@twinsearth/w2m-dsh-plugin 2.0.8 → 2.0.10

package/src/agent/transfer/artifact-ref-v3.mjs

@@ -0,0 +1,93 @@
+/**
+ * Optional ArtifactRef v3 (feature-flagged; v2 remains the default on the wire).
+ *
+ * v3 adds an explicit hash algorithm, a Merkle root and a SHA-256 root so a
+ * reader can cross-check the two aggregations. BLAKE3 is not bundled and Node
+ * has no native implementation: when it is unavailable, creation falls back to
+ * SHA-256 and records that decision instead of pretending BLAKE3 was used.
+ */
+import { createHash } from 'node:crypto';
+
+export const REF_V3_VERSION = 3;
+
+export const REF_V3_CODE = Object.freeze({
+  OK: 'REF_V3_OK',
+  BAD_SHAPE: 'REF_V3_BAD_SHAPE',
+  UNSUPPORTED_ALG: 'REF_V3_UNSUPPORTED_ALG',
+  BLAKE3_UNAVAILABLE: 'XFER_BLAKE3_UNAVAILABLE',
+  INCONSISTENT: 'REF_V3_INCONSISTENT',
+});
+
+const sha256 = (buffer) => createHash('sha256').update(buffer).digest();
+const hex64 = (value) => {
+  if (typeof value !== 'string') return null;
+  const raw = value.startsWith('sha256:') ? value.slice('sha256:'.length) : value;
+  return /^[0-9a-f]{64}$/.test(raw) ? raw : null;
+};
+const isHex64 = (value) => hex64(value) !== null;
+
+/**
+ * Merkle root over chunk digests: leaves are the existing 32-byte chunk hashes;
+ * internal nodes are SHA-256(0x01 || left || right); the final root is
+ * SHA-256(0x02 || root). An odd node is promoted, never duplicated.
+ */
+export function merkleRootSha256(chunkHashesHex) {
+  if (!Array.isArray(chunkHashesHex) || chunkHashesHex.length === 0) return null;
+  let level = chunkHashesHex.map((hex) => {
+    if (!isHex64(hex)) throw new TypeError('chunk hash must be 64 lowercase hex characters');
+    return Buffer.from(hex, 'hex');
+  });
+  while (level.length > 1) {
+    const next = [];
+    for (let i = 0; i < level.length; i += 2) {
+      if (i + 1 >= level.length) { next.push(level[i]); continue; }
+      next.push(sha256(Buffer.concat([Buffer.from([0x01]), level[i], level[i + 1]])));
+    }
+    level = next;
+  }
+  return sha256(Buffer.concat([Buffer.from([0x02]), level[0]])).toString('hex');
+}
+
+/**
+ * @param {{rootCid: string, sha256Root: string, merkleRoot: string, hashAlg?: string,
+ *          chunkBytes: number, chunkCount: number, size: number, originPeer?: string|null,
+ *          blake3Available?: boolean}} input
+ * @returns {{ok: true, ref: object} | {ok: false, code: string, detail?: string}}
+ */
+export function createRefV3(input) {
+  const requestedAlg = input?.hashAlg === 'blake3' ? 'blake3' : 'sha256';
+  const effectiveAlg = requestedAlg === 'blake3' && input?.blake3Available !== true ? 'sha256' : requestedAlg;
+  const ref = {
+    version: REF_V3_VERSION,
+    rootCid: hex64(input?.rootCid) ?? input?.rootCid,
+    sha256Root: hex64(input?.sha256Root) ?? input?.sha256Root,
+    merkleRoot: input?.merkleRoot,
+    hashAlg: effectiveAlg,
+    ...(effectiveAlg !== requestedAlg ? { fallbackFrom: requestedAlg } : {}),
+    chunkBytes: input?.chunkBytes,
+    chunkCount: input?.chunkCount,
+    size: input?.size,
+    originPeer: typeof input?.originPeer === 'string' ? input.originPeer : null,
+  };
+  return verifyRefV3(ref, { blake3Available: input?.blake3Available === true });
+}
+
+/**
+ * Validate v3 shape and invariants. A BLAKE3 v3 ref cannot be verified on a
+ * runtime without BLAKE3: that is named, not silently downgraded.
+ */
+export function verifyRefV3(ref, { blake3Available = false } = {}) {
+  if (ref === null || typeof ref !== 'object') return { ok: false, code: REF_V3_CODE.BAD_SHAPE, detail: 'ref must be an object' };
+  if (ref.version !== REF_V3_VERSION) return { ok: false, code: REF_V3_CODE.BAD_SHAPE, detail: 'version must be 3' };
+  if (!isHex64(ref.rootCid) || !isHex64(ref.sha256Root) || !isHex64(ref.merkleRoot)) {
+    return { ok: false, code: REF_V3_CODE.BAD_SHAPE, detail: 'rootCid, sha256Root and merkleRoot must be 64-hex' };
+  }
+  if (ref.hashAlg !== 'sha256' && ref.hashAlg !== 'blake3') return { ok: false, code: REF_V3_CODE.UNSUPPORTED_ALG, detail: String(ref.hashAlg) };
+  if (ref.hashAlg === 'blake3' && blake3Available !== true) return { ok: false, code: REF_V3_CODE.BLAKE3_UNAVAILABLE };
+  for (const name of ['chunkBytes', 'chunkCount', 'size']) {
+    if (!Number.isInteger(ref[name]) || ref[name] < (name === 'size' ? 0 : 1)) return { ok: false, code: REF_V3_CODE.BAD_SHAPE, detail: name };
+  }
+  if (ref.chunkCount !== Math.ceil(ref.size / ref.chunkBytes)) return { ok: false, code: REF_V3_CODE.INCONSISTENT, detail: 'chunkCount != ceil(size/chunkBytes)' };
+  if (ref.hashAlg === 'sha256' && hex64(ref.rootCid) !== hex64(ref.sha256Root)) return { ok: false, code: REF_V3_CODE.INCONSISTENT, detail: 'sha256 rootCid must equal sha256Root' };
+  return { ok: true, code: REF_V3_CODE.OK, ref, effectiveAlg: ref.hashAlg };
+}

