@twinsearth/w2m-dsh-plugin 0.10.5 → 0.11.0

package/CHANGELOG.md

@@ -4,6 +4,47 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.11.0] — 2026-10-15
+
+**Committee governance (roadmap v4.10.0): one decision engine, ordered phases, weighted votes, retained dissent.**
+
+### Built now, wired to nothing — and that is the roadmap's own instruction
+
+ROADMAP §3 says a governance layer above a fleet *that has no disagreements yet* is indistinguishable from
+a delay, and that the council earns its place when two fleets want the same machine. So `council.mjs` ships
+as the decision engine, tested in isolation, with no caller. Building it now is justified because its
+semantics are testable; deploying it now would not be.
+
+### The three falsifying tests the roadmap names, as the suite's actual cases
+
+1. **A phase cannot be skipped.** `advance()` takes no argument, so there is no way to name a destination;
+   `goTo`/`setPhase`/`jumpTo` do not exist and a test asserts their absence. A vote before the vote phase
+   refuses with `COUNCIL_UNCLEARED_TO_VOTE`, and the message says why: *a vote on nothing*.
+2. **A vote's weights are reproducible from stored inputs.** `weightOf()` is a pure function of two stored
+   integers, so `recount()` reproduces an outcome on any machine. The falsification is in the suite: a
+   tampered weight is **detected** rather than reproduced, and the tally is asserted order-independent.
+3. **A decision is retrievable *with* its dissent.** Dissent is part of the `Decision` value, not a log
+   line, and `unanimous` is an explicit flag because an empty dissent list alone cannot distinguish
+   unanimous from unrecorded. A test seals a decision and checks that dropping a ballot changes the seal.
+
+### The design choice worth naming
+
+`weight = authority × (1 + reputation/100)`, so reputation is a bounded multiplier in `[1, 2)` and **can
+never overturn authority**: authority 49 at perfect reputation (98) still loses to a bare authority 99. A
+governance layer that let reputation outvote the authority model would be a second, undeclared authority
+model, and v4.7.0 already owns that question. A tie is a **refusal**, not a coin toss, because a split
+council is exactly the case a person must see — and the refusal carries the tally that shows the split.
+
+### Two design bugs the suite caught, both the same mistake
+
+`record()` sets the seal, and `adjourn` comes **after** `record`. Deriving "sealed" from `decision !== null`
+made `record()` block `advance()`, so the final phase was unreachable; and then having `advance()` consult
+the seal at all was self-contradictory for the same reason. The fix is the distinction the module now states
+explicitly: **the seal protects the decision, not the phase machine**. Conflating "decided" with "sealed"
+produced a state nobody could reach — twice.
+
+**28 tests, 0 failures.**
+
 ## [0.10.5] — 2026-10-15
 
 **FLEET-RULES.md enters the tree, with this host's reachability measured and written down.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.10.5",
+  "version": "0.11.0",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",
@@ -113,13 +113,13 @@
     }
   },
   "scripts": {
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
     "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs",
     "test:relay": "node --test --test-force-exit test/relay.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
     "test:tools": "node --test --test-force-exit test/tools.test.mjs",
     "test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
     "pack": "node scripts/pack.mjs",
     "verify:join": "node scripts/verify-join.mjs",
     "lint": "eslint .",
@@ -135,7 +135,8 @@
     "test:fleet-sync": "node --test --test-force-exit test/fleet-sync.test.mjs",
     "test:health": "node --test --test-force-exit test/health.test.mjs",
     "test:storage": "node --test --test-force-exit test/storage.test.mjs",
-    "test:exit-channel": "node --test --test-force-exit test/exit-channel.test.mjs"
+    "test:exit-channel": "node --test --test-force-exit test/exit-channel.test.mjs",
+    "test:council": "node --test --test-force-exit test/council.test.mjs"
   },
   "keywords": [
     "dsh-bundle",

package/src/agent/council.mjs

@@ -0,0 +1,347 @@
+/**
+ * The council: one decision engine with ordered phases, weighted votes, and retained dissent.
+ *
+ * ## What this is for, and what it refuses to be
+ *
+ * The source design describes a six-role council and the ROADMAP's own §3 is explicit that a governance
+ * layer above a fleet **that has no disagreements yet** is indistinguishable from a delay. So this module is
+ * not wired into anything: it is the decision engine itself, built and tested, waiting for the measurement
+ * that earns it a caller. Building it now is justified because its *semantics* are testable in isolation;
+ * deploying it now would not be, and is not done.
