@twinsearth/w2m-dsh-plugin 1.0.10 → 1.0.12

package/CHANGELOG.md

@@ -2,6 +2,121 @@
 
 All notable changes to this project are documented here.
 
+## [1.0.12] — 2026-10-17
+
+**The five fleet-memory actions are verified end to end, against a real relay, a real profile and a real
+`fleet-memory.md` -- and the first attempt found a real defect.**
+
+### What was unverified until now
+
+`publish`, `pull`, `latest`, `diff` and `merge` had each been shipped marked **UNVERIFIED**. The merge *rule* was
+proven exhaustively as a pure function, and the relay *routes* were proven against a real relay -- **but nothing had
+ever executed the tool surface itself.** A caller with no execution is indistinguishable from a working one, which is
+the same gap this project keeps restating in a different shape.
+
+### The defect the end-to-end test found on its first run
+
+`latest` reported `published_by: null` for a publication whose author the relay knew perfectly well.
+
+`RabbitState.putFleetBlob` accepted a `publishedBy` argument that **nothing ever supplied**: the pointer store took
+it, defaulted it to `null`, and the field looked implemented. Fixed by filling it from **the authenticated device's
+`machine_id`, never from the request body** -- for the same reason the P2P announce route reads `machine_id` off the
+token: a caller that could name itself in the body could attribute a publication to a machine that never made it.
+
+**No unit test could have caught this**, because the unit under test was the pointer store, and it was behaving
+exactly as written. The bug lived in the seam between two correct components, which is what an end-to-end test is for.
+
+### What the test exercises, in the order a machine would
+
+A real relay on an ephemeral port and a real profile, then:
+
+1. **`publish`** — returns a 64-hex hash and the byte count.
+2. **`latest`** — discovers that hash **without being told it**, and reports the publishing machine.
+3. **`pull latest`** — fetches the bytes, re-hashes them, and they round-trip **exactly**.
+4. **`diff`** — on an unchanged document: `same: true`, no difference, **and the local file untouched**.
+5. the fleet's document is replaced out of band through the relay's own route;
+6. **`diff`** — now reports the divergence, and the local file is **still untouched**;
+7. **`merge`** — applies the declared rule (neither side declares a repair, so the **default layer** applies and the
+   newer publication wins), records the decision with a reason, carries the winning value into the merged text, and
+   **writes nothing to the local document.**
+
+**`wrote_anything: false` is asserted three times**, because "these actions never edit the file they read" is the
+property that makes it safe to let a network round trip participate at all.
+
+### Verified
+
+- the end-to-end suite: 1 test, passing, covering all five actions;
+- `test/fleet-merge.test.mjs`: 13 tests over the rule itself;
+- full suite: **2374 tests in 91 files, 2360 pass, 0 fail, 14 skip**;
+- pre-flight **GREEN, 15 of 15 checks**.
+
+### NOT verified, even now
+
+**Concurrency.** Everything here is one machine at a time. Two machines publishing and merging simultaneously is
+untested, and the pointer has no compare-and-swap, so the last writer to the pointer wins -- which is **the same rule
+as the default layer**, but that is a coincidence rather than a guarantee. Recorded so the next person does not read
+"end to end" as "under contention".
+
+## [1.0.11] — 2026-10-17
+
+**`w2m_memory {"action":"merge"}`: merge this machine's collective memory with the fleet's current blob, under the
+operator's conflict rule, and still write nothing.**
+
+### The rule, which is the operator's decision
+
+> **默认最新的赢；如果是修复默认流程，最全 & 验证最全面的有最后修改权。**
+>
+> Default: the newest wins. But if it is a repair of the default flow, the most complete and most thoroughly verified
+> one has final edit authority.
+
+Two layers, and the second is the one that is easy to lose: **a declared repair outranks recency**, so a repaired
+fact is not overwritten by a later-written older understanding. Between two repairs, the better-supported one wins.
+
+### What is the operator's, and what is my operationalisation -- stated so it can be challenged
+
+**Theirs:** the two layers above. **Mine, and it is in the source:**
+
+* **The entry syntax.** There is no way to read "is this a repair of the default flow" out of prose; any attempt to
+  guess would overwrite correct versions with wrong ones. So a keyed entry declares it:
+  `- 〔id:<stable-id> fix evidence=<n> verified=<n>〕<the fact>`.
+  Entries without an `id` are prose: they are unioned and never adjudicated, because without an id there is no way to
+  tell "same fact, two versions" from "two different facts".
+* **`completeness = evidence + 2 × verified`. The weight 2 is a judgement, not the operator's words.** One reproduced
+  fact outranks three unreproduced ones. It only applies when **both** sides declare `fix`.
+
+**Every decision is recorded** as a comment in the merged text (`<!-- <id> -> local (repair): ... -->`), because a
+merge that cannot explain its choices produces a document nobody can audit -- and the first sign of a wrong rule
+would be a fact nobody can find.
+
+### What it refuses
+
+| Case | Behaviour |
+|---|---|
+| the same id twice **inside one document** | **refused**, not resolved: a broken document is not a conflict |
+| a blob that fails its own hash | `W2M_BAD_BLOB`, and **nothing is merged** -- comparing unverified content would launder it |
+| a pointer naming an evicted blob | reported as that, with the remedy (publish again) |
+| no fleet document at all | reported as a state: publishing comes first |
+
+### And it still writes nothing
+
+The merged text comes back in the result; **the local file is not modified.** Half of a merge's input arrived over the
+network, and letting one round trip rewrite the only local copy would hand a remote party a write into local memory.
+
+### Verified
+
+**13 tests in `test/fleet-merge.test.mjs`** exercise the rule as a rule, with no profile and no relay: the default
+layer picks the newer publication; **a declared repair beats a NEWER non-repair** (the operator's override -- if this
+test flips, the rule has silently become "newest wins"); two repairs are separated by completeness, then by
+verification count, then by recency; a genuine tie resolves deterministically **and is recorded as a tie**; a
+duplicated id is refused; prose unions; inputs are not mutated; an identical id produces no decision.
+
+Full suite: see the pre-flight line. Pre-flight **GREEN, 15 of 15 checks**.
+
+### NOT verified
+
+The `merge` action **end to end** -- the same gap as `publish`/`pull`/`latest`/`diff`: the rule is proven, the
+plumbing around it is not, because that needs a profile with a `fleet-memory.md` and a live relay.
+
 ## [1.0.10] — 2026-10-17
 
