deadbyte-mcp 0.10.0 → 0.11.0

package/MANIFEST.SHA256

@@ -1,48 +1,48 @@
 561e5298904c144a3fdb7a6789c46f2fe48a16d6ad36d4bd6dac32e443c57450  bench/fixtures/corpus.json
 ebd5b3524b57c0227eae6d30291809d901ff99626b0b3f394da2560a054eae59  bench/fixtures/r36/case-map.json
-1a8348efb674407d180448a50035b08bfa7bf5455a12f38ddf8c9e10ce99dd2d  bin/appcontainer-stage.exe
-ce93ed4619655b423ca2601971e91275696ad050776dfd839472666abfaace77  bin/appcontainer-stage.obj
-f2bc3f30910ab52bdc1742b43eb01e839bc36ba3eed84109149abb341b8a46c5  bin/bootstrap-advapi32.exe
-16338ed8918bba0ddc6e71722f178a57d064157800ffe8b6f1508362066dc9b8  bin/bootstrap-advapi32.obj
-16bc60c788a9480ac0201bd09eb906f5a9001ad79e0f75c809de76612940199d  bin/bootstrap-exitcode.exe
-c88eb16509b609cd532149dc9a8e870a80f4433aefc41d6a1885a3932cb0f288  bin/bootstrap-exitcode.obj
-04f6a701f3418433d4a9475b0ba03edd0038d534abd2f938c0e4e0198673d8bb  bin/bootstrap-kernel32.exe
-a76f4c799a2bb7468048846987d6691138f0c6b0e8d710569a78231629186d9b  bin/bootstrap-kernel32.obj
-b93067e7fcced79f28c43223666282aa7f6648e308f642d1062526689df1e401  bin/child-control-probe.exe
-5872c5aee6359ede72ddda785febc4587b8ec3e8dd8e0ad57e25c6343be946db  bin/child-control-probe.obj
-b4e22b560ab30992b61f474bee3dbba3ef1b038f466bfff10ef2be69feb1dd13  bin/child-control-stage.exe
-75634114899115b60b22a5a47eea00b5d0dcd8a7618c24fd19f7cf7c535103f8  bin/child-control-stage.obj
-9f046b30847c63ac157ffbd2a4c1d8b26da0776bee635ad3f9481775dcf5becc  bin/contained-reverse-worker.exe
-466acb0b9dfa73ebf15304a7d302b9fb973be7d4d497b7e2a426e34bbfcde7de  bin/contained-reverse-worker.obj
-60b1e2c026a097655d13a719fdf354cc7487166a10316416923eaee876568b00  bin/contained-transform-worker.exe
-701bee9d7df7461cc3bcfb8ee2cdb1abdfd2e5a1d432f84a5a9a172999c8dbc3  bin/contained-transform-worker.obj
-8b9e13c9b392687e0c6a4ea2129a67e8b4f0eb5c9112efee7baebee200a55bcd  bin/containment-probe.exe
-7c63799ec0d9ea940d4baadff0c448fd44b263bbcccf02c5673ed031706e8cf0  bin/containment-probe.obj
-6b1d7dc71feb1ff859a6e47bdb55ac79264242dd1836fe7487585635a650e24e  bin/deadbyte-contain.exe
-6ba93f9a3da3e82e699bfb3a5108d02430b96372c432cec681ef715c145665ba  bin/deadbyte-contain.obj
-0a942a9141d637c016384adfcc285db7c58cffbddba677ab500e8a58554233ff  bin/deadbyte-exec.exe
-2f7f08efc566b5a651ab3917c118a9e0bd80cc23f1b60300030305d2a5ac729b  bin/deadbyte-exec.obj
-d37cb084bfd316d8448f2381a915402c61bb306ff8a5721e4b4a364ab192748b  bin/deadbyte-process-host.exe
-4fe5abb0ab1e7c3d72c31e42b4319ce8806cdf6714977ec844527e4fd3010a57  bin/deadbyte-process-host.obj
-d9acacfc5ff297ca2103bb7bbf8cc694e8c60477789b042a7f23d591e8ce4439  bin/deadbyte-tunnel-host.exe
-11abe39118eb2b10e7e22bbb8b26463f668494181a2fac51144eba44e6d4097f  bin/deadbyte-tunnel-host.obj
-914422a7c372fc0c064ad617a6bfcfb6fdcdc4b657e6117633e0e4c4ea38fac4  bin/WORKER-REGISTRY.txt
+634add3b9ec2a814365287ebebf4c1c0428b219160ec33e519f148b4ca0d8081  bin/appcontainer-stage.exe
+f2a74024991ea1f1e2348bcc78de59066245bef86a406ffcae003c238b991c3b  bin/appcontainer-stage.obj
+2e71a6c0aced6b4577d79b66d353307181f77b77c35d5d3b08baaef4b6c0591e  bin/bootstrap-advapi32.exe
+ac2aa6756b77b7e3111dbc286624013927d396178dfcda81b62e0cd24163dad6  bin/bootstrap-advapi32.obj
+14da909c458634ff43d758132a310f6e7094d988129767e1a9fe814b8cf52fcc  bin/bootstrap-exitcode.exe
+d2c542db3d08017d47ba05386120eba9824cc1443572aeeb608dcccea55a5f57  bin/bootstrap-exitcode.obj
+619c9ee0b2450d1400e7b11d9784d66a6c2a99ea7f150856e0eb8d3f22a52dfa  bin/bootstrap-kernel32.exe
+584b71379f8c80ad274bd2cb114d14a9b43b7da69e3233d21d7b0dd39831da13  bin/bootstrap-kernel32.obj
+d105f2d443ae6c9c5248d45168f53ca4b7791d39958e23bf137fbbe025720237  bin/child-control-probe.exe
+fc2f89683585427facd36b0bdd0e88a2a49b1c6c59add0a896cdcfcf7d4ac9b3  bin/child-control-probe.obj
+49dc13bb0987e200d8bfe88a4b0671bb883f260433e364bad4d427a76617d7c4  bin/child-control-stage.exe
+ddce17cfd8b6a7adc9754da4ceb88ed7b8bad0f534d327d1fff7430520247898  bin/child-control-stage.obj
+9f3754c3c6fe71d6fe0e04889e33b39cdc64b633e0b713d5979faec748dec69d  bin/contained-reverse-worker.exe
+3e87b49ec2a0e67d73b601f51b06dccc70f789b2ef56ca8e2fe0e2c629fb7149  bin/contained-reverse-worker.obj
+01528ffe61736cdb5010396f4b1c52203c7e1848b3aeb4181a0c04a508e1da30  bin/contained-transform-worker.exe
+94416cbfc5a4163fccee000daba4df9a97d400b297488d85f547afa98ca94420  bin/contained-transform-worker.obj
+069c555b87d075468917fb692c13bf63904c4ccf07be3ca21647526594170390  bin/containment-probe.exe
+9d445ffb63dbaa82f1c7239a6e87fb35cd939fca0022462c19ddc60f7daa7113  bin/containment-probe.obj
+e8f2f70132d81fa46e56aa58a1d1c78db88554959364acd72e5b1512a3717ebe  bin/deadbyte-contain.exe
+db2425583845cb5eb78b2888a8a50978860c5ae19a38723b1bab19f47991cbef  bin/deadbyte-contain.obj
+a84168020dee3bb5d63d97b1076523232872bf142859c07bfcb77a45428a1ce5  bin/deadbyte-exec.exe
+fa44146c227d2fd704ea0481c9800af1b7c7cb80048055afcffcc8c4adfc9b9b  bin/deadbyte-exec.obj
+8c79f30e834daf2f0a916928bc719abf27ba111f446056bf2993c84d0432747a  bin/deadbyte-process-host.exe
+bb6f237bf6984e81ee66db28ac91e8ab116d7db22b5bef1be78a2b9dc0192878  bin/deadbyte-process-host.obj
+c6a39124ba8b043d4e91a2a0511b2a7bb22f8c526e323afc33b827d4de062034  bin/deadbyte-tunnel-host.exe
+3fb93dd45d28479845cb4598513dc6c80badef26d4d53c39fb234494c87a0522  bin/deadbyte-tunnel-host.obj
+cf6ebd8ae2ca2649655ae81196ac9296d713dbfdd10d8ff0757269d088294f06  bin/WORKER-REGISTRY.txt
 e74d45bd9facf03c9a2a0ff52600252924deb804a87e4b5503f48662a2b45a3b  conpty-input-observer.obj
 8c1c45dd47e07b05eb2b43a6060ac23ecb9f7d0dd8aecfdfc29d42a6f824e507  CONTEXT.md
 e19ff4253eb57ea6befd5df8b807c1c95fda83bfebd0ba871ceae7c5412d4c27  controller/deadbyte-controller.config.psd1.example
-b724fa77a1abfd9b08091e2751f7d0143dcb2d59032b18efc40edff38c5def80  controller/deadbyte-controller.ps1
