@twinsearth/w2m-dsh-plugin 0.35.0 → 0.37.0

package/CHANGELOG.md

@@ -4,6 +4,97 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.37.0] — 2026-10-15
+
+**`council.mjs` is wired. v4.10.0's committee governance is reachable, and its dissent arrives with its decision.**
+
+0.36.0's reachability classification found `src/agent/council.mjs` as a **closed loop** — 275 lines with three
+falsifying tests asserted by name, imported by **nothing but its own suite.** This is the eleventh tool and the
+fix for the third module of that shape.
+
+### Why the state lives outside the call
+
+A council walks **seven phases across many calls**: `convene → frame → deliberate → vote → decide → record →
+adjourn`. One that lived inside a single invocation **could never finish**, and the failure would look like
+"the phases are wrong" rather than "the state was thrown away". `createCouncilSessions` holds it — the same
+lesson the approval queue and the P2P runtime taught, applied a third time.
+
+Two kinds of state, deliberately capped differently:
+
+* a **live** council is scratch space. Losing one costs the work of returning to that phase, so the cap is
+  generous (64) and eviction is **oldest-first**, so a reader can say which survives without reading code.
+* a **decided** council is the artifact. `ROADMAP.md`'s third falsifying test is that *"a decision with
+  recorded dissent is retrievable with the dissent"* — and **retrievable means after the council that produced
+  it is gone.** So the decided cap is larger (256) and decisions outlive live eviction. Tested.
+
+### One tool with an action, not seven tools
+
+The seven phases are **a state machine over one object** and the machine already refuses an operation in the
+wrong phase by name. Seven tools would let a model call the wrong one and learn the order from errors; one
+tool reports `phase` and the whole `phases` list on **every** call, so the legal next move is visible rather
+than inferred. A `CouncilRefusal` comes back as a **value** — `ok: false` with the phase and the list — not as
+a throw, for the same reason.
+
+**A tie is refused, not broken**, and the tool does not paper over it: a split council is the one case where
+the council exists to escalate to a person.
+
+Every read of a decision returns the **dissent with its reasons** and a **`recount`**, so the seal never has
+to be taken on trust.
+
+### My own error, and the fix is a pattern rather than a correction
+
+My test helper reached the `deliberate` phase by **counting advances**, got the count wrong by one, and failed
+with a `WRONG_PHASE` refusal that **read like a defect in the module**. Measured order:
+`convene → frame → deliberate → …`, so `argue` needs **two** advances and not one. The helper now **names its
+destination** — `advanceTo(council, 'deliberate')` — because **one that counts steps drifts silently when the
+phase list grows, and one that names a destination cannot.**
+
+28 tool-count assertions updated across nine files, the whole set that has caught this every time.
+
+**13 new tests, 0 failures.**
+
+## [0.36.0] — 2026-10-15
+
+**The classification found a third closed loop — and it is `council.mjs`, which `ROADMAP.md` marks shipped.**
+
+### What the classifier does that a regex cannot
+
+468 findings against this repository, and the one real defect in them was invisible. Refining the pattern
+cannot fix that: **the information is not in the name, it is in the shape of the import graph.**
+
+The shape that identified the two known defects was — **one export, one importer, and that importer is the
+test named after the module.** That is not a heuristic about naming; it is a statement about the graph: **a
+module whose only importer is its own suite exists in a closed loop, and nothing in the program reaches it.**
+The name is used only to decide whether the loop is *closed*.
+
+Against this repository: **316 `sibling-imported`, 91 `closed-loop`, 61 `same-module`.**
+
+**91 is not a defect count and the classifier says so**, in three tests that pin its own limits rather than
+commenting on them: it cannot see a **dynamic import** (`await import('./x.mjs')` names no binding), and it
+cannot see a module reached only because a **CLI entry point spawns it** — which is every file in `scripts/`,
+and is why that number is large.
+
+### `v4.10.0`'s council is BUILT, NOT ROUTED
+
+`src/agent/council.mjs` is a closed loop: **275 lines implementing committee governance, imported by nothing
+but its own suite.** `ROADMAP.md` marks v4.10.0 *shipped in 0.11.0*, and 0.30.0 verified its three falsifying
+tests are asserted by name — **which they are.** What was never checked is whether anything routes a question
+to it. **Same defect as `field-authority` and `approval-gate`, in a third module**, and the one the
+reachability work existed to find. Recorded as **built, not routed**, and routing it needs a tool surface and
+a session rather than a line of code.
+
+### A duplicated limit, found by reading the file to check the first finding
+
+`council.mjs` declared its own `export const AUTHORITY_MAX = 100` instead of importing the bound from
+`authority.mjs`. **Two copies of a limit that nothing can keep in step, and the failure is silent**: raise the
+real maximum and this module keeps refusing `101` while naming the wrong number as authoritative. It now
+imports it, and `AUTHORITY_MAX` has exactly one literal definition in `src/`.
+
+**Reading the file to check the wiring finding is how the constant surfaced** — the argument for investigating
+a report rather than counting it.
+
+**10 new tests, 0 failures.**
+
 ## [0.35.0] — 2026-10-15
 