 **`w2m_memory {"action":"diff"}`: compare this machine's collective memory against the fleet's current blob,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "main": "lib/index.js",
@@ -117,13 +117,13 @@
     }
   },
   "scripts": {
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs",
     "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs",
     "test:relay": "node --test --test-force-exit test/relay.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
     "test:tools": "node --test --test-force-exit test/tools.test.mjs",
     "test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs",
     "pack": "node scripts/pack.mjs",
     "verify:join": "node scripts/verify-join.mjs",
     "lint": "eslint .",
@@ -137,6 +137,8 @@
     "test:blocks": "node --test --test-force-exit test/blocks.test.mjs",
     "test:approval-index": "node --test --test-force-exit test/approval-index.test.mjs",
     "test:fleet-sync": "node --test --test-force-exit test/fleet-sync.test.mjs",
+    "test:fleet-merge": "node --test --test-force-exit test/fleet-merge.test.mjs",
+    "test:fleet-memory-e2e": "node --test --test-force-exit test/fleet-memory-e2e.test.mjs",
     "test:health": "node --test --test-force-exit test/health.test.mjs",
     "test:storage": "node --test --test-force-exit test/storage.test.mjs",
     "test:exit-channel": "node --test --test-force-exit test/exit-channel.test.mjs",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/fleet-merge.mjs