package/src/agent/transfer/ferry.mjs

@@ -86,6 +86,9 @@ export function verifyRefV2(ref) {
   if (typeof ref.ref !== 'string' || ref.ref === '') return { ok: false, code: 'ARTIFACT_REF_INVALID' };
   if (typeof ref.rootCid !== 'string' || !ROOT.test(ref.rootCid)) return { ok: false, code: 'ARTIFACT_ROOT_INVALID' };
   if (!Number.isSafeInteger(ref.size) || ref.size < 0 || !Number.isSafeInteger(ref.chunkCount) || ref.chunkCount < 0) return { ok: false, code: 'ARTIFACT_REF_INVALID' };
+  const plan = chunkLengths(ref.size, ref.chunkBytes);
+  if (plan.ok !== true) return plan;
+  if (plan.count !== ref.chunkCount) return { ok: false, code: 'ARTIFACT_REF_INCONSISTENT', detail: { expectedChunks: plan.count, chunkCount: ref.chunkCount } };
   if (typeof ref.originPeer !== 'string' || ref.originPeer === '') return { ok: false, code: 'ARTIFACT_ORIGIN_REQUIRED' };
   return { ok: true };
 }
@@ -165,7 +168,7 @@ export function createReceiver({ stateDir, sinkRoot, ref, destination, chunkByte
       if (buf.length !== range.length) return { ok: false, code: 'XFER_CHUNK_LENGTH_INVALID', detail: { expected: range.length, got: buf.length } };
       const digest = sha256(buf);
       if (typeof expectedSha256 !== 'string' || expectedSha256 !== digest) return { ok: false, code: 'XFER_CHUNK_HASH_MISMATCH', retry: index };
-      if (bitmap.hashes[index] !== null && bitmap.hashes[index] !== digest) return { ok: false, code: 'XFER_CHUNK_CONFLICT' };
+      if (bitmap.hashes[index] !== null && bitmap.hashes[index] !== digest) return { ok: false, code: 'XFER_CHUNK_CONFLICT', recoverable: true, retry: index };
       if (bitmap.hashes[index] === digest) return { ok: true, duplicate: true, index };
       const fd = openSync(partPath, 'r+');
       try { writeSync(fd, buf, 0, buf.length, range.offset); } finally { closeSync(fd); }
@@ -187,6 +190,14 @@ export function createReceiver({ stateDir, sinkRoot, ref, destination, chunkByte
       try { writeFileSync(join(dir, 'done.json'), JSON.stringify({ transferId, rootCid, size: bitmap.size, path: target, at: new Date().toISOString() }), { encoding: 'utf8', mode: 0o600 }); } catch { /* receipt is best effort */ }
       return { ok: true, path: target, verified: true, bytes: bitmap.size, transferId };
     },
+    /** Explicit recovery for a conflicting source: drop the claimed block so a correct source can win. */
+    evictChunk(index) {
+      if (!Number.isInteger(index) || index < 0 || index >= bitmap.chunkCount) return { ok: false, code: 'XFER_CHUNK_INDEX_INVALID' };
+      if (bitmap.hashes[index] === null) return { ok: true, index, alreadyMissing: true };
+      bitmap.hashes[index] = null;
+      save();
+      return { ok: true, index, evicted: true };
+    },
     /** 远端 P2P 拉取尚未接线：显式失败，不回落 relay。 */
     async pullFrom(originPeer) {
       return { ok: false, code: 'P2P_UNAVAILABLE', detail: { originPeer, why: 'want-block transport is a later slice; relay fallback is forbidden' } };

