@twinsearth/w2m-dsh-plugin 1.1.3 → 1.1.14

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.1.3"
+    "version": "1.1.14"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.1.3",
+      "version": "1.1.14",
       "author": {
         "name": "TwinsEarth"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.1.3",
+  "version": "1.1.14",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -2,6 +2,60 @@
 
 All notable changes to this project are documented here.
 
+## [1.1.14] — 2026-10-17
+
+**A new machine joins by itself, and a machine that cannot join the old way can now prove its account and ask.**
+
+### Joining is on by default
+
+`autoStartAgent` now defaults to **true**. The old expression was `config.autoStartAgent === true`, which made joining
+opt-IN, and the observed defect was a machine that was installed, running, and simply not in the fleet -- "installed,
+paired: false" with no hint of why. `false` is still the way to turn it off.
+
+Making this the default required changing the meaning of the tests that intentionally ran without an agent: eight suites
+now pin `autoStartAgent: false` through one `applyPinned` wrapper each, and the single case that asserts a STARTED node
+exits cleanly passes `autoStartAgent: true` inside its own template script. Two bugs were found while doing it, and both
+are recorded because they are the shape of this kind of change: inserting a key into object literals with a regex broke a
+file, and replacing call sites after defining the wrapper made the wrapper call itself.
+
+### Admission: who may join, who may be removed
+
+The relay gains a fleet-admission state machine and five routes: `admission/request`, `admission/pending`,
+`admission/{id}/decide`, `members/{id}/remove`, `removals/{id}/vote`, plus `admission/challenge`.
+
+* a request is `pending` and grants nothing until approved;
+* **10 seconds without a decision auto-approves**, but only while at least one member is online -- an empty fleet cannot
+  consent, and that refusal is a named `NO_ONLINE_MEMBER`;
+* inside **24 hours** any online member may remove a new member immediately; after 24 hours a single machine may only
+  OPEN a vote, and the quorum set is **frozen at open time** so a voter going offline mid-vote cannot move the bar;
+* the quorum is the operator's: 3+ old members need >= 50% rounded up, a two-member fleet needs one vote;
+* old members are ordered by **insertion sequence**, not timestamps -- two machines approved inside the same millisecond
+  are equal on the clock but still have an order, and a quorum that depends on a sub-millisecond race is not a quorum.
+
+### An unpaired machine can prove its account
+
+A machine whose pairing failed has no device_token, which is the situation the fallback exists for -- so the two routes
+it needs are reachable **without** one, authorised instead by an account signature:
+
+* the account gains a **derived Ed25519 identity** (`account-identity.mjs`): the same account material yields the same
+  keypair on every machine, which is what makes zero-configuration joining possible at all;
+* the public key is registered with the relay **when that account's first machine pairs** -- the only moment the relay has
+  proof of the account -- and the first key wins (a different key is refused, not silently accepted);
+* a one-time, five-minute challenge is signed and verified against it; the challenge is consumed on any attempt, the
+  signature binds `machine_id`, and issuing is rate limited **per fingerprint**;
+* the fingerprint the relay acts on comes from the **verified signature**, never from the request body.
+
+### Deliberately not in this release
+
+The client-side consumption of `degrade: true` (challenge -> request -> poll) and the approval UI (10s popup plus a
+standing dialog) are **not** shipped. The server half is tested; the client half is not written, and shipping a
+mechanism whose client does not call it is the failure this project has recorded seven times.
+
+### Verified
+
+Full gate: **GREEN**, 15 of 15 checks, twice. The suites this release touches directly: relay 163, tools 115, admission
+16, admission-routes 3, broadcast 19, join-challenge 8, account-identity 6, join-degradation 3, fleet-target 45.
+
 ## [1.1.3] — 2026-10-17
 
