@twinsearth/w2m-dsh-plugin 1.1.14 → 1.1.16

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.14", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.16", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.1.14",
+  "version": "1.1.16",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "main": "lib/index.js",
@@ -129,13 +129,13 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:admission": "node --test --test-force-exit test/admission.test.mjs",
     "test:admission-routes": "node --test --test-force-exit test/admission-routes.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs",
     "test:approval-gate": "node --test --test-force-exit test/approval-gate.test.mjs",
     "test:approval-index": "node --test --test-force-exit test/approval-index.test.mjs",
     "test:authority": "node --test --test-force-exit test/authority.test.mjs",
@@ -173,7 +173,9 @@
     "test:test-report": "node --test --test-force-exit test/test-report.test.mjs",
     "test:tools": "node --test --test-force-exit test/tools.test.mjs",
     "verify": "node scripts/check-entrypoints.mjs && node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/tools.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/p2p-node.test.mjs test/p2p-agent.test.mjs test/client-bundle.test.mjs test/loader-entry.test.mjs",
-    "verify:join": "node scripts/verify-join.mjs"
+    "verify:join": "node scripts/verify-join.mjs",
+    "test:exec-env": "node --test --test-force-exit test/exec-env-injection.test.mjs",
+    "test:account-join": "node --test --test-force-exit test/account-join.test.mjs"
   },
   "keywords": [
     "dsh-bundle",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.1.14",
+  "version": "1.1.16",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/agent/agent.mjs

@@ -3011,11 +3011,28 @@ export function createAgent(options) {
           break;
         }
 
+        /**
+         * v1.1.15 (P1): the executed command learns which machine and which slice it is.
+         *
+         * Values come from the OFFER, never from argv, so a fleet-wide split cannot be reshaped by one machine.
+         * W2M_STAGE_INDEX is separate from W2M_INDEX: for a split over four machines, each runs one stage (0) but they
+         * are machines 0..3, and conflating the two would make "print my index" print 0 everywhere.
+         */
+        const taskEnv = {
+          W2M_INDEX: String(Number.isInteger(offer.index) ? offer.index : 0),
+          W2M_INDEX_TOTAL: String(Number.isInteger(offer.index_total) ? offer.index_total : 1),
+          W2M_STAGE_INDEX: String(Number.isInteger(stage.index) ? stage.index : 0),
+          W2M_TASK_ID: String(offer.task_id ?? ''),
+          W2M_MODE: String(offer.mode ?? ''),
+          W2M_MACHINE_ID: String(offer.machine_id ?? ''),
+          W2M_MACHINE_NAME: String(offer.machine_name ?? ''),
+        };
         const ran = await runArgv(stage.command_argv, {
           cwd: stageCwdOutcome.cwd,
           timeoutMs: remainingMs,
           maxOutputBytes,
           signal: controller.signal,
+          env: taskEnv,
         });
         execution = ran;
         for (const warning of ran.warnings) if (!warnings.includes(warning)) warnings.push(warning);