@@ -0,0 +1,270 @@
+/**
+ * Fleet memory merge — the deterministic core of #2b.
+ *
+ * ## The rule, which is the operator's and not mine
+ *
+ * > **默认最新的赢；如果是修复默认流程，最全 & 验证最全面的有最后修改权。**
+ * > (Default: the newest wins. But if it is a repair of the default flow, the most complete and most thoroughly
+ * > verified one has final edit authority.)
+ *
+ * ## What is the operator's decision, and what is my operationalisation
+ *
+ * **The operator's:** the two layers. Newest wins by default; a declared repair of the default flow outranks
+ * recency. A repaired fact must not be overwritten by a later-written older understanding.
+ *
+ * **Mine, and it must be reviewable:**
+ *
+ *   * the entry syntax (§3 of FLEET-SYNC-2B-MERGE-SPEC.md) — there is no way to read "is this a repair" out of
+ *     prose, and guessing would overwrite correct versions with wrong ones;
+ *   * `completeness = evidence + 2 * verified`. Verified evidence is a stronger signal than more unverified evidence
+ *     — one reproduced fact beats three unreproduced ones. **The weight 2 is a judgement, not the operator's words**,
+ *     and it only applies when both sides declare `fix`.
+ *
+ * ## Why nothing here is silent
+ *
+ * Every adjudicated id produces a decision record, and the decision records are appended to the output as comments.
+ * **A merge that cannot explain its own choices produces a document nobody can audit**, and the first sign of a
+ * wrong rule would be a fact nobody can find.
+ *
+ * @module fleet-merge
+ */
+
+/** The bracket pair that marks an entry: U+3014 / U+3015. Chosen because they never occur in the prose. */
+const OPEN = '〔';
+const CLOSE = '〕';
+/** `- 〔...〕content` -- built from the constants so a change to the pair cannot desynchronise the parser. */
+const ENTRY_RE = new RegExp('^-\\s+' + OPEN + '([^' + CLOSE + ']*)' + CLOSE + '(.*)$');
+
+/**
+ * Parse one markdown line as a keyed entry.
+ *
+ * Only `- ` list items that begin with a `〔...〕` metadata bracket are entries. **Everything else is unkeyed prose**,
+ * and unkeyed lines never participate in adjudication: without an id there is no way to tell "these two lines are
+ * about the same thing" from "these two lines are different facts", and guessing produces conflicts that are not
+ * conflicts.
+ *
+ * @param {string} line
+ * @returns {{id:string, fix:boolean, evidence:number, verified:number, content:string, raw:string}|null}
+ */
+export function parseEntry(line) {
+  if (typeof line !== 'string') return null;
+  const match = ENTRY_RE.exec(line);
+  if (match === null) return null;
+  const meta = match[1];
+  const content = match[2];
+
+  let id = null;
+  let fix = false;
+  let evidence = 0;
+  let verified = 0;
+  for (const token of meta.trim().split(/\s+/)) {
+    if (token.startsWith('id:')) {
+      id = token.slice(3).trim();
+      continue;
+    }
+    if (token === 'fix') { fix = true; continue; }
+    const eq = token.indexOf('=');
+    if (eq > 0) {
+      const key = token.slice(0, eq);
+      const value = Number(token.slice(eq + 1));
+      if (!Number.isInteger(value) || value < 0) continue;
+      if (key === 'evidence') evidence = value;
+      else if (key === 'verified') verified = value;
+    }
+  }
+  if (id === null || id === '') return null;
+  return { id, fix, evidence, verified, content: content.trim(), raw: line };
+}
+
+/**
+ * How much a declared repair has to show, for the "most complete and most thoroughly verified" half of the rule.
+ *
+ * @param {{evidence:number, verified:number}} entry
+ */
+export function completeness(entry) {
+  return entry.evidence + 2 * entry.verified;
