@twinsearth/w2m-dsh-plugin 2.0.7 → 2.0.9

package/src/agent/transport.mjs

@@ -0,0 +1,146 @@
+/**
+ * W0: P2PTransport contract + the udp-v1 implementation.
+ *
+ * This is the seam a second stack (iroh-v1) will plug into. It is deliberately
+ * thin: it owns no protocol logic, only the shape the scheduler talks to.
+ * Nothing wires it into the agent yet, so behaviour of v2.0.8 is unchanged.
+ */
+
+export const TRANSPORT = Object.freeze({
+  UDP: 'udp-v1',
+  IROH: 'iroh-v1',
+});
+
+export const TRANSPORT_DEFAULT = Object.freeze(['udp']);
+
+export const TRANSPORT_CODE = Object.freeze({
+  OK: 'TRANSPORT_OK',
+  UNAVAILABLE: 'TRANSPORT_UNAVAILABLE',
+  BAD_SHAPE: 'TRANSPORT_BAD_SHAPE',
+  CLOSED: 'TRANSPORT_CLOSED',
+  UNKNOWN: 'TRANSPORT_UNKNOWN',
+});
+
+/**
+ * Validate the pieces a transport must expose. Returns a named refusal instead
+ * of throwing so a registry can skip a broken transport without losing the rest.
+ */
+export function assertTransportShape(transport) {
+  if (transport === null || typeof transport !== 'object') return { ok: false, code: TRANSPORT_CODE.BAD_SHAPE, detail: 'transport must be an object' };
+  for (const name of ['name', 'start', 'stop', 'send', 'onMessage', 'paths', 'diagnostics']) {
+    if (name === 'name' ? typeof transport.name !== 'string' : typeof transport[name] !== 'function') {
+      return { ok: false, code: TRANSPORT_CODE.BAD_SHAPE, detail: 'missing ' + name };
+    }
+  }
+  return { ok: true };
+}
+
+/**
+ * Resolve the configured transport list without ever inventing one.
+ * Unknown names are dropped and reported; `udp` is always kept as the fallback.
+ */
+export function resolveTransports(config = {}) {
+  const requested = Array.isArray(config.transports) ? config.transports.filter((name) => typeof name === 'string') : TRANSPORT_DEFAULT;
+  const known = new Set(Object.values(TRANSPORT));
+  const accepted = [];
+  const refused = [];
+  for (const name of requested) {
+    if (!known.has(name)) { refused.push({ name, code: TRANSPORT_CODE.UNKNOWN }); continue; }
+    if (!accepted.includes(name)) accepted.push(name);
+  }
+  if (!accepted.includes(TRANSPORT.UDP)) accepted.push(TRANSPORT.UDP);
+  return { ok: true, transports: accepted, refused };
+}
+
+/**
+ * Wrap a P2PNode-like object as udp-v1.
+ *
+ * The node is expected to expose `dial(machineId)` (returns {ok, channel}),
+ * `status()` and optionally `close()`. Channels expose `send`, `on`, `close`.
+ * This adapter caches one channel per peer so send() is not a dial per frame.
+ */
+export function createUdpTransport({ node, name = TRANSPORT.UDP } = {}) {
+  if (node === null || typeof node !== 'object' || typeof node.dial !== 'function') {
+    return { ok: false, code: TRANSPORT_CODE.BAD_SHAPE, detail: 'createUdpTransport needs a node with dial()' };
+  }
+  const channels = new Map();
+  const handlers = new Set();
+  let closed = false;
+
+  const attach = (peer, channel) => {
+    channel.on?.('message', (payload) => {
+      for (const handler of handlers) handler({ peer, payload });
+    });
+    channel.on?.('close', () => channels.delete(peer));
+  };
+
+  const transport = {
+    name,
+    async start() {
+      closed = false;
+      return { ok: true, name };
+    },
+    async stop() {
+      closed = true;
+      for (const channel of channels.values()) channel.close?.();
+      channels.clear();
+      node.close?.();
+      return { ok: true };
+    },
+    async send(peer, payload) {
+      if (closed) return { ok: false, code: TRANSPORT_CODE.CLOSED };
+      let channel = channels.get(peer) ?? null;
+      if (channel === null) {
+        const dialled = await node.dial(peer);
+        if (dialled?.ok !== true) return { ok: false, code: dialled?.code ?? 'UDP_DIAL_FAILED', detail: dialled?.error ?? null };
+        channel = dialled.channel;
+        channels.set(peer, channel);
+        attach(peer, channel);
+      }
+      await channel.send(payload);
+      return { ok: true, peer };
+    },
+    onMessage(handler) {
+      if (typeof handler !== 'function') return () => {};
+      handlers.add(handler);
+      return () => handlers.delete(handler);
+    },
+    paths() {
+      const status = typeof node.status === 'function' ? node.status() : null;
+      return Array.isArray(status?.candidates) ? status.candidates.map((candidate) => ({ ...candidate, transport: name })) : [];
+    },
+    diagnostics() {
+      const status = typeof node.status === 'function' ? node.status() : null;
+      return {
+        name,
+        closed,
+        channels: channels.size,
+        encryption: status?.encryption ?? null,
+        last_error: status?.last_error ?? null,
+      };
+    },
+  };
+  return { ok: true, transport };
+}
+
+/**
+ * Registry: the only object the backend layer will need to talk to later.
