@twinsearth/w2m-dsh-plugin 1.0.9 → 1.0.11

package/CHANGELOG.md

@@ -2,6 +2,124 @@
 
 All notable changes to this project are documented here.
 
+## [1.0.11] — 2026-10-17
+
+**`w2m_memory {"action":"merge"}`: merge this machine's collective memory with the fleet's current blob, under the
+operator's conflict rule, and still write nothing.**
+
+### The rule, which is the operator's decision
+
+> **默认最新的赢；如果是修复默认流程，最全 & 验证最全面的有最后修改权。**
+>
+> Default: the newest wins. But if it is a repair of the default flow, the most complete and most thoroughly verified
+> one has final edit authority.
+
+Two layers, and the second is the one that is easy to lose: **a declared repair outranks recency**, so a repaired
+fact is not overwritten by a later-written older understanding. Between two repairs, the better-supported one wins.
+
+### What is the operator's, and what is my operationalisation -- stated so it can be challenged
+
+**Theirs:** the two layers above. **Mine, and it is in the source:**
+
+* **The entry syntax.** There is no way to read "is this a repair of the default flow" out of prose; any attempt to
+  guess would overwrite correct versions with wrong ones. So a keyed entry declares it:
+  `- 〔id:<stable-id> fix evidence=<n> verified=<n>〕<the fact>`.
+  Entries without an `id` are prose: they are unioned and never adjudicated, because without an id there is no way to
+  tell "same fact, two versions" from "two different facts".
+* **`completeness = evidence + 2 × verified`. The weight 2 is a judgement, not the operator's words.** One reproduced
+  fact outranks three unreproduced ones. It only applies when **both** sides declare `fix`.
+
+**Every decision is recorded** as a comment in the merged text (`<!-- <id> -> local (repair): ... -->`), because a
+merge that cannot explain its choices produces a document nobody can audit -- and the first sign of a wrong rule
+would be a fact nobody can find.
+
+### What it refuses
+
+| Case | Behaviour |
+|---|---|
+| the same id twice **inside one document** | **refused**, not resolved: a broken document is not a conflict |
+| a blob that fails its own hash | `W2M_BAD_BLOB`, and **nothing is merged** -- comparing unverified content would launder it |
+| a pointer naming an evicted blob | reported as that, with the remedy (publish again) |
+| no fleet document at all | reported as a state: publishing comes first |
+
+### And it still writes nothing
+
+The merged text comes back in the result; **the local file is not modified.** Half of a merge's input arrived over the
+network, and letting one round trip rewrite the only local copy would hand a remote party a write into local memory.
+
+### Verified
+
+**13 tests in `test/fleet-merge.test.mjs`** exercise the rule as a rule, with no profile and no relay: the default
+layer picks the newer publication; **a declared repair beats a NEWER non-repair** (the operator's override -- if this
+test flips, the rule has silently become "newest wins"); two repairs are separated by completeness, then by
+verification count, then by recency; a genuine tie resolves deterministically **and is recorded as a tie**; a
+duplicated id is refused; prose unions; inputs are not mutated; an identical id produces no decision.
+
+Full suite: see the pre-flight line. Pre-flight **GREEN, 15 of 15 checks**.
+
+### NOT verified
+
+The `merge` action **end to end** -- the same gap as `publish`/`pull`/`latest`/`diff`: the rule is proven, the
+plumbing around it is not, because that needs a profile with a `fleet-memory.md` and a live relay.
+
+## [1.0.10] — 2026-10-17
+
+**`w2m_memory {"action":"diff"}`: compare this machine's collective memory against the fleet's current blob,
+and write nothing.**
+
+### Merge is still not implemented, deliberately
+
+The question merge depends on has not been answered:
+
+> **When two machines in one fleet assert different things about the same fact, who wins?**
+
+That is a product decision about what the fleet's memory *is*, not an implementation detail, and shipping a merge
+before its rule is how a fleet silently loses one machine's memory. So this release ships **the half that needs no
+decision** -- and names the other half as open rather than leaving it implied.
+
+### What `diff` answers
+
+* **Is my document the newest one?** `same: true/false`, decided by **whole-document hash equality**.