package/src/agent/transfer/router.mjs

@@ -0,0 +1,80 @@
+/**
+ * P0-a: route `xfer.*` frames that arrive on a real P2PChannel.
+ *
+ * The router owns no transport: it is handed the frame and a channel, and it
+ * uses the existing chunk source/client primitives. Registering a source or a
+ * receiver is explicit, so an unregistered frame is dropped (never guessed).
+ * One listener per channel is the caller's job; this router never attaches one.
+ */
+import { createChunkSource, createWantClient } from './want-block.mjs';
+
+export function createXferFrameRouter() {
+  const sources = new Map();    // rootCid -> { chunked, filePath, transferId, source }
+  const receivers = new Map();  // transferId -> { receiver, client }
+
+  const parse = (payload) => {
+    if (Buffer.isBuffer(payload) || typeof payload === 'string') {
+      try { return JSON.parse(Buffer.from(payload).toString('utf8')); } catch { return null; }
+    }
+    return payload !== null && typeof payload === 'object' ? payload : null;
+  };
+
+  return {
+    registerSource(rootCid, { chunked, filePath, transferId = null } = {}) {
+      if (typeof rootCid !== 'string' || rootCid === '') return { ok: false, code: 'XFER_ROOT_INVALID' };
+      sources.set(rootCid, { chunked, filePath, transferId, source: null, sourceTransferId: null });
+      return { ok: true };
+    },
+    registerReceiver(transferId, receiver, rootCid) {
+      if (typeof transferId !== 'string' || transferId === '') return { ok: false, code: 'XFER_TRANSFER_INVALID' };
+      const client = createWantClient({ transferId, rootCid, receiver });
+      if (client.ok !== true) return client;
+      receivers.set(transferId, { receiver, client });
+      return { ok: true };
+    },
+    unregister(rootCid) { sources.delete(rootCid); },
+    has(rootCid) { return sources.has(rootCid); },
+    /** Send the next want window for a registered receiver over a channel. */
+    request(transferId, channel) {
+      const entry = receivers.get(transferId);
+      if (entry === undefined || typeof channel?.send !== 'function') return { ok: false, code: 'XFER_RECEIVER_UNKNOWN' };
+      const missing = entry.client.missing();
+      if (missing.length === 0) return { ok: true, requested: 0 };
+      const frames = entry.client.requestFrames(missing);
+      for (const frame of frames) channel.send(JSON.stringify(frame));
+      return { ok: true, requested: missing.length };
+    },
+    /**
+     * @returns {boolean} true when the frame belonged to this layer (handled or refused)
+     */
+    handle(payload, { channel } = {}) {
+      const frame = parse(payload);
+      if (frame === null || typeof frame.type !== 'string' || !frame.type.startsWith('xfer.')) return false;
+      if (typeof channel?.send !== 'function') return true;
+      if (frame.type === 'xfer.want') {
+        const entry = sources.get(frame.rootCid) ?? sources.get(frame.transferId);
+        if (entry === undefined) return true; // unknown source: drop, do not leak why
+        if (entry.source === null || entry.sourceTransferId !== frame.transferId) {
+          entry.source = createChunkSource({ chunked: entry.chunked, filePath: entry.filePath, transferId: frame.transferId });
+          entry.sourceTransferId = frame.transferId;
+        }
+        const served = entry.source.handle(frame);
+        if (served.ok !== true) { channel.send(JSON.stringify({ type: 'xfer.error', transferId: frame.transferId, code: served.code })); return true; }
+        for (const outgoing of served.frames) channel.send(JSON.stringify(outgoing));
+        return true;
+      }
+      if (frame.type === 'xfer.chunk') {
+        const entry = receivers.get(frame.transferId);
+        if (entry === undefined) return true;
+        entry.receiver.writeChunk(frame.index, Buffer.from(String(frame.data), 'base64'), frame.sha256);
+        return true;
+      }
+      if (frame.type === 'xfer.error') {
+        const entry = receivers.get(frame.transferId);
+        if (entry !== undefined) entry.lastError = frame.code ?? 'XFER_PEER_ERROR';
+        return true;
+      }
+      return true;
+    },
+  };
+}