+58dadf326b8bc7bcf51b82cfac65fb11e14c54f13ee5bae7442407855c7616dd  controller/deadbyte-controller.ps1
 5e8ef223b0dbc52173aaf044a075837eef8964ff0e7e16f83a595e0d17695625  controller/deadbyte-host-policy.json.example
 6f0cc469f51444dd18211fa3346c826abeea4d2ec7a8945f0200dc5c622031ef  controller/DEADBYTE-MCP.cmd
-5c7e5ced412dc9f8532a715c7764146fe0d802130c6e47810a8d7c64fdb09433  controller/deadbyte-process-policy.json
+5c98a2942737c34580b9c6e7fa0e95615389895dd327b7523e18e41628a09bf3  controller/deadbyte-process-policy.json
 d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b  controller/deadbyte-semantic-lsp-config.json
-8b82268c8756c377c5d4f01cc0ae443736c1d15eba1604af1e3af2e70314bb84  controller/README.TXT
+9f1602b5c76b1c9036e5a907eebc0d384e07b32bc03e27ce472ecac6bec34955  controller/README.TXT
 101e613518c73c6aa31c725fe1b5f9a24c995dc9876b7b28e1f3e97ac9f8d362  DEADBYTE-MCP-R27-FINAL/R27-ADMIN-CLOSURE.json
 e9baf9abf4410ff8bd0f68e6b957dbbf9790fc88d9126311c5c135e943424952  DEADBYTE-MCP-R27-FINAL/R27-CLEANUP-FINAL-RECEIPT.json
 39cb483c0897af5027bf1790a35a4c3b9a8cd5f6e3a2e0440787615f69cd14b2  DEADBYTE-MCP-R27-FINAL/R27-FINAL-CLOSURE.json
 9aaf6d07e7511a1f0046ee8cc731d4b9660bbbf47dcea785a9c6b6cec95640bc  DEADBYTE-MCP-R27-FINAL/R27-SLOT-UPDATE-RECEIPT.json
 70dfccba12797ce5fea60668c97026cf71e7942cb4d886cac5853e05b362b6c1  DEADBYTE-MCP.cmd
 7994082e4340b5f43272e8cb111ce54043af64dc3a04d5279e251f3dae16f654  docs/ADR-0001-PRODUCTION-BASELINE-SEAMS.md
-ed66d7dbc600daf15c622cfcc076748c3e9efddbe08e5a6d552cf4f3d8f9ab71  docs/ARCHITECTURE.md
+2c25f91727682d060c28c49ef179fe7fac3baef0a7f47e6591fab632d2684416  docs/ARCHITECTURE.md
 3f455f407933d8e044682f3415bdb51e68d7c4b508411dda7d8ed65b6e1d7e79  docs/AUTHORITY.md
 3be291331862ac5bd892345e84d6ce8d9b6d835855235d7c5f28d5cd4b04afdb  docs/CHILD-CONTROL.md
 a9cbd1e2def00aae93569835f2ee17aa5cfd181e5770d7c1185c9c62deb0769e  docs/CONSTRUCTION-LADDER.md
@@ -1303,7 +1303,7 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-91a1183e5b8b84ef768a57878790d8a1f8be456630cf407593ee3ecd4ffca5f2  package.json
+9dfddaee8fadcddb22b598dd18aeadae20d5fee63b7bfd126bd1cb16952aeb9e  package.json
 5a2722b8b5b16a2b5af9851638851c82c8f795bf4685f1090745ebbe61498c91  proof/CONTAINMENT-BUILD.txt
 a8efa13e44ff50902aee64cfca542d19605a1ae23db95280ad2d44b324f3eae7  proof/MCP-SMOKE-STATUS.txt
 7c115069cc4a343ca21b0ebdee74bd8f544b02d4aa906ffa13308725825d891a  proof/NODE-SYNTAX.txt
@@ -1364,27 +1364,33 @@ bd0773a9e02e8ab11475c9cc5a7db29a8313233b7eab7f837922737e75ec5938  proof/VERIFY.t
 2c821808d4596965c577f40191daee224d3aea81989778c4af97f53a83b487db  proof/WINDOWS-CONTAINED-STATUS.txt
 f8bc839c7b4fcb0ea7b7e7ad9448847c3beae6f95f2eb4d407d1b284aaa4ff68  proof/WINDOWS-CONTAINMENT-STATUS.txt
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
-37f06cee7d844b880df4bdd03caebfbd1e05bbd66a09890fa6b0a7a6d028198c  README.txt
+6739a5a12146ffe74c80f0dd845176c45aecc0ecf0af4cebc756d8c5cd04b4c4  README.txt
 1d4e9dee6f0669bd825334a6a72e13ee85ee29ab430dcef21d893ffd744774b5  scripts/autonomous-benchmark.mjs
 06447dea18be1fa0a5e5a1167a6e3dcbd10ddfd28dd18d7bfd17383cf5bfc080  scripts/autonomous-build.ps1
 6ae23099102eb0f0be4969598ba76600d19b00abf534a039d48e63bc7d7fffe3  scripts/autonomous-tests.ps1
 1d987d12c5af6ffbaec1fe2f95aadc4740fe25933c0f0941f362daa2d2d84f48  scripts/build-containment.ps1
 1077e2f4baf2aae1c0d3e2416d00bd49a54e9e39a5939872c73143ca9e546633  scripts/capability-benchmark.mjs
 7d3c741de2b1c29f82efa96ab81fc819d8520f97413ce5ab0d4a1b1efd0e8b42  scripts/coding-live-smoke.mjs
-3aca3e98b332130a15c636fb3cc39e8cf115182bb4a348a5f0edf5520fd0196a  scripts/deferred-slot-operation.mjs
-4b895f85e2bf7009def5ecb0a96dad38832c6fac3b2a0633a6b71d9ac9a868be  scripts/final-closure-verify.mjs
-69e3beb55573b5fc3ba30a220fabf9e3585e7757430fb3264caf27e41254b789  scripts/final-closure.mjs
-feaecfaf78ebf20a42b17974a81777185b74344bc4717f00fde69b5e66ac3257  scripts/gate-windows.ps1
+254872f5f1f2fa662b1061aad4c3da59b21d882e45f7f0ceefff2f688ea493a1  scripts/deferred-slot-operation.mjs
+69e3beb55573b5fc3ba30a220fabf9e3585e7757430fb3264caf27e41254b789  scripts/final-closure-r36.mjs
+4b895f85e2bf7009def5ecb0a96dad38832c6fac3b2a0633a6b71d9ac9a868be  scripts/final-closure-verify-r36.mjs
+c6cbbfe7ea3e4c257c419535425a9f75e4d58f2d5cb18f2f408b871f1c7c20a8  scripts/final-closure-verify.mjs
+4b7dce462db12237e9f3bb8637e703689140c16e5ddd8bf08b41f8a4b35de95d  scripts/final-closure.mjs
+feaecfaf78ebf20a42b17974a81777185b74344bc4717f00fde69b5e66ac3257  scripts/gate-windows-r36.ps1
+75931dbb30e7d5b07bf781481849c7a583c7fe7250ac2e5d43a83e9c4764569b  scripts/gate-windows.ps1
 a64ab9a70c26495ac5d94c024a8813d8bd2bc8a708f236b672cb18556396c262  scripts/init-host-policy.ps1
 b655f2f9c63c7e4b651e7182c6461f9ec63d0991f770f24fe5d44b209ad6bdfb  scripts/refresh-process-policy.mjs
 c92b518b7232849d945f0fcd9c428a2366758e5c9410be68104ed50ef869a33e  scripts/release-manifest.mjs
-313c7288f07b05d08d71a2da19a28f4466dbb089eb6024d0286e4a11bee1199f  scripts/release-parity-tests.ps1
-2272ceab04fba9030fe3dad5ccb14b8313f7dea963873ca64a86945608b6e7fb  scripts/release-parity.mjs
+2272ceab04fba9030fe3dad5ccb14b8313f7dea963873ca64a86945608b6e7fb  scripts/release-parity-r36.mjs
+9e755d89732353136c560deb1a9dde45468c6a10ee00b096318f13cf638b8f24  scripts/release-parity-tests.ps1
+bb03b8645718c52f7e195703d88caf284c6bdb4459e35bc2ff67ed7dcc7ebcfb  scripts/release-parity.mjs
 caac2867971dfdf56456528b816ff56282a11cbba81510c13e1723accffac678  scripts/runtime-self-update.mjs
 b0cc75c38e0163dbcf7fb1b0d21f2dc34c71f2d0e2a156a53e570ff84afc64e6  scripts/semantic-preflight.ps1
 0a115aa9829576c86cc247f754cae69ae09ba146b637d3a1c9fbc16420d20a5d  scripts/tool-surface-snapshot.mjs
-eb59d412712270bedc33bcdabd65fe9c31994339858a4947d0dc4bac371256fc  scripts/windows-gate-evidence.mjs