package/src/plugin/account-join.mjs

@@ -0,0 +1,86 @@
+/**
+ * The fallback joining path, as the client actually walks it.
+ *
+ * ## Why this is a separate, injectable function
+ *
+ * The old path fails for three named reasons only (see join-degradation.mjs), and then this runs: ask for a challenge,
+ * sign it with the account key, submit the proof, wait for a human (or the ten-second popup) to decide. Every one of
+ * those steps can be slow or refuse, and the whole thing must be testable without a relay, a fleet, or a person.
+ *
+ * ## The two rules this encodes, both learned the hard way
+ *
+ * - **A rejection is final.** Re-asking after a "no" turns a decision into a notification queue and harasses the members
+ *   who said no. Only a caller that explicitly resets may try again.
+ * - **Give up loudly.** If the request is never decided, the caller must be told which state it ended in (expired,
+ *   pending past the deadline) rather than being left with a promise that never settles.
+ */
+import { signChallenge } from '../util/account-identity.mjs';
+
+/** Terminal states from the relay. \`pending\` is NOT terminal: it means "still waiting". */
+const TERMINAL = new Set(['approved', 'rejected', 'expired']);
+
+/**
+ * @param {{request: Function, identity: {fingerprint: string, privateKey: unknown},
+ *          machine: {machine_id: string, machine_name?: string},
+ *          basePath?: string, pollIntervalMs?: number, maxPolls?: number, sleep?: Function,
+ *          now?: () => number}} deps
+ * @returns {Promise<{ok: boolean, state: string, device_token?: string, request_id?: string, code?: string}>}
+ */
+export async function joinByAccount({
+  request,
+  identity,
+  machine,
+  basePath = '',
+  pollIntervalMs = 1000,
+  maxPolls = 30,
+  sleep = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); }),
+}) {
+  if (typeof request !== 'function') throw new TypeError('request must be a function');
+  if (!identity || typeof identity.fingerprint !== 'string') throw new TypeError('identity with a fingerprint is required');
+  if (!machine || typeof machine.machine_id !== 'string' || machine.machine_id === '') throw new TypeError('machine.machine_id is required');
+
+  const challenge = await request({
+    method: 'GET',
+    pathname: basePath + '/v1/fleet/admission/challenge',
+    query: { fingerprint: identity.fingerprint, machine_id: machine.machine_id },
+  });
+  if (challenge?.ok !== true) {
+    return { ok: false, state: 'error', code: challenge?.error?.code ?? 'CHALLENGE_REFUSED' };
+  }
+  const signature = signChallenge(identity, [challenge.json.challenge_id, challenge.json.nonce, identity.fingerprint, machine.machine_id].join('|'));
+
+  const submitted = await request({
+    method: 'POST',
+    pathname: basePath + '/v1/fleet/admission/request',
+    body: { machine_id: machine.machine_id, machine_name: machine.machine_name ?? null, challenge_id: challenge.json.challenge_id, signature },
+  });
+  if (submitted?.ok !== true) {
+    return { ok: false, state: 'error', code: submitted?.error?.code ?? 'REQUEST_REFUSED' };
+  }
+  let state = submitted.json.state ?? 'pending';
+  const requestId = submitted.json.request_id ?? null;
+  const pollToken = submitted.json.poll_token ?? null;
+
+  for (let attempt = 0; attempt < maxPolls && !TERMINAL.has(state); attempt += 1) {
+    if (attempt > 0) await sleep(pollIntervalMs);
+    const polled = await request({
+      method: 'GET',
+      pathname: basePath + '/v1/fleet/admission/' + encodeURIComponent(requestId ?? ''),
+      query: { poll_token: pollToken ?? '' },
+    });
+    if (polled?.ok !== true) {
+      return { ok: false, state: 'error', code: polled?.error?.code ?? 'POLL_REFUSED' };
+    }
+    state = polled.json.state ?? state;
+    if (TERMINAL.has(state)) {
+      return { ok: state === 'approved', state, request_id: requestId, device_token: polled.json.device_token };
+    }
+  }
+  // Not terminal within the budget: report the state we ended in rather than hanging.
+  return { ok: false, state, request_id: requestId, code: TERMINAL.has(state) ? undefined : 'STILL_PENDING' };
+}
+
+/** True only for a state a caller may treat as an answer. Exported so callers do not re-derive it. */
+export function isTerminalAdmissionState(state) {
+  return TERMINAL.has(state);
+}

package/src/plugin/tools.mjs

@@ -1,4 +1,4 @@
-/**
+/**
  * DSH: Windows2MacO - the DSH Cordis plugin.
  *
  * # What this exposes
@@ -108,6 +108,8 @@ import { acceptWithAuthority } from '../agent/field-authority.mjs';
 // exhaustively, without a profile or a relay.
 import { mergeMemory } from './fleet-merge.mjs';
 import { shouldDegrade } from './join-degradation.mjs';
+import { deriveAccountKeypair } from '../util/account-identity.mjs';
+import { joinByAccount } from './account-join.mjs';
 
