deadbyte-mcp 0.15.14 → 0.15.15

package/MANIFEST.SHA256

@@ -1329,7 +1329,7 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-1372576b26135bde7220f29d6a664dc762ca006bfbf119455a2f02f5a7267270  package.json
+0792082051518fb772aaaead59d51b32d03aebc917097371dbcceaab5911d55a  package.json
 8177e3a354721a73df889f386a97e7744a2e017d150aecf4bf309f5177d18690  proof/CONTAINMENT-BUILD.txt
 a8efa13e44ff50902aee64cfca542d19605a1ae23db95280ad2d44b324f3eae7  proof/MCP-SMOKE-STATUS.txt
 7c115069cc4a343ca21b0ebdee74bd8f544b02d4aa906ffa13308725825d891a  proof/NODE-SYNTAX.txt
@@ -1389,7 +1389,7 @@ d433aaea5cccd1e184775ac4d915f34e0b39c6c99916dddd009731ad5fd6443f  proof/V073-WIN
 bd0773a9e02e8ab11475c9cc5a7db29a8313233b7eab7f837922737e75ec5938  proof/VERIFY.txt
 2c821808d4596965c577f40191daee224d3aea81989778c4af97f53a83b487db  proof/WINDOWS-CONTAINED-STATUS.txt
 f8bc839c7b4fcb0ea7b7e7ad9448847c3beae6f95f2eb4d407d1b284aaa4ff68  proof/WINDOWS-CONTAINMENT-STATUS.txt
-c7a11729f77023dd1d741d61b35ea0b75cca061a28f3a4cbe0062ca6a536f4ab  PROVENANCE.json
+cde0c97bae86bcee9c3c1a7583d11a91423f1153cd90fc3bb9a03095fba3defd  PROVENANCE.json
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
 0b7ec5ee347ddfa6cca59740fc7a8fe3fc5d51406265bb12189e82fa106319d2  R41-PARENT.json
 bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.json
@@ -1397,8 +1397,8 @@ bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.jso
 f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.json
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
-5d81b599350d12f019586380d0983054c48fd89a7b948b335a4cec8fb9077ad7  README.txt
-5c2c00d7c5f4e593c017cf6eaa2dd85ca3350ae031247070fc313a9acc54fef4  RELEASE.json
+96e0fca6d344384cd69ca3b675a3a19da57bac2d02507c9fc404563fcb7ab117  README.txt
+e4e39e1006db0b44c9fe36811100cfcca5e76b614f736a88421031cdc3c21239  RELEASE.json
 507a42441c8fbb0b1bef63a13fad9e1680262cd6d34cc176b7ed0c5423ddbcc7  SBOM.cdx.json
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
@@ -1486,7 +1486,7 @@ a0ad824eed1d8be051d5f731579f9bf4115b311f202b75ea0d03aa257b13a671  scripts/gate-w
 de6142bd5693cf4edb8725c9c43fc77e9bdc12f5b398a757006d778d3ee3f8ed  scripts/inspect-r46-active.mjs
 7ea8cf6bf094a1612603bc716228a3753e5f06fca8a0684d2da15a04d0710c64  scripts/list-source-zips.mjs
 9d12d15f7c83ddf272834072ed37d618a232bd8a3fd36c339761fe08bb9380d8  scripts/npm-publish-r47.ps1
-2a5b53ee74619814130fcdaf6c96d75bc08efb96d4004c391ab07a1b2454b7b9  scripts/npm-release-r47.mjs
+133a29979ef92d46b9939701dbf14ded1438e34c0192571f8df7bb902492ae1a  scripts/npm-release-r47.mjs
 453dd636b452f4343a36f31a93a763e97f58ed5d6c9df3d2ba05b236934a3a1f  scripts/probe-source-zips.mjs
 8f9d97a4d23e9d05e7cadfb6a519b1ddb9da04894bca98bdc293fc3797e8423c  scripts/probe-zips.mjs
 e19a1d591ccd07af2e87d930ce23b0cc9b814bc2a395408045543847154097d7  scripts/r40-compact-ledger-probe.mjs