+* **What would I be overwriting?** `preview.local_only` and `preview.fleet_only`.
+* **Is the fleet's document even there?** Three distinct absence states, each named: the fleet never published; the
+  pointer names a blob that eviction removed; the blob exists and verified.
+
+### Four decisions worth recording
+
+**It writes nothing.** No `.orig`, no `.rej`, no silent merge. Comparing is not a licence to edit a document this
+machine owns.
+
+**`same` is hash equality, not "no line differences".** Two documents with identical line sets in a different order
+are **not** the same, and callling them the same would hide an order change -- which in a markdown document is a
+structural change.
+
+**A set comparison, not a diff.** A line-oriented diff would report "moved" versus "changed" and then want a merge
+policy. **A set comparison cannot resolve anything, which is exactly the property this step requires.**
+
+**The fleet copy is re-hashed before it is compared.** Comparing unverified content would launder it: the report
+would give a hash-verified-looking answer about bytes nobody checked. A blob that fails its own name raises
+`W2M_BAD_BLOB` and is never compared.
+
+Trailing whitespace is normalised (it is noise); leading whitespace is preserved (it is markdown structure).
+
+### Verified
+
+The comparison rule is pinned directly: `local_only` / `fleet_only` separate correctly, trailing whitespace creates
+no difference, and leading whitespace does. Full suite **2360 tests, 2346 pass, 0 fail, 14 skip**; pre-flight
+**GREEN, 15 of 15 checks**.
+
+### NOT verified
+
+The `diff` action **end to end** -- the same gap as `publish`/`pull`/`latest`: type-correct and lint-clean, but
+no test executes it, because that needs a profile with a `fleet-memory.md` and a live relay.
+
+### Open: #2b
+
+**Append-merge with conflict markers, and the marker's existence is the refusal** -- a document containing markers is
+one a human must not trust until resolved. Last-writer-wins is rejected: it loses data silently, and the project's
+own eviction rule already refuses "delete the only copy of a fact" in spirit. **That recommendation is in
+`FLEET-SYNC-2-DESIGN.md` and is not implemented, because it encodes a rule that is the operator's to choose.**
+
 ## [1.0.9] — 2026-10-17
 
 **Discovery: a machine can now ask the relay which blob its fleet published last, instead of a human relaying a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "main": "lib/index.js",
@@ -117,13 +117,13 @@
     }
   },
   "scripts": {
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs",
     "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs",
     "test:relay": "node --test --test-force-exit test/relay.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
     "test:tools": "node --test --test-force-exit test/tools.test.mjs",
     "test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs",
     "pack": "node scripts/pack.mjs",
     "verify:join": "node scripts/verify-join.mjs",
     "lint": "eslint .",
@@ -137,6 +137,7 @@
     "test:blocks": "node --test --test-force-exit test/blocks.test.mjs",
     "test:approval-index": "node --test --test-force-exit test/approval-index.test.mjs",
     "test:fleet-sync": "node --test --test-force-exit test/fleet-sync.test.mjs",
+    "test:fleet-merge": "node --test --test-force-exit test/fleet-merge.test.mjs",
     "test:health": "node --test --test-force-exit test/health.test.mjs",
     "test:storage": "node --test --test-force-exit test/storage.test.mjs",
     "test:exit-channel": "node --test --test-force-exit test/exit-channel.test.mjs",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/fleet-merge.mjs

@@ -0,0 +1,270 @@
+/**
+ * Fleet memory merge — the deterministic core of #2b.
+ *
+ * ## The rule, which is the operator's and not mine
+ *
+ * > **默认最新的赢；如果是修复默认流程，最全 & 验证最全面的有最后修改权。**
+ * > (Default: the newest wins. But if it is a repair of the default flow, the most complete and most thoroughly
+ * > verified one has final edit authority.)
+ *
+ * ## What is the operator's decision, and what is my operationalisation
+ *
+ * **The operator's:** the two layers. Newest wins by default; a declared repair of the default flow outranks
+ * recency. A repaired fact must not be overwritten by a later-written older understanding.
