageAgent(caller, subject) {
+  if (!isAssistantAgent(subject)) return isCompanyManager(caller.role);
+  if (subject.boundHumanActorId === void 0) return isCompanyManager(caller.role);
+  if (subject.boundHumanActorId === caller.actorId) return true;
+  if (subject.boundHumanReportsTo !== void 0 && subject.boundHumanReportsTo === caller.actorId) return true;
+  return isCompanyManager(caller.role);
+}
+async function assertMayManageAgent(guard, ctx, agent) {
+  if (!guard) return;
+  const role = await guard.callerRole(ctx.companyId, ctx.callerActorId);
+  const subject = { positions: agent.positions };
+  if (isAssistantAgent(subject)) {
+    const human = await guard.boundHuman(ctx.companyId, agent.id);
+    if (human) {
+      subject.boundHumanActorId = human;
+      subject.boundHumanReportsTo = await guard.reportsTo(ctx.companyId, human) ?? void 0;
+    }
+  }
+  if (mayManageAgent({ role, actorId: ctx.callerActorId }, subject)) return;
+  throw new AgentManageForbiddenError(
+    isAssistantAgent(subject) ? "\u53EA\u6709\u672C\u4EBA\u3001\u5176\u76F4\u63A5\u4E0A\u7EA7\u6216\u7EC4\u7EC7\u7BA1\u7406\u5458 / \u7BA1\u7406\u5458\u53EF\u4EE5\u7BA1\u7406\u8FD9\u4E2A\u52A9\u7406" : "\u53EA\u6709\u7EC4\u7EC7\u7BA1\u7406\u5458 / \u7BA1\u7406\u5458\u53EF\u4EE5\u7BA1\u7406\u4E13\u5BB6 Agent"
+  );
+}
+async function assertCompanyManager(guard, ctx, what) {
+  if (!guard) return;
+  const role = await guard.callerRole(ctx.companyId, ctx.callerActorId);
+  if (isCompanyManager(role)) return;
+  throw new AgentManageForbiddenError(`\u53EA\u6709\u7EC4\u7EC7\u7BA1\u7406\u5458 / \u7BA1\u7406\u5458\u53EF\u4EE5${what}`);
+}
+async function assertMayCreateAgent(guard, ctx) {
+  return assertCompanyManager(guard, ctx, "\u65B0\u5EFA Agent");
+}
+async function assertMaySelfOrManage(guard, ctx, targetActorId) {
+  if (!guard) return;
+  if (ctx.callerActorId === targetActorId) return;
+  const role = await guard.callerRole(ctx.companyId, ctx.callerActorId);
+  if (isCompanyManager(role)) return;
+  throw new AgentManageForbiddenError("\u53EA\u80FD\u4FEE\u6539\u81EA\u5DF1\u7684\u6863\u6848\uFF1B\u6539\u4ED6\u4EBA\u7684\u9700\u8981\u7EC4\u7EC7\u7BA1\u7406\u5458 / \u7BA1\u7406\u5458\u6743\u9650");
+}
+var ASSISTANT_POSITION, AgentManageForbiddenError;
+var init_agent_manage_guard = __esm({
+  "../server/src/governance/agent-manage-guard.ts"() {
+    "use strict";
+    ASSISTANT_POSITION = "assistant";
+    AgentManageForbiddenError = class extends Error {
+      status = 403;
+      code = "FORBIDDEN";
+      constructor(message) {
+        super(message);
+        this.name = "AgentManageForbiddenError";
+      }
+    };
+  }
+});
+
 // ../server/src/domains/actors/routes.ts
 async function asApiError(run) {
   try {
@@ -232470,6 +232849,33 @@ function mapMarketError(err) {
 }
 function actorsDomain(opts) {
   const { resolveCtx } = opts;
+  const asForbidden = async (run) => {
+    try {
+      await run();
+    } catch (e) {
+      if (e instanceof AgentManageForbiddenError) throw new ApiError(e.status, e.code, e.message);
+      throw e;
+    }
+  };
+  const guardAgentWrite = async (req, actor) => {
+    const ctx = { companyId: req.auth.companyId, callerActorId: req.auth.actor };
+    if (actor.kind !== "agent") {
+      await asForbidden(() => assertMaySelfOrManage(opts.agentManageGuard, ctx, actor.id));
+      return;
+    }
+    await asForbidden(() => assertMayManageAgent(opts.agentManageGuard, ctx, { id: actor.id, positions: actor.roles }));
+  };
+  const guardPositionsChange = async (req, existing, nextPositions) => {
+    if (existing.kind !== "agent" || nextPositions === void 0) return;
+    if (isAssistantAgent({ positions: existing.roles }) === isAssistantAgent({ positions: nextPositions })) return;
+    const ctx = { companyId: req.auth.companyId, callerActorId: req.auth.actor };
+    await asForbidden(() => assertMayManageAgent(opts.agentManageGuard, ctx, { id: existing.id, positions: nextPositions }));
+  };
+  const guardExistingActorWrite = async (req, service, actorId) => {
+    const existing = await service.getActor(actorId);
+    if (!existing) throw new ApiError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A\u5458\u5DE5\uFF1A${actorId}`);
+    await guardAgentWrite(req, existing);
+  };
   const revealLimits = opts.credentialRevealLimits ?? { perSession: 200, perSessionPerKey: 20 };
   const revealLimiter = new RevealRateLimiter(revealLimits.perSession, revealLimits.perSessionPerKey);
   const consoleRevealLimits = opts.credentialRevealLimits?.console ?? { perSession: 60, perSessionPerKey: 10 };
@@ -232522,6 +232928,10 @@ function actorsDomain(opts) {
       const { service } = await resolveCtx(req.auth.companyId);
       const b2 = req.body;
       if (!b2?.id || !b2.kind || !b2.name) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 id / kind / name");
+      await asForbidden(() => assertMayCreateAgent(opts.agentManageGuard, {
+        companyId: req.auth.companyId,
+        callerActorId: req.auth.actor
+      }));
       const { id, kind, name } = b2;
       const positions = positionsFromPayload(b2);
       const avatar = avatarRefFromPayload(b2);
@@ -232548,10 +232958,12 @@ function actorsDomain(opts) {
       const { service } = await resolveCtx(req.auth.companyId);
       const existing = await service.getActor(req.params.id);
       if (!existing) throw new ApiError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A\u5458\u5DE5\uFF1A${req.params.id}`);
+      await guardAgentWrite(req, existing);
       const b2 = req.body ?? {};
       const positions = positionsFromPayload(b2);
       const avatar = avatarRefFromPayload(b2);
       const tags = tagsFromPayload(b2);
+      await guardPositionsChange(req, existing, positions);
       const {
         positions: _positions,
         id: _id,
@@ -232582,23 +232994,27 @@ function actorsDomain(opts) {
     });
     router.delete("/api/actors/:id", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
+      await guardExistingActorWrite(req, service, req.params.id);
       await service.disableActor(req.params.id, req.auth.actor);
       return { status: 200, body: { ok: true } };
     });
     router.post("/api/actors/:id/avatar", async (req) => {
       const { service, blobs } = await resolveCtx(req.auth.companyId);
       if (!blobs) throw new ApiError(501, "NOT_IMPLEMENTED", "blob \u5B58\u50A8\u672A\u63A5\u5165");
+      await guardExistingActorWrite(req, service, req.params.id);
       const ref2 = await storeImageBlob(blobs, req.body?.data);
       const actor = await service.setActorAvatar(req.params.id, ref2, req.auth.actor);
       return { status: 201, body: { avatar: actor.avatar } };
     });
     router.delete("/api/actors/:id/avatar", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
+      await guardExistingActorWrite(req, service, req.params.id);
       await service.setActorAvatar(req.params.id, null, req.auth.actor);
       return { status: 200, body: { ok: true } };
     });
     router.post("/api/teams/:id/icon", async (req) => {
       const { service, blobs } = await resolveCtx(req.auth.companyId);
+      await asForbidden(() => assertCompanyManager(opts.agentManageGuard, { companyId: req.auth.companyId, callerActorId: req.auth.actor }, "\u6539\u56E2\u961F\u56FE\u6807"));
       if (!blobs) throw new ApiError(501, "NOT_IMPLEMENTED", "blob \u5B58\u50A8\u672A\u63A5\u5165");
       const ref2 = await storeImageBlob(blobs, req.body?.data);
       await service.setTeamIcon(req.params.id, ref2);
@@ -232606,6 +233022,7 @@ function actorsDomain(opts) {
     });
     router.delete("/api/teams/:id/icon", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
+      await asForbidden(() => assertCompanyManager(opts.agentManageGuard, { companyId: req.auth.companyId, callerActorId: req.auth.actor }, "\u6539\u56E2\u961F\u56FE\u6807"));
       await service.setTeamIcon(req.params.id, null);
       return { status: 200, body: { ok: true } };
     });
@@ -232617,6 +233034,7 @@ function actorsDomain(opts) {
     });
     router.post("/api/actors/:id/config", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
+      await guardExistingActorWrite(req, service, req.params.id);
       const b2 = req.body ?? {};
       const checkString = (key2) => {
         if (b2[key2] !== void 0 && typeof b2[key2] !== "string") {
@@ -232678,6 +233096,7 @@ function actorsDomain(opts) {
       const { service } = await resolveCtx(req.auth.companyId);
       const actorId = req.params.id;
       if (!await service.getActor(actorId)) throw new ApiError(404, "NOT_FOUND", "\u6CA1\u6709\u8FD9\u4E2A\u5458\u5DE5");
+      await guardExistingActorWrite(req, service, actorId);
       const raw = req.body?.candidates;
       if (!Array.isArray(raw)) throw new ApiError(400, "BAD_REQUEST", "candidates \u5FC5\u987B\u662F\u6570\u7EC4");
       if (raw.length > 20) throw new ApiError(400, "BAD_REQUEST", "\u5019\u9009\u8FD0\u884C\u65F6\u6700\u591A 20 \u6761");
@@ -232712,6 +233131,7 @@ function actorsDomain(opts) {
     });
     router.post("/api/actors/:id/config/rollback", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
+      await guardExistingActorWrite(req, service, req.params.id);
       const b2 = req.body;
       if (typeof b2?.version !== "number") throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 version");
       const cfg = await service.rollbackConfig(req.params.id, b2.version, req.auth.actor);
@@ -232723,6 +233143,7 @@ function actorsDomain(opts) {
     });
     router.patch("/api/actors/:id/settings", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
+      await guardExistingActorWrite(req, service, req.params.id);
       const b2 = req.body ?? {};
       if (b2.memoryEnabled !== void 0 && typeof b2.memoryEnabled !== "boolean") {
         throw new ApiError(400, "BAD_REQUEST", "memoryEnabled \u5FC5\u987B\u662F boolean");
@@ -232742,6 +233163,7 @@ function actorsDomain(opts) {
       const { service } = await resolveCtx(req.auth.companyId);
       const b2 = req.body;
       if (!b2?.id || !b2.name) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 id / name");
+      await asForbidden(() => assertCompanyManager(opts.agentManageGuard, { companyId: req.auth.companyId, callerActorId: req.auth.actor }, "\u65B0\u5EFA\u56E2\u961F"));