 // The base-address rules live in one place (§2), shared with the agent side. Importing the - rather
 // than re-deriving them her - is what stops the plugin and the agent from disagreeing about what
@@ -212,7 +214,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.1.14';
+const PLUGIN_VERSION = '1.1.16';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -6136,6 +6138,39 @@ export async function apply(ctx, config = {}) {
         }
         const actor = { id: typeof args?.actor_id === 'string' && args.actor_id.trim() !== '' ? args.actor_id.trim() : cfg.machineName, level: args.actor_level };
         const outcome = action === 'approve' ? 'approved' : 'rejected';
+        /**
+         * v1.1.16: a fleet-admission request is settled at the RELAY, because that is where the request lives and where
+         * the quorum rules are enforced. The local index would accept the write and change nothing that matters.
+         *
+         * The actor id is the person answering; the relay records it on the decision. A refusal is reported as such
+         * (`ALREADY_DECIDED` included) rather than thrown: the caller is looking at a list that may be a second old.
+         */
+        if (/^adm-/.test(approvalId)) {
+          const decideDevice = await readDevice(cfg);
+          const decideRelay = cfg.rabbitUrl ?? null;
+          const settled = decideRelay === null || decideDevice.device_token === null
+            ? { ok: false, json: { code: 'W2M_NO_RELAY' } }
+            : await request({
+              rabbitUrl: decideRelay,
+              token: requireToken(decideDevice),
+              method: 'POST',
+              pathname: '/v1/fleet/admission/' + encodeURIComponent(approvalId) + '/decide',
+              body: { decision: action === 'approve' ? 'approve' : 'reject', decided_by: actor.id, auto: false },
+            });
+          return JSON.stringify({
+            ok: settled?.ok === true,
+            action,
+            approval_id: approvalId,
+            kind: 'fleet_admission',
+            settled: settled?.ok === true ? outcome : null,
+            reason_code: settled?.ok === true ? null : (settled?.json?.error?.code ?? settled?.json?.code ?? settled?.error?.code ?? null),
+            detail: settled?.ok === true ? null : (settled?.json?.error?.message ?? null),
+            acted_by: actor,
+            note: settled?.ok === true
+              ? 'the machine is admitted; it will appear in w2m_devices once its agent reconnects'
+              : 'the decision was refused; the request is unchanged (already decided requests are normal when the ten-second window has passed)',
+          });
+        }
         const result = queue.decide(approvalId, actor, outcome);
         return JSON.stringify({
           ok: result.ok === true,
@@ -6159,6 +6194,43 @@ export async function apply(ctx, config = {}) {
       };
       // An actor with no level still gets the list: knowing what is waiting does not require the authority to
       // answer it, and a queue only its supervisors can see is a queue that stays full.
+      /**
+       * v1.1.16: a machine waiting to join the fleet is a request waiting for a human, which is what this tool is.
+       *
+       * It is NOT a permission escalation, so it must not be shoved through `approvalRequestFor` -- that shape requires
+       * a needs-approval verdict and a capability, and faking one would record a lie in the audit trail. The list is
+       * shared; the store underneath is not.
+       *
+       * The countdown uses the RELAY's clock: `requested_at_ms` was stamped there, and three machines in this fleet
+       * disagree on the time by tens of seconds. A local-clock countdown would fire the automatic approval early on a
+       * fast machine and late on a slow one. The relay still owns the decision (it refuses to auto-approve with no
+       * member online); this is display only.
+       */
+      let admissionRows = [];
+      try {
+        const admissionDevice = await readDevice(cfg);
+        const admissionRelay = cfg.rabbitUrl ?? null;
+        // A relay URL and a device token are what the rest of this file passes on every authenticated call; omitting
+        // them made this request throw into the catch below, which is why the merged rows were silently missing.
+        const admissionPending = admissionRelay === null || admissionDevice.device_token === null
+          ? { ok: false }
+          : await request({ rabbitUrl: admissionRelay, token: requireToken(admissionDevice), method: 'GET', pathname: '/v1/fleet/admission/pending' });
+        if (admissionPending?.ok === true && Array.isArray(admissionPending.json?.pending)) {
+          const relayNow = Date.parse(String(admissionPending.json.rabbit_time ?? '')) || Date.now();
+          admissionRows = admissionPending.json.pending.map((row) => ({
+            approval_id: row.request_id,
+            kind: 'fleet_admission',
+            machine_id: row.machine_id ?? null,
+            machine_name: row.machine_name ?? null,
+            requested_at_ms: row.requested_at_ms ?? null,
+            countdown_ms: Number.isFinite(row.requested_at_ms) ? Math.max(0, 10_000 - (relayNow - row.requested_at_ms)) : null,
+            may_act: true,
+            note: 'approving admits this machine to the fleet; the ten-second window is enforced by the relay and needs a member online',
+          }));
+        }
+      } catch {
+        // The approval list must still work when the relay is unreachable: the permission queue is local.
+      }
       const rows = queue.listFor(
         actor.level === null ? { id: actor.id, level: 0 } : actor,
         { includeSettled: args?.include_settled === true },
@@ -6170,8 +6242,8 @@ export async function apply(ctx, config = {}) {
         as: actor,
         level_known: actor.level !== null,
         summary,
-        count: rows.length,
-        rows,
+        count: rows.length + admissionRows.length,
+        rows: rows.concat(admissionRows),
         note: actor.level === null
           ? 'no actor_level was supplied, so may_act is reported as if the level were 0: the queue is visible, but whether you may answer any of it is not known'
           : 'may_act reflects the actor_level supplied',
@@ -6716,6 +6788,44 @@ async function startLocalStack(ctx, cfg) {
          */
         const reason = error?.reason_code ?? error?.code ?? null;
         const degrade = shouldDegrade(reason);
+        if (degrade === true && key !== null) {
+          /**
+           * v1.1.15: the fallback path, finally called.
+           *
+           * Two invariants are load-bearing here:
+           *
+           * 1. the seed is the FLEET KEY, never the account code -- the account code is written to the log two
+           *    hundred lines above, and deriving a signing key from a value anyone can read would hand out the
+           *    account's identity;
+           * 2. the machine id comes from the agent object that is already in this scope, not from device.json --
+           *    this machine never paired, so it has no device.json, which is the entire situation.
+           *
+           * A failure here does not change the outcome of the old attempt: the caller still sees
+           * `{paired: false, degrade: true}` and can retry later. It must not throw out of this catch block.
+           */
+          try {
+            const localMachineId = typeof agent?.runtime?.machineId === 'string' ? agent.runtime.machineId
+              : (typeof agent?.machineId === 'string' ? agent.machineId : '');
+            if (localMachineId !== '') {
+              const joined = await joinByAccount({
+                request,
+                identity: deriveAccountKeypair(key),
+                machine: { machine_id: localMachineId, machine_name: cfg.machineName ?? null },
+                maxPolls: 10,
+              });
+              if (joined.ok === true && typeof joined.device_token === 'string') {
+                saveDeviceToken(joined.device_token, identityOptions);
+                ctx.logger?.info?.('w2m: joined by account admission (' + joined.state + ')');
+                return { paired: true, by: 'account-admission' };
+              }
+              ctx.logger?.warn?.('w2m: account admission did not admit this machine (' + joined.state + (joined.code ? '/' + joined.code : '') + ')');
+            } else {
+              ctx.logger?.warn?.('w2m: no local machine id, so the account-admission fallback cannot ask to join');
+            }
+          } catch (fallbackError) {
+            ctx.logger?.warn?.('w2m: account-admission fallback failed: ' + (fallbackError instanceof Error ? fallbackError.message : String(fallbackError)));
+          }
+        }
         ctx.logger?.warn?.(`w2m: pairing by ${by} failed${reason === null ? '' : ' (' + String(reason) + ')'}: ${error instanceof Error ? error.message : String(error)}`);
         return { paired: false, by, reason_code: reason, degrade };
       }

