deadbyte-mcp 0.11.1 → 0.11.3

package/test/r38-finalization.test.mjs

@@ -0,0 +1,74 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { validateParityEvidence, R38_PREDECESSOR_RELEASE_ID, R38_PREDECESSOR_MANIFEST } from '../scripts/release-parity-r38.mjs';
+import { verifyFinalClosureObject } from '../scripts/final-closure-verify-r38.mjs';
+
+const root=new URL('../',import.meta.url);
+const text=rel=>readFile(new URL(rel,root),'utf8');
+
+function parityFixture(){
+  const manifest='a'.repeat(64);
+  return {
+    schema:'deadbyte.r38-parity.v1',status:'passed',execution_provider:'deadbyte_mcp',rdc_operation_count:0,
+    candidate:{release_id:`v0.11.2-${manifest.slice(0,16)}`,version:'0.11.2',manifest_sha256:manifest},
+    immutable_slot:{protected:true,release_root:'C:/immutable/r38',development_root:'D:/Projects/deadbyte-mcp-r36-dev'},
+    local_full:{status:'passed',tool_count:76,strict_output_schemas:true},
+    public_compact:{status:'passed',tool_count:41,capability_closure:true,gateway_count:5},
+    autonomous:{status:'passed',signed_release_verified:true,observed_failure_before_replan:true},
+    before_rollback_disarmed:{status:'passed',capability_closure:true,coding_armed:false,autonomous_armed:false},
+    rollback:{state:'completed'},stage_restore:{status:'restored',manifest_sha256:manifest},restore:{state:'completed'},
+    predecessor:{release_id:R38_PREDECESSOR_RELEASE_ID,version:'0.11.1',manifest_sha256:R38_PREDECESSOR_MANIFEST},
+    predecessor_disarmed:{status:'passed',tool_count:41,capability_closure:true},
+    successor:{release_id:`v0.11.2-${manifest.slice(0,16)}`,version:'0.11.2',manifest_sha256:manifest},
+    successor_disarmed:{status:'passed',capability_closure:true,coding_armed:false,autonomous_armed:false},
+    requirements:Object.fromEntries(['tree_read','precondition_mutation','search','owned_process','observation','coding_loop','autonomy','interrupted_recovery','evidence_verification','compact_closure','full_surface'].map(key=>[key,true]))
+  };
+}
+
+test('R38 parity validator requires full-76, compact closure, exact public 0.11.1 predecessor and immutable-slot separation',()=>{
+  const good=parityFixture();
+  assert.equal(validateParityEvidence(good),true);
+  assert.throws(()=>validateParityEvidence({...good,local_full:{...good.local_full,tool_count:75}}),/full 76/i);
+  assert.throws(()=>validateParityEvidence({...good,public_compact:{...good.public_compact,capability_closure:false}}),/compact closure/i);
+  assert.throws(()=>validateParityEvidence({...good,predecessor:{...good.predecessor,manifest_sha256:'b'.repeat(64)}}),/predecessor/i);
+  assert.throws(()=>validateParityEvidence({...good,immutable_slot:{...good.immutable_slot,development_root:good.immutable_slot.release_root}}),/immutable-slot/i);
+  assert.throws(()=>validateParityEvidence({...good,stage_restore:{status:'missing',manifest_sha256:good.candidate.manifest_sha256}}),/stage restore/i);
+});
+
+test('R38 parity captures R38 bridge, exact public 0.11.1 predecessor, stage reseed and successor restore',async()=>{
+  const parity=await text('scripts/release-parity-r38.mjs');
+  assert.match(parity,/R38_PREDECESSOR_RELEASE_ID='v0\.11\.1-220fac89dd82cdcd'/);
+  assert.match(parity,/220fac89dd82cdcdddb82cd7d0b71b768f84a5c87d57ebaca0f5383f33d97a76/);
+  assert.match(parity,/const stageRestore=await restoreFrozenStage/);
+  assert.match(parity,/publicR38Disarmed/);
+  assert.match(parity,/scheduleDeferred\('activate',candidateManifest,\{bridgeRoot:successorBridge\.root,bridgeScriptSha256:successorBridge\.sha256\}\)/);
+});
+
+test('R38 current final closure writer and independent verifier bind R38 domains and public 0.11.1 predecessor',async()=>{
+  const [writer,verifier]=await Promise.all([text('scripts/final-closure-r38.mjs'),text('scripts/final-closure-verify-r38.mjs')]);
+  assert.equal(typeof verifyFinalClosureObject,'function');
+  assert.match(writer,/DEADBYTE-R38-FINAL-CLOSURE-V1/);
+  assert.match(writer,/deadbyte\.r38-final-closure\.v1/);
+  assert.match(writer,/pointer\.version==='0\.11\.2'/);
+  assert.match(writer,/R38 FINAL MACHINE BASELINE/);
+  assert.match(writer,/deadbyte\.r38-parity\.v1/);
+  assert.match(writer,/deadbyte\.r38-windows-gate\.v1/);
+  assert.match(writer,/R38_PREDECESSOR_RELEASE_ID/);
+  assert.doesNotMatch(verifier,/from ['"]\.\.\/src\//);
+  assert.match(verifier,/DEADBYTE-R38-FINAL-CLOSURE-V1/);
+  assert.match(verifier,/deadbyte\.r38-final-closure\.v1/);
+  assert.match(verifier,/envelope\.body\.version==='0\.11\.2'/);
+  assert.match(verifier,/R38 FINAL MACHINE BASELINE/);
+  assert.match(verifier,/deadbyte\.r38-parity\.v1/);
+  assert.match(verifier,/deadbyte\.r38-windows-gate\.v1/);
+  assert.match(verifier,/220fac89dd82cdcdddb82cd7d0b71b768f84a5c87d57ebaca0f5383f33d97a76/);
+});
+
+test('R38 bounded public parity suite covers current release identity and agent fabric',async()=>{
+  const script=await text('scripts/release-parity-tests-r38.ps1');
+  assert.match(script,/r38-finalization\.test\.mjs/);
+  assert.match(script,/release-version\.test\.mjs/);
+  assert.match(script,/r37-agent-fabric\.test\.mjs/);
+  assert.match(script,/remote-live-log-r37\.test\.mjs/);
+});