       await service.upsertTeam({
         id: b2.id,
         name: b2.name,
@@ -232762,6 +233184,7 @@ function actorsDomain(opts) {
       const { service } = await resolveCtx(req.auth.companyId);
       const b2 = req.body;
       if (!b2?.actorId || !b2.nodeId || !b2.runtimeKind) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 actorId / nodeId / runtimeKind");
+      await guardExistingActorWrite(req, service, b2.actorId);
       const targetNode = await opts.resolveNodeTenancy?.(b2.nodeId).catch(() => null) ?? null;
       const foreign = foreignNodeBlock(targetNode, req.auth.companyId);
       if (foreign) throw new ApiError(400, "NODE_NOT_IN_COMPANY", foreign);
@@ -232770,6 +233193,7 @@ function actorsDomain(opts) {
     });
     router.delete("/api/bindings/:actorId", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
+      await guardExistingActorWrite(req, service, req.params.actorId);
       await service.unbind(req.params.actorId, req.auth.actor);
       return { status: 200, body: { ok: true } };
     });
@@ -232805,6 +233229,7 @@ function actorsDomain(opts) {
     });
     router.put("/api/actors/:id/connectors/:connectorId", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
+      await guardExistingActorWrite(req, service, req.params.id);
       const b2 = req.body;
       if (typeof b2?.enabled !== "boolean") throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 enabled (boolean)");
       const conn = b2.enabled ? await service.setActorConnectorEnabled(req.params.id, req.params.connectorId, true, req.auth.actor) : await service.setActorConnectorEnabled(req.params.id, req.params.connectorId, false);
@@ -233973,6 +234398,7 @@ var init_routes3 = __esm({
     init_skill_materializer();
     init_connector_skills();
     init_runtime_tenancy();
+    init_agent_manage_guard();
     CREDENTIAL_REVEAL_SOURCES = /* @__PURE__ */ new Set(["agent-cli", "agent-exec", "smoke-test", "oasis-internal", "console"]);
     RevealRateLimiter = class {
       constructor(perSession, perSessionPerKey, ttlMs = 2 * 60 * 6e4) {
@@ -234304,7 +234730,7 @@ function createActorsDomain(opts) {
   return {
     service: defaultCtx.service,
     resolveCtx,
-    register: actorsDomain({ resolveCtx, ...opts.resolveTrace ? { resolveTrace: opts.resolveTrace } : {}, ...opts.trace ? { trace: opts.trace } : {}, ...opts.listBuiltinSkills ? { listBuiltinSkills: opts.listBuiltinSkills } : {}, ...opts.getBuiltinSkills ? { getBuiltinSkills: opts.getBuiltinSkills } : {}, ...opts.getConnectorSkills ? { getConnectorSkills: opts.getConnectorSkills } : {}, ...opts.refreshConnectorSkills ? { refreshConnectorSkills: opts.refreshConnectorSkills } : {}, ...opts.memory ? { memory: opts.memory } : {}, ...opts.resolveDispatchScope ? { resolveDispatchScope: opts.resolveDispatchScope } : {}, ...opts.projectExists ? { projectExists: opts.projectExists } : {}, ...opts.companyMemberRole ? { companyMemberRole: opts.companyMemberRole } : {}, ...opts.credentialAudit ? { credentialAudit: opts.credentialAudit } : {}, ...opts.readCredentialAudit ? { readCredentialAudit: opts.readCredentialAudit } : {}, ...opts.credentialRevealLimits ? { credentialRevealLimits: opts.credentialRevealLimits } : {}, ...opts.skillMarket ? { skillMarket: opts.skillMarket } : {}, ...opts.resolveNodeTenancy ? { resolveNodeTenancy: opts.resolveNodeTenancy } : {} })
+    register: actorsDomain({ resolveCtx, ...opts.resolveTrace ? { resolveTrace: opts.resolveTrace } : {}, ...opts.trace ? { trace: opts.trace } : {}, ...opts.listBuiltinSkills ? { listBuiltinSkills: opts.listBuiltinSkills } : {}, ...opts.getBuiltinSkills ? { getBuiltinSkills: opts.getBuiltinSkills } : {}, ...opts.getConnectorSkills ? { getConnectorSkills: opts.getConnectorSkills } : {}, ...opts.refreshConnectorSkills ? { refreshConnectorSkills: opts.refreshConnectorSkills } : {}, ...opts.memory ? { memory: opts.memory } : {}, ...opts.resolveDispatchScope ? { resolveDispatchScope: opts.resolveDispatchScope } : {}, ...opts.projectExists ? { projectExists: opts.projectExists } : {}, ...opts.companyMemberRole ? { companyMemberRole: opts.companyMemberRole } : {}, ...opts.credentialAudit ? { credentialAudit: opts.credentialAudit } : {}, ...opts.readCredentialAudit ? { readCredentialAudit: opts.readCredentialAudit } : {}, ...opts.credentialRevealLimits ? { credentialRevealLimits: opts.credentialRevealLimits } : {}, ...opts.skillMarket ? { skillMarket: opts.skillMarket } : {}, ...opts.resolveNodeTenancy ? { resolveNodeTenancy: opts.resolveNodeTenancy } : {}, ...opts.agentManageGuard ? { agentManageGuard: opts.agentManageGuard } : {} })
   };
 }
 var import_node_crypto55;
@@ -241577,11 +242003,34 @@ var init_service6 = __esm({
       async isEmployedElsewhere(companyId, accountId) {
         return isEmployedElsewhere(this.store, companyId, accountId);
       }
-      /** 当前用户所属的公司（按 membership 聚合）。 */
+      /**
+       * 当前用户所属的公司（按 membership 聚合）。**只返回 `status='active'` 的**。
+       *
+       * 🚨 过滤 status 是「解散组织」能真正生效的一半（组织三层身份 ADR D9.2）：解散取的是可审计的
+       * 停用语义（`status='suspended'` + `dissolved_at/by`），成员行**保留**。不在这里过滤的话，
+       * 被解散的组织仍然会出现在顶栏切换器上、`CompanyGate` 也仍把这个人算作「有组织」——
+       * 解散就只是换了个状态字，人照进不误。口径与 `resolveCurrentCompany` 的无 selector 分支对齐
+       * （那一支本来就只挑 active）。某人全部组织都被解散后，按既有逻辑落到建团队页。
+       */
       async listForUser(accountId) {
         const memberships = await this.store.listMembershipsForAccount(accountId);
         const fetched = await Promise.all(memberships.map((m2) => this.store.getCompany(m2.companyId)));
-        return fetched.filter((c) => c !== null && c !== void 0);
+        return fetched.filter((c) => c !== null && c !== void 0 && c.status === "active");
+      }
+      /**
+       * 「我在哪些组织里还是组织管理员」——注销账号的跨组织检查（ADR D9.3）。
+       * 只看 `status='active'` 的组织：已解散的那家里是不是 owner 已经无关紧要。
+       * **不能只看当前组织**：注销是账号级动作，漏一家就等于把那家组织甩成无人可管。
+       */
+      async listOwnedActiveCompanies(accountId) {
+        const memberships = await this.store.listMembershipsForAccount(accountId);
+        const out = [];
+        for (const m2 of memberships) {
+          if (m2.role !== "owner") continue;
+          const c = await this.store.getCompany(m2.companyId);
+          if (c?.status === "active") out.push(c);
+        }
+        return out;
       }
       async get(id) {
         return this.store.getCompany(id);
@@ -241646,11 +242095,49 @@ var init_service6 = __esm({
         return account;
       }
       /**
-       * 授予某邮箱在某公司的 owner（ADR 0009 切片5：bootstrap 种子 + grant-owner 兜底）。
-       * 确保账号存在 + upsert owner 成员。幂等（重复调把其角色置 owner）。
+       * 授予某邮箱在某公司的组织管理员（ADR 0009 切片5：bootstrap 种子 + `grant-owner` 兜底）。
+       *
+       * 🚨 **它必须自己守 I1**（组织三层身份 ADR D2.4）。老实现是**无条件** upsert `role='owner'`，
+       * 而调用点之一是 serve 的 bootstrap（`OASIS_BOOTSTRAP_OWNER`，在**启动路径**上）——该组织若已有
+       * 组织管理员，它会写出第二位，在部分唯一索引 `company_members_one_owner_idx` 下直接抛错，
+       * **等于 serve 起不来**。所以三分支：
+       *  - 目标已是该组织 owner → no-op，返回既有那行；
+       *  - 组织已有**别的** owner → **不写 owner**、`console.warn`，返回 `{ granted: false, existingOwner }`，
+       *    CLI 侧据此非零退出。但**仍然保证他是成员**：还不是成员就落一条 `admin`（已是成员的角色一个字不动）。
+       *    为什么不是干脆「什么都不写」：这条通道的本意是 ADR 0009 的「第一个 owner 不会把自己锁在门外」
+       *    ——`OASIS_BOOTSTRAP_OWNER_EMAIL` 要让创始人**能登录并进得去管理面**。什么都不写的话，
+       *    首装时若默认公司迁移已经指派过一位 owner，创始人就只有账号、没有任何 membership，
+       *    登录后被 `CompanyGate` 扔到建团队页——兜底通道当场失效。管理面的闸是 `requireOwnerOrAdmin`，
+       *    admin 一样进得去；而「谁是唯一持有人」不该被一次装机悄悄换人。
+       *  - 组织无 owner（首次 bootstrap、或存量 0-owner 的脏数据）→ 照旧指派为 owner。
+       * 「换人」一律走转交（`POST /api/companies/:id/owner`），不从这条兜底通道走。
        */
       async grantOwner(companyId, email2, name) {
         const account = await this.ensureAccount(email2, name);
+        const members = await this.store.listMembers(companyId);
+        const currentOwner = members.find((m2) => m2.role === "owner");
+        if (currentOwner && currentOwner.accountId !== account.id) {
+          const existingSelf = members.find((m2) => m2.accountId === account.id);
+          if (existingSelf) {
+            console.warn(
+              `[companies] ${companyId} \u5DF2\u6709\u7EC4\u7EC7\u7BA1\u7406\u5458 ${currentOwner.accountId}\uFF0C\u672A\u6388\u4E88 ${account.id}\uFF08\u4ED6\u5DF2\u662F\u672C\u7EC4\u7EC7 ${existingSelf.role}\uFF0C\u89D2\u8272\u672A\u6539\uFF09\uFF1B\u5982\u9700\u66F4\u6362\u8BF7\u8D70\u8F6C\u4EA4\uFF08POST /api/companies/${companyId}/owner\uFF09\u3002`
+            );
+            return { granted: false, membership: existingSelf, existingOwner: currentOwner };
+          }
+          const asAdmin = {
+            companyId,
+            accountId: account.id,
+            actorId: account.id,
+            role: "admin",
+            onboardingCompletedAt: this.now()
+          };
+          await this.store.upsertMember(asAdmin);
+          console.warn(
+            `[companies] ${companyId} \u5DF2\u6709\u7EC4\u7EC7\u7BA1\u7406\u5458 ${currentOwner.accountId}\uFF0C\u672A\u6388\u4E88 ${account.id}\uFF1B\u5DF2\u6539\u4E3A\u4EE5\u300C\u7BA1\u7406\u5458\u300D\u52A0\u5165\uFF08\u7BA1\u7406\u9762\u540C\u6837\u53EF\u8FDB\uFF09\u3002\u5982\u9700\u66F4\u6362\u6301\u6709\u4EBA\u8BF7\u8D70\u8F6C\u4EA4\uFF08POST /api/companies/${companyId}/owner\uFF09\u3002`
+          );
+          return { granted: false, membership: asAdmin, existingOwner: currentOwner };
+        }
+        if (currentOwner) return { granted: false, membership: currentOwner };
         const membership = {
           companyId,
           accountId: account.id,
@@ -241659,7 +242146,7 @@ var init_service6 = __esm({
           onboardingCompletedAt: this.now()
         };
         await this.store.upsertMember(membership);
-        return membership;
+        return { granted: true, membership };
       }
       /**
        * 当前公司解析（动态、随登录用户走）：
@@ -241672,6 +242159,7 @@ var init_service6 = __esm({
         let company;
         if (selector) {
           company = await this.store.getCompany(selector) ?? await this.store.getCompanyBySlug(selector);
+          if (company && company.status !== "active") company = null;
         } else {
           company = null;
           for (const m2 of await this.store.listMembershipsForAccount(accountId)) {