@@ -1642,17 +1642,20 @@ cde7c813f5a2e9a69f09849455d1504e766963845a1f4b201ecc84090fa260d5  src/memory-r41
 2b2293a90db419dd1b548d766475c7e9e1bf243d3e9b0011969f1622ba803e74  src/native-diff.mjs
 79fb3b2cea86ef20b7c8a642f8842f686d6c91ae9e7933d546736085f6088179  src/observation-lease.mjs
 ed638caae618bb2f736b43f350fd9354ef32c6998eecca1b585bc2f289b23c59  src/observation-mcp-tools.mjs
-6a7adafe5c0c1f319f0704734c8ffbfb8c2e2051649fd5fd911e2aecd6a9d8c3  src/observation-output-contracts.mjs
-4e6d59de5c390f38d16b72c2094d0be5aec57be5a40e0516694e826e87a1ec0b  src/observation-runtime.mjs
+55fc05e62bea43a3343147b99b362bec59b22e0afe0b48a89c1523ecdc9af90c  src/observation-output-contracts.mjs
+2ec3939884567a1b8ba9dd1142b031de72d491a6e9fe7232b25f1bce2026377a  src/observation-runtime.mjs
 e7d6f2f9b783df009ee64b99197821f783b1cb2488e58ec605398a1fa1a83cb8  src/observation-smoke-client.mjs
+7d215399327b7e5a8b5e3c89bbe304c086c9b733dd5c7526b31f101afe97b783  src/operation-history.mjs
+65dc466392ab317dad527e7f08004cc975b4a77f66509e10d786c691fed7bfbb  src/operation-lifecycle.mjs
 96c29ce8f90a717ebc311155acfa075c7ea8f6f63401a37269586fbe1419376f  src/operation-policy.mjs
 e541a1dba48034b914dc15eb789a6fa0bc43f60439dda61d31a7a99de9ff1a9f  src/operator-surface.mjs
 b8e4e38fc38bd8d2efb01b58028944bc8133dcc42de12b1035784c5e01beca35  src/output-contracts.mjs
 21b76d428e4f15a7c7c5c8ddaf6862ecd8bd32153fac27167dbb6e39e15950f7  src/path-policy.mjs
 974b5e9a5f60c4b2ac8bed629fb39a4e3c06b591995bec3f5f4756da8f3fd2e1  src/process-mcp-tools.mjs
-4c90265628194d989ac78f2b06eadbfffceb9c006d5b6c2e982f5667f7a385ed  src/process-output-contracts.mjs
+3c5d6709a9e40db7e184711636bc832a892f746f1df471cad9783f8062c09877  src/process-output-contracts.mjs
 f5322664c669bc193214a803f9723e3728053f60bc008530db39a9af7f7bab75  src/process-policy.mjs
-622b984e577932ed0c342a6d7e0e8a17d08e888caa2ca67c5ecc1bbcca16042a  src/process-runtime.mjs
+ba3eafd91b69e75700824c1a6103ff0e2f6a6cad162a607e1b12250d6bc52142  src/process-readiness.mjs
+f364076cad1cead310c7d43312a2c92d18f8ffc966bf50781436f37347cc0b1d  src/process-runtime.mjs
 65d81b6cbdf4f4ce34ccef11793e79cfed6883288288915d077c11674f0873bb  src/process-smoke-client.mjs
 bb4d1532684b8f81a42377c4b0a9d4c61207856edfff496e878ffbb885b52442  src/proof-cli.mjs
 be4a4f7f16e473ac842559a5a18eccb59e3693bded59a1abc71e75ff448cc755  src/proof-worker.mjs
@@ -1667,7 +1670,7 @@ b04cadd638861a2d75d86fede83b8d4cbe7065019c13ecd7a4ec0f9a9e0c06e5  src/r44-compac
 8addaac4895359816fbef5990a903e460313a1d72968c33757b312192f1e03f8  src/r45-full-surface-probe.mjs
 afc638b797d81b16c620ca2226eacc4cb1a36562a402219cdac3376867170610  src/receipt.mjs
 a1a0ac13b2d23fa7e0cbe1c093052b68ff3498982d9abeb27dba4dec404a8908  src/release-generation.mjs
-a7a63ea58291e0676c7199633ae234030f46285840cdfc519c879c279ae8bb14  src/release-slot.mjs
+d781df334bfaa84d249112f5b0c480b14bf28759f77754307f8a8872ff17337f  src/release-slot.mjs