 **§1.5 measured at last: the reachability report, and the honest reason it is not a gate.**

package/README.md

@@ -39,7 +39,7 @@ So the cross-machine capability has to be built. This is that build.
                        ▼
    ┌──────────────────────────────────┐        ┌──────────────────────────┐
    │  Windows · DSH session           │        │  macOS · DSH session     │
-   │   w2m plugin (10 tools)          │        │   w2m plugin (10 tools)  │
+   │   w2m plugin (11 tools)          │        │   w2m plugin (11 tools)  │
    │        │                         │        │        │                 │
    │   Localside agent                │        │   Localside agent        │
    │    · three anchors               │        │    · three anchors       │
@@ -293,16 +293,16 @@ Then give it the relay URL in that profile's `cordis.patch.yml` — or leave
 >        got "@twinsearth/w2m-dsh-plugin/tools"), skipping
 > ```
 >
-> That is a silent failure by construction — the install looks right, ten tools appear, and
+> That is a silent failure by construction — the install looks right, eleven tools appear, and
 > `w2m_status` reports `paired: false` and a null `rabbitUrl` because none of your values were ever
 > applied. It is not hypothetical: this row's expected name moved from the `/tools` subpath to the
 > package root in v0.5.4 (see `cordis.patch.yml`'s header for why), and every override that still
 > asserted the old subpath stopped being applied on upgrade. `id` already identifies the row, so the
 > safest `name:` is no `name:` at all.
 
-Restart DSH. You should see ten tools: `w2m_devices`, `w2m_run`, `w2m_wait`,
+Restart DSH. You should see eleven tools: `w2m_devices`, `w2m_run`, `w2m_wait`,
 `w2m_report`, `w2m_status`, `w2m_update`, `w2m_history`, `w2m_stats`, `w2m_memory`,
-`w2m_approvals`.
+`w2m_approvals`, `w2m_council`.
 
 > `dsh` may not be on your `PATH`. On a packaged install it lives under
 > `resources/runtime/cli/bin/`. If `dsh` is not found, call it by path.
@@ -585,7 +585,7 @@ a product.
 |---|---|---|
 | relay | 142 | pairing, auth, SSE with `ready`-first and `seq` replay, leases with heartbeat renewal and expiry, dedupe, all **nine** aggregation states plus `pending`/`refused`, report generation, operator token, rate limiting, persistence and restart recovery, TLS, and the lost-offer recovery path |
 | agent | 129 | allow-list allow/deny, timeout, output truncation, exit codes, anchors on clean and dirty trees, four concurrent fingerprint computations, spool, a 40-case URL join matrix, cursor lifecycle across relay restarts, and the bundled-runtime resolver |
-| tools | 89 | ten tools registered, schemas, typed errors, polling, operator-token enforcement (no request is sent without it), sub-path endpoints, and the credential canaries |
+| tools | 89 | eleven tools registered, schemas, typed errors, polling, operator-token enforcement (no request is sent without it), sub-path endpoints, and the credential canaries |
 | broadcast | 19 | exactly one executor, the rest `observing`; observers excluded from every aggregation step so a machine that did not run is never counted as agreeing |
 | claims | 19 | the document claims themselves: the version, the bundle patch, the tool list, every documented tarball URL, and the CHANGELOG's shape |
 | fleet-target | 37 | the composer's target selection, and the `executor_machine_id` narrowing that overrides it |
@@ -713,7 +713,7 @@ the plugin:
 
 ```bash
 node scripts/check-entrypoints.mjs   # imports lib/tools.js, the exact specifier cordis.patch.yml mounts
-node scripts/verify-installed.mjs <path-to-installed-package>   # asserts the installed copy registers 10 tools
+node scripts/verify-installed.mjs <path-to-installed-package>   # asserts the installed copy registers 11 tools
 ```
 
