@twinsearth/w2m-dsh-plugin 0.10.5 → 0.12.0

package/CHANGELOG.md

@@ -4,6 +4,120 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.12.0] — 2026-10-15
+
+**Bounding unbounded writers, and making the layering enforceable instead of merely described.**
+
+### The log bounding, from three recorded incidents
+
+| When | What | Measurement |
+|---|---|---|
+| 2026-10-14 | Linux relay host filled to 100% | one uncapped writer at **14.7 GB/day** |
+| 2026-10-11 → 10-12 | MacMini `relay-test` and node logs | grew **40×** in a day |
+| recurring | build output in project copies and `/tmp` | accumulates without bound |
+
+Recovery on the 14th was `truncate`, **not** `rm`, because rsyslog still held the descriptor open — removing
+the file frees nothing while appearing to succeed. That single fact shapes the module: `methodFor` returns
+`truncate` for anything a process writes and `remove` for build output, and the two are never conflated.
+
+The 40× case is why there are **two independent findings** rather than one size threshold. `absolute` means
+this file is already too big; `rate` means it grew this much between two samples, so it can be acted on
+*before* it becomes the first kind. The rate is computed from the caller's elapsed time and **not** from
+`mtime`, because `mtime` is rewritten by a rotation, a copy or a `touch` — a rate read from it would be a rate
+of the last touch rather than of the writing.
+
+### What is refused, and why the refusal carries its reason
+
+`memory.jsonl` is the only durable copy of what a command printed, since the relay keeps `stdout_sha256` and
+never the text. `device.key` is the identity peers know a machine by, and losing it makes every peer holding
+the old one refuse that machine with no visible cause. Protection is by **resolved path prefix and by name**,
+not by name alone, because a name-based check is defeated by putting the same file in another directory. A
+protected file that *was* found is listed with its reason rather than dropped: a report that omits the
+database is indistinguishable from one where the database was not there.
+
+`node_modules`, `dist`, `target` and `build` are deliberately **not** protected — being rebuildable is exactly
+what makes them legitimate targets, and `classFor` marks them `rebuildable` so a caller prefers them over
+anything unique.
+
+### The layering, as data rather than as a paragraph
+
+The goal's wording is "分模块&分层级&分权限". A prose layering is true on the day it is written and quietly
+false afterwards, because nothing fails when an import is added. So `scripts/layer-model.mjs` holds the model
+as **data**, `scripts/layer-check.mjs` derives the graph from the real tree, and `test/layer-model.test.mjs`
+fails when they disagree.
+
+It is an **allow-list**, not a denylist. A denylist lets a new edge through and reports nothing; an allow-list
+refuses it and forces the question. The measured shape it now describes is a chain with one shared leaf:
+`plugin → agent(12), util(1), relay(1)`, `relay → chatops(4)`, and `agent`/`relay → shared(1 each)`.
+
+Three defects found while building it, all by running rather than reading:
+
+* **`src/signing.mjs` was treated as a layer.** It is a file sitting directly in `src/`, so its basename
+  became a layer name and two genuine edges came back as "unexplained" — and worse, any future root-level
+  file would have silently passed as a layer nobody declared. It now folds into a declared `shared` layer.
+* **`buildGraph(srcDir)` ignored its own argument.** `layerOf` and `insideSrc` hard-coded the real `src`, so
+  every synthetic-tree test returned zero edges. Two tests caught it; without them the real-tree test would
+  have passed for the wrong reason.
+* **`/x/dist` was classified `report_only`.** The match was on `/dist/` and `\dist\`, which a directory path
+  with no trailing separator never matches — so the single most obvious cleanup target of all was not a
+  target. Matching is now on whole path segments.
+
+A fourth finding is about the tests rather than the code: two fixtures used `mkdtempSync(tmpdir())`, so the
+OS temp path put a `tmp` segment in every path and made files legitimately removable. **The code was right
+both times and the fixture was wrong**, which is worth recording because the reflex is to change the code.
+
+### The configuration is offered; the module is what runs
+
+`deploy/logrotate/w2m.logrotate` is a host-level file that needs root to install, so this repository can
+*offer* it and cannot *enforce* it — saying otherwise is the kind of claim the fleet rules exist to prevent.
+What runs without root, from a task on any machine, is `src/agent/log-bounds.mjs`. `copytruncate` and
+`maxsize` are both set in the configuration: without the first, rotation renames the file while the daemon
+keeps writing to the old descriptor and the disk stays full; without the second, a file growing 40× a day
+reaches its cap long before a daily timer looks.
+
+**28 tests for log bounds and 22 for the layer model, 0 failures.**
+
+## [0.11.0] — 2026-10-15
+
+**Committee governance (roadmap v4.10.0): one decision engine, ordered phases, weighted votes, retained dissent.**
+
+### Built now, wired to nothing — and that is the roadmap's own instruction
+
+ROADMAP §3 says a governance layer above a fleet *that has no disagreements yet* is indistinguishable from
+a delay, and that the council earns its place when two fleets want the same machine. So `council.mjs` ships
+as the decision engine, tested in isolation, with no caller. Building it now is justified because its
+semantics are testable; deploying it now would not be.
+
+### The three falsifying tests the roadmap names, as the suite's actual cases
+
+1. **A phase cannot be skipped.** `advance()` takes no argument, so there is no way to name a destination;
+   `goTo`/`setPhase`/`jumpTo` do not exist and a test asserts their absence. A vote before the vote phase
+   refuses with `COUNCIL_UNCLEARED_TO_VOTE`, and the message says why: *a vote on nothing*.
+2. **A vote's weights are reproducible from stored inputs.** `weightOf()` is a pure function of two stored
+   integers, so `recount()` reproduces an outcome on any machine. The falsification is in the suite: a
+   tampered weight is **detected** rather than reproduced, and the tally is asserted order-independent.
+3. **A decision is retrievable *with* its dissent.** Dissent is part of the `Decision` value, not a log
+   line, and `unanimous` is an explicit flag because an empty dissent list alone cannot distinguish
+   unanimous from unrecorded. A test seals a decision and checks that dropping a ballot changes the seal.