+}
+
+/**
+ * Split a document into unkeyed prose and keyed entries.
+ *
+ * A duplicate id **within one document** is recorded rather than merged, because two entries claiming the same id in
+ * one document is a broken document, not a conflict to resolve.
+ *
+ * @param {string} text
+ * @returns {{prose:string[], entries:Map<string, object>, duplicates:string[]}}
+ */
+export function parseDocument(text) {
+  const prose = [];
+  const entries = new Map();
+  const duplicates = [];
+  for (const line of String(text ?? '').split('\n')) {
+    const entry = parseEntry(line);
+    if (entry === null) {
+      if (line.trim() !== '') prose.push(line);
+      continue;
+    }
+    if (entries.has(entry.id)) {
+      if (!duplicates.includes(entry.id)) duplicates.push(entry.id);
+      continue;
+    }
+    entries.set(entry.id, entry);
+  }
+  return { prose, entries, duplicates };
+}
+
+/**
+ * Decide one id, given the same entry from two documents.
+ *
+ * The order is fixed so the result never depends on iteration order:
+ *
+ *   1. only one side declares `fix`      -> that side
+ *   2. both declare `fix`                 -> higher `completeness`
+ *   3. equal `completeness`               -> higher `verified`
+ *   4. still equal                        -> newer (higher `addedAtMs`)
+ *   5. still equal                        -> lower hash, for determinism only, and the tie is recorded
+ *
+ * @returns {{winner:'local'|'fleet', layer:'repair'|'default'|'tie', reason:string}}
+ */
+export function decide(local, fleet, context) {
+  const { localAddedAtMs = 0, fleetAddedAtMs = 0, localHash = '', fleetHash = '' } = context;
+
+  if (local.fix !== fleet.fix) {
+    const winner = local.fix ? 'local' : 'fleet';
+    return {
+      winner,
+      layer: 'repair',
+      reason: `${winner} declares "fix" of the default flow, which outranks recency (the other side does not)`,
+    };
+  }
+
+  if (local.fix && fleet.fix) {
+    const localScore = completeness(local);
+    const fleetScore = completeness(fleet);
+    if (localScore !== fleetScore) {
+      return {
+        winner: localScore > fleetScore ? 'local' : 'fleet',
+        layer: 'repair',
+        reason: `both declare "fix"; completeness ${localScore} vs ${fleetScore} (evidence + 2 x verified)`,
+      };
+    }
+    if (local.verified !== fleet.verified) {
+      return {
+        winner: local.verified > fleet.verified ? 'local' : 'fleet',
+        layer: 'repair',
+        reason: `both declare "fix" with equal completeness; verified ${local.verified} vs ${fleet.verified}`,
+      };
+    }
+    // fall through to recency
+  }
+
+  if (localAddedAtMs !== fleetAddedAtMs) {
+    return {
+      winner: localAddedAtMs > fleetAddedAtMs ? 'local' : 'fleet',
+      layer: 'default',
+      reason: `default layer: the newer publication wins (${Math.max(localAddedAtMs, fleetAddedAtMs)} > ${Math.min(localAddedAtMs, fleetAddedAtMs)})`,
+    };
+  }
+
+  const winner = localHash < fleetHash ? 'local' : 'fleet';
+  return {
+    winner,
+    layer: 'tie',
+    reason: 'identical timestamps and scores; resolved by hash order for determinism only -- this is a genuine tie',
+  };
+}
+
+/**
+ * Merge two documents under the rule above.
+ *
+ * **Never throws for a resolvable merge, never resolves something it cannot justify, and never invents content.**
+ *
+ * @param {{localText:string, localAddedAtMs?:number, localHash?:string,
+ *          fleetText:string, fleetAddedAtMs?:number, fleetHash?:string}} input
+ * @returns {{text:string, decisions:{id:string,winner:string,layer:string,reason:string}[],