+eb59d412712270bedc33bcdabd65fe9c31994339858a4947d0dc4bac371256fc  scripts/windows-gate-evidence-r36.mjs
+ea68d948b9e3bf155b7782b5745d75d98c142a199785ba52840aff7d2272ea17  scripts/windows-gate-evidence.mjs
 5f4a73a1c3dc178c4b5de193b6cfc4774cfc46d5ad95ef0b786d4d386d82323b  src/agent-mcp-tools.mjs
+22d32373fdaceb7debae300ec4db2f3b1677072e946a203acff6f5e4dc458946  src/agent-memory-plane.mjs
 5cca555943318990ae8dc82481ab0d172e813261c71b541cc99114f411b040fa  src/agent-runtime.mjs
 0e2d1cdcc5e592ffe36e32fa6da68d84e00f992ca3a189b7a3735d8bbac476a6  src/audit-context.mjs
 cdbca84e760777e939fd813a16152318271b5cbf64e02d30921f24e1f6f59bff  src/audit-verify.mjs
@@ -1395,15 +1401,16 @@ cdbca84e760777e939fd813a16152318271b5cbf64e02d30921f24e1f6f59bff  src/audit-veri
 ab0158c3f6e270ee367ae96455dd2b75a902c808b2a10ac2c5b75fdda00be6c3  src/autonomous-local-supervisor.mjs
 f8aea762270181bfb38c15e52328357c1fbc4156dd1e3ee399b550c3a0cc63b2  src/autonomous-loop-state.mjs
 383cfe9b491b4622b744aff8a6517bb16626e80b985e81960bd235877c2b79f3  src/autonomous-mcp-tools.mjs
-f5e64199de030e0d6f117767b66901064a04c07ea60787832faed2aa2c0935d5  src/autonomous-output-contracts.mjs
+370bc4cd4069d57f242cb2c1bc5889563a75f1a9ccfbd2a4245b23e7a84a0383  src/autonomous-output-contracts.mjs
 6e73f3f438c6293917ca56b6be3c60bc3d9406e04a61f0da5ba8d754b3a10b7d  src/autonomous-plan.mjs
 697f0a18ad72661e466c716eb5af4392257042d4c79b4f09f2fd2399a06a8b64  src/autonomous-planner-contracts.mjs
 3d77077fa9d369d7e596ca3753c23a8ee2d111e8092269c46a700fc4547081a6  src/autonomous-planner.mjs
 c398c5f10eb226bc8edb4eea3b34fe1c74ed18f0c009c580fdb89969ab500a7e  src/autonomous-policy.mjs
 f9bf3b46e4b32ab7dd7864c646809e13fea64f72accf114929588dac7dc82014  src/autonomous-progress.mjs
-ad42745bbc51f4e9e95c2b3f21d2bb26c3c994b3522b03bb226976b8dc481142  src/autonomous-runtime.mjs
+18f9c7a25676aeea41f35c5461b91462ddec4deb8f17e96a219ec8865accadc3  src/autonomous-runtime.mjs
 d778233b28e4d1cfbf249a4f80e0dc434bfb43a34c9086c577a5431aaa0f2bd1  src/autonomous-supervisor-host.mjs
 b2be549d2c9fcf56466bbecbe0099d57d6f8ce5cee6e2333fc103be0d6003736  src/autonomous-supervisor.mjs
+61de686111e5b5d24ceb1e2adc8da175d69a4f22af08691c4edaea1c763cf859  src/autonomous-timeout-recovery.mjs
 e5f944a310ed957e3b8f7b1cab54c082acf1b35f8fdd7d9b672ebe1a80dc37ac  src/canonical-json.mjs
 da5181cec30034ddf089baa5358becb5651da238a2e7cf0888007a4c60b4ea6b  src/capability-benchmark-runner.mjs
 2b62295591f142ca4b3bc5b03e6434f7fc3c51d9502f9a40ef8a03d1f72a8899  src/capability-benchmark.mjs
@@ -1425,8 +1432,9 @@ dcd4c9784e88e253e91ddad3c24b38cb0b36906ed737f6d7bee7712360f66f7a  src/containmen
 fe1761b98738e1aea1d25ddf3a0ba56ccad95a43d45104a89b8665197c7c9e18  src/containment-result.mjs
 705a89cb12fedb993d55dfed32a5870d33e10db26422c944d1e52223566c096c  src/containment-smoke.mjs
 63a1d4d6a53f9eb7e02197b4e42158b867da8c042c2e61848d8a36cd398b8bd8  src/context-provenance.mjs
-b8267e129126c4791dc512a5f903f84c8dc7ea0b3415a880f693bc5d237d0e3c  src/deadbyte-cli.mjs
+47d1ecbc6a5e19c66aa2697d822ac71cc47b9cd7d55ba887d205a4cfa587dc3b  src/deadbyte-cli.mjs
 f57fe200ad916a03480c804ca57ab12b603822cbfb8d45ba7bce4376ec3d712a  src/document-adapter.mjs
+7786e7c102cd69ebaefff7696e9e420e28cf9c40c2af5c5227d26bba6fe4f824  src/effect-ledger.mjs
 f5fafd46052b09f71a528594eb230edc5766ee0d006432d744590ec97c9c580d  src/executor.mjs
 264d21a4385a0a04613fe78203e7f5e231a5c06397086cfacc88076e60b89b71  src/hash.mjs
 1cc648f59d739cb3269827a7aff23dc9dc6617a77c4da607ba947ca6e4626548  src/host-plane.mjs
@@ -1446,6 +1454,7 @@ e35ca87ad8ad7b6e046dd4bda92ed9e65939c386e7daf9b178038cde1de60b8e  src/mcp-host-s
 af63881f69cd10fafb2040c3b1836b6e4de0a07f8baa6fa0025cce33c5901767  src/mcp-smoke-client.mjs
 8e1f2ffaab1c3a7a824443314d7c4345adc3de40d864fe6b5fdcfc84d83246bf  src/native-diff-v2.mjs
 cb29ee3bee3b46ae4039148de9688dee1b58e66e3bbe1ecda411c18b1a1ac71b  src/native-diff.mjs
+79fb3b2cea86ef20b7c8a642f8842f686d6c91ae9e7933d546736085f6088179  src/observation-lease.mjs
 32641bbce1b9e2f22d4d56052c43d727ac81723a0d91bc6b6925bfc20456cb0e  src/observation-mcp-tools.mjs
 b6fad0a0fa99e11093b6418706715a470001be69c4f2550477f2d81bd37c87f5  src/observation-output-contracts.mjs
 9b6538d916369899a8301938876ccefb89f665605b6ec307062a1ef4d3996343  src/observation-runtime.mjs
@@ -1467,8 +1476,8 @@ be4a4f7f16e473ac842559a5a18eccb59e3693bded59a1abc71e75ff448cc755  src/proof-work
 afc638b797d81b16c620ca2226eacc4cb1a36562a402219cdac3376867170610  src/receipt.mjs
 adb6c8218b1067b1cf72510661cc4e8e8cedef3d7d163170c2590fd34eeea4ee  src/release-generation.mjs
 a7a63ea58291e0676c7199633ae234030f46285840cdfc519c879c279ae8bb14  src/release-slot.mjs
-5bb7bb1a5cb6b5acefe2573fbeed3e199f92e01d7d452798416a591fb8afbfa3  src/remote-live-log.mjs
-41b8de48b8ea3d1458b16a31215258d3c408d44a8b122a7ebd9b5421c06842b7  src/remote-mcp-autonomous-smoke-client.mjs
+895fbfe4afce06726bfddd7afc574dc516b42cf0ebfa57a58fec9c3e6b5fafd4  src/remote-live-log.mjs
+589c7f348ef24ce61206ea6b6d5e6962e7828c4c12eb23c9bfda7d6103dd710a  src/remote-mcp-autonomous-smoke-client.mjs
 ebff2982142263632a40b9f144e802b9cb0c86c798bb6c591de7f175ba50b660  src/remote-mcp-coding-smoke-client.mjs
 efd3f7ae0a3a614485933942ab5e27e874175feb81eb3e5130913c1e6837e7ca  src/remote-mcp-host-smoke-client.mjs
 aeed462a1090611ce04f2d4e453e4a6e9163091d6d99f768233943f1c24b949f  src/remote-mcp-machine-smoke-client.mjs
@@ -1496,8 +1505,9 @@ a765372ee27cf34b3f42ca77e43b839a306a4ca7d8b1c5e2fdd4367ab0c95769  src/tunnel-std
 16df134040e3ff1e73df722b568d3e8ac0a6923b097696cead7580da75aa8d2a  src/tunnel-stdio-compat.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-6c709b95b8c999a3f79d2e2913ed9016e7c675e6bbeec4e412c3a5be0d9583c0  src/version.mjs
+85ffcb0490fb31264f29b734afa07a46ed349d3454ebb13a4cb6e096fef086a1  src/version.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
