@twinsearth/w2m-dsh-plugin 1.1.2 → 1.1.14

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.1.2"
+    "version": "1.1.14"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.1.2",
+      "version": "1.1.14",
       "author": {
         "name": "TwinsEarth"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.1.2",
+  "version": "1.1.14",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -2,6 +2,91 @@
 
 All notable changes to this project are documented here.
 
+## [1.1.14] — 2026-10-17
+
+**A new machine joins by itself, and a machine that cannot join the old way can now prove its account and ask.**
+
+### Joining is on by default
+
+`autoStartAgent` now defaults to **true**. The old expression was `config.autoStartAgent === true`, which made joining
+opt-IN, and the observed defect was a machine that was installed, running, and simply not in the fleet -- "installed,
+paired: false" with no hint of why. `false` is still the way to turn it off.
+
+Making this the default required changing the meaning of the tests that intentionally ran without an agent: eight suites
+now pin `autoStartAgent: false` through one `applyPinned` wrapper each, and the single case that asserts a STARTED node
+exits cleanly passes `autoStartAgent: true` inside its own template script. Two bugs were found while doing it, and both
+are recorded because they are the shape of this kind of change: inserting a key into object literals with a regex broke a
+file, and replacing call sites after defining the wrapper made the wrapper call itself.
+
+### Admission: who may join, who may be removed
+
+The relay gains a fleet-admission state machine and five routes: `admission/request`, `admission/pending`,
+`admission/{id}/decide`, `members/{id}/remove`, `removals/{id}/vote`, plus `admission/challenge`.
+
+* a request is `pending` and grants nothing until approved;
+* **10 seconds without a decision auto-approves**, but only while at least one member is online -- an empty fleet cannot
+  consent, and that refusal is a named `NO_ONLINE_MEMBER`;
+* inside **24 hours** any online member may remove a new member immediately; after 24 hours a single machine may only
+  OPEN a vote, and the quorum set is **frozen at open time** so a voter going offline mid-vote cannot move the bar;
+* the quorum is the operator's: 3+ old members need >= 50% rounded up, a two-member fleet needs one vote;
+* old members are ordered by **insertion sequence**, not timestamps -- two machines approved inside the same millisecond
+  are equal on the clock but still have an order, and a quorum that depends on a sub-millisecond race is not a quorum.
+
+### An unpaired machine can prove its account
+
+A machine whose pairing failed has no device_token, which is the situation the fallback exists for -- so the two routes
+it needs are reachable **without** one, authorised instead by an account signature:
+
+* the account gains a **derived Ed25519 identity** (`account-identity.mjs`): the same account material yields the same
+  keypair on every machine, which is what makes zero-configuration joining possible at all;
+* the public key is registered with the relay **when that account's first machine pairs** -- the only moment the relay has
+  proof of the account -- and the first key wins (a different key is refused, not silently accepted);
+* a one-time, five-minute challenge is signed and verified against it; the challenge is consumed on any attempt, the
+  signature binds `machine_id`, and issuing is rate limited **per fingerprint**;
+* the fingerprint the relay acts on comes from the **verified signature**, never from the request body.
+
+### Deliberately not in this release
+
+The client-side consumption of `degrade: true` (challenge -> request -> poll) and the approval UI (10s popup plus a
+standing dialog) are **not** shipped. The server half is tested; the client half is not written, and shipping a
+mechanism whose client does not call it is the failure this project has recorded seven times.
+
+### Verified
+
+Full gate: **GREEN**, 15 of 15 checks, twice. The suites this release touches directly: relay 163, tools 115, admission
+16, admission-routes 3, broadcast 19, join-challenge 8, account-identity 6, join-degradation 3, fleet-target 45.
+
+## [1.1.3] — 2026-10-17
+
+**A machine offline for more than 72 hours leaves the list. It is not deleted, and it comes back on its own.**
+
+### The rule, and why hiding is not deleting
+
+`readFleet` filters the roster at **the read path only**:
+
+* a machine whose `last_seen` is at least **72 hours** old is **not shown** by `w2m_devices` or the composer;
+* `records` still carries **every device the relay sent**, so nothing is lost and no bookkeeping is required;
+* a **missing or unparseable** `last_seen` is **not** archived -- an unknown age must not be read as "gone for three
+  days", or a relay that omits the field would empty the list;
+* `include_stale: true` shows the archived machines, which is the operator's audit route;
+* the machine returns by reporting again: the same record with a fresh timestamp is listed, with no re-pairing.
+
+Because the relay already stops leasing machines that are offline (v1.1.2), a hidden machine is also not a dispatch
+target -- the list and the dispatch agree, from one notion of liveness plus this display rule.
+
+### The fixtures were the reason this took two attempts
+
+The first attempt changed nothing in the filter and failed 8 tests: `fleet-target`'s roster fixtures carried **fixed
+dates** (`2026-10-09` … `2026-10-11`), which are more than 72 hours old *now*, so a correct filter archived all three
+machines. Making the timestamps **relative** (`Date.now() - 60s` …) fixed all 8 without touching a single assertion,
+which is the evidence that the filter was right and the fixture was the stale part.
+
+### Verified
+
+`test/fleet-target.test.mjs` gains four assertions -- hidden from the list, **records kept**, returns on its own and
+`include_stale` shows it meanwhile, unknown age not archived -- for **45 pass, 0 fail**. `test/tools.test.mjs` 115 and
+`test/relay.test.mjs` 160 remain green.
+
 ## [1.1.2] — 2026-10-17
 