+
+### The design choice worth naming
+
+`weight = authority × (1 + reputation/100)`, so reputation is a bounded multiplier in `[1, 2)` and **can
+never overturn authority**: authority 49 at perfect reputation (98) still loses to a bare authority 99. A
+governance layer that let reputation outvote the authority model would be a second, undeclared authority
+model, and v4.7.0 already owns that question. A tie is a **refusal**, not a coin toss, because a split
+council is exactly the case a person must see — and the refusal carries the tally that shows the split.
+
+### Two design bugs the suite caught, both the same mistake
+
+`record()` sets the seal, and `adjourn` comes **after** `record`. Deriving "sealed" from `decision !== null`
+made `record()` block `advance()`, so the final phase was unreachable; and then having `advance()` consult
+the seal at all was self-contradictory for the same reason. The fix is the distinction the module now states
+explicitly: **the seal protects the decision, not the phase machine**. Conflating "decided" with "sealed"
+produced a state nobody could reach — twice.
+
+**28 tests, 0 failures.**
+
 ## [0.10.5] — 2026-10-15
 
 **FLEET-RULES.md enters the tree, with this host's reachability measured and written down.**

package/deploy/logrotate/README.md

@@ -0,0 +1,102 @@
+# Bounding the log writers on a fleet machine
+
+Two incidents put this file here, and both are recorded in the CHANGELOG with their measurements:
+
+* **2026-10-14, the Linux relay host** — root filesystem reached 100% from a single uncapped writer at
+  **14.7 GB/day**. Recovery was `truncate`, **not** `rm`, because rsyslog still held the descriptor open.
+* **2026-10-11 → 10-12, MacMini** — `relay-test` and node logs grew **40×** in a day.
+
+## What this directory is, and what it is not
+
+`w2m.logrotate` is a **host-level** configuration. It has to be installed on the machine, by someone with
+root, and it is therefore something this repository can *offer* and cannot *enforce*. Saying otherwise would
+be the kind of claim the fleet rules exist to prevent.
+
+What the repository **can** enforce is `src/agent/log-bounds.mjs`: it finds what is growing, decides the
+method (`truncate` for anything a process writes, `remove` for build output), and refuses anything
+irreplaceable. That runs from a task on any machine, needs no root, and reports through an exit code.
+
+**Use both.** The configuration is the durable fix; the module is what tells you it is needed and proves it
+was applied.
+
+## Install the configuration
+
+```sh
+# Debian/Ubuntu, as root
+install -m 0644 deploy/logrotate/w2m.logrotate /etc/logrotate.d/w2m
+
+# Check what it would do, without doing it
+logrotate --debug /etc/logrotate.d/w2m
+
+# Force one pass now
+logrotate --force /etc/logrotate.d/w2m
+```
+
+On a systemd host the timer is usually already enabled:
+
+```sh
+systemctl status logrotate.timer
+```
+
+## The two directives that matter, and why
+
+**`copytruncate` is not optional here.** Without it, rotation renames the file and the daemon keeps writing
+to the old descriptor: the new file stays empty and **the disk stays full**. That is the 2026-10-14 failure
+in a different costume, and it is why `src/agent/log-bounds.mjs` returns `truncate` rather than `remove` for
+anything a process is writing. The cost of `copytruncate` is a brief window where writes to the file can be
+lost, which is acceptable for logs and would not be for a ledger.
+
+**`maxsize` is set as well as the schedule.** A file growing 40× in a day reaches any sane cap long before a
+daily timer looks at it. `daily` plus `maxsize 256M` means "at least once a day, and immediately if it gets
+big", which is the behaviour both incidents needed.
+
+## If the paths are not these paths
+
+The configuration names the directories this fleet actually uses. Confirm them on the machine before
+installing, rather than trusting this list:
+
+```sh
+# The largest files under the directories that matter, largest first
+du -ah /var/log /var/lib/w2m /tmp 2>/dev/null | sort -rh | head -30
+
+# What is growing right now, over 60 seconds
+node -e '
+  const { snapshot, growth } = await import("./src/agent/log-bounds.mjs");
+  const before = snapshot("/var/log");
+  await new Promise((r) => setTimeout(r, 60000));
+  const after = snapshot("/var/log");
+  for (const f of growth(before, after, 60000).findings) {
+    console.log((f.bytes_per_day / 1024 ** 3).toFixed(2) + " GB/day  " + f.path);
+  }
+'
+```
+
+## Build artefacts: `cargo clean` and its equivalents
+
+The third part of the same problem is that build output accumulates in project copies and in `/tmp`. The
+general rule the module applies is **rebuildable things are preferred cleanup targets over anything unique**
+(`classFor` returns `rebuildable` for `node_modules`, `dist`, `target` and `build`).
+
+```sh
+cargo clean                       # a Rust target/ directory is routinely tens of GB
+rm -rf node_modules dist .next    # rebuildable from the lockfile and the source
+git -C <repo> clean -xdf          # removes ignored files; check `git clean -xdn` first
+```
+
+`git clean -xdf` is the one to be careful with: it removes *everything* untracked and ignored, which includes
+any local notes that were never committed. Run `git clean -xdn` first and read the list.
+
+## What must never be cleaned, whatever the pressure
+
+`src/agent/log-bounds.mjs` refuses these by resolved path and by name, and the refusal carries its reason:
+
+| Path | Why |
+|---|---|
+| `memory.jsonl` | The **only** durable copy of what a command printed — the relay keeps `stdout_sha256` and never the text. |
+| `device.json`, `device.key` | The identity peers know this machine by. Losing the key makes every peer holding the old one refuse this machine, with no visible cause. |
+| `fleet-memory.md` | Curated by hand; not reproducible from anything. |
+| `.git/` | The history, which is the only record of what was verified. |
+| `src/`, `lib/`, `bin/`, `deploy/`, `profiles/` | The tree and the data directory. |
+
+A directory that fills up is a reason to clean the *rebuildable* things first. It is never a reason to delete
+the database.

package/deploy/logrotate/w2m.logrotate

@@ -0,0 +1,86 @@
+# Log rotation for the w2m fleet.