 **Not verified:**

package/docs/1.0.0-ACCEPTANCE.md

@@ -18,7 +18,7 @@ but has no caller, that is stated in its own column rather than hidden behind a
 | 1.2 | Every dependency edge is declared, and every declared edge is used | `scripts/layer-check.mjs` | **yes** |
 | 1.3 | Every suite on disk is named by a script | pre-flight `test wiring`, `claims` | **yes** — reported, not silently ignored |
 | 1.4 | Every document's claim about the artifact matches the artifact | `test/claims.test.mjs` | **yes** — 48 claims, and it has caught real drift |
-| 1.5 | No module is unreachable — every declared thing has a caller | `scripts/reachability-check.mjs` | **MEASURED, not enforced — see below** |
+| 1.5 | No module is unreachable — every declared thing has a caller | `scripts/reachability-check.mjs`, `reachability-classify.mjs` | **MEASURED, not enforced — see below** |
 
 `1.5` is the row that mattered most and the one that went unsatisfied longest. This span shipped three
 mechanisms that were, for a round each, fully tested and completely uncalled: `field-authority.mjs`,
@@ -49,6 +49,36 @@ reliable for — including the false positive that broke the first version, `dee
 **So `1.5` is measured, not closed.** A defect of this class is now *visible*; it is not *prevented*, and
 nothing in the pre-flight fails when one appears.
 
+### What the classification found, and what it reported about itself
+
+`reachability-classify.mjs` sorts the findings by **the shape of the import graph** rather than by name. The
+shape that identified the two known defects was: **one export, one importer, and that importer is the test
+named after the module** — a closed loop, where nothing in the program reaches the code.
+
+Against this repository: **468 findings, 316 `sibling-imported`, 91 `closed-loop`, 61 `same-module`.**
+
+**The 91 is not a defect count, and the classifier says so in three pinned tests.** It cannot see a
+**dynamic import** (`await import('./x.mjs')` names no binding) and it cannot see a module reached only because
+a **CLI entry point spawns it** — which is every file in `scripts/`, and is why that number is large. Both
+limits are asserted rather than commented, because a classifier whose limits are undocumented gets trusted
+past them.
+
+**Investigating one finding by hand found a real defect that the count had buried**: `src/agent/council.mjs`
+declared its own `export const AUTHORITY_MAX = 100` instead of importing the bound from `authority.mjs`.
+**Two copies of a limit that nothing can keep in step, failing silently** — raise the real maximum and this
+module keeps refusing `101` while naming the wrong number as authoritative. It now imports it.
+
+### `v4.10.0`'s council is built and not routed — found here, not claimed before
+
+`reachability-classify` reported `src/agent/council.mjs` as a closed loop, and reading it to check that
+confirmed the finding: **275 lines implementing committee governance, imported by nothing but its own suite.**
+`v4.10.0` is marked *shipped in 0.11.0* in `ROADMAP.md`, and **0.30.0 verified its three falsifying tests are
+asserted by name** — which they are. **What was never checked is whether anything routes a question to it.**
+
+**This is the same defect as `field-authority` and `approval-gate`, in a third module**, and it is the one the
+reachability work was built to find. It is recorded here as **BUILT, NOT ROUTED** rather than described as
+delivered, and routing it needs a tool surface and a session — not a line of code.
+
 ---
 