@@ -241774,11 +242262,91 @@ var init_service6 = __esm({
        */
       async changeMemberRole(companyId, accountId, role) {
         if (!ROLES.includes(role)) throw new CompanyError(400, "BAD_ROLE", `role \u987B\u4E3A ${ROLES.join(" | ")}`);
+        if (role === "owner") {
+          throw new CompanyError(400, "OWNER_NOT_ASSIGNABLE", "\u7EC4\u7EC7\u7BA1\u7406\u5458\u53EA\u80FD\u7ECF\u8F6C\u4EA4\u4EA7\u751F\uFF0C\u4E0D\u80FD\u76F4\u63A5\u6307\u6D3E");
+        }
         await this.requireCompany(companyId);
+        const target = await this.store.getMember(companyId, accountId);
+        if (!target) throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
+        if (target.role === "owner") throw this.ownerProtected();
         const res = await this.store.updateMemberRoleIfNotLastOwner(companyId, accountId, role);
         if (res.ok) return res.member;
         if (res.reason === "not_found") throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
-        throw new CompanyError(409, "LAST_OWNER", "\u516C\u53F8\u81F3\u5C11\u8981\u7559 1 \u4E2A owner\uFF0C\u4E0D\u80FD\u964D\u7EA7\u6700\u540E\u4E00\u4E2A owner");
+        throw this.ownerProtected();
+      }
+      /** 「组织管理员受保护」的唯一错误来源——成员管理面的四个入口共用，码与文案不各写一份。 */
+      ownerProtected() {
+        return new CompanyError(403, "OWNER_PROTECTED", "\u7EC4\u7EC7\u7BA1\u7406\u5458\u4E0D\u53EF\u88AB\u7F16\u8F91\u3001\u964D\u7EA7\u6216\u79FB\u9664\uFF0C\u53EA\u80FD\u7531\u672C\u4EBA\u8F6C\u4EA4\u6216\u89E3\u6563\u7EC4\u7EC7");
+      }
+      /**
+       * 转交组织管理员（`POST /api/companies/:id/owner`，ADR D4）。
+       *
+       * 调用者身份从会话解析、**不接受 body 里指定 from**。单事务、一把锁、**先降后升**，
+       * 全部由 `store.setSoleCompanyOwner` 承担（并发语义见它的契约注释）。
+       *
+       * **刻意不做「已达成即 200」的幂等吞掉**：同一转交被重复提交时第二次同样得 409 `NOT_OWNER`。
+       * 吞掉的话「我不是 owner 了」和「我刚转交成功」在响应里长得一样，前端分不出该显示
+       * 「转交成功」还是「你的身份已变更」。
+       *
+       * **不 bump `tokenVersion`**：角色每请求现查（D7），转交不需要作废会话；bump 会把人从
+       * **其它组织**一起踢下线（G10）。
+       */
+      async transferOwner(companyId, fromAccountId, toAccountId) {
+        if (!toAccountId) throw new CompanyError(400, "BAD_REQUEST", "\u7F3A\u5C11 toAccountId");
+        if (fromAccountId === toAccountId) {
+          throw new CompanyError(400, "SELF_TRANSFER", "\u4E0D\u80FD\u628A\u7EC4\u7EC7\u7BA1\u7406\u5458\u8F6C\u4EA4\u7ED9\u81EA\u5DF1");
+        }
+        await this.requireActiveCompany(companyId);
+        const res = await this.store.setSoleCompanyOwner(companyId, toAccountId, { requireCurrentOwner: fromAccountId });
+        if (!res.ok) {
+          if (res.reason === "not_found") throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${toAccountId}`);
+          if (res.reason === "target_not_listed") {
+            throw new CompanyError(409, "TARGET_NOT_LISTED", "\u5BF9\u65B9\u5C1A\u672A\u5B8C\u6210\u52A0\u5165\uFF08\u65B0\u624B\u6307\u5F15\u672A\u8D70\u5B8C\uFF09\uFF0C\u4E0D\u80FD\u63A5\u6536\u7EC4\u7EC7\u7BA1\u7406\u5458");
+          }
+          if (res.reason === "target_inactive") {
+            throw new CompanyError(409, "TARGET_INACTIVE", "\u5BF9\u65B9\u8D26\u53F7\u5DF2\u505C\u7528\uFF0C\u4E0D\u80FD\u63A5\u6536\u7EC4\u7EC7\u7BA1\u7406\u5458");
+          }
+          throw new CompanyError(409, "NOT_OWNER", "\u4F60\u5DF2\u4E0D\u662F\u8BE5\u7EC4\u7EC7\u7684\u7EC4\u7EC7\u7BA1\u7406\u5458\uFF0C\u8EAB\u4EFD\u5DF2\u53D8\u66F4");
+        }
+        const from = res.demoted.find((m2) => m2.accountId === fromAccountId);
+        if (!from) throw new CompanyError(409, "NOT_OWNER", "\u4F60\u5DF2\u4E0D\u662F\u8BE5\u7EC4\u7EC7\u7684\u7EC4\u7EC7\u7BA1\u7406\u5458\uFF0C\u8EAB\u4EFD\u5DF2\u53D8\u66F4");
+        return { from, to: res.owner };
+      }
+      /**
+       * 存量映射用的「把这家组织收敛成唯一组织管理员」（ADR D3 回填面）。
+       * 与转交**同一把锁、同一顺序**（先降后升）——两份实现必然漂，而漂出来的差异正好落在
+       * 「中途有没有出现两位持有人」这种只有并发下才现形的地方。
+       */
+      async setSoleOwner(companyId, toAccountId) {
+        const res = await this.store.setSoleCompanyOwner(companyId, toAccountId);
+        if (!res.ok) {
+          if (res.reason === "target_not_listed") {
+            throw new CompanyError(409, "TARGET_NOT_LISTED", `\u76EE\u6807\u5C1A\u672A\u5B8C\u6210\u52A0\u5165\uFF1A${toAccountId}`);
+          }
+          if (res.reason === "target_inactive") {
+            throw new CompanyError(409, "TARGET_INACTIVE", `\u76EE\u6807\u8D26\u53F7\u5DF2\u505C\u7528\uFF1A${toAccountId}`);
+          }
+          throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${toAccountId}`);
+        }
+        return { owner: res.owner, demoted: res.demoted };
+      }
+      /**
+       * 解散组织（`DELETE /api/companies/:id`，ADR D9.2）——**可审计的停用，不是物理销毁**。
+       * 仅当前组织管理员；「我还是不是 owner」在**同一把锁内**复核（D7.2），不是入口查一次就写。
+       * 断访问靠 `resolveCurrentCompany` 只认 active（D8.4）+ `listForUser` 只列 active（D9.2）。
+       */
+      async dissolveCompany(companyId, callerAccountId) {
+        await this.requireActiveCompany(companyId);
+        const res = await this.store.dissolveCompanyIfOwner(companyId, callerAccountId, this.now());
+        if (res.ok) return res.company;
+        if (res.reason === "not_found") throw new CompanyError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A\u516C\u53F8\uFF1A${companyId}`);
+        throw new CompanyError(403, "FORBIDDEN", "\u53EA\u6709\u7EC4\u7EC7\u7BA1\u7406\u5458\u53EF\u4EE5\u89E3\u6563\u7EC4\u7EC7");
+      }
+      /** 公司必须存在**且 active**：已解散 / 已停用的组织上不接受任何写。 */
+      async requireActiveCompany(companyId) {
+        const c = await this.requireCompany(companyId);
+        if (c.status !== "active") throw new CompanyError(404, "COMPANY_NOT_FOUND", `\u516C\u53F8\u4E0D\u53EF\u7528\uFF1A${companyId}`);
+        return c;
       }
       /**
        * 改成员在本公司的昵称（组织模型 ADR §4.1 `company_member.display_name`）。
@@ -241805,9 +242373,7 @@ var init_service6 = __esm({
         await this.requireCompany(companyId);
         const member = await this.store.getMember(companyId, accountId);
         if (!member) throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
-        if (member.role === "owner" && await this.isLastOwner(companyId, accountId)) {
-          throw new CompanyError(409, "LAST_OWNER", "\u516C\u53F8\u81F3\u5C11\u8981\u7559 1 \u4E2A owner\uFF0C\u4E0D\u80FD\u79FB\u9664\u6700\u540E\u4E00\u4E2A owner");
-        }
+        if (member.role === "owner") throw this.ownerProtected();
         return member;
       }
       /**
@@ -241825,10 +242391,82 @@ var init_service6 = __esm({
        */
       async removeMember(companyId, accountId) {
         await this.requireCompany(companyId);
-        const res = await this.store.removeMemberIfNotLastOwner(companyId, accountId);
-        if (res.ok) return res.member;
+        const target = await this.store.getMember(companyId, accountId);
+        if (!target) throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
+        if (target.role === "owner") throw this.ownerProtected();
+        const res = await this.store.removeMemberAndReleaseOwnedAgents(companyId, accountId, this.now());
+        if (res.ok) return { member: res.member, releasedAgents: res.releasedAgents };
         if (res.reason === "not_found") throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
-        throw new CompanyError(409, "LAST_OWNER", "\u516C\u53F8\u81F3\u5C11\u8981\u7559 1 \u4E2A owner\uFF0C\u4E0D\u80FD\u79FB\u9664\u6700\u540E\u4E00\u4E2A owner");
+        throw this.ownerProtected();
+      }
+      /**
+       * 退出组织（`DELETE /api/companies/:id/members/me`，ADR D9.1）——**本人限定**。
+       *
+       * 组织管理员退不出：先转交、或（只剩他一个人时）解散。响应体带 `canDissolve`，
+       * 前端据它把人引到「解散组织」而不是「先转交给谁」（brief：单人团队路径）。
+       * 真正的移除副作用由 `MemberOffboardingService.applyMemberRemoval` 承担——与管理员移除他人
+       * **同一套**，不在这里另写一份。
+       */
+      async peekSelfLeave(companyId, accountId) {
+        await this.requireActiveCompany(companyId);
+        const me = await this.store.getMember(companyId, accountId);
+        if (!me) throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
+        if (me.role === "owner") {
+          const canDissolve = (await this.store.listMembers(companyId)).length <= 1;
+          throw new CompanyError(
+            409,
+            "OWNER_MUST_TRANSFER",
+            canDissolve ? "\u4F60\u662F\u8FD9\u4E2A\u7EC4\u7EC7\u552F\u4E00\u7684\u6210\u5458\uFF0C\u9000\u51FA\u8BF7\u6539\u4E3A\u89E3\u6563\u7EC4\u7EC7" : "\u7EC4\u7EC7\u7BA1\u7406\u5458\u4E0D\u80FD\u9000\u51FA\u7EC4\u7EC7\uFF0C\u8BF7\u5148\u628A\u7EC4\u7EC7\u7BA1\u7406\u5458\u8F6C\u4EA4\u7ED9\u4ED6\u4EBA",
+            { canDissolve }
+          );
+        }
+        return me;
+      }
+      /**
+       * 注销账号的**跨组织前置检查**（`DELETE /api/accounts/me`，ADR D9.3）。
+       *
+       * 遍历该账号**全部** membership，取其中 `status='active'` 的组织：只要**任意一家**里还是
+       * 组织管理员就拒（409 `OWNER_IN_ORGS`，响应体列出这些组织的 `{id, name}`），要求先转交或解散。
+       * 🚨 这条检查天然跨组织、与「当前公司」无关——**不能**只看当前组织，漏一家就等于把那家组织
+       * 甩成无人可管，而那个人已经注销、再也转交不了。
+       *
+       * 返回值 = 要逐家执行退出副作用的 membership 清单。**只含 active 组织**：已解散组织里的成员行
+       * 原样保留（账号停用后进不去，解散组织本身也解析不出来），不为了「删干净」去碰一家已经归档的
+       * 组织的成员名单——那会让它的历史成员名册凭空少人。
+       */
+      async peekAccountDeletion(accountId) {
+        const account = await this.store.getAccount(accountId);
+        if (!account) throw new CompanyError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A\u8D26\u53F7\uFF1A${accountId}`);
+        const owned = await this.listOwnedActiveCompanies(accountId);
+        if (owned.length > 0) {
+          throw new CompanyError(
+            409,
+            "OWNER_IN_ORGS",
+            "\u4F60\u8FD8\u662F\u4EE5\u4E0B\u7EC4\u7EC7\u7684\u7EC4\u7EC7\u7BA1\u7406\u5458\uFF0C\u8BF7\u5148\u8F6C\u4EA4\u6216\u89E3\u6563\u540E\u518D\u6CE8\u9500",
+            { companies: owned.map((c) => ({ id: c.id, name: c.name })) }
+          );
+        }
+        const memberships = await this.store.listMembershipsForAccount(accountId);
+        const out = [];
+        for (const m2 of memberships) {
+          const c = await this.store.getCompany(m2.companyId);
+          if (c?.status === "active") out.push(m2);
+        }
+        return out;
+      }
+      /**
+       * 注销的最后一步：账号置 `disabled` + **bump `tokenVersion`**，当场作废该账号全部会话。
+       * 这是 `tokenVersion` 的**正确**用法（账号级总闸）；转交与降级**不得**用它——那会把人从
+       * 其它组织一起踢下线（G10）。
+       *