+ *            unresolved:{id:string,reason:string}[], refused:{id:string,reason:string}[],
+ *            added:string[], removed:string[], unchanged:number, wroteAnything:false}}
+ */
+export function mergeMemory(input) {
+  const {
+    localText, localAddedAtMs = 0, localHash = '',
+    fleetText, fleetAddedAtMs = 0, fleetHash = '',
+  } = input;
+
+  const local = parseDocument(localText);
+  const fleet = parseDocument(fleetText);
+  const context = { localAddedAtMs, fleetAddedAtMs, localHash, fleetHash };
+
+  const decisions = [];
+  const unresolved = [];
+  const refused = [];
+
+  /** ids that are broken (duplicated) in either document -- refused, never merged. */
+  const broken = new Set([...local.duplicates, ...fleet.duplicates]);
+  for (const id of broken) {
+    refused.push({ id, reason: 'this id appears more than once in one document; a broken document is not a conflict' });
+  }
+
+  const allIds = [...new Set([...local.entries.keys(), ...fleet.entries.keys()])];
+  const chosen = new Map();
+  let unchanged = 0;
+
+  for (const id of allIds) {
+    if (broken.has(id)) continue;
+    const l = local.entries.get(id);
+    const f = fleet.entries.get(id);
+
+    if (l !== undefined && f === undefined) { chosen.set(id, { entry: l, side: 'local' }); continue; }
+    if (l === undefined && f !== undefined) { chosen.set(id, { entry: f, side: 'fleet' }); continue; }
+
+    // Same id on both sides. Identical text is not a conflict.
+    if (l.raw === f.raw || l.content === f.content) { chosen.set(id, { entry: l, side: 'both' }); unchanged += 1; continue; }
+
+    const verdict = decide(l, f, context);
+    chosen.set(id, { entry: verdict.winner === 'local' ? l : f, side: verdict.winner });
+    decisions.push({ id, winner: verdict.winner, layer: verdict.layer, reason: verdict.reason });
+  }
+
+  // Prose is a union; it cannot conflict because it has no identity to conflict on.
+  const localProse = new Set(local.prose);
+  const proseOut = [...local.prose];
+  for (const line of fleet.prose) if (!localProse.has(line)) proseOut.push(line);
+
+  // Entries: local document order first (so the machine's own structure survives), then fleet-only ids in fleet order.
+  const entryLines = [];
+  for (const line of String(localText ?? '').split('\n')) {
+    const parsed = parseEntry(line);
+    if (parsed === null || !chosen.has(parsed.id)) continue;
+    const pick = chosen.get(parsed.id);
+    if (!entryLines.some((e) => e.id === parsed.id)) entryLines.push({ id: parsed.id, raw: pick.entry.raw });
+  }
+  for (const line of String(fleetText ?? '').split('\n')) {
+    const parsed = parseEntry(line);
+    if (parsed === null || !chosen.has(parsed.id)) continue;
+    if (!entryLines.some((e) => e.id === parsed.id)) entryLines.push({ id: parsed.id, raw: chosen.get(parsed.id).entry.raw });
+  }
+
+  const audit = [
+    '<!-- fleet-merge: decisions are recorded so a wrong rule is visible after the fact -->',
+    ...decisions.map((d) => `<!-- ${d.id} -> ${d.winner} (${d.layer}): ${d.reason} -->`),
+    ...unresolved.map((u) => `<!-- ${u.id} UNRESOLVED: ${u.reason} -->`),
+    ...refused.map((r) => `<!-- ${r.id} REFUSED: ${r.reason} -->`),
+  ];
+
+  const text = [
+    ...proseOut,
+    ...entryLines.map((e) => e.raw),
+    ...audit,
+  ].join('\n');
+
+  return {
+    text,
+    decisions,
+    unresolved,
+    refused,
+    added: [...fleet.entries.keys()].filter((id) => !local.entries.has(id) && !broken.has(id)),
+    removed: [...local.entries.keys()].filter((id) => !fleet.entries.has(id) && !broken.has(id)),
+    unchanged,
+    wroteAnything: false,
+  };
+}