+ *
+ * ## The three properties the ROADMAP names, and how each is enforced
+ *
+ * 1. **A phase cannot be skipped.** Phases are an ordered list and `advance()` moves exactly one step, to
+ *    the declared next phase or nowhere. There is no `goTo(phase)` and no way to open a vote before the
+ *    deliberation phase has closed, because the vote reads the arguments it claims to have considered.
+ * 2. **A vote's weights are reproducible from stored inputs.** `weightOf()` is a pure function of an
+ *    authority level and a reputation, both of which are stored on the ballot. Nothing about a weight comes
+ *    from the wall clock, the environment, or the order votes arrived in — so `recount()` on a stored
+ *    decision reproduces the original outcome, and a discrepancy is detectable rather than arguable.
+ * 3. **A decision with recorded dissent is retrievable *with* the dissent.** Dissent is not a log line; it
+ *    is part of the `Decision` value. A reader who asks for a decision gets the losing arguments, because
+ *    "what did the people who disagreed say" is the question that makes a decision auditable later.
+ *
+ * ## Why dissent is retained even when it changes nothing
+ *
+ * A council that records only outcomes cannot answer "was this contested?" after the fact, and the answer
+ * determines whether a decision should be revisited or trusted. Losing arguments are the *reason* the
+ * majority is a majority, so discarding them discards the only evidence that the question was hard.
+ *
+ * ## Design choices that are deliberately narrow
+ *
+ * * **Reputation is an input, not an inference.** This module never computes a reputation from past
+ *   behaviour, because a reputation derived here would be a second, hidden authority model competing with
+ *   v4.7.0's. A caller supplies it; the ballot records it; the recount reproduces it.
+ * * **A tie is a refusal, not a coin toss.** Returning *some* outcome for a tie would hide that the council
+ *   is split, and a split council is precisely the case a human must see.
+ */
+import { createHash } from 'node:crypto';
+
+/** The seven phases, in order. Index is the position; there is no other ordering. */
+export const PHASES = Object.freeze([
+  'convene',      // the question is stated and the council is formed
+  'frame',        // the question is bounded: what is in scope, what is not
+  'deliberate',   // arguments are recorded, for and against
+  'vote',         // weighted votes are cast
+  'decide',       // the outcome is fixed and dissent is attached
+  'record',       // the decision is sealed with a hash over its inputs
+  'adjourn',      // the council closes; nothing further may be added
+]);
+
+/** The six roles of the AURA council. A role is a hat, not a machine: one machine may hold several. */
+export const ROLES = Object.freeze(['strategist', 'analyst', 'critic', 'auditor', 'executor', 'operator']);
+
+/** Refusal codes, so a caller branches on a value rather than on prose. */
+export const COUNCIL_REFUSAL = Object.freeze({
+  UNKNOWN_PHASE: 'COUNCIL_UNKNOWN_PHASE',
+  WRONG_PHASE: 'COUNCIL_WRONG_PHASE',
+  ALREADY_SEALED: 'COUNCIL_ALREADY_SEALED',
+  UNKNOWN_ROLE: 'COUNCIL_UNKNOWN_ROLE',
+  UNCLEARED_TO_VOTE: 'COUNCIL_UNCLEARED_TO_VOTE',
+  ALREADY_VOTED: 'COUNCIL_ALREADY_VOTED',
+  BAD_WEIGHT_INPUT: 'COUNCIL_BAD_WEIGHT_INPUT',
+  TIED: 'COUNCIL_TIED',
+  NOT_FOUND: 'COUNCIL_NOT_FOUND',
+});
+
+export class CouncilRefusal extends Error {
+  constructor(code, detail, extra = {}) {
+    super(`${code}: ${detail}`);
+    this.name = 'CouncilRefusal';
+    this.code = code;
+    this.detail = detail;
+    Object.assign(this, extra);
+  }
+}
+
+/** Authority bands, taken from v4.7.0: 0-49 ordinary, 50-69 captain, 70-89 org admin, 90+ system admin. */
+export const AUTHORITY_MAX = 100;
+
+/**
+ * The weight of one participant, as a pure function of the two numbers on its ballot.