 **A dispatch that names no machines now goes to the machines that are online. The rule that decides "online" had been

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.2", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.14", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.1.2",
+  "version": "1.1.14",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "main": "lib/index.js",
@@ -129,10 +129,13 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
+    "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
+    "test:admission": "node --test --test-force-exit test/admission.test.mjs",
+    "test:admission-routes": "node --test --test-force-exit test/admission-routes.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs",
     "test:approval-gate": "node --test --test-force-exit test/approval-gate.test.mjs",
     "test:approval-index": "node --test --test-force-exit test/approval-index.test.mjs",
     "test:authority": "node --test --test-force-exit test/authority.test.mjs",
@@ -155,6 +158,8 @@
     "test:fleet-sync": "node --test --test-force-exit test/fleet-sync.test.mjs",
     "test:health": "node --test --test-force-exit test/health.test.mjs",
     "test:installed-version": "node --test --test-force-exit test/installed-version.test.mjs",
+    "test:join-challenge": "node --test --test-force-exit test/join-challenge.test.mjs",
+    "test:join-degradation": "node --test --test-force-exit test/join-degradation.test.mjs",
     "test:layers": "node --test --test-force-exit test/layer-model.test.mjs",
     "test:log-bounds": "node --test --test-force-exit test/log-bounds.test.mjs",
     "test:memory": "node --test --test-force-exit test/memory.test.mjs",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.1.2",
+  "version": "1.1.14",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/fleet-target.mjs