package/test/r39-finalization.test.mjs

@@ -0,0 +1,74 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { validateParityEvidence, R39_PREDECESSOR_RELEASE_ID, R39_PREDECESSOR_MANIFEST } from '../scripts/release-parity-r39.mjs';
+import { verifyFinalClosureObject } from '../scripts/final-closure-verify-r39.mjs';
+
+const root=new URL('../',import.meta.url);
+const text=rel=>readFile(new URL(rel,root),'utf8');
+
+function parityFixture(){
+  const manifest='a'.repeat(64);
+  return {
+    schema:'deadbyte.r39-parity.v1',status:'passed',execution_provider:'deadbyte_mcp',rdc_operation_count:0,
+    candidate:{release_id:`v0.11.3-${manifest.slice(0,16)}`,version:'0.11.3',manifest_sha256:manifest},
+    immutable_slot:{protected:true,release_root:'C:/immutable/r39',development_root:'D:/Projects/deadbyte-mcp-r36-dev'},
+    local_full:{status:'passed',tool_count:76,strict_output_schemas:true},
+    public_compact:{status:'passed',tool_count:41,capability_closure:true,gateway_count:5},
+    autonomous:{status:'passed',signed_release_verified:true,observed_failure_before_replan:true},
+    before_rollback_disarmed:{status:'passed',capability_closure:true,coding_armed:false,autonomous_armed:false},
+    rollback:{state:'completed'},stage_restore:{status:'restored',manifest_sha256:manifest},restore:{state:'completed'},
+    predecessor:{release_id:R39_PREDECESSOR_RELEASE_ID,version:'0.11.2',manifest_sha256:R39_PREDECESSOR_MANIFEST},
+    predecessor_disarmed:{status:'passed',tool_count:41,capability_closure:true},
+    successor:{release_id:`v0.11.3-${manifest.slice(0,16)}`,version:'0.11.3',manifest_sha256:manifest},
+    successor_disarmed:{status:'passed',capability_closure:true,coding_armed:false,autonomous_armed:false},
+    requirements:Object.fromEntries(['tree_read','precondition_mutation','search','owned_process','observation','coding_loop','autonomy','interrupted_recovery','evidence_verification','compact_closure','full_surface'].map(key=>[key,true]))
+  };
+}
+
+test('R39 parity validator requires full-76, compact closure, exact public 0.11.2 predecessor and immutable-slot separation',()=>{
+  const good=parityFixture();
+  assert.equal(validateParityEvidence(good),true);
+  assert.throws(()=>validateParityEvidence({...good,local_full:{...good.local_full,tool_count:75}}),/full 76/i);
+  assert.throws(()=>validateParityEvidence({...good,public_compact:{...good.public_compact,capability_closure:false}}),/compact closure/i);
+  assert.throws(()=>validateParityEvidence({...good,predecessor:{...good.predecessor,manifest_sha256:'b'.repeat(64)}}),/predecessor/i);
+  assert.throws(()=>validateParityEvidence({...good,immutable_slot:{...good.immutable_slot,development_root:good.immutable_slot.release_root}}),/immutable-slot/i);
+  assert.throws(()=>validateParityEvidence({...good,stage_restore:{status:'missing',manifest_sha256:good.candidate.manifest_sha256}}),/stage restore/i);
+});
+
+test('R39 parity captures R39 bridge, exact public 0.11.2 predecessor, stage reseed and successor restore',async()=>{
+  const parity=await text('scripts/release-parity-r39.mjs');
+  assert.match(parity,/R39_PREDECESSOR_RELEASE_ID='v0\.11\.2-058605dfccaa3035'/);
+  assert.match(parity,/058605dfccaa3035a57c6393d53f2421c14e5a92bd145c2334477ba24d7cab8b/);
+  assert.match(parity,/const stageRestore=await restoreFrozenStage/);
+  assert.match(parity,/publicR39Disarmed/);
+  assert.match(parity,/scheduleDeferred\('activate',candidateManifest,\{bridgeRoot:successorBridge\.root,bridgeScriptSha256:successorBridge\.sha256\}\)/);
+});
+
+test('R39 current final closure writer and independent verifier bind R39 domains and public 0.11.2 predecessor',async()=>{
+  const [writer,verifier]=await Promise.all([text('scripts/final-closure-r39.mjs'),text('scripts/final-closure-verify-r39.mjs')]);
+  assert.equal(typeof verifyFinalClosureObject,'function');
+  assert.match(writer,/DEADBYTE-R39-FINAL-CLOSURE-V1/);
+  assert.match(writer,/deadbyte\.r39-final-closure\.v1/);
+  assert.match(writer,/pointer\.version==='0\.11\.3'/);
+  assert.match(writer,/R39 FINAL MACHINE BASELINE/);
+  assert.match(writer,/deadbyte\.r39-parity\.v1/);
+  assert.match(writer,/deadbyte\.r39-windows-gate\.v1/);
+  assert.match(writer,/R39_PREDECESSOR_RELEASE_ID/);
+  assert.doesNotMatch(verifier,/from ['"]\.\.\/src\//);
+  assert.match(verifier,/DEADBYTE-R39-FINAL-CLOSURE-V1/);
+  assert.match(verifier,/deadbyte\.r39-final-closure\.v1/);
+  assert.match(verifier,/envelope\.body\.version==='0\.11\.3'/);
+  assert.match(verifier,/R39 FINAL MACHINE BASELINE/);
+  assert.match(verifier,/deadbyte\.r39-parity\.v1/);
+  assert.match(verifier,/deadbyte\.r39-windows-gate\.v1/);
+  assert.match(verifier,/058605dfccaa3035a57c6393d53f2421c14e5a92bd145c2334477ba24d7cab8b/);
+});
+
+test('R39 bounded public parity suite covers current release identity and agent fabric',async()=>{
+  const script=await text('scripts/release-parity-tests-r39.ps1');
+  assert.match(script,/r39-finalization\.test\.mjs/);
+  assert.match(script,/release-version\.test\.mjs/);
+  assert.match(script,/r37-agent-fabric\.test\.mjs/);
+  assert.match(script,/remote-live-log-r37\.test\.mjs/);
+});

