@twinsearth/w2m-dsh-plugin 2.0.4 → 2.0.6

package/CHANGELOG.md

@@ -7,229 +7,245 @@
 
 All notable changes to this project are documented here.
 
-## [2.0.4] - 2026-10-28
-
-- GPW 双策略模式：小白模式（默认）只保留黑名单强制拒绝，其余工具调用放行；高级模式需手动切换，保持四色策略。
-- 小白模式自带默认保护文件夹（C:\Windows、C:\Program Files、D:\Program Files、Program Files (x86) 两盘），
-  与用户黑名单合并后强制拒绝；路径类调用每 3 秒最多自动放行一次，限制突发损失。
-- 高级模式挂起超时自动放行由 100 秒调整为 10 秒；黑白名单编辑与四色统计保持不变。
-- GPW 设置页新增模式选择；小白模式下隐藏白名单区块、只显示默认保护文件夹与黑名单。
-- 主 README 重写（六大核心功能、安装、Verified/Known gaps），并修正为连续三次点击到顶等与实现一致的描述。
-
-## [2.0.3] - 2026-10-28
-
-- 滚动按钮移到会话正文列右上角（黑框位置）：按官方浮动圆钮规格 34px、无边框、elevation 阴影、
-  label-primary 图标色（亮色显示为黑色，暗色自动反白）、hover/active/focus-visible 状态。
-- 位置由会话滚动区实时计算（正文列右缘 + 顶部内缩 8px），窗口缩放与侧栏变化时重新对齐。
-- 关键修复：自动完成 DSH 官方“加载更早”——会话是虚拟列表，不点“加载更早”时 scrollTop 到顶即止，
-  这是之前“点击无效/无法到顶”的真正原因。现在滚动前若已在顶部会先点一次“加载更早”等待 350ms，
-  “连续点击 3 次到顶”会循环点击“加载更早”直到它消失，再把滚动区钉在顶部。
-- 交互：点一次向上滚动约 3 轮；1.2 秒内连续点击 3 次回到第一轮。
-
-## [2.0.2] - 2026-10-28
-
-- 滚动按钮移到右下角，与 DSH 官方浮动滚动控件对齐（同右边缘、位于其上方；官方控件出现前后都会重新对齐）。
-- 修复点击无反应：滚动容器改为“试滚探针”（scrollTop ±1 实际是否被浏览器接受）寻找，
-  不再依赖 overflow 样式；命中后直接写 scrollTop。
-- 交互改为：点一次向上滚动约 3 轮；1.2 秒内连续点击 3 次回到第一轮；不再使用长按。
-
-## [2.0.1] - 2026-10-28
-
-- 修复右上角滚动按钮无效：滚动容器识别改为“命中测试 + 递归 shadow root + 允许 overflow:hidden 的程序化滚动容器”，
-  并直接写 scrollTop/scrollTo；找不到容器时回退到 window。旧实现只找 overflow:auto，虚拟列表/隐藏溢出容器下点击是空操作。
-- 只保留一个滚动图标（SVG 向上箭头，样式与右上角官方图标对齐：32px、8px 圆角、1px 边框、right:16px/top:64px），
-  删除原来的第二个“一键到顶”按钮与会话头部的重复“⇧3”按钮。
-- 交互：点一次向上滚动约 3 轮；长按 3 秒直接回到第一轮（长按后松手的 click 不会重复触发）。
-
-## [2.0.0] - 2026-10-28
-
-主插件与既有 Relay 的对接按《W2M Relay × ToFuture 外部对接 API v1.2》收敛；ToFuture 子插件按该文档
-§6/§9 保持完全独立（主插件不内嵌、不调用、不代理、不实现其运维/白名单/令牌接口）。
-
-- 能力协商：/healthz 读取 features、operator_token_required、signing.required；缺失
-  target-machines/result-projection 时明确拒绝联合派发；signing.required=true 拒绝（v1 外部客户端不支持强签）；
-  operator_token_required=false 拒绝（生产必须为 true）。
-- 派发：控制消息显式携带 target_machines（API §4.6：发到哪台机器只由它决定），保留
-  executor_machine_id 兼容旧 relay；同 id 派发捕获 409 后读回任务而不是当成成功；
-  200 但无 task_id（依赖被拒）按失败处理；被点名机器租约 refused/expired/cancelled 立即失败。
-- 移除主插件内所有 ToFuture 运维面模块（MAC/IP 白名单 HMAC 上报、relay 侧识别路由），
-  遵守 API v1.2 §9：主插件不得实现、调用或探测运维/白名单/令牌接口。
-- 联合开发（plan/approve/dispatch/merge）仍为实验性：数据面投递与合并接线未随本版交付；
-  relay 部署/升级独立于插件发布，线上 relay 版本以 /healthz 为准。
-
-## [1.9.21] - 2026-10-28
-
-- 发布边界：本版只发主插件；ToFuture 运维子插件由独立私有仓库另行发布，本包不包含安装/下载能力。
-- 保留与 Relay 服务器配套的隐藏上报模块：HMAC 网络标识上报（/v1/tofuture/identify，relay 侧静默比对、只存 HMAC）。
-  该能力默认关闭、不注册工具、不显示 UI；relay 需自行升级后才生效。
-- 删除本机隐藏能力（命令触发、隐藏加密存储、自助下载/安装、票据模型），避免在公共 npm 包中携带未交付的运维面。
-- 沿用 1.9.20 的浮动滚动浮标（⇧3 单击 3 轮 / 长按 3 秒到顶 + ⤒ 一键到顶）与搜索绿字黄底高亮。
-
-## [1.9.20] - 2026-10-28
-
-- 新增浮动滚动浮标（固定在主工作区右上角，不依赖 slot 布局）：
-  · 「⇧3」：单击向上滚动约 3 轮对话；长按 3 秒直接回到第一轮；
-  · 「⤒」：一键到顶。
-- 浮标挂载在插件生命周期内（ctx.effect 卸载时移除），失败只记录、不影响页面启动。
-
-## [1.9.19] - 2026-10-28
-
-- 对话右上角新增「⇧3」按钮：单击向上滚动约 3 轮对话，长按 3 秒直接回到第一轮。
-- 全文搜索高亮修复：改为直接插入本地 mark 元素（黄色背景 rgba(255,235,59,.85) + 绿色文字 rgba(11,122,51,1)），并递归遍历 shadow DOM；不再依赖 CSS Custom Highlight API，命中项一定可见。
-- 同版带上 v1.9.18 的聊天收紧：relay 只接收文字与 /微笑 /火箭 /烟花 指令（图片字段、data:image、Markdown 图片、base64 图片魔数一律 400 拒绝；加密消息按设计豁免）；表情按钮改为指令按钮；长提示词镜像按 3500 B 截断，避免被 4096 B 上限静默丢弃。
-
-## [1.9.17] - 2026-10-28
-
-- 修复左侧栏 GPW 入口只剩小图标：恢复 🌐 GPW 文字（侧栏 label 仍为空，不会重复）。
-- 对话全文搜索高亮加强：命中项绿色文字 + 黄色背景（::highlight(w2m-conversation-search) 与 .w2mSearchMark 双样式），主工作区正文中直接可见；显示 当前/总数，Enter/Shift+Enter 或 ↑/↓ 跳转，Esc 清除。
-
-### [2.0.0-beta.1]（pre-release） - 2026-10-28
-
-首个联合开发 beta（S0–S1）。
-
-- S0 事实基座：operator token 安全存储（0600 文件 + 指纹状态）、relay /healthz 广告 relay_version/features、客户端能力协商 fail-closed；版本偏斜策略按“三机同版本才允许联合开发、enforce 不开启”执行。
-- S1 选择真实生效：派发前按当前设备名册重校验被选机器（离线 → TARGET_UNAVAILABLE，不换机）；派发后按 relay leases 校验，未被点名的机器也执行 → 取消任务并 SELECTION_NOT_HONOURED。
-- 联合开发操作员入口：w2m-joint（plan create/list/get、approve、status、dispatch --dry-run，能力协商接入）；联合开发默认关闭，属实验性 beta。
-- 运维工具：w2m-scrub（dry-run/apply，递归清点 blobs/<aa>/<sha>，备份必须外置，二次幂等），用于旧 relay 清淤。
-- beta 发布：仅 GitHub prerelease；npm 不发布本 beta。
-
-## [1.9.16] - 2026-10-28
-
-- G0-2：relay /healthz 新增 relay_version 与 features（target-machines / result-projection / guard-v1 / relay-version-v1）；w2m_status 显示这两项，便于核对三台 relay 的实际版本与能力。
-- 新增 relay-capabilities 模块与 w2m-joint dispatch 能力协商：目标 relay 缺少必需 feature（或旧 relay 完全不广告）时，联合派发 fail-closed 返回 RELAY_CAPABILITIES_MISSING，不靠“先发再发现”。
-- 新增 test/relay-health-capabilities.test.mjs（5 项）。
-
-## [1.9.15] - 2026-10-28
-
-- G0-1：operator token 安全存储。新增 `~/.w2m/operator-token`（0600，可用 W2M_OPERATOR_TOKEN_FILE 覆盖）与 `w2m-operator` CLI（set 从 stdin/文件读取、status 只显示指纹、clear）；w2m_status 新增 operatorToken_fingerprint/operatorToken_source，token 值不进日志/状态。
-- 解析顺序：profile config（兼容）→ 安全文件（推荐）→ 环境变量（兼容）。
-- 新增 test/operator-token.test.mjs（6 项）。
-
-## [1.9.14] - 2026-10-28
-
-- 修复「立即更新」失败（fetch failed）：GitHub Release 下载被网络阻断时，自动回退到 npm registry 的同一版本 tarball；下载前校验 registry 的 sha512 integrity（缺失时 sha1 shasum），再由现有安装器做 sha256 校验、备份与回滚。
-- 安装器仍走运行时 pnpm（Windows 不再尝试 dsh.cmd）。
-- 更新相关测试 66/66 通过。
-
-## [1.9.13] - 2026-10-28
-
-- 新增操作员联合开发 CLI `w2m-joint`：plan create/list/get、approve（人签、authority≥70、TTL 默认 10 分钟）、status、dispatch --dry-run（打印控制信封，真实发送未接线并返回 DISPATCH_NOT_WIRED）。
-- 该 CLI 是 SOP 的操作员入口：计划先落盘、人工审批、再允许派发；dispatch 真发仍要求 operator token 与 relay 能力广告（下一片）。
-- 端到端本机冒烟：create → approve → status(dispatch_allowed=true) → dispatch --dry-run(2 envelopes)。
-
-## [1.9.12] - 2026-10-28
-
-- 联合开发安全门（S1/S2 预置）：plan-store 保存与读取都重算 plan_sha256（篡改即 PLAN_TAMPERED）、planSha 强制 64 位十六进制（拒绝路径穿越）、审批绑定 plan_sha/approver/authority/TTL 并重算 approval_sha256（篡改/过期/低权限拒绝）、原子写。
-- 全部机器选中真实性（S1）：w2m_run 在派发前用当前设备名册重校验被选机器（离线即 TARGET_UNAVAILABLE，不换机）；派发后按 relay 的 leases 校验，发现未被点名的机器也拿到租约即取消任务并返回 SELECTION_NOT_HONOURED。
-- 新增 test/joint-dev-plan-store.test.mjs（11 项）。
-
-## [1.9.11] - 2026-10-28
-
-- 修复左侧栏只剩图标：GPW 名称恢复到入口内（🌐 GPW），侧栏 label 仍为空，避免再次重复。
-- 对话全文搜索：匹配项以黄色高亮（CSS Custom Highlight API ::highlight(w2m-conversation-search)），显示 当前/总数 计数；Enter/Shift+Enter 或 ↑/↓ 在命中项间滚动，Esc 清除。
-
-## [1.9.10] - 2026-10-28
-
-- 新增 `bin/w2m-self-update.mjs`：可被编队任务直接下发的自更新入口，读取 GitHub Release、校验 SHA256SUMS、调用已验证安装器，输出一行 JSON，不重启 DSH。
-- 固化升级策略：优先下发自更新指令；失败才使用 Node 远程执行回退（macOS 用 mac-self-update，Windows 用 node 替换+备份）。
-- 参数：--profile、--dry-run、--allow-prerelease；环境变量 W2M_PROFILE_DIR / W2M_UPDATE_REPO。
-
-## [1.9.9] - 2026-10-28
-
-- 对话主工作区新增全文搜索：会话头部（置顶按钮同排）🔍 图标，点击展开搜索框，Enter/Shift+Enter 或 ↑/↓ 在已渲染对话中查找并高亮（Electron/Chromium find）。
-
-- 修复 Windows「立即更新」失败：dsh 以 dsh.cmd 安装时，child_process.spawn(shell:false) 会报 EINVAL。现在 Windows 下不再把 .cmd/.bat 当作可直接执行计划，自动改用运行时 pnpm；若 dsh 计划出现 EINVAL，也会回退 pnpm 重试一次。
-- 新增回归测试：.cmd 计划被拒绝并走 pnpm；spawn 失败仍回滚。
-
-## [1.9.8] - 2026-10-28
-
-- 左栏 GPW 入口改为纯图标（🌐），去掉重复的文字条目。
-- 设置页 GPW 标签名称改为「GPW」，并使用与管理台一致的新页面（不再复用弹窗面板）。
-- 编队群组视图内补齐常用聊天表情行（此前只在浮窗全屏时出现）。
-
-## [1.9.7] - 2026-10-28
-
-- 侧边栏与设置页入口统一命名为「GPW」，左对齐并沿用插件标签的字体、字号与间距。
-- GPW 主工作区面板与设置页面板改为管理台布局：标题 + 查询/操作卡片 + 标签页 + 数据表格（路径/类型/状态/移除），参考系统黑白名单界面。
-- 右下角浮标继续复用原弹窗面板，Composer 入口不变。
-
-## [1.9.6] - 2026-10-28
-- 修复：左侧栏 GPW 点击无效。侧栏入口改用 `main` 槽位（key 与 panellist id 一致），点击切换到主工作区的完整 GPW 页面。
-- GPW 页面改为主工作区整页布局（960px 内容、独立滚动、卡片化分区），不再是右下角弹窗形态。
-- 修复：设置页 GPW 标签沿用设置页样式（与通用设置页一致的卡片/分区）。
-- 新增：「编队群组」对话视图标签（conversation.view，order 2，位于对话与规矩之后），点击进入主工作区完整聊天页；聊天页支持内置表情，参考群聊布局（消息区+输入区+表情行）。
-- 底部状态栏保持：本编队在线/总数、全部机器在线/总数。
-本次为 v1.9.5 五方发布（1.9.4 未发布，内容并入本版本）。
-- 顶部标签栏新增「编队聊天」入口：点击进入完整分页面，支持内置表情。
-- 底部状态栏常驻显示：本编队在线/总数、全部机器在线/总数，无需展开 Composer 的机器列表。
-- 左侧导航栏新增 GPW 入口（🌐 图标），位于插件与自动化任务之间；点击进入完整分页面（960px 工作区），右下角浮标与 Composer 入口保持不变。
-- 设置页新增 GPW 标签栏，位于「模型」与「内置插件」之间，内嵌完整 GPW 管理面板。
-- 插件详情页（与卸载按钮同页）新增「W2M 插件更新」：检测更新、立即更新、自动更新开关；安装完成后自动刷新页面，无需卸载、无需重启应用。
-- 更新检测打开即执行；旧版本直接显示新版本号与安装按钮；npm 镜像失败回退 registry.npmjs.org。
-
-## [1.9.5] - 2026-10-27
-
-## [1.9.3] - 2026-10-27
-- 左侧边栏新增常驻 GPW 入口（默认显示、无关闭按钮），Composer 与右下角浮窗保留。
-- 插件设置页新增“W2M 插件更新”分区：检测更新、发现新版本后立即安装、自动更新开关（开启后每次启动自动安装）。
-- 更新检测修复：设置页打开即检查；本机为旧版时直接显示新版本号与安装按钮；npm 镜像不可用时回退 registry.npmjs.org。
-- 自动更新不再只是偏好：开关打开后会实际调用校验与安装流程，并提示重启。
-
-## [1.9.2-beta.1] - 2026-10-27
-- P0 止血：relay 数据面端点退役（blob/blob-sessions/latest → 403），结果信封校验后投影后存储（不再落 argv/head/tail/路径原文）。
-- B1 兼容窗口：默认接收 v1 信封并投影，设置 W2M_DATA_PLANE_GUARD=enforce 才硬拒。
-- guard 递归扫描 + 16 KiB 语义上限 + 协议错误形状。
-- beta：仅 GitHub prerelease，不含 npm/packages 发布。
-**V1.9.1 更新**
-
-## [1.9.1] — 2026-10-27
-
-## [1.9.0] — 2026-10-27
-
-**V1.9.0 大版本更新**
-
-## [1.8.2] — 2026-10-26
-
-**GPW 超时策略：黄类（名单外）100 秒无人应答自动同意；黑白名单规则不变；已覆盖父目录的子文件夹拦截记录折叠。**
-
-- **只读工具绿名单扩展**：`read/read_file/search/grep/glob/list/…`、`job_list/job_output/job_status/job_wait`、`w2m_status/w2m_devices/w2m_tasks/w2m_history/w2m_report/w2m_memory/w2m_stats` 判为绿色（无打扰放行）；`job_kill/job_start/w2m_run/w2m_cancel/w2m_intent` 仍为黄色（可变更，需人工）。
-- 超时默认值 120s → **100s**；超时结果由「拒绝」改为「自动同意」（仅黄类 / 名单外路径调用）。
-- 红线（危险命令、敏感/系统路径、显式 deny）仍然立即拒绝，不进入待审批队列；白名单命中仍然立即放行。
-  因此超时规则不会扩大任何名单的授权范围。
-- 自动同意的调用会记录为会话授权（指纹），同一操作的后续出现以蓝色（已授权常态）直接放行。
-- 「最近被拦截」折叠逻辑确认覆盖父目录下的子文件夹：名单条目是根目录，其任意深度子文件夹的拦截记录都会进入
-  「已在名单中 N 条」折叠组（`folder_in` 双向包含匹配）。
-- 新增 `test/gpw-auto-approve.test.mjs`（4 项：超时自动同意→下次变蓝；红线仍拒；白名单立即放行；100s 默认值）。
-- 证据：`docs/acceptance/1.8.2/GPW-AUTO-APPROVE.json`。
-## [1.8.1] — 2026-10-26
-
-**GPW「最近被拦截」去噪：已在名单中的条目折叠显示；加入名单后条目立即消失。**
-
-- 状态接口为每条 recent 增加 `folder_in`（whitelist / blacklist / null）：文件夹已被名单覆盖的拦截记录不再占用主列表。
-- 面板把已覆盖条目折叠为「已在名单中 N 条 · 展开/收起」，展开后只读展示（不重复给加入按钮）。
-- 从最近拦截一键加入白/黑名单时，服务端同步裁剪该条目（以及被同一父目录覆盖的条目），下一次轮询不再出现。
-- 新增 `test/gpw-recent-fold.test.mjs`（4 项：覆盖归属、嵌套覆盖、客户端折叠静态断言、状态接口字段）。
-- 证据：`docs/acceptance/1.8.1/GPW-RECENT-FOLD.json`。
-## [1.8.0] — 2026-10-26
-
-**GPW 增加四色审核 / 标记 / 提醒系统：绿（通过）、蓝（正常）、黄（警报）、红（风险）。**
-
-- 新增 `src/plugin/gpw-colors.mjs`：把 DSH 各插件的审核行为归位到四色（只读/L1-L2/白名单命中/allow-list = 绿；
-  本会话已批准过（指纹授权）= 蓝；越界写、非白名单命令、中风险 git/npm/网络操作、未知工具 = 黄；
-  危险命令黑名单、敏感路径、系统路径、显式 deny 目录 = 红）。
-- 门控改为颜色决策：绿/蓝直接放行（蓝来自会话内批准后的操作指纹）；黄进入 GPW 待审批队列；红直接拒绝
-  （`tools.guard` + `tools/pre-execute` 双保险，拒绝理由带颜色语义）。
-- 标记与提醒：`/api/w2m/gpw/state` 新增四色计数（colors）、待审批项与最近拦截项的颜色字段；
-  面板显示四色图例与计数，待审批/最近条目带颜色标记；「允许本次会话」动作（allow-session）批准后，
-  同一操作后续以蓝色（已授权常态）放行。
-- 一句话语义：绿=不用管，蓝=管过了，黄=现在管，红=管也不让过（或必须人工硬确认）。
-- 证据：`docs/acceptance/1.8.0/GPW-COLORS.json`。
+## [2.0.6] - 2026-10-29
+
+- 修复 CI 跨平台失败：sink 授权 route 先把 stateDir 解析为 realpath（Windows RUNNER~1 / macOS
+  /var→/private/var），避免“stateDir 内部目录”被误放行；相关测试按 canonical 路径断言。
+- 会话搜索：纯数字 ≤100 不触发搜索（无高亮/无跳转）；只高亮当前视口，每屏最多 6 条，
+  滚动时按新视口刷新（150ms 防抖，不抢滚动位置）；输入仍保持 3 秒防抖。
+- 一键到顶：等待“加载中…”结束后再点“加载更早”，连续两页无增长即停止。
+
+## [2.0.5] - 2026-10-29
+
+- Relay 支持 AEAD v2 加密消息信封（A7 收尾）：`enc.v=2` 携带 `aad:{session_id,machine_id,message_id}`，
+  relay 校验明文 AAD 与消息的 session/machine 一致后原样存储与回放；v1 信封保持兼容。
+- 新增能力标记 `chat-enc-v2`（`/healthz.features`），主插件据此启用 encrypted mirror 发送。
+- 新增错误码：`CHAT_AAD_MISSING` / `CHAT_AAD_MISMATCH` / `CHAT_AAD_INVALID`。
+- 测试：fleet-messages AEAD v2 用例、能力协商断言（v1 兼容与未知版本拒绝保持）。
+
+## [2.0.4] - 2026-10-28
+
+- GPW 双策略模式：小白模式（默认）只保留黑名单强制拒绝，其余工具调用放行；高级模式需手动切换，保持四色策略。
+- 小白模式自带默认保护文件夹（C:\Windows、C:\Program Files、D:\Program Files、Program Files (x86) 两盘），
+  与用户黑名单合并后强制拒绝；路径类调用每 3 秒最多自动放行一次，限制突发损失。
+- 高级模式挂起超时自动放行由 100 秒调整为 10 秒；黑白名单编辑与四色统计保持不变。
+- GPW 设置页新增模式选择；小白模式下隐藏白名单区块、只显示默认保护文件夹与黑名单。
+- 主 README 重写（六大核心功能、安装、Verified/Known gaps），并修正为连续三次点击到顶等与实现一致的描述。
+
+## [2.0.3] - 2026-10-28
+
+- 滚动按钮移到会话正文列右上角（黑框位置）：按官方浮动圆钮规格 34px、无边框、elevation 阴影、
+  label-primary 图标色（亮色显示为黑色，暗色自动反白）、hover/active/focus-visible 状态。
+- 位置由会话滚动区实时计算（正文列右缘 + 顶部内缩 8px），窗口缩放与侧栏变化时重新对齐。
+- 关键修复：自动完成 DSH 官方“加载更早”——会话是虚拟列表，不点“加载更早”时 scrollTop 到顶即止，
+  这是之前“点击无效/无法到顶”的真正原因。现在滚动前若已在顶部会先点一次“加载更早”等待 350ms，
+  “连续点击 3 次到顶”会循环点击“加载更早”直到它消失，再把滚动区钉在顶部。
+- 交互：点一次向上滚动约 3 轮；1.2 秒内连续点击 3 次回到第一轮。
+
+## [2.0.2] - 2026-10-28
+
+- 滚动按钮移到右下角，与 DSH 官方浮动滚动控件对齐（同右边缘、位于其上方；官方控件出现前后都会重新对齐）。
+- 修复点击无反应：滚动容器改为“试滚探针”（scrollTop ±1 实际是否被浏览器接受）寻找，
+  不再依赖 overflow 样式；命中后直接写 scrollTop。
+- 交互改为：点一次向上滚动约 3 轮；1.2 秒内连续点击 3 次回到第一轮；不再使用长按。
+
+## [2.0.1] - 2026-10-28
+
+- 修复右上角滚动按钮无效：滚动容器识别改为“命中测试 + 递归 shadow root + 允许 overflow:hidden 的程序化滚动容器”，
+  并直接写 scrollTop/scrollTo；找不到容器时回退到 window。旧实现只找 overflow:auto，虚拟列表/隐藏溢出容器下点击是空操作。
+- 只保留一个滚动图标（SVG 向上箭头，样式与右上角官方图标对齐：32px、8px 圆角、1px 边框、right:16px/top:64px），
+  删除原来的第二个“一键到顶”按钮与会话头部的重复“⇧3”按钮。
+- 交互：点一次向上滚动约 3 轮；长按 3 秒直接回到第一轮（长按后松手的 click 不会重复触发）。
+
+## [2.0.0] - 2026-10-28
+
+主插件与既有 Relay 的对接按《W2M Relay × ToFuture 外部对接 API v1.2》收敛；ToFuture 子插件按该文档
+§6/§9 保持完全独立（主插件不内嵌、不调用、不代理、不实现其运维/白名单/令牌接口）。
+
+- 能力协商：/healthz 读取 features、operator_token_required、signing.required；缺失
+  target-machines/result-projection 时明确拒绝联合派发；signing.required=true 拒绝（v1 外部客户端不支持强签）；
+  operator_token_required=false 拒绝（生产必须为 true）。
+- 派发：控制消息显式携带 target_machines（API §4.6：发到哪台机器只由它决定），保留
+  executor_machine_id 兼容旧 relay；同 id 派发捕获 409 后读回任务而不是当成成功；
+  200 但无 task_id（依赖被拒）按失败处理；被点名机器租约 refused/expired/cancelled 立即失败。
+- 移除主插件内所有 ToFuture 运维面模块（MAC/IP 白名单 HMAC 上报、relay 侧识别路由），
+  遵守 API v1.2 §9：主插件不得实现、调用或探测运维/白名单/令牌接口。
+- 联合开发（plan/approve/dispatch/merge）仍为实验性：数据面投递与合并接线未随本版交付；
+  relay 部署/升级独立于插件发布，线上 relay 版本以 /healthz 为准。
+
+## [1.9.21] - 2026-10-28
+
+- 发布边界：本版只发主插件；ToFuture 运维子插件由独立私有仓库另行发布，本包不包含安装/下载能力。
+- 保留与 Relay 服务器配套的隐藏上报模块：HMAC 网络标识上报（/v1/tofuture/identify，relay 侧静默比对、只存 HMAC）。
+  该能力默认关闭、不注册工具、不显示 UI；relay 需自行升级后才生效。
+- 删除本机隐藏能力（命令触发、隐藏加密存储、自助下载/安装、票据模型），避免在公共 npm 包中携带未交付的运维面。
+- 沿用 1.9.20 的浮动滚动浮标（⇧3 单击 3 轮 / 长按 3 秒到顶 + ⤒ 一键到顶）与搜索绿字黄底高亮。
+
+## [1.9.20] - 2026-10-28
+
+- 新增浮动滚动浮标（固定在主工作区右上角，不依赖 slot 布局）：
+  · 「⇧3」：单击向上滚动约 3 轮对话；长按 3 秒直接回到第一轮；
+  · 「⤒」：一键到顶。
+- 浮标挂载在插件生命周期内（ctx.effect 卸载时移除），失败只记录、不影响页面启动。
+
+## [1.9.19] - 2026-10-28
+
+- 对话右上角新增「⇧3」按钮：单击向上滚动约 3 轮对话，长按 3 秒直接回到第一轮。
+- 全文搜索高亮修复：改为直接插入本地 mark 元素（黄色背景 rgba(255,235,59,.85) + 绿色文字 rgba(11,122,51,1)），并递归遍历 shadow DOM；不再依赖 CSS Custom Highlight API，命中项一定可见。
+- 同版带上 v1.9.18 的聊天收紧：relay 只接收文字与 /微笑 /火箭 /烟花 指令（图片字段、data:image、Markdown 图片、base64 图片魔数一律 400 拒绝；加密消息按设计豁免）；表情按钮改为指令按钮；长提示词镜像按 3500 B 截断，避免被 4096 B 上限静默丢弃。
+
+## [1.9.17] - 2026-10-28
+
+- 修复左侧栏 GPW 入口只剩小图标：恢复 🌐 GPW 文字（侧栏 label 仍为空，不会重复）。
+- 对话全文搜索高亮加强：命中项绿色文字 + 黄色背景（::highlight(w2m-conversation-search) 与 .w2mSearchMark 双样式），主工作区正文中直接可见；显示 当前/总数，Enter/Shift+Enter 或 ↑/↓ 跳转，Esc 清除。
+
+### [2.0.0-beta.1]（pre-release） - 2026-10-28
+
+首个联合开发 beta（S0–S1）。
+
+- S0 事实基座：operator token 安全存储（0600 文件 + 指纹状态）、relay /healthz 广告 relay_version/features、客户端能力协商 fail-closed；版本偏斜策略按“三机同版本才允许联合开发、enforce 不开启”执行。
+- S1 选择真实生效：派发前按当前设备名册重校验被选机器（离线 → TARGET_UNAVAILABLE，不换机）；派发后按 relay leases 校验，未被点名的机器也执行 → 取消任务并 SELECTION_NOT_HONOURED。
+- 联合开发操作员入口：w2m-joint（plan create/list/get、approve、status、dispatch --dry-run，能力协商接入）；联合开发默认关闭，属实验性 beta。
+- 运维工具：w2m-scrub（dry-run/apply，递归清点 blobs/<aa>/<sha>，备份必须外置，二次幂等），用于旧 relay 清淤。
+- beta 发布：仅 GitHub prerelease；npm 不发布本 beta。
+
+## [1.9.16] - 2026-10-28
+
+- G0-2：relay /healthz 新增 relay_version 与 features（target-machines / result-projection / guard-v1 / relay-version-v1）；w2m_status 显示这两项，便于核对三台 relay 的实际版本与能力。
+- 新增 relay-capabilities 模块与 w2m-joint dispatch 能力协商：目标 relay 缺少必需 feature（或旧 relay 完全不广告）时，联合派发 fail-closed 返回 RELAY_CAPABILITIES_MISSING，不靠“先发再发现”。
+- 新增 test/relay-health-capabilities.test.mjs（5 项）。
+
+## [1.9.15] - 2026-10-28
+
+- G0-1：operator token 安全存储。新增 `~/.w2m/operator-token`（0600，可用 W2M_OPERATOR_TOKEN_FILE 覆盖）与 `w2m-operator` CLI（set 从 stdin/文件读取、status 只显示指纹、clear）；w2m_status 新增 operatorToken_fingerprint/operatorToken_source，token 值不进日志/状态。
+- 解析顺序：profile config（兼容）→ 安全文件（推荐）→ 环境变量（兼容）。
+- 新增 test/operator-token.test.mjs（6 项）。
+
+## [1.9.14] - 2026-10-28
+
+- 修复「立即更新」失败（fetch failed）：GitHub Release 下载被网络阻断时，自动回退到 npm registry 的同一版本 tarball；下载前校验 registry 的 sha512 integrity（缺失时 sha1 shasum），再由现有安装器做 sha256 校验、备份与回滚。
+- 安装器仍走运行时 pnpm（Windows 不再尝试 dsh.cmd）。
+- 更新相关测试 66/66 通过。
+
+## [1.9.13] - 2026-10-28
+
+- 新增操作员联合开发 CLI `w2m-joint`：plan create/list/get、approve（人签、authority≥70、TTL 默认 10 分钟）、status、dispatch --dry-run（打印控制信封，真实发送未接线并返回 DISPATCH_NOT_WIRED）。
+- 该 CLI 是 SOP 的操作员入口：计划先落盘、人工审批、再允许派发；dispatch 真发仍要求 operator token 与 relay 能力广告（下一片）。
+- 端到端本机冒烟：create → approve → status(dispatch_allowed=true) → dispatch --dry-run(2 envelopes)。
+
+## [1.9.12] - 2026-10-28
+
+- 联合开发安全门（S1/S2 预置）：plan-store 保存与读取都重算 plan_sha256（篡改即 PLAN_TAMPERED）、planSha 强制 64 位十六进制（拒绝路径穿越）、审批绑定 plan_sha/approver/authority/TTL 并重算 approval_sha256（篡改/过期/低权限拒绝）、原子写。
+- 全部机器选中真实性（S1）：w2m_run 在派发前用当前设备名册重校验被选机器（离线即 TARGET_UNAVAILABLE，不换机）；派发后按 relay 的 leases 校验，发现未被点名的机器也拿到租约即取消任务并返回 SELECTION_NOT_HONOURED。
+- 新增 test/joint-dev-plan-store.test.mjs（11 项）。
+
+## [1.9.11] - 2026-10-28
+
+- 修复左侧栏只剩图标：GPW 名称恢复到入口内（🌐 GPW），侧栏 label 仍为空，避免再次重复。
+- 对话全文搜索：匹配项以黄色高亮（CSS Custom Highlight API ::highlight(w2m-conversation-search)），显示 当前/总数 计数；Enter/Shift+Enter 或 ↑/↓ 在命中项间滚动，Esc 清除。
+
+## [1.9.10] - 2026-10-28
+
+- 新增 `bin/w2m-self-update.mjs`：可被编队任务直接下发的自更新入口，读取 GitHub Release、校验 SHA256SUMS、调用已验证安装器，输出一行 JSON，不重启 DSH。
+- 固化升级策略：优先下发自更新指令；失败才使用 Node 远程执行回退（macOS 用 mac-self-update，Windows 用 node 替换+备份）。
+- 参数：--profile、--dry-run、--allow-prerelease；环境变量 W2M_PROFILE_DIR / W2M_UPDATE_REPO。
+
+## [1.9.9] - 2026-10-28
+
+- 对话主工作区新增全文搜索：会话头部（置顶按钮同排）🔍 图标，点击展开搜索框，Enter/Shift+Enter 或 ↑/↓ 在已渲染对话中查找并高亮（Electron/Chromium find）。
+
+- 修复 Windows「立即更新」失败：dsh 以 dsh.cmd 安装时，child_process.spawn(shell:false) 会报 EINVAL。现在 Windows 下不再把 .cmd/.bat 当作可直接执行计划，自动改用运行时 pnpm；若 dsh 计划出现 EINVAL，也会回退 pnpm 重试一次。
+- 新增回归测试：.cmd 计划被拒绝并走 pnpm；spawn 失败仍回滚。
+
+## [1.9.8] - 2026-10-28
+
+- 左栏 GPW 入口改为纯图标（🌐），去掉重复的文字条目。
+- 设置页 GPW 标签名称改为「GPW」，并使用与管理台一致的新页面（不再复用弹窗面板）。
+- 编队群组视图内补齐常用聊天表情行（此前只在浮窗全屏时出现）。
+
+## [1.9.7] - 2026-10-28
+
+- 侧边栏与设置页入口统一命名为「GPW」，左对齐并沿用插件标签的字体、字号与间距。
+- GPW 主工作区面板与设置页面板改为管理台布局：标题 + 查询/操作卡片 + 标签页 + 数据表格（路径/类型/状态/移除），参考系统黑白名单界面。
+- 右下角浮标继续复用原弹窗面板，Composer 入口不变。
+
+## [1.9.6] - 2026-10-28
+- 修复：左侧栏 GPW 点击无效。侧栏入口改用 `main` 槽位（key 与 panellist id 一致），点击切换到主工作区的完整 GPW 页面。
+- GPW 页面改为主工作区整页布局（960px 内容、独立滚动、卡片化分区），不再是右下角弹窗形态。
+- 修复：设置页 GPW 标签沿用设置页样式（与通用设置页一致的卡片/分区）。
+- 新增：「编队群组」对话视图标签（conversation.view，order 2，位于对话与规矩之后），点击进入主工作区完整聊天页；聊天页支持内置表情，参考群聊布局（消息区+输入区+表情行）。
+- 底部状态栏保持：本编队在线/总数、全部机器在线/总数。
+本次为 v1.9.5 五方发布（1.9.4 未发布，内容并入本版本）。
+- 顶部标签栏新增「编队聊天」入口：点击进入完整分页面，支持内置表情。
+- 底部状态栏常驻显示：本编队在线/总数、全部机器在线/总数，无需展开 Composer 的机器列表。
+- 左侧导航栏新增 GPW 入口（🌐 图标），位于插件与自动化任务之间；点击进入完整分页面（960px 工作区），右下角浮标与 Composer 入口保持不变。
+- 设置页新增 GPW 标签栏，位于「模型」与「内置插件」之间，内嵌完整 GPW 管理面板。
+- 插件详情页（与卸载按钮同页）新增「W2M 插件更新」：检测更新、立即更新、自动更新开关；安装完成后自动刷新页面，无需卸载、无需重启应用。
+- 更新检测打开即执行；旧版本直接显示新版本号与安装按钮；npm 镜像失败回退 registry.npmjs.org。
+
+## [1.9.5] - 2026-10-27
+
+## [1.9.3] - 2026-10-27
+- 左侧边栏新增常驻 GPW 入口（默认显示、无关闭按钮），Composer 与右下角浮窗保留。
+- 插件设置页新增“W2M 插件更新”分区：检测更新、发现新版本后立即安装、自动更新开关（开启后每次启动自动安装）。
+- 更新检测修复：设置页打开即检查；本机为旧版时直接显示新版本号与安装按钮；npm 镜像不可用时回退 registry.npmjs.org。
+- 自动更新不再只是偏好：开关打开后会实际调用校验与安装流程，并提示重启。
+
+## [1.9.2-beta.1] - 2026-10-27
+- P0 止血：relay 数据面端点退役（blob/blob-sessions/latest → 403），结果信封校验后投影后存储（不再落 argv/head/tail/路径原文）。
+- B1 兼容窗口：默认接收 v1 信封并投影，设置 W2M_DATA_PLANE_GUARD=enforce 才硬拒。
+- guard 递归扫描 + 16 KiB 语义上限 + 协议错误形状。
+- beta：仅 GitHub prerelease，不含 npm/packages 发布。
+**V1.9.1 更新**
+
+## [1.9.1] — 2026-10-27
+
+## [1.9.0] — 2026-10-27
+
+**V1.9.0 大版本更新**
+
+## [1.8.2] — 2026-10-26
+
+**GPW 超时策略：黄类（名单外）100 秒无人应答自动同意；黑白名单规则不变；已覆盖父目录的子文件夹拦截记录折叠。**
+
+- **只读工具绿名单扩展**：`read/read_file/search/grep/glob/list/…`、`job_list/job_output/job_status/job_wait`、`w2m_status/w2m_devices/w2m_tasks/w2m_history/w2m_report/w2m_memory/w2m_stats` 判为绿色（无打扰放行）；`job_kill/job_start/w2m_run/w2m_cancel/w2m_intent` 仍为黄色（可变更，需人工）。
+- 超时默认值 120s → **100s**；超时结果由「拒绝」改为「自动同意」（仅黄类 / 名单外路径调用）。
+- 红线（危险命令、敏感/系统路径、显式 deny）仍然立即拒绝，不进入待审批队列；白名单命中仍然立即放行。
+  因此超时规则不会扩大任何名单的授权范围。
+- 自动同意的调用会记录为会话授权（指纹），同一操作的后续出现以蓝色（已授权常态）直接放行。
+- 「最近被拦截」折叠逻辑确认覆盖父目录下的子文件夹：名单条目是根目录，其任意深度子文件夹的拦截记录都会进入
+  「已在名单中 N 条」折叠组（`folder_in` 双向包含匹配）。
+- 新增 `test/gpw-auto-approve.test.mjs`（4 项：超时自动同意→下次变蓝；红线仍拒；白名单立即放行；100s 默认值）。
+- 证据：`docs/acceptance/1.8.2/GPW-AUTO-APPROVE.json`。
+## [1.8.1] — 2026-10-26
+
+**GPW「最近被拦截」去噪：已在名单中的条目折叠显示；加入名单后条目立即消失。**
+
+- 状态接口为每条 recent 增加 `folder_in`（whitelist / blacklist / null）：文件夹已被名单覆盖的拦截记录不再占用主列表。
+- 面板把已覆盖条目折叠为「已在名单中 N 条 · 展开/收起」，展开后只读展示（不重复给加入按钮）。
+- 从最近拦截一键加入白/黑名单时，服务端同步裁剪该条目（以及被同一父目录覆盖的条目），下一次轮询不再出现。
+- 新增 `test/gpw-recent-fold.test.mjs`（4 项：覆盖归属、嵌套覆盖、客户端折叠静态断言、状态接口字段）。
+- 证据：`docs/acceptance/1.8.1/GPW-RECENT-FOLD.json`。
+## [1.8.0] — 2026-10-26
+
+**GPW 增加四色审核 / 标记 / 提醒系统：绿（通过）、蓝（正常）、黄（警报）、红（风险）。**
+
+- 新增 `src/plugin/gpw-colors.mjs`：把 DSH 各插件的审核行为归位到四色（只读/L1-L2/白名单命中/allow-list = 绿；
+  本会话已批准过（指纹授权）= 蓝；越界写、非白名单命令、中风险 git/npm/网络操作、未知工具 = 黄；
+  危险命令黑名单、敏感路径、系统路径、显式 deny 目录 = 红）。
+- 门控改为颜色决策：绿/蓝直接放行（蓝来自会话内批准后的操作指纹）；黄进入 GPW 待审批队列；红直接拒绝
+  （`tools.guard` + `tools/pre-execute` 双保险，拒绝理由带颜色语义）。
+- 标记与提醒：`/api/w2m/gpw/state` 新增四色计数（colors）、待审批项与最近拦截项的颜色字段；
+  面板显示四色图例与计数，待审批/最近条目带颜色标记；「允许本次会话」动作（allow-session）批准后，
+  同一操作后续以蓝色（已授权常态）放行。
+- 一句话语义：绿=不用管，蓝=管过了，黄=现在管，红=管也不让过（或必须人工硬确认）。
+- 证据：`docs/acceptance/1.8.0/GPW-COLORS.json`。
 ## [1.7.9] — 2026-10-26
 
 **GPW 三项操作性问题修复：拦截即时弹选择、名单长列表折叠、名单文件防篡改。**
 
-- **名单策略调整：文件夹包含子文件夹**：名单条目按「根目录 + 全部子文件夹」递归匹配（`E:\work` 覆盖 `E:\work\a\b\c.txt`，`E:\workshop` 不会被误匹配；嵌套黑名单仍优先）；命令工具里的相对路径按会话工作区解析后再分类。新增测试覆盖递归覆盖、同前缀兄弟目录与相对路径。
-- **发布门禁稳定性**：`test/mcp-http-live.test.mjs` 的 relay 实连用例在出口网络不可达（或 MCP 工具层报 "could not reach the relay"）时明确 `skip`，网络抖动不再把 release 门禁判红；其余用例仍覆盖本地绑定行为。
+- **名单策略调整：文件夹包含子文件夹**：名单条目按「根目录 + 全部子文件夹」递归匹配（`E:\work` 覆盖 `E:\work\a\b\c.txt`，`E:\workshop` 不会被误匹配；嵌套黑名单仍优先）；命令工具里的相对路径按会话工作区解析后再分类。新增测试覆盖递归覆盖、同前缀兄弟目录与相对路径。
+- **发布门禁稳定性**：`test/mcp-http-live.test.mjs` 的 relay 实连用例在出口网络不可达（或 MCP 工具层报 "could not reach the relay"）时明确 `skip`，网络抖动不再把 release 门禁判红；其余用例仍覆盖本地绑定行为。
 - **拦截即审批（不再静默挂起）**：`tools/pre-execute` 挂起 C 类调用后，客户端在 **composer 行**
   （`conversation.input.left`）新增内联提示 `GpwPrompt`：显示工具名与「允许本次 / 拒绝本次 / 打开面板」；
   多个待审批显示数量。浮窗按钮增加待审批数量徽标，`w2m-gpw-open` 事件让内联提示直接打开面板。
@@ -243,1572 +259,1572 @@ All notable changes to this project are documented here.