+#
+# Install:  install -m 0644 deploy/logrotate/w2m.logrotate /etc/logrotate.d/w2m
+# Test:     logrotate --debug /etc/logrotate.d/w2m
+#
+# Two incidents put this file here, and both are in the CHANGELOG with their measurements:
+#   * 2026-10-14  the relay host's root filesystem reached 100% at 14.7 GB/day from one uncapped writer.
+#                 Recovery was `truncate`, not `rm`, because rsyslog still held the descriptor open.
+#   * 2026-10-11  MacMini's relay-test and node logs grew 40x in a single day.
+#
+# Two directives carry the weight, and neither is a default:
+#
+#   copytruncate   Without it, rotation renames the file while the daemon keeps writing to the old
+#                  descriptor: the new file stays empty and THE DISK STAYS FULL. That is the first
+#                  incident in a different costume. The cost is a brief window where writes to the file
+#                  can be lost, which is acceptable for logs and would not be for a ledger.
+#
+#   maxsize        Set as well as the schedule, because a file growing 40x a day reaches any sane cap long
+#                  before a daily timer looks at it. `daily` + `maxsize 256M` means "at least once a day,
+#                  and immediately if it gets big", which is what both incidents needed.
+
+# The w2m daemons. `w2m-rabbit` owns the relay; `w2m-localside` and `w2m-stun` write far less but share
+# the directory, and rotating a file that is not there is why `missingok` is set.
+/var/log/w2m/*.log /var/log/w2m/*.out /var/log/w2m/*.err {
+  daily
+  maxsize 256M
+  rotate 7
+  compress
+  delaycompress
+  missingok
+  notifempty
+  copytruncate
+  create 0640 root adm
+}
+
+# The relay's own test output. This is the path named in the 2026-10-11 incident: it is written by a test
+# harness rather than a service, so nothing signals it and `copytruncate` is the only safe method.
+/var/log/w2m/relay-test* {
+  daily
+  maxsize 128M
+  rotate 3
+  compress
+  delaycompress
+  missingok
+  notifempty
+  copytruncate
+}
+
+# Anything a node process leaves behind under the state directory. Bounded tightly, because a crash loop
+# writes these faster than anything else on the machine.
+/var/lib/w2m/*.log /var/lib/w2m/logs/*.log {
+  daily
+  maxsize 128M
+  rotate 5
+  compress
+  delaycompress
+  missingok
+  notifempty
+  copytruncate
+}
+
+# Deploy-time and test-time logs that accumulate in the checkout. These are not written by a long-lived
+# process, so `nocopytruncate` would also work -- `copytruncate` is kept for uniformity, since a file that
+# nobody expects to be open is exactly the file that will be.
+/home/*/w2m-dev/*.log /home/*/w2m-dev/logs/*.log /Users/*/w2m-dev/*.log /Users/*/w2m-dev/logs/*.log {
+  daily
+  maxsize 128M
+  rotate 3
+  compress
+  delaycompress
+  missingok
+  notifempty
+  copytruncate
+}
+
+# A backstop for /tmp. This is deliberately last and deliberately blunt: /tmp on a machine that runs tests
+# accumulates build output, and the alternative is the filesystem filling while every specific rule above
+# reports nothing to do. `maxage` is the part that helps; the size cap is a secondary guard.
+/tmp/w2m* /tmp/relay-test* {
+  daily
+  maxsize 512M
+  rotate 1
+  missingok
+  notifempty
+  copytruncate
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.10.5",
+  "version": "0.12.0",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",
@@ -113,13 +113,13 @@
     }
   },
   "scripts": {
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/log-bounds.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
     "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs",
     "test:relay": "node --test --test-force-exit test/relay.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
     "test:tools": "node --test --test-force-exit test/tools.test.mjs",
     "test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/log-bounds.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
     "pack": "node scripts/pack.mjs",
     "verify:join": "node scripts/verify-join.mjs",
     "lint": "eslint .",
@@ -135,7 +135,11 @@
     "test:fleet-sync": "node --test --test-force-exit test/fleet-sync.test.mjs",
     "test:health": "node --test --test-force-exit test/health.test.mjs",
     "test:storage": "node --test --test-force-exit test/storage.test.mjs",
-    "test:exit-channel": "node --test --test-force-exit test/exit-channel.test.mjs"
+    "test:exit-channel": "node --test --test-force-exit test/exit-channel.test.mjs",
+    "test:council": "node --test --test-force-exit test/council.test.mjs",
+    "test:layers": "node --test --test-force-exit test/layer-model.test.mjs",
+    "test:log-bounds": "node --test --test-force-exit test/log-bounds.test.mjs",
+    "layer-check": "node scripts/layer-check.mjs"
   },
   "keywords": [
     "dsh-bundle",

package/src/agent/council.mjs

@@ -0,0 +1,347 @@
+/**
+ * The council: one decision engine with ordered phases, weighted votes, and retained dissent.
+ *
+ * ## What this is for, and what it refuses to be
+ *
+ * The source design describes a six-role council and the ROADMAP's own §3 is explicit that a governance
+ * layer above a fleet **that has no disagreements yet** is indistinguishable from a delay. So this module is
+ * not wired into anything: it is the decision engine itself, built and tested, waiting for the measurement
+ * that earns it a caller. Building it now is justified because its *semantics* are testable in isolation;
+ * deploying it now would not be, and is not done.
+ *
+ * ## The three properties the ROADMAP names, and how each is enforced
+ *
+ * 1. **A phase cannot be skipped.** Phases are an ordered list and `advance()` moves exactly one step, to
+ *    the declared next phase or nowhere. There is no `goTo(phase)` and no way to open a vote before the
+ *    deliberation phase has closed, because the vote reads the arguments it claims to have considered.
+ * 2. **A vote's weights are reproducible from stored inputs.** `weightOf()` is a pure function of an
+ *    authority level and a reputation, both of which are stored on the ballot. Nothing about a weight comes
+ *    from the wall clock, the environment, or the order votes arrived in — so `recount()` on a stored
+ *    decision reproduces the original outcome, and a discrepancy is detectable rather than arguable.
+ * 3. **A decision with recorded dissent is retrievable *with* the dissent.** Dissent is not a log line; it
+ *    is part of the `Decision` value. A reader who asks for a decision gets the losing arguments, because
+ *    "what did the people who disagreed say" is the question that makes a decision auditable later.