+76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 2a78c818058b25efdc143a3a97c832da231ccd6ff9d90c7796d681a0251b85c4  test/agent-crash-child.mjs
 d9461ab7c118ee75d37a2d6f5e637d7e43505af6a9ad8c7ddafffc8ace185a5b  test/agent-crash-worker.mjs
 9642b43fafe704501ba18455be70ec54f3234cc318ea9bc762afeed8522e51cd  test/agent-runtime-adversarial.test.mjs
@@ -1517,7 +1527,7 @@ bb760a934f0d4cd99f61b8636491fa2cc81308d0934f932213daef25878036fb  test/autonomou
 5148ed954ecb87d353f1de1c2d5656fd30778866d24d311ce7472ab92898191c  test/autonomous-loop-state.test.mjs
 e693f99d06924b1c165e7ea03534190cfd268c2bd6340e31553edb903b0efbf8  test/autonomous-loop-v2.test.mjs
 694a40854a4aceebc53677f899430ef7b79d28afcd4a7b3c3fef55a9f0fb8c5f  test/autonomous-loop.test.mjs
-2a5693cdb3915c3b75688be3f646446684e541eb3744a53530dd7d296dad0148  test/autonomous-output-contract.test.mjs
+6b9a088010ba82a624d6cf6e3f8a8f8891c0dda004f5c6e27c0e08826fc60674  test/autonomous-output-contract.test.mjs
 581a9887c5e5593f57ab10a6f68dfaa0f709e9bc419340094f6cf7e1d36f87a3  test/autonomous-plan.test.mjs
 4f34949332e87b798d48fed30696d26656d31891694ba486eb0afa6fb76b135f  test/autonomous-progress.test.mjs
 c2eace9093dc9c14d6e7c88540d7edff70e730ae09ea6207fb9dd93dba15186d  test/autonomous-r34-e2e.test.mjs
@@ -1551,7 +1561,7 @@ a972bd20fa927427e6d8e4181699a27e792e916b02dcf8a1ac3e2b44afd238c1  test/controlle
 ceba7d1a09ccdcb20f33fe4e6de7667ffe0f0170d1bc9fefadfdba4d7f228090  test/controller-r29.test.mjs
 4d0dc810d9af13907f31c834a13acfb7e01ffbbe65575b69649fe52741e42175  test/controller-r30.test.mjs
 aeeb4894cc9656d13812817c969d9edf31a50222911f65c75472af03d9c4ea80  test/controller.test.mjs
-4fc11c6d0f7b2c7e5126476238a59cee622533ab8ffd53d51ecb19f1beecee91  test/core.test.mjs
+9fb8e0c3e82af27076edcfdcfe9582adf52c399c39b2dc3870735c008bd36aeb  test/core.test.mjs
 7ba4b06a1c4141ba87b5b371157fb59940d15a1016b4c599a13753d63ad0d3d3  test/DEADBYTE-MCP-WRITE-PROBE.txt
 c526724a6d10648fdd5152af917ba2fe51836dc5877daaac554bbd9e52fcd47e  test/deferred-slot-operation-behavior.test.mjs
 69a515b1a36f0620cae4057ea8dc5302751058e290aedaf2f0b637eb3288aba8  test/deferred-slot-operation.test.mjs
@@ -1644,24 +1654,28 @@ b84622d07d2ecfe27b55e45f7e89949f29a2d14184d8c6f6f82ed7f1e5fa59be  test/process-n
 510f51a6288a1030387cf372951499aea6dba2a35362ad89510bf7480e2f8004  test/process-release-gate.test.mjs
 e19a477abb83c63a1fb7ab5d5d1e9925113cded95d57084186b6ecd6161780e0  test/process-runtime.test.mjs
 34afc8a01e0c21501ec2647b7b0198b73570bce89eaaa983bd50c5709bb83fb8  test/process-supervision.test.mjs
-dace54db509e1d18d2f7680b1c65eec89537e708bcadc78086d59680680dc447  test/production-docs.test.mjs
+f5d4d7fc900cde24e75ace4e3a4da57afc40219370cd3c7e16f6f00393cd8f54  test/production-docs.test.mjs
 a20273128f4e6dcf2163c0b3fb7fe6ed9bf4d698fb0a5a0c4638396331d961cf  test/prompts-resources.test.mjs
 fcb70992870cd2f84674d578b0aaee554f958969c629a9d522d1efd230fe8288  test/provider-circuit.test.mjs
 0286df49beb2c2dcf46e384d87687d8d7a1618dd86f068517e36ae80dceb489b  test/public-autonomous-ingress-budget.test.mjs
-a9f3e673b8d9ffffee5818c05fe46993956b365073491493a63978a5852a2c0d  test/r33-closeout-regression.test.mjs
-458a36f63b3252d7b49b9fbd021e7a1b687b4cb3c5d64d298cfc713a5950c88e  test/r33-finalization.test.mjs
-e2cbb4bddf144150dd2f5b7e2b85b099a15a12b2d5b2b883288ad8cb5634dab7  test/r36-finalization.test.mjs
-781099893373d1e30a1e3eb5ca6e663969f1275e6815de9b19a19f0aa5403aa0  test/r36-release-identity.test.mjs
+e2322f4d6fc14366b3cf17d9a0baa9a50ca6dd5734fcad41815e7915f9585b27  test/r33-closeout-regression.test.mjs
+6744839b555deb8bebb820d00a307b29317c632ad096d2b6260580c4f7034057  test/r33-finalization.test.mjs
+7e419d3c1caf79bfc7407207f50e5645298f9b19d91a7d6f595af185b92cd55e  test/r36-finalization.test.mjs
+137fe16498b9fead9f3b35f4cfd8b60fd2b6fbbd575ad80d43eac5909f125448  test/r36-release-identity.test.mjs
+6dfb1b2b74b9e1cc74998d3fe7ce3c69bbad6b6751dabc81a65b6ec810872820  test/r37-agent-fabric.test.mjs
+72bc1863a2e113f7815903595d010b9c15513e05243d4eef3bef584aea18757b  test/r37-autonomous-timeout-recovery.test.mjs
+2784bc897985a3fdbba83316c5f0fa2f8e4a96b68fa4a46624722871d25ae9ba  test/r37-finalization.test.mjs
 9d48d51958c30df4931cebe5f5a8f1d6a82de6ffb7fd08711dfc658bc12b201c  test/release-generation.test.mjs
 bb58887a2c393cd5aac3fa3bb3a04de2704bd2a30dd2083ea638543485fa7e60  test/release-manifest-windows.test.mjs
 7cc69e786bfd9e4a7e70888c4c1b5f756a264bc1a991139c468b63af23f24c38  test/release-slot.test.mjs
 0109c76b480cc600f6ed42be4519df3fa6835012bb9e4ba4ae6be6635468c4a8  test/release-smoke-isolation.test.mjs
-8ef7fd9e9317e090bb84d002da33626a7a6cc9924dcdfbc693870ff7b2bb403a  test/release-version.test.mjs
+c2eb4a58604f4f46c3cf4043fcf4d2f4608325d1d7226be8da90f49120c14f7d  test/release-version.test.mjs
 3d26a0550a22c69990567d998c28e4ba0978c71429741c10c7c47f261653fbe2  test/remote-live-log-r36.test.mjs
+5787c8c5ff6c73d3d6d49d9b7efedb1b032f4fd0cd23c0e521e3dd4aba2872e5  test/remote-live-log-r37.test.mjs
 02ad827dc46e3dacf1ef2cfd861f583a44c471b1411cc674f4d61cd421418ad3  test/remote-live-log-recovery-r36.test.mjs
 cda93f7e2453916855a338de63360eb9c9e0b7c513391d344d01c32f500b188e  test/remote-r24-catalog.test.mjs
 7fb0196c15dc0c98a86d330ece3c752db5d2285289cb7b264a04871ba2fbd3d8  test/remote-result-journal.test.mjs
-7b6e50377090d13301b93ac5afe547b7c5b044bdf75705d1425eb1032a8c5d28  test/remote-session-cli.test.mjs
+1f72bbd9c0ab522b5442857f6690af29fdeb5d53e26af02777feb47560b518d3  test/remote-session-cli.test.mjs
 6faccee09e78210ee580f364ce5d56254c0bc8c38351a3a37642a0c60a3291d0  test/runtime-self-update.test.mjs
 b131611ec56e83d5db05d40b9be9b029396a177bca1ddacac9bf13086d370897  test/semantic-backend-registry.test.mjs
 a939ffa93544602d713749bc315fb970bd1a0d59b0d1570f2b8d4c26b4ec6e35  test/semantic-code.test.mjs