+ * It keeps a default and can report every registered transport's diagnostics.
+ */
+export function createTransportRegistry({ transports = [], defaultName = TRANSPORT.UDP } = {}) {
+  const byName = new Map();
+  const refused = [];
+  for (const transport of transports) {
+    const shape = assertTransportShape(transport);
+    if (shape.ok !== true) { refused.push({ transport: transport?.name ?? null, code: shape.code, detail: shape.detail }); continue; }
+    byName.set(transport.name, transport);
+  }
+  return {
+    ok: true,
+    refused,
+    names: [...byName.keys()],
+    get(name) { return byName.get(name) ?? null; },
+    defaultTransport() { return byName.get(defaultName) ?? byName.get(TRANSPORT.UDP) ?? null; },
+    diagnostics() { return [...byName.values()].map((transport) => transport.diagnostics()); },
+  };
+}

package/src/game/xiangqi.mjs

@@ -0,0 +1,217 @@
+/**
+ * 中国象棋核心规则（联合开发演示用，零依赖）。
+ *
+ * 棋盘 10 行 × 9 列：row 0 为黑方底线，row 9 为红方底线；红先。
+ * 棋子：K 帅/将, A 仕/士, E 相/象, H 马, R 车, C 炮, P 兵/卒。
+ * 已实现：全部走子规则、炮架、马腿、象眼、过河兵、九宫、飞将、将军/将死/困毙（困毙判负）。
+ */
+export const COLS = 9;
+export const ROWS = 10;
+const RED = 'r';
+const BLACK = 'b';
+
+const START = [
+  ['r', 'h', 'e', 'a', 'k', 'a', 'e', 'h', 'r'],
+  [null, null, null, null, null, null, null, null, null],
+  [null, 'c', null, null, null, null, null, 'c', null],
+  ['p', null, 'p', null, 'p', null, 'p', null, 'p'],
+  [null, null, null, null, null, null, null, null, null],
+  [null, null, null, null, null, null, null, null, null],
+  ['P', null, 'P', null, 'P', null, 'P', null, 'P'],
+  [null, 'C', null, null, null, null, null, 'C', null],
+  [null, null, null, null, null, null, null, null, null],
+  ['R', 'H', 'E', 'A', 'K', 'A', 'E', 'H', 'R'],
+];
+
+const isRed = (piece) => piece !== null && piece === piece.toUpperCase();
+const sideOf = (piece) => (piece === null ? null : isRed(piece) ? RED : BLACK);
+
+export function createGame() {
+  return {
+    board: START.map((row) => row.slice()),
+    turn: RED,
+    ply: 0,
+    history: [],
+    result: null,
+  };
+}
+
+const cloneBoard = (board) => board.map((row) => row.slice());
+const inBoard = (r, c) => r >= 0 && r < ROWS && c >= 0 && c < COLS;
+const inPalace = (side, r, c) => {
+  if (c < 3 || c > 5) return false;
+  return side === RED ? r >= 7 && r <= 9 : r >= 0 && r <= 2;
+};
+const crossedRiver = (side, r) => (side === RED ? r <= 4 : r >= 5);
+
+function pseudoMoves(board, side, r, c) {
+  const piece = board[r][c];
+  if (piece === null || sideOf(piece) !== side) return [];
+  const type = piece.toUpperCase();
+  const out = [];
+  const push = (rr, cc) => {
+    if (!inBoard(rr, cc)) return;
+    const target = board[rr][cc];
+    if (target === null || sideOf(target) !== side) out.push([rr, cc]);
+  };
+  if (type === 'K') {
+    for (const [dr, dc] of [[1, 0], [-1, 0], [0, 1], [0, -1]]) {
+      const rr = r + dr; const cc = c + dc;
+      if (inPalace(side, rr, cc)) push(rr, cc);
+    }
+  } else if (type === 'A') {
+    for (const [dr, dc] of [[1, 1], [1, -1], [-1, 1], [-1, -1]]) {
+      const rr = r + dr; const cc = c + dc;