+ *
+ * ## Why dissent is retained even when it changes nothing
+ *
+ * A council that records only outcomes cannot answer "was this contested?" after the fact, and the answer
+ * determines whether a decision should be revisited or trusted. Losing arguments are the *reason* the
+ * majority is a majority, so discarding them discards the only evidence that the question was hard.
+ *
+ * ## Design choices that are deliberately narrow
+ *
+ * * **Reputation is an input, not an inference.** This module never computes a reputation from past
+ *   behaviour, because a reputation derived here would be a second, hidden authority model competing with
+ *   v4.7.0's. A caller supplies it; the ballot records it; the recount reproduces it.
+ * * **A tie is a refusal, not a coin toss.** Returning *some* outcome for a tie would hide that the council
+ *   is split, and a split council is precisely the case a human must see.
+ */
+import { createHash } from 'node:crypto';
+
+/** The seven phases, in order. Index is the position; there is no other ordering. */
+export const PHASES = Object.freeze([
+  'convene',      // the question is stated and the council is formed
+  'frame',        // the question is bounded: what is in scope, what is not
+  'deliberate',   // arguments are recorded, for and against
+  'vote',         // weighted votes are cast
+  'decide',       // the outcome is fixed and dissent is attached
+  'record',       // the decision is sealed with a hash over its inputs
+  'adjourn',      // the council closes; nothing further may be added
+]);
+
+/** The six roles of the AURA council. A role is a hat, not a machine: one machine may hold several. */
+export const ROLES = Object.freeze(['strategist', 'analyst', 'critic', 'auditor', 'executor', 'operator']);
+
+/** Refusal codes, so a caller branches on a value rather than on prose. */
+export const COUNCIL_REFUSAL = Object.freeze({
+  UNKNOWN_PHASE: 'COUNCIL_UNKNOWN_PHASE',
+  WRONG_PHASE: 'COUNCIL_WRONG_PHASE',
+  ALREADY_SEALED: 'COUNCIL_ALREADY_SEALED',
+  UNKNOWN_ROLE: 'COUNCIL_UNKNOWN_ROLE',
+  UNCLEARED_TO_VOTE: 'COUNCIL_UNCLEARED_TO_VOTE',
+  ALREADY_VOTED: 'COUNCIL_ALREADY_VOTED',
+  BAD_WEIGHT_INPUT: 'COUNCIL_BAD_WEIGHT_INPUT',
+  TIED: 'COUNCIL_TIED',
+  NOT_FOUND: 'COUNCIL_NOT_FOUND',
+});
+
+export class CouncilRefusal extends Error {
+  constructor(code, detail, extra = {}) {
+    super(`${code}: ${detail}`);
+    this.name = 'CouncilRefusal';
+    this.code = code;
+    this.detail = detail;
+    Object.assign(this, extra);
+  }
+}
+
+/** Authority bands, taken from v4.7.0: 0-49 ordinary, 50-69 captain, 70-89 org admin, 90+ system admin. */
+export const AUTHORITY_MAX = 100;
+
+/**
+ * The weight of one participant, as a pure function of the two numbers on its ballot.
+ *
+ * **This is the whole reproducibility property.** Every input is a stored integer, so the same ballot
+ * recounts to the same weight on any machine and at any time. The formula is deliberately simple and
+ * deliberately *not* clever:
+ *
+ *   weight = authority × (1 + reputation/100)
+ *
+ * Authority is the primary term because v4.7.0 already defines what it means and this module has no standing
+ * to reinterpret it. Reputation is a bounded multiplier in `[1, 2)`, so reputation can promote a voice but
+ * **can never outvote authority**: a participant at authority 40 with a perfect reputation weighs 80, which
+ * is still less than a bare authority of 90. That ordering is the point — a governance layer that let
+ * reputation overturn the authority model would be a second, undeclared authority model.
+ *
+ * @param {{authority: number, reputation: number}} ballot
+ * @returns {number} the weight, exact and reproducible
+ */
+export function weightOf({ authority, reputation } = {}) {
+  if (!Number.isInteger(authority) || authority < 0 || authority > AUTHORITY_MAX) {
+    throw new CouncilRefusal(COUNCIL_REFUSAL.BAD_WEIGHT_INPUT, `authority must be an integer in 0..${AUTHORITY_MAX}, got ${JSON.stringify(authority)}`);
+  }
+  if (!Number.isFinite(reputation) || reputation < 0 || reputation > 100) {
+    throw new CouncilRefusal(COUNCIL_REFUSAL.BAD_WEIGHT_INPUT, `reputation must be a number in 0..100, got ${JSON.stringify(reputation)}`);
+  }
+  // Rounded to 6 places so a floating-point tail cannot make two equal ballots differ in a recount.
+  return Math.round(authority * (1 + reputation / 100) * 1e6) / 1e6;
+}
+
+/**
+ * A stable hash over everything a decision depended on.
+ *
+ * Exists so "the weights are reproducible" is checkable rather than assertable: recompute the seal from the
+ * stored inputs and compare. The fields are sorted and JSON-encoded with no spacing, so the seal does not
+ * depend on property order.
+ */
+export function sealOf(decision) {
+  const inputs = {
+    question: decision.question,
+    phase_reached: decision.phase_reached,
+    outcomes: (decision.ballots ?? []).map((b) => ({
+      participant: b.participant, role: b.role, authority: b.authority,
+      reputation: b.reputation, choice: b.choice, weight: b.weight, reason: b.reason,
+    })),
+    arguments: (decision.arguments ?? []).map((a) => ({ participant: a.participant, stance: a.stance, text: a.text })),
+  };
+  return createHash('sha256').update(JSON.stringify(inputs)).digest('hex');
+}
+
+/**
+ * Open a council.