@@ -156,6 +156,15 @@ export function isSelectableDevice(device) {
  * @param {string|null} localMachineId This machine's id, for the "this machine" mark.
  * @returns {object}
  */
+/**
+ * v1.1.3: how long a machine may be unheard from before it leaves the list.
+ *
+ * The operator's rule: offline for 72 hours is no longer shown, **nothing is deleted**, and it comes back on its own
+ * once it reports again. Hiding and deleting are deliberately different -- deleting would throw away the history of a
+ * machine that is merely switched off, and re-pairing would be the only way back.
+ */
+const ARCHIVE_AFTER_MS = 72 * 60 * 60 * 1000;
+
 export function describeTargetMachine(device, localMachineId = null) {
   const machineId = typeof device?.machine_id === 'string' && device.machine_id !== '' ? device.machine_id : null;
   return {
@@ -343,7 +352,7 @@ export function dispatchSelectionFields(selection, mode) {
  *   fields rather than this module's projection of them.
  */
 export async function readFleet(deps) {
-  const { rabbitUrl, token = null, localMachineId = null, signal, request } = deps;
+  const { rabbitUrl, token = null, localMachineId = null, signal, request, include_stale = false } = deps;
   if (typeof rabbitUrl !== 'string' || rabbitUrl === '') {
     return {
       ok: false,
@@ -397,7 +406,18 @@ export async function readFleet(deps) {
   const records = Array.isArray(result.json?.devices)
     ? result.json.devices
     : (Array.isArray(result.json?.machines) ? result.json.machines : []);
-  const machines = records.map((record) => describeTargetMachine(record, localMachineId));
+  const allMachines = records.map((record) => describeTargetMachine(record, localMachineId));
+  /**
+   * Archived means "not shown", never "removed": `records` still carries every device, so a caller that asks for the
+   * archived ones receives them. A missing or unparseable timestamp is NOT archived -- "unknown" must not be read as
+   * "gone for three days", or a relay that omits the field would empty the list.
+   */
+  const isArchived = (machine) => {
+    const raw = machine.last_seen;
+    const at = typeof raw === 'number' ? raw : Date.parse(String(raw ?? ''));
+    return Number.isFinite(at) && (Date.now() - at) >= ARCHIVE_AFTER_MS;
+  };
+  const machines = include_stale === true ? allMachines : allMachines.filter((machine) => !isArchived(machine));
   return {
     ok: true,
     error: null,
@@ -410,6 +430,7 @@ export async function readFleet(deps) {
     // Machines the relay still lists but whose lease is not live. Reported so "3 machines" is never
     // mistaken for "3 machines you can use".
     excluded: machines.filter((machine) => !machine.online).length,
+    archived: allMachines.length - machines.length,
   };
 }
 

package/src/plugin/join-degradation.mjs

@@ -0,0 +1,34 @@
+/**
+ * When may the old joining path give up and the new one take over?
+ *
+ * The operator's rule (2026-10-17): "旧机制优先，失败才降级". The whole value of a fallback is that it fires when the
+ * old path **cannot** work -- and the whole danger is that it fires when the old path merely hiccuped. A machine pushed
+ * into an approval queue because the network blipped for two seconds is worse than one that retried.
+ *
+ * So this is a whitelist of three reasons, and everything else is "retry the old path":
+ *
+ *   1. the pairing code is invalid or already used -- the old path can never succeed with it;
+ *   2. the relay is unreachable at the configured address -- no code will help;
+ *   3. pairing timed out -- the old path got its chance and did not finish.
+ *
+ * Everything else (401 on the operator token, a config error, a permission refusal, an unexpected 5xx) is a signal that
+ * something needs a human, **not** a signal to change mechanisms. Defaulting to `false` is deliberate: an unknown
+ * failure must not silently move a machine between flows.
+ */
+
+/** The only three reasons the old path may be abandoned. */
+export const DEGRADABLE_REASONS = Object.freeze([
+  'PAIRING_CODE_INVALID',
+  'RELAY_UNREACHABLE',
+  'PAIRING_TIMEOUT',
+]);
+
+/**
+ * @param {string|{reason_code?: string, code?: string, status?: number}} failure
+ * @returns {boolean} true only for the three whitelisted reasons.
+ */
+export function shouldDegrade(failure) {
+  const reason = typeof failure === 'string' ? failure : (failure?.reason_code ?? failure?.code ?? null);
+  if (typeof reason !== 'string') return false;
+  return DEGRADABLE_REASONS.includes(reason);
+}

package/src/plugin/tools.mjs

@@ -1,4 +1,4 @@
-/**
+/**
  * DSH: Windows2MacO - the DSH Cordis plugin.
  *
  * # What this exposes
@@ -107,6 +107,7 @@ import { acceptWithAuthority } from '../agent/field-authority.mjs';
 // v1.0.11: the merge rule (#2b) lives in its own module so the operator's two layers can be tested as a rule,
 // exhaustively, without a profile or a relay.
 import { mergeMemory } from './fleet-merge.mjs';
+import { shouldDegrade } from './join-degradation.mjs';
 