 ## 2. 分层级 — layers, with a direction

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",
@@ -113,13 +113,13 @@
     }
   },
   "scripts": {
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
     "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs",
     "test:relay": "node --test --test-force-exit test/relay.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
     "test:tools": "node --test --test-force-exit test/tools.test.mjs",
     "test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
     "pack": "node scripts/pack.mjs",
     "verify:join": "node scripts/verify-join.mjs",
     "lint": "eslint .",
@@ -151,7 +151,9 @@
     "test:approval-gate": "node --test --test-force-exit test/approval-gate.test.mjs",
     "test:authority-choice": "node --test --test-force-exit test/authority-choice.test.mjs",
     "test:reachability": "node --test --test-force-exit test/reachability-check.test.mjs",
-    "reachability": "node scripts/reachability-check.mjs"
+    "reachability": "node scripts/reachability-check.mjs",
+    "reachability:classify": "node scripts/reachability-classify.mjs",
+    "test:council-session": "node --test --test-force-exit test/council-session.test.mjs"
   },
   "keywords": [
     "dsh-bundle",

package/src/agent/council-session.mjs

@@ -0,0 +1,139 @@
+/**
+ * Live councils, and the decisions they finish — the part that must outlive a single tool call.
+ *
+ * ## Why this exists as a separate module
+ *
+ * A council runs through **seven phases across many calls**: someone convenes it, people assign roles, argue,
+ * vote, and only then is an outcome fixed and sealed. A `convene()` that lived and died inside one tool
+ * invocation would be a state machine nobody could ever finish, and the failure would look like "the phases
+ * are wrong" rather than "the state was thrown away".
+ *
+ * This is the same lesson `tools.mjs` learned about the approval queue and the P2P runtime: **something that
+ * must outlive a single call belongs to something other than the call.**
+ *
+ * ## Why decided councils are kept when live ones are dropped
+ *
+ * The two are different kinds of thing:
+ *
+ *   * a **live** council is scratch space. Losing one costs the work of getting back to that phase, and that
+ *     is a real cost, so the cap is generous;
+ *   * a **decided** council is the artifact. `ROADMAP.md`'s third falsifying test for v4.10.0 is that *"a
+ *     decision with recorded dissent is retrievable with the dissent"* — and **retrievable means after the
+ *     council that produced it is gone.** So a sealed decision is what gets evicted last.
+ *
+ * ## What the caps are for
+ *
+ * Neither map is bounded by anything but a number here, and a long-running process that convenes councils
+ * fills memory. The caps are **stated and tested** rather than discovered, and eviction is **oldest-first** so
+ * the behaviour is predictable: a reader can say which council survives without reading the implementation.
+ */
+import { PHASES, ROLES, convene, recount } from './council.mjs';
+
+/** How many unfinished councils are held. Generous, because losing one costs redoing the phases. */
+export const MAX_LIVE_COUNCILS = 64;
+
+/** How many decided councils are held. Larger, because these are the artifact rather than the workspace. */
+export const MAX_DECIDED_COUNCILS = 256;
+
+/** Why a session operation was refused. */
+export const SESSION_REFUSAL = Object.freeze({
+  NO_ID: 'COUNCIL_SESSION_NO_ID',
+  NOT_FOUND: 'COUNCIL_SESSION_NOT_FOUND',
+  NOT_DECIDED: 'COUNCIL_SESSION_NOT_DECIDED',
+  ALREADY_EXISTS: 'COUNCIL_SESSION_ALREADY_EXISTS',
+});
+
+/**
+ * @param {{maxLive?: number, maxDecided?: number}} [options]
+ */
+export function createCouncilSessions(options = {}) {
+  const maxLive = Number.isInteger(options.maxLive) ? options.maxLive : MAX_LIVE_COUNCILS;
+  const maxDecided = Number.isInteger(options.maxDecided) ? options.maxDecided : MAX_DECIDED_COUNCILS;
+
+  /** Insertion-ordered, so "oldest" is the first key — eviction needs no timestamps to be predictable. */
+  const live = new Map();
+  const decided = new Map();
+