   - 旧版无签名文件在首次启动时一次性迁移为 v2；升级后再次出现的无签名/缺失文件视为篡改。
   - 诚实边界：DSH 与插件同用户运行时，OS 只读位可被有意的进程绕过；但签名校验使**静默改名单不可能**，
     篡改会被检测并锁定（需操作员重置）。强隔离需独立用户/服务账号（后续项）。
-- **名单继承保证**：黑白名单与其 MAC 密钥位于 `$DSH_HOME/xclient/`（插件包之外），升级、重启、卸载重装都会原样继承；只有面板中的显式「移除 / 重置名单」会改变它。新增 `test/gpw-persistence.test.mjs`（5 项）覆盖。
+- **名单继承保证**：黑白名单与其 MAC 密钥位于 `$DSH_HOME/xclient/`（插件包之外），升级、重启、卸载重装都会原样继承；只有面板中的显式「移除 / 重置名单」会改变它。新增 `test/gpw-persistence.test.mjs`（5 项）覆盖。
 - 测试：新增 test/gpw-hardening.test.mjs（8 项：签名往返、只读拒绝直写、MAC 不匹配/删除检测、legacy 标记、reset、密钥 sidecar）
   与 test/gpw-tamper-gate.test.mjs（4 项：篡改 fail-closed → 409 → 重置恢复 → 内联审批放行；legacy 迁移；客户端内联提示/折叠/重置静态断言）。
   reset、密钥 sidecar）。`client-bundle` 更新为五个 composer 控件；`gpw-activation` 用临时名单文件隔离，
   不再写真实 `~/.dsh`。
 - 证据：`gpw-hardening 8/8`、`gpw-folder-policy 9/9`、`gpw-activation 4/4`、`client-bundle 26/26`（node 进程内运行）。
 
-## [1.7.8] — 2026-10-26
-
-**GPW 启用失败修复（第二个）：`TypeError: Cannot read properties of undefined (reading 'layers')`。**
-
-- 根因：v1.7.7 为做黑名单同步拒绝，在**激活期**调用根上下文的 `ctx.tools.guard()`。tools 服务是**按 agent 组合**的，
-  根作用域实例在激活阶段还没有 layer 表，于是抛 `reading 'layers'`，dsh-gpw 仍无法激活。
-- 修复：改为在 `agent/created` 监听里对**每个 agent 自己的上下文** `agent.ctx.tools.guard(...)` 注册黑名单守卫，
-  并用 `ctx.effect` 统一释放；根上下文不再读取 tools 服务（`inject` 回到只有 `permissionPresets`）。
-- 保留 `tools/pre-execute` 三分类拦截；guard 缺失的宿主不会因此激活失败（pre-execute 仍会拒绝黑名单）。
-- 回归测试升级：`test/gpw-activation.test.mjs` 现在用严格 Cordis 语义 Proxy（读取根 `tools` 即抛错）验证激活，
-  并通过伪造 `agent/created` 断言守卫注册在 agent 上下文。
-- 同时补全 bundle patch 中 GPW v2 的配置项（requireFullAccess / whitelist / blacklist / pendingTimeoutMs）。
-- 证据：`docs/acceptance/1.7.8/GPW-AGENT-SCOPE.json`。
-## [1.7.7] — 2026-10-26
-
-**GPW 子插件启用失败修复：`cannot get property "tools" without inject`。**
-
-- 根因：`gpw.mjs` 读取 `ctx.tools.guard` 做黑名单同步拦截，但 `inject` 只声明了 `permissionPresets`。
-  Cordis 对未声明服务读取直接抛错，插件激活因此失败（组件启用失败：1 entry did not activate dsh-gpw）。
-- 修复：`inject = ['permissionPresets', 'tools']`；guard 读取改为防御式（老宿主无 guard 扩展时不影响
-  `tools/pre-execute` 拦截）。
-- 新增回归测试 `test/gpw-activation.test.mjs`：用严格 Cordis 语义的 Proxy 上下文调用 `apply()`，
-  未声明服务读取即抛错；断言 `tools/pre-execute` 监听已安装。
-- 证据：`docs/acceptance/1.7.7/GPW-INJECT.json`。
-## [1.7.6] — 2026-10-25
-
-**审计修复版：测试零残留工具链 + 修复泄漏的测试夹具，并固化 v1.6.1→v1.7.4 审计报告。**
-
-- 新增 `scripts/temp-residue.mjs`（`snapshot` / `report` / `clean`）：对用户 TEMP 中 `w2m-*`、`gpw-*`
-  测试残留做基线快照、前缀统计与按年龄的安全清理；审计实测清理了 15,608 个历史残留目录。
-- 新增 `test/helpers/temp-cleanup.mjs`：基线式 per-test 清理，避免并发测试互删夹具。
-- 修复会泄漏临时目录的测试：`gpw-folder-policy`、`agent`（workspace 两处 fixture）、`worktree`（makeRepo）。
-- 零残留复测：单轮全量测试新增残留从约 1,000 个降至 74 个（剩余前缀已量化，作为下一轮清理清单）。
-- 新增审计报告 `docs/audit/AUDIT-1.6.1-1.7.4.md`：14 个正式版的 Release/CI/Compat 全绿记录、
-  2930 个测试 0 失败、lint 0 error、实机部署与落库断言、relay 延迟与测试耗时实测。
-- 证据：`docs/acceptance/1.7.6/AUDIT-ZERO-RESIDUE.json`。
-## [1.7.5-beta.1] — 2026-10-25
-
-**GPW 升级为文件夹三分类网关（完全权限下生效）：黑名单拒绝 / 白名单放行 / 其余进入 GPW 自己的待审批队列。**
-
-- 生效条件：仅当会话权限预设为 **完全权限**（`danger-full-access`）时拦截；其它预设交给 DSH 自己的沙箱/审批，
-  不重复介入。
-- **黑名单（拒绝）**：`ctx.tools.guard()` 同步拦截，返回拒绝原因即不执行；与 `tools/pre-execute` 的监听顺序无关。
-- **白名单（通过）**：等价于扩大的工作区，无需再审；仍受自动审批预算约束（每滚动窗口 10 次、间隔 3s），
-  预算耗尽后同样进入待审批队列而不是静默放行。
-- **其它文件夹（C 类，待审批）**：调用被挂起，进入 GPW 自己的待审批队列；用户在 GPW 面板点「允许本次/拒绝本次」
-  才继续（默认 120s 无答复则拒绝）。这不是 DSH 的 approval 策略，所以在 approval=never 的完全权限下依然有效。
-- 面板（Node 执行能力菜单内新增「GPW 文件夹策略」）：白/黑名单展示与移除；「添加文件夹」通过宿主原生选择器
-  （Windows FolderBrowserDialog / macOS choose folder / zenity）选路径，读写名单不需要编辑任何 profile YAML；
-  名单保存在 `$DSH_HOME/xclient/gpw-folders.json`，另有待审批列表与允许/拒绝按钮。
-- 测试：`test/gpw-folder-policy.test.mjs`（6/6，三分类、deny 优先、前缀误判防护、命令路径提取、预算映射）。
-## [1.7.4] — 2026-10-25
-
-**修复两处桌面宿主兼容性问题：`agent.identity` 崩溃、切换 relay 后旧 device token 导致 401 无法入队。**
-
-- 崩溃修复：`agent.identity?.()` 在桌面宿主上抛 `TypeError: agent.identity is not a function`，
-  且发生在 `agent.start().then(...)` 回调里变成未处理 rejection，把整个 DSH 宿主带崩。
-  新增 `agentIdentityOf()` 做类型判断，`agent.start()` 仍为非阻塞并记录失败。
-- 迁移修复：relay 切换到新主 relay 后，`device.json` 里的 token 属于旧 relay，新 relay 回
-  `401 UNAUTHORIZED: missing or invalid device_token`；启动逻辑看到已有 token 就跳过配对，
-  导致机器停在"无列表"。现在会先用 token 探测配置的 relay：**明确 401/403 才丢弃并重新配对**，
-  网络错误保留 token（不会因短暂故障误触发配对）。
-- 新增回归测试：`test/agent-identity-safe.test.mjs`、`test/re-pair-stale-token.test.mjs`。
-- 证据：`docs/acceptance/1.7.4/DESKTOP-HOST-COMPAT.json`（含真实崩溃信息与迁移症状）。
-## [1.7.3] — 2026-10-25
-
-**截图提示改为顶部浮层（5 秒自动消失、可关闭、不挤压输入框）；全服计数标注来源 relay 并单列本编队。**
-
-- 截图成功/失败提示不再插在输入区里：改为聊天面板顶部浮层（绝对定位，不占布局；连续截图只替换同一行，
-  不会越堆越多），**5 秒自动消失**，右侧 × 可立即关闭。
-- 全服统计行改为「主 relay（地址）全服：X/Y 个编队 · A/B 台在线」，并新增一行「本编队：n/m 台在线」；
-  两者语义不同，不再混在一起看。
-- relay 角色判定改为按**配置的主 relay**（不再按响应最快，备用 relay 偶然更快时会被误标成 primary）。
-- 证据：`docs/acceptance/1.7.3/TOAST-AND-TOTALS.json`（fleet task `01M5ANYMVMSGGQV`；宿主截图 141,768 字节）。
-## [1.7.2] — 2026-10-25
-
-**按实测反馈调整编队聊天截图/复制：只复制不预览、快捷键 Ctrl+Shift+P、强制可选中。**
-
-- 截图按钮不再在面板里生成缩略图/下载行：抓到画面后**只写入剪贴板**并给一行提示，聊天区域保持干净。
-- 快捷键从 Ctrl+P 改为 **Ctrl+Shift+P（macOS 也支持 Cmd+Shift+P）**；普通 Ctrl+P 不再被劫持，
-  浏览器/应用的打印快捷键恢复原样。
-- 选中&复制：`user-select:text!important` 应用到整个面板的所有子节点（不再只覆盖几个类），
-  并在消息列表上阻止宿主吞掉 mousedown/copy 事件，保证拖选与 Ctrl+C 生效；单条消息的 ⧉ 复制按钮
-  仍走「浏览器剪贴板 → 宿主剪贴板」回退链。
-- 全服统计只认**配置的主 relay**：主 relay 不可达时不再把备用 relay 的数字（1/1 编队、2/5 在线）当"全服"显示，
-  而是显示「主 relay 不可达 · 全服统计不可用」。修复了在线编队/在线机器数量"错误"的观感来源。
-- 证据：`docs/acceptance/1.7.2/CHAT-CLIPBOARD-SHORTCUT.json`（fleet task `01M5ANYMVMR3IOB`；
-  宿主截图实测 159,561 字节并复制成功）。
-## [1.7.1] — 2026-10-25
-
-**修复桌面壳下聊天截图/复制失败（permission denied）与插件更新"no supported installer available"。**
-
-- 截图：浏览器 `getDisplayMedia` 在 DSH 桌面（Electron）被拒绝（`permission denied`）。新增**宿主侧截图**
-  `POST /api/w2m/capture`（Windows PowerShell System.Drawing；macOS screencapture；返回 JPEG base64），
-  按钮与 Ctrl+P 在渲染层捕获失败时自动回退到宿主截图，并在宿主侧复制到剪贴板。
-- 复制：`navigator.clipboard` 被拒时新增**宿主剪贴板** `POST /api/w2m/clipboard`（Windows Set-Clipboard /
-  macOS osascript），单条消息复制按钮与复制文本都走这条回退链。
-- 选中：transcript 的 `user-select:text` 改为 `!important`，避免宿主全局样式覆盖导致无法选中。
-- 插件更新：`update-install` 的安装器解析新增桌面运行时布局
-  （`<app>/resources/runtime/<runtime>/dependencies/pnpm/bin/pnpm.mjs`、`~/.dsh/dsh-runtimes` 兜底），
-  并用运行时自带的 `node` 执行 pnpm（桌面壳的 `process.execPath` 不是 Node）。修复了更新按钮
-  "install update: no supported installer available"。
-
-- 测试：capture-route 4/4、fleet-chat-capture 3/3、client-bundle 26/26、update-resolver 4/4；
-  证据 `docs/acceptance/1.7.1/DESKTOP-CAPTURE-UPDATER.json`（fleet task `01M5ANYMVMN9CNQ`）。
-## [1.7.0] — 2026-10-25
-
-**编队聊天框：截图按钮 + Ctrl+P 快捷键 + 对话内容可选中&复制。**
-
-- 输入区新增 **📷 截图按钮**：`getDisplayMedia` 让用户选屏幕/窗口 → 抓帧为 PNG → 自动复制到剪贴板，
-  面板内显示缩略预览（可下载/再次复制）；宿主不支持或权限被拒时在面板内显示原因，不抛未处理异常。
-- **Ctrl+P（macOS 也支持 Cmd+P）**：聊天面板打开时触发同一截图流程，并在捕获阶段 `preventDefault`，
-  不会弹出浏览器打印对话框。
-- **对话内容可选中&复制**：transcript/消息文本 `user-select:text`；每条消息新增 **⧉ 复制** 按钮；
-  划选文字时点击消息不会误触发"回复"。
-
-已知边界：编队聊天协议仍是纯文本（relay 消息不含图片字段），所以截图是"复制到剪贴板 + 预览/下载"，
-不会作为图片消息广播给其他机器——图片传输需要扩展 relay 消息协议（后续版本）。
-
-- 测试：`test/fleet-chat-capture.test.mjs` 3/3；client-bundle 26/26；
-  证据 `docs/acceptance/1.7.0/CHAT-CAPTURE-CONTROLS.json`（fleet task `01M5ANYMVMLRC5H`）。
-## [1.6.9] — 2026-10-24
-
-**修复 failover 监控从未安装的根因：`startLocalStack` 等待了永不 settle 的 `agent.start()`。**
-
-阶段日志（macOS，1.6.8，现场实测）：
-
-```
-W wrap enter relayUrls=[腾讯云, Vultr]   ← 配置正确
-A startLocalStack enter
-C createAgent done
-S before agent.start              ← 之后没有任何日志
-```
-
-agent 实际已上线（编队在线），但 `await agent.start()` 的 Promise 永不返回，导致 `startLocalStack` 不返回 →
-`startFailoverStack` 永远走不到 `relayPool(cfg)` / `setInterval`，**监控循环从未创建**，自动 failover 不可能触发。
-
-修复：
-
-- `startLocalStack` 不再 await `agent.start()`：后台启动，失败写日志（`w2m: agent start failed`）。
-- mount 只需要返回清理句柄，不需要"观察启动完成"；agent 会通过 relay 自报在线。
-- 新增回归测试 `test/agent-start-nonblocking.test.mjs`：读取源码，若 `startLocalStack` 再次 await
-  `agent.start()` 即失败（防止该阻塞回归）。
-- 证据：`docs/acceptance/1.6.9/FAILOVER-MONITOR-INSTALL.json`（fleet task `01M5ANYMVMKL55O`）。
-## [1.6.8] — 2026-10-24
-
-**插件面板新增「检查插件更新」按钮：npm 对比 → 自动更新 → 提示重启 DSH。**
-
-- 客户端：目标机器菜单 relay 区新增按钮。点击后：① GET `/api/w2m/plugin-update` 联网查 npm latest
-  并与已装版本比较；② 有新版时 POST `{action:"apply"}` 执行安装；③ 安装完成显示"请重启 DSH 以载入最新插件"。
-- 宿主：新增路由 `/api/w2m/plugin-update`。检查逻辑在 `src/plugin/npm-update.mjs`（纯函数，可单测：只认
-  `latest > installed`，网络失败是错误值而不是"已最新"）。
-- 安装复用**既有已验证更新器**（`auto-update.mjs` → `update-install.mjs`）：下载 tarball、用 release
-  SHA256SUMS 校验 SHA-256、备份旧包、替换新版——按钮点击不会引入第二套弱校验安装路径。
-- 测试：npm-update 4/4、client-bundle 26/26；证据 `docs/acceptance/1.6.8/PLUGIN-UPDATE-BUTTON.json`
-  （fleet task `01M5ANYMVMI9EHA`）。
-- 边界：DSH 插件管理页的「卸载」按钮属于宿主应用（打包在 app.asar 内），插件包无法直接注入其旁边；
-  本按钮位于 w2m 插件自己的面板中。若要放进宿主插件页，需要 DSH 侧提供插件动作扩展点（已列为待评估）。
-## [1.6.7] — 2026-10-24
-
-**修复 v1.6.6 failover 的阻塞 bug：远端 relay 模式下清理函数抛错，切换后无法重启 stack。**
-
-现场演练（停主 relay 180s）暴露：机器掉线后没有切到备用，恢复主 relay 后才重新上线。根因：
-
-- `startLocalStack` 的清理函数无条件执行 `await relay.close()`；而 `relay` 只在"本进程自建本地 relay"
-  时才非空，远端 relay 模式下是 `null` → 抛 TypeError；
-- failover 的切换流程 `await stop()` 抛错后被 catch 吞掉，**后续的 restart 从未执行**（stack 停了没起来）。
-
-修复：
-- 清理函数 null-safe/idempotent：仅当 `relay` 是带 `close()` 的对象才调用；`agent.stop()` 失败也继续清理。
-- 切换流程：`stop()` 失败不再跳过 restart；并写诊断日志 `xclient/relay-failover.log`（每轮探测/切换/重启错误）。
-- 测试：relay-failover 5/5、relay 200/200；证据 `docs/acceptance/1.6.7/FAILOVER-CLEANUP-FIX.json`
-  （fleet task `01M5ANYMVMFSSP3`）。
-## [1.6.6] — 2026-10-24
-
-**relay 自动 failover：主 relay 故障时自动切到备用，恢复后自动切回。**
-
-现场事故（2026-10-24）：主 relay 主机整体不可达（8787 与 SSH 22 都超时），备用 relay 一直健康，
-但每台机器仍死连主 relay——备用链路只是常驻成员，不会接管，编队停摆。
-
-- 新增 `src/plugin/relay-failover.mjs`：非对称滞回状态机（**连续 3 次**探测失败才切走，**连续 5 次**
-  健康才切回；没有可达备选则不切）。纯函数，边界可单测。
-- `startLocalStack` 外包一层 `startFailoverStack`：每 10s 探测池内各 relay `/healthz`；
-  决策为切换时，停止当前 in-process stack，把 `cfg.rabbitUrl` 设为备 relay 并重启 stack——
-  **切换是重新入队（fleet key 重新配对），不是重连**（device token 是按 relay 签发的）。
-- `w2m_status` 新增 `failover` 快照：primary/active/pool、失败计数、切换次数、最近切换原因与历史。
-- 测试：relay-failover 5/5、relay 200/200；证据 `docs/acceptance/1.6.6/RELAY-FAILOVER.json`
-  （fleet task `01M5ANYMVM9GEKQ`）。
-## [1.6.5] — 2026-10-24
-
-**Windows 后台自动化不再弹窗：VBScript 隐藏包装 + 计划任务工具 + 文档。**
-
-现场故障：给 standby 守护（每 2 分钟）和 TwinsEarth 守望（每 5 分钟）用 `schtasks /TR "node.exe ..."`
-注册任务，导致桌面每隔几分钟弹出一个控制台窗口（守望脚本还会累积进程）。
-
-- 新增 `src/util/windows-hidden-task.mjs`：纯函数构造 VBScript 包装（`WScript.Shell.Run` 窗口样式 0、
-  不等待）与 `schtasks` 参数；命令行/参数先按 Windows 规则引用，再整体做一次 VBScript 转义（避免二次转义）。
-- 新增 `bin/w2m-hidden-task.mjs`：`--name/--every-minutes/--command/--arg/--workdir/--delete`，
-  一条命令注册“无窗口”计划任务。
-- 新增 `docs/WINDOWS-BACKGROUND-TASKS.md`：故障原因、正确做法、原则（分钟级任务只放短检查；一次性任务用完即删）。
-- 测试：windows-hidden-task 5/5（含转义与参数校验）；证据
-  `docs/acceptance/1.6.5/HIDDEN-BACKGROUND-TASKS.json`（fleet task `01M5ANYMVM30H98`）。
-## [1.6.4] — 2026-10-24
-
-**修复：`/healthz` 漏发 `fleets_online`（1.6.3 的 `fleetSummary` 已计算，但 `stats()` 没带到公开字段）。**
-
-- `stats()` 现在同时输出 `fleets_total` 与 `fleets_online`；
-- 面板可正确显示 `全服：X/Y 个编队 · M/T 台在线`（X = 至少一台机器在线的编队数）；
-- relay 主机升级到 1.6.4（含 1.6.3/1.6.2/1.6.1 全部内容）。
-- 测试：relay 200/200、fleet-target 49/49；证据 `docs/acceptance/1.6.4/HEALTHZ-FLEETS-ONLINE.json`
-  （fleet task `01M5ANYMVLX3MI7`）。
-## [1.6.3] — 2026-10-24
-
-**编队与机器同构显示：在线编队数/编队总数 + 在线机器/机器总数。**
-
-- relay `fleetSummary()` 新增 `fleets_online`（至少一台机器在线的编队数），`/healthz` 公开计数同步增加；
-- 面板 relay 区显示：`全服：X/Y 个编队 · M/T 台在线`（fleet-target probe 读取 `fleets_online`）；
-- relay 主机升级到 1.6.3（含 1.6.2 全服概览与 1.6.1 安全修复）。
-- 测试：relay 200/200、fleet-target 49/49、client-bundle 26/26；证据
-  `docs/acceptance/1.6.3/ONLINE-FLEETS.json`（fleet task `01M5ANYMVLWMTSG`）。
-## [1.6.2] — 2026-10-24
-
-**relay 全服概览：多少个编队、多少台机器在线（healthz + operator /v1/fleets + 面板一行显示）。**
-
-- `state.fleetSummary()`：按 fleet 聚合设备数/在线数，返回 `fleets_total`、`devices_online`、
-  `devices_total`、`unfleeted_devices` 与 per-fleet 明细。
-- `GET /healthz`（公开）新增上述**聚合计数**（不暴露 per-fleet 明细）；
-- `GET /v1/fleets`（operator token）：返回 per-fleet 明细（其他账号的编队名不向普通设备暴露）。
-- 面板 relay 折叠区新增一行：`全服：N 个编队 · M/T 台在线`（fleet-target probe 读取 healthz 计数）。
-- relay 主机将升级到 1.6.2（包含 1.6.1 的 Node 执行仅人工/内存态与 allow-list 解释器身份修复）。
-- 测试：relay 200/200、fleet-target 49/49、client-bundle 26/26；证据
-  `docs/acceptance/1.6.2/RELAY-FLEET-OVERVIEW.json`（fleet task `01M5ANYMVLRYXSN`）。
-## [1.6.1] — 2026-10-24
-
-**Node 执行开关改为「仅人工 UI 手动、进程内存态」：文件/远程/自动化一律无法授权。**
-
-本次实机验证暴露了一个必须修掉的现实：grant 任务可以远程写 `~/.w2m/exec-capability.json`，
-从而远程把机器变成可执行任意 Node 代码——与"最高权限只允许人工手动选中"直接冲突。
-
-- 能力状态改为**进程内存**唯一权威：`readExecCapability` 不再读磁盘；旧文件（含 permanent）被忽略；
-  只有 host 路由 `/api/w2m/capability`（composer 人工点击）能写。
-- **不随重启保留**：进程退出即回到 denied（"永久"= 本次进程生命周期）；
-  `describe` 明确返回 `survives_restart: false`、`manual_only: true`、`file_ignored: true`。
-- 三态语义不变：denied / temporary（默认 24h，上限 7 天，过期即失效）/ permanent（本进程内）。
-- 测试重写：`test/exec-capability.test.mjs` 6/6（含"磁盘写 permanent 仍 denied""路由是唯一 setter"
-  "重启即撤销"）；agent.test 161 项通过（PATH 环境问题已在本机修复，非代码缺陷）。
-- 修复 allow-list 解释器身份回归：当 argv[0] 是 **运行 agent 的同一个 node（process.execPath）** 时，
-  bare 条目 `node` 应放行（此前机器 PATH 里 node 指向别的程序时会误拒，实测 12 个 e2e 失败）。
-- 证据 `docs/acceptance/1.6.1/MANUAL-ONLY-CAPABILITY.json`（fleet task `01M5ANYMVLDYWBH`）。
-## [1.6.0] — 2026-10-24
-
-**一台 relay 承载 N 个编队：每个 DeepSeek 账号一个编队，共享 relay 但互相隔离。**
-
-- bootstrap 答案从"单个编队的归属"改为"relay 拓扑声明"：签名与有效期仍严格，fleet_id 不匹配不再拒绝
-  （`strictFleet: true` 保留旧行为）。一份 operator 签名即可服务全部编队，新账号机器无需人工重签。
-- `scripts/verify-fleet-isolation.mjs` 扩展到 **3 个编队** 14 项检查（设备枚举/任务/聊天/记忆），全过。
-- 新增 `docs/MULTI-FLEET.md`：编排模型、运维视图、零人工接入新账号、配额与边界。
-- 测试：bootstrap 6/6（含拓扑答案用例）、fleet isolation 14/14；证据 `docs/acceptance/1.6.0/N-FLEET.json`
-  （fleet task `01M5ANYMVLBU716`）。
-## [1.5.5] — 2026-10-23
-
-**跨编队隔离：同 relay 上的另一账号机器不再出现在本编队的枚举/任务/聊天/记忆里。**
-
-现场：另一账号的机器（自己的 fleet_id、自己的 fleet_key）出现在我们的机器列表里，被读成"非本账号
-机器进入编队"。排查结论：该机器的编队绑定本身是正确的，问题在于 relay 的**读取面没有按 fleet 过滤**
-（派发侧自 v0.7.7 起已按 fleet 隔离，operator token 为 relay 级权限属于设计）。
-
-- `GET /v1/devices`：按请求设备的 fleet 过滤（无 fleet 的旧设备在未配置 fleet 的 relay 上保持历史行为）。
-- `GET /v1/tasks`：任务记录携带 `fleet_id`，列表按调用者 fleet 过滤（operator 派发是 relay 级，不会进入
-  某个编队的列表）。
-- `POST /v1/fleet/messages`：`fleet_id` 取自已认证设备，忽略 body（防止把消息标成别的编队）。
-- `GET /v1/fleet/messages`：读取时按调用者 fleet 过滤。
-- fleet memory 文档按 fleet 前缀隔离（无 fleet 设备沿用历史键，单编队 relay 不受影响）。
-- 新增 `scripts/verify-fleet-isolation.mjs`：真实 relay + 两个 fleet 的黑盒验证（设备/任务/聊天/记忆
-  共 11 项检查），可作为部署前门禁脚本运行。
-- 验证：脚本 11/11 通过（fleet task `01M5ANYMVL2Q8PD`）；relay.test 200/200 通过。
-## [1.5.4] — 2026-10-23
-
-**验签 bootstrap 的结果覆盖过期的显式 relay（现场故障：设备仍指向 127.0.0.1）。**
-
-现场证据：DSH 升级到 v1.5.3 后仍报 `W2M_UNREACHABLE: could not reach the Rabbit at
-http://127.0.0.1:8787`——它的 profile 仍显式写着本机地址，v1.5.3 只在“无显式 relay”时才采用
-bootstrap 池，于是拿到池却继续拨 loopback。
-
-- bootstrap 验签成功后**总是采用** `relays[0]` 作为 `rabbitUrl`，并 warn 记录被替换的旧地址；
-  想固定 relay 的运维应显式设置 `relayUrls`（此时 bootstrap 分支不执行）。
-- 只影响“验签通过”的答案；失败仍保持原配置并写 `w2m_status.bootstrap.last_error`。
-- 测试：bootstrap 6/6、bootstrap-cli 6/6；证据 `docs/acceptance/1.5.4/BOOTSTRAP-WINS.json`
-  （fleet task `01M5ANYMVL0FV9C`）。
-## [1.5.3] — 2026-10-23
-
-**零接触自动入队：只能升级插件的机器也能自己找到编队。**
-
-v1.5.2 的验签 bootstrap 需要一个 URL、一个 operator 公钥和 fleetKey 才能触发——新装机器三样都没有，
-于是仍然回落到编译期默认 relay 并报 W2M_UNREACHABLE。v1.5.3 把触发条件做进包里：
-
-- 包内置默认 bootstrap 端点与 **operator 公钥 pin**（只含公钥；端点无法签发，私钥不出运维机）。
-- bootstrap 证明改为可选：机器还没拿到 fleetKey 时，仍可凭"签名 + 有效期 + relay 形状"采用
-  operator 声明的 relay 池（relay 列表是公开路由信息；加入编队仍需账号派生密钥，是独立一步）。
-- `startLocalStack` 在无 relayUrls 时始终尝试 bootstrap（默认值生效），成功即用池（首个 primary），
-  失败保持回落并写入 `w2m_status.bootstrap.last_error`。
-- 包内默认 patch：`autoStartAgent: true`（本 fork），新装即启动 agent。
-- 因此只有"升级插件"这一条通道的机器：升级 → 重启 → 自动取 relay 池 → 账号密钥就绪后自动配对入队。
-- 测试：bootstrap 6/6（含 keyless）、bootstrap-cli 6/6、fleet-target 49/49；层模型 clean；
-  证据 `docs/acceptance/1.5.3/ZERO-TOUCH-BOOTSTRAP.json`（真实 fleet task `01M5ANYMVKZ7DHH`）。
-## [1.5.2] — 2026-10-23
-
-**新机器自动获得 relay 归属（验签 bootstrap）+ 一次性配置工具。**
-
-- 新增 `src/plugin/bootstrap.mjs`：机器用 fleetKey 派生 HMAC 证明请求 relay 列表；响应必须由
-  operator 公钥（pin）对 canonical payload（fleet_id + 排序后的 relays + issued_at + expires_at）
-  验签；过期/错 fleet/被篡改/坏 JSON 全部命名拒绝。缓存每次读取都重验签名与有效期，手改缓存无效。
-  **任何失败都不改现有 relay 配置**，原因写入 `w2m_status.bootstrap.last_error`。
-- `startLocalStack` 接线：无 `relayUrls` 且配置 `bootstrapUrl`+`fleetKey`+operator 公钥时启动即解析
-  （缓存优先，其次网络），成功则采用该 relay 池（首个为 primary）；`w2m_status` 新增
-  `bootstrap {configured, url, source, relays, expires_at, last_error}`。
-- 新增 `bin/w2m-bootstrap.mjs`：一条命令写 `relayUrls`/`fleetKey`/`autoStartAgent` 到 profile patch，
-  只改受管键、写前备份、所有输入先校验；`--temporary` 写 `relayTemporary: true`，面板以
-  **红色“临时 Relay 节点（回退配置）”**显示。
-- 新增 `bin/w2m-bootstrap-sign.mjs`：运维侧用 operator 私钥签名 relay 列表，输出可静态托管。
-- 控制面板 relay 折叠区支持 temporary 红色标记（仅主题 token，无硬编码颜色）。
-- 层模型修复：bootstrap 模块不依赖 chatops 层（layer-check 保持 clean）。
-- 测试：bootstrap 5/5、bootstrap-cli 6/6、fleet-target 49/49、client-bundle 26/26；
-  证据 `docs/acceptance/1.5.2/VERIFIED-BOOTSTRAP.json`（真实 fleet task `01M5ANYMVKXNU8E`）。
-## [1.5.1] — 2026-10-23
-
-**备用链路的身份隔离 + 控制面板的 relay 折叠。**
-
-- `bin/w2m-secondary-link.mjs`：默认给子进程独立身份目录（`<stateDir>/dsh-home`），并同时设置
-  `DSH_HOME` / `USERPROFILE` / `HOME`，可用 `--identity-home` 指定。修复的是 v1.5.0 现场实测的坑：
-  备用链路首次启动覆盖了主链路 `~/.dsh/xclient/device.json`，机器在下一次重启前看不出问题，
-  重启后却会以**备用身份**连到**错误的 relay**。这种"重启后才爆"的坑按默认隔离处理。
-- 控制面板 relay 折叠：`GET /api/w2m/target` 快照新增 `relays`（`relayUrls` 数组优先，兼容单
-  `rabbitUrl`），探测 `/healthz` 后按 RTT 排序、标注 primary/standby/offline；超过 3 个节点时只显示
-  3 个并给出 "+N 折叠" 提示，展开后显示全部（含离线节点，不隐藏故障）。
-- 探针失败保留在列表末尾（`ok:false`），网络异常不会让节点从视图中消失，也不会抛进快照路径。
-- 测试：secondary-link 7/7、fleet-target 49/49（新增 relay pool 四个用例）；门禁 GREEN ×2；
-  证据 `docs/acceptance/1.5.1/IDENTITY-ISOLATION-RELAY-FOLD.json`（真实 fleet task `01M5ANYMVKS3OQZ`）。
-
-## [1.5.0] — 2026-10-23
-
-**多 relay 双通道（active-passive）+ relay 健康看门狗。**
-
-- 新增 `bin/w2m-secondary-link.mjs`：在一台机器上拉一条通往备用 relay 的常在线链接。
-  它监督子进程 `w2m-localside`（同一套协议客户端），子进程退出按指数退避重启并记录每次转换，
-  由 systemd/launchd/计划任务只守护这一层——避免"链接一次启动后静默死掉"的已知失败形态。
-- active-passive 是**路由规则**：两条链接都常连，任务只在主 relay 派发；主 relay 掉线或延迟严重时
-  把同一任务改派到备用 relay（机器已在线，无需重连），正常情况下一台机器只有一个执行者。
-- 新增 `deploy/relay/`：`w2m-watchdog.sh` + systemd `.service/.timer`。每 30s 检查
-  `/healthz` 的 `"ok":true`，连续 2 次失败才重启 relay/stun；每小时最多 5 次重启（避免掩盖根因），
-  日志写 `/var/lib/w2m/watchdog/watchdog.log`。relay 因此独立于"是否有编队成员"保持在线。
-- 新增 `docs/MULTI-RELAY.md`：拓扑、选路规则（健康且 RTT 最低且目标全在线）、relay 互为成员、
-  以及 relay 超过 3 个时客户端折叠显示（`relays: 3 shown · +N online`）的约定。
-- 测试：`test/secondary-link.test.mjs` 6/6（参数校验、child argv、退避重启、日志）；
-  门禁 GREEN ×2；证据 `docs/acceptance/1.5.0/SECONDARY-LINK.json`（真实 fleet task `01M5ANYMVKR311N`）。