 **A machine offline for more than 72 hours leaves the list. It is not deleted, and it comes back on its own.**

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.3", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.1.14", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.1.3",
+  "version": "1.1.14",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "main": "lib/index.js",
@@ -129,10 +129,13 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
+    "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
+    "test:admission": "node --test --test-force-exit test/admission.test.mjs",
+    "test:admission-routes": "node --test --test-force-exit test/admission-routes.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs",
     "test:approval-gate": "node --test --test-force-exit test/approval-gate.test.mjs",
     "test:approval-index": "node --test --test-force-exit test/approval-index.test.mjs",
     "test:authority": "node --test --test-force-exit test/authority.test.mjs",
@@ -155,6 +158,8 @@
     "test:fleet-sync": "node --test --test-force-exit test/fleet-sync.test.mjs",
     "test:health": "node --test --test-force-exit test/health.test.mjs",
     "test:installed-version": "node --test --test-force-exit test/installed-version.test.mjs",
+    "test:join-challenge": "node --test --test-force-exit test/join-challenge.test.mjs",
+    "test:join-degradation": "node --test --test-force-exit test/join-degradation.test.mjs",
     "test:layers": "node --test --test-force-exit test/layer-model.test.mjs",
     "test:log-bounds": "node --test --test-force-exit test/log-bounds.test.mjs",
     "test:memory": "node --test --test-force-exit test/memory.test.mjs",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.1.3",
+  "version": "1.1.14",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/join-degradation.mjs

@@ -0,0 +1,34 @@
+/**
+ * When may the old joining path give up and the new one take over?
+ *
+ * The operator's rule (2026-10-17): "旧机制优先，失败才降级". The whole value of a fallback is that it fires when the
+ * old path **cannot** work -- and the whole danger is that it fires when the old path merely hiccuped. A machine pushed
+ * into an approval queue because the network blipped for two seconds is worse than one that retried.
+ *
+ * So this is a whitelist of three reasons, and everything else is "retry the old path":
+ *
+ *   1. the pairing code is invalid or already used -- the old path can never succeed with it;
+ *   2. the relay is unreachable at the configured address -- no code will help;
+ *   3. pairing timed out -- the old path got its chance and did not finish.
+ *
+ * Everything else (401 on the operator token, a config error, a permission refusal, an unexpected 5xx) is a signal that
+ * something needs a human, **not** a signal to change mechanisms. Defaulting to `false` is deliberate: an unknown
+ * failure must not silently move a machine between flows.
+ */
+
+/** The only three reasons the old path may be abandoned. */
+export const DEGRADABLE_REASONS = Object.freeze([
+  'PAIRING_CODE_INVALID',
+  'RELAY_UNREACHABLE',
+  'PAIRING_TIMEOUT',
+]);
+
+/**
+ * @param {string|{reason_code?: string, code?: string, status?: number}} failure
+ * @returns {boolean} true only for the three whitelisted reasons.
+ */
+export function shouldDegrade(failure) {
+  const reason = typeof failure === 'string' ? failure : (failure?.reason_code ?? failure?.code ?? null);
+  if (typeof reason !== 'string') return false;
+  return DEGRADABLE_REASONS.includes(reason);
+}

package/src/plugin/tools.mjs

@@ -1,4 +1,4 @@
-/**
+/**
  * DSH: Windows2MacO - the DSH Cordis plugin.
  *
  * # What this exposes
@@ -107,6 +107,7 @@ import { acceptWithAuthority } from '../agent/field-authority.mjs';
 // v1.0.11: the merge rule (#2b) lives in its own module so the operator's two layers can be tested as a rule,
 // exhaustively, without a profile or a relay.
 import { mergeMemory } from './fleet-merge.mjs';
+import { shouldDegrade } from './join-degradation.mjs';
 