package/src/plugin/tools.mjs

@@ -104,6 +104,9 @@ import { appendMemory, readMemorySync } from '../agent/memory.mjs';
 // plugin asserting a claim on its own behalf, which is the sender's job.
 import { acceptBlock, verifyBlock } from '../agent/blocks.mjs';
 import { acceptWithAuthority } from '../agent/field-authority.mjs';
+// v1.0.11: the merge rule (#2b) lives in its own module so the operator's two layers can be tested as a rule,
+// exhaustively, without a profile or a relay.
+import { mergeMemory } from './fleet-merge.mjs';
 
 // The base-address rules live in one place (§2), shared with the agent side. Importing the - rather
 // than re-deriving them her - is what stops the plugin and the agent from disagreeing about what
@@ -208,7 +211,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.0.10';
+const PLUGIN_VERSION = '1.0.12';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -5141,14 +5144,15 @@ export async function apply(ctx, config = {}) {
        */
       action: {
         type: 'string',
-        enum: ['read', 'publish', 'pull', 'latest', 'diff'],
+        enum: ['read', 'publish', 'pull', 'latest', 'diff', 'merge'],
         description:
           'read (default) = answer from memory. publish = upload the curated collective memory '
           + '(`fleet-memory.md`) to the relay as a content-addressed blob and return its SHA-256. latest = ask the '
           + 'relay which blob this fleet published last. pull = fetch one blob by SHA-256 -- or by "latest" -- and '
           + 'return its text, re-hashing it. diff = compare the local document against the fleet current blob and '
-          + 'report what differs, **writing nothing**: merge has no conflict rule yet, so this action deliberately '
-          + 'resolves nothing. None of these modifies the local file.',
+          + 'report what differs. merge = apply the declared conflict rule (newest wins by default; a declared '
+          + 'repair of the default flow outranks recency) and return the merged text with every decision recorded. '
+          + '**No action modifies the local file.**',
         default: 'read',
       },
       hash: {
@@ -5609,6 +5613,116 @@ export async function apply(ctx, config = {}) {
         });
       }
 