+ *
+ * **Mine, and it must be reviewable:**
+ *
+ *   * the entry syntax (§3 of FLEET-SYNC-2B-MERGE-SPEC.md) — there is no way to read "is this a repair" out of
+ *     prose, and guessing would overwrite correct versions with wrong ones;
+ *   * `completeness = evidence + 2 * verified`. Verified evidence is a stronger signal than more unverified evidence
+ *     — one reproduced fact beats three unreproduced ones. **The weight 2 is a judgement, not the operator's words**,
+ *     and it only applies when both sides declare `fix`.
+ *
+ * ## Why nothing here is silent
+ *
+ * Every adjudicated id produces a decision record, and the decision records are appended to the output as comments.
+ * **A merge that cannot explain its own choices produces a document nobody can audit**, and the first sign of a
+ * wrong rule would be a fact nobody can find.
+ *
+ * @module fleet-merge
+ */
+
+/** The bracket pair that marks an entry: U+3014 / U+3015. Chosen because they never occur in the prose. */
+const OPEN = '〔';
+const CLOSE = '〕';
+/** `- 〔...〕content` -- built from the constants so a change to the pair cannot desynchronise the parser. */
+const ENTRY_RE = new RegExp('^-\\s+' + OPEN + '([^' + CLOSE + ']*)' + CLOSE + '(.*)$');
+
+/**
+ * Parse one markdown line as a keyed entry.
+ *
+ * Only `- ` list items that begin with a `〔...〕` metadata bracket are entries. **Everything else is unkeyed prose**,
+ * and unkeyed lines never participate in adjudication: without an id there is no way to tell "these two lines are
+ * about the same thing" from "these two lines are different facts", and guessing produces conflicts that are not
+ * conflicts.
+ *
+ * @param {string} line
+ * @returns {{id:string, fix:boolean, evidence:number, verified:number, content:string, raw:string}|null}
+ */
+export function parseEntry(line) {
+  if (typeof line !== 'string') return null;
+  const match = ENTRY_RE.exec(line);
+  if (match === null) return null;
+  const meta = match[1];
+  const content = match[2];
+
+  let id = null;
+  let fix = false;
+  let evidence = 0;
+  let verified = 0;
+  for (const token of meta.trim().split(/\s+/)) {
+    if (token.startsWith('id:')) {
+      id = token.slice(3).trim();
+      continue;
+    }
+    if (token === 'fix') { fix = true; continue; }
+    const eq = token.indexOf('=');
+    if (eq > 0) {
+      const key = token.slice(0, eq);
+      const value = Number(token.slice(eq + 1));
+      if (!Number.isInteger(value) || value < 0) continue;
+      if (key === 'evidence') evidence = value;
+      else if (key === 'verified') verified = value;
+    }
+  }
+  if (id === null || id === '') return null;
+  return { id, fix, evidence, verified, content: content.trim(), raw: line };
+}
+
+/**
+ * How much a declared repair has to show, for the "most complete and most thoroughly verified" half of the rule.
+ *
+ * @param {{evidence:number, verified:number}} entry
+ */
+export function completeness(entry) {
+  return entry.evidence + 2 * entry.verified;
+}
+
+/**
+ * Split a document into unkeyed prose and keyed entries.
+ *
+ * A duplicate id **within one document** is recorded rather than merged, because two entries claiming the same id in
+ * one document is a broken document, not a conflict to resolve.
+ *
+ * @param {string} text
+ * @returns {{prose:string[], entries:Map<string, object>, duplicates:string[]}}
+ */
+export function parseDocument(text) {
+  const prose = [];
+  const entries = new Map();
+  const duplicates = [];
+  for (const line of String(text ?? '').split('\n')) {
+    const entry = parseEntry(line);
+    if (entry === null) {
+      if (line.trim() !== '') prose.push(line);
+      continue;
+    }
+    if (entries.has(entry.id)) {
+      if (!duplicates.includes(entry.id)) duplicates.push(entry.id);
+      continue;
+    }
+    entries.set(entry.id, entry);
+  }
+  return { prose, entries, duplicates };
+}
+
+/**
+ * Decide one id, given the same entry from two documents.