package/src/relay/admission.mjs

@@ -1,3 +1,4 @@
+import { randomBytes } from 'node:crypto';
 /**
  * Fleet admission: who may join a fleet, who may be removed, and by how many votes.
  *
@@ -111,8 +112,9 @@ export function createAdmission(options = {}) {
       request_id, machine_id, machine_name, account_fingerprint, fleet_id,
       state: ADMISSION.PENDING, requested_at_ms: now(), decided_at_ms: null,
       decided_by: null, auto: false,
+      poll_token: randomBytes(16).toString('hex'),
     });
-    return { ok: true, request_id, state: ADMISSION.PENDING };
+    return { ok: true, request_id, state: ADMISSION.PENDING, poll_token: requests.get(request_id).poll_token };
   }
 
   function getRequest(request_id) {
@@ -231,9 +233,18 @@ export function createAdmission(options = {}) {
     return r === undefined ? null : { removal_id: r.removal_id, target_machine_id: r.target_machine_id, state: r.state, need: r.need, snapshot: [...r.snapshot], yes: [...r.votes.values()].filter((v) => v === 'yes').length, no: [...r.votes.values()].filter((v) => v === 'no').length, votes: r.votes.size };
   }
 
+  /** Poll without a device token: the asking machine has none. The token is the credential, and it is not guessable from the id. */
+  function poll(request_id, poll_token) {
+    const r = requests.get(request_id);
+    if (r === undefined || typeof poll_token !== 'string' || poll_token === '' || r.poll_token !== poll_token) {
+      return { ok: false, code: 'NOT_FOUND' };
+    }
+    return { ok: true, request_id, state: r.state };
+  }
+
   function pendingFor() {
     return [...requests.values()].filter((r) => r.state === ADMISSION.PENDING).map((r) => ({ ...r }));
   }
 
-  return { requestAdmission, decide, tick, getRequest, pendingFor, remove, vote, getRemoval, isMember, memberOf, setOnline, seedFounder, _members: members };
+  return { requestAdmission, decide, tick, getRequest, pendingFor, poll, remove, vote, getRemoval, isMember, memberOf, setOnline, seedFounder, _members: members };
 }