+      /**
+       * v1.0.11 (#2b): merge this machine's collective memory with the fleet's current blob, **under the operator's
+       * rule**, and still write nothing.
+       *
+       * ## The rule (the operator's, quoted)
+       *
+       * > 默认最新的赢；如果是修复默认流程，最全 & 验证最全面的有最后修改权。
+       *
+       * The two layers are implemented in `src/plugin/fleet-merge.mjs`: newest publication wins by default, and a
+       * declared repair of the default flow outranks recency. **The operationalisation is that module's; this branch
+       * only supplies the inputs.**
+       *
+       * ## Why the result is returned rather than written
+       *
+       * The local file is this machine's only copy, and half of a merge's input arrived over the network. **Letting
+       * one round trip rewrite it would hand a remote party a write into local memory.** So the merged text comes
+       * back in the result, decisions and all, and the caller decides.
+       *
+       * ## Recency inputs, named
+       *
+       * `localAddedAtMs` is the file's mtime; `fleetAddedAtMs` is the relay's `published_at` for the pointer's blob.
+       * Both are compared as milliseconds. **Neither is a claim about content** -- which is exactly why they are only
+       * the tie-break of last resort under the default layer.
+       */
+      if (typeof args?.action === 'string' && args.action === 'merge') {
+        const file = collectivePath();
+        if (file === null) {
+          throw new W2MError('W2M_CONFIG', 'W2M_CONFIG: there is no profile to merge collective memory from', {
+            hint: 'the collective layer lives beside the profile that mounted this plugin',
+          });
+        }
+        let localBytes;
+        let localStat;
+        try {
+          localBytes = await fs.readFile(file);
+          localStat = await fs.stat(file);
+        } catch {
+          throw new W2MError('W2M_NOT_FOUND', `W2M_NOT_FOUND: no collective memory to merge at ${file}`, {
+            hint: 'merge needs a local document; it compares against the fleet copy, it does not create one',
+          });
+        }
+        const localHash = createHash('sha256').update(localBytes).digest('hex');
+        const base = requireRabbit(cfg);
+        const token = await resolveToken(cfg);
+
+        const pointer = await request({ rabbitUrl: base, token, pathname: '/v1/fleet/blobs/latest', signal: exec?.signal });
+        if (pointer.status === 404) {
+          return JSON.stringify({
+            ok: true, merged: false, wrote_anything: false,
+            local: { hash: localHash, bytes: localBytes.length, file },
+            reason: 'this fleet has published no blob yet, so there is nothing to merge with. Publishing comes first.',
+          });
+        }
+        if (pointer.status !== 200) {
+          throw new W2MError('W2M_RABBIT_REFUSED', `W2M_RABBIT_REFUSED: GET /v1/fleet/blobs/latest answered HTTP ${pointer.status}`, {
+            http_status: pointer.status, detail: pointer.error ?? null,
+          });
+        }
+        const fleetHash = String(pointer.json?.hash ?? '');
+        const fleetRes = await request({
+          rabbitUrl: base, token, pathname: `/v1/fleet/blobs/${fleetHash}`,
+          accept: 'application/octet-stream', signal: exec?.signal,
+        });
+        if (fleetRes.status !== 200) {
+          throw new W2MError('W2M_NOT_FOUND', `W2M_NOT_FOUND: the fleet pointer names ${fleetHash}, which answered HTTP ${fleetRes.status}`, {
+            hint: 'the pointer is a hint (see #3); oldest-first eviction can remove the blob it names',
+            prescribed: 'publish from a machine in this fleet to establish a current document again',
+          });
+        }
+        const fleetText = fleetRes.text ?? '';
+        const fleetActual = createHash('sha256').update(fleetText, 'utf8').digest('hex');
+        if (fleetActual !== fleetHash) {
+          throw new W2MError('W2M_BAD_BLOB', `W2M_BAD_BLOB: the fleet blob ${fleetHash} hashes to ${fleetActual} instead`, {
+            hint: 'refusing to merge unverified content', expected: fleetHash, actual: fleetActual,
+          });
+        }
+
+        const fleetPublishedAt = Date.parse(String(pointer.json?.published_at ?? ''));
+        const outcome = mergeMemory({
+          localText: localBytes.toString('utf8'),
+          localAddedAtMs: Number.isFinite(localStat.mtimeMs) ? localStat.mtimeMs : 0,
+          localHash,
+          fleetText,
+          fleetAddedAtMs: Number.isFinite(fleetPublishedAt) ? fleetPublishedAt : 0,
+          fleetHash,
+        });
+
+        return JSON.stringify({
+          ok: true,
+          merged: true,
+          wrote_anything: false,
+          rule: 'default: newest publication wins; a declared repair of the default flow outranks recency, and between '
+            + 'two repairs the one with the higher (evidence + 2 x verified) wins',
+          local: { hash: localHash, bytes: localBytes.length, file, added_at_ms: Math.round(localStat.mtimeMs) },
+          fleet: {
+            hash: fleetHash, bytes: Buffer.byteLength(fleetText, 'utf8'),
+            published_at: pointer.json?.published_at ?? null, published_by: pointer.json?.published_by ?? null,
+          },
+          decisions: outcome.decisions,
+          unresolved: outcome.unresolved,
+          refused: outcome.refused,
+          unchanged: outcome.unchanged,
+          added: outcome.added,
+          removed: outcome.removed,
+          merged_text: outcome.text,
+          next: 'this result is text only. Writing it back is the caller\'s decision -- a merge does not edit the '
+            + 'document it read.',
+        });
+      }
+
       const limitRaw = Number(args?.limit);
       const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? Math.min(Math.floor(limitRaw), 500) : 20;
 

package/src/relay/state.mjs

@@ -560,7 +560,20 @@ export class RabbitState {
     }
     const scope = this.scopeBlobFleet(device);
     if (scope.ok !== true) return { ok: false, reason: scope.reason, detail: scope.text };
-    return this._persist.putBlob(bytes, { fleetId: scope.fleetId });
+    /**
+     * v1.0.12: `publishedBy` comes from **the authenticated device, never from the request body.**
+     *
+     * The relay knows which device is writing; the request does not get a say, for the same reason `machine_id` is
+     * read off the token in the P2P announce route -- a caller that could name itself in the body could attribute a
+     * publication to a machine that never made it.
+     *
+     * An end-to-end test caught this field being `null`: the pointer store accepted a `publishedBy` argument that
+     * nothing supplied, so `latest` reported `published_by: null` for a publication whose author was right there.
+     */
+    return this._persist.putBlob(bytes, {
+      fleetId: scope.fleetId,
+      publishedBy: typeof device?.machine_id === 'string' ? device.machine_id : null,
+    });
   }
 
   /**