+ *
+ * The order is fixed so the result never depends on iteration order:
+ *
+ *   1. only one side declares `fix`      -> that side
+ *   2. both declare `fix`                 -> higher `completeness`
+ *   3. equal `completeness`               -> higher `verified`
+ *   4. still equal                        -> newer (higher `addedAtMs`)
+ *   5. still equal                        -> lower hash, for determinism only, and the tie is recorded
+ *
+ * @returns {{winner:'local'|'fleet', layer:'repair'|'default'|'tie', reason:string}}
+ */
+export function decide(local, fleet, context) {
+  const { localAddedAtMs = 0, fleetAddedAtMs = 0, localHash = '', fleetHash = '' } = context;
+
+  if (local.fix !== fleet.fix) {
+    const winner = local.fix ? 'local' : 'fleet';
+    return {
+      winner,
+      layer: 'repair',
+      reason: `${winner} declares "fix" of the default flow, which outranks recency (the other side does not)`,
+    };
+  }
+
+  if (local.fix && fleet.fix) {
+    const localScore = completeness(local);
+    const fleetScore = completeness(fleet);
+    if (localScore !== fleetScore) {
+      return {
+        winner: localScore > fleetScore ? 'local' : 'fleet',
+        layer: 'repair',
+        reason: `both declare "fix"; completeness ${localScore} vs ${fleetScore} (evidence + 2 x verified)`,
+      };
+    }
+    if (local.verified !== fleet.verified) {
+      return {
+        winner: local.verified > fleet.verified ? 'local' : 'fleet',
+        layer: 'repair',
+        reason: `both declare "fix" with equal completeness; verified ${local.verified} vs ${fleet.verified}`,
+      };
+    }
+    // fall through to recency
+  }
+
+  if (localAddedAtMs !== fleetAddedAtMs) {
+    return {
+      winner: localAddedAtMs > fleetAddedAtMs ? 'local' : 'fleet',
+      layer: 'default',
+      reason: `default layer: the newer publication wins (${Math.max(localAddedAtMs, fleetAddedAtMs)} > ${Math.min(localAddedAtMs, fleetAddedAtMs)})`,
+    };
+  }
+
+  const winner = localHash < fleetHash ? 'local' : 'fleet';
+  return {
+    winner,
+    layer: 'tie',
+    reason: 'identical timestamps and scores; resolved by hash order for determinism only -- this is a genuine tie',
+  };
+}
+
+/**
+ * Merge two documents under the rule above.
+ *
+ * **Never throws for a resolvable merge, never resolves something it cannot justify, and never invents content.**
+ *
+ * @param {{localText:string, localAddedAtMs?:number, localHash?:string,
+ *          fleetText:string, fleetAddedAtMs?:number, fleetHash?:string}} input
+ * @returns {{text:string, decisions:{id:string,winner:string,layer:string,reason:string}[],
+ *            unresolved:{id:string,reason:string}[], refused:{id:string,reason:string}[],
+ *            added:string[], removed:string[], unchanged:number, wroteAnything:false}}
+ */
+export function mergeMemory(input) {
+  const {
+    localText, localAddedAtMs = 0, localHash = '',
+    fleetText, fleetAddedAtMs = 0, fleetHash = '',
+  } = input;
+
+  const local = parseDocument(localText);
+  const fleet = parseDocument(fleetText);
+  const context = { localAddedAtMs, fleetAddedAtMs, localHash, fleetHash };
+
+  const decisions = [];
+  const unresolved = [];
+  const refused = [];
+
+  /** ids that are broken (duplicated) in either document -- refused, never merged. */
+  const broken = new Set([...local.duplicates, ...fleet.duplicates]);
+  for (const id of broken) {
+    refused.push({ id, reason: 'this id appears more than once in one document; a broken document is not a conflict' });
+  }
+
+  const allIds = [...new Set([...local.entries.keys(), ...fleet.entries.keys()])];
+  const chosen = new Map();
+  let unchanged = 0;
+
+  for (const id of allIds) {
+    if (broken.has(id)) continue;
+    const l = local.entries.get(id);
+    const f = fleet.entries.get(id);
+
+    if (l !== undefined && f === undefined) { chosen.set(id, { entry: l, side: 'local' }); continue; }
+    if (l === undefined && f !== undefined) { chosen.set(id, { entry: f, side: 'fleet' }); continue; }
+
+    // Same id on both sides. Identical text is not a conflict.