package/test/release-generation.test.mjs

@@ -30,16 +30,23 @@ test('R27 generation bundle rebinds authority and mutable state outside the rele
     ]},
     LocalReadyUri:'http://127.0.0.1:8787/healthz',UrlRegex:'https://x',McpUrlFile:'C:/mcp-url.txt',McpUrlFileSha256:EXE,McpPathFile:'C:/token.txt',StartTimeoutSeconds:30,ProbeTimeoutSeconds:3};
   const coding={schema:'deadbyte.coding-policy.v1',enabled:true,lease_file:'C:/old/coding.json',evidence_dir:'C:/old/evidence',
-    roots:{core:{path:'C:/old/core',read:true,write:true,exec:true,deny_paths:['node_modules']}},commands:{tests:command()},max_read_bytes:524288,max_write_bytes:2097152};
+    roots:{core:{path:'C:/old/core',read:true,write:true,exec:true,deny_paths:['node_modules']}},commands:{tests:command(),powershell_script:command()},max_read_bytes:524288,max_write_bytes:2097152};
   const autonomous={schema:'deadbyte.autonomous-policy.v1',enabled:true,lease_file:'C:/old/auto.json',evidence_dir:'C:/old/auto-evidence',coding_policy_sha256:'0'.repeat(64),root_ids:['core'],planner:{backend:'client_sampling',max_tokens:4096},
-    profiles:{gate:{kind:'command',root_id:'core',command_id:'tests',script_path:'scripts/gate.ps1',script_sha256:'0'.repeat(64),args:[],cwd:'.',timeout_ms:120000,expect_exit_code:0,required_for_release:true,run_after_mutation:true,description:'gate'}},
+    profiles:{
+      gate:{kind:'command',root_id:'core',command_id:'tests',script_path:'scripts/gate.ps1',script_sha256:'0'.repeat(64),args:[],cwd:'.',timeout_ms:120000,expect_exit_code:0,required_for_release:true,run_after_mutation:true,description:'gate'},
+      'windows-release':{kind:'command',root_id:'core',command_id:'powershell_script',script_path:'scripts/gate-windows-old.ps1',script_sha256:'0'.repeat(64),args:[],cwd:'.',timeout_ms:300000,expect_exit_code:0,required_for_release:true,run_after_mutation:false,description:'historical Windows release gate'}
+    },
     limits:{max_iterations:12,max_mutations:24,max_wall_ms:1800000,max_context_bytes:1048576,max_diff_bytes:1048576,max_files_per_diff:8}};
   const host={schema:'deadbyte.host-policy.v1',enabled:true,arm_file:'C:/old/host.json',roots:{core:{path:'C:/old/core',read:true,write:true,exec:true}},commands:{tests:command()},max_read_bytes:262144,max_write_bytes:1048576};
   const processPolicy={schema:'deadbyte.process-policy.v1',enabled:true,grant_file:'C:/old/process-grant.json',state_dir:'C:/old/process-state',
     native_host:{path:'C:/old/deadbyte-process-host.exe',sha256:'0'.repeat(64)},
     roots:{core:{path:'C:/old/core',deny_paths:['node_modules']}},
     profiles:{probe:{executable:'C:/Windows/System32/ping.exe',executable_sha256:EXE,root_ids:['core'],prefix_args:['127.0.0.1','-n','2'],max_args:0,max_arg_bytes:256,max_sessions:1,max_input_bytes:4096,max_retained_output_bytes:65536,env_allow:['PATH','TEMP','TMP'],input_actions:{}}}};
-  const development=path.join(base,'development'); await mkdir(development,{recursive:true}); await mkdir(path.join(development,'scripts'),{recursive:true}); await writeFile(path.join(development,'scripts','gate.ps1'),'Write-Output gate\n');
+  const development=path.join(base,'development'); await mkdir(development,{recursive:true}); await mkdir(path.join(development,'scripts'),{recursive:true});
+  await writeFile(path.join(development,'scripts','gate.ps1'),'Write-Output gate\n');
+  await writeFile(path.join(development,'scripts','gate-windows-old.ps1'),'Write-Output old-gate\n');
+  await writeFile(path.join(development,'scripts','gate-windows-current.ps1'),'Write-Output current-gate\n');
+  await writeFile(path.join(development,'package.json'),JSON.stringify({scripts:{'gate:windows':'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-current.ps1'}}));
   const result=await createGenerationBundle({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy});
   const verified=await verifyGenerationBundle(result.generation_root,result.generation_manifest_sha256);
   assert.equal(verified.files,6);
@@ -62,6 +69,9 @@ test('R27 generation bundle rebinds authority and mutable state outside the rele
   assert.equal(generatedAuto.coding_policy_sha256,sha(codingBytes));
   assert.equal(generatedAuto.lease_file,path.join(path.resolve(state),'runtime','autonomous-grant.json'));
   assert.equal(generatedAuto.profiles.gate.script_sha256,sha(Buffer.from('Write-Output gate\n')));
+  assert.equal(generatedAuto.profiles['windows-release'].script_path,'scripts/gate-windows-current.ps1');
+  assert.equal(generatedAuto.profiles['windows-release'].script_sha256,sha(Buffer.from('Write-Output current-gate\n')));
+  assert.equal(generatedAuto.profiles['windows-release'].description,'Full Windows target release gate; runs only when finish is requested.');
   const generatedHost=JSON.parse(await readFile(result.host_policy_path,'utf8'));
   assert.equal(generatedHost.roots.core.path,path.resolve(development));
   assert.notEqual(generatedHost.roots.core.path,path.resolve(release));