 // The base-address rules live in one place (§2), shared with the agent side. Importing the - rather
 // than re-deriving them her - is what stops the plugin and the agent from disagreeing about what
@@ -211,7 +212,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.1.3';
+const PLUGIN_VERSION = '1.1.14';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -687,7 +688,8 @@ function readConfig(config = {}) {
     machineName: typeof config.machineName === 'string' && config.machineName.trim() !== ''
       ? config.machineName.trim()
       : os.hostname(),
-    autoStartAgent: config.autoStartAgent === true,
+    // v1.1.6: joining is on by default; `false` is the only way off.
+    autoStartAgent: config.autoStartAgent !== false,
       /**
        * v0.8.3: the account-derived key this machine joins its fleet with.
        *
@@ -6704,10 +6706,18 @@ async function startLocalStack(ctx, cfg) {
         ctx.logger?.info?.(`w2m: paired by ${by}`);
         return { paired: true, by };
       } catch (error) {
-        // Named rather than swallowed: an agent that failed to pair runs and does nothing, which
-        // looks identical to a fleet with no work.
-        ctx.logger?.warn?.(`w2m: pairing by ${by} failed: ${error instanceof Error ? error.message : String(error)}`);
-        return { paired: false, by };
+        /**
+         * The failure is classified here, where the reason still exists.
+         *
+         * v1.1.6 adds a second joining path (account fingerprint + member approval) that may only take over when the
+         * FIRST path cannot work -- an invalid pairing code, an unreachable relay, a timeout. Anything else (a config
+         * error, a permission refusal) needs a human, and moving the machine between mechanisms would hide that. The
+         * classifier owns that rule; this only has to stop discarding the error before it can be read.
+         */
+        const reason = error?.reason_code ?? error?.code ?? null;
+        const degrade = shouldDegrade(reason);
+        ctx.logger?.warn?.(`w2m: pairing by ${by} failed${reason === null ? '' : ' (' + String(reason) + ')'}: ${error instanceof Error ? error.message : String(error)}`);
+        return { paired: false, by, reason_code: reason, degrade };
       }
     }
 