+       * **数据口径要诚实**：oplog 里的历史署名、已交付产物、任务轨迹**不删**（内核纯净红线）。
+       * 「注销」= 这个人再也登不进来、不再是任何 active 组织的成员，不等于「个人数据被永久删除」。
+       */
+      async finalizeAccountDeletion(accountId) {
+        const account = await this.store.getAccount(accountId);
+        if (!account) throw new CompanyError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A\u8D26\u53F7\uFF1A${accountId}`);
+        await this.store.upsertAccount({ ...account, status: "disabled" });
+        await this.store.bumpAccountTokenVersion(accountId);
       }
       // —— 邀请（本地模型，CO-005）——
       /**
@@ -242263,33 +242901,32 @@ var init_service6 = __esm({
         if (!c) throw new CompanyError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A\u516C\u53F8\uFF1A${companyId}`);
         return c;
       }
-      async isLastOwner(companyId, accountId) {
-        const owners = (await this.store.listMembers(companyId)).filter((m2) => m2.role === "owner");
-        return owners.length === 1 && owners[0].accountId === accountId;
-      }
     };
   }
 });
 
 // ../server/src/domains/companies/offboarding.ts
-var import_node_crypto59, MemberOffboardingService;
+var import_node_crypto59, OWNER_PROTECTED_MESSAGE, MemberOffboardingService;
 var init_offboarding = __esm({
   "../server/src/domains/companies/offboarding.ts"() {
     "use strict";
     import_node_crypto59 = require("node:crypto");
     init_service6();
+    OWNER_PROTECTED_MESSAGE = "\u7EC4\u7EC7\u7BA1\u7406\u5458\u4E0D\u53EF\u88AB\u79FB\u9664\uFF0C\u53EA\u80FD\u7531\u672C\u4EBA\u8F6C\u4EA4\u6216\u89E3\u6563\u7EC4\u7EC7";
     MemberOffboardingService = class {
       store;
       now;
       listInFlight;
       transferAssignment;
       disableActor;
+      restoreActor;
       constructor(opts) {
         this.store = opts.store;
         this.now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
         this.listInFlight = opts.listInFlightAssignments;
         this.transferAssignment = opts.transferAssignment;
         this.disableActor = opts.disableActor;
+        this.restoreActor = opts.restoreActor;
       }
       /** 该成员是不是公司最后一个 owner（最后一个 owner 立即阻断，先于任何交接讨论）。 */
       async isLastOwner(companyId, accountId) {
@@ -242315,12 +242952,13 @@ var init_offboarding = __esm({
        */
       async blockersForRemoval(companyId, accountId) {
         const blockers = [];
-        const member = await this.store.getMember(companyId, accountId);
+        const members = await this.store.listMembers(companyId);
+        const member = members.find((m2) => m2.accountId === accountId);
         if (!member) {
           return [{ code: "NOT_FOUND", message: `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}` }];
         }
-        if (await this.isLastOwner(companyId, accountId)) {
-          blockers.push({ code: "LAST_OWNER", message: "\u516C\u53F8\u81F3\u5C11\u8981\u7559 1 \u4E2A owner\uFF0C\u4E0D\u80FD\u79FB\u9664\u6700\u540E\u4E00\u4E2A owner" });
+        if (member.role === "owner") {
+          blockers.push({ code: "OWNER_PROTECTED", message: OWNER_PROTECTED_MESSAGE });
         }
         return blockers;
       }
@@ -242342,6 +242980,7 @@ var init_offboarding = __esm({
       async plan(companyId, accountId, initiatedBy) {
         const member = await this.store.getMember(companyId, accountId);
         if (!member) throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
+        if (member.role === "owner") throw new CompanyError(403, "OWNER_PROTECTED", OWNER_PROTECTED_MESSAGE);
         if (await this.isLastOwner(companyId, accountId)) {
           throw new CompanyError(409, "LAST_OWNER", "\u516C\u53F8\u81F3\u5C11\u8981\u7559 1 \u4E2A owner\uFF0C\u4E0D\u80FD\u79FB\u9664\u6700\u540E\u4E00\u4E2A owner");
         }
@@ -242388,10 +243027,9 @@ var init_offboarding = __esm({
         if (op.version !== expectedVersion) {
           throw new CompanyError(409, "STALE_PLAN", `\u8BA1\u5212\u7248\u672C\u5DF2\u53D8\uFF08\u5F53\u524D ${op.version}\uFF0C\u4F60\u7ED9\u7684\u662F ${expectedVersion}\uFF09\uFF0C\u8BF7\u91CD\u65B0\u53D6\u8BA1\u5212`);
         }
-        if (await this.isLastOwner(companyId, accountId)) {
-          throw new CompanyError(409, "LAST_OWNER", "\u516C\u53F8\u81F3\u5C11\u8981\u7559 1 \u4E2A owner\uFF0C\u4E0D\u80FD\u79FB\u9664\u6700\u540E\u4E00\u4E2A owner");
-        }
-        const released = await this.releaseOwnedAgents(companyId, accountId);
+        const members = await this.store.listMembers(companyId);
+        const target = members.find((m2) => m2.accountId === accountId);
+        if (target?.role === "owner") throw new CompanyError(403, "OWNER_PROTECTED", OWNER_PROTECTED_MESSAGE);
         const remaining = await this.blockersForRemoval(companyId, accountId);
         if (remaining.length > 0) {
           await this.store.updateMemberOffboardingIfVersion(
@@ -242403,19 +243041,7 @@ var init_offboarding = __esm({
           );
           throw new CompanyError(409, remaining[0].code, `\u4ECD\u6709\u672A\u4EA4\u63A5\u9879\uFF1A${remaining.map((b2) => b2.message).join("; ")}`);
         }
-        const member = await this.store.getMember(companyId, accountId);
-        if (member && !await isEmployedElsewhere(this.store, companyId, accountId)) {
-          await this.disableActor?.(companyId, member.actorId);
-        }
-        await this.store.deletePrincipalBridge(companyId, "human", accountId);
-        const removed = await this.store.removeMemberIfNotLastOwner(companyId, accountId);
-        if (!removed.ok) {
-          throw new CompanyError(
-            removed.reason === "last_owner" ? 409 : 404,
-            removed.reason === "last_owner" ? "LAST_OWNER" : "NOT_FOUND",
-            removed.reason === "last_owner" ? "\u516C\u53F8\u81F3\u5C11\u8981\u7559 1 \u4E2A owner" : `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`
-          );
-        }
+        const released = await this.applyMemberRemoval(companyId, accountId);
         await this.store.updateMemberOffboardingIfVersion(
           companyId,
           operationId,
@@ -242425,6 +243051,65 @@ var init_offboarding = __esm({
         );
         return { status: "removed", transferred: [], left: released };
       }
+      /**
+       * 移除一条成员关系的**全套副作用**，三条移除路径共用（管理员移除他人 `commit`、
+       * 本人退出组织 `DELETE …/members/me`、注销账号 `DELETE /api/accounts/me`）。
+       *
+       * 顺序与原子性（2026-09-23 代码评审打回后重排）：
+       *   ① 读一遍成员行：不存在 → 404；**已经是组织管理员 → 当场 403，一个副作用都不做**（D5.2）。
+       *   ② 停用花名册里这个人（**还在别家公司在职就不停用**——停用打的是全局那一行）。
+       *      这一步必须在③之前：成员行一删，本公司的 scoped registry 就不再认这个 actor，
+       *      停用会静默 no-op，人被移除了却还挂在花名册上（QA D3 修过一次的病）。
+       *   ③ **一个事务**做完控制面三件事：锁内复核目标不是组织管理员 → 清名下 agent 的负责人字段
+       *      （`digital_employee.owner` 的复合 FK 是 ON DELETE RESTRICT，不清就是裸 FK 违例；
+       *      **只清 owner**，不改状态、不撤凭证、不解绑助理，PRD v1.5）→ 删 human principal bridge
+       *      → 删成员行（`store.removeMemberAndReleaseOwnedAgents`）。
+       *   ④ ③失败（并发转交把这个人升成了组织管理员，A09）→ 把②CAS 还原回去。
+       *
+       * **为什么③非要是一个事务**：以前①②③是「先清负责人、再停用、再删桥，最后才去拿锁删成员行」
+       * 四段独立的写。A09 那条并发（`O` 转交给 `A1` 的同时另一位管理员删 `A1`）走到最后一步才被
+       * `OWNER_PROTECTED` 拒——而此刻 `A1` 名下 Agent 的负责人已经被清空、桥已经被删、人已经被停用。
+       * 请求失败了，破坏却留下了：新上任的组织管理员丢了名下全部 Agent 的归属、还从花名册上消失。
+       * 现在控制面那三件事共一把锁（与转交锁同一组行），失败时一行都没写；跨不进这把锁的只有员工侧
+       * 停用，用 CAS 补偿还原——「停用之后有别人写过这个 actor」就跳过，不撤销他人的合法写（QA R9）。
+       */
+      async applyMemberRemoval(companyId, accountId) {
+        const member = await this.store.getMember(companyId, accountId);
+        if (!member) throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
+        if (member.role === "owner") throw new CompanyError(403, "OWNER_PROTECTED", OWNER_PROTECTED_MESSAGE);
+        let ticket = null;
+        if (!await isEmployedElsewhere(this.store, companyId, accountId)) {
+          ticket = await this.disableActor?.(companyId, member.actorId) ?? null;
+        }
+        const removed = await this.store.removeMemberAndReleaseOwnedAgents(companyId, accountId, this.now()).catch(async (e) => {
+          await this.compensateDisable(companyId, ticket);
+          throw e;
+        });
+        if (!removed.ok) {
+          await this.compensateDisable(companyId, ticket);
+          if (removed.reason === "not_found") {
+            throw new CompanyError(404, "NOT_FOUND", `\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF1A${accountId}`);
+          }
+          throw new CompanyError(403, "OWNER_PROTECTED", OWNER_PROTECTED_MESSAGE);
+        }
+        return removed.releasedAgents;
+      }
+      /**
+       * 把②那次停用还原回去。**只还原本次自己造成的那一次**：`restoreActor` 走 CAS，
+       * 停用之后但凡有别人写过这个 actor 就跳过——留下「成员还在 + actor 已停用」这个合法终态
+       * （与员工页 `DELETE /api/actors/:id` 的终态同构），比静默撤销他人的合法停用安全。
+       * 补偿本身失败不改写主错误：调用方要看到的是「为什么没删成」，不是补偿的二级故障。
+       */
+      async compensateDisable(companyId, ticket) {
+        if (!ticket || !this.restoreActor) return;
+        try {
+          await this.restoreActor(companyId, ticket);
+        } catch (e) {
+          console.error(
+            `[offboarding] restore actor ${ticket.actorId} failed after removal was rejected: ${e instanceof Error ? e.message : String(e)}`
+          );
+        }
+      }
       /**
        * 把该成员名下所有 agent 的负责人字段清空，返回被清的 agent id。
        *
@@ -242512,13 +243197,28 @@ function companiesDomain(opts) {
     }
     return n;
   };
+  const requireActiveCompany = async (companyId) => {
+    const company = await service.get(companyId);
+    if (!company || company.status !== "active") {
+      throw new ApiError(404, "COMPANY_NOT_FOUND", `\u7EC4\u7EC7\u4E0D\u5B58\u5728\u6216\u5DF2\u4E0D\u53EF\u7528\uFF1A${companyId}`);
+    }
+  };
   const requireOwnerOrAdmin = async (req, companyId) => {
     const me = await whoami(req);
     const member = await service.getMember(companyId, me.accountId);
-    if (!member || member.role !== "owner" && member.role !== "admin") {
+    if (!member) throw new ApiError(403, "FORBIDDEN", "\u9700\u8981\u8BE5\u516C\u53F8\u7684 owner/admin \u6743\u9650");
+    await requireActiveCompany(companyId);
+    if (member.role !== "owner" && member.role !== "admin") {
       throw new ApiError(403, "FORBIDDEN", "\u9700\u8981\u8BE5\u516C\u53F8\u7684 owner/admin \u6743\u9650");
     }
   };
+  const requireMember = async (req, companyId) => {