package/test/release-version.test.mjs

@@ -5,40 +5,62 @@ import { createHash } from 'node:crypto';
 
 const root=new URL('../',import.meta.url);
 const text=rel=>readFile(new URL(rel,root),'utf8');
-const R37_PREDECESSOR_RELEASE_ID='v0.11.0-08c2a0008b1f84c9';
-const R37_PREDECESSOR_MANIFEST='08c2a0008b1f84c90f7ce7faa1e3decbd03f33612bc0fdc7d1ba591b548798e8';
+const R39_PREDECESSOR_RELEASE_ID='v0.11.2-058605dfccaa3035';
+const R39_PREDECESSOR_MANIFEST='058605dfccaa3035a57c6393d53f2421c14e5a92bd145c2334477ba24d7cab8b';
 
-test('R37 patch release authority agrees on V0.11.1 and preserves exact public 0.11.0 predecessor',async()=>{
+test('R39 hotfix authority agrees on V0.11.3 and preserves exact public 0.11.2 predecessor',async()=>{
   const pkg=JSON.parse(await text('package.json'));
   const [version,controller,gate,readme,architecture,controllerReadme,deferred,parity,closure,closureVerify,windowsGate,semanticConfig]=await Promise.all([
-    text('src/version.mjs'),text('controller/deadbyte-controller.ps1'),text('scripts/gate-windows.ps1'),
+    text('src/version.mjs'),text('controller/deadbyte-controller.ps1'),text('scripts/gate-windows-r39.ps1'),
     text('README.txt'),text('docs/ARCHITECTURE.md'),text('controller/README.TXT'),
-    text('scripts/deferred-slot-operation.mjs'),text('scripts/release-parity.mjs'),text('scripts/final-closure.mjs'),
-    text('scripts/final-closure-verify.mjs'),text('scripts/windows-gate-evidence.mjs'),
+    text('scripts/deferred-slot-operation-r39.mjs'),text('scripts/release-parity-r39.mjs'),text('scripts/final-closure-r39.mjs'),
+    text('scripts/final-closure-verify-r39.mjs'),text('scripts/windows-gate-evidence-r39.mjs'),
     text('controller/deadbyte-semantic-lsp-config.json')
   ]);
-  assert.equal(pkg.version,'0.11.1');
-  assert.match(version,/DEADBYTE_VERSION = '0\.11\.1'/);
-  assert.match(controller,/CONTROLLER V0\.11\.1 \/ R37/);
-  assert.match(gate,/DEADBYTE V0\.11\.1 \/ R37 WINDOWS BATCH GATE: PASS/);
-  assert.match(readme,/^DEADBYTE MCP V0\.11\.1 \/ R37 PRODUCTION BASELINE$/m);
-  assert.match(architecture,/^# DEADBYTE MCP V0\.11\.1 \/ R37 ARCHITECTURE$/m);
-  assert.match(controllerReadme,/^DEADBYTE MCP V0\.11\.1 \/ R37 CONTROLLER$/m);
-  assert.match(deferred,/--expected-version','0\.11\.1'/);
-  assert.match(parity,/R37_PREDECESSOR_RELEASE_ID='v0\.11\.0-08c2a0008b1f84c9'/);
-  assert.match(parity,new RegExp(R37_PREDECESSOR_MANIFEST));
-  assert.match(parity,/version==='0\.11\.1'|version:'0\.11\.1'/);
-  assert.match(closure,/version:'0\.11\.1'/);
-  assert.match(closureVerify,/DEADBYTE V0\.11\.1 \/ R37 WINDOWS BATCH GATE: PASS/);
-  assert.match(windowsGate,/version:'0\.11\.1'/);
+  assert.equal(pkg.version,'0.11.3');
+  assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r39.ps1');
+  assert.equal(pkg.scripts['self-update:deferred'],'node scripts/deferred-slot-operation-r39.mjs');
+  assert.equal(pkg.scripts['release:parity'],'node scripts/release-parity-r39.mjs');
+  assert.equal(pkg.scripts['release:final:write'],'node scripts/final-closure-r39.mjs');
