@twinsearth/w2m-dsh-plugin 0.15.0 → 0.16.0

package/CHANGELOG.md

@@ -4,6 +4,52 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.16.0] — 2026-10-15
+
+**A non-zero exit code is not a fleet failure, and this session conflated them repeatedly.**
+
+Twelve real task reports were fetched one request at a time — the only correct input, since `w2m_history`
+records current lease state rather than outcomes — and the measured result was **12 acting leases, 12 `done`,
+0 expired, 0 refused**. Yet several runs in the same session produced no result at all. Both facts are true.
+
+They are different failures, and the difference decides where a reader looks:
+
+| Observation | What it means | Where the fault is |
+|---|---|---|
+| `exit_code: 70`, `lease_state: done` | **The command ran and reported 70.** The fleet worked. | the command |
+| `exit_code: null`, `lease_state: expired` | **No result was ever produced.** | the machine, the lease, or the network |
+
+`classifyLease()` and `isFleetFailure()` now encode that distinction, and **`exit_code` is the decisive field,
+not the lease state** — a lease can be `done` while its command returned non-zero, which is a *successful
+execution of a failing command*. `isFleetFailure` returns true only for the no-result case; a refusal is the
+request being wrong, and an observer was never asked to act.
+
+A rate that merged the two would report a healthy fleet as broken, or a broken one as healthy, depending on
+which it happened to count.
+
+### The measured fleet, this round
+
+| Measure | Value | Note |
+|---|---|---|
+| acting leases | 12 of 12 | a bounded sample, fetched per task |
+| expiry rate | **0.0 %** | 0 expired in the sample |
+| refusal rate | **0.0 %** | 0 refused |
+| direct share | **0.0 %** | **every task went by relay** |
+| P2P delivery rate | **0.0 %** | no direct channel was ever established |
+| fleet size | **3 usable of 5 paired** | two `win-desktop` silent ≈ 17.2 h |
+
+**The 0 % direct share is the finding worth acting on**: not one task in the sample used a direct path, so the
+entire fleet has been running on the relay at RTT **354 ms** (macmini) and **336 ms** (ToFuture) where
+jp-shared answers in **20 ms**.
+
+### Still not fixed
+
+The two relay endpoints still disagree about whether the silent machines are online — `reconcile()` detects it
+and says which to trust, but the disagreement itself needs a change on the relay, and this session has no shell
+on that host.
+
+**24 tests, 0 failures.**
+
 ## [0.15.0] — 2026-10-15
 
 **The fleet is three machines, not five — and two relay endpoints disagree about it.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",

package/src/agent/fleet-scale.mjs

@@ -48,6 +48,69 @@ export const FAILURE_STATES = Object.freeze(['expired', 'timeout']);
 /** Outcomes that are not the fleet's fault, so they are counted separately. */
 export const REQUEST_FAULT_STATES = Object.freeze(['refused']);
 
+/**
+ * How a lease ended, told apart properly.
+ *
+ * ## The conflation this exists to prevent
+ *
+ * This session repeatedly read `exit_code: 70` as a failure and `lease_state: expired` as the same kind of
+ * failure. **They are not the same kind of thing at all**, and the difference decides where a reader looks:
+ *
+ *   * `exit_code: 70` with `lease_state: done` means **the command ran and reported 70**. The fleet worked.
+ *     The number is the command's answer, and the machine is fine.
+ *   * `exit_code: null` with `lease_state: expired` means **no result was ever produced**. The command may not
+ *     have started. Nothing is known about what it did, and the machine — or the lease, or the network — is
+ *     where the fault is.
+ *
+ * Measured: twelve consecutive real reports showed **12 acting leases, 12 `done`, 0 expired** — while several
+ * runs in the same session had produced no result at all. Both facts are true; they are different failures.
+ * A rate that merged them would report a healthy fleet as broken, or a broken one as healthy, depending on
+ * which it happened to count.
+ */
+export const LEASE_OUTCOME = Object.freeze({
+  RAN: 'ran',                 // a result was produced, whatever it said
+  NO_RESULT: 'no_result',     // nothing came back; the command's behaviour is unknown
+  REFUSED: 'refused',         // the allow-list rejected it before it could run
+  OBSERVED_ONLY: 'observed',  // the machine was told the outcome without being asked to act
+  UNKNOWN: 'unknown',
+});
+
+/**
+ * Classify one machine entry from a task report.
+ *
+ * `exit_code` is the decisive field, **not** the lease state: a lease can be `done` while its command
+ * returned non-zero, and that is a successful execution of a failing command.
+ */
+export function classifyLease(entry) {
+  if (entry === null || typeof entry !== 'object') return { outcome: LEASE_OUTCOME.UNKNOWN, ran: false, exit_code: null, detail: 'no machine entry' };
+  const state = String(entry.lease_state ?? entry.outcome ?? '');
+  const code = entry.exit_code;
+  if (state === 'observing') return { outcome: LEASE_OUTCOME.OBSERVED_ONLY, ran: false, exit_code: null, detail: 'told the outcome, not asked to act' };
+  if (state === 'refused') return { outcome: LEASE_OUTCOME.REFUSED, ran: false, exit_code: null, detail: entry.refusal_reason ?? 'refused' };
+  if (state === 'done') {
+    return {
+      outcome: LEASE_OUTCOME.RAN,
+      ran: true,
+      exit_code: Number.isFinite(code) ? code : null,
+      detail: Number.isFinite(code) && code !== 0
+        ? `ran and reported ${code} -- the command's answer, not a fleet failure`
+        : 'ran and reported success',
+    };
+  }
+  if (state === 'expired' || state === 'timeout') {
+    return { outcome: LEASE_OUTCOME.NO_RESULT, ran: false, exit_code: null, detail: 'no result was produced; what the command did is unknown' };
+  }
+  return { outcome: LEASE_OUTCOME.UNKNOWN, ran: false, exit_code: null, detail: `unrecognised lease state ${JSON.stringify(state)}` };
+}
+
+/**
+ * Whether a non-zero exit code is a fleet failure. It is not, and this function exists so a caller does not
+ * have to decide that for itself each time.
+ */
+export function isFleetFailure(entry) {
+  return classifyLease(entry).outcome === LEASE_OUTCOME.NO_RESULT;
+}
+
 /**
  * Summarise a set of task reports.
  *

package/src/plugin/tools.mjs

@@ -185,7 +185,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '0.15.0';
+const PLUGIN_VERSION = '0.16.0';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;