+ *
+ * @param {object} options
+ * @param {string} options.question what is being decided
+ * @param {string[]} [options.participants] who is in the room, before roles are assigned
+ * @param {() => number} [options.now] injected clock
+ */
+export function convene({ question, participants = [], now = () => Date.now() } = {}) {
+  if (typeof question !== 'string' || question.trim() === '') throw new TypeError('convene: question is required');
+
+  /** @type {Array<{participant: string, role: string|null}>} */
+  const members = participants.map((p) => ({ participant: p, role: null }));
+  let phaseIndex = 0;
+  const arguments_ = [];
+  const ballots = [];
+  let decision = null;
+  /**
+   * Whether the decision has been *sealed*, which is not the same as whether it exists.
+   *
+   * The first version derived this from `decision !== null`, and that made `record()` block `advance()` —
+   * so the council could never reach `adjourn`, which comes after `record`. The tests caught it in two
+   * places. The distinction is worth keeping explicit: a decided-but-unsealed outcome is still open to being
+   * recorded, and only a sealed one is closed to every change.
+   */
+  let isSealed = false;
+  const openedAt = new Date(now()).toISOString();
+
+  const currentPhase = () => PHASES[phaseIndex];
+  const refuseIfSealed = () => {
+    if (isSealed) throw new CouncilRefusal(COUNCIL_REFUSAL.ALREADY_SEALED, 'the council has adjourned; a sealed decision is not modified');
+  };
+
+  /** Assign a role. Roles are additive, so one participant may hold several -- a fact worth allowing. */
+  function assign(participant, role) {
+    refuseIfSealed();
+    if (!ROLES.includes(role)) throw new CouncilRefusal(COUNCIL_REFUSAL.UNKNOWN_ROLE, `${JSON.stringify(role)} is not one of ${ROLES.join(', ')}`);
+    if (phaseIndex > 0) throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `roles are assigned during "convene"; the council is in "${currentPhase()}"`);
+    const existing = members.find((m) => m.participant === participant);
+    if (existing) existing.role = existing.role === null ? role : `${existing.role},${role}`;
+    else members.push({ participant, role });
+    return { participant, role };
+  }
+
+  /**
+   * Move exactly one phase forward.
+   *
+   * There is no way to move two phases or to name a destination. A phase cannot be skipped because the only
+   * transition available is to the declared successor -- and that is the ROADMAP's first falsifying test,
+   * enforced structurally rather than by a check a caller could bypass.
+   *
+   * **`advance()` deliberately does not consult the seal.** The seal protects the *decision* from being
+   * changed; it is not a lock on the phase machine. Tying the two together is self-contradictory, because
+   * `record` seals and `adjourn` comes after it -- so a seal that blocked advancement would make the final
+   * phase unreachable. Two tests caught that, which is the second time in this module that conflating
+   * "decided" with "sealed" produced a state nobody could reach.
+   */
+  function advance() {
+    if (phaseIndex >= PHASES.length - 1) return { phase: currentPhase(), moved: false, detail: 'already in the final phase' };
+    phaseIndex += 1;
+    return { phase: currentPhase(), moved: true };
+  }
+
+  /** Record an argument. Only during `deliberate`, because arguments exist to be considered by the vote. */
+  function argue({ participant, stance, text }) {
+    refuseIfSealed();
+    if (currentPhase() !== 'deliberate') {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `arguments are recorded during "deliberate"; the council is in "${currentPhase()}"`);
+    }
+    if (stance !== 'for' && stance !== 'against') {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `stance must be "for" or "against", got ${JSON.stringify(stance)}`);
+    }
+    const entry = { participant, stance, text: String(text ?? '') };
+    arguments_.push(entry);
+    return entry;
+  }
+
+  /** Cast a weighted vote. Only during `vote`, and only after the deliberation phase has closed. */
+  function vote({ participant, role = null, authority, reputation, choice, reason = null }) {
+    refuseIfSealed();
+    if (currentPhase() !== 'vote') {
+      throw new CouncilRefusal(
+        COUNCIL_REFUSAL.UNCLEARED_TO_VOTE,
+        `votes are cast during "vote"; the council is in "${currentPhase()}". A vote before deliberation would be a vote on nothing.`,
+      );
+    }
+    if (!Number.isInteger(authority)) throw new CouncilRefusal(COUNCIL_REFUSAL.BAD_WEIGHT_INPUT, 'authority must be an integer');
+    const weight = weightOf({ authority, reputation });
+    if (ballots.some((b) => b.participant === participant)) {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.ALREADY_VOTED, `${participant} has already voted; a second ballot would let one participant vote twice`);
+    }
+    const ballot = { participant, role, authority, reputation, choice, weight, reason, cast_at: new Date(now()).toISOString() };
+    ballots.push(ballot);
+    return ballot;
+  }
+
+  /**
+   * Fix the outcome and attach the dissent.
+   *
+   * A tie is refused rather than broken. Returning *some* outcome for a tie would hide that the council is
+   * split, and a split council is exactly the case a person must see.
+   */
+  function decide() {
+    refuseIfSealed();
+    if (currentPhase() !== 'decide') {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `the outcome is fixed during "decide"; the council is in "${currentPhase()}"`);
+    }
+    const tally = {};
+    for (const b of ballots) tally[b.choice] = Math.round(((tally[b.choice] ?? 0) + b.weight) * 1e6) / 1e6;
+    const ranked = Object.entries(tally).sort((a, b) => b[1] - a[1]);
+    if (ranked.length === 0) throw new CouncilRefusal(COUNCIL_REFUSAL.TIED, 'no votes were cast, so there is no outcome to fix');
+    if (ranked.length > 1 && ranked[0][1] === ranked[1][1]) {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.TIED, `a tie between ${ranked[0][0]} and ${ranked[1][0]} at weight ${ranked[0][1]}; a split council needs a person`, { tally });
+    }
+    const [outcome, weight] = ranked[0];
+    const dissent = ballots
+      .filter((b) => b.choice !== outcome)
+      .map((b) => ({
+        participant: b.participant,
+        role: b.role,
+        choice: b.choice,
+        weight: b.weight,
+        // The arguing text is carried alongside the ballot where the participant supplied one, because a
+        // dissent without its reason is a number rather than a position.