package/src/relay/admission.mjs

@@ -0,0 +1,239 @@
+/**
+ * Fleet admission: who may join a fleet, who may be removed, and by how many votes.
+ *
+ * ## Why this is a state machine and not a route handler
+ *
+ * Every rule the operator set is a *time window* or a *quorum*, and both are the kind of logic that reads correctly in
+ * a route handler and is wrong at the edges: a decision that arrives one millisecond after the automatic one, a vote
+ * whose quorum changes because a voter went offline mid-vote, a removal of the last member. None of that needs a socket,
+ * so none of it is tested through one -- the routes are thin wrappers over this file.
+ *
+ * ## The four operator decisions this encodes (2026-10-17)
+ *
+ * 1. the OLD mechanism stays the default; this one is the fallback, so nothing here is on any startup path yet;
+ * 2. `autoApproveMs = 10_000` -- but **never** with zero members online, because an empty fleet cannot consent;
+ * 3. a fleet of 2 needs 1 vote (= 50%), 3 or more needs >= 50% rounded up;
+ * 4. the quorum denominator is **currently online old members only**, so the set is **frozen when the vote opens**.
+ *
+ * ## Clock
+ *
+ * Every decision is stamped with `now()`, which the caller supplies. The default is `Date.now`; the tests pass a
+ * clock they control, and production uses the relay's clock. **No client clock is ever trusted** -- three machines in
+ * this fleet disagreed by tens of seconds, and a vote that opens or closes on a client clock is a vote an attacker
+ * schedules.
+ */
+
+/** Request states. A request that is not `approved` grants nothing. */
+export const ADMISSION = Object.freeze({
+  PENDING: 'pending',
+  APPROVED: 'approved',
+  REJECTED: 'rejected',
+  EXPIRED: 'expired',
+});
+
+/** Operator decision: 10s, and only while at least one member is online. */
+export const AUTO_APPROVE_MS = 10_000;
+/** A request nobody decided expires, so a machine cannot wait forever on a fleet that is gone. */
+export const REQUEST_TTL_MS = 24 * 60 * 60 * 1000;
+/** Removal is immediate inside this window; after it, a vote is required. */
+export const KICK_WINDOW_MS = 24 * 60 * 60 * 1000;
+/** How long a removal vote stays open. */
+export const VOTE_WINDOW_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * The quorum, as the operator stated it: 3+ old members needs >= 50% rounded up; a fleet of 2 needs **one** vote.
+ *
+ * `Math.ceil(n / 2)` would demand 2 votes from a two-member fleet, which makes removal impossible -- the operator
+ * called that out explicitly ("2 人小编队一人就行").
+ */
+export function neededVotes(onlineOldMembers) {
+  const n = Number.isInteger(onlineOldMembers) && onlineOldMembers > 0 ? onlineOldMembers : 0;
+  if (n === 0) return 0;
+  if (n <= 2) return 1;
+  return Math.ceil(n / 2);
+}
+
+/**
+ * @param {{now?: () => number, autoApproveMs?: number}} [options]
+ */
+export function createAdmission(options = {}) {
+  const now = typeof options.now === 'function' ? options.now : () => Date.now();
+  const autoApproveMs = Number.isInteger(options.autoApproveMs) ? options.autoApproveMs : AUTO_APPROVE_MS;
+
+  /** machine_id -> {joined_at_ms, fleet_id} for every APPROVED member. */
+  const members = new Map();
+  let joinSeq = 0;
+  /** request_id -> request record. */
+  const requests = new Map();
+  /** removal_id -> vote record. */
+  const removals = new Map();
+  let seq = 0;
+  const nextId = (prefix) => { seq += 1; return prefix + '-' + String(seq).padStart(4, '0'); };
+
+  const onlineMembers = () => [...members.keys()].filter((id) => members.get(id).online === true);
+
+  function seedFounder(machine_id, fleet_id = 'fleet-1', online = true) {
+    joinSeq += 1;
+    members.set(machine_id, { joined_at_ms: now(), fleet_id, online, join_seq: joinSeq });
+    return memberOf(machine_id);
+  }
+
+  function memberOf(machine_id) {
+    const m = members.get(machine_id);
+    return m === undefined ? null : { machine_id, joined_at_ms: m.joined_at_ms, fleet_id: m.fleet_id, online: m.online === true };
+  }
+
+  /** A pending request grants nothing: this is what the dispatch path asks. */