-
-## [1.4.4] — 2026-10-23
-
-**relay 重启不再丢失编队归属（devices.json 持久化 fleet_id）。**
-
-- 持久化修复：`devices.json` 快照新增 `fleet_id` / `fleet_source`，`restore()` 同步恢复。
-  在此之前，relay 重启后设备全在、token 仍有效，但每台设备的 fleet 归属全变成 null——
-  编队"静默消失"且没有任何错误可看（本次在共享 relay 上实测复现）。
-- 桥接 getupdates 看门狗：空闲时每 10 分钟输出 `polling ... connection live`；
-  40s 长轮询超时明确记录 `poll timeout after 40s -- reconnecting`；
-  连续 5 分钟没有一次成功轮询则退出（exit 3），由 launchd KeepAlive / systemd Restart= 拉起新连接，
-  避免"进程活着但没人知道它是否还在轮询"的静默状态。
-- 测试：relay 新增 fleet 重启往返用例（pair by fleet_key → 重启 → fleet_id/fleet_source 保留）；
-  bridge 套件 36/36；门禁 GREEN ×2。
-- 证据：docs/acceptance/1.4.4/FLEET-PERSISTENCE.json（真实 fleet task `01M5FLEETPERSIST0000000002`）。
-
-## [1.4.3] — 2026-10-22
-
-**微信编队桥接：回复可靠性修复（不回复/静默问题）。**
-
-- 每条消息独立 try/catch：任何处理异常不再让进程退出，改为回复
-  `处理失败（阶段，错误码）：原因 + /help 提示`（新增 `renderBridgeError`）。
-- 桥接启动调用 `ilink/bot/msg/notifystart`：修复"token 有效、进程在跑、但 iLink 不推送消息"的静默状态；
-  日志记录 `notifystart : ok`，失败也记录原因。
-- 非文本、空消息、未以 `/run` 开头、权限不足、派发失败/超时等路径均保证有回复与下一步提示。
-- 运行方式支持 launchd 常驻（KeepAlive 自动拉起；macOS plist 由运维部署，不进入安装包）。
-
-- **授权优先级修复**：exec-capability 只在任务未携带 grant 时兜底；grant 被拒（replay / 过期 / 机器不符）
-  原样上报，不再被能力分支覆盖成路径匹配错误，`GRANT_REPLAY` 语义恢复。
-
-真机验收（macmini）：`notifystart ok`、错误回复代码在位、launchd state=running、bridge 进程存活；
-证据 `docs/acceptance/1.4.3/BRIDGE-LIVE.json`。测试：chatops-ilink-fleet-bridge 36/36。
-
-## [1.4.2] — 2026-10-22
-
-**Node 代码执行权限成为 UI 可激活的子插件能力（命中真机验收）。**
-
-- 新增 `src/util/exec-capability.mjs`：机器本地能力状态（拒绝 / 临时 24h / 永久），fail-closed；临时档带绝对
-  `expires_at_ms`，过期即拒绝；唯一可放行的前缀固定为 `node -e`。
-- 新增 host 路由 `GET/POST /api/w2m/capability`（`src/plugin/exec-capability-route.mjs`），同源、在 host
-  认证栅栏内；浏览器不接触文件系统或设备 token。
-- client `lib/client.js` 在 `conversation.input.left` 新增第三个控制（order 42）：
-  `Node 执行：拒绝 | 临时 24 小时 | 永久`，带 RCE 风险提示与剩余时间。
-- agent 每个任务前读取能力文件；命中时结果信封 `authorization.provenance = "exec-capability"`，
-  warnings 记录 `EXEC_CAPABILITY`；pipeline 各 stage 同样覆盖。
-
-真机验收（TwinsEarth，插件 1.4.2-beta.1；先清空 `cordis.patch.yml` 的旧 allow-list 以隔离能力路径）：
-- 无能力、空 allow-list：`node --version` → `COMMAND_NOT_ALLOWED`
-- 能力=永久、空 allow-list：`node -e` → **ok**（`node -e` 是唯一被放行的前缀）
-- 能力=临时 5s 到期后：`node -e` → `COMMAND_NOT_ALLOWED`（fail-closed）
-- 证据：`docs/acceptance/1.4.2/CAPABILITY-LIVE.json`
-
-Verified: 单测/路由/客户端契约 43/43；候选 gate GREEN ×2；stable gate 见发布记录。
-
-## [1.4.2-beta.1] — 2026-10-22
-
-**Node 代码执行权限成为 UI 可激活的子插件能力。**
-
-- 新增 `src/util/exec-capability.mjs`：机器本地能力状态（拒绝 / 临时 24h / 永久），fail-closed，
-  临时档带绝对 `expires_at_ms`，过期即拒绝。
-- 新增 host 路由 `GET/POST /api/w2m/capability`（`src/plugin/exec-capability-route.mjs`），同源、在
-  host 认证栅栏内；浏览器不再接触文件系统或设备 token。
-- client `lib/client.js` 在 `conversation.input.left` 座位新增第三个控制（order 42）：
-  `Node 执行：拒绝 | 临时 24 小时 | 永久`，带 RCE 风险提示与剩余时间。
-- agent 每个任务前读取能力文件；命中时结果信封 `authorization.provenance = "exec-capability"`，
-  warnings 记录 `EXEC_CAPABILITY`；pipeline 各 stage 同样覆盖。
-- 文档 `docs/EXEC-CAPABILITY.md`；测试 `test/exec-capability.test.mjs`（7/7）、
-  client-bundle/loader-entry/exec-capability 合计 43/43。
-
-Verified: 单测与路由测试全绿；候选版本真机验收（UI 激活 → agent 下一任务可执行 node -e）。
-
-## [1.4.1] — 2026-10-22
-
-**修复：授权模型在从未 bootstrap 的机器上不可用（真机发现）。**
-
-- relay 的 offer 对 **grant 任务**也携带 `operator_key`（此前只有 maintenance 请求携带）。在空 allow-list 的机器上，
-  agent 首次收到 offer 时据此 TOFU pin；修复前该机器只会得到 `GRANT_NO_PINNED_KEY`，即"显式授权"形同虚设。
-- 任务台账记录 `operator_key`，relay 重启回放恢复 `workspace / grant / grant_summary / maintenance / operator_key`：
-  修复前重启后 re-offer 会丢失授权字段，机器会以错误的理由拒绝任务。
-
-真机验收（relay 1.4.1 候选，TwinsEarth 插件 1.4.0、allow-list 为空）：
-
-- 无 grant 的 `node --version` → `COMMAND_NOT_ALLOWED`
-- operator grant 授权的 `node -e` → **ok**，输出 `{plugin:"1.4.0", pinned:"^1.4.0", node:"v24.21.0"}`
-- relay M1 diag（root runner）→ ok，66,046 bytes
-- 证据：`docs/acceptance/1.4.1/TWIN-GRANT-LIVE.json`、`M1-LIVE-DIAG.json`
-
-Verified: relay TOFU offer 测试 1/1、grant/ledger 相关 3/3；候选部署后真机全部通过。
-
-## [1.4.1-beta.1] — 2026-10-22
-
-**候选：授权模型在"从未 bootstrap 的机器"上可用。**
-
-- relay 的 offer 现在对 **grant 任务**也携带 `operator_key`（此前只有 maintenance 请求携带），首次见到该键的
-  agent 因此可以 TOFU pin；在此之前，空 allow-list 的新机器收到 grant 只会得到 `GRANT_NO_PINNED_KEY`。
-- 任务台账记录 `operator_key`，重启回放恢复 `workspace / grant / grant_summary / maintenance / operator_key`：
-  此前 relay 重启后 re-offer 的任务会丢失授权/工作区字段，机器会以错误的理由拒绝。
-- 真机验证路径：TwinsEarth（allow-list 为空、插件 1.4.0）用 operator grant 执行 `node -e` 读取版本。
-
-Verified: relay TOFU offer 测试 1/1，grant/ledger 相关 3/3；候选部署到 relay 后做真机验收。
-
-## [1.4.0] — 2026-10-22
-
-**稳定版：执行授权、任务、协作三个模型的第一版落地。**
-
-- **执行授权模型**：`bin/w2m-grant.mjs` 签发单次执行授权（绑定 task_id/argv/机器/≤10min TTL/max_uses）；relay 派发预检
-  （`GRANT_TASK_MISMATCH` / `GRANT_ARGV_MISMATCH` / `GRANT_EXPIRED` → 400）；撤销 `POST /v1/grants/revoke`（幂等、
-  ledger 留痕、派发 `403 GRANT_REVOKED`）与审计 `GET /v1/grants`；结果信封携带 `authorization.provenance`
-  （grant/allow-list/maintenance）；使用台账不可写时 `GRANT_LEDGER_UNAVAILABLE` fail-closed。
-- **任务模型**：任务可声明 `workspace {kind:'worktree', base_commit, produce}`；agent 在独立 worktree 中执行、提交、
-  生成相对 base 的 patch 并上传内容寻址 blob，结果携带 `{base_commit, head_commit, changed_files, patch_sha256,
-  patch_bytes, cleaned}`；relay 侧分支 refs（单调、必须声明 from=head）、合并队列（patch sha256 幂等、already_merged）、
-  冲突结果带 conflict_sha256 且绝不推进分支。
-- **协作模型**：项目 room/board/artifact 索引/decisions/project memory/通知（共享对象事件广播 + 每 reader 未读水位）/
-  项目级 SSE（ready + since_seq 补齐 + 实时 project.event）。
-- **M7**：指标注册表与 `/metrics` 接线、证据 schema 与 preflight 第 16 项证据门禁；候选版本可用 candidate line
-  fallback，stable 必须提供本线真机证据。
-
-**发布时真机状态（如实）**：relay 宿主已运行 1.4.0 候选（1.4.0-beta.1，代码与 stable 相同），relay 侧真机回归 10/10
-通过（board/artifacts/decisions/memory/locks/blobs/refs/merge/notifications/项目 SSE）。M1 维护通道的 diag 在换版后
-未能执行：非特权换版路径（fleet node 通道）替换目录后由 kill 触发的重启没有拉起 `w2m-localside`（部署脚本的
-systemctl 被拒绝）；在控制台执行 `systemctl restart w2m-localside` 后即可继续完成 M1 复验与 stable 官方资产部署。
-
-证据：`docs/acceptance/1.4.0/`（REGRESSION-1.4.0.json、M1-LIVE-MAINTENANCE.json）。
-
-## [1.4.0-beta.1] — 2026-10-22
-
-**v1.4.0 三模型候选：执行授权模型落地、任务模型落地、协作模型落地。**
-
-这是把 1.3.12–1.3.14 的 beta 线合成一版的候选，供 stable 前真机验收。
-
-- **执行授权模型（v1.4.0）**：`bin/w2m-grant.mjs` 签发单次执行授权（绑定 task_id/argv/机器/≤10min TTL）；
-  relay 派发预检（`GRANT_TASK_MISMATCH` / `GRANT_ARGV_MISMATCH` / `GRANT_EXPIRED`）；撤销
-  `POST /v1/grants/revoke`（幂等、ledger 留痕、派发 `403 GRANT_REVOKED`）与审计 `GET /v1/grants`；
-  结果信封带 `authorization.provenance`（grant/allow-list/maintenance）；使用台账不可写时
-  `GRANT_LEDGER_UNAVAILABLE` fail-closed（真机发现的 EACCES 崩溃已修）。
-- **任务模型（v1.4.1 前身）**：任务可声明 `workspace {kind:'worktree', base_commit, produce}`；
-  agent 在独立 worktree 执行 → 提交 → 生成相对 base 的 patch → 上传内容寻址 blob → 证据
-  `{base_commit, head_commit, changed_files, patch_sha256, patch_bytes, cleaned}`；
-  relay 侧分支 refs（单调、必须声明 from=head）、合并队列（按 patch sha256 幂等、already_merged）、
-  冲突结果携带 conflict_sha256 且绝不推进分支；refs/merge-queue HTTP 路由。
-- **协作模型（v1.4.2 前身）**：项目 room（成员/角色/快照+增量事件）、board、artifact 索引、
-  decisions（append-only）、project memory（版本文档）、通知（共享对象事件广播 + 每 reader 未读水位）、
-  项目级 SSE（ready + since_seq 补齐 + 实时 project.event + keepalive）。
-
-M7 证据门禁对候选版本增加 candidate line fallback：beta 候选可引用其所基于发布线的真机证据（其产物在机器升级前构建），stable 仍必须提供本线真机证据。
-
-Verified: gate GREEN ×2；relay 测试、agent 测试、workspace/refs/board/notification/SSE 用例全绿。
-
-## [1.3.12-beta.4] — 2026-10-22
-
-**执行授权模型真机修复：使用台账不可写时 fail closed，而不是 crashed。**
-
-在 relay 宿主上实测时发现"授权了但一执行就崩"：维护状态目录 `/var/lib/w2m/maintenance` 由 root 拥有且 0755，agent 以
-非特权用户运行，grant 第一次通过后写 `grant-uses.json` 报 EACCES，异常冒泡成任务 `crashed` —— 授权判定其实已经通过
-（同一 argv 无 grant 时是 `COMMAND_NOT_ALLOWED`），失败发生在记录环节。
-
-- `grant-gate`：台账写入包 try/catch，失败返回 `GRANT_LEDGER_UNAVAILABLE`，不执行"未记录的一次授权"（否则单次授权会变成
-  可重放漏洞），也不再把整个 handler 打崩。
-- `bootstrap.sh`：`$BASE` 改为 `root:w2m 0775`，让默认安装就能写台账；queue 仍 0770、done/claimed 0750。
-- 回归用例：usedFile 指向不可写路径，断言返回该 code 而非抛异常。
-
-真机对比（修复前、relay 宿主）：
-- 无 grant 的 `uname -s` → `refused/COMMAND_NOT_ALLOWED`；
-- 有合法 grant 的同一 argv → 通过 gate，随后因台账 EACCES 报 crashed（本次修复的目标）。
-
-Verified: grant-gate 7/7（含新用例）；gate GREEN twice。
-
-## [1.3.12-beta.3] — 2026-10-22
-
-**执行授权模型收尾：每个结果都说明"是谁授权的"。**
-
-beta.1 让操作员能授权一次执行，beta.2 让授权可撤销、可审计；这一版补上最后一块——结果自身携带授权来源，而不是只能在
-relay 台账里反查。
-
-- 结果信封新增 `authorization` 字段：`{provenance: "grant" | "allow-list" | "maintenance", capability_id?, grant_id?}`。
-  grant 路径带 `grant_id`（可与 ledger 对账），maintenance 路径带 request_id（可与 M1 台账对账），allow-list 路径标记
-  provenance 即可。
-- 一个决定、两个受众：gate 决定"跑不跑"，信封记录"这是哪一种决定"；refused 路径不伪造 provenance。
-- e2e 断言：空 allow-list + 合法 grant 的结果 `authorization.provenance === "grant"` 且带 grant_id。
-- 边界如实写进文档：provenance 是执行机器对自身判定的陈述，relay 存储但不验证它；签名仍由 agent 验证，派发仍由 relay
-  预检，撤销仍由 relay 记账——台账才是权威。
-
-Verified: agent 159/157（含 grant replay e2e 的 provenance 断言）；gate GREEN twice。
-
-## [1.3.12-beta.2] — 2026-10-22
-
-**执行授权模型补完：撤销与操作员审计。**
-
-beta.1 让操作员能"授权某一次执行"；这一版让授权可以被收回、可以被查账，而不是只能等 TTL 过期。
-
-- **撤销**：`POST /v1/grants/revoke`（operator token）`{grant_id, reason?}`。幂等（第二次 `already_revoked: true`），写入
-  ledger `grant.revoked`，带 reason 与操作者。
-- **派发拒绝**：携带已撤销 grant 的任务在 `POST /v1/task` 被拒，`403 GRANT_REVOKED`，机器收不到 offer；revocation 先于
-  argv/task 绑定检查，理由更直接。
-- **审计视图**：`GET /v1/grants`（operator token）返回 `tasks`（task_id / grant_id / argv_hash / key_id / mode / created_at）
-  与 `revoked` 列表；device token 为 401，授权台账不属于机器工作面。
-- **边界**：撤销阻止的是**新派发**；agent 断网时仍会执行已到手 grant 里绑定的那一次（正确性仍取决于 relay 派发，与 M2 §4
-  一致）。撤销后要重新授权必须签发新 grant_id。
-
-Verified: grant 13/13；grant-issue 3/3；relay 191/191（新增撤销+审计用例）；gate GREEN twice。
-
-## [1.3.12-beta.1] — 2026-10-22
-
-**执行授权模型：静态 allow-list 之外，操作员可以显式授权某一次执行。**
-
-在此之前授权只有一层：机器本地配置的 allow-list，一个长期决定，没有"就这一次"的途径。这一版把 M2 grant 补成一条可用的
-路径——签发、派发、验证、审计——而不是一个只在测试里存在的协议。
-
-- **`bin/w2m-grant.mjs`**：操作员签发一条 grant。绑定一个 task_id（必须先确定）、一个 argv、若干 machine_id、≤10 分钟 TTL
-  和 max_uses（默认 1）；stdout 输出可直接放进 `POST /v1/task` 的 `grant` 字段，stderr 打印 task_id/argv_hash/expires_at。
-  该 CLI 同时登记为 package bin `w2m-grant`。
-- **relay 派发预检**：task_id 不符 → `GRANT_TASK_MISMATCH`，argv_hash 不符 → `GRANT_ARGV_MISMATCH`，已过期 →
-  `GRANT_EXPIRED`，都是 HTTP 400 的调用方错误；relay 不替 agent 做授权裁决。
-- **审计**：task summary 增加 `argv_hash` 与 `grant_key_id`（`grant_id` 已有），让"谁授权了哪条命令"可查。
-- **agent 仍是验证者**：签名、任务/机器绑定、argv、TTL、max_uses、重放（`GRANT_REPLAY`）由机器本地用 pin 的操作员公钥判定；
-  空 allow-list + 合法 grant 执行，无 grant 仍 `COMMAND_NOT_ALLOWED`（既有 e2e 覆盖）。
-- **文档**：`docs/COLLAB/EXECUTION-AUTH-MODEL.md` 状态改为已实现，补上"取 task_id → 签发 → 携带派发 → 两处检查 → 审计字段"
-  的完整路径和仍然不做的边界（无长期委托、无自动签发、无跨项目授权）。
-
-Verified: grant-issue 3/3（真实 CLI 子进程签发并用签名载荷验证）；grant 13/13；relay 190/190（新增派发预检用例）；gate GREEN twice。
-
-## [1.3.11] — 2026-10-22
-
-**Stable release: the collaboration stack's first seven modules, with the gate that measures them.**
-
-This is the first stable since 1.3.9 (docs) that ships runtime work, and the first beta line to end with its acceptance evidence
-enforced by the pre-flight rather than stored beside it. What is in it, by module:
-
-- **M1 maintenance channel** (live on the relay host): signed update/restart/diag requests, operator-key pinning, a root runner and
-  a bootstrap for Linux/Windows. Accepted on the real machine: diag (9 sections / 62 KB), relay restart with a new relay_id and
-  the result delivered after it, update to 1.3.10-beta.10 (download + sha256 + atomic swap), and a post-update diag. Evidence:
-  docs/acceptance/1.3.10-beta.10/.
-- **M2 grants**: single-use, task-bound Ed25519 grants with argv hash, TTL, use ledger and named refusals; e2e covers an empty
-  allow-list succeeding under a grant, replay, argv tampering and the no-grant refusal.
-- **M3 Git-native tasks**: isolated worktrees at the caller's base commit, a content-addressed patch artifact contract, a merge
-  queue with merge-slot serialisation, strict/replay policies, already_merged and a structured conflict artifact. Module-level,
-  24 tests across the three slices plus two composed workflow tests.
-- **M4 project room**: project objects, membership roles, a deny-by-default action matrix, snapshot + incremental events, task
-  attribution (implicit default project, explicit projects refused when unknown), and the /v1/projects routes.
-- **M5 multi-client primitives**: branch/file locks (leases, renewal, owner force-release, merge preflight conflicts), reviews
-  (self-review guard, duplicate-verdict refusal, approval gate by patch sha) and notifications (dedupe, digest, per-reader
-  watermarks, retention), with the lock routes live and their events projected into the project stream.
-- **M6 cross-network reliability**: chunked, resumable blob uploads with verified commits, Range downloads, and an agent result
-  outbox (atomic, persisted exponential backoff, cross-restart recovery, bounded).
-- **M7 metrics and acceptance**: a 39-metric contract with a cardinality guard, live on /metrics; a validator for acceptance
-  evidence; and the pre-flight's 16th check, which fails a release whose evidence does not validate or whose release line has no
-  record.
-
-Verified: pre-flight GREEN twice (16/16 checks, 2828 tests: 2814 pass, 0 fail, 14 skip); beta line beta.1 through beta.25 shipped on
-GitHub prereleases only.
-
-Known limitations, stated rather than implied: the merge queue and the review/notification routes are not wired into the task path
-yet; a request that restarts the agent itself loses the ferry result (relay restarts are fine); M4 role checks cover the lock routes
-and reads, not every future write; the relay runs beta.10 and is upgraded separately from this tag.
-
-## [1.3.10-beta.25] — 2026-10-22
-
-**M7 final core slice: acceptance evidence is a gate, not a folder.**
-
-The pre-flight grew its 16th check. `acceptance evidence (every committed record validates, and the release line has one)`
-does three things a file list cannot:
-
-1. every JSON record under `docs/acceptance/` is validated with the M7 schema (`src/acceptance/evidence.mjs`) — a record that
-   does not say which machine ran it, when, by whom and under which task id fails the gate;
-2. the current release line must have at least one record: shipping a beta that claims an accepted capability while pointing at
-   no evidence from its own `1.3.x` line is RED;
-3. it reports what it read ("4 acceptance record(s) validated; 4 for the 1.3.10 line"), so a green row is a statement about a
-   specific set of records rather than about an empty directory.
-
-The check is bound to `docs/acceptance` in `GATE_INVENTORY`, so deleting the directory or the check breaks the inventory's
-both-directions rule; the evidence validator's accepted-orphan entry is removed now that the gate imports it.
-
-Not claimed: this gate proves the records are well-formed and current, not that the described runs happened — that is what the
-task id, the machine ids and the executor field are for, and they are now mandatory.
-
-Verified: gate GREEN twice with 16/16 registered checks; the evidence check passes on the four M1 records.
-
-## [1.3.10-beta.24] — 2026-10-22
-
-**M7 second slice: acceptance evidence has a schema, and the committed evidence is validated against it.**
-
-- `src/acceptance/evidence.mjs` validates every required field of the M7 evidence record: version, uppercase case id, kind
-  (positive/negative/chaos), requirement, at least one machine, ISO `executed_at`, executor (lead/human/agent), a result with a
-  verdict, and — for a positive case — the real `task_id`. Optional fields are validated when present: argv arrays,
-  `[from, to]` ledger ranges, `{sha256, bytes}` artifacts and an assertions object. Every problem is returned at once, because a
-  release check should list what to fix rather than one field per run.
-- `summarizeEvidence()` counts valid records by kind and version and names the invalid ones, which is what a release note or a
-  gate summary reads.
-- The test suite validates the **actual committed files** under `docs/acceptance/` — a schema that rejected the project's own
-  evidence would be a schema written for a fictional project. It also pins that both the flat `result.outcome` and the nested
-  `result.task.outcome` (the live restart record) are accepted as the same fact.
-
-Registered as an accepted library with its exit named (the preflight evidence gate).
-
-Still to wire for M7: the preflight check that a release's evidence exists and validates, and the remaining instrumentation.
-
-Verified: evidence 6/6; gate GREEN twice.
-
-## [1.3.10-beta.23] — 2026-10-22
-
-**M7 wiring: the registry is live on /metrics.**
-
-- Relay state owns the M7 registry. The project room now notifies a listener per event, and that callback counts
-  `wm_project_events_total{type}` once for both the room's own events (project created, member changes, task linked) and the
-  lock/review/notification events projected into it — a projection is appended, then counted through the room hook, so it cannot
-  be double-counted.
-- `GET /metrics` appends the registry body under a `# reliability registry` marker. A relay that never records into the registry
-  renders exactly what it rendered before, which is why the existing exposition tests still pass unchanged.
-- Lock routes count `wm_lock_acquired_total{kind}` and `wm_lock_conflict_total{kind}`.
-- One route test: after creating a project and acquiring a branch lock, `/metrics` carries
-  `wm_project_events_total{type="project.created"}` and `wm_lock_acquired_total{kind="branch"}`.
-
-Verified: relay 189/189 (one new test); the registry and room suites are unchanged; gate GREEN twice.
-
-## [1.3.10-beta.22] — 2026-10-22
-
-**M7 first slice: one metrics contract for the whole collaboration stack.** A local module and eight tests; the relay /metrics
-route and the call sites do not record into it yet.
-
-- `src/relay/reliability-metrics.mjs` declares every M7 metric name, its type and the labels it may carry — 39 definitions across tasks,
-  authorization, data plane, collaboration and transport. An undeclared name, an undeclared label, or a high-cardinality label
-  (`task_id`, `dedupe_key`, ids) is refused at record time, so a metrics endpoint cannot silently become a memory leak.
-- Counters refuse decrements; gauges hold the last value; histograms keep cumulative buckets plus sum/count. `renderPrometheus()`
-  emits `_bucket/_sum/_count` with sorted, escaped label values, and `snapshot()` gives the same data as plain JSON for the panel.