+    const me = await whoami(req);
+    const member = await service.getMember(companyId, me.accountId);
+    if (!member) throw new ApiError(403, "NOT_A_MEMBER", "\u4E0D\u662F\u8BE5\u516C\u53F8\u6210\u5458\uFF0C\u8BBF\u95EE\u88AB\u62D2");
+    await requireActiveCompany(companyId);
+    return me;
+  };
   return (router) => {
     router.get("/api/companies", async (req) => {
       const me = await whoami(req);
@@ -242578,7 +243278,9 @@ function companiesDomain(opts) {
       return { status: 200, body: { ok: true } };
     });
     router.get("/api/companies/:id/members", async (req) => {
-      const items = await service.listMemberViews(req.params.id).catch(mapErr);
+      const cid = req.params.id;
+      await requireMember(req, cid);
+      const items = await service.listMemberViews(cid).catch(mapErr);
       return { status: 200, body: { items } };
     });
     router.get("/api/companies/:id/members/me", async (req) => {
@@ -242608,6 +243310,9 @@ function companiesDomain(opts) {
       if (b2.role === void 0 && b2.displayName === void 0) {
         throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11\u53EF\u66F4\u65B0\u5B57\u6BB5\uFF08role / displayName\uFF09");
       }
+      const me = await whoami(req);
+      if (b2.role !== void 0 || me.accountId !== aid) await requireOwnerOrAdmin(req, cid);
+      else await requireMember(req, cid);
       let member;
       if (b2.role !== void 0) {
         if (!b2.role) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 role");
@@ -242622,11 +243327,19 @@ function companiesDomain(opts) {
       }
       return { status: 200, body: member };
     });
+    router.delete("/api/companies/:id/members/me", async (req) => {
+      const off = requireOffboarding();
+      const cid = req.params.id;
+      const me = await whoami(req);
+      await service.peekSelfLeave(cid, me.accountId).catch(mapErr);
+      const released = await off.applyMemberRemoval(cid, me.accountId).catch(mapErr);
+      return { status: 200, body: { ok: true, releasedAgents: released } };
+    });
     router.delete("/api/companies/:id/members/:accountId", async (req) => {
       const cid = req.params.id;
       const aid = req.params.accountId;
+      await requireOwnerOrAdmin(req, cid);
       const member = await service.peekRemovableMember(cid, aid).catch(mapErr);
-      if (offboarding) await offboarding.releaseOwnedAgents(cid, aid).catch(mapErr);
       let actorsSvc;
       let ownedDisableBefore = null;
       let disableSeq = 0;
@@ -242666,6 +243379,32 @@ function companiesDomain(opts) {
       }
       return { status: 200, body: { ok: true } };
     });
+    router.post("/api/companies/:id/owner", async (req) => {
+      const cid = req.params.id;
+      const b2 = req.body ?? {};
+      if (typeof b2.toAccountId !== "string" || !b2.toAccountId.trim()) {
+        throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 toAccountId: string");
+      }
+      const me = await whoami(req);
+      const res = await service.transferOwner(cid, me.accountId, b2.toAccountId.trim()).catch(mapErr);
+      return { status: 200, body: res };
+    });
+    router.delete("/api/companies/:id", async (req) => {
+      const cid = req.params.id;
+      const me = await whoami(req);
+      const company = await service.dissolveCompany(cid, me.accountId).catch(mapErr);
+      return { status: 200, body: company };
+    });
+    router.delete("/api/accounts/me", async (req) => {
+      const off = requireOffboarding();
+      const me = await whoami(req);
+      const memberships = await service.peekAccountDeletion(me.accountId).catch(mapErr);
+      for (const m2 of memberships) {
+        await off.applyMemberRemoval(m2.companyId, me.accountId).catch(mapErr);
+      }
+      await service.finalizeAccountDeletion(me.accountId).catch(mapErr);
+      return { status: 200, body: { ok: true, leftCompanies: memberships.map((m2) => m2.companyId) } };
+    });
     router.get("/api/companies/:id/agent-credentials", async (req) => {
       const creds = requireCredentials();
       const cid = req.params.id;
@@ -242713,6 +243452,7 @@ function companiesDomain(opts) {
     router.post("/api/companies/:id/invitations", async (req) => {
       const b2 = req.body ?? {};
       if (!b2.email) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 email");
+      await requireOwnerOrAdmin(req, req.params.id);
       const role = b2.role ?? "member";
       const me = await whoami(req);
       const invitation = await service.createInvitation(req.params.id, b2.email, role, me.accountId).catch(mapErr);
@@ -242852,7 +243592,7 @@ var init_routes6 = __esm({
     init_router();
     init_service6();
     init_image_upload();
-    COMPANY_CROSS_TENANT_PREFIXES = ["/api/companies", "/api/invitations", "/api/invite-links"];
+    COMPANY_CROSS_TENANT_PREFIXES = ["/api/companies", "/api/invitations", "/api/invite-links", "/api/accounts"];
   }
 });
 
@@ -242995,9 +243735,30 @@ function createCompaniesDomain(opts) {
     ...opts.resolveActorsCtx !== void 0 ? {
       // 未认领转 left 的 agent、以及 commit 移除掉的那位成员，都要把员工侧 ActorRecord
       // 一并软停用——否则控制面说「已离开/已移除」、花名册还显示在岗，两个事实源当场分叉。
+      //
+      // 用 `disableActorIfCurrentlyActive` 而不是 `disableActor`，并把 `{before, seq}` 回给
+      // offboarding：只有**真的把这个 actor 从 active 拉到 disabled** 的那一次调用才拿得到
+      // 返回值，也才「拥有」这次状态变更；已被并发请求或员工页先停用的一律 ok:false，
+      // 本次就不 own、移除失败也不补偿（QA R10 的判据，两条移除路径同一套）。
       disableActor: async (companyId, actorId) => {
         const ctx = await opts.resolveActorsCtx(companyId);
-        await ctx.service.disableActorIfCurrentlyActive(actorId, "system:offboarding");
+        const res = await ctx.service.disableActorIfCurrentlyActive(actorId, "system:offboarding");
+        return res.ok ? { actorId, before: res.before, seq: res.seq } : null;
+      },
+      // 移除最终失败时的补偿：**CAS** 写回停用前那一行。`expectedSeq` 对不上（停用之后
+      // 有任何第三方写过这个 actor）就跳过——不静默撤销他人的合法停用 / 改名（QA R9）。
+      restoreActor: async (companyId, ticket) => {
+        const ctx = await opts.resolveActorsCtx(companyId);
+        const res = await ctx.service.casUpsertActor(
+          { ...ticket.before, status: "active" },
+          ticket.seq,
+          "system:offboarding"
+        );
+        if (!res.ok) {
+          console.info(
+            `[companies] restore skipped for ${ticket.actorId}: another write intervened after the disable`
+          );
+        }
       }
     } : {}
   });
@@ -259991,7 +260752,35 @@ var init_pool = __esm({
 });
 
 // ../storage/src/postgres-control-plane.ts
-var ident8, PostgresControlPlaneStore, rowToDigitalEmployee, rowToAgentCredential, rowToBridge, rowToOffboarding, toIso, rowToCompany, rowToMember, rowToInvitation, rowToInviteLink, rowToAccount, rowToVerificationCode;
+async function ensureOneOwnerInvariant(pool, s2) {
+  try {
+    const bad = await pool.query(
+      `SELECT company_id, count(*) FILTER (WHERE role = 'owner') AS owners
+         FROM "${s2}".company_members
+        GROUP BY company_id
+       HAVING count(*) FILTER (WHERE role = 'owner') <> 1
+        ORDER BY company_id`
+    );
+    if (bad.rowCount && bad.rowCount > 0) {
+      console.warn(
+        `[control-plane] ${bad.rowCount} \u5BB6\u7EC4\u7EC7\u7684\u7EC4\u7EC7\u7BA1\u7406\u5458\u6570\u91CF\u4E0D\u662F 1\uFF0C\u5DF2\u8DF3\u8FC7\uFF08\u4E0D\u81EA\u52A8\u6311\u4EBA\uFF09\uFF1A` + bad.rows.map((r) => `${r.company_id}=${r.owners}`).join(", ") + `\u3002\u7528 \`pnpm migrate:org-identity inventory\` \u51FA\u76D8\u70B9\u3001\u6309\u51BB\u7ED3 manifest \u8DD1 backfill\u3002`
+      );
+    }
+  } catch (e) {
+    console.warn(`[control-plane] \u7EC4\u7EC7\u7BA1\u7406\u5458\u6570\u91CF\u590D\u6838\u5931\u8D25\uFF08\u4E0D\u963B\u65AD\u542F\u52A8\uFF09\uFF1A${e instanceof Error ? e.message : String(e)}`);
+  }
+  try {
+    await pool.query(
+      `CREATE UNIQUE INDEX IF NOT EXISTS company_members_one_owner_idx
+         ON "${s2}".company_members (company_id) WHERE role = 'owner'`
+    );
+  } catch (e) {
+    console.warn(
+      `[control-plane] \u5EFA company_members_one_owner_idx \u5931\u8D25\uFF08\u4E0D\u963B\u65AD\u542F\u52A8\uFF0C\u5E94\u7528\u5C42\u5224\u636E\u4ECD\u5728\uFF09\uFF1A${e instanceof Error ? e.message : String(e)}`
+    );
+  }
+}
+var ident8, PostgresControlPlaneStore, rowToDigitalEmployee, rowToAgentCredential, rowToBridge, rowToOffboarding, toIso, rowToCompany, rowToRoleMigration, migrationRow2, rowToMember, rowToInvitation, rowToInviteLink, rowToAccount, rowToVerificationCode;
 var init_postgres_control_plane = __esm({
   "../storage/src/postgres-control-plane.ts"() {
     "use strict";
@@ -260021,6 +260810,8 @@ var init_postgres_control_plane = __esm({
         onboarding_variant text                  -- \u767B\u5F55\u540E\u52A9\u7406\u5F15\u5BFC\u53D8\u4F53 A|B\uFF1BNULL=\u7F3A\u7701\u89C6\u4E3A A
       )`);
         await pool.query(`ALTER TABLE "${s2}".companies ADD COLUMN IF NOT EXISTS onboarding_variant text`);
+        await pool.query(`ALTER TABLE "${s2}".companies ADD COLUMN IF NOT EXISTS dissolved_at timestamptz`);
+        await pool.query(`ALTER TABLE "${s2}".companies ADD COLUMN IF NOT EXISTS dissolved_by text`);
         await pool.query(`
       CREATE TABLE IF NOT EXISTS "${s2}".company_members (
         company_id text NOT NULL,
@@ -260209,6 +261000,19 @@ var init_postgres_control_plane = __esm({
           CHECK (status IN ('handoff_required','handoff_in_progress','ready_to_remove','removed'))
       )`);
         await pool.query(`CREATE UNIQUE INDEX IF NOT EXISTS member_offboardings_active_uq ON "${s2}".member_offboardings (company_id, account_id) WHERE status <> 'removed'`);
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS "${s2}".company_member_role_migrations (
+        id               bigserial PRIMARY KEY,
+        company_id       text        NOT NULL,
+        account_id       text        NOT NULL,
+        role_before      text        NOT NULL,
+        role_after       text        NOT NULL,
+        evidence         text        NOT NULL,   -- 'E1' | 'manifest'
+        manifest_version text,
+        applied_at       timestamptz NOT NULL DEFAULT now()
+      )`);
+        await pool.query(`CREATE INDEX IF NOT EXISTS company_member_role_migrations_company_idx ON "${s2}".company_member_role_migrations (company_id, applied_at DESC)`);