 // The base-address rules live in one place (§2), shared with the agent side. Importing the - rather
 // than re-deriving them her - is what stops the plugin and the agent from disagreeing about what
@@ -211,7 +212,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.1.2';
+const PLUGIN_VERSION = '1.1.14';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -687,7 +688,8 @@ function readConfig(config = {}) {
     machineName: typeof config.machineName === 'string' && config.machineName.trim() !== ''
       ? config.machineName.trim()
       : os.hostname(),
-    autoStartAgent: config.autoStartAgent === true,
+    // v1.1.6: joining is on by default; `false` is the only way off.
+    autoStartAgent: config.autoStartAgent !== false,
       /**
        * v0.8.3: the account-derived key this machine joins its fleet with.
        *
@@ -6704,10 +6706,18 @@ async function startLocalStack(ctx, cfg) {
         ctx.logger?.info?.(`w2m: paired by ${by}`);
         return { paired: true, by };
       } catch (error) {
-        // Named rather than swallowed: an agent that failed to pair runs and does nothing, which
-        // looks identical to a fleet with no work.
-        ctx.logger?.warn?.(`w2m: pairing by ${by} failed: ${error instanceof Error ? error.message : String(error)}`);
-        return { paired: false, by };
+        /**
+         * The failure is classified here, where the reason still exists.
+         *
+         * v1.1.6 adds a second joining path (account fingerprint + member approval) that may only take over when the
+         * FIRST path cannot work -- an invalid pairing code, an unreachable relay, a timeout. Anything else (a config
+         * error, a permission refusal) needs a human, and moving the machine between mechanisms would hide that. The
+         * classifier owns that rule; this only has to stop discarding the error before it can be read.
+         */
+        const reason = error?.reason_code ?? error?.code ?? null;
+        const degrade = shouldDegrade(reason);
+        ctx.logger?.warn?.(`w2m: pairing by ${by} failed${reason === null ? '' : ' (' + String(reason) + ')'}: ${error instanceof Error ? error.message : String(error)}`);
+        return { paired: false, by, reason_code: reason, degrade };
       }
     }
 