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.10.0 / R36 PRODUCTION BASELINE
+DEADBYTE MCP V0.11.0 / R37 PRODUCTION BASELINE
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -7,9 +7,8 @@ NPX PRIMARY OPERATOR UX
 ------------------------
 Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
 
-  npx -y deadbyte-mcp@0.10.0 mcp
+  npx -y deadbyte-mcp@0.11.0 mcp
   npx deadbyte-mcp@latest remote
-  npx deadbyte-mcp@latest remote --verbose
   npx deadbyte-mcp@latest remote status
   npx deadbyte-mcp@latest remote restart
   npx deadbyte-mcp@latest audit status
@@ -19,10 +18,9 @@ The `mcp` command is the quiet stdio server entry for local MCP clients; stdout
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.
 Bare `remote` is a foreground device session: it starts/resumes the verified runtime, arms process,
 coding, and autonomous authority, independently verifies those three planes are ARMED, and requires
-Host to remain DISARMED. The compact console shows device/bridge/cloud/session readiness plus live
-request-before-result activity (`RUN`, `OK`, `ERR`, interrupted/recovery, and cleanup) without dumping
-SHA values, request IDs, raw JSON payloads, or duplicate Bridge TOOL IN/OUT records. Use
-`remote --verbose` only when detailed audit plus Bridge diagnostics are needed. Session shutdown
+Host to remain DISARMED. The single remote console shows device/bridge/cloud/session readiness plus a
+unified live timeline (`RUN`, `OK`, `ERR`, interrupted/recovery, cursors, and sanitized Bridge IN/OUT/ERR
+diagnostics) without dumping raw JSON payloads, tokens, private keys, or full Bridge payload records. Session shutdown
 revokes process/coding/autonomous authority, applies fail-safe Host disarm, and parks the Bridge. A detached
 nonce-bound guardian watches the foreground owner and performs the same revoke+park cleanup if the
 owner is hard-killed before `finally` can run. The v2 runtime marker binds owner PID, guardian PID,
@@ -275,7 +273,7 @@ MCP CLIENT CONFIGURATION
 ------------------------
 The local stdio entry point is quiet and suitable for MCP hosts:
 