+        text: arguments_.filter((a) => a.participant === b.participant).map((a) => a.text).join(' ').trim() || null,
+      }));
+    decision = {
+      question,
+      opened_at: openedAt,
+      decided_at: new Date(now()).toISOString(),
+      phase_reached: 'decide',
+      outcome,
+      weight,
+      tally,
+      ballots: [...ballots],
+      arguments: [...arguments_],
+      dissent,
+      unanimous: dissent.length === 0,
+    };
+    return decision;
+  }
+
+  /** Seal the decision. After this the council refuses every mutation. */
+  function record() {
+    refuseIfSealed();
+    if (currentPhase() !== 'record') {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, `the decision is sealed during "record"; the council is in "${currentPhase()}"`);
+    }
+    if (decision === null) {
+      throw new CouncilRefusal(COUNCIL_REFUSAL.WRONG_PHASE, 'there is no decision to seal; decide() must run before record()');
+    }
+    decision.phase_reached = 'record';
+    decision.seal = sealOf(decision);
+    decision.sealed_at = new Date(now()).toISOString();
+    isSealed = true;
+    return decision;
+  }
+
+  return {
+    get phase() { return currentPhase(); },
+    get phases() { return [...PHASES]; },
+    get members() { return members.map((m) => ({ ...m })); },
+    get votes() { return ballots.map((b) => ({ ...b })); },
+    get arguments() { return arguments_.map((a) => ({ ...a })); },
+    get decision() { return decision; },
+    assign,
+    argue,
+    vote,
+    decide,
+    record,
+    advance,
+  };
+}
+
+/**
+ * Recompute a stored decision's outcome from its stored inputs.
+ *
+ * This is what makes "the weights are reproducible" checkable instead of merely claimed: hand it a decision
+ * that was recorded earlier -- possibly on another machine -- and it either reproduces the outcome or says
+ * by how much it disagrees. It trusts nothing but the ballot fields.
+ *
+ * @param {object} decision
+ * @returns {{reproduced: boolean, outcome: string|null, weight: number|null, seal_matches: boolean, detail: string}}
+ */
+export function recount(decision) {
+  if (decision === null || typeof decision !== 'object') {
+    return { reproduced: false, outcome: null, weight: null, seal_matches: false, detail: 'no decision supplied' };
+  }
+  const tally = {};
+  for (const b of decision.ballots ?? []) {
+    let weight;
+    try {
+      weight = weightOf({ authority: b.authority, reputation: b.reputation });
+    } catch (e) {
+      return { reproduced: false, outcome: null, weight: null, seal_matches: false, detail: `ballot for ${b.participant} has inputs a weight cannot be computed from: ${e.message}` };
+    }
+    if (weight !== b.weight) {
+      return {
+        reproduced: false, outcome: null, weight: null, seal_matches: false,
+        detail: `ballot for ${b.participant} records weight ${b.weight} but its stored inputs give ${weight}`,
+      };
+    }
+    tally[b.choice] = Math.round(((tally[b.choice] ?? 0) + weight) * 1e6) / 1e6;
+  }
+  const ranked = Object.entries(tally).sort((a, b) => b[1] - a[1]);
+  if (ranked.length === 0) return { reproduced: false, outcome: null, weight: null, seal_matches: false, detail: 'no ballots to recount' };
+  const sealMatches = decision.seal === undefined ? false : sealOf(decision) === decision.seal;
+  const same = ranked[0][0] === decision.outcome && ranked[0][1] === decision.weight;
+  return {
+    reproduced: same,
+    outcome: ranked[0][0],
+    weight: ranked[0][1],
+    seal_matches: sealMatches,
+    detail: same
+      ? `outcome ${ranked[0][0]} at weight ${ranked[0][1]} reproduced from ${(decision.ballots ?? []).length} stored ballot(s)`
+      : `stored outcome was ${decision.outcome} at ${decision.weight}; the stored inputs give ${ranked[0][0]} at ${ranked[0][1]}`,
+  };
+}

package/src/agent/log-bounds.mjs

@@ -0,0 +1,330 @@
+/**
+ * Bounding unbounded writers: find what is growing, classify what may be removed, and never touch what cannot.
+ *
+ * ## The incidents this comes from, because the thresholds are not guesses
+ *
+ * 1. **2026-10-14, the Linux relay host.** Root filesystem reached 100% because a process wrote 14.7 GB/day
+ *    with no cap. The recovery was `truncate`, **not** `rm` — rsyslog still held the file descriptor open, so
+ *    removing the file freed nothing while appearing to succeed. That single fact is why this module
+ *    distinguishes "remove" from "truncate" instead of offering one delete operation.
+ * 2. **2026-10-11 → 10-12, MacMini.** `relay-test` and node logs grew by a factor of 40. A factor is the
+ *    important part: the harm is not a file being large, it is a file being large *and still accelerating*,
+ *    and a size threshold alone cannot see the difference.
+ *
+ * So there are two independent findings, and they need different responses:
+ *
+ *   * `absolute` — this file is already too big. Act now.
+ *   * `rate` — this file grew this much between two samples. Act *before* it becomes the first kind.
+ *
+ * ## Why this module proposes rather than performs
+ *
+ * The same reason `src/agent/health.mjs` does. A component that decides a file is disposable *and* deletes it
+ * is one bug away from deleting `memory.jsonl`, which is the only durable copy of what a command printed —
+ * the relay keeps hashes and never the text. Every removal here is returned as a **proposal with a method**
+ * (`truncate` or `remove`) and a reason, and the one function that does act refuses anything not marked
+ * removable.
+ *
+ * ## What "removable" means here
+ *
+ * Only files that are **this machine's own disposable output**: logs, test artefacts, build output, temp
+ * files. Never a repository, never a data directory, never a credential, never something a running process
+ * is writing. The protected list is checked by resolved path prefix, so a temp directory under a protected
+ * root is still protected.
+ */
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+/** Bytes in a gigabyte, because every threshold below is about disk. */
+const GB = 1024 ** 3;
+
+/** A single file this large is worth acting on by itself. */
+export const FILE_WARN_BYTES = 256 * 1024 * 1024;
+
+/** A single file this large is the incident, not a warning about it. */
+export const FILE_CRITICAL_BYTES = 1 * GB;
+
+/**
+ * Growth per day that counts as unbounded.