+        await ensureOneOwnerInvariant(pool, s2);
         return new _PostgresControlPlaneStore(pool, schema);
       }
       // —— 公司 ——
@@ -260249,11 +261053,51 @@ var init_postgres_control_plane = __esm({
           args.push(patch.onboardingVariant);
           sets.push(`onboarding_variant = $${args.length}`);
         }
+        if (patch.dissolvedAt !== void 0) {
+          args.push(patch.dissolvedAt);
+          sets.push(`dissolved_at = $${args.length}`);
+        }
+        if (patch.dissolvedBy !== void 0) {
+          args.push(patch.dissolvedBy);
+          sets.push(`dissolved_by = $${args.length}`);
+        }
         args.push(id);
         const sql = sets.length ? `UPDATE ${this.s}.companies SET ${sets.join(", ")} WHERE id = $${args.length}` : `SELECT 1 FROM ${this.s}.companies WHERE id = $${args.length}`;
         const r = await this.pool.query(sql, args);
         if (r.rowCount === 0) throw new Error(`company not found: ${id}`);
       }
+      async dissolveCompanyIfOwner(companyId, accountId, at2) {
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN");
+          const caller = await client.query(
+            `SELECT role FROM ${this.s}.company_members WHERE company_id = $1 AND account_id = $2 FOR UPDATE`,
+            [companyId, accountId]
+          );
+          if (!caller.rows[0] || caller.rows[0].role !== "owner") {
+            await client.query("ROLLBACK");
+            const exists = await this.pool.query(`SELECT 1 FROM ${this.s}.companies WHERE id = $1`, [companyId]);
+            return { ok: false, reason: exists.rowCount ? "not_owner" : "not_found" };
+          }
+          const updated = await client.query(
+            `UPDATE ${this.s}.companies SET status = 'suspended', dissolved_at = $2, dissolved_by = $3
+          WHERE id = $1 RETURNING *`,
+            [companyId, at2, accountId]
+          );
+          if (!updated.rows[0]) {
+            await client.query("ROLLBACK");
+            return { ok: false, reason: "not_found" };
+          }
+          await client.query("COMMIT");
+          return { ok: true, company: rowToCompany(updated.rows[0]) };
+        } catch (e) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw e;
+        } finally {
+          client.release();
+        }
+      }
       // —— 成员 ——
       async upsertMember(m2) {
         await this.pool.query(
@@ -260327,6 +261171,48 @@ var init_postgres_control_plane = __esm({
           client.release();
         }
       }
+      async removeMemberAndReleaseOwnedAgents(companyId, accountId, at2) {
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN");
+          const all2 = await client.query(
+            `SELECT company_id, account_id, actor_id, role, display_name, onboarding_completed_at, onboarding_step
+           FROM ${this.s}.company_members WHERE company_id = $1 FOR UPDATE`,
+            [companyId]
+          );
+          const target = all2.rows.map(rowToMember).find((m2) => m2.accountId === accountId);
+          if (!target) {
+            await client.query("ROLLBACK");
+            return { ok: false, reason: "not_found" };
+          }
+          if (target.role === "owner") {
+            await client.query("ROLLBACK");
+            return { ok: false, reason: "owner_protected" };
+          }
+          const released = await client.query(
+            `UPDATE ${this.s}.digital_employees SET owner_account_id = NULL, updated_at = $3
+          WHERE company_id = $1 AND owner_account_id = $2
+        RETURNING id`,
+            [companyId, accountId, at2]
+          );
+          await client.query(
+            `DELETE FROM ${this.s}.principal_bridge WHERE company_id = $1 AND principal_type = 'human' AND principal_id = $2`,
+            [companyId, accountId]
+          );
+          await client.query(
+            `DELETE FROM ${this.s}.company_members WHERE company_id = $1 AND account_id = $2`,
+            [companyId, accountId]
+          );
+          await client.query("COMMIT");
+          return { ok: true, member: target, releasedAgents: released.rows.map((r) => r.id) };
+        } catch (e) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw e;
+        } finally {
+          client.release();
+        }
+      }
       async updateMemberRoleIfNotLastOwner(companyId, accountId, role) {
         const client = await this.pool.connect();
         try {
@@ -260365,6 +261251,170 @@ var init_postgres_control_plane = __esm({
           client.release();
         }
       }
+      async setSoleCompanyOwner(companyId, toAccountId, opts) {
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN");
+          const all2 = await client.query(
+            `SELECT company_id, account_id, actor_id, role, display_name, onboarding_completed_at, onboarding_step
+           FROM ${this.s}.company_members WHERE company_id = $1 FOR UPDATE`,
+            [companyId]
+          );
+          const rows = all2.rows.map(rowToMember);
+          const target = rows.find((m2) => m2.accountId === toAccountId);
+          if (!target) {
+            await client.query("ROLLBACK");
+            return { ok: false, reason: "not_found" };
+          }
+          if (opts?.requireCurrentOwner !== void 0) {
+            const caller = rows.find((m2) => m2.accountId === opts.requireCurrentOwner);
+            if (!caller || caller.role !== "owner") {
+              await client.query("ROLLBACK");
+              return { ok: false, reason: "not_owner" };
+            }
+          }
+          if (!target.onboardingCompletedAt && target.role !== "owner") {
+            await client.query("ROLLBACK");
+            return { ok: false, reason: "target_not_listed" };
+          }
+          const acc = await client.query(
+            `SELECT status FROM ${this.s}.accounts WHERE id = $1`,
+            [toAccountId]
+          );
+          if (!acc.rows[0] || acc.rows[0].status !== "active") {
+            await client.query("ROLLBACK");
+            return { ok: false, reason: "target_inactive" };
+          }
+          const others = rows.filter((m2) => m2.role === "owner" && m2.accountId !== toAccountId);
+          if (others.length === 0 && target.role === "owner") {
+            await client.query("COMMIT");
+            return { ok: true, owner: target, demoted: [] };
+          }
+          if (others.length > 0) {
+            await client.query(
+              `UPDATE ${this.s}.company_members SET role = 'admin', updated_at = now()
+            WHERE company_id = $1 AND role = 'owner' AND account_id <> $2`,
+              [companyId, toAccountId]
+            );
+          }
+          if (target.role !== "owner") {
+            await client.query(
+              `UPDATE ${this.s}.company_members SET role = 'owner', updated_at = now()
+            WHERE company_id = $1 AND account_id = $2`,
+              [companyId, toAccountId]
+            );
+          }
+          await client.query("COMMIT");
+          return {
+            ok: true,
+            owner: { ...target, role: "owner" },
+            demoted: others.map((m2) => ({ ...m2, role: "admin" }))
+          };
+        } catch (e) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw e;
+        } finally {
+          client.release();
+        }
+      }
+      // —— 存量身份映射（ADR D3）——
+      async migrateSoleCompanyOwner(companyId, toAccountId, audit2) {
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN");
+          const all2 = await client.query(
+            `SELECT company_id, account_id, actor_id, role, display_name, onboarding_completed_at, onboarding_step
+           FROM ${this.s}.company_members WHERE company_id = $1 FOR UPDATE`,
+            [companyId]
+          );
+          const rows = all2.rows.map(rowToMember);
+          const target = rows.find((m2) => m2.accountId === toAccountId);
+          if (!target) {
+            await client.query("ROLLBACK");
+            return { ok: false, reason: "not_found" };
+          }
+          const others = rows.filter((m2) => m2.role === "owner" && m2.accountId !== toAccountId);
+          if (others.length === 0 && target.role === "owner") {
+            await client.query("COMMIT");
+            return { ok: true, owner: target, demoted: [], auditRows: [] };
+          }
+          if (others.length > 0) {
+            await client.query(
+              `UPDATE ${this.s}.company_members SET role = 'admin' WHERE company_id = $1 AND role = 'owner' AND account_id <> $2`,
+              [companyId, toAccountId]
+            );
+          }
+          if (target.role !== "owner") {
+            await client.query(
+              `UPDATE ${this.s}.company_members SET role = 'owner' WHERE company_id = $1 AND account_id = $2`,
+              [companyId, toAccountId]
+            );
+          }
+          const auditRows = [
+            ...others.map((m2) => migrationRow2(companyId, m2.accountId, "owner", "admin", audit2)),
+            ...target.role !== "owner" ? [migrationRow2(companyId, toAccountId, target.role, "owner", audit2)] : []
+          ];
+          for (const r of auditRows) {
+            await client.query(
+              `INSERT INTO ${this.s}.company_member_role_migrations
+             (company_id, account_id, role_before, role_after, evidence, manifest_version, applied_at)
+           VALUES ($1,$2,$3,$4,$5,$6,$7)`,
+              [r.companyId, r.accountId, r.roleBefore, r.roleAfter, r.evidence, r.manifestVersion ?? null, r.appliedAt]
+            );
+          }
+          await client.query("COMMIT");
+          return {
+            ok: true,
+            owner: { ...target, role: "owner" },
+            demoted: others.map((m2) => ({ ...m2, role: "admin" })),
+            auditRows
+          };
+        } catch (e) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw e;
+        } finally {
+          client.release();
+        }
+      }
+      async setMemberRoleOnly(companyId, accountId, role) {
+        const r = await this.pool.query(
+          `UPDATE ${this.s}.company_members SET role = $3 WHERE company_id = $1 AND account_id = $2`,
+          [companyId, accountId, role]
+        );
+        return (r.rowCount ?? 0) > 0;
+      }