-  npx -y deadbyte-mcp@0.10.0 mcp
+  npx -y deadbyte-mcp@0.11.0 mcp
 
 CLAUDE DESKTOP
 Use the standard local-server entry in claude_desktop_config.json:
@@ -284,7 +282,7 @@ Use the standard local-server entry in claude_desktop_config.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.10.0", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.11.0", "mcp"]
       }
     }
   }
@@ -297,7 +295,7 @@ Create .cursor/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.10.0", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.11.0", "mcp"]
       }
     }
   }
@@ -310,7 +308,7 @@ Create .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.10.0", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.11.0", "mcp"]
       }
     }
   }
@@ -320,7 +318,7 @@ Add this to ~/.codex/config.toml:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.10.0", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.11.0", "mcp"]
 
 The remote device path remains `npx deadbyte-mcp@latest remote`. Remote public MCP uses the
 verified HTTPS named-tunnel URL selected by the active generation; do not commit a private device
@@ -370,8 +368,9 @@ Workspace allowlist and coding-policy root checks are on by design. Paths are ro
 traversal, symlink escape, denied paths, stale preconditions, and unknown executables fail closed.
 Destructive or executable host work requires the relevant standing grant / authority plane.
 Process execution uses policy-selected profiles or pinned scripts rather than a raw caller-selected
-shell command. Audit files retain request identity, timing, bounded metadata, and signed evidence
-even though normal `remote` console output is compact; use `remote --verbose` for forensic output.
+shell command. Audit files retain request identity, timing, bounded metadata, and signed evidence. The single `remote`
+console exposes the useful correlated timeline and sanitized transport diagnostics directly; there is no
+separate verbose mode.
 
 EVIDENCE-BASED COMPARISON
 -------------------------

package/bin/WORKER-REGISTRY.txt

@@ -2,11 +2,11 @@ schema=deadbyte.worker-registry.v1
 version=0.6.0
 policy=compile-time-operation-to-executable
 launcher.executable=deadbyte-exec.exe
-launcher.sha256=0a942a9141d637c016384adfcc285db7c58cffbddba677ab500e8a58554233ff
+launcher.sha256=a84168020dee3bb5d63d97b1076523232872bf142859c07bfcb77a45428a1ce5
 operation.lowercase_ascii=contained-transform-v1
 operation.reverse_bytes=contained-reverse-v1
 operation.uppercase_ascii=contained-transform-v1
 worker.contained-reverse-v1.executable=contained-reverse-worker.exe
-worker.contained-reverse-v1.sha256=9f046b30847c63ac157ffbd2a4c1d8b26da0776bee635ad3f9481775dcf5becc
+worker.contained-reverse-v1.sha256=9f3754c3c6fe71d6fe0e04889e33b39cdc64b633e0b713d5979faec748dec69d
 worker.contained-transform-v1.executable=contained-transform-worker.exe
-worker.contained-transform-v1.sha256=60b1e2c026a097655d13a719fdf354cc7487166a10316416923eaee876568b00
+worker.contained-transform-v1.sha256=01528ffe61736cdb5010396f4b1c52203c7e1848b3aeb4181a0c04a508e1da30

package/controller/README.TXT

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.10.0 / R36 CONTROLLER
+DEADBYTE MCP V0.11.0 / R37 CONTROLLER
 ====================================
 