+    if (l.raw === f.raw || l.content === f.content) { chosen.set(id, { entry: l, side: 'both' }); unchanged += 1; continue; }
+
+    const verdict = decide(l, f, context);
+    chosen.set(id, { entry: verdict.winner === 'local' ? l : f, side: verdict.winner });
+    decisions.push({ id, winner: verdict.winner, layer: verdict.layer, reason: verdict.reason });
+  }
+
+  // Prose is a union; it cannot conflict because it has no identity to conflict on.
+  const localProse = new Set(local.prose);
+  const proseOut = [...local.prose];
+  for (const line of fleet.prose) if (!localProse.has(line)) proseOut.push(line);
+
+  // Entries: local document order first (so the machine's own structure survives), then fleet-only ids in fleet order.
+  const entryLines = [];
+  for (const line of String(localText ?? '').split('\n')) {
+    const parsed = parseEntry(line);
+    if (parsed === null || !chosen.has(parsed.id)) continue;
+    const pick = chosen.get(parsed.id);
+    if (!entryLines.some((e) => e.id === parsed.id)) entryLines.push({ id: parsed.id, raw: pick.entry.raw });
+  }
+  for (const line of String(fleetText ?? '').split('\n')) {
+    const parsed = parseEntry(line);
+    if (parsed === null || !chosen.has(parsed.id)) continue;
+    if (!entryLines.some((e) => e.id === parsed.id)) entryLines.push({ id: parsed.id, raw: chosen.get(parsed.id).entry.raw });
+  }
+
+  const audit = [
+    '<!-- fleet-merge: decisions are recorded so a wrong rule is visible after the fact -->',
+    ...decisions.map((d) => `<!-- ${d.id} -> ${d.winner} (${d.layer}): ${d.reason} -->`),
+    ...unresolved.map((u) => `<!-- ${u.id} UNRESOLVED: ${u.reason} -->`),
+    ...refused.map((r) => `<!-- ${r.id} REFUSED: ${r.reason} -->`),
+  ];
+
+  const text = [
+    ...proseOut,
+    ...entryLines.map((e) => e.raw),
+    ...audit,
+  ].join('\n');
+
+  return {
+    text,
+    decisions,
+    unresolved,
+    refused,
+    added: [...fleet.entries.keys()].filter((id) => !local.entries.has(id) && !broken.has(id)),
+    removed: [...local.entries.keys()].filter((id) => !fleet.entries.has(id) && !broken.has(id)),
+    unchanged,
+    wroteAnything: false,
+  };
+}

package/src/plugin/tools.mjs

@@ -104,6 +104,9 @@ import { appendMemory, readMemorySync } from '../agent/memory.mjs';
 // plugin asserting a claim on its own behalf, which is the sender's job.
 import { acceptBlock, verifyBlock } from '../agent/blocks.mjs';
 import { acceptWithAuthority } from '../agent/field-authority.mjs';
+// v1.0.11: the merge rule (#2b) lives in its own module so the operator's two layers can be tested as a rule,
+// exhaustively, without a profile or a relay.
+import { mergeMemory } from './fleet-merge.mjs';
 
 // The base-address rules live in one place (§2), shared with the agent side. Importing the - rather
 // than re-deriving them her - is what stops the plugin and the agent from disagreeing about what
@@ -208,7 +211,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.0.9';
+const PLUGIN_VERSION = '1.0.11';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -5141,13 +5144,15 @@ export async function apply(ctx, config = {}) {
        */
       action: {
         type: 'string',
-        enum: ['read', 'publish', 'pull', 'latest'],
+        enum: ['read', 'publish', 'pull', 'latest', 'diff', 'merge'],
         description:
           'read (default) = answer from memory. publish = upload the curated collective memory '
           + '(`fleet-memory.md`) to the relay as a content-addressed blob and return its SHA-256. latest = ask the '
-          + 'relay which blob this fleet published last (the discovery half of the channel). pull = fetch one blob '
-          + 'by SHA-256 -- or by "latest" -- and return its text, re-hashing what came back against the name it was '
-          + 'asked for. None of these modifies the local file.',
+          + 'relay which blob this fleet published last. pull = fetch one blob by SHA-256 -- or by "latest" -- and '
+          + 'return its text, re-hashing it. diff = compare the local document against the fleet current blob and '
+          + 'report what differs. merge = apply the declared conflict rule (newest wins by default; a declared '
+          + 'repair of the default flow outranks recency) and return the merged text with every decision recorded. '
+          + '**No action modifies the local file.**',
         default: 'read',
       },
       hash: {
@@ -5464,6 +5469,260 @@ export async function apply(ctx, config = {}) {
         });
       }
 
+      /**
+       * v1.0.10 (#2a): **compare** this machine's collective memory against the fleet's current blob. Writes nothing.