+  const requireId = (id) => typeof id === 'string' && id.trim() !== '';
+
+  /**
+   * Open a council under an id.
+   *
+   * The id is **required from the caller** rather than generated here, for the reason `raiseApproval` gives:
+   * an id invented at this layer could not be correlated with whoever is waiting to use it.
+   */
+  function open(id, { question, participants = [], now } = {}) {
+    if (!requireId(id)) {
+      return { ok: false, reason_code: SESSION_REFUSAL.NO_ID, detail: 'opening a council needs an id the caller chose, so it can be addressed later' };
+    }
+    if (live.has(id) || decided.has(id)) {
+      // Refused rather than replaced: silently discarding a council mid-phase would look like the phases had
+      // reset, which is the most misleading possible symptom.
+      return { ok: false, reason_code: SESSION_REFUSAL.ALREADY_EXISTS, detail: `a council is already open under ${JSON.stringify(id)}; choose another id or adjourn it first` };
+    }
+    const council = convene({ question, participants, ...(typeof now === 'function' ? { now } : {}) });
+    live.set(id, council);
+    while (live.size > maxLive) live.delete(live.keys().next().value);
+    return { ok: true, id, phase: council.phase, phases: council.phases, roles: [...ROLES], detail: `opened at "${council.phase}"` };
+  }
+
+  /** The live council under an id, or a refusal naming what is missing. */
+  function get(id) {
+    if (!requireId(id)) return { ok: false, reason_code: SESSION_REFUSAL.NO_ID, detail: 'a council id is required' };
+    const council = live.get(id) ?? null;
+    if (council === null) {
+      const wasDecided = decided.has(id);
+      return {
+        ok: false,
+        reason_code: wasDecided ? SESSION_REFUSAL.NOT_DECIDED : SESSION_REFUSAL.NOT_FOUND,
+        detail: wasDecided
+          ? `${JSON.stringify(id)} has already been decided and sealed, so it cannot be advanced; read it with action="decision"`
+          : `no live council under ${JSON.stringify(id)}`,
+      };
+    }
+    return { ok: true, id, council };
+  }
+
+  /**
+   * Seal a council and move it from live to decided.
+   *
+   * Called after `record()`. The council object stays the same; only which map holds it changes, and that is
+   * the whole point — **a decided council must remain readable after it stops being advanceable.**
+   */
+  function seal(id) {
+    const found = get(id);
+    if (!found.ok) return found;
+    const decision = found.council.decision;
+    if (decision === null || decision === undefined) {
+      return { ok: false, reason_code: SESSION_REFUSAL.NOT_DECIDED, detail: 'the council has no decision to seal; decide() must run first' };
+    }
+    live.delete(id);
+    decided.set(id, { decision, sealed_at: new Date().toISOString() });
+    while (decided.size > maxDecided) decided.delete(decided.keys().next().value);
+    return { ok: true, id, decision };
+  }
+
+  /** A decided council, with its dissent, and whether its outcome reproduces from its own stored ballots. */
+  function decision(id) {
+    if (!requireId(id)) return { ok: false, reason_code: SESSION_REFUSAL.NO_ID, detail: 'a council id is required' };
+    const held = decided.get(id);
+    if (held === undefined) {
+      return {
+        ok: false,
+        reason_code: live.has(id) ? SESSION_REFUSAL.NOT_DECIDED : SESSION_REFUSAL.NOT_FOUND,
+        detail: live.has(id) ? `${JSON.stringify(id)} is still open, so nothing is decided yet` : `no decided council under ${JSON.stringify(id)}`,
+      };
+    }
+    // `recount` is what makes "weights are reproducible" checkable rather than asserted: it recomputes from
+    // the stored ballots and reports agreement. Returning it WITH the decision means a reader never has to
+    // take the seal on trust.
+    return { ok: true, id, ...held, recount: recount(held.decision) };
+  }
+
+  /** Ids held, oldest first, for a caller that wants to know what is here without listing contents. */
+  function ids() {
+    return { live: [...live.keys()], decided: [...decided.keys()] };
+  }
+
+  return { open, get, seal, decision, ids, maxLive, maxDecided, phaseNames: [...PHASES] };
+}