+      // —— 存量身份映射审计（ADR D3.4）——
+      async appendMemberRoleMigrations(rows) {
+        if (rows.length === 0) return;
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN");
+          for (const r of rows) {
+            await client.query(
+              `INSERT INTO ${this.s}.company_member_role_migrations
+             (company_id, account_id, role_before, role_after, evidence, manifest_version, applied_at)
+           VALUES ($1,$2,$3,$4,$5,$6,$7)`,
+              [r.companyId, r.accountId, r.roleBefore, r.roleAfter, r.evidence, r.manifestVersion ?? null, r.appliedAt]
+            );
+          }
+          await client.query("COMMIT");
+        } catch (e) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw e;
+        } finally {
+          client.release();
+        }
+      }
+      async listMemberRoleMigrations(companyId) {
+        const r = companyId === void 0 ? await this.pool.query(`SELECT * FROM ${this.s}.company_member_role_migrations ORDER BY applied_at, id`) : await this.pool.query(
+          `SELECT * FROM ${this.s}.company_member_role_migrations WHERE company_id = $1 ORDER BY applied_at, id`,
+          [companyId]
+        );
+        return r.rows.map(rowToRoleMigration);
+      }
       // —— 邀请 ——
       async createInvitation(inv) {
         await this.pool.query(
@@ -260834,7 +261884,28 @@ var init_postgres_control_plane = __esm({
       ...row.avatar !== null && row.avatar !== void 0 ? { avatar: row.avatar } : {},
       status: row.status,
       createdAt: new Date(row.created_at).toISOString(),
-      ...row.onboarding_variant ? { onboardingVariant: row.onboarding_variant } : {}
+      ...row.onboarding_variant ? { onboardingVariant: row.onboarding_variant } : {},
+      // 解散痕迹（组织三层身份 ADR D9.2）：两列一起有、一起空。普通运维停用不写它们。
+      ...row.dissolved_at != null ? { dissolvedAt: toIso(row.dissolved_at) } : {},
+      ...row.dissolved_by != null ? { dissolvedBy: row.dissolved_by } : {}
+    });
+    rowToRoleMigration = (row) => ({
+      companyId: row.company_id,
+      accountId: row.account_id,
+      roleBefore: row.role_before,
+      roleAfter: row.role_after,
+      evidence: row.evidence,
+      ...row.manifest_version != null ? { manifestVersion: row.manifest_version } : {},
+      appliedAt: toIso(row.applied_at)
+    });
+    migrationRow2 = (companyId, accountId, roleBefore, roleAfter, audit2) => ({
+      companyId,
+      accountId,
+      roleBefore,
+      roleAfter,
+      evidence: audit2.evidence,
+      ...audit2.evidence === "manifest" && audit2.manifestVersion !== void 0 ? { manifestVersion: audit2.manifestVersion } : {},
+      appliedAt: audit2.appliedAt
     });
     rowToMember = (row) => ({
       companyId: row.company_id,
@@ -276559,6 +277630,7 @@ __export(src_exports2, {
   ACTOR_DELETED_CHAT_MESSAGE: () => ACTOR_DELETED_CHAT_MESSAGE,
   ACTOR_DELETED_ERROR_CODE: () => ACTOR_DELETED_ERROR_CODE,
   ASSISTANT_ARCHIVED_CODE: () => ASSISTANT_ARCHIVED_CODE,
+  ASSISTANT_POSITION: () => ASSISTANT_POSITION,
   ASSISTANT_TIER_RULES: () => ASSISTANT_TIER_RULES,
   AUTOMATION_TEMPLATES: () => AUTOMATION_TEMPLATES,
   AUTONOMOUS_ETHOS: () => AUTONOMOUS_ETHOS,
@@ -276566,6 +277638,7 @@ __export(src_exports2, {
   ActorMemoryService: () => ActorMemoryService,
   ActorsService: () => ActorsService,
   AgentCredentialService: () => AgentCredentialService,
+  AgentManageForbiddenError: () => AgentManageForbiddenError,
   ApiError: () => ApiError,
   AssistantLazyCreateError: () => AssistantLazyCreateError,
   AssistantsService: () => AssistantsService,
@@ -276703,6 +277776,7 @@ __export(src_exports2, {
   OPERATOR_SCOPE: () => OPERATOR_SCOPE,
   ORPHANED_TURN_ASSISTANT_NOTICE: () => ORPHANED_TURN_ASSISTANT_NOTICE,
   OUTPUT_COPY_LIMITS: () => OUTPUT_COPY_LIMITS,
+  OWNER_PROTECTED_MESSAGE: () => OWNER_PROTECTED_MESSAGE,
   PARENT_CONVERSATION_PATH: () => PARENT_CONVERSATION_PATH,
   PARENT_CONVERSATION_RECENT_TURNS: () => PARENT_CONVERSATION_RECENT_TURNS,
   PostgresNotificationStore: () => PostgresNotificationStore,
@@ -276757,11 +277831,16 @@ __export(src_exports2, {
   applyWorkspaceBundle: () => applyWorkspaceBundle,
   assembleDelegationsDomain: () => assembleDelegationsDomain,
   assertBindingWritePermission: () => assertBindingWritePermission,
+  assertCompanyManager: () => assertCompanyManager,
   assertCreatableVariable: () => assertCreatableVariable,
+  assertMayCreateAgent: () => assertMayCreateAgent,
+  assertMayManageAgent: () => assertMayManageAgent,
+  assertMaySelfOrManage: () => assertMaySelfOrManage,
   assistantRowRecovery: () => assistantRowRecovery,
   assistantsDomain: () => assistantsDomain,
   atCapacity: () => atCapacity,
   automationsDomain: () => automationsDomain,
+  backfillOrgIdentity: () => backfillOrgIdentity,
   backfillOrgModel: () => backfillOrgModel,
   backfillOrgModelOnStartup: () => backfillOrgModelOnStartup,
   backfillResolvedLetterReadMarkers: () => backfillResolvedLetterReadMarkers,
@@ -276934,8 +278013,11 @@ __export(src_exports2, {
   hideDeleted: () => hideDeleted,
   humanSubmitSourceRunId: () => humanSubmitSourceRunId,
   idlenessOf: () => idlenessOf,
+  inventoryOrgIdentity: () => inventoryOrgIdentity,
   isActiveCoordinatorAgent: () => isActiveCoordinatorAgent,
+  isAssistantAgent: () => isAssistantAgent,
   isCompanyCrossTenantPath: () => isCompanyCrossTenantPath,
+  isCompanyManager: () => isCompanyManager,
   isCoordinatorAgentName: () => isCoordinatorAgentName,
   isCoordinatorRunReader: () => isCoordinatorRunReader,
   isCredentialAuditKind: () => isCredentialAuditKind,
@@ -276995,6 +278077,7 @@ __export(src_exports2, {
   matchedKnowledgeQueryTerms: () => matchedKnowledgeQueryTerms,
   materializeBuiltinSkills: () => materializeBuiltinSkills,
   materializeSkillFiles: () => materializeSkillFiles,
+  mayManageAgent: () => mayManageAgent,
   mayManageWorkorder: () => mayManageWorkorder,
   mayReassignProjectItem: () => mayReassignProjectItem,
   memberNameResolver: () => memberNameResolver,
@@ -277109,6 +278192,7 @@ __export(src_exports2, {
   retireCdGateInTypeDef: () => retireCdGateInTypeDef,
   retireCdGateInTypeStore: () => retireCdGateInTypeStore,
   rolesDomain: () => rolesDomain,
+  rollbackOrgIdentity: () => rollbackOrgIdentity,
   routeFusedSignal: () => routeFusedSignal,
   runtimeConnectionStatus: () => runtimeConnectionStatus,
   runtimeDriftBlock: () => runtimeDriftBlock,
@@ -277200,6 +278284,7 @@ var init_src11 = __esm({
     init_outputs_scan();
     init_outputs_copy();
     init_org_model_backfill();
+    init_org_identity_migration();
     init_types_admin();
     init_roles_admin();
     init_roles_seed();
@@ -277311,6 +278396,7 @@ var init_src11 = __esm({
     init_chat_builtin_skills();
     init_connector_skills();
     init_connector_tool_versions();
+    init_agent_manage_guard();
     init_board_watch();
     init_uncategorized_project();
     init_run_settlement();
@@ -280989,6 +282075,28 @@ async function startServe(opts) {
       const role = members.find((m2) => m2.actorId === actorId)?.role;
       return role === "owner" || role === "admin" || role === "member" ? role : null;
     },
+    /* Agent 写面的行政权闸（组织三层身份 ADR D6，判据在 `governance/agent-manage-guard.ts`）。
+       三条读取面都**每请求现查**、都按 `(组织, 账号)` 双键——禁止把角色塞进任何跨请求缓存
+       （D7.1：`agentPrincipalByToken` 只缓存 `{companyId, actorId}`，不许顺手加 role）。
+       `controlPlaneStore` / `getEngine` / `resolveAssistantsCtx` 在下方才就绪；这三个箭头只在
+       请求时跑（同 `projectExists` 的惰性模式）。 */
+    agentManageGuard: {
+      callerRole: async (companyId, callerActorId) => {
+        const cid = companyId ?? defaultCompanyId;
+        const members = await controlPlaneStore.listMembers(cid);
+        const row = members.find((m2) => m2.actorId === callerActorId || m2.accountId === callerActorId);
+        return row?.role;
+      },
+      boundHuman: async (companyId, agentId) => {
+        const ctx = await resolveAssistantsCtxLazy(companyId);
+        if (!ctx) return null;
+        return (await ctx.service.getByAgent(agentId))?.humanActorId ?? null;
+      },
+      reportsTo: async (companyId, humanActorId) => {
+        const engine2 = await getEngine(companyId ?? defaultCompanyId);
+        return (await engine2.registry.getActor(humanActorId))?.reportsTo ?? null;
+      }
+    },
     // CO-302 数据面隔离（actors 域试点）：按当前公司取其引擎，用各自 registry 服务该域请求。
     // engineRouter 在下方（行 ~411）以 const 声明；此箭头只在请求时调用，那时已初始化，闭包引用合法
     // （TDZ 只在构造时访问才报错，这里不访问）。默认公司命中现有单实例（registry===registryStore），
@@ -281051,6 +282159,12 @@ async function startServe(opts) {
     isPlatformAdmin: async () => false
     // 占位；controlPlaneStore 就绪后由下方 setPlatformAdminChecker 注入真判据
   });
+  let resolveAssistantsCtxImpl = null;
+  const resolveAssistantsCtx = async (companyId) => {
+    if (!resolveAssistantsCtxImpl) throw new Error("assistants ctx resolver \u5C1A\u672A\u88C5\u914D\uFF08\u542F\u52A8\u671F\u4E0D\u5E94\u6709\u8BF7\u6C42\uFF09");
+    return resolveAssistantsCtxImpl(companyId);
+  };
+  const resolveAssistantsCtxLazy = async (companyId) => resolveAssistantsCtxImpl ? resolveAssistantsCtxImpl(companyId) : null;
   let projectStateStore;
   let artifactStateStore;
   let chatSessionStore;
@@ -281780,8 +282894,7 @@ async function startServe(opts) {
   const controlPlaneStore = pgDsn && pgPool ? await PostgresControlPlaneStore.open(pgPool, sharedSchema) : await FileControlPlaneStore.open(path30.join(opts.dir, "control-plane.json"));
   assistantsService.setPlatformAdminChecker(async (caller) => {
     const member = await controlPlaneStore.getMember(defaultCompanyId, caller);
-    if (!member) return false;
-    return member.role === "owner";
+    return member?.role === "owner" || member?.role === "admin";
   });
   if (pgDsn && pgPool) {
     const priceStore = await PostgresModelPriceStore.open(pgPool, sharedSchema);
@@ -281879,16 +282992,29 @@ async function startServe(opts) {
       }
     }
     if (!await controlPlaneStore.getMember(defaultCompanyId, operatorActor)) {
-      await controlPlaneStore.upsertMember({ companyId: defaultCompanyId, accountId: operatorActor, actorId: operatorActor, role: "owner", onboardingCompletedAt: seededAt });
+      const hasOwner = (await controlPlaneStore.listMembers(defaultCompanyId)).some((m2) => m2.role === "owner");