+ *
+ * **This is the whole reproducibility property.** Every input is a stored integer, so the same ballot
+ * recounts to the same weight on any machine and at any time. The formula is deliberately simple and
+ * deliberately *not* clever:
+ *
+ *   weight = authority × (1 + reputation/100)
+ *
+ * Authority is the primary term because v4.7.0 already defines what it means and this module has no standing
+ * to reinterpret it. Reputation is a bounded multiplier in `[1, 2)`, so reputation can promote a voice but
+ * **can never outvote authority**: a participant at authority 40 with a perfect reputation weighs 80, which
+ * is still less than a bare authority of 90. That ordering is the point — a governance layer that let
+ * reputation overturn the authority model would be a second, undeclared authority model.
+ *
+ * @param {{authority: number, reputation: number}} ballot
+ * @returns {number} the weight, exact and reproducible
+ */
+export function weightOf({ authority, reputation } = {}) {
+  if (!Number.isInteger(authority) || authority < 0 || authority > AUTHORITY_MAX) {
+    throw new CouncilRefusal(COUNCIL_REFUSAL.BAD_WEIGHT_INPUT, `authority must be an integer in 0..${AUTHORITY_MAX}, got ${JSON.stringify(authority)}`);
+  }
+  if (!Number.isFinite(reputation) || reputation < 0 || reputation > 100) {
+    throw new CouncilRefusal(COUNCIL_REFUSAL.BAD_WEIGHT_INPUT, `reputation must be a number in 0..100, got ${JSON.stringify(reputation)}`);
+  }
+  // Rounded to 6 places so a floating-point tail cannot make two equal ballots differ in a recount.
+  return Math.round(authority * (1 + reputation / 100) * 1e6) / 1e6;
+}
+
+/**
+ * A stable hash over everything a decision depended on.
+ *
+ * Exists so "the weights are reproducible" is checkable rather than assertable: recompute the seal from the
+ * stored inputs and compare. The fields are sorted and JSON-encoded with no spacing, so the seal does not
+ * depend on property order.
+ */
+export function sealOf(decision) {
+  const inputs = {
+    question: decision.question,
+    phase_reached: decision.phase_reached,
+    outcomes: (decision.ballots ?? []).map((b) => ({
+      participant: b.participant, role: b.role, authority: b.authority,
+      reputation: b.reputation, choice: b.choice, weight: b.weight, reason: b.reason,
+    })),
+    arguments: (decision.arguments ?? []).map((a) => ({ participant: a.participant, stance: a.stance, text: a.text })),
+  };
+  return createHash('sha256').update(JSON.stringify(inputs)).digest('hex');
+}
+
+/**
+ * Open a council.
+ *
+ * @param {object} options
+ * @param {string} options.question what is being decided
+ * @param {string[]} [options.participants] who is in the room, before roles are assigned
+ * @param {() => number} [options.now] injected clock
+ */
+export function convene({ question, participants = [], now = () => Date.now() } = {}) {
+  if (typeof question !== 'string' || question.trim() === '') throw new TypeError('convene: question is required');
+
+  /** @type {Array<{participant: string, role: string|null}>} */
+  const members = participants.map((p) => ({ participant: p, role: null }));
+  let phaseIndex = 0;
+  const arguments_ = [];
+  const ballots = [];
+  let decision = null;
+  /**
+   * Whether the decision has been *sealed*, which is not the same as whether it exists.
+   *
+   * The first version derived this from `decision !== null`, and that made `record()` block `advance()` —
+   * so the council could never reach `adjourn`, which comes after `record`. The tests caught it in two
+   * places. The distinction is worth keeping explicit: a decided-but-unsealed outcome is still open to being
+   * recorded, and only a sealed one is closed to every change.
+   */
+  let isSealed = false;
+  const openedAt = new Date(now()).toISOString();
+
+  const currentPhase = () => PHASES[phaseIndex];
+  const refuseIfSealed = () => {
+    if (isSealed) throw new CouncilRefusal(COUNCIL_REFUSAL.ALREADY_SEALED, 'the council has adjourned; a sealed decision is not modified');
+  };
+
+  /** Assign a role. Roles are additive, so one participant may hold several -- a fact worth allowing. */
+  function assign(participant, role) {
+    refuseIfSealed();
+    if (!ROLES.includes(role)) throw new CouncilRefusal(COUNCIL_REFUSAL.UNKNOWN_ROLE, `${JSON.stringify(role)} is not one of ${ROLES.join(', ')}`);
+    if (phaseIndex > 0) throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `roles are assigned during "convene"; the council is in "${currentPhase()}"`);
+    const existing = members.find((m) => m.participant === participant);
+    if (existing) existing.role = existing.role === null ? role : `${existing.role},${role}`;
+    else members.push({ participant, role });
+    return { participant, role };
+  }
+
+  /**
+   * Move exactly one phase forward.