+  function isMember(machine_id) { return members.has(machine_id); }
+
+  function setOnline(machine_id, online) {
+    const m = members.get(machine_id);
+    if (m === undefined) return false;
+    m.online = online === true;
+    return true;
+  }
+
+  function requestAdmission({ machine_id, machine_name = null, account_fingerprint = null, fleet_id = 'fleet-1' }) {
+    if (typeof machine_id !== 'string' || machine_id === '') throw new Error('machine_id is required');
+    if (members.has(machine_id)) return { ok: true, already_member: true, state: ADMISSION.APPROVED, request_id: null };
+    // One open request per machine: re-requesting returns the same record rather than creating a queue.
+    for (const r of requests.values()) {
+      if (r.machine_id === machine_id && r.state === ADMISSION.PENDING) return { ok: true, request_id: r.request_id, state: r.state, replayed: true };
+    }
+    // A fleet with no members has nobody to approve, so the first machine founds it.
+    if (members.size === 0) {
+      joinSeq += 1;
+      members.set(machine_id, { joined_at_ms: now(), fleet_id, online: true, join_seq: joinSeq });
+      return { ok: true, state: ADMISSION.APPROVED, request_id: null, founder: true };
+    }
+    const request_id = nextId('adm');
+    requests.set(request_id, {
+      request_id, machine_id, machine_name, account_fingerprint, fleet_id,
+      state: ADMISSION.PENDING, requested_at_ms: now(), decided_at_ms: null,
+      decided_by: null, auto: false,
+    });
+    return { ok: true, request_id, state: ADMISSION.PENDING };
+  }
+
+  function getRequest(request_id) {
+    const r = requests.get(request_id);
+    return r === undefined ? null : { ...r };
+  }
+
+  /**
+   * Approve or reject. `auto` is recorded, because "nobody was watching" and "a person said yes" are different facts.
+   */
+  function decide(request_id, { decision, decided_by = null, auto = false }) {
+    const r = requests.get(request_id);
+    if (r === undefined) return { ok: false, code: 'NOT_FOUND' };
+    if (r.state !== ADMISSION.PENDING) return { ok: false, code: 'ALREADY_DECIDED', state: r.state };
+    if (decision !== 'approve' && decision !== 'reject') return { ok: false, code: 'BAD_DECISION' };
+    if (auto === true && onlineMembers().length === 0) {
+      // An empty fleet cannot consent. This is the one rule that must not be relaxed for convenience.
+      return { ok: false, code: 'NO_ONLINE_MEMBER' };
+    }
+    r.state = decision === 'approve' ? ADMISSION.APPROVED : ADMISSION.REJECTED;
+    r.decided_at_ms = now();
+    r.decided_by = decided_by;
+    r.auto = auto === true;
+    if (r.state === ADMISSION.APPROVED) {
+      joinSeq += 1;
+      members.set(r.machine_id, { joined_at_ms: r.decided_at_ms, fleet_id: r.fleet_id, online: true, join_seq: joinSeq });
+    }
+    return { ok: true, request_id, state: r.state, auto: r.auto };
+  }
+
+  /**
+   * Tick: applies the automatic approval and the request TTL. Called by the caller's timer, not by a setTimeout here,
+   * so a test controls time completely.
+   */
+  function tick() {
+    const t = now();
+    const decided = [];
+    for (const r of requests.values()) {
+      if (r.state !== ADMISSION.PENDING) continue;
+      const age = t - r.requested_at_ms;
+      if (age >= REQUEST_TTL_MS) { r.state = ADMISSION.EXPIRED; r.decided_at_ms = t; decided.push({ request_id: r.request_id, state: r.state }); continue; }
+      if (age >= autoApproveMs && onlineMembers().length > 0) {
+        r.state = ADMISSION.APPROVED; r.decided_at_ms = t; r.decided_by = 'auto'; r.auto = true;
+        joinSeq += 1;
+        members.set(r.machine_id, { joined_at_ms: t, fleet_id: r.fleet_id, online: true, join_seq: joinSeq });
+        decided.push({ request_id: r.request_id, state: r.state, auto: true });
+      }
+    }
+    return decided;
+  }
+
+  /**
+   * Remove a member.
+   *
+   * Inside KICK_WINDOW_MS of joining, any online member may do it immediately. After that, a single machine may only