package/src/agent/council.mjs

@@ -75,8 +75,25 @@ export class CouncilRefusal extends Error {
   }
 }
 
-/** Authority bands, taken from v4.7.0: 0-49 ordinary, 50-69 captain, 70-89 org admin, 90+ system admin. */
-export const AUTHORITY_MAX = 100;
+/**
+ * Authority bands, taken from v4.7.0: 0-49 ordinary, 50-69 captain, 70-89 org admin, 90+ system admin.
+ *
+ * ## This was a SECOND copy of a number that already existed, and the reachability check is what found it
+ *
+ * It read `export const AUTHORITY_MAX = 100;` — a literal, redeclared here. `src/agent/authority.mjs` owns
+ * that bound and the bands it belongs to, and `AUTHORITY_BAND_FLOORS` is derived from them precisely so a new
+ * band cannot leave a stale copy behind. A second literal cannot be kept in step by anything, and **the
+ * failure it produces is silent**: raise the real maximum to 120 and this module keeps refusing 101, with a
+ * message that names the wrong number as authoritative.
+ *
+ * Found by `scripts/reachability-classify.mjs`, which reported this file as a **closed loop** — a module whose
+ * only importer is the test named after it. That finding was about wiring, and the duplicated constant was
+ * sitting in the same file. **Reading the file to check the first finding is how the second one surfaced**,
+ * which is the argument for investigating a report rather than counting it.
+ */
+import { AUTHORITY_MAX } from './authority.mjs';
+
+export { AUTHORITY_MAX };
 
 /**
  * The weight of one participant, as a pure function of the two numbers on its ballot.

package/src/plugin/tools.mjs

@@ -131,6 +131,10 @@ import { gateDispatch, approvalRequestFor, raiseApproval } from '../agent/permis
 import { createApprovalIndex } from '../agent/approval-index.mjs';
 // v0.31.0: the approval queue's front door. Written in 0.30.0 and given a caller here.
 import { createApprovalGate } from '../agent/approval-gate.mjs';
+// v0.37.0: v4.10.0's council, reached at last. `reachability-classify.mjs` found it imported by nothing but
+// its own suite, and that is the defect this import fixes.
+import { PHASES, ROLES } from '../agent/council.mjs';
+import { createCouncilSessions } from '../agent/council-session.mjs';
 import { AUTHORITY_MAX, isAuthorityLevel } from '../agent/authority.mjs';
 // v0.33.0: the level is chosen by NAME rather than typed. `resolveConfiguredLevel` also accepts a plain
 // integer, because a profile patch written by an earlier version must keep loading.
@@ -198,7 +202,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '0.35.0';
+const PLUGIN_VERSION = '0.37.0';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -3331,6 +3335,19 @@ export async function apply(ctx, config = {}) {
     Number.isInteger(config.approvalRaiseLimitPerMinute) ? { limit: config.approvalRaiseLimitPerMinute } : {},
   );
 