package/src/agent/transfer/want-block.mjs

@@ -87,3 +87,49 @@ export function verifyChunkFrame(frame) {
   if (digest !== frame.sha256) return { ok: false, code: 'XFER_CHUNK_HASH_MISMATCH' };
   return { ok: true, data };
 }
+
+
+/**
+ * P0-a: run the chunk source over a MessageChannel (P2PChannel / iroh sidecar)
+ * instead of a bare dgram socket. Frames stay JSON for wire compatibility; the
+ * channel supplies encryption, ACK and fragmentation.
+ */
+export function attachChunkSource(channel, { chunked, filePath, transferId = null }) {
+  const source = createChunkSource({ chunked, filePath, transferId });
+  if (source.ok !== true) return source;
+  const handler = (payload) => {
+    let frame = null;
+    try { frame = JSON.parse(Buffer.from(payload).toString('utf8')); } catch { return; }
+    const served = source.handle(frame);
+    if (served.ok !== true) { channel.send(JSON.stringify({ type: ERROR, transferId: frame?.transferId ?? null, code: served.code })); return; }
+    for (const outgoing of served.frames) channel.send(JSON.stringify(outgoing));
+  };
+  channel.on('message', handler);
+  return { ok: true, close: () => channel.off?.('message', handler) };
+}
+
+/**
+ * P0-a: receiver side over a MessageChannel. request() sends the next window;
+ * inbound chunk frames are validated and written exactly as in the UDP path.
+ */
+export function attachWantClient(channel, { transferId, rootCid, receiver }) {
+  const client = createWantClient({ transferId, rootCid, receiver });
+  if (client.ok !== true) return client;
+  const handler = (payload) => {
+    let frame = null;
+    try { frame = JSON.parse(Buffer.from(payload).toString('utf8')); } catch { return; }
+    client.accept(frame);
+  };
+  channel.on('message', handler);
+  return {
+    ok: true,
+    client,
+    request() {
+      const missing = client.missing();
+      if (missing.length === 0) return 0;
+      channel.send(JSON.stringify(client.requestFrames(missing)[0]));
+      return missing.length;
+    },
+    close: () => channel.off?.('message', handler),
+  };
+}