+   * OPEN a vote: the quorum set is frozen here, at open time, so a voter going offline mid-vote cannot silently lower
+   * the bar (or raise it).
+   */
+  function remove(target_machine_id, { requested_by, reason = null }) {
+    const target = members.get(target_machine_id);
+    if (target === undefined) return { ok: false, code: 'NOT_A_MEMBER' };
+    if (requested_by === target_machine_id) return { ok: false, code: 'CANNOT_REMOVE_SELF' };
+    if (!members.has(requested_by)) return { ok: false, code: 'NOT_A_MEMBER' };
+    if (members.size <= 1) return { ok: false, code: 'LAST_MEMBER' };
+
+    const age = now() - target.joined_at_ms;
+    // Insertion order, not timestamps: two machines approved inside the same millisecond are equal on the clock but
+    // still have an order, and a quorum that depends on a sub-millisecond race is not a quorum.
+    const oldMembers = [...members.keys()].filter((id) => id !== target_machine_id
+      && (members.get(id).join_seq ?? 0) < (target.join_seq ?? 0));
+    const snapshot = oldMembers.filter((id) => members.get(id).online === true);
+
+    if (age <= KICK_WINDOW_MS) {
+      members.delete(target_machine_id);
+      return { ok: true, immediate: true, removed: target_machine_id };
+    }
+    const removal_id = 'rmv-' + String(seq += 1).padStart(4, '0');
+    const record = {
+      removal_id, target_machine_id, requested_by, reason,
+      snapshot: [...snapshot], recent_votes: snapshot.slice(0, 1),
+      votes: new Map(), state: 'open', opened_at_ms: now(), need: neededVotes(snapshot.length),
+    };
+    // The requestor counts as the first yes; the operator's "a single machine may initiate" implies that much.
+    if (record.recent_votes.includes(requested_by)) record.votes.set(requested_by, 'yes');
+    removals.set(removal_id, record);
+    return {
+      ok: true, immediate: false, removal_id, need: record.need,
+      snapshot: [...record.snapshot], votes: record.votes.size,
+    };
+  }
+
+  /** Vote on an OPEN removal. Only the frozen snapshot may vote; the target never may. */
+  function vote(removal_id, { machine_id, vote: choice }) {
+    const r = removals.get(removal_id);
+    if (r === undefined) return { ok: false, code: 'NOT_FOUND' };
+    if (r.state !== 'open') return { ok: false, code: 'CLOSED', state: r.state };
+    if (now() - r.opened_at_ms > VOTE_WINDOW_MS) { r.state = 'expired'; return { ok: false, code: 'VOTE_WINDOW_OVER' }; }
+    if (machine_id === r.target_machine_id) return { ok: false, code: 'TARGET_CANNOT_VOTE' };
+    if (!r.snapshot.includes(machine_id)) return { ok: false, code: 'NOT_IN_SNAPSHOT' };
+    if (choice !== 'yes' && choice !== 'no') return { ok: false, code: 'BAD_VOTE' };
+    r.votes.set(machine_id, choice);
+    const yes = [...r.votes.values()].filter((v) => v === 'yes').length;
+    const no = [...r.votes.values()].filter((v) => v === 'no').length;
+    if (yes >= r.need) {
+      r.state = 'carried';
+      if (members.size > 1) members.delete(r.target_machine_id);
+      return { ok: true, state: 'carried', yes, no, need: r.need, removed: r.target_machine_id };
+    }
+    // Once enough no votes exist that yes can no longer reach the bar, it is decided.
+    if (no > r.snapshot.length - r.need) { r.state = 'failed'; return { ok: true, state: 'failed', yes, no, need: r.need }; }
+    return { ok: true, state: 'open', yes, no, need: r.need };
+  }
+
+  function getRemoval(removal_id) {
+    const r = removals.get(removal_id);
+    return r === undefined ? null : { removal_id: r.removal_id, target_machine_id: r.target_machine_id, state: r.state, need: r.need, snapshot: [...r.snapshot], yes: [...r.votes.values()].filter((v) => v === 'yes').length, no: [...r.votes.values()].filter((v) => v === 'no').length, votes: r.votes.size };
+  }
+
+  function pendingFor() {
+    return [...requests.values()].filter((r) => r.state === ADMISSION.PENDING).map((r) => ({ ...r }));
+  }
+
+  return { requestAdmission, decide, tick, getRequest, pendingFor, remove, vote, getRemoval, isMember, memberOf, setOnline, seedFounder, _members: members };
+}