+  /**
+   * v0.37.0: the council, reached at last.
+   *
+   * `src/agent/council.mjs` shipped in 0.11.0 as v4.10.0's committee governance — 275 lines with three
+   * falsifying tests asserted by name — and **nothing imported it.** `scripts/reachability-classify.mjs`
+   * reported it as a closed loop in 0.36.0, and that is what this fixes.
+   *
+   * `createCouncilSessions` holds the state, because a council runs through **seven phases across many
+   * calls**: one that lived inside a single invocation could never finish. That is the same lesson the
+   * approval queue and the P2P runtime taught, applied a third time.
+   */
+  const councilSessions = createCouncilSessions();
+
   // v0.6.1: the two browser routes behind the composer's target control. Additive and optional: a
   // host without `connection.fetch` still gets every tool, and `w2m_status` reports the absence  -   // which is the honest place for it, since a host that has no Connection at all is simply not a web
   // composition and does not need a warning on every headless run.
@@ -5389,6 +5406,150 @@ export async function apply(ctx, config = {}) {
       });
     },
   }));
+
+  /**
+   * v0.37.0: the eleventh tool -- a question put to a council, and the outcome read back with its dissent.
+   *
+   * ## Why one tool with an action rather than seven
+   *
+   * The seven phases are a **state machine over one object**, and the machine already refuses an operation in
+   * the wrong phase with a named refusal. Seven tools would let a model call the wrong one and have to learn
+   * the order from errors; one tool with an action can report `phase` and `phases` on every call, so the
+   * legal next move is visible rather than inferred.
+   *
+   * ## What it will not do
+   *
+   * It does not break a tie. `decide()` refuses one by name, because a split council is exactly the case a
+   * person must see -- and a tool that returned *some* outcome for a tie would hide the only situation where
+   * the council exists to escalate.
+   */
+  ctx.tools.register(defineTool({
+    name: 'w2m_council',
+    description:
+      'Put a question to a council of agents and read the outcome back WITH its dissent. A council walks seven ' +
+      'phases (' + PHASES.join(' -> ') + ') and every action reports the phase it is in and the whole phase list, so the ' +
+      'legal next move is visible rather than guessed. Roles are assigned during "convene", arguments are ' +
+      'recorded during "deliberate", votes during "vote", the outcome is fixed during "decide", and "record" ' +
+      'seals it. A TIE IS REFUSED, not broken: a split council is the case a person must see. Votes carry a ' +
+      'weight computed from the voter\'s authority and reputation, and that weight is reproducible from the ' +
+      'stored ballots, which every read reports.',
+    parameters: {
+      action: {
+        type: 'string',
+        enum: ['open', 'advance', 'assign', 'argue', 'vote', 'decide', 'record', 'state', 'decision', 'list'],
+        description: 'What to do. "open" starts a council, "state" reports one mid-flight, "decision" reads a sealed one back with its dissent.',
+        default: 'state',
+      },
+      council_id: {
+        type: 'string',
+        description: 'Which council. Required for everything except "list"; chosen by the caller so it can be addressed later.',
+      },
+      question: { type: 'string', description: 'What the council is deciding. Used by "open" only.' },
+      participant: { type: 'string', description: 'Who is acting. Used by assign, argue and vote.' },
+      role: { type: 'string', enum: [...ROLES], description: 'The hat being worn. Used by "assign" only.' },
+      stance: { type: 'string', enum: ['for', 'against'], description: 'Which side an argument takes. Used by "argue" only.' },
+      text: { type: 'string', description: 'The argument itself. Used by "argue" only.' },
+      authority: { type: 'number', description: 'The voter authority level, 0..100. Used by "vote"; the weight comes from this and reputation.' },
+      reputation: { type: 'number', description: 'The voter reputation. Used by "vote"; it can never overturn authority.' },
+      choice: { type: 'string', description: 'What the voter votes for. Used by "vote" only.' },
+      reason: { type: 'string', description: 'Why the voter chose it. Carried with the ballot and read back with the dissent.' },
+    },
+    output: jsonOutput,
+    presentCall: (args) => ({
+      card: 'generic',
+      title: `w2m council ${typeof args?.action === 'string' ? args.action : 'state'}`,
+      // Only actions that change the council are writes; reading one is not.