 3f41fa32ddeed403b5431a338821b62e0c1946a9d808f06d0edb2d9341ca0121  src/remote-console.mjs
 ce6ec7ec794d1603f95311eac4712a0f8b26e7e96bc3617f88fba4297cc8b376  src/remote-device-r44.mjs
 123a157a5149992a3eee85ffa2ea4ef420efc67e9f6bb394b87fbe164dd56db2  src/remote-live-log.mjs
@@ -1707,7 +1710,7 @@ bac271c6f5218752ac5ff4decf5249e3893ddb35c63c092ce17238c27fc4d35b  src/trust-init
 16df134040e3ff1e73df722b568d3e8ac0a6923b097696cead7580da75aa8d2a  src/tunnel-stdio-compat.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-52a36e0a261fab6d40aa96b523efbaa87738600bacc6cd8b8d68047a261828cd  src/version.mjs
+5f91722767fdc9df81616509ca7c5362846ef8161191499ace7ac2b99a78ea30  src/version.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs
@@ -1885,7 +1888,9 @@ e1f9097b7f7d22a498b8cb2a8cafbb45ba69f613e2be58e09a3beb4be1e19db7  test/memory-pr
 80536bffc3bd3d05bcc863908fcf124adc843837efeba0fec8aad77c433158f9  test/native-diff.test.mjs
 3c68c05a68b4c8ab24839d82ff457cd835ac0cb9527b915c24ee684ce47338f7  test/observation-integration.test.mjs
 1147cf367361b6ac30e0f903da133dc169cc34585101e1b67d7e47a7034587a4  test/observation-mcp-tools.test.mjs
-dbc64f9e39b21b3a9e55be6a276ceb1e0c523daf59dc72104c081df993cf3269  test/observation-runtime.test.mjs
+42c03845d304636218d456162b965ace12cc450ab3eeb62d28c7eeef70f363cf  test/observation-runtime.test.mjs
+ea60bf617122536ed10f546dc660491522e79c70a05d827efe5b50f09de5711f  test/operation-history.test.mjs
+874924c2d2e4073b1032e3e4a81af809efd2919044e19c0f862535a2d7442392  test/operation-lifecycle.test.mjs
 d0eacc6d75b692b3a7e3bfc8e543b6c075cfad84d9373051f36d6eefdbce6339  test/output-schema.test.mjs
 b25e37f3224fc63b020a84468b8955a5de68c7f2751c88de23832c23e343fea3  test/package-boundary.test.mjs
 8f28e3990b79cc58bf52a646a88f374270396c9bc8738f5eceb156f721ae8a81  test/process-longrun-r36.test.mjs
@@ -1893,8 +1898,9 @@ ddac61c12ab29be1736885c01c999ca0346ba44c712cc2c8a48a7eea1ed62a53  test/process-m
 b84622d07d2ecfe27b55e45f7e89949f29a2d14184d8c6f6f82ed7f1e5fa59be  test/process-native.test.mjs
 39d66e1d69a4afcfde6c9e22c77f3df6d404450376b475d1a81f3b3c99488e20  test/process-policy-refresh.test.mjs
 8c5daf35a5aeb6e0b8327ce64cffc2c87bb400e731f7e174fdcac066c27256c4  test/process-policy.test.mjs
+e13275898e892ca70455cb53bb0a8c936c0f1a0a1c82ece671a314aefe106367  test/process-readiness.test.mjs
 510f51a6288a1030387cf372951499aea6dba2a35362ad89510bf7480e2f8004  test/process-release-gate.test.mjs
-548da6269630e40afb38b5906326eb14faff71c2b7f266503989fb5f63d41344  test/process-runtime.test.mjs
+56f0e586a6b62b48623026078de4948cdbafe94e3213f5e9f166b1b89d34dba9  test/process-runtime.test.mjs
 e53d37bf4746495ecc30eaff9bf5bc92456d390edc6f54193d5067eae8f95588  test/process-supervision.test.mjs
 8b1c58809472a0ea65bf7fb90da0d4f21ce0bca948c3b1d04c6f6110be184a2e  test/production-docs.test.mjs
 8d7a03c03c9070cc81401f0c2bf22eab28f4a4970a4701dd7a1095845ae500d1  test/prompts-resources.test.mjs