+      if (inPalace(side, rr, cc)) push(rr, cc);
+    }
+  } else if (type === 'E') {
+    for (const [dr, dc] of [[2, 2], [2, -2], [-2, 2], [-2, -2]]) {
+      const rr = r + dr; const cc = c + dc;
+      if (!inBoard(rr, cc) || crossedRiver(side, rr)) continue;
+      if (board[r + dr / 2][c + dc / 2] !== null) continue;
+      push(rr, cc);
+    }
+  } else if (type === 'H') {
+    for (const [dr, dc, lr, lc] of [
+      [2, 1, 1, 0], [2, -1, 1, 0], [-2, 1, -1, 0], [-2, -1, -1, 0],
+      [1, 2, 0, 1], [-1, 2, 0, 1], [1, -2, 0, -1], [-1, -2, 0, -1],
+    ]) {
+      const rr = r + dr; const cc = c + dc;
+      if (!inBoard(rr, cc)) continue;
+      if (board[r + lr][c + lc] !== null) continue;
+      push(rr, cc);
+    }
+  } else if (type === 'R' || type === 'C') {
+    for (const [dr, dc] of [[1, 0], [-1, 0], [0, 1], [0, -1]]) {
+      let rr = r + dr; let cc = c + dc; let screen = false;
+      while (inBoard(rr, cc)) {
+        const target = board[rr][cc];
+        if (type === 'R') {
+          if (target === null) out.push([rr, cc]);
+          else { if (sideOf(target) !== side) out.push([rr, cc]); break; }
+        } else if (target === null) {
+          if (!screen) out.push([rr, cc]);
+        } else if (!screen) {
+          screen = true;
+        } else {
+          if (sideOf(target) !== side) out.push([rr, cc]);
+          break;
+        }
+        rr += dr; cc += dc;
+      }
+    }
+  } else if (type === 'P') {
+    const forward = side === RED ? -1 : 1;
+    push(r + forward, c);
+    if (crossedRiver(side, r)) { push(r, c - 1); push(r, c + 1); }
+  }
+  return out;
+}
+
+function kingAt(board, side) {
+  for (let r = 0; r < ROWS; r += 1) for (let c = 0; c < COLS; c += 1) {
+    const p = board[r][c];
+    if (p !== null && p.toUpperCase() === 'K' && sideOf(p) === side) return [r, c];
+  }
+  return null;
+}
+
+function kingsFace(board) {
+  const rk = kingAt(board, RED); const bk = kingAt(board, BLACK);
+  if (rk === null || bk === null || rk[1] !== bk[1]) return false;
+  const c = rk[1];
+  const from = Math.min(rk[0], bk[0]) + 1; const to = Math.max(rk[0], bk[0]);
+  for (let r = from; r < to; r += 1) if (board[r][c] !== null) return false;
+  return true;
+}
+
+/** 某方是否被将军（含飞将）。 */
+export function inCheck(board, side) {
+  if (kingsFace(board)) return true;
+  const king = kingAt(board, side);
+  if (king === null) return true;
+  const enemy = side === RED ? BLACK : RED;
+  for (let r = 0; r < ROWS; r += 1) for (let c = 0; c < COLS; c += 1) {
+    const p = board[r][c];
+    if (p === null || sideOf(p) !== enemy) continue;
+    if (pseudoMoves(board, enemy, r, c).some(([rr, cc]) => rr === king[0] && cc === king[1])) return true;
+  }
+  return false;
+}
+
+export function legalMovesFrom(board, side, r, c) {
+  return pseudoMoves(board, side, r, c).filter(([rr, cc]) => {
+    const next = cloneBoard(board);
+    next[rr][cc] = next[r][c]; next[r][c] = null;
+    return !inCheck(next, side);
+  });
+}
+
+export function allLegalMoves(board, side) {
+  const out = [];
+  for (let r = 0; r < ROWS; r += 1) for (let c = 0; c < COLS; c += 1) {
+    if (board[r][c] !== null && sideOf(board[r][c]) === side) {