+  assert.equal(pkg.scripts['release:final:verify'],'node scripts/final-closure-verify-r39.mjs');
+  assert.match(version,/DEADBYTE_VERSION = '0\.11\.3'/);
+  assert.match(controller,/CONTROLLER V0\.11\.3 \/ R39/);
+  assert.match(gate,/DEADBYTE V0\.11\.3 \/ R39 WINDOWS BATCH GATE: PASS/);
+  assert.match(readme,/^DEADBYTE MCP V0\.11\.3 \/ R39 HOTFIX BASELINE$/m);
+  assert.match(architecture,/^# DEADBYTE MCP V0\.11\.3 \/ R39 ARCHITECTURE$/m);
+  assert.match(controllerReadme,/^DEADBYTE MCP V0\.11\.3 \/ R39 CONTROLLER$/m);
+  assert.match(deferred,/--expected-version','0\.11\.3'/);
+  assert.match(parity,/R39_PREDECESSOR_RELEASE_ID='v0\.11\.2-058605dfccaa3035'/);
+  assert.match(parity,new RegExp(R39_PREDECESSOR_MANIFEST));
+  assert.match(parity,/version==='0\.11\.3'|version:'0\.11\.3'/);
+  assert.match(closure,/version:'0\.11\.3'/);
+  assert.match(closureVerify,/DEADBYTE V0\.11\.3 \/ R39 WINDOWS BATCH GATE: PASS/);
+  assert.match(windowsGate,/version:'0\.11\.3'/);
   assert.equal(createHash('sha256').update(Buffer.from(semanticConfig,'utf8')).digest('hex'),'d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b');
+  assert.equal(R39_PREDECESSOR_RELEASE_ID,'v0.11.2-058605dfccaa3035');
 });
 
-test('R37 patch keeps capability surface and fixes ONLINE remote startup without restoring verbose mode',async()=>{
-  const [parity,cli]=await Promise.all([text('src/remote-mcp-r36-parity-client.mjs'),text('src/deadbyte-cli.mjs')]);
-  assert.match(parity,/R36_EXPECTED_TOOLS\.length !== 76/);
-  assert.match(parity,/R36_COMPACT_TOOL_LIMIT=42/);
+test('R39 hotfix keeps ONLINE reuse and fixes PowerShell $Host recovery collision',async()=>{
+  const [cli,controller]=await Promise.all([text('src/deadbyte-cli.mjs'),text('controller/deadbyte-controller.ps1')]);
   assert.match(cli,/controllerRuntimeReady/);
   assert.match(cli,/Runtime already ONLINE; reusing verified bridge\/cloud\/supervisor/);
-  assert.doesNotMatch(cli,/remote --verbose/);
+  assert.match(cli,/invokeController\(ctx,'start',\{discardOutput:true,timeoutMs:REMOTE_START_TIMEOUT_MS\}\)/);
+  assert.match(cli,/remote controller start returned without a verified ONLINE runtime/);
+  assert.match(cli,/discardOutput\?\['ignore','ignore','ignore'\]/);
+  const start=controller.indexOf('function Recover-AutonomousSupervisor');
+  const end=controller.indexOf('function Show-State',start);
+  assert.ok(start>=0&&end>start,'supervisor recovery block missing');
+  const block=controller.slice(start,end);
+  assert.doesNotMatch(block,/\$host\s*=/i);
+  assert.match(block,/\$hostStatus\s*=\s*Get-HostArmStatus/);
+});
+
+test('sealed R37 tooling remains historical 0.11.1 authority',async()=>{
+  const [parity,gate,closure]=await Promise.all([
+    text('scripts/release-parity.mjs'),text('scripts/gate-windows.ps1'),text('scripts/final-closure.mjs')
+  ]);
+  assert.match(parity,/R37_PREDECESSOR_RELEASE_ID='v0\.11\.0-08c2a0008b1f84c9'/);
+  assert.match(parity,/version==='0\.11\.1'|version:'0\.11\.1'/);
+  assert.match(gate,/DEADBYTE V0\.11\.1 \/ R37 WINDOWS BATCH GATE: PASS/);
+  assert.match(closure,/version:'0\.11\.1'/);
 });