package/src/relay/admission.mjs

@@ -0,0 +1,239 @@
+/**
+ * Fleet admission: who may join a fleet, who may be removed, and by how many votes.
+ *
+ * ## Why this is a state machine and not a route handler
+ *
+ * Every rule the operator set is a *time window* or a *quorum*, and both are the kind of logic that reads correctly in
+ * a route handler and is wrong at the edges: a decision that arrives one millisecond after the automatic one, a vote
+ * whose quorum changes because a voter went offline mid-vote, a removal of the last member. None of that needs a socket,
+ * so none of it is tested through one -- the routes are thin wrappers over this file.
+ *
+ * ## The four operator decisions this encodes (2026-10-17)
+ *
+ * 1. the OLD mechanism stays the default; this one is the fallback, so nothing here is on any startup path yet;
+ * 2. `autoApproveMs = 10_000` -- but **never** with zero members online, because an empty fleet cannot consent;
+ * 3. a fleet of 2 needs 1 vote (= 50%), 3 or more needs >= 50% rounded up;
+ * 4. the quorum denominator is **currently online old members only**, so the set is **frozen when the vote opens**.
+ *
+ * ## Clock
+ *
+ * Every decision is stamped with `now()`, which the caller supplies. The default is `Date.now`; the tests pass a
+ * clock they control, and production uses the relay's clock. **No client clock is ever trusted** -- three machines in
+ * this fleet disagreed by tens of seconds, and a vote that opens or closes on a client clock is a vote an attacker
+ * schedules.
+ */
+
+/** Request states. A request that is not `approved` grants nothing. */
+export const ADMISSION = Object.freeze({
+  PENDING: 'pending',
+  APPROVED: 'approved',
+  REJECTED: 'rejected',
+  EXPIRED: 'expired',
+});
+
+/** Operator decision: 10s, and only while at least one member is online. */
+export const AUTO_APPROVE_MS = 10_000;
+/** A request nobody decided expires, so a machine cannot wait forever on a fleet that is gone. */
+export const REQUEST_TTL_MS = 24 * 60 * 60 * 1000;
+/** Removal is immediate inside this window; after it, a vote is required. */
+export const KICK_WINDOW_MS = 24 * 60 * 60 * 1000;
+/** How long a removal vote stays open. */
+export const VOTE_WINDOW_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * The quorum, as the operator stated it: 3+ old members needs >= 50% rounded up; a fleet of 2 needs **one** vote.
+ *
+ * `Math.ceil(n / 2)` would demand 2 votes from a two-member fleet, which makes removal impossible -- the operator
+ * called that out explicitly ("2 人小编队一人就行").
+ */
+export function neededVotes(onlineOldMembers) {
+  const n = Number.isInteger(onlineOldMembers) && onlineOldMembers > 0 ? onlineOldMembers : 0;
+  if (n === 0) return 0;
+  if (n <= 2) return 1;
+  return Math.ceil(n / 2);
+}
+
+/**
+ * @param {{now?: () => number, autoApproveMs?: number}} [options]
+ */
+export function createAdmission(options = {}) {
+  const now = typeof options.now === 'function' ? options.now : () => Date.now();
+  const autoApproveMs = Number.isInteger(options.autoApproveMs) ? options.autoApproveMs : AUTO_APPROVE_MS;
+
+  /** machine_id -> {joined_at_ms, fleet_id} for every APPROVED member. */
+  const members = new Map();
+  let joinSeq = 0;
+  /** request_id -> request record. */
+  const requests = new Map();
+  /** removal_id -> vote record. */
+  const removals = new Map();
+  let seq = 0;
+  const nextId = (prefix) => { seq += 1; return prefix + '-' + String(seq).padStart(4, '0'); };
+
+  const onlineMembers = () => [...members.keys()].filter((id) => members.get(id).online === true);
+
+  function seedFounder(machine_id, fleet_id = 'fleet-1', online = true) {
+    joinSeq += 1;
+    members.set(machine_id, { joined_at_ms: now(), fleet_id, online, join_seq: joinSeq });
+    return memberOf(machine_id);
+  }
+
+  function memberOf(machine_id) {
+    const m = members.get(machine_id);
+    return m === undefined ? null : { machine_id, joined_at_ms: m.joined_at_ms, fleet_id: m.fleet_id, online: m.online === true };
+  }
+
+  /** A pending request grants nothing: this is what the dispatch path asks. */