+       *
+       * ## Why this exists before merge does
+       *
+       * "Merge" needs a conflict rule -- *when two machines assert different facts, who wins?* -- and that is a
+       * product decision, not an implementation detail. Shipping a merge before its rule is how a fleet silently
+       * loses one machine's memory.
+       *
+       * What needs no decision is the half that **prevents harm**: telling a caller whether their local document is
+       * the newest one, and what would be lost if they published over the fleet's copy. That is this action.
+       *
+       * ## Why a set comparison instead of a diff
+       *
+       * `same` is decided by **whole-document hash equality**, not by the absence of line differences: two documents
+       * with identical line sets in a different order are not the same, and reporting them as the same would hide an
+       * order change. The line sets are then reported as `local_only` / `fleet_only` -- deliberately *not* a diff,
+       * because a diff would report "moved" versus "changed" and then want a merge policy. **A set comparison cannot
+       * resolve anything, which is the property this step needs.**
+       *
+       * ## Why it re-hashes the fleet copy
+       *
+       * Comparing unverified content would launder it: the report would give a hash-verified-looking answer about
+       * bytes nobody checked. A blob that fails its own name is reported as unverified, never compared.
+       */
+      if (typeof args?.action === 'string' && args.action === 'diff') {
+        const file = collectivePath();
+        if (file === null) {
+          throw new W2MError('W2M_CONFIG', 'W2M_CONFIG: there is no profile to compare collective memory from', {
+            hint: 'the collective layer lives beside the profile that mounted this plugin',
+          });
+        }
+        let localBytes;
+        try {
+          localBytes = await fs.readFile(file);
+        } catch {
+          throw new W2MError('W2M_NOT_FOUND', `W2M_NOT_FOUND: no collective memory to compare at ${file}`, {
+            hint: 'write measured facts to it first; this action compares, it does not create',
+          });
+        }
+        const localHash = createHash('sha256').update(localBytes).digest('hex');
+        const base = requireRabbit(cfg);
+        const token = await resolveToken(cfg);
+
+        const pointer = await request({
+          rabbitUrl: base,
+          token,
+          pathname: '/v1/fleet/blobs/latest',
+          signal: exec?.signal,
+        });
+        if (pointer.status === 404) {
+          // No fleet document yet: nothing to differ from. Reported as a state, not as an error.
+          return JSON.stringify({
+            ok: true,
+            same: false,
+            local: { hash: localHash, bytes: localBytes.length, file },
+            fleet: { present: false, reason: 'this fleet has published no blob yet' },
+            merged: false,
+            wrote_anything: false,
+          });
+        }
+        if (pointer.status !== 200) {
+          throw new W2MError(
+            'W2M_RABBIT_REFUSED',
+            `W2M_RABBIT_REFUSED: GET /v1/fleet/blobs/latest answered HTTP ${pointer.status}`,
+            { http_status: pointer.status, detail: pointer.error ?? null },
+          );
+        }
+        const fleetHash = String(pointer.json?.hash ?? '');
+        const fleetRes = await request({
+          rabbitUrl: base,
+          token,
+          pathname: `/v1/fleet/blobs/${fleetHash}`,
+          accept: 'application/octet-stream',
+          signal: exec?.signal,
+        });
+        if (fleetRes.status === 404) {
+          // The pointer is a hint (see #3): eviction can take the document it names.