+ *
+ * 1 GB/day is a tenth of the measured 14.7 GB/day that filled the relay host, so it is deliberately an early
+ * warning rather than a late one: at this rate a machine has roughly ten days, which is enough time to act
+ * without being urgent about it.
+ */
+export const RATE_WARN_BYTES_PER_DAY = 1 * GB;
+
+/** A whole directory this large is reported even when no single file in it is remarkable. */
+export const DIR_WARN_BYTES = 2 * GB;
+
+/**
+ * Paths whose contents may never be proposed for removal.
+ *
+ * This is a **prefix list checked against resolved paths**, not a set of names, because a name-based check is
+ * defeated by putting the same file in another directory. The entries are the things whose loss is not
+ * recoverable from anywhere else in this system:
+ *
+ *   * `.git` — the history. Removing it removes the only record of what was verified.
+ *   * `memory.jsonl` lives under a profile directory; those directories are protected wholesale.
+ *   * `node_modules` and `dist` are **not** here on purpose: they are rebuildable, which is exactly what
+ *     makes them legitimate cleanup targets. They are separately flagged as `rebuildable` rather than
+ *     `disposable`, so a caller can prefer them over anything unique.
+ */
+export const PROTECTED_PREFIXES = Object.freeze([
+  '.git',
+  'profiles',
+  'lib',
+  'src',
+  'bin',
+  'deploy',
+]);
+
+/** Names that are never a cleanup target wherever they appear. */
+export const PROTECTED_NAMES = Object.freeze([
+  'memory.jsonl',
+  'memory.jsonl.1',
+  'device.json',
+  'device.key',
+  'fleet-memory.md',
+  'ledger.jsonl',
+  'manifest.json',
+  '.env',
+  'id_rsa',
+  'id_ed25519',
+]);
+
+/**
+ * Whether a path is protected.
+ *
+ * @param {string} pathname
+ * @param {string} root the directory the path is interpreted against
+ * @returns {{protected: boolean, reason: string|null}}
+ */
+export function isProtected(pathname, root) {
+  const base = String(pathname).split(/[/\\]/).pop() ?? '';
+  if (PROTECTED_NAMES.includes(base)) return { protected: true, reason: `"${base}" is irreplaceable and is never a cleanup target` };
+  const rel = resolve(root, pathname).slice(resolve(root).length).replace(/^[/\\]+/, '');
+  const first = rel.split(/[/\\]/)[0];
+  if (PROTECTED_PREFIXES.includes(first)) return { protected: true, reason: `"${first}/" is part of the tree or the data directory` };
+  return { protected: false, reason: null };
+}
+
+/**
+ * How a file should be dealt with, which is not always "delete it".
+ *
+ * `truncate` exists because of the 2026-10-14 recovery: removing a file a daemon still holds open frees
+ * nothing, and the operation appears to succeed. For any log a process writes, truncation is the correct
+ * method and removal is the wrong one.
+ */
+export const METHOD = Object.freeze({
+  TRUNCATE: 'truncate',
+  REMOVE: 'remove',
+  ROTATE: 'rotate',
+  REPORT_ONLY: 'report_only',
+});
+
+/** Normalise a path for matching: one separator, no trailing separator. */
+const normalise = (pathname) => String(pathname).replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase();
+
+/** True when `segment` appears as a whole path segment, so `/x/dist` and `/x/dist/a` both match `dist`. */
+function hasSegment(pathname, segment) {
+  return normalise(pathname).split('/').includes(segment);
+}
+
+/**
+ * Which method suits a path.
+ *
+ * A `*.log` (or `relay-test`, or a path under a `log` directory) is being written by something, so it is
+ * truncated or rotated. A build artefact is not being written, so it is removed outright.
+ *
+ * Matching is on **whole path segments** rather than on substrings. The first version looked for `/dist/` and
+ * `\dist\`, which failed for the directory itself — `/x/dist` has no trailing separator — so the single most
+ * obvious cleanup target of all was classified `report_only`. Two tests caught it, one of them written for a
+ * different purpose.
+ */
+export function methodFor(pathname) {
+  const p = normalise(pathname);
+  if (p.endsWith('.log') || p.endsWith('.err') || p.includes('relay-test') || hasSegment(p, 'log') || hasSegment(p, 'logs')) {
+    return METHOD.TRUNCATE;
+  }
+  if (hasSegment(p, 'node_modules') || hasSegment(p, 'dist') || hasSegment(p, 'target') || hasSegment(p, 'build')) {
+    return METHOD.REMOVE;
+  }
+  if (p.endsWith('.tmp') || hasSegment(p, 'tmp') || hasSegment(p, 'temp')) return METHOD.REMOVE;
+  return METHOD.REPORT_ONLY;
+}
+
+/** Classify a cleanup target so a caller can prefer rebuildable things over anything unique. */
+export function classFor(pathname) {
+  const p = normalise(pathname);
+  if (hasSegment(p, 'node_modules') || hasSegment(p, 'dist') || hasSegment(p, 'target') || hasSegment(p, 'build')) return 'rebuildable';
+  if (p.endsWith('.log') || hasSegment(p, 'log') || hasSegment(p, 'logs') || p.includes('relay-test') || p.endsWith('.tmp')) return 'disposable';
+  return 'unknown';
+}
+
+/**
+ * Sample the size of every file under a path, recursively.
+ *
+ * Bounded by `maxFiles` on purpose. The first version of the health check walked a user's home directory and
+ * made a health check that **timed out** — a monitoring tool too expensive to monitor. The same limit applies
+ * here for the same reason, and `truncated: true` says so rather than reporting a partial scan as complete.
+ *
+ * @returns {Map<string, number>} absolute path -> bytes
+ */
+export function snapshot(root, { maxFiles = 20000 } = {}) {
+  const sizes = new Map();
+  if (!existsSync(root)) return sizes;
+  const stack = [resolve(root)];
+  let seen = 0;
+  while (stack.length > 0 && seen < maxFiles) {
+    const dir = stack.pop();
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { continue; }
+    for (const entry of entries) {
+      if (seen >= maxFiles) break;
+      const full = resolve(dir, entry.name);
+      if (entry.isDirectory()) stack.push(full);
+      else if (entry.isFile()) {
+        seen += 1;
+        try { sizes.set(full, statSync(full).size); } catch { sizes.set(full, -1); }
+      }
+    }
+  }
+  return sizes;
+}
+
+/**
+ * Compare two snapshots and report what grew.