+  function isMember(machine_id) { return members.has(machine_id); }
+
+  function setOnline(machine_id, online) {
+    const m = members.get(machine_id);
+    if (m === undefined) return false;
+    m.online = online === true;
+    return true;
+  }
+
+  function requestAdmission({ machine_id, machine_name = null, account_fingerprint = null, fleet_id = 'fleet-1' }) {
+    if (typeof machine_id !== 'string' || machine_id === '') throw new Error('machine_id is required');
+    if (members.has(machine_id)) return { ok: true, already_member: true, state: ADMISSION.APPROVED, request_id: null };
+    // One open request per machine: re-requesting returns the same record rather than creating a queue.
+    for (const r of requests.values()) {
+      if (r.machine_id === machine_id && r.state === ADMISSION.PENDING) return { ok: true, request_id: r.request_id, state: r.state, replayed: true };
+    }
+    // A fleet with no members has nobody to approve, so the first machine founds it.
+    if (members.size === 0) {
+      joinSeq += 1;
+      members.set(machine_id, { joined_at_ms: now(), fleet_id, online: true, join_seq: joinSeq });
+      return { ok: true, state: ADMISSION.APPROVED, request_id: null, founder: true };
+    }
+    const request_id = nextId('adm');
+    requests.set(request_id, {
+      request_id, machine_id, machine_name, account_fingerprint, fleet_id,
+      state: ADMISSION.PENDING, requested_at_ms: now(), decided_at_ms: null,
+      decided_by: null, auto: false,
+    });
+    return { ok: true, request_id, state: ADMISSION.PENDING };
+  }
+
+  function getRequest(request_id) {
+    const r = requests.get(request_id);
+    return r === undefined ? null : { ...r };
+  }
+
+  /**
+   * Approve or reject. `auto` is recorded, because "nobody was watching" and "a person said yes" are different facts.
+   */
+  function decide(request_id, { decision, decided_by = null, auto = false }) {
+    const r = requests.get(request_id);
+    if (r === undefined) return { ok: false, code: 'NOT_FOUND' };
+    if (r.state !== ADMISSION.PENDING) return { ok: false, code: 'ALREADY_DECIDED', state: r.state };
+    if (decision !== 'approve' && decision !== 'reject') return { ok: false, code: 'BAD_DECISION' };
+    if (auto === true && onlineMembers().length === 0) {
+      // An empty fleet cannot consent. This is the one rule that must not be relaxed for convenience.
+      return { ok: false, code: 'NO_ONLINE_MEMBER' };
+    }
+    r.state = decision === 'approve' ? ADMISSION.APPROVED : ADMISSION.REJECTED;
+    r.decided_at_ms = now();
+    r.decided_by = decided_by;
+    r.auto = auto === true;
+    if (r.state === ADMISSION.APPROVED) {
+      joinSeq += 1;
+      members.set(r.machine_id, { joined_at_ms: r.decided_at_ms, fleet_id: r.fleet_id, online: true, join_seq: joinSeq });
+    }
+    return { ok: true, request_id, state: r.state, auto: r.auto };
+  }
+
+  /**
+   * Tick: applies the automatic approval and the request TTL. Called by the caller's timer, not by a setTimeout here,
+   * so a test controls time completely.
+   */
+  function tick() {
+    const t = now();
+    const decided = [];
+    for (const r of requests.values()) {
+      if (r.state !== ADMISSION.PENDING) continue;
+      const age = t - r.requested_at_ms;
+      if (age >= REQUEST_TTL_MS) { r.state = ADMISSION.EXPIRED; r.decided_at_ms = t; decided.push({ request_id: r.request_id, state: r.state }); continue; }
+      if (age >= autoApproveMs && onlineMembers().length > 0) {
+        r.state = ADMISSION.APPROVED; r.decided_at_ms = t; r.decided_by = 'auto'; r.auto = true;
+        joinSeq += 1;
+        members.set(r.machine_id, { joined_at_ms: t, fleet_id: r.fleet_id, online: true, join_seq: joinSeq });
+        decided.push({ request_id: r.request_id, state: r.state, auto: true });
+      }
+    }
+    return decided;
+  }
+
+  /**
+   * Remove a member.
+   *
+   * Inside KICK_WINDOW_MS of joining, any online member may do it immediately. After that, a single machine may only