 ENTRY POINT
@@ -9,7 +9,7 @@ Primary operator entry point:
 
 Bare `remote` is a foreground device session. It starts the verified runtime, arms process,
 coding, and autonomous authority, verifies those three planes are ARMED, and requires Host to stay
-DISARMED. The production Bridge uses the R36 compact capability profile (<=42 tools) while local
+DISARMED. The production Bridge uses the R37 compact capability profile (<=42 tools) while local
 stdio MCP keeps the exact full 76-tool profile. The compact console shows request-before-result
 Live Activity without raw SHA text, request IDs, payload JSON, or duplicate Bridge stdout by
 default; use `remote --verbose` for the detailed audit/runtime stream. Ctrl+C/SIGTERM or foreground
@@ -96,7 +96,7 @@ policy digests and profile hashes to the explicit mutable development root; the
   armautonomous      require coding authority, then enable a standing autonomous grant
   disarmautonomous   revoke autonomous authority immediately
   autonomousstatus   report configured/standing-grant/coding-disarmed state
-  autonomoustest     run the R36 compact public capability-closure MRTR production gate
+  autonomoustest     run the R37 compact public capability-closure MRTR production gate
 
 disarmcoding also revokes autonomous authority. No MCP tool creates or widens either
 grant. With an openai_compatible planner the MCP server starts a background supervisor;

package/controller/deadbyte-controller.ps1

@@ -1197,7 +1197,7 @@ while ($true) {
     Clear-Host
     $cfg = Get-Config
     Assert-ControllerRootBound $cfg
-    Write-Host 'DEADBYTE MCP ON-DEMAND CONTROLLER V0.10.0 / R36'
+    Write-Host 'DEADBYTE MCP ON-DEMAND CONTROLLER V0.11.0 / R37'
     Write-Host '======================================'
     Show-State $cfg | Out-Null
     Write-Host ''

package/controller/deadbyte-process-policy.json

@@ -5,7 +5,7 @@
   "state_dir": "D:\\Projects\\deadbyte-mcp-r36-dev\\controller\\runtime\\process-state",
   "native_host": {
     "path": "D:\\Projects\\deadbyte-mcp-r36-dev\\bin\\deadbyte-process-host.exe",
-    "sha256": "d37cb084bfd316d8448f2381a915402c61bb306ff8a5721e4b4a364ab192748b"
+    "sha256": "8c79f30e834daf2f0a916928bc719abf27ba111f446056bf2993c84d0432747a"
   },
   "roots": {
     "core": {