+      await controlPlaneStore.upsertMember({
+        companyId: defaultCompanyId,
+        accountId: operatorActor,
+        actorId: operatorActor,
+        role: hasOwner ? "admin" : "owner",
+        onboardingCompletedAt: seededAt
+      });
+      if (hasOwner) {
+        console.log(`[serve] \u9ED8\u8BA4\u516C\u53F8\u5DF2\u6709\u7EC4\u7EC7\u7BA1\u7406\u5458\uFF0C\u8FD0\u7EF4\u8005 ${operatorActor} \u4EE5\u300C\u7BA1\u7406\u5458\u300D\u52A0\u5165\uFF08\u7BA1\u7406\u9762\u540C\u6837\u53EF\u8FDB\uFF09`);
+      }
     }
   }
   const bootstrapEmail = process.env["OASIS_BOOTSTRAP_OWNER_EMAIL"];
   if (bootstrapEmail) {
-    const m2 = await companies.service.grantOwner(defaultCompanyId, bootstrapEmail);
-    console.log(`[serve] bootstrap owner\uFF1A${bootstrapEmail} \u2192 ${m2.accountId}\uFF08\u9ED8\u8BA4\u516C\u53F8 owner\uFF09`);
+    const res = await companies.service.grantOwner(defaultCompanyId, bootstrapEmail);
+    const bootstrapAccount = await controlPlaneStore.getAccountByEmail(bootstrapEmail.trim().toLowerCase());
+    console.log(
+      res.granted ? `[serve] bootstrap owner\uFF1A${bootstrapEmail} \u2192 ${res.membership.accountId}\uFF08\u9ED8\u8BA4\u516C\u53F8 owner\uFF09` : `[serve] bootstrap owner \u8DF3\u8FC7\uFF1A\u9ED8\u8BA4\u516C\u53F8\u5DF2\u6709\u7EC4\u7EC7\u7BA1\u7406\u5458 ${res.membership.accountId}\uFF08\u6362\u4EBA\u8D70\u8F6C\u4EA4\uFF09`
+    );
     const bootstrapPw = process.env["OASIS_BOOTSTRAP_OWNER_PASSWORD"];
-    if (bootstrapPw) {
-      await controlPlaneStore.setAccountPassword(m2.accountId, hashPassword(bootstrapPw));
+    if (bootstrapPw && bootstrapAccount) {
+      await controlPlaneStore.setAccountPassword(bootstrapAccount.id, hashPassword(bootstrapPw));
       console.log(`[serve] bootstrap owner \u5BC6\u7801\u5DF2\u8BBE\uFF08OASIS_BOOTSTRAP_OWNER_PASSWORD\uFF09`);
     }
   }
@@ -282060,6 +283186,36 @@ async function startServe(opts) {
     planeInflight.set(companyId, building);
     return building;
   };
+  resolveAssistantsCtxImpl = async (companyId) => {
+    const cid = companyId ?? defaultCompanyId;
+    const ctx = await actors.resolveCtx(cid);
+    const engine2 = await getEngine(cid);
+    const primary = Boolean(
+      pgPool && cutoverStore && cutoverStore.readsCompanySchema(await cutoverStore.get(cid, "assistant"))
+    );
+    const plane = primary ? await openCompanyPlane(cid) : void 0;
+    return {
+      service: new AssistantsService({
+        bindStore: plane?.assistants ?? assistantBindStore,
+        prefsStore: plane?.humanPrefs ?? humanPrefsStore,
+        registry: engine2.registry,
+        actors: ctx.service,
+        // 这一份服务的是**请求方的公司**——助理只在这家的在线 runtime 里挑机器（ADR-0164 §5）。
+        companyId: () => cid,
+        listRuntimes: (nodeId, scope2) => nodeStore.listRuntimes(nodeId, scope2),
+        // owner | admin 同档（组织三层身份 ADR D6.4）：只认 owner 会让「管理员」失去今天
+        // 「组织管理者」本就有的助理管理能力——那是本次改动造成的能力回归，不是新规则。
+        isPlatformAdmin: async (caller) => {
+          const member = await controlPlaneStore.getMember(cid, caller);
+          return member?.role === "owner" || member?.role === "admin";
+        },
+        // 「创建者的机器」要先知道谁是创建者：本公司的 owner 成员，保持 listMembers 的加入先后
+        // （新模型下它恰好返回一个元素，`ownerAssistantRuntime` 的「取第一个有着落的」语义不变）。
+        listOwnerIds: async () => (await controlPlaneStore.listMembers(cid)).filter((m2) => m2.role === "owner").map((m2) => m2.actorId)
+      }),
+      getActor: (id) => engine2.registry.getActor(id)
+    };
+  };
   const openCompanyPlaneUncached = async (companyId) => {
     if (!pgPool || !locationStore || !cutoverStore) {
       throw new Error("openCompanyPlane \u9700\u8981 Postgres");
@@ -283121,34 +284277,10 @@ async function startServe(opts) {
       assistantsDomain({
         service: assistantsService,
         getActor: (id) => registryStore.getActor(id),
-        resolveService: async (companyId) => {
-          const cid = companyId ?? defaultCompanyId;
-          const ctx = await actors.resolveCtx(cid);
-          const engine2 = await getEngine(cid);
-          const primary = Boolean(
-            pgPool && cutoverStore && cutoverStore.readsCompanySchema(await cutoverStore.get(cid, "assistant"))
-          );
-          const plane = primary ? await openCompanyPlane(cid) : void 0;
-          return {
-            service: new AssistantsService({
-              bindStore: plane?.assistants ?? assistantBindStore,
-              prefsStore: plane?.humanPrefs ?? humanPrefsStore,
-              registry: engine2.registry,
-              actors: ctx.service,
-              // 这一份服务的是**请求方的公司**——助理只在这家的在线 runtime 里挑机器（ADR-0164 §5）。
-              companyId: () => cid,
-              listRuntimes: (nodeId, scope2) => nodeStore.listRuntimes(nodeId, scope2),
-              isPlatformAdmin: async (caller) => {
-                const member = await controlPlaneStore.getMember(cid, caller);
-                return member?.role === "owner";
-              },
-              // 「创建者的机器」要先知道谁是创建者：本公司的 owner 成员，保持 listMembers 的加入先后
-              // （第一个 owner = 建团队的人；三种 store 都按加入先后返回，见控制面一致性套件）。
-              listOwnerIds: async () => (await controlPlaneStore.listMembers(cid)).filter((m2) => m2.role === "owner").map((m2) => m2.actorId)
-            }),
-            getActor: (id) => engine2.registry.getActor(id)
-          };
-        }
+        // 与 actors 域的 agentManageGuard.boundHuman **同一份**：「这个 agent 绑给了哪个真人」
+        // 两处各解析一次助理 store 必然漂，而漂出来的差异正好是「删助理」与「解绑助理」两条路
+        // 的闸又对不上（G4 的形状）。
+        resolveService: resolveAssistantsCtx
       }),
       companies.register,
       projectsDomain2.register,
@@ -292604,7 +293736,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
     }
   }
 }
-var CLI_VERSION = "2.2.80" ? "2.2.80" : "dev";
+var CLI_VERSION = "2.2.82" ? "2.2.82" : "dev";
 function apiHeaders(token, company) {
   const headers = {
     authorization: `Bearer ${token}`,
@@ -293001,8 +294133,19 @@ async function runCli(argv, println = console.log, progressln = console.error) {
     const name = flags.get("name");
     if (!await store.getCompany(companyId)) throw new Error(`\u516C\u53F8\u4E0D\u5B58\u5728\uFF1A${companyId}\uFF08\u5148\u8BA9 serve \u8DD1\u4E00\u6B21\u4EE5\u5EFA\u9ED8\u8BA4\u516C\u53F8\uFF0C\u6216\u7528 --company \u6307\u5B9A\u5DF2\u5B58\u5728\u516C\u53F8\uFF09`);
     const svc = new CompaniesService({ store });
-    const m2 = await svc.grantOwner(companyId, email2, name);
-    println(`\u5DF2\u6388 owner\uFF1A${email2} \u2192 ${m2.accountId}\uFF08\u516C\u53F8 ${companyId}\uFF09`);
+    const res = await svc.grantOwner(companyId, email2, name);
+    if (!res.granted && res.existingOwner) {
+      process.stderr.write(
+        `\u516C\u53F8 ${companyId} \u5DF2\u6709\u7EC4\u7EC7\u7BA1\u7406\u5458 ${res.existingOwner.accountId}\uFF0C\u672A\u6388\u4E88 ${email2}\uFF1B\u4ED6\u73B0\u5728\u662F\u672C\u7EC4\u7EC7\u7684\u300C${res.membership.role === "admin" ? "\u7BA1\u7406\u5458" : res.membership.role}\u300D\uFF08\u7BA1\u7406\u9762\u540C\u6837\u53EF\u8FDB\uFF09\u3002
+\u6362\u4EBA\u8BF7\u8BA9\u73B0\u4EFB\u6301\u6709\u4EBA\u8C03 POST /api/companies/${companyId}/owner\uFF08\u8F6C\u4EA4\uFF09\u3002
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    println(
+      res.granted ? `\u5DF2\u6388 owner\uFF1A${email2} \u2192 ${res.membership.accountId}\uFF08\u516C\u53F8 ${companyId}\uFF09` : `${email2} \u5DF2\u662F\u516C\u53F8 ${companyId} \u7684\u7EC4\u7EC7\u7BA1\u7406\u5458\uFF0C\u65E0\u9700\u6539\u52A8\uFF08\u5E42\u7B49\uFF09`
+    );
     process.stderr.write("\u63D0\u793A\uFF1A\u82E5 serve \u6B63\u5728\u8FD0\u884C\uFF0C\u63A7\u5236\u9762\u6587\u4EF6\u65E0\u9501\uFF0C\u5EFA\u8BAE\u505C\u6B62 serve \u540E\u518D\u6267\u884C\u4EE5\u514D\u5E76\u53D1\u5199\u3002\n");
     return;
   }
@@ -294390,7 +295533,13 @@ ${res.warning}`);
         if (live.length > 0) {
           for (const r of live) println(`[design] \u5F15\u64CE\u5728\u8DD1\uFF1Arun ${r.runId.slice(0, 8)} \u72B6\u6001=${r.status}\u2014\u2014\u522B\u518D\u8D77\u65B0\u8F6E\uFF1B\u8FC7\u51E0\u5206\u949F\u518D status\uFF0C\u6216\u672C\u8F6E\u6536\u5DE5\u7B49\u91CD\u6D3E\u3002`);
         } else if (st.runs.length > 0) {
-          for (const r of st.runs.slice(0, 3)) println(`[design] \u8FD1\u671F run\uFF1A${r.runId.slice(0, 8)} \u7EC8\u6001=${r.status}`);
+          for (const r of st.runs.slice(0, 3)) {
+            println(`[design] \u8FD1\u671F run\uFF1A${r.runId.slice(0, 8)} \u7EC8\u6001=${r.status}${r.agentId ? ` \u5F15\u64CE=${r.agentId}` : ""}`);
+            if (r.status === "failed" && r.error) {
+              const reason = r.error.length > 300 ? `${r.error.slice(0, 300)}\u2026` : r.error;
+              println(`[design]   \u5931\u8D25\u539F\u56E0\uFF08od \u539F\u6587\uFF09\uFF1A${reason}`);
+            }
+          }
         } else {
           println(`[design] \u65E0\u5728\u4E16 run \u8BB0\u5F55\uFF08od \u91CD\u542F\u540E\u4E3A\u7A7A\uFF0C\u5C5E\u6B63\u5E38\uFF09\u2014\u2014\u770B\u4E0B\u9762\u677F\u4E0A\u4EA7\u7269\u5373\u6301\u4E45\u771F\u76F8\u3002`);
         }
@@ -294402,7 +295551,7 @@ ${res.warning}`);
         for (const a of st.artifacts) println(`  - ${a.path}\uFF08${a.kind ?? "?"}\uFF09status=${a.status ?? "?"}${a.mtime ? ` \xB7 ${new Date(a.mtime).toISOString()}` : ""}`);
         if (flags.get("pull") === "true") {
           const odPublic = (flags.get("od-public-url") ?? process.env["OASIS_OPEN_DESIGN_PUBLIC_URL"] ?? "https://design.open-friday.com").replace(/\/$/, "");
-          const { dir: dir2, entry } = await harvestBoard(odBase, odFetch, odPublic, os13.tmpdir(), st.boardKey, st.runs[0]?.runId ?? "status-pull");
+          const { dir: dir2, entry } = await harvestBoard(odBase, odFetch, odPublic, os13.tmpdir(), st.boardKey, latestSucceededRun(st.runs)?.runId ?? "status-pull");
           println(`[design] \u5DF2\u62C9\u5230\u672C\u5730\uFF1A${dir2}\uFF08\u5165\u53E3 ${entry}\uFF09`);
           println(`[design] \u8BFB\u5B8C\u6EE1\u610F\u5373\u4EA4\u7A3F\uFF1Aoasis propose ${artifactId} --from-dir ${dir2} --reason "<\u8FD9\u7248\u505A\u4E86\u4EC0\u4E48>"`);
         } else {
@@ -296503,7 +297652,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.80" : "dev";
+var PKG_VERSION = true ? "2.2.82" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;