+      for (const [rr, cc] of legalMovesFrom(board, side, r, c)) out.push({ from: [r, c], to: [rr, cc] });
+    }
+  }
+  return out;
+}
+
+const FILE = 'abcdefghi';
+export const squareName = (r, c) => FILE[c] + String(ROWS - r);
+
+/** @returns {{ok: true, state: object, move: object} | {ok: false, code: string}} */
+export function applyMove(game, from, to) {
+  if (game.result !== null) return { ok: false, code: 'GAME_OVER' };
+  if (!Array.isArray(from) || !Array.isArray(to) || !inBoard(from[0], from[1]) || !inBoard(to[0], to[1])) return { ok: false, code: 'SQUARE_INVALID' };
+  const piece = game.board[from[0]][from[1]];
+  if (piece === null || sideOf(piece) !== game.turn) return { ok: false, code: 'NOT_YOUR_PIECE' };
+  const legal = legalMovesFrom(game.board, game.turn, from[0], from[1]);
+  if (!legal.some(([r, c]) => r === to[0] && c === to[1])) return { ok: false, code: 'ILLEGAL_MOVE' };
+  const board = cloneBoard(game.board);
+  const captured = board[to[0]][to[1]];
+  board[to[0]][to[1]] = piece; board[from[0]][from[1]] = null;
+  const mover = game.turn;
+  const next = { ...game, board, turn: mover === RED ? BLACK : RED, ply: game.ply + 1, history: [...game.history, { from, to, piece, captured }] };
+  const opponentHasMoves = allLegalMoves(board, next.turn).length > 0;
+  const opponentChecked = inCheck(board, next.turn);
+  if (!opponentHasMoves) {
+    next.result = { winner: mover, reason: captured !== null && captured.toUpperCase() === 'K' ? 'KING_CAPTURED' : opponentChecked ? 'CHECKMATE' : 'STALEMATE' };
+  } else if (opponentChecked) {
+    next.check = true;
+  } else {
+    next.check = false;
+  }
+  next.lastMove = { from, to, piece, captured, check: opponentChecked === true && next.result === null };
+  return { ok: true, state: next, move: next.lastMove };
+}
+
+const GLYPH = { K: '帅', A: '仕', E: '相', H: '马', R: '车', C: '炮', P: '兵', k: '将', a: '士', e: '象', h: '马', r: '车', c: '炮', p: '卒' };
+
+export function boardAscii(game) {
+  const lines = ['    a b c d e f g h i'];
+  for (let r = 0; r < ROWS; r += 1) {
+    const cells = [];
+    for (let c = 0; c < COLS; c += 1) {
+      const p = game.board[r][c];
+      cells.push(p === null ? '·' : GLYPH[p] ?? p);
+    }
+    lines.push(String(ROWS - r).padStart(2, ' ') + '  ' + cells.join(' '));
+  }
+  lines.push('    a b c d e f g h i');
+  return lines.join('\n');
+}
+
+export function moveText(move) {
+  return squareName(move.from[0], move.from[1]) + '-' + squareName(move.to[0], move.to[1]);
+}
+
+export function describeProgress(game) {
+  const side = game.turn === RED ? '红' : '黑';
+  if (game.result !== null) {
+    const winner = game.result.winner === RED ? '红方' : '黑方';
+    return `第 ${game.ply} 手结束：${winner}胜（${game.result.reason}）`;
+  }
+  const last = game.lastMove ? `上一手 ${moveText(game.lastMove)}${game.lastMove.captured ? ' 吃 ' + GLYPH[game.lastMove.captured] : ''}` : '开局';
+  return `第 ${game.ply} 手 · ${side}方行棋 · ${last}${game.check ? ' · 将军！' : ''}`;
+}

package/src/plugin/fleet-binding.mjs

@@ -0,0 +1,105 @@
+/**
+ * Fleet binding diagnostics (read-only).