+   * OPEN a vote: the quorum set is frozen here, at open time, so a voter going offline mid-vote cannot silently lower
+   * the bar (or raise it).
+   */
+  function remove(target_machine_id, { requested_by, reason = null }) {
+    const target = members.get(target_machine_id);
+    if (target === undefined) return { ok: false, code: 'NOT_A_MEMBER' };
+    if (requested_by === target_machine_id) return { ok: false, code: 'CANNOT_REMOVE_SELF' };
+    if (!members.has(requested_by)) return { ok: false, code: 'NOT_A_MEMBER' };
+    if (members.size <= 1) return { ok: false, code: 'LAST_MEMBER' };
+
+    const age = now() - target.joined_at_ms;
+    // Insertion order, not timestamps: two machines approved inside the same millisecond are equal on the clock but
+    // still have an order, and a quorum that depends on a sub-millisecond race is not a quorum.
+    const oldMembers = [...members.keys()].filter((id) => id !== target_machine_id
+      && (members.get(id).join_seq ?? 0) < (target.join_seq ?? 0));
+    const snapshot = oldMembers.filter((id) => members.get(id).online === true);
+
+    if (age <= KICK_WINDOW_MS) {
+      members.delete(target_machine_id);
+      return { ok: true, immediate: true, removed: target_machine_id };
+    }
+    const removal_id = 'rmv-' + String(seq += 1).padStart(4, '0');
+    const record = {
+      removal_id, target_machine_id, requested_by, reason,
+      snapshot: [...snapshot], recent_votes: snapshot.slice(0, 1),
+      votes: new Map(), state: 'open', opened_at_ms: now(), need: neededVotes(snapshot.length),
+    };
+    // The requestor counts as the first yes; the operator's "a single machine may initiate" implies that much.
+    if (record.recent_votes.includes(requested_by)) record.votes.set(requested_by, 'yes');
+    removals.set(removal_id, record);
+    return {
+      ok: true, immediate: false, removal_id, need: record.need,
+      snapshot: [...record.snapshot], votes: record.votes.size,
+    };
+  }
+
+  /** Vote on an OPEN removal. Only the frozen snapshot may vote; the target never may. */
+  function vote(removal_id, { machine_id, vote: choice }) {
+    const r = removals.get(removal_id);
+    if (r === undefined) return { ok: false, code: 'NOT_FOUND' };
+    if (r.state !== 'open') return { ok: false, code: 'CLOSED', state: r.state };
+    if (now() - r.opened_at_ms > VOTE_WINDOW_MS) { r.state = 'expired'; return { ok: false, code: 'VOTE_WINDOW_OVER' }; }
+    if (machine_id === r.target_machine_id) return { ok: false, code: 'TARGET_CANNOT_VOTE' };
+    if (!r.snapshot.includes(machine_id)) return { ok: false, code: 'NOT_IN_SNAPSHOT' };
+    if (choice !== 'yes' && choice !== 'no') return { ok: false, code: 'BAD_VOTE' };
+    r.votes.set(machine_id, choice);
+    const yes = [...r.votes.values()].filter((v) => v === 'yes').length;
+    const no = [...r.votes.values()].filter((v) => v === 'no').length;
+    if (yes >= r.need) {
+      r.state = 'carried';
+      if (members.size > 1) members.delete(r.target_machine_id);
+      return { ok: true, state: 'carried', yes, no, need: r.need, removed: r.target_machine_id };
+    }
+    // Once enough no votes exist that yes can no longer reach the bar, it is decided.
+    if (no > r.snapshot.length - r.need) { r.state = 'failed'; return { ok: true, state: 'failed', yes, no, need: r.need }; }
+    return { ok: true, state: 'open', yes, no, need: r.need };
+  }
+
+  function getRemoval(removal_id) {
+    const r = removals.get(removal_id);
+    return r === undefined ? null : { removal_id: r.removal_id, target_machine_id: r.target_machine_id, state: r.state, need: r.need, snapshot: [...r.snapshot], yes: [...r.votes.values()].filter((v) => v === 'yes').length, no: [...r.votes.values()].filter((v) => v === 'no').length, votes: r.votes.size };
+  }
+
+  function pendingFor() {
+    return [...requests.values()].filter((r) => r.state === ADMISSION.PENDING).map((r) => ({ ...r }));
+  }
+
+  return { requestAdmission, decide, tick, getRequest, pendingFor, remove, vote, getRemoval, isMember, memberOf, setOnline, seedFounder, _members: members };
+}