package/test/remote-live-log-r37.test.mjs

@@ -7,7 +7,7 @@ test('R37 live timeline renders sanitized tool-call detail and correlates termin
   const tracker=createLiveTimelineTracker({clock:()=>now});
   const run=tracker.observe({event_type:'tool.request',tool:'coding_file_read',request_id:'abcdef1234567890',
     args:{root_id:'projects',path:'src/a.mjs',content:'SECRET',token:'SECRET'}});
-  assert.match(run,/^1970-01-01T00:00:01\.000Z \| coding_file_read\s+\| Arguments: \{/);
+  assert.match(run,/^1970-01-01T07:00:01\.000\+07:00 \| coding_file_read\s+\| Arguments: \{/);
   assert.match(run,/\"path\":\"src\/a\.mjs\"/);
   assert.match(run,/\"reason\":\"payload\"/);
   assert.match(run,/\"reason\":\"secret\"/);

package/test/remote-session-cli.test.mjs

@@ -16,11 +16,15 @@ async function fixture({failCommand='',statusOnline=false}={}){
   const state=path.join(dir,'state');
   const bin=path.join(state,'bin');
   const trace=path.join(dir,'trace.txt');
+  const startedMarker=path.join(dir,'started.txt');
+  const spawnedStdout=path.join(dir,'spawned.stdout.log');
+  const spawnedStderr=path.join(dir,'spawned.stderr.log');
+  const spawnedPid=path.join(dir,'spawned.pid');
   await mkdir(bin,{recursive:true});
   const launcher=path.join(bin,'DEADBYTE-MCP.ps1');
-  const ps1=`param([string]$Command)\n$ErrorActionPreference='Stop'\nfor($i=0;$i -lt 20;$i++){ try { [IO.File]::AppendAllText($env:DEADBYTE_REMOTE_TEST_TRACE,(\"$Command\" + [Environment]::NewLine),[Text.Encoding]::UTF8); break } catch { if($i -eq 19){ throw }; Start-Sleep -Milliseconds 10 } }\nif ($env:DEADBYTE_REMOTE_TEST_FAIL -and $Command -eq $env:DEADBYTE_REMOTE_TEST_FAIL) { Write-Error \"forced $Command failure\"; exit 9 }\nswitch ($Command) {\n  'start' { Write-Host 'DEADBYTE MCP = ONLINE' }\n  'status' { if ($env:DEADBYTE_REMOTE_TEST_STATUS_ONLINE -eq '1') { Write-Host 'DEADBYTE MCP = ONLINE'; Write-Host 'Bridge PID   : 1001 [verified]'; Write-Host 'Cloud PID    : 1002 [verified]'; Write-Host 'Local ready  : True'; Write-Host 'Loop supervisor: RUNNING [verified]' } else { Write-Host 'DEADBYTE MCP = OFFLINE' } }\n  'processstatus' { Write-Host 'Process plane  : ARMED [standing-grant]' }\n  'codingstatus' { Write-Host 'Coding plane  : ARMED [standing-grant]' }\n  'autonomousstatus' { Write-Host 'Autonomous     : ARMED [standing-grant]' }\n  'hoststatus' { Write-Host 'Host plane    : DISARMED [disarmed]' }\n  'park' { Write-Host 'DEADBYTE MCP = PARKED' }\n  default { Write-Host \"$Command OK\" }\n}\nexit 0\n`;
+  const ps1=`param([string]$Command)\n$ErrorActionPreference='Stop'\nfor($i=0;$i -lt 20;$i++){ try { [IO.File]::AppendAllText($env:DEADBYTE_REMOTE_TEST_TRACE,(\"$Command\" + [Environment]::NewLine),[Text.Encoding]::UTF8); break } catch { if($i -eq 19){ throw }; Start-Sleep -Milliseconds 10 } }\nif ($env:DEADBYTE_REMOTE_TEST_FAIL -and $Command -eq $env:DEADBYTE_REMOTE_TEST_FAIL) { Write-Error \"forced $Command failure\"; exit 9 }\nswitch ($Command) {\n  'start' { if ($env:DEADBYTE_REMOTE_TEST_SPAWN_CHILD -eq '1') { $node=(Get-Command node.exe).Source; $spawned=Start-Process -FilePath $node -ArgumentList @('-e','setTimeout(()=>process.exit(0),10000)') -PassThru -WindowStyle Hidden -RedirectStandardOutput $env:DEADBYTE_REMOTE_TEST_SPAWN_STDOUT -RedirectStandardError $env:DEADBYTE_REMOTE_TEST_SPAWN_STDERR; if ($env:DEADBYTE_REMOTE_TEST_SPAWN_PID) { [IO.File]::WriteAllText($env:DEADBYTE_REMOTE_TEST_SPAWN_PID,[string]$spawned.Id,[Text.Encoding]::UTF8) } }; if ($env:DEADBYTE_REMOTE_TEST_STARTED) { [IO.File]::WriteAllText($env:DEADBYTE_REMOTE_TEST_STARTED,'1',[Text.Encoding]::UTF8) }; Write-Host 'DEADBYTE MCP = ONLINE' }\n  'status' { if ($env:DEADBYTE_REMOTE_TEST_STATUS_ONLINE -eq '1' -or ($env:DEADBYTE_REMOTE_TEST_STARTED -and (Test-Path -LiteralPath $env:DEADBYTE_REMOTE_TEST_STARTED))) { Write-Host 'DEADBYTE MCP = ONLINE'; Write-Host 'Bridge PID   : 1001 [verified]'; Write-Host 'Cloud PID    : 1002 [verified]'; Write-Host 'Local ready  : True'; Write-Host 'Loop supervisor: RUNNING [verified]' } else { Write-Host 'DEADBYTE MCP = OFFLINE' } }\n  'processstatus' { Write-Host 'Process plane  : ARMED [standing-grant]' }\n  'codingstatus' { Write-Host 'Coding plane  : ARMED [standing-grant]' }\n  'autonomousstatus' { Write-Host 'Autonomous     : ARMED [standing-grant]' }\n  'hoststatus' { Write-Host 'Host plane    : DISARMED [disarmed]' }\n  'park' { if ($env:DEADBYTE_REMOTE_TEST_STARTED) { Remove-Item -LiteralPath $env:DEADBYTE_REMOTE_TEST_STARTED -Force -ErrorAction SilentlyContinue }; Write-Host 'DEADBYTE MCP = PARKED' }\n  default { Write-Host \"$Command OK\" }\n}\nexit 0\n`;
   await writeFile(launcher,ps1,'utf8');
-  return {dir,state,trace,env:{...process.env,DEADBYTE_STATE_ROOT:state,DEADBYTE_REMOTE_TEST_TRACE:trace,DEADBYTE_REMOTE_TEST_FAIL:failCommand,DEADBYTE_REMOTE_TEST_STATUS_ONLINE:statusOnline?'1':'0'}};
+  return {dir,state,trace,env:{...process.env,DEADBYTE_STATE_ROOT:state,DEADBYTE_REMOTE_TEST_TRACE:trace,DEADBYTE_REMOTE_TEST_FAIL:failCommand,DEADBYTE_REMOTE_TEST_STATUS_ONLINE:statusOnline?'1':'0',DEADBYTE_REMOTE_TEST_STARTED:startedMarker,DEADBYTE_REMOTE_TEST_SPAWN_STDOUT:spawnedStdout,DEADBYTE_REMOTE_TEST_SPAWN_STDERR:spawnedStderr,DEADBYTE_REMOTE_TEST_SPAWN_PID:spawnedPid},spawnedPid};
 }
 