package/PROVENANCE.json

@@ -1,6 +1,6 @@
 {
   "schema": "deadbyte.provenance.v1",
-  "version": "0.15.11",
+  "version": "0.15.15",
   "builder": "deadbyte-r46-fileless-powershell",
   "source_model": "development-root -> MANIFEST.SHA256 -> immutable release slot -> generation bundle -> signed final closure",
   "signing": "ed25519",

package/README.txt

@@ -8,11 +8,11 @@ NPX PRIMARY OPERATOR UX
 Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
 
   npx -y deadbyte-mcp@0.15.11 mcp
-  npx -y deadbyte-mcp@0.15.11 remote
-  npx -y deadbyte-mcp@0.15.11 remote status
-  npx -y deadbyte-mcp@0.15.11 remote restart
-  npx -y deadbyte-mcp@0.15.11 audit status
-  npx -y deadbyte-mcp@0.15.11 audit verify
+  npx -y deadbyte-mcp@0.15.15 remote
+  npx -y deadbyte-mcp@0.15.15 remote status
+  npx -y deadbyte-mcp@0.15.15 remote restart
+  npx -y deadbyte-mcp@0.15.15 audit status
+  npx -y deadbyte-mcp@0.15.15 audit verify
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.

package/RELEASE.json

@@ -1,53 +1,53 @@
-{
-    "schema":  "deadbyte.release.v1",
-    "name":  "deadbyte-mcp",
-    "version":  "0.15.13",
-    "train":  "R46",
-    "label":  "FILELESS POWERSHELL PRODUCT BASELINE",
-    "protocol_revision":  "2026-07-28",
-    "parent":  {
-                   "release_id":  "v0.15.2-0fb46542f6a4345f",
-                   "manifest_sha256":  "0fb46542f6a4345f1c527565d06bf6e9b8e283260e47bf684fb70a60308fcf34",
-                   "generation_manifest_sha256":  "00cde7bf540cc2804d679a39040d5b07193c5f8a0d49cac3b882402f8f4e6ad8"
-               },
-    "platform":  {
-                     "primary":  "win32",
-                     "architectures":  [
-                                           "x64"
-                                       ]
-                 },
-    "capabilities":  {
-                         "host_execution_modes":  [
-                                                      "script",
-                                                      "inline",
-                                                      "native"
-                                                  ],
-                         "hardware_queries":  [
-                                                  "cpu",
-                                                  "gpu",
-                                                  "memory",
-                                                  "storage",
-                                                  "network",
-                                                  "pci"
-                                              ],
-                         "compact_tool_count":  43,
-                         "full_tool_count":  83,
-                         "process_profiles":  [
-                                                  "ping_hold",
-                                                  "powershell",
-                                                  "powershell_repl"
-                                              ],
-                         "powershell_fileless":  true,
-                         "powershell_source_max_arg_bytes":  8192,
-                         "powershell_persistent_repl":  true,
-                         "process_raw_input_profile_opt_in":  true,
-                         "process_tail_reads":  true,
-                         "process_wait_reads":  true,
-                         "process_chunked_output_ring":  true,
-                         "remote_reachability_ttl":  true,
-                         "remote_probe_timeout_retry":  true,
-                         "remote_dispatch_timeout_no_retry":  true,
-                         "observation_search_session_ttl":  true,
-                         "observation_search_session_cap":  128
-                     }
-}
+{
+  "schema": "deadbyte.release.v1",
+  "name": "deadbyte-mcp",
+  "version": "0.15.15",
+  "train": "R46",
+  "label": "FILELESS POWERSHELL PRODUCT BASELINE",
+  "protocol_revision": "2026-07-28",
+  "parent": {
+    "release_id": "v0.15.2-0fb46542f6a4345f",
+    "manifest_sha256": "0fb46542f6a4345f1c527565d06bf6e9b8e283260e47bf684fb70a60308fcf34",
+    "generation_manifest_sha256": "00cde7bf540cc2804d679a39040d5b07193c5f8a0d49cac3b882402f8f4e6ad8"
+  },
+  "platform": {
+    "primary": "win32",
+    "architectures": [
+      "x64"
+    ]
+  },
+  "capabilities": {
+    "host_execution_modes": [
+      "script",
+      "inline",
+      "native"
+    ],
+    "hardware_queries": [
+      "cpu",
+      "gpu",
+      "memory",
+      "storage",
+      "network",
+      "pci"
+    ],
+    "compact_tool_count": 43,
+    "full_tool_count": 83,
+    "process_profiles": [
+      "ping_hold",
+      "powershell",
+      "powershell_repl"
+    ],
+    "powershell_fileless": true,
+    "powershell_source_max_arg_bytes": 8192,
+    "powershell_persistent_repl": true,
+    "process_raw_input_profile_opt_in": true,
+    "process_tail_reads": true,
+    "process_wait_reads": true,
+    "process_chunked_output_ring": true,
+    "remote_reachability_ttl": true,
+    "remote_probe_timeout_retry": true,
+    "remote_dispatch_timeout_no_retry": true,
+    "observation_search_session_ttl": true,
+    "observation_search_session_cap": 128
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.14",
+  "version": "0.15.15",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/npm-release-r47.mjs