+   *
+   * There is no way to move two phases or to name a destination. A phase cannot be skipped because the only
+   * transition available is to the declared successor -- and that is the ROADMAP's first falsifying test,
+   * enforced structurally rather than by a check a caller could bypass.
+   *
+   * **`advance()` deliberately does not consult the seal.** The seal protects the *decision* from being
+   * changed; it is not a lock on the phase machine. Tying the two together is self-contradictory, because
+   * `record` seals and `adjourn` comes after it -- so a seal that blocked advancement would make the final
+   * phase unreachable. Two tests caught that, which is the second time in this module that conflating
+   * "decided" with "sealed" produced a state nobody could reach.
+   */
+  function advance() {
+    if (phaseIndex >= PHASES.length - 1) return { phase: currentPhase(), moved: false, detail: 'already in the final phase' };
+    phaseIndex += 1;
+    return { phase: currentPhase(), moved: true };
+  }
+
+  /** Record an argument. Only during `deliberate`, because arguments exist to be considered by the vote. */
+  function argue({ participant, stance, text }) {
+    refuseIfSealed();
+    if (currentPhase() !== 'deliberate') {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `arguments are recorded during "deliberate"; the council is in "${currentPhase()}"`);
+    }
+    if (stance !== 'for' && stance !== 'against') {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `stance must be "for" or "against", got ${JSON.stringify(stance)}`);
+    }
+    const entry = { participant, stance, text: String(text ?? '') };
+    arguments_.push(entry);
+    return entry;
+  }
+
+  /** Cast a weighted vote. Only during `vote`, and only after the deliberation phase has closed. */
+  function vote({ participant, role = null, authority, reputation, choice, reason = null }) {
+    refuseIfSealed();
+    if (currentPhase() !== 'vote') {
+      throw new CouncilRefusal(
+        COUNCIL_REFUSAL.UNCLEARED_TO_VOTE,
+        `votes are cast during "vote"; the council is in "${currentPhase()}". A vote before deliberation would be a vote on nothing.`,
+      );
+    }
+    if (!Number.isInteger(authority)) throw new CouncilRefusal(COUNCIL_REFUSAL.BAD_WEIGHT_INPUT, 'authority must be an integer');
+    const weight = weightOf({ authority, reputation });
+    if (ballots.some((b) => b.participant === participant)) {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.ALREADY_VOTED, `${participant} has already voted; a second ballot would let one participant vote twice`);
+    }
+    const ballot = { participant, role, authority, reputation, choice, weight, reason, cast_at: new Date(now()).toISOString() };
+    ballots.push(ballot);
+    return ballot;
+  }
+
+  /**
+   * Fix the outcome and attach the dissent.
+   *
+   * A tie is refused rather than broken. Returning *some* outcome for a tie would hide that the council is
+   * split, and a split council is exactly the case a person must see.
+   */
+  function decide() {
+    refuseIfSealed();
+    if (currentPhase() !== 'decide') {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `the outcome is fixed during "decide"; the council is in "${currentPhase()}"`);
+    }
+    const tally = {};
+    for (const b of ballots) tally[b.choice] = Math.round(((tally[b.choice] ?? 0) + b.weight) * 1e6) / 1e6;
+    const ranked = Object.entries(tally).sort((a, b) => b[1] - a[1]);
+    if (ranked.length === 0) throw new CouncilRefusal(COUNCIL_REFUSAL.TIED, 'no votes were cast, so there is no outcome to fix');
+    if (ranked.length > 1 && ranked[0][1] === ranked[1][1]) {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.TIED, `a tie between ${ranked[0][0]} and ${ranked[1][0]} at weight ${ranked[0][1]}; a split council needs a person`, { tally });
+    }
+    const [outcome, weight] = ranked[0];
+    const dissent = ballots
+      .filter((b) => b.choice !== outcome)
+      .map((b) => ({
+        participant: b.participant,
+        role: b.role,
+        choice: b.choice,
+        weight: b.weight,
+        // The arguing text is carried alongside the ballot where the participant supplied one, because a
+        // dissent without its reason is a number rather than a position.