+ *
+ * `elapsedMs` comes from the caller as the difference between the two sample times, not from file
+ * modification times: `mtime` is rewritten by a rotation, a copy, or a `touch`, and a rate computed from it
+ * would be a rate of the last *touch* rather than of the writing.
+ *
+ * @param {Map<string, number>} before
+ * @param {Map<string, number>} after
+ * @param {number} elapsedMs
+ */
+export function growth(before, after, elapsedMs, { warnBytesPerDay = RATE_WARN_BYTES_PER_DAY } = {}) {
+  if (!Number.isFinite(elapsedMs) || elapsedMs <= 0) return { findings: [], elapsed_ms: elapsedMs, unreadable: true };
+  const perDay = (bytes) => Math.round((bytes / elapsedMs) * 86_400_000);
+  const findings = [];
+  for (const [path, size] of after) {
+    const previous = before.get(path) ?? 0;
+    const delta = size - previous;
+    if (delta <= 0) continue;
+    const rate = perDay(delta);
+    if (rate < warnBytesPerDay) continue;
+    findings.push({
+      path,
+      grew_bytes: delta,
+      from_bytes: previous,
+      to_bytes: size,
+      bytes_per_day: rate,
+      // A file that did not exist before is a new writer, which is a different diagnosis from one that was
+      // always there and has started accelerating.
+      new_file: previous === 0,
+    });
+  }
+  findings.sort((a, b) => b.bytes_per_day - a.bytes_per_day);
+  return { findings, elapsed_ms: elapsedMs, unreadable: false };
+}
+
+/**
+ * Turn findings and sizes into proposals.
+ *
+ * Returns `{ proposals, protected, notes }`. A protected path that was found is listed under `protected`
+ * **with its reason**, rather than dropped: a report that silently omits the database is one a reader cannot
+ * tell from a report where the database was not found.
+ */
+export function plan({ root, sizes = new Map(), grown = [], fileWarn = FILE_WARN_BYTES, fileCritical = FILE_CRITICAL_BYTES } = {}) {
+  const proposals = [];
+  const protected_ = [];
+
+  const consider = (pathname, reason, severity, bytes) => {
+    const guard = isProtected(pathname, root ?? process.cwd());
+    if (guard.protected) {
+      protected_.push({ path: pathname, bytes, reason: guard.reason, triggered_by: reason });
+      return;
+    }
+    proposals.push({
+      path: pathname,
+      bytes,
+      severity,
+      triggered_by: reason,
+      method: methodFor(pathname),
+      class: classFor(pathname),
+    });
+  };
+
+  for (const [path, size] of sizes) {
+    if (size < 0) continue;
+    if (size >= fileCritical) consider(path, 'absolute', 'critical', size);
+    else if (size >= fileWarn) consider(path, 'absolute', 'warn', size);
+  }
+  for (const g of grown) {
+    consider(g.path, 'rate', g.bytes_per_day >= 10 * GB ? 'critical' : 'warn', g.to_bytes);
+  }
+
+  // Critical first, then by size: a caller working through the list top-down should reach the incident
+  // before the tidying.
+  proposals.sort((a, b) => (a.severity === b.severity ? b.bytes - a.bytes : a.severity === 'critical' ? -1 : 1));
+  return { proposals, protected: protected_, notes: [] };
+}
+
+/**
+ * A `logrotate` configuration for the files that need one.
+ *
+ * `copytruncate` is the important directive and it is not a default: without it, rotation renames the file
+ * and the daemon keeps writing to the old descriptor, so the new file stays empty **and the disk stays
+ * full** — the exact failure of 2026-10-14 in a different costume. `copytruncate` copies then truncates in
+ * place, which works for a process nobody is going to signal.
+ *
+ * `maxsize` is set as well as `daily`, because a file that grows 40x in a day reaches its limit long before
+ * the daily job looks at it.
+ */
+export function logrotateConfig(paths, options = {}) {
+  const maxsize = options.maxsize ?? '256M';
+  const rotate = options.rotate ?? 5;
+  const frequency = options.frequency ?? 'daily';
+  const header = [
+    '# Generated by scripts/log-bounds.mjs --bounds.',
+    '# copytruncate, not create: a daemon holding the old descriptor keeps the disk full otherwise.',
+    '# maxsize as well as the schedule: a file growing 40x a day hits its cap before the timer notices.',
+    '',
+  ].join('\n');
+  const body = paths.map((p) => [
+    `${p} {`,
+    `  ${frequency}`,
+    `  maxsize ${maxsize}`,
+    '  rotate ' + rotate,
+    '  compress',
+    '  delaycompress',
+    '  missingok',
+    '  notifempty',
+    '  copytruncate',
+    '}',
+    '',
+  ].join('\n')).join('\n');
+  return header + body;
+}
+
+/**
+ * Delete or truncate a single path, refusing anything protected.
+ *
+ * The only acting function here, and it re-checks the guard rather than trusting the caller's plan: a plan is
+ * data that may have been filtered, sorted, serialised or hand-edited between being made and being applied.
+ *
+ * @returns {{ok: boolean, method: string, detail: string}}
+ */
+export function apply(pathname, root, { truncate } = {}) {
+  const guard = isProtected(pathname, root);
+  if (guard.protected) return { ok: false, method: METHOD.REPORT_ONLY, detail: `refused: ${guard.reason}` };
+  const method = methodFor(pathname);
+  if (method === METHOD.REPORT_ONLY) {
+    return { ok: false, method, detail: 'not a log, a build artefact or a temp file; reported rather than acted on' };
+  }
+  if (typeof truncate !== 'function') return { ok: false, method, detail: 'no truncate function supplied; refusing to act without one' };
+  try {
+    return { ok: true, method, detail: truncate(pathname, method) };
+  } catch (e) {
+    return { ok: false, method, detail: `failed: ${e.message}` };
+  }
+}

package/src/plugin/tools.mjs

@@ -185,7 +185,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '0.10.5';
+const PLUGIN_VERSION = '0.12.0';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;