+      kind: ['open', 'advance', 'assign', 'argue', 'vote', 'decide', 'record'].includes(args?.action) ? 'write' : 'read',
+      rawInput: {},
+    }),
+    async execute(args, exec) {
+      throwIfAborted(exec?.signal);
+      const action = typeof args?.action === 'string' ? args.action : 'state';
+      const id = typeof args?.council_id === 'string' ? args.council_id : null;
+
+      if (action === 'list') {
+        return JSON.stringify({ ok: true, action, ...councilSessions.ids(), phases: PHASES, roles: [...ROLES] });
+      }
+      if (action === 'open') {
+        const opened = councilSessions.open(id, { question: typeof args?.question === 'string' ? args.question : '' });
+        return JSON.stringify({ ok: opened.ok, action, council_id: id, phase: opened.phase ?? null, phases: PHASES, roles: [...ROLES], reason_code: opened.reason_code ?? null, detail: opened.detail });
+      }
+      if (action === 'decision') {
+        const read = councilSessions.decision(id);
+        return JSON.stringify({
+          ok: read.ok,
+          action,
+          council_id: id,
+          reason_code: read.reason_code ?? null,
+          detail: read.detail ?? null,
+          decision: read.decision ?? null,
+          // A dissent without its reason is a number rather than a position, and a decision whose outcome does
+          // not reproduce from its own ballots is one nobody should act on. Both travel with every read.
+          dissent: read.decision?.dissent ?? null,
+          unanimous: read.decision?.unanimous ?? null,
+          recount: read.recount ?? null,
+        });
+      }
+
+      const found = councilSessions.get(id);
+      if (!found.ok) {
+        return JSON.stringify({ ok: false, action, council_id: id, reason_code: found.reason_code, detail: found.detail });
+      }
+      const council = found.council;
+
+      // Every mutation goes through the council's own refusals rather than a check here, so the phase rules
+      // live in exactly one place and a tool cannot disagree with the module about them.
+      try {
+        if (action === 'advance') {
+          const moved = council.advance();
+          return JSON.stringify({ ok: true, action, council_id: id, phase: moved.phase, phases: PHASES, moved: moved.moved, detail: moved.detail ?? null });
+        }
+        if (action === 'assign') {
+          const assigned = council.assign(args?.participant, args?.role);
+          return JSON.stringify({ ok: true, action, council_id: id, phase: council.phase, assigned });
+        }
+        if (action === 'argue') {
+          const recorded = council.argue({ participant: args?.participant, stance: args?.stance, text: args?.text });
+          return JSON.stringify({ ok: true, action, council_id: id, phase: council.phase, argument: recorded });
+        }
+        if (action === 'vote') {
+          const ballot = council.vote({ participant: args?.participant, authority: args?.authority, reputation: args?.reputation, choice: args?.choice, reason: args?.reason ?? null });
+          // The weight is returned because it is the thing a reader would otherwise have to recompute to
+          // believe the tally.
+          return JSON.stringify({ ok: true, action, council_id: id, phase: council.phase, ballot });
+        }
+        if (action === 'decide') {
+          const decision = council.decide();
+          return JSON.stringify({ ok: true, action, council_id: id, phase: council.phase, decision, dissent: decision.dissent, unanimous: decision.unanimous });
+        }
+        if (action === 'record') {
+          const sealed = council.record();
+          const moved = councilSessions.seal(id);
+          return JSON.stringify({ ok: moved.ok, action, council_id: id, phase: council.phase, seal: sealed, reason_code: moved.reason_code ?? null, detail: moved.detail ?? null });
+        }
+      } catch (error) {
+        // A phase refusal is a value, not a crash: the caller is told which phase it is in and what the phase
+        // list is, so it can correct itself without a second call to find out.
+        if (error?.name === 'CouncilRefusal') {
+          return JSON.stringify({ ok: false, action, council_id: id, phase: council.phase, phases: PHASES, reason_code: error.code, detail: error.message, extra: error.extra ?? null });
+        }
+        throw error;
+      }
+
+      // "state" and anything unrecognised: report rather than mutate.
+      return JSON.stringify({
+        ok: true,
+        action: 'state',
+        council_id: id,
+        phase: council.phase,
+        phases: PHASES,
+        members: council.members,
+        votes: council.votes,
+        arguments: council.arguments,
+        decision: council.decision,
+      });
+    },
+  }));
 }
 
 /**