package/src/relay/join-challenge.mjs

@@ -0,0 +1,92 @@
+/**
+ * The exchange that lets an UNPAIRED machine prove an account it cannot authenticate as a device.
+ *
+ * ## The shape
+ *
+ *   1. the machine asks for a challenge, naming the account fingerprint;
+ *   2. the relay answers with a one-time nonce and an expiry;
+ *   3. the machine signs \`challenge|nonce|fingerprint|machine_id\` with the account's derived private key;
+ *   4. the relay verifies with the public key registered when that account's first machine paired.
+ *
+ * ## The three properties, and why each is a test
+ *
+ * - **One-time.** A challenge is consumed by the first attempt, success or failure, because a retryable nonce is a replay
+ *   window. Consuming on failure means an attacker who guessed wrong must fetch a new challenge -- which is rate limited.
+ * - **Expiring.** Five minutes, on the relay's clock. A nonce that lives for ever is a signature that can be reused at
+ *   leisure.
+ * - **Rate limited per fingerprint.** Not per address: the thing being protected is a fingerprint, and an attacker with
+ *   many addresses must not get many guesses.
+ *
+ * The signature payload binds the machine_id as well as the fingerprint: a valid signature harvested for one machine must
+ * not admit another.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { verifyChallenge } from '../util/account-identity.mjs';
+
+export const CHALLENGE_TTL_MS = 5 * 60 * 1000;
+export const CHALLENGE_MAX_PER_MINUTE = 5;
+
+/**
+ * @param {{now?: () => number, ttlMs?: number, maxPerMinute?: number,
+ *          publicKeyFor: (fingerprint: string) => (string|null)}} options
+ */
+export function createJoinChallenges(options = {}) {
+  const now = typeof options.now === 'function' ? options.now : () => Date.now();
+  const ttlMs = Number.isInteger(options.ttlMs) ? options.ttlMs : CHALLENGE_TTL_MS;
+  const maxPerMinute = Number.isInteger(options.maxPerMinute) ? options.maxPerMinute : CHALLENGE_MAX_PER_MINUTE;
+  const publicKeyFor = typeof options.publicKeyFor === 'function' ? options.publicKeyFor : () => null;
+
+  /** challenge_id -> { fingerprint, nonce, expires_at_ms } */
+  const open = new Map();
+  /** fingerprint -> [issue times] */
+  const issued = new Map();
+
+  const prune = () => {
+    const t = now();
+    for (const [id, c] of open) if (c.expires_at_ms <= t) open.delete(id);
+  };
+
+  /** The exact bytes signed. Exported so the client and the tests cannot drift from the relay. */
+  const signingPayload = (challenge) => [challenge.challenge_id, challenge.nonce, challenge.fingerprint, challenge.machine_id].join('|');
+
+  function issue(fingerprint, machineId = '') {
+    if (typeof fingerprint !== 'string' || fingerprint === '') return { ok: false, code: 'BAD_FINGERPRINT' };
+    if (publicKeyFor(fingerprint) === null) return { ok: false, code: 'FINGERPRINT_UNREGISTERED' };
+    prune();
+    const recent = (issued.get(fingerprint) ?? []).filter((at) => now() - at < 60_000);
+    if (recent.length >= maxPerMinute) { issued.set(fingerprint, recent); return { ok: false, code: 'RATE_LIMITED' }; }
+    recent.push(now());
+    issued.set(fingerprint, recent);
+    const challenge_id = createHash('sha256').update(fingerprint).update(String(randomBytes(16).toString('hex'))).update(String(now())).digest('hex').slice(0, 32);
+    const challenge = {
+      challenge_id, nonce: randomBytes(16).toString('hex'), fingerprint,
+      machine_id: typeof machineId === 'string' ? machineId : '', expires_at_ms: now() + ttlMs,
+    };
+    open.set(challenge_id, challenge);
+    return { ok: true, challenge_id, nonce: challenge.nonce, expires_at_ms: challenge.expires_at_ms };
+  }
+
+  /**
+   * Verify a signed challenge. Consumes the challenge on ANY attempt.
+   *
+   * @param {{challenge_id: string, machine_id: string, signature: string}} request
+   * @returns {{ok: true, fingerprint: string} | {ok: false, code: string}}
+   */
+  function consume(request) {
+    prune();
+    const challenge = open.get(request?.challenge_id);
+    if (challenge === undefined) return { ok: false, code: 'CHALLENGE_INVALID' };
+    open.delete(challenge.challenge_id);   // one attempt, success or not
+    if (challenge.expires_at_ms <= now()) return { ok: false, code: 'CHALLENGE_EXPIRED' };
+    if (typeof request.machine_id !== 'string' || request.machine_id === '') return { ok: false, code: 'BAD_REQUEST' };
+    // The machine that signs must be the machine that asked: issuing for one id and signing for another is a forgery.
+    if (challenge.machine_id !== '' && challenge.machine_id !== request.machine_id) return { ok: false, code: 'MACHINE_MISMATCH' };
+    const pem = publicKeyFor(challenge.fingerprint);
+    if (pem === null) return { ok: false, code: 'FINGERPRINT_UNREGISTERED' };
+    const payload = signingPayload({ ...challenge, machine_id: request.machine_id });
+    if (verifyChallenge(pem, payload, request.signature) !== true) return { ok: false, code: 'SIGNATURE_INVALID' };
+    return { ok: true, fingerprint: challenge.fingerprint };
+  }
+
+  return { issue, consume, signingPayload, _open: open };
+}