-- Eight tests: label aggregation, undeclared metric/label refusal, wrong-type and decrement refusal, gauge semantics, cumulative
-  buckets, Prometheus text (including `+Inf`), label escaping, and the contract's own shape.
-
-Registered as an accepted library with its exit named (the /metrics route and instrumentation). Note on the name: the exposition module was already called metrics.mjs, so after a naming collision during this work its file and test were restored, and this registry ships as reliability-metrics.mjs; both test files pass.
-
-Still to wire for M7: the /metrics route, the instrumentation call sites, the acceptance-evidence validator and the preflight
-evidence check.
-
-Verified: metrics 8/8; gate GREEN twice.
-
-## [1.3.10-beta.21] — 2026-10-22
-
-**M6 second slice: the agent result outbox.** A local module and eight tests; the agent delivery path still uses the existing
-spool and has not switched to it yet.
-
-- `src/agent/outbox.mjs` — a result is written to disk (temp + rename, so a crash leaves either the old state or the complete
-  entry) before any network attempt, keyed by `(task_id, attempt)` so a retried handler is one entry. Delivery removes the entry
-  only after the relay acknowledged it; the relay's own dedupe makes a re-delivery safe when that acknowledgement was lost.
-- Retries use exponential backoff persisted with the entry (`1s, 2s, 4s …` capped at 60s), so closing the laptop for an hour is
-  a resume rather than a restart. Past `max_attempts` the entry moves to `dead/` and is reported as exhausted.
-- Limits: 200 entries / 16 MiB; beyond that the oldest entries are dropped and the caller sees `outbox_full: true`
-  (`OUTBOX_FULL` in the changelog's words) rather than a silent disk fill. A single oversize result is refused.
-- Eight tests: atomic persist + depth, duplicate enqueue, restart recovery with attempt counts, backoff growth and exhaustion,
-  ack-only removal, count-limit drop keeping the newest, corrupt-file quarantine, oversize refusal.
-
-Registered as an accepted library with its exit named (the agent delivery switch).
-
-Still to wire for M6: the agent's upload/download decision for large artifacts, and P2P as acceleration-only with metrics.
-
-Verified: outbox 8/8; gate GREEN twice.
-
-## [1.3.10-beta.20] — 2026-10-22
-
-**M6 wiring: chunk session and Range routes.** Large artifacts now travel over HTTP without restarting from zero.
-
-- `POST /v1/fleet/blob-sessions` declares `{sha256, size, chunk_bytes?}`; `PUT …/:sid/chunks/:index` uploads one idempotent chunk
-  (octet-stream); `GET …/:sid` returns received/missing so an interrupted upload resumes; `POST …/:sid/commit` verifies the
-  assembled sha256 and, on success, stores the bytes through the existing content-addressed blob store. A missing chunk answers
-  `409 BLOB_INCOMPLETE` with the indices; a mismatch deletes the session and creates nothing.
-- `GET /v1/fleet/blobs/:sha?range=start-end` answers `206` with `Content-Range`, so a client can fetch a large patch (or a conflict
-  artifact) in slices instead of one allocation.
-- The blob-session module's responses are now uniformly `{ok, session: {...}}`, which the routes and the original tests share.
-
-Two HTTP tests: a chunked upload that commits and is then read whole plus as a Range, and an incomplete commit naming `[0,1]`.
-
-Still to wire for M6: the agent result outbox, and P2P as acceleration-only with its observable success rate.
-
-Verified: blob-sessions 9/9, relay 188/188 (2 new route tests); gate GREEN twice.
-
-## [1.3.10-beta.19] — 2026-10-22
-
-**M6 first slice: large artifacts can be uploaded in resumable chunks.** A local module and nine tests; the routes and the
-agent upload path are the wiring slice after it.
-
-- `src/relay/blob-sessions.mjs` — a client declares the final `sha256` and `size` once, then uploads chunks in any order
-  (each index idempotent), asks what is missing, and commits. Only a commit whose assembled bytes hash to the declared sha256
-  becomes a blob; a mismatch deletes the session and returns `BLOB_SHA_MISMATCH`, so nothing can be referenced that does not
-  exist.
-- Limits follow the spec: default 1 MiB chunks, `≤8 MiB` per chunk, `≤256` chunks and `≤64 MiB` per blob, two open sessions and
-  512 MiB unfinished bytes per machine, 24h session TTL. A resume after a disconnect is `status()` plus the missing indices,
-  which is exactly the "don't restart a 40 MiB patch" property.
-- Nine tests: plan/status, out-of-order + idempotent chunks, verified commit through the store hook, incomplete commit naming
-  the missing chunks, sha mismatch deleting the session, chunk length/size refusals, quotas, TTL expiry, and blob/chunk ceilings.
-
-Registered as an accepted library with its exit named (the blob-session routes + agent upload).
-
-Still to wire for M6: the HTTP chunk routes and Range downloads, the agent outbox for offline results, and P2P as acceleration
-only.
-
-Verified: blob-sessions 9/9; gate GREEN twice.
-
-## [1.3.10-beta.18] — 2026-10-22
-
-**M5 wiring, part 1: lock routes and one event stream for the primitives.**
-
-- Relay state now owns the three M5 primitives (locks, reviews, notifications) and projects their events into the project room
-  stream with the module sequence attached, so a client can reconstruct "what happened" from one cursor instead of three.
-- `/v1/projects/:id/locks`: `GET` list, `POST` acquire, `POST …/:lock_id/renew`, `DELETE …/:lock_id` (holder release), and
-  `DELETE …?force=1&reason=…` (owner only). A conflict is an answer, not a transport error: `409` with the holder and expiry, so a
-  client can show who is editing instead of parsing a failure. Role checks sit on M4 membership (default project treats a paired
-  machine as worker); a non-member receives `404` and learns nothing about the project.
-- Two route tests: acquire/list/conflict/foreign-release/ordered-release, plus non-member `404` and `LOCK_FORCE_DENIED` for a
-  worker trying to force release.
-
-Still to wire: review and notification routes, the merge/review gate, and the panel views.
-
-Verified: relay 186/186 (2 new lock route tests); gate GREEN twice.
-
-## [1.3.10-beta.17] — 2026-10-22
-
-**M5 third primitive: notifications.** A local module and eight tests; no routes or SSE projection use it yet.
-
-- `src/relay/project-notifications.mjs` — notifications for a project addressed to a member or broadcast, each with kind,
-  subject, refs and `requires_action`. Every row is also a `notification.created` event for the live stream, and the list route
-  is the catch-up path.
-- Semantics pinned by tests: the same (kind, primary ref, target) inside 60s is one row; different refs/kinds are distinct;
-  overflow beyond 120 per minute collapses into one digest row that carries the count; unread is counted after a per-reader
-  watermark; a watermark never moves backwards; paging is `since_ms` + limit; retention drops rows older than 7 days (or beyond
-  2000 per project).
-- The reader is a member identity (machine or operator), not a transport: an offline client reconnects and reads the same
-  watermark it left.
-
-Registered as an accepted library with its exit named (the notification routes).
-
-M5 primitives are now all designed-and-implemented at module level: locks (beta.15), reviews (beta.16), notifications (beta.17).
-Still missing for M5: the routes, the merge/ref gates using them, and the panel views.
-
-Verified: project-notifications 8/8; gate GREEN twice.
-
-## [1.3.10-beta.16] — 2026-10-22
-
-**M5 second primitive: review tasks.** A local module and ten tests; the review routes and the merge gate do not call it yet.
-
-- `src/relay/project-reviews.mjs` — a review points at a content-addressed `{kind, sha256, source_task_id, diffstat}` target and
-  collects decisions from listed reviewers. Verdicts are records, not a mutable flag: `approve`/`changes_requested`/`comment`
-  accumulate, approvals are counted per distinct reviewer, and reaching `required_approvals` moves the review to `approved`.
-- Safety rules the tests pin: self-review is refused unless an owner overrides it (and the override is its own event); reviewers
-  must be maintainer/owner; only listed reviewers may decide; a reviewer cannot record the same verdict twice; a
-  `changes_requested` closes the round and refuses a later approve; a due date expires a pending review and late decisions are
-  refused; `approvedFor(project, sha256)` answers the merge gate for an exact patch.
-- Every state change is emitted as an event (`review.requested/decided/approved/changes_requested/expired/self_review_override`).
-
-Registered as an accepted library with its exit named (the review routes + merge-requires-review gate).
-
-Not in this slice: notifications (§4), the third M5 primitive.
-
-Verified: project-reviews 10/10; gate GREEN twice.
-
-## [1.3.10-beta.15] — 2026-10-22
-
-**M5 first primitive: branch and file locks.** A local module and eight tests; no routes or merge preflight call it yet.
-
-- `src/relay/project-locks.mjs` — one exclusive holder per `(project, branch)` or `(project, path)`, leases with renewal, lazy
-  expiry that frees the target and records `lock.expired`, owner-only force release with a mandatory reason recorded as
-  `lock.force_released`, per-project/per-holder limits (20/10), and a `conflicts()` preflight that answers which live locks cover a
-  branch or a set of paths.
-- Every mutation is returned as an event (`lock.acquired/renewed/released/expired/force_released`) so the project stream can carry
-  it; the module holds no relay state and takes the clock as an injection.
-- Eight tests: acquire/list/release, LOCK_HELD naming the holder, expired re-entry with both events, renew ownership and
-  non-revival, force-release permission and reason, limits, preflight conflicts for branch and paths, and malformed-input refusal.
-
-Registered as an accepted library with its exit named (the lock routes and the merge preflight check).
-
-Not in this slice: review tasks (§3) and notifications (§4), which are the next two M5 primitives.
-
-Verified: project-locks 8/8; gate GREEN twice.
-
-## [1.3.10-beta.14] — 2026-10-22
-
-**M4 third slice: the `/v1/projects` routes.**
-
-- `GET /v1/projects` — the default project plus the projects this machine is a member of (device token).
-- `GET /v1/projects/:id` — snapshot with `last_event_seq`; a machine that is not a member gets `NOT_FOUND`, so a project's
-  existence is not leaked. The default project stays readable for any paired machine because it is the implicit home of unnamed
-  tasks.
-- `GET /v1/projects/:id/events?since_seq=N` — the incremental slice and `next_seq`, so a client can resume after a disconnect.
-- `POST /v1/projects` and `POST /v1/projects/:id/members` — operator token only (the dispatch credential), because these change
-  who may act on shared state; the body's initial `members` array is seeded atomically with the project.
-- The routes authenticate per method and therefore sit above the shared device guard: an operator token is not a device token,
-  and the earlier placement made every write answer `UNAUTHORIZED`.
-- Three HTTP tests: list/create/snapshot/events with a member, a non-member seeing `NOT_FOUND`, the operator requirement, and an
-  unknown project answering `NOT_FOUND`.
-
-Still missing: artifact/memory/decision mounts, the panel view, and multi-client e2e.
-
-Verified: relay 184/184 (3 new route tests); gate GREEN twice.
-
-## [1.3.10-beta.13] — 2026-10-22
-
-**M4 second slice: tasks belong to a project, and the room records it.** Relay state now owns a project room; no HTTP routes yet.
-
-- `POST /v1/task` (internal `createTask`) accepts an optional `project_id`. Unnamed tasks land in the implicit `default`
-  project, which is created lazily on first use; an explicit unknown project is refused with `BAD_REQUEST` rather than being
-  created silently.
-- The project room records a `task.linked` event for every task, so a snapshot's `last_event_seq` moves with the work and a
-  second client can apply it as an incremental event.
-- State exposes `projectSnapshot(projectId)` and `projectEvents(projectId, {sinceSeq})`; the task summary carries
-  `project_id`; the replay path restores it from the ledger.
-- Three attribution tests: implicit default + linked event consistency, explicit project visible on the summary, and an unknown
-  project refused without creating one.
-
-Still missing, stated: the `/v1/projects` HTTP routes, artefact/memory/decision mounts, the panel view, and multi-client e2e.
-
-Verified: project-attribution 3/3, project-room 8/8, relay 181/181; gate GREEN twice.
-
-## [1.3.10-beta.12] — 2026-10-22
-
-**M4 first slice: the project room object.** A local module and eight tests; the relay routes and the panel do not call it yet.
-
-- `src/relay/project-room.mjs` — a project aggregate (project id, name, origin, settings, members), the four roles
-  (owner/maintainer/worker/observer), a deny-by-default action matrix (`read/dispatch/artifact/lock/memory/decide/merge/
-  settings/members`), member add/remove/role-change as recorded events, a snapshot carrying `last_event_seq`, incremental
-  events since a sequence, and per-member project listing.
-- Safety rules the tests pin: the last owner cannot be removed; a duplicate member is refused by name; an unknown project is
-  refused rather than creating an empty one; the permission check returns the required and current role rather than a bare
-  false; a role change records `{from,to}`.
-
-Registered as an accepted library with its exit named (the `/v1/projects` routes and the room panel), because nothing reaches it
-yet.
-
-Also in this tree since beta.11: the M1 live-acceptance evidence files under `docs/acceptance/1.3.10-beta.10/`.
-
-Verified: project-room 8/8; gate GREEN twice.
-
-## [1.3.10-beta.11] — 2026-10-22
-
-**M1 update path fixed and the full acceptance set recorded.**
-
-The live update acceptance exposed two defects that made `update` unusable even though diag and restart already worked:
-
-1. **EXDEV on swap** — staging unpacked under `/tmp` (often tmpfs) and the swap is a rename into `/opt/w2m/app`, so the kernel
-   refused with `EXDEV: cross-device link`. Staging now lives on the same filesystem as the app directory
-   (`/opt/w2m/.maintenance-staging`).
-2. **Ferry reported success for a failed action** — the ferry returning a result file only means the runner wrote one; the
-   runner's own `status` was not inspected, so a failed update was reported as `ok`. The agent now reports
-   `MAINTENANCE_FAILED` with the runner's code, and a test covers the shape.
-
-Acceptance evidence now in the tree:
-- `docs/acceptance/1.3.10-beta.10/M1-LIVE-DIAG.json` (9 sections, 62,238 bytes, runner ok)
-- `M1-LIVE-RESTART.json` (relay restarted, new relay_id, result delivered)
-- `M1-LIVE-UPDATE.json` (download + sha256 + swap to 1.3.10-beta.10, no auto-restart)
-- `M1-LIVE-POSTUPDATE-DIAG.json` (after update + restart, a new diag still returns 59,581 bytes)
-
-Known limitation unchanged and documented: a request restarting the agent itself kills the ferry before it reads the result
-file, so the accepted restart target is the relay; delayed restart is the next fix.
-
-Verified: gate GREEN twice; actions/ferry unit tests pass.
-
-## [1.3.10-beta.10] — 2026-10-22
-
-**M1 live acceptance: the maintenance channel works end to end on a real machine.**
-
-The relay host (jp-shared) was bootstrapped and two signed requests were executed by the root runner:
-
-- **diag** — the runner produced 9 sections (version/services/journal/disk/ports), the agent returned the task as `ok` with
-  62,238 bytes of result, and the runner's own result file confirms `status: ok`. Evidence:
-  `docs/acceptance/1.3.10-beta.10/M1-LIVE-DIAG.json`.
-- **restart (rabbit)** — the relay was restarted by the runner, the agent survived it and delivered the task result, and the
-  relay came back with a new `relay_id` and a fresh uptime. Evidence:
-  `docs/acceptance/1.3.10-beta.10/M1-LIVE-RESTART.json`.
-
-The run found four real defects, all fixed here:
-
-1. The agent's envelope builder hashes and sizes the output; the maintenance ferry passed an execution object without
-   `stdout_sha256/stdout_bytes/stderr_sha256/stderr_bytes`, so every maintenance task ended as `crashed` **after** the action had
-   already run. The ferry now fills them.
-2. `--operator-key` without `--operator-key-id` claimed an empty key id, which the pin store correctly refused as a mismatch;
-   an absent id now means "trust the key that arrives".
-3. `bootstrap.sh` made the queue root-only, so the unprivileged agent could never enqueue a request; the queue is now
-   `root:w2m 0770` (write but not execute) and `done` is `root:w2m 0750`.
-4. Known limitation, documented rather than hidden: a request that restarts **the agent itself** kills the process still waiting
-   for its result file, so that result is lost (the action still runs). Restarting the relay is unaffected, which is why the
-   accepted case uses that target; the delayed-restart fix is next.
-
-Also verified: gate GREEN twice; the local agent suite still passes with the ferry envelope fix.
-
-## [1.3.10-beta.9] — 2026-10-22
-
-**M3 conflict contract completed: MERGE_CONFLICT now carries the conflict itself.**
-
-When `git apply --3way` cannot apply a patch, the queue previously reported the changed files and the git message. It now also
-captures the state git left in the merge worktree (conflict markers included) as a `conflictArtifact`:
-`{ sha256, bytes, text }`. That is the evidence a reviewer needs to decide whether to resubmit against the new base or resolve
-by hand, and it is the same content-addressed shape the patch artifacts use.
-
-The head still does not move on a conflict; the test asserts both the artifact (with conflict markers) and the unchanged head,
-and the composed M3 workflow test still passes.
-
-Verified: merge-queue 7/7 (conflict artifact assertion included), m3-workflow 2/2; gate GREEN twice.
-
-## [1.3.10-beta.8] — 2026-10-22
-
-**M3 composed: worktree -> patch -> merge queue, proven together.**
-
-Two integration tests drive the three modules the way a real task pair would: both tasks start from the same base in isolated
-worktrees, each commits its change and produces a patch artifact, and the queue merges them one after the other. The disjoint
-case ends with both files changed and the branch advanced to the second merge; the same-file case ends with a structured
-MERGE_CONFLICT listing the file, the head still on the first approved commit, and the first task's change intact.
-
-No runtime wiring yet: the agent's task handler does not create worktrees, and the relay does not run the queue. This release
-records that the modules agree with each other before either becomes reachable, which is the point of composing them now.
-
-M1 real-machine acceptance remains pending: the relay host agent is offline and root SSH authentication is refused, so the
-privileged bootstrap has not run.
-
-Verified: m3-workflow 2/2, merge-queue 7/7, worktree 5/5, patch-artifact 5/5; gate GREEN twice.
-
-## [1.3.10-beta.7] — 2026-10-22
-
-**M3 third block: the merge queue.** A local module and seven real-git tests; the relay task path does not import it yet.
-
-- `src/relay/merge-queue.mjs` — one queue per project+branch with a single merge slot (holder + TTL), items named by the
-  patch sha256, `strict` and `replay` base policies, and terminal verdicts: MERGED (branch head advances), `already_merged`
-  for a repeat submission, `BASE_MISMATCH` under strict, and a structured `MERGE_CONFLICT` with the changed files that never
-  advances the head.
-- Application happens in a detached throwaway worktree, then the repository's branch and working tree are moved to the new
-  commit — a merge that committed only in the worktree would leave the next reviewer looking at a head that never moved.
-- Seven tests cover merge-and-advance, idempotent re-submission, stale base, conflict (head unchanged), replay onto a moved
-  head, merge-slot serialisation, and patch naming.
-
-Registered as an accepted library with its exit named (the relay merge executor dispatch), because nothing reaches it yet.
-
-Still pending, unchanged: the M1 real-machine acceptance (relay runs beta.5 and carries the maintenance field live, but the
-relay host's agent is offline and root SSH authentication has not been restored), and the M2/M3 live runs.
-
-Verified: merge-queue 7/7; the rest of the suite is unchanged; gate GREEN twice.
-
-## [1.3.10-beta.6] — 2026-10-21
-
-**M3 first two blocks: isolated worktrees and a patch artifact contract. Plus the grant replay e2e.**
-
-- `src/agent/worktree.mjs` — one git worktree per task, created detached at the caller's `base_commit`; hooks disabled,
-  commit identity fixed, a porcelain snapshot before and after, commit-if-changed, `format-patch` relative to the base, and
-  a removal that reports failure instead of leaking a directory. Unknown base commit and missing repository are named refusals.
-- `src/agent/patch-artifact.mjs` — the transportable result: sha256 over the patch bytes, byte count, base/head commits,
-  sorted changed files, inline/blob mode, and `no_change` as a successful outcome for an empty patch. Non-ASCII patches are
-  measured in UTF-8 bytes, not characters.
-- Five real-git tests for the worktree lifecycle and five for the artifact contract.
-- `test/agent.test.mjs` gains the grant **replay** e2e: the same signed grant is used twice, the first run executes, the second
-  is refused with `GRANT_REPLAY` — the use ledger is what makes "single-use" true across processes.
-
-Not in this slice (stated, not implied): the merge queue itself (strict/replay bases, merge-slot serialization,
-`MERGE_CONFLICT`), review tasks and locks (M5), and the project room (M4). The M1 real-machine acceptance is also still pending:
-the relay was upgraded to beta.5 and the maintenance field is verified live, but the relay host's agent is offline and root SSH
-authentication is refused, so the privileged bootstrap has not run.
-
-Verified: agent 159/157 (replay e2e included), relay 181/181, grant 10/10, grant-gate 6/6, maintenance 17/17, ferry 4/4,
-worktree 5/5, patch-artifact 5/5, layer-model 24/24, claims 47/47; gate GREEN twice.
-
-## [1.3.10-beta.5] — 2026-10-21
-
-**M2 grant e2e: the explicit-authorisation path is proven end to end.**
-
-Four fake-relay tests now drive the real agent process:
-
-- an empty allow-list executes a command **only** because a valid grant authorises that exact argv (the envelope is `ok` and
-  the stdout hash matches);
-- the same command with no grant is still `COMMAND_NOT_ALLOWED`;
-- a grant that signed a different argv is refused with `GRANT_ARGV_MISMATCH`;
-- a grant that names another machine is refused with `GRANT_WRONG_MACHINE`.
-
-Two integration defects the e2e exposed, both fixed: the per-stage allow-list re-check ran again after step 5, so a grant that
-had authorised the task was refused at the stage boundary; and the matcher's result carries `allowed` (not `ok`), so both the
-gate result and the stage override had to use that shape or the refusal fell back to `COMMAND_NOT_ALLOWED`.
-
-Verified: agent 158/156 (4 new e2e cases), relay 181/181, grant 10/10, grant-gate 6/6, maintenance 17/17, ferry 4/4,
-layer-model 24/24, claims 47/47; gate GREEN twice.
-
-## [1.3.10-beta.4] — 2026-10-21
-
-**M1 bootstrap tooling: one privileged step, then the channel is remote.** No runtime behaviour changes.
-
-- `deploy/maintenance/bootstrap.sh` (Linux, run once as root) — installs the fixed-action path unit/service, creates the
-  queue/done/claimed directories with root ownership, optionally pins the operator public key, and enables the watcher. It
-  refuses to run without `--machine-id` and refuses a tree where `bin/w2m-maintenance.mjs` is absent.
-- `deploy/maintenance/bootstrap.ps1` (Windows, run once as Administrator) — same shape via a SYSTEM scheduled task; it
-  substitutes the app directory and machine id into the task XML rather than editing the shipped file.
-- `docs/COLLAB/M1-ACCEPTANCE-RUNBOOK.md` — the real-machine acceptance cases (diag/restart/update/rollback plus four named
-  refusals), what "green" means, and the limitations that must appear in the release note (privileged bootstrap, TOFU pinning,
-  no automatic recovery if a restarted machine cannot be reached).
-
-Both scripts install **only** the fixed update/restart/diag runner; neither installs a shell, and neither touches the
-allow-list. The design's security boundary is unchanged: the agent ferries a signed request, the root runner decides.
-
-Honest gap, unchanged: the M1 real-machine acceptance run itself still needs a machine with a privileged bootstrap and a
-relay carrying the maintenance fields; and the M2 grant path still lacks a fake-relay e2e case. Both are next.
-
-Verified: gate GREEN twice; pack carries the new scripts and document.
-
-## [1.3.10-beta.3] — 2026-10-21
-
-**M2 first slice: task-level grants become the explicit authorisation channel.** Design: `docs/COLLAB/M2-TASK-GRANT.md`.
-
-- `src/maintenance/grant.mjs` — grant protocol: task binding, named machine ids, argv hash + expanded argv for the operator
-  to read, max uses, TTL capped at 10 minutes, nonce, and constraint fields that may only tighten the task (mode/cwd/write/
-  write_scope). Verification has a named refusal for every distinct failure: wrong machine, wrong task, argv mismatch,
-  expired, future, TTL too long, replay, uses exhausted, revoked key, unknown key, bad signature, constraint widening.
-- `src/agent/grant-gate.mjs` — the agent-side gate: pins the operator key on first sight, verifies the grant against the
-  concrete argv, and persists use counts so a spent grant stays spent across restarts. A corrupt use ledger is never read as
-  "nothing used yet".
-- The agent asks the grant gate **before** falling through to the allow-list refusal, and reports a grant refusal with its own
-  `GRANT_*` code instead of folding it into `COMMAND_NOT_ALLOWED`.
-- The relay accepts an optional `grant` on `POST /v1/task` (8 KiB cap, `grant_id` + 64-hex `argv_hash` checked), carries it on
-  the offer, writes `grant_summary` into the ledger and exposes `grant_id` on the task summary.
-
-Honest gap: the grant path has unit coverage (protocol 10, gate 6) and the existing agent/relay suites are unchanged-green,
-but there is no fake-relay e2e yet for "empty allow-list executes under a grant". That case and the real two-machine run land
-in the next slice together with the M2 acceptance evidence.
-
-Verified: agent 154/152, relay 181/181, grant 10/10, grant-gate 6/6, maintenance 17/17, ferry 4/4, layer-model 24/24; gate
-GREEN twice.
-
-## [1.3.10-beta.2] — 2026-10-21
-
-**M1 maintenance channel: relay passthrough + agent ferry.** The remote loop now has both ends.
-
-- The relay accepts an optional `maintenance` request and `operator_key` on `POST /v1/task` (operator token already required),
-  registers the key once (`operator.key.registered` in the ledger, replayed on restart), carries the request on the offer, and
-  exposes `maintenance_request_id` on the task summary.
-- `src/agent/maintenance-ferry.mjs` — the agent pins the operator key on first sight (TOFU, rotation chain thereafter), verifies
-  the request against the pin, writes it atomically into the queue the root runner watches, waits for the runner's result file,
-  and reports it as the task result. A refusal is a named value (`MAINTENANCE_NO_PINNED_KEY`, `MAINTENANCE_BAD_SIGNATURE`,
-  `MAINTENANCE_RUNNER_TIMEOUT`, ...), never a thrown error, so the task result says why.
-- The agent never gains the privilege to run update/restart/diag: the root runner (beta.1) remains the only executor.
-- Layer model declares `maintenance` as a capability layer with an `agent -> maintenance` edge, so the new dependency is
-  explained rather than excused.
-
-Known gap, stated: no fake-runner agent-e2e test for the ferry yet (the ferry's own four cases cover pin/verify/queue/refusal);
-the end-to-end case lands with the real-machine acceptance run in beta.3.
-
-Verified: gate GREEN twice with the bundled node on PATH: 2731 tests / 2717 pass / 0 fail / 14 skip in 135 files
-(agent 154/152, relay 181/181, maintenance 17/17, ferry 4/4, layer-model 24/24, claims 44/44).
-
-## [1.3.10-beta.1] — 2026-10-21
-
-**M1 maintenance channel, first implementation slice.** Design: `docs/COLLAB/M1-MAINTENANCE.md` (the design series names this slice v1.3.2-beta; it ships as 1.3.10-beta.1 because 1.3.9 was already published as a stable release and versions must stay ordered).
-
-The maintenance channel lets an operator authorise exactly one of three fixed actions on one machine (update, restart, diag)
-with an Ed25519-signed request, executed by a root/SYSTEM runner that reads a queue the unprivileged agent may write to. An
-allow-list entry is not needed: the signature is the authorisation, and widening the allow-list is never the answer.
-
-### What this slice contains
-
-- `src/maintenance/protocol.mjs` — request envelope, canonical signing bytes, parameter whitelists for the three actions,
-  and the complete refusal vocabulary (wrong machine, expired, future, TTL too long, replay, revoked key, unknown key,
-  bad signature, bad action, bad params, too large, missing signature). TTL is capped at 10 minutes and only the pinned
-  operator key can sign.
-- `src/maintenance/operator-key.mjs` — Ed25519 key generation, relay registration payload, trust-on-first-use pinning with a
-  rotation chain (a new key must be signed by the pinned one), revocation, and a corrupt pin store that refuses instead of
-  trusting nothing.
-- `src/maintenance/runner.mjs` — queue scanning, claim-before-verify, signature verification, persisted replay sets
-  (request id + nonce), idempotent re-runs, and a result file for every request it looks at, refusals included.
-- `src/maintenance/actions.mjs` — the three fixed actions with no shell interpolation: diag (fixed read-only command set,
-  capped output), restart (fixed unit order and health waits), update (https download, sha256 verify, staged extraction,
-  version check inside the artifact, backup, atomic swap, health check, automatic rollback).
-- `bin/w2m-maintenance.mjs` — the root entry point (once/watch, pin bootstrap, root guard).
-- `deploy/server/w2m-maintenance.{service,path}` and `deploy/windows/w2m-maintenance.xml` — the runner as a systemd path
-  unit / SYSTEM scheduled task.
-
-### What this slice deliberately does not contain
-
-The relay routes that distribute the operator public key and the agent-side ferry that carries a request from a task offer
-to the queue (and the result back) are the next slice (1.3.10-beta.2). Until then the channel is exercised by placing a
-signed request in the queue directory directly — which is also the offline/bootstrap path the design keeps.
-
-Tests: 17 new cases cover the protocol, pinning/rotation/revocation and the runner's refusal and replay behaviour. The
-destructive actions are not executed in tests; they are covered by the real-machine acceptance runbook (M7 evidence).
-
-Verified: gate GREEN twice.
-
-## [1.3.9] — 2026-10-21
-
-**Design-first release: the collaboration line is specified, not yet implemented.**
-
-This release ships the design specification for the multi-machine / multi-client collaboration capability, and no behaviour change: the
-plugin, relay and agent are byte-identical in function to 1.3.1. It exists so the plan is reviewable, versioned, and citable before any
-of it is built.
-
-### What is in this release
-
-- `docs/MULTI-MACHINE-COLLABORATION-PLAN.md` — capability audit (what exists today is dispatch + aggregation, not collaboration),
-  root causes (missing execution-authorization model, missing workspace model, missing shared-object model), and the M1–M7 module plan.
-- `docs/COLLAB/M1-MAINTENANCE.md` — v1.3.2-beta design: signed maintenance requests executed by a root/SYSTEM unit through a queue
-  directory; remote update/restart/diag without SSH and without widening the allow-list.
-- `docs/COLLAB/M2-TASK-GRANT.md` — v1.3.3-beta design: operator-signed per-execution grants (argv hash, machine ids, TTL, task binding),
-  agent-side verification, ledger audit, revocation; the allow-list stops being the only execution authority.
-- `docs/COLLAB/M3-GIT-NATIVE-TASKS.md` — v1.3.4-beta design: per-task git worktrees, patch artifacts as the transportable result, a
-  serialized merge queue, and MERGE_CONFLICT as a first-class outcome.
-- `docs/COLLAB/M4-PROJECT-ROOM.md` — v1.3.5-beta design: relay-side project objects (members, board, artifacts, memory, decisions,
-  refs), snapshot + incremental event protocol, role-based permissions.
-- `docs/COLLAB/M5-MULTI-CLIENT-PRIMITIVES.md` — v1.3.6-beta design: branch/file locks, review tasks with findings and merge gating,
-  and notifications with delivery guarantees and read watermarks.
-- `docs/COLLAB/M6-CROSS-NETWORK-RELIABILITY.md` — v1.3.7-beta design: relay as the authoritative channel, chunked/resumable blobs,
-  agent result outbox, and P2P demoted to opportunistic acceleration.
-- `docs/COLLAB/M7-METRICS-ACCEPTANCE.md` — v1.3.8-beta design: every capability must be triggerable by a real task, negative tests are
-  mandatory, metrics are computed by the relay, and evidence is checked by pre-flight.
-
-### What is explicitly not in this release
-
-No code for M1–M7. The three model-level designs (v1.4.0 execution-authorization, v1.4.1 task, v1.4.2 collaboration) are not written yet.
-The next stable release that changes behaviour will be the one that implements M1 + M2 (the remote-operations loop), with real-machine
-acceptance evidence recorded as described in M7.
-
-Verified: gate GREEN twice on this tree; the package differs from 1.3.1 only in documentation and version metadata.
-
-## [1.3.1] — 2026-10-21
-
-**A red Compat and a green local gate: the loader-entry test was the gap.**
-
-v1.3.0 shipped with a failing Compat job: `test/loader-entry.test.mjs` still listed the fifteen tools it expected the packed
-artifact to register, and the artifact registers sixteen (`w2m_reduce`). The gate ran from the tree, where that test's expectation
-matched the *other* fixture it derives from, so the disagreement only appeared in the packed-copy mount. The expectation now names
-`w2m_reduce`, and this patch release is the artifact that matches it.
-
-No behaviour changes: the fix is the expectation, not the tool surface. beta.2 completes the fix: `EXPECTED_TOOLS` in that same test is the list the loader gate compares against, and beta.1 patched only the other fixture. v1.3.0 is superseded.
-
-This is the stable fix for v1.3.0's red Compat: the loader gate and the packed artifact now agree at sixteen tools. v1.3.0 is superseded on every channel; the artifact behaviour is unchanged. Verified: gate GREEN twice (2710 tests / 2696 pass / 0 fail / 14 skip in 133 files), and Compat on this tag is green before it is called stable.
-
-## [1.3.0] — 2026-10-21
-
-The first stable release of the collaboration line. It consolidates the four betas that followed 1.2.7 and changes no protocol in a
-way that a 1.2.7 peer cannot ignore; every addition is additive and named.
-
-### Data plane
-
-**A reduce phase you can actually run.** `w2m_reduce` dispatches a reduce task only from complete data: it refuses unless every
-declared shard reported as a blob and the named reducer reported (`W2M_REDUCE_NOT_READY` with the missing indexes), never picks a
-reducer, and refuses inline inputs that cannot be carried to another machine. The relay validates, stores, ledgers and offers
-`reduce_of` + `reduce_inputs`; the agent fetches those content-addressed blobs before the reduce runs and exposes
-`W2M_REDUCE_INPUTS_DIR` / `W2M_REDUCE_MANIFEST` / `W2M_REDUCE_OF`; a failed fetch refuses the whole task rather than reducing a
-partial fleet.