+          return JSON.stringify({
+            ok: true,
+            same: false,
+            local: { hash: localHash, bytes: localBytes.length, file },
+            fleet: {
+              present: false,
+              pointed_at: fleetHash,
+              reason: 'the pointer names a blob that no longer exists (oldest-first eviction)',
+            },
+            merged: false,
+            wrote_anything: false,
+          });
+        }
+        if (fleetRes.status !== 200) {
+          throw new W2MError(
+            'W2M_RABBIT_REFUSED',
+            `W2M_RABBIT_REFUSED: GET /v1/fleet/blobs/${fleetHash} answered HTTP ${fleetRes.status}`,
+            { http_status: fleetRes.status, detail: fleetRes.error ?? null },
+          );
+        }
+        const fleetText = fleetRes.text ?? '';
+        const fleetActual = createHash('sha256').update(fleetText, 'utf8').digest('hex');
+        if (fleetActual !== fleetHash) {
+          throw new W2MError(
+            'W2M_BAD_BLOB',
+            `W2M_BAD_BLOB: the fleet blob ${fleetHash} hashes to ${fleetActual} instead`,
+            {
+              hint: 'refusing to compare unverified content -- a comparison over bytes nobody checked would '
+                + 'launder them',
+              expected: fleetHash,
+              actual: fleetActual,
+            },
+          );
+        }
+
+        const localText = localBytes.toString('utf8');
+        // Trailing whitespace only: leading whitespace is markdown structure, not noise.
+        const norm = (text) => new Set(text.split('\n').map((line) => line.replace(/\s+$/, '')));
+        const localLines = norm(localText);
+        const fleetLines = norm(fleetText);
+        const localOnly = [...localLines].filter((line) => !fleetLines.has(line));
+        const fleetOnly = [...fleetLines].filter((line) => !localLines.has(line));
+        return JSON.stringify({
+          ok: true,
+          same: localHash === fleetHash,
+          local: { hash: localHash, bytes: localBytes.length, lines: localLines.size, file },
+          fleet: {
+            present: true,
+            hash: fleetHash,
+            bytes: Buffer.byteLength(fleetText, 'utf8'),
+            lines: fleetLines.size,
+            published_at: pointer.json?.published_at ?? null,
+            published_by: pointer.json?.published_by ?? null,
+          },
+          differing_lines: localOnly.length + fleetOnly.length,
+          preview: {
+            local_only: localOnly.slice(0, 20),
+            fleet_only: fleetOnly.slice(0, 20),
+            truncated: localOnly.length > 20 || fleetOnly.length > 20,
+          },
+          merged: false,
+          wrote_anything: false,
+          note: 'a comparison only. Merge has no conflict rule yet, so nothing is resolved and nothing is written.',
+        });
+      }
+
+      /**
+       * v1.0.11 (#2b): merge this machine's collective memory with the fleet's current blob, **under the operator's
+       * rule**, and still write nothing.
+       *
+       * ## The rule (the operator's, quoted)
+       *
+       * > 默认最新的赢；如果是修复默认流程，最全 & 验证最全面的有最后修改权。
+       *
+       * The two layers are implemented in `src/plugin/fleet-merge.mjs`: newest publication wins by default, and a
+       * declared repair of the default flow outranks recency. **The operationalisation is that module's; this branch
+       * only supplies the inputs.**
+       *
+       * ## Why the result is returned rather than written
+       *
+       * The local file is this machine's only copy, and half of a merge's input arrived over the network. **Letting
+       * one round trip rewrite it would hand a remote party a write into local memory.** So the merged text comes
+       * back in the result, decisions and all, and the caller decides.
+       *
+       * ## Recency inputs, named
+       *
+       * `localAddedAtMs` is the file's mtime; `fleetAddedAtMs` is the relay's `published_at` for the pointer's blob.
+       * Both are compared as milliseconds. **Neither is a claim about content** -- which is exactly why they are only
+       * the tie-break of last resort under the default layer.