+ *
+ * A device token can be valid while `fleet_id` is null: the relay lists the machine globally
+ * ("all machines") but filters it out of every fleet view ("this fleet"). v0.8.7's
+ * "already paired -> do not pair again" rule made that state sticky, so it needs to be
+ * *observed* rather than inferred from "paired: true".
+ *
+ * Nothing here writes: the status tool reports, and the auto-start path decides whether to
+ * re-admit using the fleet key it already holds.
+ */
+
+export const FLEET_BINDING_CODE = Object.freeze({
+  BOUND: 'FLEET_BOUND',
+  UNBOUND: 'FLEET_UNBOUND',
+  UNPAIRED: 'FLEET_UNPAIRED',
+  TOKEN_REJECTED: 'FLEET_TOKEN_REJECTED',
+  UNKNOWN: 'FLEET_UNKNOWN',
+});
+
+/**
+ * Should a start-up re-admit even though a token exists?
+ * Only when the token is valid, the machine has no fleet, and a key is available to bind it.
+ */
+export function shouldRejoin({ token, fleetId, fleetKey }) {
+  return typeof token === 'string' && token !== ''
+    && (fleetId === null || fleetId === undefined || fleetId === '')
+    && typeof fleetKey === 'string' && fleetKey.trim() !== '';
+}
+
+/**
+ * Read this machine's relay record and classify its fleet binding.
+ *
+ * @param {{relayUrl: string, token: string|null, machineId: string|null,
+ *          fleetKey: string|null, fetchImpl?: Function, timeoutMs?: number}} input
+ * @returns {Promise<object>} a bounded, token-free status block
+ */
+export async function diagnoseFleetBinding({ relayUrl, token, machineId, fleetKey = null, fetchImpl = fetch, timeoutMs = 2500 }) {
+  const checkedAt = new Date().toISOString();
+  const fleetKeyConfigured = typeof fleetKey === 'string' && fleetKey.trim() !== '';
+  const base = {
+    ok: true,
+    state: 'unknown',
+    code: FLEET_BINDING_CODE.UNKNOWN,
+    fleet_id: null,
+    token_present: typeof token === 'string' && token !== '',
+    fleet_key_configured: fleetKeyConfigured,
+    machine_id: machineId,
+    checked_at: checkedAt,
+    detail: null,
+    remedy: null,
+  };
+  if (base.token_present !== true) {
+    return { ...base, state: 'unpaired', code: FLEET_BINDING_CODE.UNPAIRED, detail: 'this machine has no device token' };
+  }
+  if (typeof relayUrl !== 'string' || relayUrl === '') {
+    return { ...base, detail: 'no relay URL is configured' };
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(relayUrl.replace(/\/+$/, '') + '/v1/devices', {
+      headers: { authorization: 'Bearer ' + token, accept: 'application/json' },
+      signal: controller.signal,
+    });
+    if (response.status === 401 || response.status === 403) {
+      return {
+        ...base,
+        state: 'token_rejected',
+        code: FLEET_BINDING_CODE.TOKEN_REJECTED,
+        detail: 'the relay rejected this device token (HTTP ' + response.status + ')',
+        remedy: 're-pair this machine (the stored token is stale for this relay)',
+      };
+    }
+    if (response.ok !== true) {
+      return { ...base, detail: 'the relay answered HTTP ' + response.status };
+    }
+    const body = await response.json().catch(() => null);
+    const devices = Array.isArray(body?.devices) ? body.devices : [];
+    const self = devices.find((entry) => entry?.machine_id === machineId) ?? null;
+    if (self === null) {
+      return { ...base, detail: 'the relay answered 200 but does not list this machine' };
+    }
+    const fleetId = typeof self.fleet_id === 'string' && self.fleet_id !== '' ? self.fleet_id : null;
+    if (fleetId === null) {
+      return {
+        ...base,
+        state: 'unbound',
+        code: FLEET_BINDING_CODE.UNBOUND,
+        detail: 'the token is valid, but the relay records this machine with fleet_id=null',
+        remedy: fleetKeyConfigured
+          ? 'a fleet key is configured; the next start re-admits this machine into its fleet'
+          : 'set fleetKey / W2M_FLEET_KEY, then restart the agent so the machine can join its fleet',
+      };
+    }
+    return { ...base, state: 'bound', code: FLEET_BINDING_CODE.BOUND, fleet_id: fleetId };
+  } catch (error) {
+    return {
+      ...base,
+      detail: 'the fleet binding could not be read: ' + (error instanceof Error ? error.message : String(error)),
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/src/plugin/tools.mjs

@@ -1,4 +1,5 @@
 import { FAILOVER_DEFAULTS, createRelayFailover, relayPool } from './relay-failover.mjs';
+import { diagnoseFleetBinding, shouldRejoin } from './fleet-binding.mjs';
 import { DEFAULT_BOOTSTRAP_URL, DEFAULT_BOOTSTRAP_OPERATOR_KEY_PEM } from './bootstrap.mjs';
 /**
  * DSH: Windows2MacO - the DSH Cordis plugin.