-
-**A suggestion that dispenses no action.** `w2m_wait` carries `reduce_suggestion`: ready only when every declared shard reported and
-a reducer was named, the missing indexes otherwise, the candidate machines, and the literal next step. It is derived, never stored,
-and it dispatches nothing.
-
-**Message ids survive a restart, artifacts are one size everywhere.** Chat ids carry a random per-process relay epoch
-(`msg-<epoch>-<seq>`) so a restart cannot recycle an id a client persisted; the blob transport frame is 16 MiB, matching the agent's
-dataflow hard cap, instead of 1 MiB against it.
-
-### Collaboration
-
-**The panel shows the scheduler's own buckets.** The fleet-chat panel renders 准备 / 进行 / 等待 / 阻塞 counts beside the relay's task
-list, derived from the relay's `status` and `waiting_on`; read-only, no dispatch.
-
-**Conflicts name their next step.** `w2m_memory append` returns `merge_hint` with a 409: `re-read-then-append`, `behind_by`, the
-unseen count, the sample size and the literal instruction to re-read, compare and append against the current revision -- never an
-automatic merge.
-
-**Decisions leave a trail.** `w2m_council fleet-decide` reports `trail` (`appended` / `refused` / `error` / `not-written`), and the
-test asserts that status instead of implying a record exists.
-
-### Verified
-
-Gate GREEN twice, 15 of 15: 2710 tests / 2696 pass / 0 fail / 14 skip in 133 files. Two-machine live runs over the real relay cover
-the turn state machine (ask/await over SSE with a refusal), dependency scheduling, and the missing-shard refusal, plus the panel and
-proxy behaviour above.
-
-### Known limits, stated
-
-- `pipeline` keeps `index_total` at 1; blob map results come from plain commands above the inline cap.
-- The reduce suggestion is advisory: the caller dispatches the reduce (this release does not let the relay decide to run a command).
-- The composer panel does not render the board buckets on a host without the Connection service; the tools still work.
-
-## [1.2.11-beta.1] — 2026-10-21
-
-A beta by policy: GitHub prerelease only, never npm.
-
-### The task board in the composer panel
-
-The fleet-chat panel already listed the relay's tasks; it now also shows the four buckets the scheduler uses — 准备 / 进行 / 等待 / 阻塞 — derived from the relay's own `status` and `waiting_on`, never from a classification of its own. Read-only: the panel dispatches nothing.
-
-### Merge hint on memory conflicts
-
-`w2m_memory append` returns `merge_hint` with a 409: state `re-read-then-append`, `behind_by`, the number of unseen records, the sample size, and the literal next step (re-read, compare, append against the current revision — do not merge unseen records). Pure function, no automatic merge.
-
-### Council decisions leave a trail
-
-`w2m_council fleet-decide` reports `trail` (`appended` / `refused` / `error` / `not-written`) instead of implying a record exists; the test now asserts that status.
-
-Verified: gate GREEN twice, 2704 tests / 2690 pass / 0 fail / 14 skip in 132 files; client-bundle 25/25 after the board line; the merge-hint and trail tests are new.
-
-## [1.2.10-beta.1] — 2026-10-21
-
-A beta by policy: GitHub prerelease only, never npm. This one makes the reduce phase executable.
-
-### Reduce execution (caller-dispatched)
-
-`w2m_reduce` dispatches a reduce only from complete data: it refuses unless every declared shard reported as a blob and the named reducer reported (`W2M_REDUCE_NOT_READY`, with the missing indexes). It never picks a reducer and never invents inputs; inline results are refused (`W2M_REDUCE_INLINE_INPUT`) because they cannot be carried to another machine.
-
-The relay validates and carries `reduce_of` + `reduce_inputs` (at most 16 artifacts, sha256 only) on the task, the ledger and the offer; the agent fetches those content-addressed blobs BEFORE running the reduce and exposes `W2M_REDUCE_INPUTS_DIR` / `W2M_REDUCE_MANIFEST` / `W2M_REDUCE_OF` to the command. A failed fetch refuses the task (`REDUCE_INPUT_FETCH_FAILED`) rather than reducing half the fleet.
-
-Verified: gate GREEN twice, 2701 tests / 2687 pass / 0 fail / 14 skip in 131 files; new agent e2e proves the reduce reads the exact artifact bytes; the tool has a dispatch test and a refusal test.
-
-## [1.2.9-beta.1] — 2026-10-21
-
-A beta by policy: **GitHub prerelease only, never npm.** The theme is the data plane and the collaboration plane: the design is
-written down (`docs/DATA-PLANE-COLLABORATION.md`) and this release ships its first slice.
-
-### `reduce_suggestion` on `w2m_wait`
-
-Every terminal wait now answers three questions without acting on them: is the data complete, who could reduce it, and what the
-caller is supposed to do next (`dispatch the reduce yourself; this tool does not run it`). It is a pure function over the machine
-facts the aggregate already publishes:
-
-- **ready** only when every declared shard reported and a reducer was named;
-- **missing indexes** when a shard never reported (an expired lease cannot claim one);
-- **candidates** listing the machines that reported, with the reason;
-- a named reducer that never reported is refused by name (`REDUCER_UNREPORTED`) rather than silently replaced -- changing the
-  machine changes what the reduce runs against;
-- a caller that named no reducer gets `REDUCER_MISSING` and candidates, never an invented choice.
-
-Nothing is stored and nothing is dispatched. Two readers of the same aggregate get the same suggestion, and reading does not
-change relay state.
-
-### The design document states the open question
-
-Caller-dispatched reduce (current direction) versus auto-reduce in the relay. The design leans caller-dispatched, because a relay
-that decides to run a command is the boundary every other decision avoids; a beta that flipped that default would be the wrong
-place to discover it. The document also names the next collaboration slices: conflict-merge UI, council decision trail to shared
-memory, and the board in the composer panel.
-
-### Verified
-
-Gate GREEN twice: 2699 tests / 2685 pass / 0 fail / 14 skip in 131 files. New: `suggestReduce` unit tests (7) covering complete,
-partial-with-missing, no-reducer, unreported-reducer and mixed inline+blob inputs; `w2m_wait` carries the suggestion for every
-aggregate.
-## [1.2.8-beta.1] — 2026-10-21
-
-A beta, by policy: **not published to npm**. It is a GitHub prerelease, installable by a developer who asks for it.
-
-### Message ids are unique across a relay restart
-
-The relay's chat sequence resets on restart, so a bare `msg-000001` named a different message after every deploy. Clients persist
-those ids -- an open turn, a read watermark, `reply_to` -- and live testing caught exactly that: a Windows `ask` recorded a turn, the
-relay restarted, a new message reused the id, and the wait settled the OLD turn as `answered_after_timeout` while the reply was
-fresh. Message ids now carry a random per-process epoch (`msg-<epoch>-<seq>`), so a restart cannot recycle an id and old clients that
-render ids verbatim keep working.
-
-### One size for "how large may one artifact be"
-
-The blob transport frame was 1 MiB while the agent's dataflow hard cap is 16 MiB, so an artifact between the two was accepted by the
-agent and then failed its upload (`BLOB_UPLOAD_FAILED`) on a relay that looked fine. `BLOB_FRAME_BYTES` is now 16 MiB, matching the
-agent, while every JSON route keeps the 64 KiB frame limit.
-
-### Verified
-
-Gate GREEN twice: 2691 tests / 2677 pass / 0 fail / 14 skip in 130 files. New tests: an id is unique across two store instances
-(same sequence, different process), an explicit epoch is honoured, and a 2 MiB blob survives the transport intact.
-
-### Still open (unchanged from 1.2.7)
-
-- `pipeline` keeps `index_total` at 1; blob map results come from plain commands above the inline cap.
-- macmini runs 1.2.6 from its own checkout and needs a `git pull` + restart for the plain-command blob behaviour.
-## [1.2.7] — 2026-10-21
-
-**The scheduler enforces the graph, a wait survives a restart and a dropped stream, and a partial fleet can no longer call itself
-a complete reduce.**
-
-### Turns are a state machine on disk
-
-A question written with `action:'ask'` becomes a persisted turn (`ask_id`, deadline). `await` attaches to that record, so a process
-restart does not lose the question or turn a late answer into silence; a late answer is recorded as `answered_after_timeout`. The
-wait prefers the relay's event stream, re-subscribes when the stream drops, and polls only when streaming is unavailable. A reply
-now carries `reply_state: 'answered'|'refused'`, so a refusal is a state the waiter reads rather than wording it guesses.
-
-### Dependencies block dispatch, and release when their prerequisite settles
-
-A task with `depends_on` is not offered: its leases are `waiting`, which redelivery skips and the sweeper ignores. When every
-prerequisite is settled -- **by a result, an expiry or a refusal** -- `_releaseDependents` moves those leases to offers. The graph
-edges and `assignee` are written into the task ledger, because live testing showed a restarted relay losing them and keeping a
-waiting task waiting forever. `assignee` is enforced, not recorded: only that machine gets a lease, and an unknown assignee is
-refused by name. `GET /v1/tasks` now publishes a derived `status` (`waiting`/`active`/`done`/`failed`/`cancelled`) and
-`waiting_on`, so the board and the scheduler cannot disagree.
-
-### Dataflow: an expected shard count, and a reduce that refuses partial input
-
-`buildReducePlan` takes `expectedIndexTotal` from the task (`index_total`) and refuses `MISSING_SHARD` (with the missing indexes),
-`MAP_INDEX_MISSING` and `MAP_INDEX_OUT_OF_RANGE`; only machines that actually reported can claim a shard, so an expired lease no
-longer makes a partial run look complete. Two production gaps were found by live testing and closed with it:
-
-- **A large plain-command stdout was never a blob.** The blob path lived only in the pipeline loop, so a split/mapreduce map result
-  was always inline and a reduce plan could never see what it reduces. Any command output above the inline cap now uploads a blob
-  exactly as a pipeline stage does (best effort: a failed upload keeps the command successful and says why).
-- **The relay's own frame limit made the blob channel unusable.** `MAX_FRAME_BYTES` (64 KiB) equals the inline threshold, so every
-  blob was by construction larger than the frame cap and a real upload failed with `FRAME_TOO_LARGE` while the fake relay in tests
-  accepted it. Blob PUTs now get a bounded 1 MiB frame (`BLOB_FRAME_BYTES`); every JSON route keeps the 64 KiB cap.
-- The aggregate now publishes `blob_sha256`, `output_mode`, `stdout_head` and `stdout_bytes` per machine: `w2m_wait` used to read
-  `aggregate.detail.machines`, a shape the production `/v1/tasks` response never carries, so the reduce plan was unreachable
-  outside tests.
-
-### Verified
-
-Gate GREEN twice, 15 of 15: 2687 tests / 2673 pass / 0 fail / 14 skip in 130 files.
-
-Two-machine live runs on Windows (ToFuture) and jp-shared over the real relay:
-
-- **await over SSE**: Windows asks, jp-shared replies `reply_state:'refused'`; the wait returns `state=refused, via=stream`, and the
-  turn is settled on disk.
-- **dependency chain**: B with `depends_on: [A]` is `waiting`, A settles, B is released (observed `status=active` with offers).
-- **missing shard**: a split task with `index_total: 5` whose map results are blobs is refused as
-  `MISSING_SHARD {missing:[1,3,4], expectedIndexTotal:5}` with `dataflow_degraded: true` -- the first live exercise of the blob
-  channel end to end.
-
-Both live-testing defects above (release only on a result; graph edges missing from the ledger) were found by these runs and are
-covered by tests now.
-
-### Limits, stated
-
-- A pipeline task runs the whole chain per machine, so `index_total` stays 1 for it; blob map results come from plain commands above
-  the inline cap.
-- The blob transport frame is 1 MiB while the agent's dataflow hard cap is 16 MiB: a single artifact above 1 MiB fails its upload
-  explicitly (`BLOB_UPLOAD_FAILED`) rather than being split across frames.
-- The jp-shared agent was upgraded to this build; macmini runs 1.2.6 from its own checkout and needs a `git pull` + restart to get
-  the plain-command blob behaviour.
-## [1.2.6] — 2026-10-20
-
-**Security surface: signatures, a permission matrix, and output that no longer carries secrets — plus the reliability the chat
-needed before it could be trusted with real messages.**
-
-### Command signatures
-
-The agent signs `{task_id, argv_hash, machine_id, ts}` with an Ed25519 key derived from its device key (`DeviceKey` is X25519 and
-cannot sign; deriving keeps one secret per machine). The envelope carries `signature {alg, value, public_key, ts}`, and
-`w2m_wait` reports every machine as `signed`, `unsigned` or `bad_signature`, with a task-level `signature_warning`. A tampered
-`argv_hash` verifies as `bad_signature` -- tested at the unit level and end to end through a real agent run.
-
-Honest limit: the public half travels inside the signature. That proves the result matches the key it carries, not that the key
-belongs to the machine. Binding it to the relay's device record is the remaining step for non-repudiation across machines, and it
-is named here rather than implied.
-
-### Permission matrix
-
-`src/util/policy-matrix.mjs` is the single table: `observer < worker < owner` against `read_private | vote | join | dispatch |
-approve | manage_members`. A refusal is `FORBIDDEN_ACTION` naming the action, the level required and the level held. The relay
-enforces it where a role actually acts: an observer may read the fleet flow and may not post into it. Unknown means worker, never
-owner.
-
-### Output redaction
-
-`stdout_head`/`tail` and `stderr_head`/`tail` are filtered for API keys, `npm_`/`github_pat_` tokens and private-key blocks,
-replaced in place with `[redacted:class]` so line numbers survive. Hashes and blobs are never touched: they are evidence of the raw
-bytes. `redactOutput: false` is allowed and marks the envelope `unredacted: true`.
-
-### End-to-end encrypted chat
-
-Sending encrypts with AES-256-GCM under a group key derived as `HKDF(fleetKey, 'fleet-chat-v1')`; the relay stores ciphertext and
-cannot open it. Reading decrypts what the key covers and marks the rest `encrypted: true` with a `decrypt_error`. Plaintext
-messages keep working, so older clients neither break nor are lied to. The relay validates the encryption envelope's shape and
-refuses a malformed one (`BAD_ENCRYPTION`), and cannot search content -- which is the point, and is written down as the cost.
-
-### Reliability
-
-- **Role persistence**: `member.role` ledger entries replay on restart, so a relay restart no longer silently demotes every owner.
-  Verified live: the role that was lost before the deploy came back after it.
-- **Chat cursor**: `list` continues where the last page ended (`since_ms` from a persisted per-session cursor) and advances only
-  over what was actually read.
-- **Offline spool**: a send that cannot reach the relay is written to disk with an idempotency key and replayed on the next call;
-  a replay that the relay already received returns the first message instead of posting twice.
-
-### Verified
-
-Gate GREEN twice, 15 of 15: 2666 tests / 2652 pass / 0 fail / 14 skip in 130 files. New suites: chat-crypto (8),
-envelope-signature (6), policy-matrix (9); agent 152, relay 173, tools 132, fleet-messages 14.
-
-Relay redeployed twice from hash-verified tarballs, with state backups, and the new surfaces exercised against the live relay:
-encrypted message stored as ciphertext and read back, malformed encryption refused with 400, roles restored after restart.
-
-### Known gaps
-
-- The GitHub Packages mirror still holds an orphan `1.2.4` published by a diagnostic dispatch; removal needs a token with package
-  administration (this one sees 404 on the package API).
-- The signing public key is not yet bound to the relay's device record (see above).
-- Two-machine end-to-end runs of the new chat surface are still not done; the HTTP and tool surfaces are tested against fakes and
-  exercised once against jp-shared.
-## [1.2.5] — 2026-10-20
-
-**Who is in the fleet, what they have read, who was named, and a retry that cannot double-post.**
-
-### Members and roles
-
-`GET /v1/fleet/members` lists every machine with its name, role, join time, presence and last-seen time. `PUT
-/v1/fleet/members/{id}` changes a role and requires the **operator** token, so the route sits with dispatch rather than behind the
-device gate. Roles are `owner | worker | observer` and live in their own table: a device record is written by pairing and by
-reconnect, and a role is an operator decision that must survive both. An unknown machine is a `worker`, never an `owner` -- a
-re-pair cannot gain authority. The last owner cannot be demoted, because then nobody could readmit a machine.
-
-### Read watermarks
-
-`PUT /v1/fleet/read/{session}` records how far this machine has read a conversation (its own token decides which machine);
-`GET /v1/fleet/read/{session}` answers the watermark and an unread count of messages from others newer than it. Only forward: a
-stale marker arriving late must not move the watermark backwards, or the count would grow for messages already seen.
-
-### Mentions
-
-A message may carry `mentions: [machine_id]` (at most 10, validated). The row is still **one** row -- a mention is a
-notification hint, not a delivery mechanism -- and the SSE notification says only whether **this** listener was named. It never
-carries the text, and it does not carry the mention list.
-
-### Idempotent posts
-
-`POST /v1/fleet/messages` accepts `idempotency_key` (per session). A retry after a lost response returns the **first** message
-with `deduped: true` instead of storing the sentence twice. The key is bounded, like the message log.
-
-### Two defects the 1.2.4 tag carried, fixed here
-
-The 1.2.4 commit (tag `v1.2.4`) had a red CI and a red Compat, both found before approval:
-
-- **Compat**: `w2m_wait`'s `reducer_machine_id` declaration had been pasted **inside** `poll_ms`. Every local check was green;
-  the real host refused the whole entry ("parameters.poll_ms.reducer_machine_id is not supported by the value schema DSL"). The
-  parameter now sits where it belongs, and `schema-spec.mjs` gained `strayParameterProblems()` — a parameter declaration
-  nested inside another parameter is now refused where the tool is written, with two tests.
-- **CI**: the cancellation HTTP test had been inserted inside an enclosing `it`. Node 24 ran it; Node 20/22 reported
-  `cancelledByParent`. The test now lives in its own top-level `describe`.
-
-### Verified
-
-Gate GREEN twice, 15 of 15: 2628 tests / 2614 pass / 0 fail / 14 skip. New suites: fleet-members (6); fleet-messages grew to 11;
-relay grew to 171 including two HTTP cases for members and watermarks.
-
-The relay was deployed a fourth time from a hash-verified tarball with a state backup, and the new routes were exercised against
-the live relay (members returned 8 machines; a role change returned 200; a watermark round-tripped; unread answered 0).
-
-### Not in this release
-
-- **Offline replay of outbound chat** is not implemented. The agent's spool already holds undeliverable *results*; chat text is
-  not yet spooled and replayed.
-- A two-machine end-to-end run of mentions/watermarks. The HTTP surface is tested against the fake relay and exercised once
-  against jp-shared, but not by two physical machines.
-## [1.2.4] — 2026-10-20
-
-**Fleet collaboration, part two: cancellation, dependencies, a task board, questions on disk, and output that travels.**
-
-### Cancelling a task over HTTP
-
-`state.cancelTask` has existed since the task ledger gained a cancel flag, but **no route reached it**. `POST /v1/tasks/{id}/cancel`
-now does, with the same operator authorization dispatch requires, and `w2m_cancel` is the tool over it. Cancelling twice is not
-an error: the ledger is the answer.
-
-### Prerequisites and a task board
-
-- `POST /v1/task` accepts `depends_on[]`. Validated at **enqueue** time: unknown prerequisite, self-edge, duplicate edge and
-  cycles are refused by name (`src/relay/task-deps.mjs`), because a graph checked only when a worker picks the task up puts the
-  refusal on a machine that did not create the problem.
-- `depends_on` / `assignee` travel on the task record.
-- `w2m_tasks` (the fifteenth tool) is the board: it classifies every visible task as ready / active / waiting / blocked / done
-  (`src/plugin/task-graph.mjs`). A prerequisite outside the page is treated as **waiting**, never as absent.
-
-### Questions that survive a restart
-
-`src/plugin/ask-store.mjs` keeps open questions in a JSONL file next to the profile (`ask-store.jsonl`, atomic rewrite, cap on
-records). A reply that arrives after the deadline is recorded as `answered_after_timeout` rather than overwriting the timeout or
-being dropped, and a settled question is never reopened. `w2m_chat` gained `action: "asks"`, and `await` settles the stored ask.
-
-### Output that travels
-
-`src/util/dataflow.mjs` (moved from `src/plugin/` — the layer check refused an `agent -> plugin` edge) is now wired:
-
-- a pipeline stage whose stdout exceeds 64 KiB **uploads it as a blob** (`PUT /v1/fleet/blobs/{sha256}`) and the envelope names
-  it (`blob_sha256`, `output_mode: "blob"`) instead of inlining head/tail;
-- a failed upload **fails the stage** by name (`BLOB_UPLOAD_FAILED`) rather than leaving a reference to nothing;
-- `w2m_wait` builds the reduce plan with `buildReducePlan` from the **raw** envelopes and marks the verdict `degraded` when a
-  shard is missing — but only when the caller declared `reducer_machine_id`, so a large pipeline result is not mistaken for a
-  partial reduce.
-
-The end-to-end fixture this release adds (`test/agent.test.mjs`) runs a real agent against a fake relay: it asserts the blob name
-is the hash of the bytes sent and that a refused upload fails the stage. Two real defects surfaced while writing it and are fixed
-here: the stage stdout arrives as a `Buffer` (it was handed to the signature helper as a string), and a 70 KiB test argv exceeds
-Windows' `CreateProcess` limit.
-
-### Retry and hand-off
-
-- `POST /v1/task` accepts `max_attempts` (1..5, default 1) and `retry_on` (`expired|failed|partial|timeout`). Defaults keep
-  at-most-once for every existing caller; a malformed policy is `BAD_REQUEST`, not silently ignored.
-- On lease expiry, `retry_on` containing `expired` performs the hand-off `halt=now` always had: attempt+1 and a re-offer to idle
-  machines (`_takeover`, which already refuses writing tasks to avoid double application).
-
-### mapreduce
-
-`mode: "mapreduce"` is accepted with `reduce_argv` and an optional `reducer_machine_id`. The map half is ordinary dispatch; the
-reduce half is **described, never launched** — the caller runs it as an explicit second task after `w2m_wait` says every shard is
-present, so one task id never describes two executions.
-
-### Relay
-
-The relay was deployed three times during this release (cancel route, retry policy, mapreduce) from hash-verified tarballs, each
-with a state backup, a health check, and a 401 check on the pre-existing routes. **The relay name is separate from the package
-version**: the tarball deployed was the 1.2.3-labelled build carrying this code, and is re-deployed from the released 1.2.4 tarball
-below.
-
-### Verified
-
-Gate GREEN twice, 15 of 15: 2610 tests / 2596 pass / 0 fail / 14 skip. Notable suites: agent 149 (147 pass, 2 skipped),
-relay 169, tools 127, task-deps 13, task-graph 11, ask-store 8, turn 5, dataflow 7, dataflow-wiring 7.
-
-### Not verified
-
-A two-machine run of cancel / retry / mapreduce end to end. The code paths are tested against a fake relay and against the real
-relay's HTTP surface, but no test here runs two physical machines exchanging an expired lease.
+## [1.7.8] — 2026-10-26
+
+**GPW 启用失败修复（第二个）：`TypeError: Cannot read properties of undefined (reading 'layers')`。**
+
+- 根因：v1.7.7 为做黑名单同步拒绝，在**激活期**调用根上下文的 `ctx.tools.guard()`。tools 服务是**按 agent 组合**的，
+  根作用域实例在激活阶段还没有 layer 表，于是抛 `reading 'layers'`，dsh-gpw 仍无法激活。
+- 修复：改为在 `agent/created` 监听里对**每个 agent 自己的上下文** `agent.ctx.tools.guard(...)` 注册黑名单守卫，
+  并用 `ctx.effect` 统一释放；根上下文不再读取 tools 服务（`inject` 回到只有 `permissionPresets`）。
+- 保留 `tools/pre-execute` 三分类拦截；guard 缺失的宿主不会因此激活失败（pre-execute 仍会拒绝黑名单）。
+- 回归测试升级：`test/gpw-activation.test.mjs` 现在用严格 Cordis 语义 Proxy（读取根 `tools` 即抛错）验证激活，
+  并通过伪造 `agent/created` 断言守卫注册在 agent 上下文。
+- 同时补全 bundle patch 中 GPW v2 的配置项（requireFullAccess / whitelist / blacklist / pendingTimeoutMs）。
+- 证据：`docs/acceptance/1.7.8/GPW-AGENT-SCOPE.json`。
+## [1.7.7] — 2026-10-26
+
+**GPW 子插件启用失败修复：`cannot get property "tools" without inject`。**
+
+- 根因：`gpw.mjs` 读取 `ctx.tools.guard` 做黑名单同步拦截，但 `inject` 只声明了 `permissionPresets`。
+  Cordis 对未声明服务读取直接抛错，插件激活因此失败（组件启用失败：1 entry did not activate dsh-gpw）。
+- 修复：`inject = ['permissionPresets', 'tools']`；guard 读取改为防御式（老宿主无 guard 扩展时不影响
+  `tools/pre-execute` 拦截）。
+- 新增回归测试 `test/gpw-activation.test.mjs`：用严格 Cordis 语义的 Proxy 上下文调用 `apply()`，
+  未声明服务读取即抛错；断言 `tools/pre-execute` 监听已安装。
+- 证据：`docs/acceptance/1.7.7/GPW-INJECT.json`。
+## [1.7.6] — 2026-10-25
+
+**审计修复版：测试零残留工具链 + 修复泄漏的测试夹具，并固化 v1.6.1→v1.7.4 审计报告。**
+
+- 新增 `scripts/temp-residue.mjs`（`snapshot` / `report` / `clean`）：对用户 TEMP 中 `w2m-*`、`gpw-*`
+  测试残留做基线快照、前缀统计与按年龄的安全清理；审计实测清理了 15,608 个历史残留目录。
+- 新增 `test/helpers/temp-cleanup.mjs`：基线式 per-test 清理，避免并发测试互删夹具。
+- 修复会泄漏临时目录的测试：`gpw-folder-policy`、`agent`（workspace 两处 fixture）、`worktree`（makeRepo）。
+- 零残留复测：单轮全量测试新增残留从约 1,000 个降至 74 个（剩余前缀已量化，作为下一轮清理清单）。
+- 新增审计报告 `docs/audit/AUDIT-1.6.1-1.7.4.md`：14 个正式版的 Release/CI/Compat 全绿记录、
+  2930 个测试 0 失败、lint 0 error、实机部署与落库断言、relay 延迟与测试耗时实测。
+- 证据：`docs/acceptance/1.7.6/AUDIT-ZERO-RESIDUE.json`。
+## [1.7.5-beta.1] — 2026-10-25
+
+**GPW 升级为文件夹三分类网关（完全权限下生效）：黑名单拒绝 / 白名单放行 / 其余进入 GPW 自己的待审批队列。**
+
+- 生效条件：仅当会话权限预设为 **完全权限**（`danger-full-access`）时拦截；其它预设交给 DSH 自己的沙箱/审批，
+  不重复介入。
+- **黑名单（拒绝）**：`ctx.tools.guard()` 同步拦截，返回拒绝原因即不执行；与 `tools/pre-execute` 的监听顺序无关。
+- **白名单（通过）**：等价于扩大的工作区，无需再审；仍受自动审批预算约束（每滚动窗口 10 次、间隔 3s），