+       */
+      if (typeof args?.action === 'string' && args.action === 'merge') {
+        const file = collectivePath();
+        if (file === null) {
+          throw new W2MError('W2M_CONFIG', 'W2M_CONFIG: there is no profile to merge collective memory from', {
+            hint: 'the collective layer lives beside the profile that mounted this plugin',
+          });
+        }
+        let localBytes;
+        let localStat;
+        try {
+          localBytes = await fs.readFile(file);
+          localStat = await fs.stat(file);
+        } catch {
+          throw new W2MError('W2M_NOT_FOUND', `W2M_NOT_FOUND: no collective memory to merge at ${file}`, {
+            hint: 'merge needs a local document; it compares against the fleet copy, it does not create one',
+          });
+        }
+        const localHash = createHash('sha256').update(localBytes).digest('hex');
+        const base = requireRabbit(cfg);
+        const token = await resolveToken(cfg);
+
+        const pointer = await request({ rabbitUrl: base, token, pathname: '/v1/fleet/blobs/latest', signal: exec?.signal });
+        if (pointer.status === 404) {
+          return JSON.stringify({
+            ok: true, merged: false, wrote_anything: false,
+            local: { hash: localHash, bytes: localBytes.length, file },
+            reason: 'this fleet has published no blob yet, so there is nothing to merge with. Publishing comes first.',
+          });
+        }
+        if (pointer.status !== 200) {
+          throw new W2MError('W2M_RABBIT_REFUSED', `W2M_RABBIT_REFUSED: GET /v1/fleet/blobs/latest answered HTTP ${pointer.status}`, {
+            http_status: pointer.status, detail: pointer.error ?? null,
+          });
+        }
+        const fleetHash = String(pointer.json?.hash ?? '');
+        const fleetRes = await request({
+          rabbitUrl: base, token, pathname: `/v1/fleet/blobs/${fleetHash}`,
+          accept: 'application/octet-stream', signal: exec?.signal,
+        });
+        if (fleetRes.status !== 200) {
+          throw new W2MError('W2M_NOT_FOUND', `W2M_NOT_FOUND: the fleet pointer names ${fleetHash}, which answered HTTP ${fleetRes.status}`, {
+            hint: 'the pointer is a hint (see #3); oldest-first eviction can remove the blob it names',
+            prescribed: 'publish from a machine in this fleet to establish a current document again',
+          });
+        }
+        const fleetText = fleetRes.text ?? '';
+        const fleetActual = createHash('sha256').update(fleetText, 'utf8').digest('hex');
+        if (fleetActual !== fleetHash) {
+          throw new W2MError('W2M_BAD_BLOB', `W2M_BAD_BLOB: the fleet blob ${fleetHash} hashes to ${fleetActual} instead`, {
+            hint: 'refusing to merge unverified content', expected: fleetHash, actual: fleetActual,
+          });
+        }
+
+        const fleetPublishedAt = Date.parse(String(pointer.json?.published_at ?? ''));
+        const outcome = mergeMemory({
+          localText: localBytes.toString('utf8'),
+          localAddedAtMs: Number.isFinite(localStat.mtimeMs) ? localStat.mtimeMs : 0,
+          localHash,
+          fleetText,
+          fleetAddedAtMs: Number.isFinite(fleetPublishedAt) ? fleetPublishedAt : 0,
+          fleetHash,
+        });
+
+        return JSON.stringify({
+          ok: true,
+          merged: true,
+          wrote_anything: false,
+          rule: 'default: newest publication wins; a declared repair of the default flow outranks recency, and between '
+            + 'two repairs the one with the higher (evidence + 2 x verified) wins',
+          local: { hash: localHash, bytes: localBytes.length, file, added_at_ms: Math.round(localStat.mtimeMs) },
+          fleet: {
+            hash: fleetHash, bytes: Buffer.byteLength(fleetText, 'utf8'),
+            published_at: pointer.json?.published_at ?? null, published_by: pointer.json?.published_by ?? null,
+          },
+          decisions: outcome.decisions,
+          unresolved: outcome.unresolved,
+          refused: outcome.refused,
+          unchanged: outcome.unchanged,
+          added: outcome.added,
+          removed: outcome.removed,
+          merged_text: outcome.text,
+          next: 'this result is text only. Writing it back is the caller\'s decision -- a merge does not edit the '
+            + 'document it read.',
+        });
+      }
+
       const limitRaw = Number(args?.limit);
       const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? Math.min(Math.floor(limitRaw), 500) : 20;