package/src/agent/transport.mjs

@@ -0,0 +1,146 @@
+/**
+ * W0: P2PTransport contract + the udp-v1 implementation.
+ *
+ * This is the seam a second stack (iroh-v1) will plug into. It is deliberately
+ * thin: it owns no protocol logic, only the shape the scheduler talks to.
+ * Nothing wires it into the agent yet, so behaviour of v2.0.8 is unchanged.
+ */
+
+export const TRANSPORT = Object.freeze({
+  UDP: 'udp-v1',
+  IROH: 'iroh-v1',
+});
+
+export const TRANSPORT_DEFAULT = Object.freeze(['udp']);
+
+export const TRANSPORT_CODE = Object.freeze({
+  OK: 'TRANSPORT_OK',
+  UNAVAILABLE: 'TRANSPORT_UNAVAILABLE',
+  BAD_SHAPE: 'TRANSPORT_BAD_SHAPE',
+  CLOSED: 'TRANSPORT_CLOSED',
+  UNKNOWN: 'TRANSPORT_UNKNOWN',
+});
+
+/**
+ * Validate the pieces a transport must expose. Returns a named refusal instead
+ * of throwing so a registry can skip a broken transport without losing the rest.
+ */
+export function assertTransportShape(transport) {
+  if (transport === null || typeof transport !== 'object') return { ok: false, code: TRANSPORT_CODE.BAD_SHAPE, detail: 'transport must be an object' };
+  for (const name of ['name', 'start', 'stop', 'send', 'onMessage', 'paths', 'diagnostics']) {
+    if (name === 'name' ? typeof transport.name !== 'string' : typeof transport[name] !== 'function') {
+      return { ok: false, code: TRANSPORT_CODE.BAD_SHAPE, detail: 'missing ' + name };
+    }
+  }
+  return { ok: true };
+}
+
+/**
+ * Resolve the configured transport list without ever inventing one.
+ * Unknown names are dropped and reported; `udp` is always kept as the fallback.
+ */
+export function resolveTransports(config = {}) {
+  const requested = Array.isArray(config.transports) ? config.transports.filter((name) => typeof name === 'string') : TRANSPORT_DEFAULT;
+  const known = new Set(Object.values(TRANSPORT));
+  const accepted = [];
+  const refused = [];
+  for (const name of requested) {
+    if (!known.has(name)) { refused.push({ name, code: TRANSPORT_CODE.UNKNOWN }); continue; }
+    if (!accepted.includes(name)) accepted.push(name);
+  }
+  if (!accepted.includes(TRANSPORT.UDP)) accepted.push(TRANSPORT.UDP);
+  return { ok: true, transports: accepted, refused };
+}
+
+/**
+ * Wrap a P2PNode-like object as udp-v1.
+ *
+ * The node is expected to expose `dial(machineId)` (returns {ok, channel}),
+ * `status()` and optionally `close()`. Channels expose `send`, `on`, `close`.
+ * This adapter caches one channel per peer so send() is not a dial per frame.
+ */
+export function createUdpTransport({ node, name = TRANSPORT.UDP } = {}) {
+  if (node === null || typeof node !== 'object' || typeof node.dial !== 'function') {
+    return { ok: false, code: TRANSPORT_CODE.BAD_SHAPE, detail: 'createUdpTransport needs a node with dial()' };
+  }
+  const channels = new Map();
+  const handlers = new Set();
+  let closed = false;
+
+  const attach = (peer, channel) => {
+    channel.on?.('message', (payload) => {
+      for (const handler of handlers) handler({ peer, payload });
+    });
+    channel.on?.('close', () => channels.delete(peer));
+  };
+
+  const transport = {
+    name,
+    async start() {
+      closed = false;
+      return { ok: true, name };
+    },
+    async stop() {
+      closed = true;
+      for (const channel of channels.values()) channel.close?.();
+      channels.clear();
+      node.close?.();
+      return { ok: true };
+    },
+    async send(peer, payload) {
+      if (closed) return { ok: false, code: TRANSPORT_CODE.CLOSED };
+      let channel = channels.get(peer) ?? null;
+      if (channel === null) {
+        const dialled = await node.dial(peer);
+        if (dialled?.ok !== true) return { ok: false, code: dialled?.code ?? 'UDP_DIAL_FAILED', detail: dialled?.error ?? null };
+        channel = dialled.channel;
+        channels.set(peer, channel);
+        attach(peer, channel);
+      }
+      await channel.send(payload);
+      return { ok: true, peer };
+    },
+    onMessage(handler) {
+      if (typeof handler !== 'function') return () => {};
+      handlers.add(handler);
+      return () => handlers.delete(handler);
+    },
+    paths() {
+      const status = typeof node.status === 'function' ? node.status() : null;
+      return Array.isArray(status?.candidates) ? status.candidates.map((candidate) => ({ ...candidate, transport: name })) : [];
+    },
+    diagnostics() {
+      const status = typeof node.status === 'function' ? node.status() : null;
+      return {
+        name,
+        closed,
+        channels: channels.size,
+        encryption: status?.encryption ?? null,
+        last_error: status?.last_error ?? null,
+      };
+    },
+  };
+  return { ok: true, transport };
+}
+
+/**
+ * Registry: the only object the backend layer will need to talk to later.
+ * It keeps a default and can report every registered transport's diagnostics.
+ */
+export function createTransportRegistry({ transports = [], defaultName = TRANSPORT.UDP } = {}) {
+  const byName = new Map();
+  const refused = [];
+  for (const transport of transports) {
+    const shape = assertTransportShape(transport);
+    if (shape.ok !== true) { refused.push({ transport: transport?.name ?? null, code: shape.code, detail: shape.detail }); continue; }
+    byName.set(transport.name, transport);
+  }
+  return {
+    ok: true,
+    refused,
+    names: [...byName.keys()],
+    get(name) { return byName.get(name) ?? null; },
+    defaultTransport() { return byName.get(defaultName) ?? byName.get(TRANSPORT.UDP) ?? null; },
+    diagnostics() { return [...byName.values()].map((transport) => transport.diagnostics()); },
+  };
+}