+  预算耗尽后同样进入待审批队列而不是静默放行。
+- **其它文件夹（C 类，待审批）**：调用被挂起，进入 GPW 自己的待审批队列；用户在 GPW 面板点「允许本次/拒绝本次」
+  才继续（默认 120s 无答复则拒绝）。这不是 DSH 的 approval 策略，所以在 approval=never 的完全权限下依然有效。
+- 面板（Node 执行能力菜单内新增「GPW 文件夹策略」）：白/黑名单展示与移除；「添加文件夹」通过宿主原生选择器
+  （Windows FolderBrowserDialog / macOS choose folder / zenity）选路径，读写名单不需要编辑任何 profile YAML；
+  名单保存在 `$DSH_HOME/xclient/gpw-folders.json`，另有待审批列表与允许/拒绝按钮。
+- 测试：`test/gpw-folder-policy.test.mjs`（6/6，三分类、deny 优先、前缀误判防护、命令路径提取、预算映射）。
+## [1.7.4] — 2026-10-25
+
+**修复两处桌面宿主兼容性问题：`agent.identity` 崩溃、切换 relay 后旧 device token 导致 401 无法入队。**
+
+- 崩溃修复：`agent.identity?.()` 在桌面宿主上抛 `TypeError: agent.identity is not a function`，
+  且发生在 `agent.start().then(...)` 回调里变成未处理 rejection，把整个 DSH 宿主带崩。
+  新增 `agentIdentityOf()` 做类型判断，`agent.start()` 仍为非阻塞并记录失败。
+- 迁移修复：relay 切换到新主 relay 后，`device.json` 里的 token 属于旧 relay，新 relay 回
+  `401 UNAUTHORIZED: missing or invalid device_token`；启动逻辑看到已有 token 就跳过配对，
+  导致机器停在"无列表"。现在会先用 token 探测配置的 relay：**明确 401/403 才丢弃并重新配对**，
+  网络错误保留 token（不会因短暂故障误触发配对）。
+- 新增回归测试：`test/agent-identity-safe.test.mjs`、`test/re-pair-stale-token.test.mjs`。
+- 证据：`docs/acceptance/1.7.4/DESKTOP-HOST-COMPAT.json`（含真实崩溃信息与迁移症状）。
+## [1.7.3] — 2026-10-25
+
+**截图提示改为顶部浮层（5 秒自动消失、可关闭、不挤压输入框）；全服计数标注来源 relay 并单列本编队。**
+
+- 截图成功/失败提示不再插在输入区里：改为聊天面板顶部浮层（绝对定位，不占布局；连续截图只替换同一行，
+  不会越堆越多），**5 秒自动消失**，右侧 × 可立即关闭。
+- 全服统计行改为「主 relay（地址）全服：X/Y 个编队 · A/B 台在线」，并新增一行「本编队：n/m 台在线」；
+  两者语义不同，不再混在一起看。
+- relay 角色判定改为按**配置的主 relay**（不再按响应最快，备用 relay 偶然更快时会被误标成 primary）。
+- 证据：`docs/acceptance/1.7.3/TOAST-AND-TOTALS.json`（fleet task `01M5ANYMVMSGGQV`；宿主截图 141,768 字节）。
+## [1.7.2] — 2026-10-25
+
+**按实测反馈调整编队聊天截图/复制：只复制不预览、快捷键 Ctrl+Shift+P、强制可选中。**
+
+- 截图按钮不再在面板里生成缩略图/下载行：抓到画面后**只写入剪贴板**并给一行提示，聊天区域保持干净。
+- 快捷键从 Ctrl+P 改为 **Ctrl+Shift+P（macOS 也支持 Cmd+Shift+P）**；普通 Ctrl+P 不再被劫持，
+  浏览器/应用的打印快捷键恢复原样。
+- 选中&复制：`user-select:text!important` 应用到整个面板的所有子节点（不再只覆盖几个类），
+  并在消息列表上阻止宿主吞掉 mousedown/copy 事件，保证拖选与 Ctrl+C 生效；单条消息的 ⧉ 复制按钮
+  仍走「浏览器剪贴板 → 宿主剪贴板」回退链。
+- 全服统计只认**配置的主 relay**：主 relay 不可达时不再把备用 relay 的数字（1/1 编队、2/5 在线）当"全服"显示，
+  而是显示「主 relay 不可达 · 全服统计不可用」。修复了在线编队/在线机器数量"错误"的观感来源。
+- 证据：`docs/acceptance/1.7.2/CHAT-CLIPBOARD-SHORTCUT.json`（fleet task `01M5ANYMVMR3IOB`；
+  宿主截图实测 159,561 字节并复制成功）。
+## [1.7.1] — 2026-10-25
+
+**修复桌面壳下聊天截图/复制失败（permission denied）与插件更新"no supported installer available"。**
+
+- 截图：浏览器 `getDisplayMedia` 在 DSH 桌面（Electron）被拒绝（`permission denied`）。新增**宿主侧截图**
+  `POST /api/w2m/capture`（Windows PowerShell System.Drawing；macOS screencapture；返回 JPEG base64），
+  按钮与 Ctrl+P 在渲染层捕获失败时自动回退到宿主截图，并在宿主侧复制到剪贴板。
+- 复制：`navigator.clipboard` 被拒时新增**宿主剪贴板** `POST /api/w2m/clipboard`（Windows Set-Clipboard /
+  macOS osascript），单条消息复制按钮与复制文本都走这条回退链。
+- 选中：transcript 的 `user-select:text` 改为 `!important`，避免宿主全局样式覆盖导致无法选中。
+- 插件更新：`update-install` 的安装器解析新增桌面运行时布局
+  （`<app>/resources/runtime/<runtime>/dependencies/pnpm/bin/pnpm.mjs`、`~/.dsh/dsh-runtimes` 兜底），
+  并用运行时自带的 `node` 执行 pnpm（桌面壳的 `process.execPath` 不是 Node）。修复了更新按钮
+  "install update: no supported installer available"。
+
+- 测试：capture-route 4/4、fleet-chat-capture 3/3、client-bundle 26/26、update-resolver 4/4；
+  证据 `docs/acceptance/1.7.1/DESKTOP-CAPTURE-UPDATER.json`（fleet task `01M5ANYMVMN9CNQ`）。
+## [1.7.0] — 2026-10-25
+
+**编队聊天框：截图按钮 + Ctrl+P 快捷键 + 对话内容可选中&复制。**
+
+- 输入区新增 **📷 截图按钮**：`getDisplayMedia` 让用户选屏幕/窗口 → 抓帧为 PNG → 自动复制到剪贴板，
+  面板内显示缩略预览（可下载/再次复制）；宿主不支持或权限被拒时在面板内显示原因，不抛未处理异常。
+- **Ctrl+P（macOS 也支持 Cmd+P）**：聊天面板打开时触发同一截图流程，并在捕获阶段 `preventDefault`，
+  不会弹出浏览器打印对话框。
+- **对话内容可选中&复制**：transcript/消息文本 `user-select:text`；每条消息新增 **⧉ 复制** 按钮；
+  划选文字时点击消息不会误触发"回复"。
+
+已知边界：编队聊天协议仍是纯文本（relay 消息不含图片字段），所以截图是"复制到剪贴板 + 预览/下载"，
+不会作为图片消息广播给其他机器——图片传输需要扩展 relay 消息协议（后续版本）。
+
+- 测试：`test/fleet-chat-capture.test.mjs` 3/3；client-bundle 26/26；
+  证据 `docs/acceptance/1.7.0/CHAT-CAPTURE-CONTROLS.json`（fleet task `01M5ANYMVMLRC5H`）。
+## [1.6.9] — 2026-10-24
+
+**修复 failover 监控从未安装的根因：`startLocalStack` 等待了永不 settle 的 `agent.start()`。**
+
+阶段日志（macOS，1.6.8，现场实测）：
+
+```
+W wrap enter relayUrls=[腾讯云, Vultr]   ← 配置正确
+A startLocalStack enter
+C createAgent done
+S before agent.start              ← 之后没有任何日志
+```
+
+agent 实际已上线（编队在线），但 `await agent.start()` 的 Promise 永不返回，导致 `startLocalStack` 不返回 →
+`startFailoverStack` 永远走不到 `relayPool(cfg)` / `setInterval`，**监控循环从未创建**，自动 failover 不可能触发。
+
+修复：
+
+- `startLocalStack` 不再 await `agent.start()`：后台启动，失败写日志（`w2m: agent start failed`）。
+- mount 只需要返回清理句柄，不需要"观察启动完成"；agent 会通过 relay 自报在线。
+- 新增回归测试 `test/agent-start-nonblocking.test.mjs`：读取源码，若 `startLocalStack` 再次 await
+  `agent.start()` 即失败（防止该阻塞回归）。
+- 证据：`docs/acceptance/1.6.9/FAILOVER-MONITOR-INSTALL.json`（fleet task `01M5ANYMVMKL55O`）。
+## [1.6.8] — 2026-10-24
+
+**插件面板新增「检查插件更新」按钮：npm 对比 → 自动更新 → 提示重启 DSH。**
+
+- 客户端：目标机器菜单 relay 区新增按钮。点击后：① GET `/api/w2m/plugin-update` 联网查 npm latest
+  并与已装版本比较；② 有新版时 POST `{action:"apply"}` 执行安装；③ 安装完成显示"请重启 DSH 以载入最新插件"。
+- 宿主：新增路由 `/api/w2m/plugin-update`。检查逻辑在 `src/plugin/npm-update.mjs`（纯函数，可单测：只认
+  `latest > installed`，网络失败是错误值而不是"已最新"）。
+- 安装复用**既有已验证更新器**（`auto-update.mjs` → `update-install.mjs`）：下载 tarball、用 release
+  SHA256SUMS 校验 SHA-256、备份旧包、替换新版——按钮点击不会引入第二套弱校验安装路径。
+- 测试：npm-update 4/4、client-bundle 26/26；证据 `docs/acceptance/1.6.8/PLUGIN-UPDATE-BUTTON.json`
+  （fleet task `01M5ANYMVMI9EHA`）。
+- 边界：DSH 插件管理页的「卸载」按钮属于宿主应用（打包在 app.asar 内），插件包无法直接注入其旁边；
+  本按钮位于 w2m 插件自己的面板中。若要放进宿主插件页，需要 DSH 侧提供插件动作扩展点（已列为待评估）。
+## [1.6.7] — 2026-10-24
+
+**修复 v1.6.6 failover 的阻塞 bug：远端 relay 模式下清理函数抛错，切换后无法重启 stack。**
+
+现场演练（停主 relay 180s）暴露：机器掉线后没有切到备用，恢复主 relay 后才重新上线。根因：
+
+- `startLocalStack` 的清理函数无条件执行 `await relay.close()`；而 `relay` 只在"本进程自建本地 relay"
+  时才非空，远端 relay 模式下是 `null` → 抛 TypeError；
+- failover 的切换流程 `await stop()` 抛错后被 catch 吞掉，**后续的 restart 从未执行**（stack 停了没起来）。
+
+修复：
+- 清理函数 null-safe/idempotent：仅当 `relay` 是带 `close()` 的对象才调用；`agent.stop()` 失败也继续清理。
+- 切换流程：`stop()` 失败不再跳过 restart；并写诊断日志 `xclient/relay-failover.log`（每轮探测/切换/重启错误）。
+- 测试：relay-failover 5/5、relay 200/200；证据 `docs/acceptance/1.6.7/FAILOVER-CLEANUP-FIX.json`
+  （fleet task `01M5ANYMVMFSSP3`）。
+## [1.6.6] — 2026-10-24
+
+**relay 自动 failover：主 relay 故障时自动切到备用，恢复后自动切回。**
+
+现场事故（2026-10-24）：主 relay 主机整体不可达（8787 与 SSH 22 都超时），备用 relay 一直健康，
+但每台机器仍死连主 relay——备用链路只是常驻成员，不会接管，编队停摆。
+
+- 新增 `src/plugin/relay-failover.mjs`：非对称滞回状态机（**连续 3 次**探测失败才切走，**连续 5 次**
+  健康才切回；没有可达备选则不切）。纯函数，边界可单测。
+- `startLocalStack` 外包一层 `startFailoverStack`：每 10s 探测池内各 relay `/healthz`；
+  决策为切换时，停止当前 in-process stack，把 `cfg.rabbitUrl` 设为备 relay 并重启 stack——
+  **切换是重新入队（fleet key 重新配对），不是重连**（device token 是按 relay 签发的）。
+- `w2m_status` 新增 `failover` 快照：primary/active/pool、失败计数、切换次数、最近切换原因与历史。
+- 测试：relay-failover 5/5、relay 200/200；证据 `docs/acceptance/1.6.6/RELAY-FAILOVER.json`
+  （fleet task `01M5ANYMVM9GEKQ`）。
+## [1.6.5] — 2026-10-24
+
+**Windows 后台自动化不再弹窗：VBScript 隐藏包装 + 计划任务工具 + 文档。**
+
+现场故障：给 standby 守护（每 2 分钟）和 TwinsEarth 守望（每 5 分钟）用 `schtasks /TR "node.exe ..."`
+注册任务，导致桌面每隔几分钟弹出一个控制台窗口（守望脚本还会累积进程）。
+
+- 新增 `src/util/windows-hidden-task.mjs`：纯函数构造 VBScript 包装（`WScript.Shell.Run` 窗口样式 0、
+  不等待）与 `schtasks` 参数；命令行/参数先按 Windows 规则引用，再整体做一次 VBScript 转义（避免二次转义）。
+- 新增 `bin/w2m-hidden-task.mjs`：`--name/--every-minutes/--command/--arg/--workdir/--delete`，
+  一条命令注册“无窗口”计划任务。
+- 新增 `docs/WINDOWS-BACKGROUND-TASKS.md`：故障原因、正确做法、原则（分钟级任务只放短检查；一次性任务用完即删）。
+- 测试：windows-hidden-task 5/5（含转义与参数校验）；证据
+  `docs/acceptance/1.6.5/HIDDEN-BACKGROUND-TASKS.json`（fleet task `01M5ANYMVM30H98`）。
+## [1.6.4] — 2026-10-24
+
+**修复：`/healthz` 漏发 `fleets_online`（1.6.3 的 `fleetSummary` 已计算，但 `stats()` 没带到公开字段）。**
+
+- `stats()` 现在同时输出 `fleets_total` 与 `fleets_online`；
+- 面板可正确显示 `全服：X/Y 个编队 · M/T 台在线`（X = 至少一台机器在线的编队数）；
+- relay 主机升级到 1.6.4（含 1.6.3/1.6.2/1.6.1 全部内容）。
+- 测试：relay 200/200、fleet-target 49/49；证据 `docs/acceptance/1.6.4/HEALTHZ-FLEETS-ONLINE.json`
+  （fleet task `01M5ANYMVLX3MI7`）。
+## [1.6.3] — 2026-10-24
+
+**编队与机器同构显示：在线编队数/编队总数 + 在线机器/机器总数。**
+
+- relay `fleetSummary()` 新增 `fleets_online`（至少一台机器在线的编队数），`/healthz` 公开计数同步增加；
+- 面板 relay 区显示：`全服：X/Y 个编队 · M/T 台在线`（fleet-target probe 读取 `fleets_online`）；
+- relay 主机升级到 1.6.3（含 1.6.2 全服概览与 1.6.1 安全修复）。
+- 测试：relay 200/200、fleet-target 49/49、client-bundle 26/26；证据
+  `docs/acceptance/1.6.3/ONLINE-FLEETS.json`（fleet task `01M5ANYMVLWMTSG`）。
+## [1.6.2] — 2026-10-24
+
+**relay 全服概览：多少个编队、多少台机器在线（healthz + operator /v1/fleets + 面板一行显示）。**
+
+- `state.fleetSummary()`：按 fleet 聚合设备数/在线数，返回 `fleets_total`、`devices_online`、
+  `devices_total`、`unfleeted_devices` 与 per-fleet 明细。
+- `GET /healthz`（公开）新增上述**聚合计数**（不暴露 per-fleet 明细）；
+- `GET /v1/fleets`（operator token）：返回 per-fleet 明细（其他账号的编队名不向普通设备暴露）。
+- 面板 relay 折叠区新增一行：`全服：N 个编队 · M/T 台在线`（fleet-target probe 读取 healthz 计数）。
+- relay 主机将升级到 1.6.2（包含 1.6.1 的 Node 执行仅人工/内存态与 allow-list 解释器身份修复）。
+- 测试：relay 200/200、fleet-target 49/49、client-bundle 26/26；证据
+  `docs/acceptance/1.6.2/RELAY-FLEET-OVERVIEW.json`（fleet task `01M5ANYMVLRYXSN`）。
+## [1.6.1] — 2026-10-24
+
+**Node 执行开关改为「仅人工 UI 手动、进程内存态」：文件/远程/自动化一律无法授权。**
+
+本次实机验证暴露了一个必须修掉的现实：grant 任务可以远程写 `~/.w2m/exec-capability.json`，
+从而远程把机器变成可执行任意 Node 代码——与"最高权限只允许人工手动选中"直接冲突。
+
+- 能力状态改为**进程内存**唯一权威：`readExecCapability` 不再读磁盘；旧文件（含 permanent）被忽略；
+  只有 host 路由 `/api/w2m/capability`（composer 人工点击）能写。
+- **不随重启保留**：进程退出即回到 denied（"永久"= 本次进程生命周期）；
+  `describe` 明确返回 `survives_restart: false`、`manual_only: true`、`file_ignored: true`。
+- 三态语义不变：denied / temporary（默认 24h，上限 7 天，过期即失效）/ permanent（本进程内）。
+- 测试重写：`test/exec-capability.test.mjs` 6/6（含"磁盘写 permanent 仍 denied""路由是唯一 setter"
+  "重启即撤销"）；agent.test 161 项通过（PATH 环境问题已在本机修复，非代码缺陷）。
+- 修复 allow-list 解释器身份回归：当 argv[0] 是 **运行 agent 的同一个 node（process.execPath）** 时，
+  bare 条目 `node` 应放行（此前机器 PATH 里 node 指向别的程序时会误拒，实测 12 个 e2e 失败）。
+- 证据 `docs/acceptance/1.6.1/MANUAL-ONLY-CAPABILITY.json`（fleet task `01M5ANYMVLDYWBH`）。
+## [1.6.0] — 2026-10-24
+
+**一台 relay 承载 N 个编队：每个 DeepSeek 账号一个编队，共享 relay 但互相隔离。**
+
+- bootstrap 答案从"单个编队的归属"改为"relay 拓扑声明"：签名与有效期仍严格，fleet_id 不匹配不再拒绝
+  （`strictFleet: true` 保留旧行为）。一份 operator 签名即可服务全部编队，新账号机器无需人工重签。
+- `scripts/verify-fleet-isolation.mjs` 扩展到 **3 个编队** 14 项检查（设备枚举/任务/聊天/记忆），全过。
+- 新增 `docs/MULTI-FLEET.md`：编排模型、运维视图、零人工接入新账号、配额与边界。
+- 测试：bootstrap 6/6（含拓扑答案用例）、fleet isolation 14/14；证据 `docs/acceptance/1.6.0/N-FLEET.json`
+  （fleet task `01M5ANYMVLBU716`）。
+## [1.5.5] — 2026-10-23
+
+**跨编队隔离：同 relay 上的另一账号机器不再出现在本编队的枚举/任务/聊天/记忆里。**
+
+现场：另一账号的机器（自己的 fleet_id、自己的 fleet_key）出现在我们的机器列表里，被读成"非本账号
+机器进入编队"。排查结论：该机器的编队绑定本身是正确的，问题在于 relay 的**读取面没有按 fleet 过滤**
+（派发侧自 v0.7.7 起已按 fleet 隔离，operator token 为 relay 级权限属于设计）。
+
+- `GET /v1/devices`：按请求设备的 fleet 过滤（无 fleet 的旧设备在未配置 fleet 的 relay 上保持历史行为）。
+- `GET /v1/tasks`：任务记录携带 `fleet_id`，列表按调用者 fleet 过滤（operator 派发是 relay 级，不会进入
+  某个编队的列表）。
+- `POST /v1/fleet/messages`：`fleet_id` 取自已认证设备，忽略 body（防止把消息标成别的编队）。
+- `GET /v1/fleet/messages`：读取时按调用者 fleet 过滤。
+- fleet memory 文档按 fleet 前缀隔离（无 fleet 设备沿用历史键，单编队 relay 不受影响）。
+- 新增 `scripts/verify-fleet-isolation.mjs`：真实 relay + 两个 fleet 的黑盒验证（设备/任务/聊天/记忆
+  共 11 项检查），可作为部署前门禁脚本运行。
+- 验证：脚本 11/11 通过（fleet task `01M5ANYMVL2Q8PD`）；relay.test 200/200 通过。
+## [1.5.4] — 2026-10-23
+
+**验签 bootstrap 的结果覆盖过期的显式 relay（现场故障：设备仍指向 127.0.0.1）。**
+
+现场证据：DSH 升级到 v1.5.3 后仍报 `W2M_UNREACHABLE: could not reach the Rabbit at
+http://127.0.0.1:8787`——它的 profile 仍显式写着本机地址，v1.5.3 只在“无显式 relay”时才采用
+bootstrap 池，于是拿到池却继续拨 loopback。
+
+- bootstrap 验签成功后**总是采用** `relays[0]` 作为 `rabbitUrl`，并 warn 记录被替换的旧地址；
+  想固定 relay 的运维应显式设置 `relayUrls`（此时 bootstrap 分支不执行）。
+- 只影响“验签通过”的答案；失败仍保持原配置并写 `w2m_status.bootstrap.last_error`。
+- 测试：bootstrap 6/6、bootstrap-cli 6/6；证据 `docs/acceptance/1.5.4/BOOTSTRAP-WINS.json`
+  （fleet task `01M5ANYMVL0FV9C`）。
+## [1.5.3] — 2026-10-23
+
+**零接触自动入队：只能升级插件的机器也能自己找到编队。**
+
+v1.5.2 的验签 bootstrap 需要一个 URL、一个 operator 公钥和 fleetKey 才能触发——新装机器三样都没有，
+于是仍然回落到编译期默认 relay 并报 W2M_UNREACHABLE。v1.5.3 把触发条件做进包里：
+
+- 包内置默认 bootstrap 端点与 **operator 公钥 pin**（只含公钥；端点无法签发，私钥不出运维机）。
+- bootstrap 证明改为可选：机器还没拿到 fleetKey 时，仍可凭"签名 + 有效期 + relay 形状"采用
+  operator 声明的 relay 池（relay 列表是公开路由信息；加入编队仍需账号派生密钥，是独立一步）。
+- `startLocalStack` 在无 relayUrls 时始终尝试 bootstrap（默认值生效），成功即用池（首个 primary），
+  失败保持回落并写入 `w2m_status.bootstrap.last_error`。
+- 包内默认 patch：`autoStartAgent: true`（本 fork），新装即启动 agent。
+- 因此只有"升级插件"这一条通道的机器：升级 → 重启 → 自动取 relay 池 → 账号密钥就绪后自动配对入队。
+- 测试：bootstrap 6/6（含 keyless）、bootstrap-cli 6/6、fleet-target 49/49；层模型 clean；
+  证据 `docs/acceptance/1.5.3/ZERO-TOUCH-BOOTSTRAP.json`（真实 fleet task `01M5ANYMVKZ7DHH`）。
+## [1.5.2] — 2026-10-23
+
+**新机器自动获得 relay 归属（验签 bootstrap）+ 一次性配置工具。**
+
+- 新增 `src/plugin/bootstrap.mjs`：机器用 fleetKey 派生 HMAC 证明请求 relay 列表；响应必须由
+  operator 公钥（pin）对 canonical payload（fleet_id + 排序后的 relays + issued_at + expires_at）
+  验签；过期/错 fleet/被篡改/坏 JSON 全部命名拒绝。缓存每次读取都重验签名与有效期，手改缓存无效。
+  **任何失败都不改现有 relay 配置**，原因写入 `w2m_status.bootstrap.last_error`。
+- `startLocalStack` 接线：无 `relayUrls` 且配置 `bootstrapUrl`+`fleetKey`+operator 公钥时启动即解析
+  （缓存优先，其次网络），成功则采用该 relay 池（首个为 primary）；`w2m_status` 新增
+  `bootstrap {configured, url, source, relays, expires_at, last_error}`。
+- 新增 `bin/w2m-bootstrap.mjs`：一条命令写 `relayUrls`/`fleetKey`/`autoStartAgent` 到 profile patch，
+  只改受管键、写前备份、所有输入先校验；`--temporary` 写 `relayTemporary: true`，面板以
+  **红色“临时 Relay 节点（回退配置）”**显示。
+- 新增 `bin/w2m-bootstrap-sign.mjs`：运维侧用 operator 私钥签名 relay 列表，输出可静态托管。
+- 控制面板 relay 折叠区支持 temporary 红色标记（仅主题 token，无硬编码颜色）。
+- 层模型修复：bootstrap 模块不依赖 chatops 层（layer-check 保持 clean）。
+- 测试：bootstrap 5/5、bootstrap-cli 6/6、fleet-target 49/49、client-bundle 26/26；
+  证据 `docs/acceptance/1.5.2/VERIFIED-BOOTSTRAP.json`（真实 fleet task `01M5ANYMVKXNU8E`）。
+## [1.5.1] — 2026-10-23
+
+**备用链路的身份隔离 + 控制面板的 relay 折叠。**
+
+- `bin/w2m-secondary-link.mjs`：默认给子进程独立身份目录（`<stateDir>/dsh-home`），并同时设置
+  `DSH_HOME` / `USERPROFILE` / `HOME`，可用 `--identity-home` 指定。修复的是 v1.5.0 现场实测的坑：
+  备用链路首次启动覆盖了主链路 `~/.dsh/xclient/device.json`，机器在下一次重启前看不出问题，
+  重启后却会以**备用身份**连到**错误的 relay**。这种"重启后才爆"的坑按默认隔离处理。
+- 控制面板 relay 折叠：`GET /api/w2m/target` 快照新增 `relays`（`relayUrls` 数组优先，兼容单
+  `rabbitUrl`），探测 `/healthz` 后按 RTT 排序、标注 primary/standby/offline；超过 3 个节点时只显示
+  3 个并给出 "+N 折叠" 提示，展开后显示全部（含离线节点，不隐藏故障）。
+- 探针失败保留在列表末尾（`ok:false`），网络异常不会让节点从视图中消失，也不会抛进快照路径。
+- 测试：secondary-link 7/7、fleet-target 49/49（新增 relay pool 四个用例）；门禁 GREEN ×2；
+  证据 `docs/acceptance/1.5.1/IDENTITY-ISOLATION-RELAY-FOLD.json`（真实 fleet task `01M5ANYMVKS3OQZ`）。
+
+## [1.5.0] — 2026-10-23
+
+**多 relay 双通道（active-passive）+ relay 健康看门狗。**
+
+- 新增 `bin/w2m-secondary-link.mjs`：在一台机器上拉一条通往备用 relay 的常在线链接。
+  它监督子进程 `w2m-localside`（同一套协议客户端），子进程退出按指数退避重启并记录每次转换，
+  由 systemd/launchd/计划任务只守护这一层——避免"链接一次启动后静默死掉"的已知失败形态。
+- active-passive 是**路由规则**：两条链接都常连，任务只在主 relay 派发；主 relay 掉线或延迟严重时
+  把同一任务改派到备用 relay（机器已在线，无需重连），正常情况下一台机器只有一个执行者。
+- 新增 `deploy/relay/`：`w2m-watchdog.sh` + systemd `.service/.timer`。每 30s 检查
+  `/healthz` 的 `"ok":true`，连续 2 次失败才重启 relay/stun；每小时最多 5 次重启（避免掩盖根因），
+  日志写 `/var/lib/w2m/watchdog/watchdog.log`。relay 因此独立于"是否有编队成员"保持在线。
+- 新增 `docs/MULTI-RELAY.md`：拓扑、选路规则（健康且 RTT 最低且目标全在线）、relay 互为成员、
+  以及 relay 超过 3 个时客户端折叠显示（`relays: 3 shown · +N online`）的约定。
+- 测试：`test/secondary-link.test.mjs` 6/6（参数校验、child argv、退避重启、日志）；
+  门禁 GREEN ×2；证据 `docs/acceptance/1.5.0/SECONDARY-LINK.json`（真实 fleet task `01M5ANYMVKR311N`）。
+
+## [1.4.4] — 2026-10-23
+
+**relay 重启不再丢失编队归属（devices.json 持久化 fleet_id）。**
+
+- 持久化修复：`devices.json` 快照新增 `fleet_id` / `fleet_source`，`restore()` 同步恢复。
+  在此之前，relay 重启后设备全在、token 仍有效，但每台设备的 fleet 归属全变成 null——
+  编队"静默消失"且没有任何错误可看（本次在共享 relay 上实测复现）。
+- 桥接 getupdates 看门狗：空闲时每 10 分钟输出 `polling ... connection live`；
+  40s 长轮询超时明确记录 `poll timeout after 40s -- reconnecting`；
+  连续 5 分钟没有一次成功轮询则退出（exit 3），由 launchd KeepAlive / systemd Restart= 拉起新连接，
+  避免"进程活着但没人知道它是否还在轮询"的静默状态。
+- 测试：relay 新增 fleet 重启往返用例（pair by fleet_key → 重启 → fleet_id/fleet_source 保留）；
+  bridge 套件 36/36；门禁 GREEN ×2。
+- 证据：docs/acceptance/1.4.4/FLEET-PERSISTENCE.json（真实 fleet task `01M5FLEETPERSIST0000000002`）。
+
+## [1.4.3] — 2026-10-22
+
+**微信编队桥接：回复可靠性修复（不回复/静默问题）。**
+
+- 每条消息独立 try/catch：任何处理异常不再让进程退出，改为回复
+  `处理失败（阶段，错误码）：原因 + /help 提示`（新增 `renderBridgeError`）。
+- 桥接启动调用 `ilink/bot/msg/notifystart`：修复"token 有效、进程在跑、但 iLink 不推送消息"的静默状态；
+  日志记录 `notifystart : ok`，失败也记录原因。
+- 非文本、空消息、未以 `/run` 开头、权限不足、派发失败/超时等路径均保证有回复与下一步提示。
+- 运行方式支持 launchd 常驻（KeepAlive 自动拉起；macOS plist 由运维部署，不进入安装包）。
+
+- **授权优先级修复**：exec-capability 只在任务未携带 grant 时兜底；grant 被拒（replay / 过期 / 机器不符）
+  原样上报，不再被能力分支覆盖成路径匹配错误，`GRANT_REPLAY` 语义恢复。
+
+真机验收（macmini）：`notifystart ok`、错误回复代码在位、launchd state=running、bridge 进程存活；
+证据 `docs/acceptance/1.4.3/BRIDGE-LIVE.json`。测试：chatops-ilink-fleet-bridge 36/36。
+
+## [1.4.2] — 2026-10-22
+
+**Node 代码执行权限成为 UI 可激活的子插件能力（命中真机验收）。**
+
+- 新增 `src/util/exec-capability.mjs`：机器本地能力状态（拒绝 / 临时 24h / 永久），fail-closed；临时档带绝对
+  `expires_at_ms`，过期即拒绝；唯一可放行的前缀固定为 `node -e`。
+- 新增 host 路由 `GET/POST /api/w2m/capability`（`src/plugin/exec-capability-route.mjs`），同源、在 host
+  认证栅栏内；浏览器不接触文件系统或设备 token。
+- client `lib/client.js` 在 `conversation.input.left` 新增第三个控制（order 42）：
+  `Node 执行：拒绝 | 临时 24 小时 | 永久`，带 RCE 风险提示与剩余时间。
+- agent 每个任务前读取能力文件；命中时结果信封 `authorization.provenance = "exec-capability"`，
+  warnings 记录 `EXEC_CAPABILITY`；pipeline 各 stage 同样覆盖。
+
+真机验收（TwinsEarth，插件 1.4.2-beta.1；先清空 `cordis.patch.yml` 的旧 allow-list 以隔离能力路径）：
+- 无能力、空 allow-list：`node --version` → `COMMAND_NOT_ALLOWED`
+- 能力=永久、空 allow-list：`node -e` → **ok**（`node -e` 是唯一被放行的前缀）
+- 能力=临时 5s 到期后：`node -e` → `COMMAND_NOT_ALLOWED`（fail-closed）
+- 证据：`docs/acceptance/1.4.2/CAPABILITY-LIVE.json`
+
+Verified: 单测/路由/客户端契约 43/43；候选 gate GREEN ×2；stable gate 见发布记录。
+
+## [1.4.2-beta.1] — 2026-10-22
+
+**Node 代码执行权限成为 UI 可激活的子插件能力。**
+
+- 新增 `src/util/exec-capability.mjs`：机器本地能力状态（拒绝 / 临时 24h / 永久），fail-closed，
+  临时档带绝对 `expires_at_ms`，过期即拒绝。
+- 新增 host 路由 `GET/POST /api/w2m/capability`（`src/plugin/exec-capability-route.mjs`），同源、在
+  host 认证栅栏内；浏览器不再接触文件系统或设备 token。
+- client `lib/client.js` 在 `conversation.input.left` 座位新增第三个控制（order 42）：
+  `Node 执行：拒绝 | 临时 24 小时 | 永久`，带 RCE 风险提示与剩余时间。
+- agent 每个任务前读取能力文件；命中时结果信封 `authorization.provenance = "exec-capability"`，
+  warnings 记录 `EXEC_CAPABILITY`；pipeline 各 stage 同样覆盖。
+- 文档 `docs/EXEC-CAPABILITY.md`；测试 `test/exec-capability.test.mjs`（7/7）、
+  client-bundle/loader-entry/exec-capability 合计 43/43。
+
+Verified: 单测与路由测试全绿；候选版本真机验收（UI 激活 → agent 下一任务可执行 node -e）。
+
+## [1.4.1] — 2026-10-22
+
+**修复：授权模型在从未 bootstrap 的机器上不可用（真机发现）。**
+
+- relay 的 offer 对 **grant 任务**也携带 `operator_key`（此前只有 maintenance 请求携带）。在空 allow-list 的机器上，
+  agent 首次收到 offer 时据此 TOFU pin；修复前该机器只会得到 `GRANT_NO_PINNED_KEY`，即"显式授权"形同虚设。
+- 任务台账记录 `operator_key`，relay 重启回放恢复 `workspace / grant / grant_summary / maintenance / operator_key`：
+  修复前重启后 re-offer 会丢失授权字段，机器会以错误的理由拒绝任务。
+
+真机验收（relay 1.4.1 候选，TwinsEarth 插件 1.4.0、allow-list 为空）：
+
+- 无 grant 的 `node --version` → `COMMAND_NOT_ALLOWED`
+- operator grant 授权的 `node -e` → **ok**，输出 `{plugin:"1.4.0", pinned:"^1.4.0", node:"v24.21.0"}`
+- relay M1 diag（root runner）→ ok，66,046 bytes
+- 证据：`docs/acceptance/1.4.1/TWIN-GRANT-LIVE.json`、`M1-LIVE-DIAG.json`
+
+Verified: relay TOFU offer 测试 1/1、grant/ledger 相关 3/3；候选部署后真机全部通过。
+
+## [1.4.1-beta.1] — 2026-10-22
+
+**候选：授权模型在"从未 bootstrap 的机器"上可用。**
+
+- relay 的 offer 现在对 **grant 任务**也携带 `operator_key`（此前只有 maintenance 请求携带），首次见到该键的
+  agent 因此可以 TOFU pin；在此之前，空 allow-list 的新机器收到 grant 只会得到 `GRANT_NO_PINNED_KEY`。
+- 任务台账记录 `operator_key`，重启回放恢复 `workspace / grant / grant_summary / maintenance / operator_key`：
+  此前 relay 重启后 re-offer 的任务会丢失授权/工作区字段，机器会以错误的理由拒绝。
+- 真机验证路径：TwinsEarth（allow-list 为空、插件 1.4.0）用 operator grant 执行 `node -e` 读取版本。
+
+Verified: relay TOFU offer 测试 1/1，grant/ledger 相关 3/3；候选部署到 relay 后做真机验收。
+
+## [1.4.0] — 2026-10-22
+
+**稳定版：执行授权、任务、协作三个模型的第一版落地。**
+
+- **执行授权模型**：`bin/w2m-grant.mjs` 签发单次执行授权（绑定 task_id/argv/机器/≤10min TTL/max_uses）；relay 派发预检
+  （`GRANT_TASK_MISMATCH` / `GRANT_ARGV_MISMATCH` / `GRANT_EXPIRED` → 400）；撤销 `POST /v1/grants/revoke`（幂等、
+  ledger 留痕、派发 `403 GRANT_REVOKED`）与审计 `GET /v1/grants`；结果信封携带 `authorization.provenance`
+  （grant/allow-list/maintenance）；使用台账不可写时 `GRANT_LEDGER_UNAVAILABLE` fail-closed。
+- **任务模型**：任务可声明 `workspace {kind:'worktree', base_commit, produce}`；agent 在独立 worktree 中执行、提交、
+  生成相对 base 的 patch 并上传内容寻址 blob，结果携带 `{base_commit, head_commit, changed_files, patch_sha256,
+  patch_bytes, cleaned}`；relay 侧分支 refs（单调、必须声明 from=head）、合并队列（patch sha256 幂等、already_merged）、
+  冲突结果带 conflict_sha256 且绝不推进分支。
+- **协作模型**：项目 room/board/artifact 索引/decisions/project memory/通知（共享对象事件广播 + 每 reader 未读水位）/
+  项目级 SSE（ready + since_seq 补齐 + 实时 project.event）。
+- **M7**：指标注册表与 `/metrics` 接线、证据 schema 与 preflight 第 16 项证据门禁；候选版本可用 candidate line
+  fallback，stable 必须提供本线真机证据。
+
+**发布时真机状态（如实）**：relay 宿主已运行 1.4.0 候选（1.4.0-beta.1，代码与 stable 相同），relay 侧真机回归 10/10
+通过（board/artifacts/decisions/memory/locks/blobs/refs/merge/notifications/项目 SSE）。M1 维护通道的 diag 在换版后
+未能执行：非特权换版路径（fleet node 通道）替换目录后由 kill 触发的重启没有拉起 `w2m-localside`（部署脚本的
+systemctl 被拒绝）；在控制台执行 `systemctl restart w2m-localside` 后即可继续完成 M1 复验与 stable 官方资产部署。
+
+证据：`docs/acceptance/1.4.0/`（REGRESSION-1.4.0.json、M1-LIVE-MAINTENANCE.json）。
+
+## [1.4.0-beta.1] — 2026-10-22
+
+**v1.4.0 三模型候选：执行授权模型落地、任务模型落地、协作模型落地。**
+
+这是把 1.3.12–1.3.14 的 beta 线合成一版的候选，供 stable 前真机验收。
+
+- **执行授权模型（v1.4.0）**：`bin/w2m-grant.mjs` 签发单次执行授权（绑定 task_id/argv/机器/≤10min TTL）；
+  relay 派发预检（`GRANT_TASK_MISMATCH` / `GRANT_ARGV_MISMATCH` / `GRANT_EXPIRED`）；撤销
+  `POST /v1/grants/revoke`（幂等、ledger 留痕、派发 `403 GRANT_REVOKED`）与审计 `GET /v1/grants`；
+  结果信封带 `authorization.provenance`（grant/allow-list/maintenance）；使用台账不可写时
+  `GRANT_LEDGER_UNAVAILABLE` fail-closed（真机发现的 EACCES 崩溃已修）。
+- **任务模型（v1.4.1 前身）**：任务可声明 `workspace {kind:'worktree', base_commit, produce}`；
+  agent 在独立 worktree 执行 → 提交 → 生成相对 base 的 patch → 上传内容寻址 blob → 证据
+  `{base_commit, head_commit, changed_files, patch_sha256, patch_bytes, cleaned}`；
+  relay 侧分支 refs（单调、必须声明 from=head）、合并队列（按 patch sha256 幂等、already_merged）、
+  冲突结果携带 conflict_sha256 且绝不推进分支；refs/merge-queue HTTP 路由。
+- **协作模型（v1.4.2 前身）**：项目 room（成员/角色/快照+增量事件）、board、artifact 索引、
+  decisions（append-only）、project memory（版本文档）、通知（共享对象事件广播 + 每 reader 未读水位）、
+  项目级 SSE（ready + since_seq 补齐 + 实时 project.event + keepalive）。
+
+M7 证据门禁对候选版本增加 candidate line fallback：beta 候选可引用其所基于发布线的真机证据（其产物在机器升级前构建），stable 仍必须提供本线真机证据。
+
+Verified: gate GREEN ×2；relay 测试、agent 测试、workspace/refs/board/notification/SSE 用例全绿。
+
+## [1.3.12-beta.4] — 2026-10-22
+
+**执行授权模型真机修复：使用台账不可写时 fail closed，而不是 crashed。**
+
+在 relay 宿主上实测时发现"授权了但一执行就崩"：维护状态目录 `/var/lib/w2m/maintenance` 由 root 拥有且 0755，agent 以
+非特权用户运行，grant 第一次通过后写 `grant-uses.json` 报 EACCES，异常冒泡成任务 `crashed` —— 授权判定其实已经通过
+（同一 argv 无 grant 时是 `COMMAND_NOT_ALLOWED`），失败发生在记录环节。
+
+- `grant-gate`：台账写入包 try/catch，失败返回 `GRANT_LEDGER_UNAVAILABLE`，不执行"未记录的一次授权"（否则单次授权会变成
+  可重放漏洞），也不再把整个 handler 打崩。
+- `bootstrap.sh`：`$BASE` 改为 `root:w2m 0775`，让默认安装就能写台账；queue 仍 0770、done/claimed 0750。
+- 回归用例：usedFile 指向不可写路径，断言返回该 code 而非抛异常。
+
+真机对比（修复前、relay 宿主）：
+- 无 grant 的 `uname -s` → `refused/COMMAND_NOT_ALLOWED`；
+- 有合法 grant 的同一 argv → 通过 gate，随后因台账 EACCES 报 crashed（本次修复的目标）。
+
+Verified: grant-gate 7/7（含新用例）；gate GREEN twice。
+
+## [1.3.12-beta.3] — 2026-10-22
+
+**执行授权模型收尾：每个结果都说明"是谁授权的"。**
+
+beta.1 让操作员能授权一次执行，beta.2 让授权可撤销、可审计；这一版补上最后一块——结果自身携带授权来源，而不是只能在
+relay 台账里反查。
+
+- 结果信封新增 `authorization` 字段：`{provenance: "grant" | "allow-list" | "maintenance", capability_id?, grant_id?}`。
+  grant 路径带 `grant_id`（可与 ledger 对账），maintenance 路径带 request_id（可与 M1 台账对账），allow-list 路径标记
+  provenance 即可。
+- 一个决定、两个受众：gate 决定"跑不跑"，信封记录"这是哪一种决定"；refused 路径不伪造 provenance。
+- e2e 断言：空 allow-list + 合法 grant 的结果 `authorization.provenance === "grant"` 且带 grant_id。
+- 边界如实写进文档：provenance 是执行机器对自身判定的陈述，relay 存储但不验证它；签名仍由 agent 验证，派发仍由 relay
+  预检，撤销仍由 relay 记账——台账才是权威。
+
+Verified: agent 159/157（含 grant replay e2e 的 provenance 断言）；gate GREEN twice。
+
+## [1.3.12-beta.2] — 2026-10-22
+
+**执行授权模型补完：撤销与操作员审计。**
+
+beta.1 让操作员能"授权某一次执行"；这一版让授权可以被收回、可以被查账，而不是只能等 TTL 过期。
+
+- **撤销**：`POST /v1/grants/revoke`（operator token）`{grant_id, reason?}`。幂等（第二次 `already_revoked: true`），写入
+  ledger `grant.revoked`，带 reason 与操作者。
+- **派发拒绝**：携带已撤销 grant 的任务在 `POST /v1/task` 被拒，`403 GRANT_REVOKED`，机器收不到 offer；revocation 先于
+  argv/task 绑定检查，理由更直接。
+- **审计视图**：`GET /v1/grants`（operator token）返回 `tasks`（task_id / grant_id / argv_hash / key_id / mode / created_at）
+  与 `revoked` 列表；device token 为 401，授权台账不属于机器工作面。
+- **边界**：撤销阻止的是**新派发**；agent 断网时仍会执行已到手 grant 里绑定的那一次（正确性仍取决于 relay 派发，与 M2 §4
+  一致）。撤销后要重新授权必须签发新 grant_id。
+
+Verified: grant 13/13；grant-issue 3/3；relay 191/191（新增撤销+审计用例）；gate GREEN twice。
+
+## [1.3.12-beta.1] — 2026-10-22
+
+**执行授权模型：静态 allow-list 之外，操作员可以显式授权某一次执行。**
+
+在此之前授权只有一层：机器本地配置的 allow-list，一个长期决定，没有"就这一次"的途径。这一版把 M2 grant 补成一条可用的
+路径——签发、派发、验证、审计——而不是一个只在测试里存在的协议。
+
+- **`bin/w2m-grant.mjs`**：操作员签发一条 grant。绑定一个 task_id（必须先确定）、一个 argv、若干 machine_id、≤10 分钟 TTL
+  和 max_uses（默认 1）；stdout 输出可直接放进 `POST /v1/task` 的 `grant` 字段，stderr 打印 task_id/argv_hash/expires_at。
+  该 CLI 同时登记为 package bin `w2m-grant`。
+- **relay 派发预检**：task_id 不符 → `GRANT_TASK_MISMATCH`，argv_hash 不符 → `GRANT_ARGV_MISMATCH`，已过期 →
+  `GRANT_EXPIRED`，都是 HTTP 400 的调用方错误；relay 不替 agent 做授权裁决。
+- **审计**：task summary 增加 `argv_hash` 与 `grant_key_id`（`grant_id` 已有），让"谁授权了哪条命令"可查。
+- **agent 仍是验证者**：签名、任务/机器绑定、argv、TTL、max_uses、重放（`GRANT_REPLAY`）由机器本地用 pin 的操作员公钥判定；
+  空 allow-list + 合法 grant 执行，无 grant 仍 `COMMAND_NOT_ALLOWED`（既有 e2e 覆盖）。
+- **文档**：`docs/COLLAB/EXECUTION-AUTH-MODEL.md` 状态改为已实现，补上"取 task_id → 签发 → 携带派发 → 两处检查 → 审计字段"
+  的完整路径和仍然不做的边界（无长期委托、无自动签发、无跨项目授权）。
+
+Verified: grant-issue 3/3（真实 CLI 子进程签发并用签名载荷验证）；grant 13/13；relay 190/190（新增派发预检用例）；gate GREEN twice。
+
+## [1.3.11] — 2026-10-22
+
+**Stable release: the collaboration stack's first seven modules, with the gate that measures them.**
+
+This is the first stable since 1.3.9 (docs) that ships runtime work, and the first beta line to end with its acceptance evidence
+enforced by the pre-flight rather than stored beside it. What is in it, by module:
+
+- **M1 maintenance channel** (live on the relay host): signed update/restart/diag requests, operator-key pinning, a root runner and
+  a bootstrap for Linux/Windows. Accepted on the real machine: diag (9 sections / 62 KB), relay restart with a new relay_id and
+  the result delivered after it, update to 1.3.10-beta.10 (download + sha256 + atomic swap), and a post-update diag. Evidence:
+  docs/acceptance/1.3.10-beta.10/.