@@ -64,6 +64,27 @@ async function main() {
   const version = pkg.version;
   if (pkg.name !== 'deadbyte-mcp') throw new Error(`unexpected package name: ${pkg.name}`);
 
+  const releaseBytes = await readFile(path.join(root, 'RELEASE.json'));
+  if (releaseBytes.subarray(0, 3).equals(Buffer.from([0xEF, 0xBB, 0xBF]))) {
+    throw new Error('RELEASE.json must be UTF-8 without BOM');
+  }
+  const release = JSON.parse(releaseBytes.toString('utf8'));
+  const provenance = JSON.parse(await readFile(path.join(root, 'PROVENANCE.json'), 'utf8'));
+  if (release.schema !== 'deadbyte.release.v1' || release.name !== pkg.name) {
+    throw new Error('RELEASE.json schema/package identity mismatch');
+  }
+  if (release.version !== version) {
+    throw new Error(`RELEASE.json version mismatch: package=${version} release=${release.version}`);
+  }
+  if (provenance.version !== version) {
+    throw new Error(`PROVENANCE.json version mismatch: package=${version} provenance=${provenance.version}`);
+  }
+  if (release.parent?.release_id !== provenance.parent_release_id ||
+      release.parent?.manifest_sha256 !== provenance.parent_manifest_sha256 ||
+      release.parent?.generation_manifest_sha256 !== provenance.parent_generation_manifest_sha256) {
+    throw new Error('RELEASE.json parent identity does not match sealed PROVENANCE.json lineage');
+  }
+
   const existing = spawnSync(node, [npmCli, 'view', `deadbyte-mcp@${version}`, 'version', '--json'], {
     cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], shell: false, windowsHide: true,
   });

package/src/observation-output-contracts.mjs

@@ -5,7 +5,8 @@ const hex64=z.string().regex(/^[0-9a-f]{64}$/);
 const receiptId=z.string().regex(/^[0-9a-f]{24}$/);
 const searchState=z.enum(['pending','running','completed','cancelled','failed']);
 const evidenceShape={request_sha256:hex64,result_head_sha256:hex64,receipt_id:receiptId.nullable(),receipt_sha256:hex64.nullable()};
-const resultSchema=z.strictObject({path:z.string().min(1).max(512),line:z.number().int().min(1),column:z.number().int().min(1),preview:z.string().max(512)});
+const overflowSchema=z.strictObject({occurred:z.boolean(),reason:z.enum(['result_cap','byte_cap','time_limit','producer_failure']).nullable(),emitted:z.number().int().nonnegative(),dropped:z.union([z.number().int().nonnegative(),z.literal('unknown')]),resume_supported:z.boolean()});
+const resultSchema=z.strictObject({result_id:hex64,path:z.string().min(1).max(512),file_sha256:hex64,line:z.number().int().min(1),column:z.number().int().min(1),preview:z.string().max(512)});
 const processSchema=z.strictObject({pid:z.number().int().positive(),parent_pid:z.number().int().nonnegative(),name:z.string().max(260),
   ownership:z.enum(['deadbyte-runtime','deadbyte-session','external']),executable_path:z.string().max(2048).nullable(),command_line:z.string().max(4096).nullable()});
 