@@ -290,7 +291,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '2.0.7';
+const PLUGIN_VERSION = '2.0.9';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -1680,7 +1681,17 @@ async function pushOffer(node, frame, crypto = {}) {
   // no channel at all.
   const dialOptions = session === undefined ? {} : { session };
   try {
-    const dialled = await node.dial(frame.machine_id, dialOptions);
+    let dialled = await node.dial(frame.machine_id, { ...dialOptions, peerKey });
+    if (dialled.ok === true
+      && dialled.reused === true
+      && dialled.channel?.encryption?.encrypted !== true
+      && peerKey !== null
+      && typeof node.dropChannel === 'function') {
+      // A plaintext channel from an earlier reverse dial must not win by reuse: drop it and
+      // immediately redial with the peer key, so this offer gets a real handshake.
+      node.dropChannel(dialled.session);
+      dialled = await node.dial(frame.machine_id, { ...dialOptions, peerKey });
+    }
     if (!dialled.ok) {
       return {
         ok: false,
@@ -4997,6 +5008,13 @@ const result = await request({
       };
       })();
 
+      const fleetBinding = await diagnoseFleetBinding({
+        relayUrl: cfg.rabbitUrl,
+        token: device.device_token,
+        machineId: device.machine_id,
+        fleetKey: cfg.fleetKey,
+      });
+
       return JSON.stringify(
         {
           ok: true,
@@ -5021,6 +5039,7 @@ const result = await request({
           rabbit_source: cfg.rabbitSource,
           rabbit_url: cfg.rabbitUrl,
           p2p: p2pStatus,
+          fleet: fleetBinding,
           rtt,
           config: {
             rabbitUrl: cfg.rabbitUrl,
@@ -5031,6 +5050,7 @@ const result = await request({
             autoStartAgent: cfg.autoStartAgent,
             allowedCommands: cfg.allowedCommands,
             pairingCode_configured: cfg.pairingCode !== null,
+            fleetKey_configured: cfg.fleetKey !== null,
             p2pMode: cfg.p2pMode,
             // The resolved list, shared server first, exactly as the node will query it.
             stunServers: cfg.stunServers,
@@ -8029,6 +8049,18 @@ async function startLocalStack(ctx, cfg) {
             if (identityOptions.identity !== undefined && identityOptions.identity !== null) identityOptions.identity.device_token = null;
             ctx.logger?.warn?.('w2m: stored device token was rejected by ' + relayForToken + ' (HTTP ' + probe.status + '); pairing again with the fleet key');
           }
+          if (alreadyPaired && fleetKeyFromConfig !== null) {
+            const binding = await diagnoseFleetBinding({
+              relayUrl: relayForToken,
+              token: existingToken,
+              machineId: loaded.identity.machine_id,
+              fleetKey: fleetKeyFromConfig,
+            });
+            if (shouldRejoin({ token: existingToken, fleetId: binding.fleet_id, fleetKey: fleetKeyFromConfig })) {
+              alreadyPaired = false;
+              ctx.logger?.warn?.('w2m: FLEET_UNBOUND (token valid, fleet_id=null); re-admitting with the configured fleet key');
+            }
+          }
         } catch { /* network error: keep the token, do not force a re-pair */ }
       }
     }