+- **M2 grants**: single-use, task-bound Ed25519 grants with argv hash, TTL, use ledger and named refusals; e2e covers an empty
+  allow-list succeeding under a grant, replay, argv tampering and the no-grant refusal.
+- **M3 Git-native tasks**: isolated worktrees at the caller's base commit, a content-addressed patch artifact contract, a merge
+  queue with merge-slot serialisation, strict/replay policies, already_merged and a structured conflict artifact. Module-level,
+  24 tests across the three slices plus two composed workflow tests.
+- **M4 project room**: project objects, membership roles, a deny-by-default action matrix, snapshot + incremental events, task
+  attribution (implicit default project, explicit projects refused when unknown), and the /v1/projects routes.
+- **M5 multi-client primitives**: branch/file locks (leases, renewal, owner force-release, merge preflight conflicts), reviews
+  (self-review guard, duplicate-verdict refusal, approval gate by patch sha) and notifications (dedupe, digest, per-reader
+  watermarks, retention), with the lock routes live and their events projected into the project stream.
+- **M6 cross-network reliability**: chunked, resumable blob uploads with verified commits, Range downloads, and an agent result
+  outbox (atomic, persisted exponential backoff, cross-restart recovery, bounded).
+- **M7 metrics and acceptance**: a 39-metric contract with a cardinality guard, live on /metrics; a validator for acceptance
+  evidence; and the pre-flight's 16th check, which fails a release whose evidence does not validate or whose release line has no
+  record.
+
+Verified: pre-flight GREEN twice (16/16 checks, 2828 tests: 2814 pass, 0 fail, 14 skip); beta line beta.1 through beta.25 shipped on
+GitHub prereleases only.
+
+Known limitations, stated rather than implied: the merge queue and the review/notification routes are not wired into the task path
+yet; a request that restarts the agent itself loses the ferry result (relay restarts are fine); M4 role checks cover the lock routes
+and reads, not every future write; the relay runs beta.10 and is upgraded separately from this tag.
+
+## [1.3.10-beta.25] — 2026-10-22
+
+**M7 final core slice: acceptance evidence is a gate, not a folder.**
+
+The pre-flight grew its 16th check. `acceptance evidence (every committed record validates, and the release line has one)`
+does three things a file list cannot:
+
+1. every JSON record under `docs/acceptance/` is validated with the M7 schema (`src/acceptance/evidence.mjs`) — a record that
+   does not say which machine ran it, when, by whom and under which task id fails the gate;
+2. the current release line must have at least one record: shipping a beta that claims an accepted capability while pointing at
+   no evidence from its own `1.3.x` line is RED;
+3. it reports what it read ("4 acceptance record(s) validated; 4 for the 1.3.10 line"), so a green row is a statement about a
+   specific set of records rather than about an empty directory.
+
+The check is bound to `docs/acceptance` in `GATE_INVENTORY`, so deleting the directory or the check breaks the inventory's
+both-directions rule; the evidence validator's accepted-orphan entry is removed now that the gate imports it.
+
+Not claimed: this gate proves the records are well-formed and current, not that the described runs happened — that is what the
+task id, the machine ids and the executor field are for, and they are now mandatory.
+
+Verified: gate GREEN twice with 16/16 registered checks; the evidence check passes on the four M1 records.
+
+## [1.3.10-beta.24] — 2026-10-22
+
+**M7 second slice: acceptance evidence has a schema, and the committed evidence is validated against it.**
+
+- `src/acceptance/evidence.mjs` validates every required field of the M7 evidence record: version, uppercase case id, kind
+  (positive/negative/chaos), requirement, at least one machine, ISO `executed_at`, executor (lead/human/agent), a result with a
+  verdict, and — for a positive case — the real `task_id`. Optional fields are validated when present: argv arrays,
+  `[from, to]` ledger ranges, `{sha256, bytes}` artifacts and an assertions object. Every problem is returned at once, because a
+  release check should list what to fix rather than one field per run.
+- `summarizeEvidence()` counts valid records by kind and version and names the invalid ones, which is what a release note or a
+  gate summary reads.
+- The test suite validates the **actual committed files** under `docs/acceptance/` — a schema that rejected the project's own
+  evidence would be a schema written for a fictional project. It also pins that both the flat `result.outcome` and the nested
+  `result.task.outcome` (the live restart record) are accepted as the same fact.
+
+Registered as an accepted library with its exit named (the preflight evidence gate).
+
+Still to wire for M7: the preflight check that a release's evidence exists and validates, and the remaining instrumentation.
+
+Verified: evidence 6/6; gate GREEN twice.
+
+## [1.3.10-beta.23] — 2026-10-22
+
+**M7 wiring: the registry is live on /metrics.**
+
+- Relay state owns the M7 registry. The project room now notifies a listener per event, and that callback counts
+  `wm_project_events_total{type}` once for both the room's own events (project created, member changes, task linked) and the
+  lock/review/notification events projected into it — a projection is appended, then counted through the room hook, so it cannot
+  be double-counted.
+- `GET /metrics` appends the registry body under a `# reliability registry` marker. A relay that never records into the registry
+  renders exactly what it rendered before, which is why the existing exposition tests still pass unchanged.
+- Lock routes count `wm_lock_acquired_total{kind}` and `wm_lock_conflict_total{kind}`.
+- One route test: after creating a project and acquiring a branch lock, `/metrics` carries
+  `wm_project_events_total{type="project.created"}` and `wm_lock_acquired_total{kind="branch"}`.
+
+Verified: relay 189/189 (one new test); the registry and room suites are unchanged; gate GREEN twice.
+
+## [1.3.10-beta.22] — 2026-10-22
+
+**M7 first slice: one metrics contract for the whole collaboration stack.** A local module and eight tests; the relay /metrics
+route and the call sites do not record into it yet.
+
+- `src/relay/reliability-metrics.mjs` declares every M7 metric name, its type and the labels it may carry — 39 definitions across tasks,
+  authorization, data plane, collaboration and transport. An undeclared name, an undeclared label, or a high-cardinality label
+  (`task_id`, `dedupe_key`, ids) is refused at record time, so a metrics endpoint cannot silently become a memory leak.
+- Counters refuse decrements; gauges hold the last value; histograms keep cumulative buckets plus sum/count. `renderPrometheus()`
+  emits `_bucket/_sum/_count` with sorted, escaped label values, and `snapshot()` gives the same data as plain JSON for the panel.
+- Eight tests: label aggregation, undeclared metric/label refusal, wrong-type and decrement refusal, gauge semantics, cumulative
+  buckets, Prometheus text (including `+Inf`), label escaping, and the contract's own shape.
+
+Registered as an accepted library with its exit named (the /metrics route and instrumentation). Note on the name: the exposition module was already called metrics.mjs, so after a naming collision during this work its file and test were restored, and this registry ships as reliability-metrics.mjs; both test files pass.
+
+Still to wire for M7: the /metrics route, the instrumentation call sites, the acceptance-evidence validator and the preflight
+evidence check.
+
+Verified: metrics 8/8; gate GREEN twice.
+
+## [1.3.10-beta.21] — 2026-10-22
+
+**M6 second slice: the agent result outbox.** A local module and eight tests; the agent delivery path still uses the existing
+spool and has not switched to it yet.
+
+- `src/agent/outbox.mjs` — a result is written to disk (temp + rename, so a crash leaves either the old state or the complete
+  entry) before any network attempt, keyed by `(task_id, attempt)` so a retried handler is one entry. Delivery removes the entry
+  only after the relay acknowledged it; the relay's own dedupe makes a re-delivery safe when that acknowledgement was lost.
+- Retries use exponential backoff persisted with the entry (`1s, 2s, 4s …` capped at 60s), so closing the laptop for an hour is
+  a resume rather than a restart. Past `max_attempts` the entry moves to `dead/` and is reported as exhausted.
+- Limits: 200 entries / 16 MiB; beyond that the oldest entries are dropped and the caller sees `outbox_full: true`
+  (`OUTBOX_FULL` in the changelog's words) rather than a silent disk fill. A single oversize result is refused.
+- Eight tests: atomic persist + depth, duplicate enqueue, restart recovery with attempt counts, backoff growth and exhaustion,
+  ack-only removal, count-limit drop keeping the newest, corrupt-file quarantine, oversize refusal.
+
+Registered as an accepted library with its exit named (the agent delivery switch).
+
+Still to wire for M6: the agent's upload/download decision for large artifacts, and P2P as acceleration-only with metrics.
+
+Verified: outbox 8/8; gate GREEN twice.
+
+## [1.3.10-beta.20] — 2026-10-22
+
+**M6 wiring: chunk session and Range routes.** Large artifacts now travel over HTTP without restarting from zero.
+
+- `POST /v1/fleet/blob-sessions` declares `{sha256, size, chunk_bytes?}`; `PUT …/:sid/chunks/:index` uploads one idempotent chunk
+  (octet-stream); `GET …/:sid` returns received/missing so an interrupted upload resumes; `POST …/:sid/commit` verifies the
+  assembled sha256 and, on success, stores the bytes through the existing content-addressed blob store. A missing chunk answers
+  `409 BLOB_INCOMPLETE` with the indices; a mismatch deletes the session and creates nothing.
+- `GET /v1/fleet/blobs/:sha?range=start-end` answers `206` with `Content-Range`, so a client can fetch a large patch (or a conflict
+  artifact) in slices instead of one allocation.
+- The blob-session module's responses are now uniformly `{ok, session: {...}}`, which the routes and the original tests share.
+
+Two HTTP tests: a chunked upload that commits and is then read whole plus as a Range, and an incomplete commit naming `[0,1]`.
+
+Still to wire for M6: the agent result outbox, and P2P as acceleration-only with its observable success rate.
+
+Verified: blob-sessions 9/9, relay 188/188 (2 new route tests); gate GREEN twice.
+
+## [1.3.10-beta.19] — 2026-10-22
+
+**M6 first slice: large artifacts can be uploaded in resumable chunks.** A local module and nine tests; the routes and the
+agent upload path are the wiring slice after it.
+
+- `src/relay/blob-sessions.mjs` — a client declares the final `sha256` and `size` once, then uploads chunks in any order
+  (each index idempotent), asks what is missing, and commits. Only a commit whose assembled bytes hash to the declared sha256
+  becomes a blob; a mismatch deletes the session and returns `BLOB_SHA_MISMATCH`, so nothing can be referenced that does not
+  exist.
+- Limits follow the spec: default 1 MiB chunks, `≤8 MiB` per chunk, `≤256` chunks and `≤64 MiB` per blob, two open sessions and
+  512 MiB unfinished bytes per machine, 24h session TTL. A resume after a disconnect is `status()` plus the missing indices,
+  which is exactly the "don't restart a 40 MiB patch" property.
+- Nine tests: plan/status, out-of-order + idempotent chunks, verified commit through the store hook, incomplete commit naming
+  the missing chunks, sha mismatch deleting the session, chunk length/size refusals, quotas, TTL expiry, and blob/chunk ceilings.
+
+Registered as an accepted library with its exit named (the blob-session routes + agent upload).
+
+Still to wire for M6: the HTTP chunk routes and Range downloads, the agent outbox for offline results, and P2P as acceleration
+only.
+
+Verified: blob-sessions 9/9; gate GREEN twice.
+
+## [1.3.10-beta.18] — 2026-10-22
+
+**M5 wiring, part 1: lock routes and one event stream for the primitives.**
+
+- Relay state now owns the three M5 primitives (locks, reviews, notifications) and projects their events into the project room
+  stream with the module sequence attached, so a client can reconstruct "what happened" from one cursor instead of three.
+- `/v1/projects/:id/locks`: `GET` list, `POST` acquire, `POST …/:lock_id/renew`, `DELETE …/:lock_id` (holder release), and
+  `DELETE …?force=1&reason=…` (owner only). A conflict is an answer, not a transport error: `409` with the holder and expiry, so a
+  client can show who is editing instead of parsing a failure. Role checks sit on M4 membership (default project treats a paired
+  machine as worker); a non-member receives `404` and learns nothing about the project.
+- Two route tests: acquire/list/conflict/foreign-release/ordered-release, plus non-member `404` and `LOCK_FORCE_DENIED` for a
+  worker trying to force release.
+
+Still to wire: review and notification routes, the merge/review gate, and the panel views.
+
+Verified: relay 186/186 (2 new lock route tests); gate GREEN twice.
+
+## [1.3.10-beta.17] — 2026-10-22
+
+**M5 third primitive: notifications.** A local module and eight tests; no routes or SSE projection use it yet.
+
+- `src/relay/project-notifications.mjs` — notifications for a project addressed to a member or broadcast, each with kind,
+  subject, refs and `requires_action`. Every row is also a `notification.created` event for the live stream, and the list route
+  is the catch-up path.
+- Semantics pinned by tests: the same (kind, primary ref, target) inside 60s is one row; different refs/kinds are distinct;
+  overflow beyond 120 per minute collapses into one digest row that carries the count; unread is counted after a per-reader
+  watermark; a watermark never moves backwards; paging is `since_ms` + limit; retention drops rows older than 7 days (or beyond
+  2000 per project).
+- The reader is a member identity (machine or operator), not a transport: an offline client reconnects and reads the same
+  watermark it left.
+
+Registered as an accepted library with its exit named (the notification routes).
+
+M5 primitives are now all designed-and-implemented at module level: locks (beta.15), reviews (beta.16), notifications (beta.17).
+Still missing for M5: the routes, the merge/ref gates using them, and the panel views.
+
+Verified: project-notifications 8/8; gate GREEN twice.
+
+## [1.3.10-beta.16] — 2026-10-22
+
+**M5 second primitive: review tasks.** A local module and ten tests; the review routes and the merge gate do not call it yet.
+
+- `src/relay/project-reviews.mjs` — a review points at a content-addressed `{kind, sha256, source_task_id, diffstat}` target and
+  collects decisions from listed reviewers. Verdicts are records, not a mutable flag: `approve`/`changes_requested`/`comment`
+  accumulate, approvals are counted per distinct reviewer, and reaching `required_approvals` moves the review to `approved`.
+- Safety rules the tests pin: self-review is refused unless an owner overrides it (and the override is its own event); reviewers
+  must be maintainer/owner; only listed reviewers may decide; a reviewer cannot record the same verdict twice; a
+  `changes_requested` closes the round and refuses a later approve; a due date expires a pending review and late decisions are
+  refused; `approvedFor(project, sha256)` answers the merge gate for an exact patch.
+- Every state change is emitted as an event (`review.requested/decided/approved/changes_requested/expired/self_review_override`).
+
+Registered as an accepted library with its exit named (the review routes + merge-requires-review gate).
+
+Not in this slice: notifications (§4), the third M5 primitive.
+
+Verified: project-reviews 10/10; gate GREEN twice.
+
+## [1.3.10-beta.15] — 2026-10-22
+
+**M5 first primitive: branch and file locks.** A local module and eight tests; no routes or merge preflight call it yet.
+
+- `src/relay/project-locks.mjs` — one exclusive holder per `(project, branch)` or `(project, path)`, leases with renewal, lazy
+  expiry that frees the target and records `lock.expired`, owner-only force release with a mandatory reason recorded as
+  `lock.force_released`, per-project/per-holder limits (20/10), and a `conflicts()` preflight that answers which live locks cover a
+  branch or a set of paths.
+- Every mutation is returned as an event (`lock.acquired/renewed/released/expired/force_released`) so the project stream can carry
+  it; the module holds no relay state and takes the clock as an injection.
+- Eight tests: acquire/list/release, LOCK_HELD naming the holder, expired re-entry with both events, renew ownership and
+  non-revival, force-release permission and reason, limits, preflight conflicts for branch and paths, and malformed-input refusal.
+
+Registered as an accepted library with its exit named (the lock routes and the merge preflight check).
+
+Not in this slice: review tasks (§3) and notifications (§4), which are the next two M5 primitives.
+
+Verified: project-locks 8/8; gate GREEN twice.
+
+## [1.3.10-beta.14] — 2026-10-22
+
+**M4 third slice: the `/v1/projects` routes.**
+
+- `GET /v1/projects` — the default project plus the projects this machine is a member of (device token).
+- `GET /v1/projects/:id` — snapshot with `last_event_seq`; a machine that is not a member gets `NOT_FOUND`, so a project's
+  existence is not leaked. The default project stays readable for any paired machine because it is the implicit home of unnamed
+  tasks.
+- `GET /v1/projects/:id/events?since_seq=N` — the incremental slice and `next_seq`, so a client can resume after a disconnect.
+- `POST /v1/projects` and `POST /v1/projects/:id/members` — operator token only (the dispatch credential), because these change
+  who may act on shared state; the body's initial `members` array is seeded atomically with the project.
+- The routes authenticate per method and therefore sit above the shared device guard: an operator token is not a device token,
+  and the earlier placement made every write answer `UNAUTHORIZED`.
+- Three HTTP tests: list/create/snapshot/events with a member, a non-member seeing `NOT_FOUND`, the operator requirement, and an
+  unknown project answering `NOT_FOUND`.
+
+Still missing: artifact/memory/decision mounts, the panel view, and multi-client e2e.
+
+Verified: relay 184/184 (3 new route tests); gate GREEN twice.
+
+## [1.3.10-beta.13] — 2026-10-22
+
+**M4 second slice: tasks belong to a project, and the room records it.** Relay state now owns a project room; no HTTP routes yet.
+
+- `POST /v1/task` (internal `createTask`) accepts an optional `project_id`. Unnamed tasks land in the implicit `default`
+  project, which is created lazily on first use; an explicit unknown project is refused with `BAD_REQUEST` rather than being
+  created silently.
+- The project room records a `task.linked` event for every task, so a snapshot's `last_event_seq` moves with the work and a
+  second client can apply it as an incremental event.
+- State exposes `projectSnapshot(projectId)` and `projectEvents(projectId, {sinceSeq})`; the task summary carries
+  `project_id`; the replay path restores it from the ledger.
+- Three attribution tests: implicit default + linked event consistency, explicit project visible on the summary, and an unknown
+  project refused without creating one.
+
+Still missing, stated: the `/v1/projects` HTTP routes, artefact/memory/decision mounts, the panel view, and multi-client e2e.
+
+Verified: project-attribution 3/3, project-room 8/8, relay 181/181; gate GREEN twice.
+
+## [1.3.10-beta.12] — 2026-10-22
+
+**M4 first slice: the project room object.** A local module and eight tests; the relay routes and the panel do not call it yet.
+
+- `src/relay/project-room.mjs` — a project aggregate (project id, name, origin, settings, members), the four roles
+  (owner/maintainer/worker/observer), a deny-by-default action matrix (`read/dispatch/artifact/lock/memory/decide/merge/
+  settings/members`), member add/remove/role-change as recorded events, a snapshot carrying `last_event_seq`, incremental
+  events since a sequence, and per-member project listing.
+- Safety rules the tests pin: the last owner cannot be removed; a duplicate member is refused by name; an unknown project is
+  refused rather than creating an empty one; the permission check returns the required and current role rather than a bare
+  false; a role change records `{from,to}`.
+
+Registered as an accepted library with its exit named (the `/v1/projects` routes and the room panel), because nothing reaches it
+yet.
+
+Also in this tree since beta.11: the M1 live-acceptance evidence files under `docs/acceptance/1.3.10-beta.10/`.
+
+Verified: project-room 8/8; gate GREEN twice.
+
+## [1.3.10-beta.11] — 2026-10-22
+
+**M1 update path fixed and the full acceptance set recorded.**
+
+The live update acceptance exposed two defects that made `update` unusable even though diag and restart already worked:
+
+1. **EXDEV on swap** — staging unpacked under `/tmp` (often tmpfs) and the swap is a rename into `/opt/w2m/app`, so the kernel
+   refused with `EXDEV: cross-device link`. Staging now lives on the same filesystem as the app directory
+   (`/opt/w2m/.maintenance-staging`).
+2. **Ferry reported success for a failed action** — the ferry returning a result file only means the runner wrote one; the
+   runner's own `status` was not inspected, so a failed update was reported as `ok`. The agent now reports
+   `MAINTENANCE_FAILED` with the runner's code, and a test covers the shape.
+
+Acceptance evidence now in the tree:
+- `docs/acceptance/1.3.10-beta.10/M1-LIVE-DIAG.json` (9 sections, 62,238 bytes, runner ok)
+- `M1-LIVE-RESTART.json` (relay restarted, new relay_id, result delivered)
+- `M1-LIVE-UPDATE.json` (download + sha256 + swap to 1.3.10-beta.10, no auto-restart)
+- `M1-LIVE-POSTUPDATE-DIAG.json` (after update + restart, a new diag still returns 59,581 bytes)
+
+Known limitation unchanged and documented: a request restarting the agent itself kills the ferry before it reads the result
+file, so the accepted restart target is the relay; delayed restart is the next fix.
+
+Verified: gate GREEN twice; actions/ferry unit tests pass.
+
+## [1.3.10-beta.10] — 2026-10-22
+
+**M1 live acceptance: the maintenance channel works end to end on a real machine.**
+
+The relay host (jp-shared) was bootstrapped and two signed requests were executed by the root runner:
+
+- **diag** — the runner produced 9 sections (version/services/journal/disk/ports), the agent returned the task as `ok` with
+  62,238 bytes of result, and the runner's own result file confirms `status: ok`. Evidence:
+  `docs/acceptance/1.3.10-beta.10/M1-LIVE-DIAG.json`.
+- **restart (rabbit)** — the relay was restarted by the runner, the agent survived it and delivered the task result, and the
+  relay came back with a new `relay_id` and a fresh uptime. Evidence:
+  `docs/acceptance/1.3.10-beta.10/M1-LIVE-RESTART.json`.
+
+The run found four real defects, all fixed here:
+
+1. The agent's envelope builder hashes and sizes the output; the maintenance ferry passed an execution object without
+   `stdout_sha256/stdout_bytes/stderr_sha256/stderr_bytes`, so every maintenance task ended as `crashed` **after** the action had
+   already run. The ferry now fills them.
+2. `--operator-key` without `--operator-key-id` claimed an empty key id, which the pin store correctly refused as a mismatch;
+   an absent id now means "trust the key that arrives".
+3. `bootstrap.sh` made the queue root-only, so the unprivileged agent could never enqueue a request; the queue is now
+   `root:w2m 0770` (write but not execute) and `done` is `root:w2m 0750`.
+4. Known limitation, documented rather than hidden: a request that restarts **the agent itself** kills the process still waiting
+   for its result file, so that result is lost (the action still runs). Restarting the relay is unaffected, which is why the
+   accepted case uses that target; the delayed-restart fix is next.
+
+Also verified: gate GREEN twice; the local agent suite still passes with the ferry envelope fix.
+
+## [1.3.10-beta.9] — 2026-10-22
+
+**M3 conflict contract completed: MERGE_CONFLICT now carries the conflict itself.**
+
+When `git apply --3way` cannot apply a patch, the queue previously reported the changed files and the git message. It now also
+captures the state git left in the merge worktree (conflict markers included) as a `conflictArtifact`:
+`{ sha256, bytes, text }`. That is the evidence a reviewer needs to decide whether to resubmit against the new base or resolve
+by hand, and it is the same content-addressed shape the patch artifacts use.
+
+The head still does not move on a conflict; the test asserts both the artifact (with conflict markers) and the unchanged head,
+and the composed M3 workflow test still passes.
+
+Verified: merge-queue 7/7 (conflict artifact assertion included), m3-workflow 2/2; gate GREEN twice.
+
+## [1.3.10-beta.8] — 2026-10-22
+
+**M3 composed: worktree -> patch -> merge queue, proven together.**
+
+Two integration tests drive the three modules the way a real task pair would: both tasks start from the same base in isolated
+worktrees, each commits its change and produces a patch artifact, and the queue merges them one after the other. The disjoint
+case ends with both files changed and the branch advanced to the second merge; the same-file case ends with a structured
+MERGE_CONFLICT listing the file, the head still on the first approved commit, and the first task's change intact.
+
+No runtime wiring yet: the agent's task handler does not create worktrees, and the relay does not run the queue. This release
+records that the modules agree with each other before either becomes reachable, which is the point of composing them now.
+
+M1 real-machine acceptance remains pending: the relay host agent is offline and root SSH authentication is refused, so the
+privileged bootstrap has not run.
+
+Verified: m3-workflow 2/2, merge-queue 7/7, worktree 5/5, patch-artifact 5/5; gate GREEN twice.
+
+## [1.3.10-beta.7] — 2026-10-22
+
+**M3 third block: the merge queue.** A local module and seven real-git tests; the relay task path does not import it yet.
+
+- `src/relay/merge-queue.mjs` — one queue per project+branch with a single merge slot (holder + TTL), items named by the
+  patch sha256, `strict` and `replay` base policies, and terminal verdicts: MERGED (branch head advances), `already_merged`
+  for a repeat submission, `BASE_MISMATCH` under strict, and a structured `MERGE_CONFLICT` with the changed files that never
+  advances the head.
+- Application happens in a detached throwaway worktree, then the repository's branch and working tree are moved to the new
+  commit — a merge that committed only in the worktree would leave the next reviewer looking at a head that never moved.
+- Seven tests cover merge-and-advance, idempotent re-submission, stale base, conflict (head unchanged), replay onto a moved
+  head, merge-slot serialisation, and patch naming.
+
+Registered as an accepted library with its exit named (the relay merge executor dispatch), because nothing reaches it yet.
+
+Still pending, unchanged: the M1 real-machine acceptance (relay runs beta.5 and carries the maintenance field live, but the
+relay host's agent is offline and root SSH authentication has not been restored), and the M2/M3 live runs.
+
+Verified: merge-queue 7/7; the rest of the suite is unchanged; gate GREEN twice.
+
+## [1.3.10-beta.6] — 2026-10-21
+
+**M3 first two blocks: isolated worktrees and a patch artifact contract. Plus the grant replay e2e.**
+
+- `src/agent/worktree.mjs` — one git worktree per task, created detached at the caller's `base_commit`; hooks disabled,
+  commit identity fixed, a porcelain snapshot before and after, commit-if-changed, `format-patch` relative to the base, and
+  a removal that reports failure instead of leaking a directory. Unknown base commit and missing repository are named refusals.
+- `src/agent/patch-artifact.mjs` — the transportable result: sha256 over the patch bytes, byte count, base/head commits,
+  sorted changed files, inline/blob mode, and `no_change` as a successful outcome for an empty patch. Non-ASCII patches are
+  measured in UTF-8 bytes, not characters.
+- Five real-git tests for the worktree lifecycle and five for the artifact contract.
+- `test/agent.test.mjs` gains the grant **replay** e2e: the same signed grant is used twice, the first run executes, the second
+  is refused with `GRANT_REPLAY` — the use ledger is what makes "single-use" true across processes.
+
+Not in this slice (stated, not implied): the merge queue itself (strict/replay bases, merge-slot serialization,
+`MERGE_CONFLICT`), review tasks and locks (M5), and the project room (M4). The M1 real-machine acceptance is also still pending:
+the relay was upgraded to beta.5 and the maintenance field is verified live, but the relay host's agent is offline and root SSH
+authentication is refused, so the privileged bootstrap has not run.
+
+Verified: agent 159/157 (replay e2e included), relay 181/181, grant 10/10, grant-gate 6/6, maintenance 17/17, ferry 4/4,
+worktree 5/5, patch-artifact 5/5, layer-model 24/24, claims 47/47; gate GREEN twice.
+
+## [1.3.10-beta.5] — 2026-10-21
+
+**M2 grant e2e: the explicit-authorisation path is proven end to end.**
+
+Four fake-relay tests now drive the real agent process:
+
+- an empty allow-list executes a command **only** because a valid grant authorises that exact argv (the envelope is `ok` and
+  the stdout hash matches);
+- the same command with no grant is still `COMMAND_NOT_ALLOWED`;
+- a grant that signed a different argv is refused with `GRANT_ARGV_MISMATCH`;
+- a grant that names another machine is refused with `GRANT_WRONG_MACHINE`.
+
+Two integration defects the e2e exposed, both fixed: the per-stage allow-list re-check ran again after step 5, so a grant that
+had authorised the task was refused at the stage boundary; and the matcher's result carries `allowed` (not `ok`), so both the
+gate result and the stage override had to use that shape or the refusal fell back to `COMMAND_NOT_ALLOWED`.
+
+Verified: agent 158/156 (4 new e2e cases), relay 181/181, grant 10/10, grant-gate 6/6, maintenance 17/17, ferry 4/4,
+layer-model 24/24, claims 47/47; gate GREEN twice.
+
+## [1.3.10-beta.4] — 2026-10-21
+
+**M1 bootstrap tooling: one privileged step, then the channel is remote.** No runtime behaviour changes.
+
+- `deploy/maintenance/bootstrap.sh` (Linux, run once as root) — installs the fixed-action path unit/service, creates the
+  queue/done/claimed directories with root ownership, optionally pins the operator public key, and enables the watcher. It
+  refuses to run without `--machine-id` and refuses a tree where `bin/w2m-maintenance.mjs` is absent.
+- `deploy/maintenance/bootstrap.ps1` (Windows, run once as Administrator) — same shape via a SYSTEM scheduled task; it
+  substitutes the app directory and machine id into the task XML rather than editing the shipped file.