package/docs/ARCHITECTURE.md

@@ -1,4 +1,4 @@
-# DEADBYTE MCP V0.10.0 / R36 ARCHITECTURE
+# DEADBYTE MCP V0.11.0 / R37 ARCHITECTURE
 
 ```mermaid
 flowchart TD

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP machine-truth runtime with signed audit chain, immutable release slots, contained execution, coding/autonomous production authority, and npx-first remote control.",

package/scripts/deferred-slot-operation.mjs

@@ -22,7 +22,7 @@ const atomicJson=async(file,value)=>{
 };
 function activationArgs(manifestSha){
   if(!HEX64.test(manifestSha??'')) throw new Error('activate requires one lowercase manifest SHA-256');
-  return ['--stage',packageRoot,'--development-root',packageRoot,'--expected-version','0.10.0',
+  return ['--stage',packageRoot,'--development-root',packageRoot,'--expected-version','0.11.0',
     '--expected-manifest',manifestSha,'--process-policy',path.join(packageRoot,'controller','deadbyte-process-policy.json'),
     '--process-policy-sha256',null,'--semantic-lsp-config',path.join(packageRoot,'controller','deadbyte-semantic-lsp-config.json'),
     '--semantic-lsp-config-sha256',null,'--enable-machine-fs','--enable-observation','--enable-autonomous-supervisor'];

package/scripts/final-closure-r36.mjs

@@ -0,0 +1,113 @@
+import { createHash, createPrivateKey, createPublicKey, sign as cryptoSign } from 'node:crypto';
+import { lstat, mkdir, open, readFile, rename, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { probeR36FullSurface } from '../src/r36-full-surface-probe.mjs';
+import { probeR36CompactDisarmed } from '../src/r36-compact-disarmed-probe.mjs';
+import {
+  validateParityEvidence,
+  R35_PREDECESSOR_RELEASE_ID,
+  R35_PREDECESSOR_MANIFEST
+} from './release-parity.mjs';
+
+const DOMAIN=Buffer.from('DEADBYTE-R36-FINAL-CLOSURE-V1\0','utf8');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+  ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
+const canonicalJson=value=>JSON.stringify(canonical(value));
+function insist(ok,msg){if(!ok) throw new Error(msg);}
+function samePath(a,b){return path.resolve(String(a)).toLowerCase()===path.resolve(String(b)).toLowerCase();}
+async function fileEvidence(file){const abs=path.resolve(file),bytes=await readFile(abs);return {path:abs,sha256:sha256(bytes)};}
+async function publicUrl(){
+  const value=(await readFile(path.join(stateRoot,'bridge','mcp-url.txt'),'utf8')).trim();
+  const url=new URL(value);insist(url.protocol==='https:','final closure requires HTTPS public endpoint');return value;
+}
+async function grantAbsence(){
+  const out={};
+  for(const name of ['process-grant.json','coding-grant.json','autonomous-grant.json','host-grant.json']){
+    let absent=false;try{await lstat(path.join(stateRoot,'runtime',name));}catch(error){if(error?.code==='ENOENT') absent=true;else throw error;}
+    insist(absent,`authority grant still present: ${name}`);out[name]=true;
+  }
+  return out;
+}
+async function atomicCreate(file,bytes){
+  await mkdir(path.dirname(file),{recursive:true});
+  const temp=`${file}.tmp-${process.pid}-${Math.random().toString(16).slice(2)}`;
+  const handle=await open(temp,'wx');
+  try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+  try{await rename(temp,file);}catch(error){await rm(temp,{force:true}).catch(()=>{});throw error;}
+}
+
+export async function writeFinalClosure({parityPath,activationPath,windowsGatePath}){
+  const pointer=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+  insist(pointer.version==='0.10.0','final closure requires V0.10.0 active release');
+  insist(pointer.release_id===`v${pointer.version}-${pointer.manifest_sha256.slice(0,16)}`,'final closure release id/content address mismatch');
+
+  const parity=JSON.parse(await readFile(path.resolve(parityPath),'utf8'));
+  insist(parity.schema==='deadbyte.r36-parity.v1','R36 parity schema mismatch at final closure');
+  validateParityEvidence(parity);
+  insist(parity.candidate?.release_id===pointer.release_id&&parity.candidate?.manifest_sha256===pointer.manifest_sha256,'parity candidate/current release mismatch');
+  insist(parity.successor?.release_id===pointer.release_id&&parity.successor?.manifest_sha256===pointer.manifest_sha256,'parity successor/current release mismatch');
+  insist(parity.predecessor?.release_id===R35_PREDECESSOR_RELEASE_ID&&parity.predecessor?.manifest_sha256===R35_PREDECESSOR_MANIFEST,'parity predecessor identity mismatch');
+  insist(parity.rollback?.receipt_path&&parity.restore?.receipt_path,'parity rollback/restore receipt paths missing');
+  insist(parity.immutable_slot?.protected===true,'parity immutable-slot proof missing');
+  insist(samePath(parity.immutable_slot.release_root,pointer.release_root),'parity immutable release root mismatch');
+  insist(!samePath(parity.immutable_slot.development_root,pointer.release_root),'development_root must differ from immutable release_root');
+
+  const windowsGate=JSON.parse(await readFile(path.resolve(windowsGatePath),'utf8'));
+  insist(windowsGate.schema==='deadbyte.r36-windows-gate.v1'&&windowsGate.status==='passed'&&windowsGate.exit_code===0,'R36 Windows gate evidence invalid');
+  insist(windowsGate.version==='0.10.0'&&windowsGate.manifest_sha256===pointer.manifest_sha256,'R36 Windows gate/current release mismatch');
+  insist(windowsGate.marker==='DEADBYTE V0.10.0 / R36 WINDOWS BATCH GATE: PASS','R36 Windows gate marker mismatch');
+
+  const localFull=await probeR36FullSurface({packageRoot:pointer.release_root,generationRoot:pointer.generation_root,stateRoot});
+  insist(localFull.status==='passed'&&localFull.tool_count===76&&localFull.strict_output_schemas===true,'final local full 76-tool proof failed');
+  const compact=await probeR36CompactDisarmed(await publicUrl());
+  insist(compact.status==='passed'&&compact.tool_count<=42&&compact.capability_closure===true,'final public compact capability closure failed');
+  insist(compact.coding_armed===false&&compact.autonomous_armed===false,'final public compact authority is not DISARMED');
+  insist(compact.release_id===pointer.release_id&&compact.release_manifest_sha256===pointer.manifest_sha256,'final public compact release binding mismatch');
+  insist(compact.machine_status?.release_id===pointer.release_id&&compact.machine_status?.release_manifest_sha256===pointer.manifest_sha256,'final machine status/current release mismatch');
+  insist(compact.machine_ping?.nonce===compact.nonce,'final machine ping nonce mismatch');
+
+  const evidence={
+    parity:await fileEvidence(parityPath),activation:await fileEvidence(activationPath),
+    rollback:await fileEvidence(parity.rollback.receipt_path),restore:await fileEvidence(parity.restore.receipt_path),
+    windows_gate:await fileEvidence(windowsGatePath)
+  };
+  const body={
+    schema:'deadbyte.r36-final-closure.v1',version:'0.10.0',release_label:'R36 FINAL MACHINE BASELINE',
+    completed_at_utc:new Date().toISOString(),active_pointer:pointer,
+    predecessor:{release_id:R35_PREDECESSOR_RELEASE_ID,version:'0.9.0',manifest_sha256:R35_PREDECESSOR_MANIFEST},
+    immutable_slot:{protected:true,release_root:path.resolve(pointer.release_root),development_root:path.resolve(parity.immutable_slot.development_root)},
+    surfaces:{
+      local_full:{status:localFull.status,profile:localFull.profile,tool_count:localFull.tool_count,catalog_sha256:localFull.catalog_sha256,strict_output_schemas:localFull.strict_output_schemas,protocol_revision:localFull.protocol_revision},
+      public_compact:{status:compact.status,profile:compact.profile,tool_count:compact.tool_count,catalog_sha256:compact.catalog_sha256,strict_output_schemas:compact.strict_output_schemas,ledger_sha256:compact.ledger_sha256,capability_count:compact.capability_count,production_non_host_capabilities:compact.production_non_host_capabilities,capability_closure:compact.capability_closure,coding_armed:compact.coding_armed,autonomous_armed:compact.autonomous_armed,protocol_revision:compact.protocol_revision}
+    },
+    evidence,
+    machine:{status:compact.machine_status,ping:compact.machine_ping,nonce:compact.nonce},
+    authority:{all_disarmed:true,grants_absent:await grantAbsence()}
+  };
+  const privateKey=createPrivateKey(await readFile(path.join(stateRoot,'trust','ed25519-private.pem')));
+  const publicKey=createPublicKey(privateKey);
+  insist(privateKey.asymmetricKeyType==='ed25519'&&publicKey.asymmetricKeyType==='ed25519','closure signing key must be Ed25519');
+  const keyId=sha256(Buffer.from(publicKey.export({type:'spki',format:'der'})));
+  const bodyBytes=Buffer.from(canonicalJson(body),'utf8');
+  const signature=cryptoSign(null,Buffer.concat([DOMAIN,bodyBytes]),privateKey);
+  const envelope={body,body_sha256:sha256(bodyBytes),attestation:{algorithm:'ed25519',domain:'DEADBYTE-R36-FINAL-CLOSURE-V1',key_id:keyId,signature_base64:signature.toString('base64')}};
+  envelope.closure_sha256=sha256(Buffer.from(canonicalJson(envelope),'utf8'));
+  const dir=path.join(stateRoot,'evidence','release');
+  const file=path.join(dir,`r36-final-${pointer.manifest_sha256.slice(0,16)}.json`);
+  const bytes=Buffer.from(`${JSON.stringify(envelope,null,2)}\n`,'utf8');
+  await atomicCreate(file,bytes);
+  return {status:'written',path:file,sha256:sha256(bytes),closure_sha256:envelope.closure_sha256,release_id:pointer.release_id};
+}
+
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked){
+  const [parityPath,activationPath,windowsGatePath]=process.argv.slice(2);
+  if(!parityPath||!activationPath||!windowsGatePath) throw new Error('usage: node scripts/final-closure.mjs <parity.json> <activation-receipt.json> <windows-gate.json>');
+  writeFinalClosure({parityPath,activationPath,windowsGatePath})
+    .then(result=>console.log(JSON.stringify(result,null,2)))
+    .catch(error=>{console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;});
+}