@@ -17,18 +18,18 @@ function statusContract(shape,successRequired=[]){
 }
 
 export const observationSearchStartOutputSchema=z.strictObject({
-  status:z.enum(['accepted','failed']),error:z.string().optional(),search_id:hex64.optional(),state:searchState.optional(),request_sha256:hex64.optional()
-}).superRefine((v,ctx)=>{if(v.status==='accepted'){for(const k of ['search_id','state','request_sha256']) if(v[k]===undefined) ctx.addIssue({code:'custom',path:[k],message:`${k} required`});} else if(!v.error) ctx.addIssue({code:'custom',path:['error'],message:'error required'});});
+  status:z.enum(['accepted','failed']),error:z.string().optional(),search_id:hex64.optional(),snapshot_id:hex64.optional(),state:searchState.optional(),request_sha256:hex64.optional()
+}).superRefine((v,ctx)=>{if(v.status==='accepted'){for(const k of ['search_id','snapshot_id','state','request_sha256']) if(v[k]===undefined) ctx.addIssue({code:'custom',path:[k],message:`${k} required`});} else if(!v.error) ctx.addIssue({code:'custom',path:['error'],message:'error required'});});
 export const observationSearchPageOutputSchema=statusContract({
-  search_id:hex64.optional(),state:searchState.optional(),results:z.array(resultSchema).max(500).optional(),next_cursor:z.string().max(512).nullable().optional(),
+  search_id:hex64.optional(),snapshot_id:hex64.optional(),state:searchState.optional(),results:z.array(resultSchema).max(500).optional(),next_cursor:z.string().max(1024).nullable().optional(),sequence:z.number().int().min(0).optional(),overflow:overflowSchema.optional(),
   ...Object.fromEntries(Object.entries(evidenceShape).map(([k,v])=>[k,v.optional()]))
-},['search_id','state','results','next_cursor','request_sha256','result_head_sha256','receipt_id','receipt_sha256']);
+},['search_id','snapshot_id','state','results','next_cursor','sequence','overflow','request_sha256','result_head_sha256','receipt_id','receipt_sha256']);
 
 export const observationSearchStatusOutputSchema=statusContract({
-  search_id:hex64.optional(),state:searchState.optional(),result_count:z.number().int().nonnegative().optional(),files_scanned:z.number().int().nonnegative().optional(),
-  bytes_scanned:z.number().int().nonnegative().optional(),truncated:z.boolean().optional(),search_error:z.string().nullable().optional(),
+  search_id:hex64.optional(),snapshot_id:hex64.optional(),state:searchState.optional(),result_count:z.number().int().nonnegative().optional(),files_scanned:z.number().int().nonnegative().optional(),
+  bytes_scanned:z.number().int().nonnegative().optional(),truncated:z.boolean().optional(),overflow:overflowSchema.optional(),search_error:z.string().nullable().optional(),
   ...Object.fromEntries(Object.entries(evidenceShape).map(([k,v])=>[k,v.optional()]))
-},['search_id','state','result_count','files_scanned','bytes_scanned','truncated','search_error','request_sha256','result_head_sha256','receipt_id','receipt_sha256']);
+},['search_id','snapshot_id','state','result_count','files_scanned','bytes_scanned','truncated','overflow','search_error','request_sha256','result_head_sha256','receipt_id','receipt_sha256']);
 
 export const observationSearchCancelOutputSchema=statusContract({
   search_id:hex64.optional(),state:searchState.optional(),cancel_requested:z.boolean().optional()