+- `docs/COLLAB/M1-ACCEPTANCE-RUNBOOK.md` — the real-machine acceptance cases (diag/restart/update/rollback plus four named
+  refusals), what "green" means, and the limitations that must appear in the release note (privileged bootstrap, TOFU pinning,
+  no automatic recovery if a restarted machine cannot be reached).
+
+Both scripts install **only** the fixed update/restart/diag runner; neither installs a shell, and neither touches the
+allow-list. The design's security boundary is unchanged: the agent ferries a signed request, the root runner decides.
+
+Honest gap, unchanged: the M1 real-machine acceptance run itself still needs a machine with a privileged bootstrap and a
+relay carrying the maintenance fields; and the M2 grant path still lacks a fake-relay e2e case. Both are next.
+
+Verified: gate GREEN twice; pack carries the new scripts and document.
+
+## [1.3.10-beta.3] — 2026-10-21
+
+**M2 first slice: task-level grants become the explicit authorisation channel.** Design: `docs/COLLAB/M2-TASK-GRANT.md`.
+
+- `src/maintenance/grant.mjs` — grant protocol: task binding, named machine ids, argv hash + expanded argv for the operator
+  to read, max uses, TTL capped at 10 minutes, nonce, and constraint fields that may only tighten the task (mode/cwd/write/
+  write_scope). Verification has a named refusal for every distinct failure: wrong machine, wrong task, argv mismatch,
+  expired, future, TTL too long, replay, uses exhausted, revoked key, unknown key, bad signature, constraint widening.
+- `src/agent/grant-gate.mjs` — the agent-side gate: pins the operator key on first sight, verifies the grant against the
+  concrete argv, and persists use counts so a spent grant stays spent across restarts. A corrupt use ledger is never read as
+  "nothing used yet".
+- The agent asks the grant gate **before** falling through to the allow-list refusal, and reports a grant refusal with its own
+  `GRANT_*` code instead of folding it into `COMMAND_NOT_ALLOWED`.
+- The relay accepts an optional `grant` on `POST /v1/task` (8 KiB cap, `grant_id` + 64-hex `argv_hash` checked), carries it on
+  the offer, writes `grant_summary` into the ledger and exposes `grant_id` on the task summary.
+
+Honest gap: the grant path has unit coverage (protocol 10, gate 6) and the existing agent/relay suites are unchanged-green,
+but there is no fake-relay e2e yet for "empty allow-list executes under a grant". That case and the real two-machine run land
+in the next slice together with the M2 acceptance evidence.
+
+Verified: agent 154/152, relay 181/181, grant 10/10, grant-gate 6/6, maintenance 17/17, ferry 4/4, layer-model 24/24; gate
+GREEN twice.
+
+## [1.3.10-beta.2] — 2026-10-21
+
+**M1 maintenance channel: relay passthrough + agent ferry.** The remote loop now has both ends.
+
+- The relay accepts an optional `maintenance` request and `operator_key` on `POST /v1/task` (operator token already required),
+  registers the key once (`operator.key.registered` in the ledger, replayed on restart), carries the request on the offer, and
+  exposes `maintenance_request_id` on the task summary.
+- `src/agent/maintenance-ferry.mjs` — the agent pins the operator key on first sight (TOFU, rotation chain thereafter), verifies
+  the request against the pin, writes it atomically into the queue the root runner watches, waits for the runner's result file,
+  and reports it as the task result. A refusal is a named value (`MAINTENANCE_NO_PINNED_KEY`, `MAINTENANCE_BAD_SIGNATURE`,
+  `MAINTENANCE_RUNNER_TIMEOUT`, ...), never a thrown error, so the task result says why.
+- The agent never gains the privilege to run update/restart/diag: the root runner (beta.1) remains the only executor.
+- Layer model declares `maintenance` as a capability layer with an `agent -> maintenance` edge, so the new dependency is
+  explained rather than excused.
+
+Known gap, stated: no fake-runner agent-e2e test for the ferry yet (the ferry's own four cases cover pin/verify/queue/refusal);
+the end-to-end case lands with the real-machine acceptance run in beta.3.
+
+Verified: gate GREEN twice with the bundled node on PATH: 2731 tests / 2717 pass / 0 fail / 14 skip in 135 files
+(agent 154/152, relay 181/181, maintenance 17/17, ferry 4/4, layer-model 24/24, claims 44/44).
+
+## [1.3.10-beta.1] — 2026-10-21
+
+**M1 maintenance channel, first implementation slice.** Design: `docs/COLLAB/M1-MAINTENANCE.md` (the design series names this slice v1.3.2-beta; it ships as 1.3.10-beta.1 because 1.3.9 was already published as a stable release and versions must stay ordered).
+
+The maintenance channel lets an operator authorise exactly one of three fixed actions on one machine (update, restart, diag)
+with an Ed25519-signed request, executed by a root/SYSTEM runner that reads a queue the unprivileged agent may write to. An
+allow-list entry is not needed: the signature is the authorisation, and widening the allow-list is never the answer.
+
+### What this slice contains
+
+- `src/maintenance/protocol.mjs` — request envelope, canonical signing bytes, parameter whitelists for the three actions,
+  and the complete refusal vocabulary (wrong machine, expired, future, TTL too long, replay, revoked key, unknown key,
+  bad signature, bad action, bad params, too large, missing signature). TTL is capped at 10 minutes and only the pinned
+  operator key can sign.
+- `src/maintenance/operator-key.mjs` — Ed25519 key generation, relay registration payload, trust-on-first-use pinning with a
+  rotation chain (a new key must be signed by the pinned one), revocation, and a corrupt pin store that refuses instead of
+  trusting nothing.
+- `src/maintenance/runner.mjs` — queue scanning, claim-before-verify, signature verification, persisted replay sets
+  (request id + nonce), idempotent re-runs, and a result file for every request it looks at, refusals included.
+- `src/maintenance/actions.mjs` — the three fixed actions with no shell interpolation: diag (fixed read-only command set,
+  capped output), restart (fixed unit order and health waits), update (https download, sha256 verify, staged extraction,
+  version check inside the artifact, backup, atomic swap, health check, automatic rollback).
+- `bin/w2m-maintenance.mjs` — the root entry point (once/watch, pin bootstrap, root guard).
+- `deploy/server/w2m-maintenance.{service,path}` and `deploy/windows/w2m-maintenance.xml` — the runner as a systemd path
+  unit / SYSTEM scheduled task.
+
+### What this slice deliberately does not contain
+
+The relay routes that distribute the operator public key and the agent-side ferry that carries a request from a task offer
+to the queue (and the result back) are the next slice (1.3.10-beta.2). Until then the channel is exercised by placing a
+signed request in the queue directory directly — which is also the offline/bootstrap path the design keeps.
+
+Tests: 17 new cases cover the protocol, pinning/rotation/revocation and the runner's refusal and replay behaviour. The
+destructive actions are not executed in tests; they are covered by the real-machine acceptance runbook (M7 evidence).
+
+Verified: gate GREEN twice.
+
+## [1.3.9] — 2026-10-21
+
+**Design-first release: the collaboration line is specified, not yet implemented.**
+
+This release ships the design specification for the multi-machine / multi-client collaboration capability, and no behaviour change: the
+plugin, relay and agent are byte-identical in function to 1.3.1. It exists so the plan is reviewable, versioned, and citable before any
+of it is built.
+
+### What is in this release
+
+- `docs/MULTI-MACHINE-COLLABORATION-PLAN.md` — capability audit (what exists today is dispatch + aggregation, not collaboration),
+  root causes (missing execution-authorization model, missing workspace model, missing shared-object model), and the M1–M7 module plan.
+- `docs/COLLAB/M1-MAINTENANCE.md` — v1.3.2-beta design: signed maintenance requests executed by a root/SYSTEM unit through a queue
+  directory; remote update/restart/diag without SSH and without widening the allow-list.
+- `docs/COLLAB/M2-TASK-GRANT.md` — v1.3.3-beta design: operator-signed per-execution grants (argv hash, machine ids, TTL, task binding),
+  agent-side verification, ledger audit, revocation; the allow-list stops being the only execution authority.
+- `docs/COLLAB/M3-GIT-NATIVE-TASKS.md` — v1.3.4-beta design: per-task git worktrees, patch artifacts as the transportable result, a
+  serialized merge queue, and MERGE_CONFLICT as a first-class outcome.
+- `docs/COLLAB/M4-PROJECT-ROOM.md` — v1.3.5-beta design: relay-side project objects (members, board, artifacts, memory, decisions,
+  refs), snapshot + incremental event protocol, role-based permissions.
+- `docs/COLLAB/M5-MULTI-CLIENT-PRIMITIVES.md` — v1.3.6-beta design: branch/file locks, review tasks with findings and merge gating,
+  and notifications with delivery guarantees and read watermarks.
+- `docs/COLLAB/M6-CROSS-NETWORK-RELIABILITY.md` — v1.3.7-beta design: relay as the authoritative channel, chunked/resumable blobs,
+  agent result outbox, and P2P demoted to opportunistic acceleration.
+- `docs/COLLAB/M7-METRICS-ACCEPTANCE.md` — v1.3.8-beta design: every capability must be triggerable by a real task, negative tests are
+  mandatory, metrics are computed by the relay, and evidence is checked by pre-flight.
+
+### What is explicitly not in this release
+
+No code for M1–M7. The three model-level designs (v1.4.0 execution-authorization, v1.4.1 task, v1.4.2 collaboration) are not written yet.
+The next stable release that changes behaviour will be the one that implements M1 + M2 (the remote-operations loop), with real-machine
+acceptance evidence recorded as described in M7.
+
+Verified: gate GREEN twice on this tree; the package differs from 1.3.1 only in documentation and version metadata.
+
+## [1.3.1] — 2026-10-21
+
+**A red Compat and a green local gate: the loader-entry test was the gap.**
+
+v1.3.0 shipped with a failing Compat job: `test/loader-entry.test.mjs` still listed the fifteen tools it expected the packed
+artifact to register, and the artifact registers sixteen (`w2m_reduce`). The gate ran from the tree, where that test's expectation
+matched the *other* fixture it derives from, so the disagreement only appeared in the packed-copy mount. The expectation now names
+`w2m_reduce`, and this patch release is the artifact that matches it.
+
+No behaviour changes: the fix is the expectation, not the tool surface. beta.2 completes the fix: `EXPECTED_TOOLS` in that same test is the list the loader gate compares against, and beta.1 patched only the other fixture. v1.3.0 is superseded.
+
+This is the stable fix for v1.3.0's red Compat: the loader gate and the packed artifact now agree at sixteen tools. v1.3.0 is superseded on every channel; the artifact behaviour is unchanged. Verified: gate GREEN twice (2710 tests / 2696 pass / 0 fail / 14 skip in 133 files), and Compat on this tag is green before it is called stable.
+
+## [1.3.0] — 2026-10-21
+
+The first stable release of the collaboration line. It consolidates the four betas that followed 1.2.7 and changes no protocol in a
+way that a 1.2.7 peer cannot ignore; every addition is additive and named.
+
+### Data plane
+
+**A reduce phase you can actually run.** `w2m_reduce` dispatches a reduce task only from complete data: it refuses unless every
+declared shard reported as a blob and the named reducer reported (`W2M_REDUCE_NOT_READY` with the missing indexes), never picks a
+reducer, and refuses inline inputs that cannot be carried to another machine. The relay validates, stores, ledgers and offers
+`reduce_of` + `reduce_inputs`; the agent fetches those content-addressed blobs before the reduce runs and exposes
+`W2M_REDUCE_INPUTS_DIR` / `W2M_REDUCE_MANIFEST` / `W2M_REDUCE_OF`; a failed fetch refuses the whole task rather than reducing a
+partial fleet.
+
+**A suggestion that dispenses no action.** `w2m_wait` carries `reduce_suggestion`: ready only when every declared shard reported and
+a reducer was named, the missing indexes otherwise, the candidate machines, and the literal next step. It is derived, never stored,
+and it dispatches nothing.
+
+**Message ids survive a restart, artifacts are one size everywhere.** Chat ids carry a random per-process relay epoch
+(`msg-<epoch>-<seq>`) so a restart cannot recycle an id a client persisted; the blob transport frame is 16 MiB, matching the agent's
+dataflow hard cap, instead of 1 MiB against it.
+
+### Collaboration
+
+**The panel shows the scheduler's own buckets.** The fleet-chat panel renders 准备 / 进行 / 等待 / 阻塞 counts beside the relay's task
+list, derived from the relay's `status` and `waiting_on`; read-only, no dispatch.
+
+**Conflicts name their next step.** `w2m_memory append` returns `merge_hint` with a 409: `re-read-then-append`, `behind_by`, the
+unseen count, the sample size and the literal instruction to re-read, compare and append against the current revision -- never an
+automatic merge.
+
+**Decisions leave a trail.** `w2m_council fleet-decide` reports `trail` (`appended` / `refused` / `error` / `not-written`), and the
+test asserts that status instead of implying a record exists.
+
+### Verified
+
+Gate GREEN twice, 15 of 15: 2710 tests / 2696 pass / 0 fail / 14 skip in 133 files. Two-machine live runs over the real relay cover
+the turn state machine (ask/await over SSE with a refusal), dependency scheduling, and the missing-shard refusal, plus the panel and
+proxy behaviour above.
+
+### Known limits, stated
+
+- `pipeline` keeps `index_total` at 1; blob map results come from plain commands above the inline cap.
+- The reduce suggestion is advisory: the caller dispatches the reduce (this release does not let the relay decide to run a command).
+- The composer panel does not render the board buckets on a host without the Connection service; the tools still work.
+
+## [1.2.11-beta.1] — 2026-10-21
+
+A beta by policy: GitHub prerelease only, never npm.
+
+### The task board in the composer panel
+
+The fleet-chat panel already listed the relay's tasks; it now also shows the four buckets the scheduler uses — 准备 / 进行 / 等待 / 阻塞 — derived from the relay's own `status` and `waiting_on`, never from a classification of its own. Read-only: the panel dispatches nothing.
+
+### Merge hint on memory conflicts
+
+`w2m_memory append` returns `merge_hint` with a 409: state `re-read-then-append`, `behind_by`, the number of unseen records, the sample size, and the literal next step (re-read, compare, append against the current revision — do not merge unseen records). Pure function, no automatic merge.
+
+### Council decisions leave a trail
+
+`w2m_council fleet-decide` reports `trail` (`appended` / `refused` / `error` / `not-written`) instead of implying a record exists; the test now asserts that status.
+
+Verified: gate GREEN twice, 2704 tests / 2690 pass / 0 fail / 14 skip in 132 files; client-bundle 25/25 after the board line; the merge-hint and trail tests are new.
+
+## [1.2.10-beta.1] — 2026-10-21
+
+A beta by policy: GitHub prerelease only, never npm. This one makes the reduce phase executable.
+
+### Reduce execution (caller-dispatched)
+
+`w2m_reduce` dispatches a reduce only from complete data: it refuses unless every declared shard reported as a blob and the named reducer reported (`W2M_REDUCE_NOT_READY`, with the missing indexes). It never picks a reducer and never invents inputs; inline results are refused (`W2M_REDUCE_INLINE_INPUT`) because they cannot be carried to another machine.
+
+The relay validates and carries `reduce_of` + `reduce_inputs` (at most 16 artifacts, sha256 only) on the task, the ledger and the offer; the agent fetches those content-addressed blobs BEFORE running the reduce and exposes `W2M_REDUCE_INPUTS_DIR` / `W2M_REDUCE_MANIFEST` / `W2M_REDUCE_OF` to the command. A failed fetch refuses the task (`REDUCE_INPUT_FETCH_FAILED`) rather than reducing half the fleet.
+
+Verified: gate GREEN twice, 2701 tests / 2687 pass / 0 fail / 14 skip in 131 files; new agent e2e proves the reduce reads the exact artifact bytes; the tool has a dispatch test and a refusal test.
+
+## [1.2.9-beta.1] — 2026-10-21
+
+A beta by policy: **GitHub prerelease only, never npm.** The theme is the data plane and the collaboration plane: the design is
+written down (`docs/DATA-PLANE-COLLABORATION.md`) and this release ships its first slice.
+
+### `reduce_suggestion` on `w2m_wait`
+
+Every terminal wait now answers three questions without acting on them: is the data complete, who could reduce it, and what the
+caller is supposed to do next (`dispatch the reduce yourself; this tool does not run it`). It is a pure function over the machine
+facts the aggregate already publishes:
+
+- **ready** only when every declared shard reported and a reducer was named;
+- **missing indexes** when a shard never reported (an expired lease cannot claim one);
+- **candidates** listing the machines that reported, with the reason;
+- a named reducer that never reported is refused by name (`REDUCER_UNREPORTED`) rather than silently replaced -- changing the
+  machine changes what the reduce runs against;
+- a caller that named no reducer gets `REDUCER_MISSING` and candidates, never an invented choice.
+
+Nothing is stored and nothing is dispatched. Two readers of the same aggregate get the same suggestion, and reading does not
+change relay state.
+
+### The design document states the open question
+
+Caller-dispatched reduce (current direction) versus auto-reduce in the relay. The design leans caller-dispatched, because a relay
+that decides to run a command is the boundary every other decision avoids; a beta that flipped that default would be the wrong
+place to discover it. The document also names the next collaboration slices: conflict-merge UI, council decision trail to shared
+memory, and the board in the composer panel.
+
+### Verified
+
+Gate GREEN twice: 2699 tests / 2685 pass / 0 fail / 14 skip in 131 files. New: `suggestReduce` unit tests (7) covering complete,
+partial-with-missing, no-reducer, unreported-reducer and mixed inline+blob inputs; `w2m_wait` carries the suggestion for every
+aggregate.
+## [1.2.8-beta.1] — 2026-10-21
+
+A beta, by policy: **not published to npm**. It is a GitHub prerelease, installable by a developer who asks for it.
+
+### Message ids are unique across a relay restart
+
+The relay's chat sequence resets on restart, so a bare `msg-000001` named a different message after every deploy. Clients persist
+those ids -- an open turn, a read watermark, `reply_to` -- and live testing caught exactly that: a Windows `ask` recorded a turn, the
+relay restarted, a new message reused the id, and the wait settled the OLD turn as `answered_after_timeout` while the reply was
+fresh. Message ids now carry a random per-process epoch (`msg-<epoch>-<seq>`), so a restart cannot recycle an id and old clients that
+render ids verbatim keep working.
+
+### One size for "how large may one artifact be"
+
+The blob transport frame was 1 MiB while the agent's dataflow hard cap is 16 MiB, so an artifact between the two was accepted by the
+agent and then failed its upload (`BLOB_UPLOAD_FAILED`) on a relay that looked fine. `BLOB_FRAME_BYTES` is now 16 MiB, matching the
+agent, while every JSON route keeps the 64 KiB frame limit.
+
+### Verified
+
+Gate GREEN twice: 2691 tests / 2677 pass / 0 fail / 14 skip in 130 files. New tests: an id is unique across two store instances
+(same sequence, different process), an explicit epoch is honoured, and a 2 MiB blob survives the transport intact.
+
+### Still open (unchanged from 1.2.7)
+
+- `pipeline` keeps `index_total` at 1; blob map results come from plain commands above the inline cap.
+- macmini runs 1.2.6 from its own checkout and needs a `git pull` + restart for the plain-command blob behaviour.
+## [1.2.7] — 2026-10-21
+
+**The scheduler enforces the graph, a wait survives a restart and a dropped stream, and a partial fleet can no longer call itself
+a complete reduce.**
+
+### Turns are a state machine on disk
+
+A question written with `action:'ask'` becomes a persisted turn (`ask_id`, deadline). `await` attaches to that record, so a process
+restart does not lose the question or turn a late answer into silence; a late answer is recorded as `answered_after_timeout`. The
+wait prefers the relay's event stream, re-subscribes when the stream drops, and polls only when streaming is unavailable. A reply
+now carries `reply_state: 'answered'|'refused'`, so a refusal is a state the waiter reads rather than wording it guesses.
+
+### Dependencies block dispatch, and release when their prerequisite settles
+
+A task with `depends_on` is not offered: its leases are `waiting`, which redelivery skips and the sweeper ignores. When every
+prerequisite is settled -- **by a result, an expiry or a refusal** -- `_releaseDependents` moves those leases to offers. The graph
+edges and `assignee` are written into the task ledger, because live testing showed a restarted relay losing them and keeping a
+waiting task waiting forever. `assignee` is enforced, not recorded: only that machine gets a lease, and an unknown assignee is
+refused by name. `GET /v1/tasks` now publishes a derived `status` (`waiting`/`active`/`done`/`failed`/`cancelled`) and
+`waiting_on`, so the board and the scheduler cannot disagree.
+
+### Dataflow: an expected shard count, and a reduce that refuses partial input
+
+`buildReducePlan` takes `expectedIndexTotal` from the task (`index_total`) and refuses `MISSING_SHARD` (with the missing indexes),
+`MAP_INDEX_MISSING` and `MAP_INDEX_OUT_OF_RANGE`; only machines that actually reported can claim a shard, so an expired lease no
+longer makes a partial run look complete. Two production gaps were found by live testing and closed with it:
+
+- **A large plain-command stdout was never a blob.** The blob path lived only in the pipeline loop, so a split/mapreduce map result
+  was always inline and a reduce plan could never see what it reduces. Any command output above the inline cap now uploads a blob
+  exactly as a pipeline stage does (best effort: a failed upload keeps the command successful and says why).
+- **The relay's own frame limit made the blob channel unusable.** `MAX_FRAME_BYTES` (64 KiB) equals the inline threshold, so every
+  blob was by construction larger than the frame cap and a real upload failed with `FRAME_TOO_LARGE` while the fake relay in tests
+  accepted it. Blob PUTs now get a bounded 1 MiB frame (`BLOB_FRAME_BYTES`); every JSON route keeps the 64 KiB cap.
+- The aggregate now publishes `blob_sha256`, `output_mode`, `stdout_head` and `stdout_bytes` per machine: `w2m_wait` used to read
+  `aggregate.detail.machines`, a shape the production `/v1/tasks` response never carries, so the reduce plan was unreachable
+  outside tests.
+
+### Verified
+
+Gate GREEN twice, 15 of 15: 2687 tests / 2673 pass / 0 fail / 14 skip in 130 files.
+
+Two-machine live runs on Windows (ToFuture) and jp-shared over the real relay:
+
+- **await over SSE**: Windows asks, jp-shared replies `reply_state:'refused'`; the wait returns `state=refused, via=stream`, and the
+  turn is settled on disk.
+- **dependency chain**: B with `depends_on: [A]` is `waiting`, A settles, B is released (observed `status=active` with offers).
+- **missing shard**: a split task with `index_total: 5` whose map results are blobs is refused as
+  `MISSING_SHARD {missing:[1,3,4], expectedIndexTotal:5}` with `dataflow_degraded: true` -- the first live exercise of the blob
+  channel end to end.
+
+Both live-testing defects above (release only on a result; graph edges missing from the ledger) were found by these runs and are
+covered by tests now.
+
+### Limits, stated
+
+- A pipeline task runs the whole chain per machine, so `index_total` stays 1 for it; blob map results come from plain commands above
+  the inline cap.
+- The blob transport frame is 1 MiB while the agent's dataflow hard cap is 16 MiB: a single artifact above 1 MiB fails its upload
+  explicitly (`BLOB_UPLOAD_FAILED`) rather than being split across frames.
+- The jp-shared agent was upgraded to this build; macmini runs 1.2.6 from its own checkout and needs a `git pull` + restart to get
+  the plain-command blob behaviour.
+## [1.2.6] — 2026-10-20
+
+**Security surface: signatures, a permission matrix, and output that no longer carries secrets — plus the reliability the chat
+needed before it could be trusted with real messages.**
+
+### Command signatures
+
+The agent signs `{task_id, argv_hash, machine_id, ts}` with an Ed25519 key derived from its device key (`DeviceKey` is X25519 and
+cannot sign; deriving keeps one secret per machine). The envelope carries `signature {alg, value, public_key, ts}`, and
+`w2m_wait` reports every machine as `signed`, `unsigned` or `bad_signature`, with a task-level `signature_warning`. A tampered
+`argv_hash` verifies as `bad_signature` -- tested at the unit level and end to end through a real agent run.
+
+Honest limit: the public half travels inside the signature. That proves the result matches the key it carries, not that the key
+belongs to the machine. Binding it to the relay's device record is the remaining step for non-repudiation across machines, and it
+is named here rather than implied.
+
+### Permission matrix
+
+`src/util/policy-matrix.mjs` is the single table: `observer < worker < owner` against `read_private | vote | join | dispatch |
+approve | manage_members`. A refusal is `FORBIDDEN_ACTION` naming the action, the level required and the level held. The relay
+enforces it where a role actually acts: an observer may read the fleet flow and may not post into it. Unknown means worker, never
+owner.
+
+### Output redaction
+
+`stdout_head`/`tail` and `stderr_head`/`tail` are filtered for API keys, `npm_`/`github_pat_` tokens and private-key blocks,
+replaced in place with `[redacted:class]` so line numbers survive. Hashes and blobs are never touched: they are evidence of the raw
+bytes. `redactOutput: false` is allowed and marks the envelope `unredacted: true`.
+
+### End-to-end encrypted chat
+
+Sending encrypts with AES-256-GCM under a group key derived as `HKDF(fleetKey, 'fleet-chat-v1')`; the relay stores ciphertext and
+cannot open it. Reading decrypts what the key covers and marks the rest `encrypted: true` with a `decrypt_error`. Plaintext
+messages keep working, so older clients neither break nor are lied to. The relay validates the encryption envelope's shape and
+refuses a malformed one (`BAD_ENCRYPTION`), and cannot search content -- which is the point, and is written down as the cost.
+
+### Reliability
+
+- **Role persistence**: `member.role` ledger entries replay on restart, so a relay restart no longer silently demotes every owner.
+  Verified live: the role that was lost before the deploy came back after it.
+- **Chat cursor**: `list` continues where the last page ended (`since_ms` from a persisted per-session cursor) and advances only
+  over what was actually read.
+- **Offline spool**: a send that cannot reach the relay is written to disk with an idempotency key and replayed on the next call;
+  a replay that the relay already received returns the first message instead of posting twice.
+
+### Verified
+
+Gate GREEN twice, 15 of 15: 2666 tests / 2652 pass / 0 fail / 14 skip in 130 files. New suites: chat-crypto (8),
+envelope-signature (6), policy-matrix (9); agent 152, relay 173, tools 132, fleet-messages 14.
+
+Relay redeployed twice from hash-verified tarballs, with state backups, and the new surfaces exercised against the live relay:
+encrypted message stored as ciphertext and read back, malformed encryption refused with 400, roles restored after restart.
+
+### Known gaps
+
+- The GitHub Packages mirror still holds an orphan `1.2.4` published by a diagnostic dispatch; removal needs a token with package
+  administration (this one sees 404 on the package API).
+- The signing public key is not yet bound to the relay's device record (see above).
+- Two-machine end-to-end runs of the new chat surface are still not done; the HTTP and tool surfaces are tested against fakes and
+  exercised once against jp-shared.
+## [1.2.5] — 2026-10-20
+
+**Who is in the fleet, what they have read, who was named, and a retry that cannot double-post.**
+
+### Members and roles
+
+`GET /v1/fleet/members` lists every machine with its name, role, join time, presence and last-seen time. `PUT
+/v1/fleet/members/{id}` changes a role and requires the **operator** token, so the route sits with dispatch rather than behind the
+device gate. Roles are `owner | worker | observer` and live in their own table: a device record is written by pairing and by
+reconnect, and a role is an operator decision that must survive both. An unknown machine is a `worker`, never an `owner` -- a
+re-pair cannot gain authority. The last owner cannot be demoted, because then nobody could readmit a machine.
+
+### Read watermarks
+
+`PUT /v1/fleet/read/{session}` records how far this machine has read a conversation (its own token decides which machine);
+`GET /v1/fleet/read/{session}` answers the watermark and an unread count of messages from others newer than it. Only forward: a
+stale marker arriving late must not move the watermark backwards, or the count would grow for messages already seen.
+
+### Mentions
+
+A message may carry `mentions: [machine_id]` (at most 10, validated). The row is still **one** row -- a mention is a
+notification hint, not a delivery mechanism -- and the SSE notification says only whether **this** listener was named. It never
+carries the text, and it does not carry the mention list.
+
+### Idempotent posts
+
+`POST /v1/fleet/messages` accepts `idempotency_key` (per session). A retry after a lost response returns the **first** message
+with `deduped: true` instead of storing the sentence twice. The key is bounded, like the message log.
+
+### Two defects the 1.2.4 tag carried, fixed here
+
+The 1.2.4 commit (tag `v1.2.4`) had a red CI and a red Compat, both found before approval:
+
+- **Compat**: `w2m_wait`'s `reducer_machine_id` declaration had been pasted **inside** `poll_ms`. Every local check was green;
+  the real host refused the whole entry ("parameters.poll_ms.reducer_machine_id is not supported by the value schema DSL"). The
+  parameter now sits where it belongs, and `schema-spec.mjs` gained `strayParameterProblems()` — a parameter declaration
+  nested inside another parameter is now refused where the tool is written, with two tests.
+- **CI**: the cancellation HTTP test had been inserted inside an enclosing `it`. Node 24 ran it; Node 20/22 reported
+  `cancelledByParent`. The test now lives in its own top-level `describe`.
+
+### Verified
+
+Gate GREEN twice, 15 of 15: 2628 tests / 2614 pass / 0 fail / 14 skip. New suites: fleet-members (6); fleet-messages grew to 11;
+relay grew to 171 including two HTTP cases for members and watermarks.
+
+The relay was deployed a fourth time from a hash-verified tarball with a state backup, and the new routes were exercised against
+the live relay (members returned 8 machines; a role change returned 200; a watermark round-tripped; unread answered 0).
+
+### Not in this release
+
+- **Offline replay of outbound chat** is not implemented. The agent's spool already holds undeliverable *results*; chat text is
+  not yet spooled and replayed.
+- A two-machine end-to-end run of mentions/watermarks. The HTTP surface is tested against the fake relay and exercised once
+  against jp-shared, but not by two physical machines.
+## [1.2.4] — 2026-10-20
+
+**Fleet collaboration, part two: cancellation, dependencies, a task board, questions on disk, and output that travels.**
+
+### Cancelling a task over HTTP
+
+`state.cancelTask` has existed since the task ledger gained a cancel flag, but **no route reached it**. `POST /v1/tasks/{id}/cancel`
+now does, with the same operator authorization dispatch requires, and `w2m_cancel` is the tool over it. Cancelling twice is not
+an error: the ledger is the answer.
+
+### Prerequisites and a task board
+
+- `POST /v1/task` accepts `depends_on[]`. Validated at **enqueue** time: unknown prerequisite, self-edge, duplicate edge and
+  cycles are refused by name (`src/relay/task-deps.mjs`), because a graph checked only when a worker picks the task up puts the
+  refusal on a machine that did not create the problem.
+- `depends_on` / `assignee` travel on the task record.
+- `w2m_tasks` (the fifteenth tool) is the board: it classifies every visible task as ready / active / waiting / blocked / done
+  (`src/plugin/task-graph.mjs`). A prerequisite outside the page is treated as **waiting**, never as absent.
+
+### Questions that survive a restart
+
+`src/plugin/ask-store.mjs` keeps open questions in a JSONL file next to the profile (`ask-store.jsonl`, atomic rewrite, cap on
+records). A reply that arrives after the deadline is recorded as `answered_after_timeout` rather than overwriting the timeout or
+being dropped, and a settled question is never reopened. `w2m_chat` gained `action: "asks"`, and `await` settles the stored ask.
+
+### Output that travels
+
+`src/util/dataflow.mjs` (moved from `src/plugin/` — the layer check refused an `agent -> plugin` edge) is now wired:
+
+- a pipeline stage whose stdout exceeds 64 KiB **uploads it as a blob** (`PUT /v1/fleet/blobs/{sha256}`) and the envelope names
+  it (`blob_sha256`, `output_mode: "blob"`) instead of inlining head/tail;
+- a failed upload **fails the stage** by name (`BLOB_UPLOAD_FAILED`) rather than leaving a reference to nothing;
+- `w2m_wait` builds the reduce plan with `buildReducePlan` from the **raw** envelopes and marks the verdict `degraded` when a
+  shard is missing — but only when the caller declared `reducer_machine_id`, so a large pipeline result is not mistaken for a
+  partial reduce.
+
+The end-to-end fixture this release adds (`test/agent.test.mjs`) runs a real agent against a fake relay: it asserts the blob name
+is the hash of the bytes sent and that a refused upload fails the stage. Two real defects surfaced while writing it and are fixed
+here: the stage stdout arrives as a `Buffer` (it was handed to the signature helper as a string), and a 70 KiB test argv exceeds
+Windows' `CreateProcess` limit.
+
+### Retry and hand-off
+
+- `POST /v1/task` accepts `max_attempts` (1..5, default 1) and `retry_on` (`expired|failed|partial|timeout`). Defaults keep
+  at-most-once for every existing caller; a malformed policy is `BAD_REQUEST`, not silently ignored.
+- On lease expiry, `retry_on` containing `expired` performs the hand-off `halt=now` always had: attempt+1 and a re-offer to idle
+  machines (`_takeover`, which already refuses writing tasks to avoid double application).
+
+### mapreduce
+
+`mode: "mapreduce"` is accepted with `reduce_argv` and an optional `reducer_machine_id`. The map half is ordinary dispatch; the
+reduce half is **described, never launched** — the caller runs it as an explicit second task after `w2m_wait` says every shard is
+present, so one task id never describes two executions.
+
+### Relay
+
+The relay was deployed three times during this release (cancel route, retry policy, mapreduce) from hash-verified tarballs, each
+with a state backup, a health check, and a 401 check on the pre-existing routes. **The relay name is separate from the package
+version**: the tarball deployed was the 1.2.3-labelled build carrying this code, and is re-deployed from the released 1.2.4 tarball
+below.
+
+### Verified
+
+Gate GREEN twice, 15 of 15: 2610 tests / 2596 pass / 0 fail / 14 skip. Notable suites: agent 149 (147 pass, 2 skipped),
+relay 169, tools 127, task-deps 13, task-graph 11, ask-store 8, turn 5, dataflow 7, dataflow-wiring 7.
+
+### Not verified
+
+A two-machine run of cancel / retry / mapreduce end to end. The code paths are tested against a fake relay and against the real
+relay's HTTP surface, but no test here runs two physical machines exchanging an expired lease.
 ## [1.2.3] — 2026-10-20
 
 **The packed artifact did not mount. This fixes that, and the reason it was not caught here.**