 async function traceCommands(file,{read=readFile,retryDelayMs=10,maxAttempts=20}={}){
@@ -90,15 +94,45 @@ winTest('bare remote reuses a fully verified ONLINE runtime without invoking blo
   }
 });
 
+winTest('bare remote PARKED startup does not wait for a long-lived child holding inherited pipe handles',async()=>{
+  const fx=await fixture();
+  fx.env.DEADBYTE_REMOTE_TEST_SPAWN_CHILD='1';
+  let child=null;
+  try{
+    const startedAt=Date.now();
+    child=spawn(process.execPath,[cliPath,'remote'],{env:fx.env,stdio:['pipe','pipe','pipe'],windowsHide:true});
+    const output=await collect(child);
+    const ready=await waitFor(fx.trace,commands=>commands.includes('hoststatus'),{timeoutMs:8000});
+    const elapsed=Date.now()-startedAt;
+    assert.deepEqual(ready.slice(0,10),[
+      'status','start','status','armprocess','armcoding','armautonomous',
+      'processstatus','codingstatus','autonomousstatus','hoststatus'
+    ]);
+    assert.ok(elapsed<7000,`PARKED startup waited on inherited child pipe handles: ${elapsed}ms`);
+    assert.equal(child.exitCode,null,'remote session must remain foreground after PARKED startup');
+    assert.match(output.stdout,/\[BOOT\] Starting bridge\/runtime\.\.\./);
+    assert.match(output.stdout,/\[OK\] ONLINE/);
+    child.stdin.end();
+    const ended=await Promise.race([output.closed,sleep(6000).then(()=>({timeout:true}))]);
+    assert.equal(ended.timeout,undefined,'remote session did not exit after PARKED startup proof');
+    assert.equal(ended.code,0,output.stderr);
+  }finally{
+    if(child?.exitCode===null) child.kill('SIGKILL');
+    try{const pid=Number((await readFile(fx.spawnedPid,'utf8')).trim());if(Number.isInteger(pid)&&pid>0) process.kill(pid,'SIGKILL');}catch{}
+    await sleep(100);
+    await rm(fx.dir,{recursive:true,force:true});
+  }
+});
+
 winTest('bare remote uses one unified live timeline, keeps authority semantics, then disarms and parks when the foreground session ends',async()=>{
   const fx=await fixture();
   let child=null;
   try{
     child=spawn(process.execPath,[cliPath,'remote'],{env:fx.env,stdio:['pipe','pipe','pipe'],windowsHide:true});
     const output=await collect(child);
-    const ready=await waitFor(fx.trace,commands=>commands.slice(0,9).join(',')==='status,start,armprocess,armcoding,armautonomous,processstatus,codingstatus,autonomousstatus,hoststatus');
-    assert.deepEqual(ready.slice(0,9),[
-      'status','start','armprocess','armcoding','armautonomous',
+    const ready=await waitFor(fx.trace,commands=>commands.slice(0,10).join(',')==='status,start,status,armprocess,armcoding,armautonomous,processstatus,codingstatus,autonomousstatus,hoststatus');
+    assert.deepEqual(ready.slice(0,10),[
+      'status','start','status','armprocess','armcoding','armautonomous',
       'processstatus','codingstatus','autonomousstatus','hoststatus'
     ]);
     assert.equal(child.exitCode,null,'remote session must remain foreground after becoming ready');
@@ -136,9 +170,9 @@ winTest('bare remote uses one unified live timeline, keeps authority semantics,
     ].join('\n')+'\n','utf8');
     const logDeadline=Date.now()+3000;
     while(Date.now()<logDeadline&&!/✗ \[fedcba98\] ERR coding_file_read 1\.73s/.test(output.stdout)) await sleep(50);
-    assert.match(output.stdout,/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3}Z \| coding_tree\s+\| Arguments: .*\"path\":\"src\".*\"root_id\":\"projects\".*\[cursor r1:[0-9a-f]{24}:1\]$/m);
+    assert.match(output.stdout,/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3}\+07:00 \| coding_tree\s+\| Arguments: .*\"path\":\"src\".*\"root_id\":\"projects\".*\[cursor r1:[0-9a-f]{24}:1\]$/m);