+        text: arguments_.filter((a) => a.participant === b.participant).map((a) => a.text).join(' ').trim() || null,
+      }));
+    decision = {
+      question,
+      opened_at: openedAt,
+      decided_at: new Date(now()).toISOString(),
+      phase_reached: 'decide',
+      outcome,
+      weight,
+      tally,
+      ballots: [...ballots],
+      arguments: [...arguments_],
+      dissent,
+      unanimous: dissent.length === 0,
+    };
+    return decision;
+  }
+
+  /** Seal the decision. After this the council refuses every mutation. */
+  function record() {
+    refuseIfSealed();
+    if (currentPhase() !== 'record') {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `the decision is sealed during "record"; the council is in "${currentPhase()}"`);
+    }
+    if (decision === null) {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, 'there is no decision to seal; decide() must run before record()');
+    }
+    decision.phase_reached = 'record';
+    decision.seal = sealOf(decision);
+    decision.sealed_at = new Date(now()).toISOString();
+    isSealed = true;
+    return decision;
+  }
+
+  return {
+    get phase() { return currentPhase(); },
+    get phases() { return [...PHASES]; },
+    get members() { return members.map((m) => ({ ...m })); },
+    get votes() { return ballots.map((b) => ({ ...b })); },
+    get arguments() { return arguments_.map((a) => ({ ...a })); },
+    get decision() { return decision; },
+    assign,
+    argue,
+    vote,
+    decide,
+    record,
+    advance,
+  };
+}
+
+/**
+ * Recompute a stored decision's outcome from its stored inputs.
+ *
+ * This is what makes "the weights are reproducible" checkable instead of merely claimed: hand it a decision
+ * that was recorded earlier -- possibly on another machine -- and it either reproduces the outcome or says
+ * by how much it disagrees. It trusts nothing but the ballot fields.
+ *
+ * @param {object} decision
+ * @returns {{reproduced: boolean, outcome: string|null, weight: number|null, seal_matches: boolean, detail: string}}
+ */
+export function recount(decision) {
+  if (decision === null || typeof decision !== 'object') {
+    return { reproduced: false, outcome: null, weight: null, seal_matches: false, detail: 'no decision supplied' };
+  }
+  const tally = {};
+  for (const b of decision.ballots ?? []) {
+    let weight;
+    try {
+      weight = weightOf({ authority: b.authority, reputation: b.reputation });
+    } catch (e) {
+      return { reproduced: false, outcome: null, weight: null, seal_matches: false, detail: `ballot for ${b.participant} has inputs a weight cannot be computed from: ${e.message}` };
+    }
+    if (weight !== b.weight) {
+      return {
+        reproduced: false, outcome: null, weight: null, seal_matches: false,
+        detail: `ballot for ${b.participant} records weight ${b.weight} but its stored inputs give ${weight}`,
+      };
+    }
+    tally[b.choice] = Math.round(((tally[b.choice] ?? 0) + weight) * 1e6) / 1e6;
+  }
+  const ranked = Object.entries(tally).sort((a, b) => b[1] - a[1]);
+  if (ranked.length === 0) return { reproduced: false, outcome: null, weight: null, seal_matches: false, detail: 'no ballots to recount' };
+  const sealMatches = decision.seal === undefined ? false : sealOf(decision) === decision.seal;
+  const same = ranked[0][0] === decision.outcome && ranked[0][1] === decision.weight;
+  return {
+    reproduced: same,
+    outcome: ranked[0][0],
+    weight: ranked[0][1],
+    seal_matches: sealMatches,
+    detail: same
+      ? `outcome ${ranked[0][0]} at weight ${ranked[0][1]} reproduced from ${(decision.ballots ?? []).length} stored ballot(s)`
+      : `stored outcome was ${decision.outcome} at ${decision.weight}; the stored inputs give ${ranked[0][0]} at ${ranked[0][1]}`,
+  };
+}

package/src/plugin/tools.mjs

@@ -185,7 +185,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '0.10.5';
+const PLUGIN_VERSION = '0.11.0';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;