package/src/plugin/tools.mjs

@@ -1,4 +1,4 @@
-import { FAILOVER_DEFAULTS, createRelayFailover, relayPool } from './relay-failover.mjs';
+import { FAILOVER_DEFAULTS, createRelayFailover, relayPool } from './relay-failover.mjs';
 import { diagnoseFleetBinding, shouldRejoin } from './fleet-binding.mjs';
 import { DEFAULT_BOOTSTRAP_URL, DEFAULT_BOOTSTRAP_OPERATOR_KEY_PEM } from './bootstrap.mjs';
 /**
@@ -291,7 +291,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '2.0.8';
+const PLUGIN_VERSION = '2.0.10';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -1681,7 +1681,17 @@ async function pushOffer(node, frame, crypto = {}) {
   // no channel at all.
   const dialOptions = session === undefined ? {} : { session };
   try {
-    const dialled = await node.dial(frame.machine_id, dialOptions);
+    let dialled = await node.dial(frame.machine_id, { ...dialOptions, peerKey });
+    if (dialled.ok === true
+      && dialled.reused === true
+      && dialled.channel?.encryption?.encrypted !== true
+      && peerKey !== null
+      && typeof node.dropChannel === 'function') {
+      // A plaintext channel from an earlier reverse dial must not win by reuse: drop it and
+      // immediately redial with the peer key, so this offer gets a real handshake.
+      node.dropChannel(dialled.session);
+      dialled = await node.dial(frame.machine_id, { ...dialOptions, peerKey });
+    }
     if (!dialled.ok) {
       return {
         ok: false,
@@ -4998,13 +5008,13 @@ const result = await request({
       };
       })();
 
-      const fleetBinding = await diagnoseFleetBinding({
-        relayUrl: cfg.rabbitUrl,
-        token: device.device_token,
-        machineId: device.machine_id,
-        fleetKey: cfg.fleetKey,
-      });
-
+      const fleetBinding = await diagnoseFleetBinding({
+        relayUrl: cfg.rabbitUrl,
+        token: device.device_token,
+        machineId: device.machine_id,
+        fleetKey: cfg.fleetKey,
+      });
+
       return JSON.stringify(
         {
           ok: true,
@@ -5028,8 +5038,8 @@ const result = await request({
            */
           rabbit_source: cfg.rabbitSource,
           rabbit_url: cfg.rabbitUrl,
-          p2p: p2pStatus,
-          fleet: fleetBinding,
+          p2p: p2pStatus,
+          fleet: fleetBinding,
           rtt,
           config: {
             rabbitUrl: cfg.rabbitUrl,
@@ -5039,7 +5049,7 @@ const result = await request({
             projectDir: cfg.projectDir,
             autoStartAgent: cfg.autoStartAgent,
             allowedCommands: cfg.allowedCommands,
-            pairingCode_configured: cfg.pairingCode !== null,
+            pairingCode_configured: cfg.pairingCode !== null,
             fleetKey_configured: cfg.fleetKey !== null,
             p2pMode: cfg.p2pMode,
             // The resolved list, shared server first, exactly as the node will query it.
@@ -8039,18 +8049,18 @@ async function startLocalStack(ctx, cfg) {
             if (identityOptions.identity !== undefined && identityOptions.identity !== null) identityOptions.identity.device_token = null;
             ctx.logger?.warn?.('w2m: stored device token was rejected by ' + relayForToken + ' (HTTP ' + probe.status + '); pairing again with the fleet key');
           }
-          if (alreadyPaired && fleetKeyFromConfig !== null) {
-            const binding = await diagnoseFleetBinding({
-              relayUrl: relayForToken,
-              token: existingToken,
-              machineId: loaded.identity.machine_id,
-              fleetKey: fleetKeyFromConfig,
-            });
-            if (shouldRejoin({ token: existingToken, fleetId: binding.fleet_id, fleetKey: fleetKeyFromConfig })) {
-              alreadyPaired = false;
-              ctx.logger?.warn?.('w2m: FLEET_UNBOUND (token valid, fleet_id=null); re-admitting with the configured fleet key');
-            }
-          }
+          if (alreadyPaired && fleetKeyFromConfig !== null) {
+            const binding = await diagnoseFleetBinding({
+              relayUrl: relayForToken,
+              token: existingToken,
+              machineId: loaded.identity.machine_id,
+              fleetKey: fleetKeyFromConfig,
+            });
+            if (shouldRejoin({ token: existingToken, fleetId: binding.fleet_id, fleetKey: fleetKeyFromConfig })) {
+              alreadyPaired = false;
+              ctx.logger?.warn?.('w2m: FLEET_UNBOUND (token valid, fleet_id=null); re-admitting with the configured fleet key');
+            }
+          }
         } catch { /* network error: keep the token, do not force a re-pair */ }
       }
     }