     assert.match(output.stdout,/✓ \[abcdef12\] OK  coding_tree 42ms \[cursor r1:[0-9a-f]{24}:2\]/);
-    assert.match(output.stdout,/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3}Z \| coding_file_read\s+\| Arguments: \{\"path\":\"src\/deadbyte-cli\.mjs\",\"root_id\":\"projects\"\} \[cursor r1:[0-9a-f]{24}:3\]$/m);
+    assert.match(output.stdout,/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3}\+07:00 \| coding_file_read\s+\| Arguments: \{\"path\":\"src\/deadbyte-cli\.mjs\",\"root_id\":\"projects\"\} \[cursor r1:[0-9a-f]{24}:3\]$/m);
     assert.match(output.stdout,/✗ \[fedcba98\] ERR coding_file_read 1\.73s \[cursor r1:[0-9a-f]{24}:4\]/);
     assert.equal((output.stdout.match(/✓ \[abcdef12\] OK  coding_tree 42ms/g)||[]).length,1,'duplicate terminal result must print once');
     const resultJournal=JSON.parse(await readFile(path.join(fx.state,'runtime','remote-results',`${marker.result_session_id}.json`),'utf8'));
@@ -209,7 +243,7 @@ winTest('remote --resume replays sanitized tool-call and terminal result events
     while(Date.now()<deadline&&(!/coding_file_read\s+\| Arguments: .*REPLAY cursor r1:[0-9a-f]{24}:3/.test(secondOutput.stdout)||
       !/\[REPLAY\] \[OK\] coding_file_read \[cursor r1:[0-9a-f]{24}:4\]/.test(secondOutput.stdout)||
       !/\[LOG\] Unified live timeline/.test(secondOutput.stdout))) await sleep(50);
-    assert.match(secondOutput.stdout,/^2026-09-18T16:30:01\.000Z \| coding_file_read\s+\| Arguments: .*\"path\":\"src\/deadbyte-cli\.mjs\".*REPLAY cursor r1:[0-9a-f]{24}:3$/m);
+    assert.match(secondOutput.stdout,/^2026-09-18T23:30:01\.000\+07:00 \| coding_file_read\s+\| Arguments: .*\"path\":\"src\/deadbyte-cli\.mjs\".*REPLAY cursor r1:[0-9a-f]{24}:3$/m);
     assert.match(secondOutput.stdout,/\[REPLAY\] \[OK\] coding_file_read \[cursor r1:[0-9a-f]{24}:4\]/);
     assert.match(secondOutput.stdout,/♻️ \[SESSION\] Previous result stream replayed/);
     assert.doesNotMatch(secondOutput.stdout,/DO_NOT_REPLAY_SECRET/);
@@ -249,9 +283,9 @@ winTest('detached guardian revokes authority, parks, and removes the session mar
   try{
     child=spawn(process.execPath,[cliPath,'remote'],{env:fx.env,stdio:['pipe','pipe','pipe'],windowsHide:true});
     const output=await collect(child);
-    const ready=await waitFor(fx.trace,commands=>commands.slice(0,8).join(',')==='start,armprocess,armcoding,armautonomous,processstatus,codingstatus,autonomousstatus,hoststatus');
-    assert.deepEqual(ready.slice(0,9),[
-      'status','start','armprocess','armcoding','armautonomous',
+    const ready=await waitFor(fx.trace,commands=>commands.slice(0,10).join(',')==='status,start,status,armprocess,armcoding,armautonomous,processstatus,codingstatus,autonomousstatus,hoststatus');
+    assert.deepEqual(ready.slice(0,10),[
+      'status','start','status','armprocess','armcoding','armautonomous',
       'processstatus','codingstatus','autonomousstatus','hoststatus'
     ]);
     const markerPath=path.join(fx.state,'runtime','remote-session.json');
@@ -294,7 +328,7 @@ winTest('bare remote rolls back authority and parks if one plane fails to arm',a
     assert.equal(ended.timeout,undefined,'failed startup did not terminate');
     assert.notEqual(ended.code,0);
     const commands=await traceCommands(fx.trace);
-    assert.deepEqual(commands.slice(0,4),['status','start','armprocess','armcoding']);
+    assert.deepEqual(commands.slice(0,5),['status','start','status','armprocess','armcoding']);
     assert.deepEqual(commands.slice(-5),['disarmautonomous','disarmcoding','disarmprocess','disarmhost','park']);
     assert.doesNotMatch(output.stdout,/Live logs/i);
   }finally{await rm(fx.dir,{recursive:true,force:true});}