package/src/observation-runtime.mjs

@@ -51,6 +51,8 @@ function decodeCursor(value){
   try { return JSON.parse(Buffer.from(String(value),'base64url').toString('utf8')); }
   catch { throw new Error('invalid observation cursor'); }
 }
+function cursorTag(secret, body){ return sha256Bytes(Buffer.concat([secret,Buffer.from(canonicalJson(body),'utf8')])); }
+function makeStableResultId({path,fileSha256,line,column}){ return sha256Object({schema:'deadbyte.search-result.v1',path:path.replaceAll('\\\\','/'),file_sha256:fileSha256,line,column}); }
 async function writeReceipt(runtime,kind,requestSha,resultHead,summary){
   const receiptId=randomBytes(12).toString('hex');
   const body={schema:OBSERVATION_RECEIPT_SCHEMA,receipt_id:receiptId,kind,
@@ -140,6 +142,9 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
   if(!Number.isInteger(maxSearchSessions)||maxSearchSessions<1||maxSearchSessions>4096) throw new Error('maxSearchSessions out of range');
   if(typeof clockMs!=='function') throw new Error('clockMs must be a function');
   const searches=new Map(),snapshots=new Map();
+  const searchCursorSecrets=new Map();
+  const SEARCH_CURSOR_SCHEMA='deadbyte.search-cursor.v1';
+  const overflowReason=Object.freeze({result_cap:'result_cap',byte_cap:'byte_cap',time_limit:'time_limit',producer_failure:'producer_failure'});
   let signingPromise=null;
   const runtime={policy,signing:()=>signingPromise??=(loadPrivateSigningKey(signingKeyPath))};
   const terminalSearchState=state=>['completed','cancelled','failed'].includes(state);
@@ -175,7 +180,7 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
     session.state='running';
     try {
       const start=await resolveObservationRoot(policy,session.root_id,session.path);
-      const files=[]; const queue=[{dir:start.resolved,rel:start.reported==='.'?'':start.reported}];
+      const snapshotId=session.snapshot_id; const queue=[{dir:start.resolved,rel:start.reported==='.'?'':start.reported}]; const files=[];
       while(queue.length&&files.length<session.max_files&&!session.cancel_requested){
         const current=queue.shift(); const children=await readdir(current.dir,{withFileTypes:true});
         children.sort((a,b)=>a.name.localeCompare(b.name));
@@ -189,28 +194,30 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
         }
       }
       files.sort((a,b)=>a.path.localeCompare(b.path));
-      if(queue.length) session.truncated=true;
+      if(queue.length){ session.truncated=true; session.overflow={occurred:true,reason:overflowReason.result_cap,emitted:session.results.length,dropped:'unknown',resume_supported:false}; }
       const needle=session.case_sensitive?session.pattern:session.pattern.toLowerCase();
       for(const file of files){
         if(session.cancel_requested) break;
         if(file.bytes>session.max_file_bytes) continue;
-        if(session.bytes_scanned+file.bytes>session.max_bytes){ session.truncated=true; break; }
-        const bytes=await readFile(file.full); let text;
+        if(session.bytes_scanned+file.bytes>session.max_bytes){ session.truncated=true; session.overflow={occurred:true,reason:overflowReason.byte_cap,emitted:session.results.length,dropped:'unknown',resume_supported:false}; break; }
+        const bytes=await readFile(file.full); const fileSha256=sha256Bytes(bytes); let text;
         try { text=decodeUtf8Strict(bytes); } catch { continue; }
         session.files_scanned++; session.bytes_scanned+=bytes.length;
         const lines=text.split(/\r?\n/);
         for(let i=0;i<lines.length;i++){
           const hay=session.case_sensitive?lines[i]:lines[i].toLowerCase(); const index=hay.indexOf(needle);
           if(index<0) continue;
-          const result={path:file.path,line:i+1,column:index+1,preview:lines[i].slice(Math.max(0,index-40),index+Math.min(200,session.pattern.length+120))};
+          const resultBase={path:file.path,file_sha256:fileSha256,line:i+1,column:index+1,preview:lines[i].slice(Math.max(0,index-40),index+Math.min(200,session.pattern.length+120))};
+          const result={...resultBase,result_id:makeStableResultId(resultBase)};
           session.results.push(result); session.result_head_sha256=sha256Object({previous_result_sha256:session.result_head_sha256,result});
-          if(session.results.length>=session.max_results){ session.truncated=true; break; }
+          if(session.results.length>=session.max_results){ session.truncated=true; session.overflow={occurred:true,reason:overflowReason.result_cap,emitted:session.results.length,dropped:'unknown',resume_supported:false}; break; }
         }
         if(session.results.length>=session.max_results) break;
         await new Promise(resolve=>setImmediate(resolve));
       }
+      if(session.cancel_requested){ session.overflow={occurred:session.truncated,reason:session.truncated?overflowReason.result_cap:null,emitted:session.results.length,dropped:session.truncated?'unknown':0,resume_supported:false}; }
       await finalizeSearch(session,session.cancel_requested?'cancelled':'completed');
-    } catch(error){ await finalizeSearch(session,'failed',error); }
+    } catch(error){ session.overflow={occurred:true,reason:overflowReason.producer_failure,emitted:session.results.length,dropped:'unknown',resume_supported:false}; await finalizeSearch(session,'failed',error); }
   }
   async function searchStart({rootId,relativePath='.',pattern,caseSensitive=false,maxResults=200,maxFiles=2000,maxBytes=4*1024*1024,maxFileBytes=262144}){
     if(typeof pattern!=='string'||pattern.length<1||pattern.length>256) throw new Error('search pattern must be 1-256 characters');
@@ -224,14 +231,16 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
     const args={root_id:rootId,path:relativePath,pattern,case_sensitive:caseSensitive,max_results:maxResults,max_files:maxFiles,max_bytes:maxBytes,max_file_bytes:maxFileBytes};
     const session={search_id:randomBytes(32).toString('hex'),root_id:rootId,path:relativePath,pattern,case_sensitive:caseSensitive,
       max_results:maxResults,max_files:maxFiles,max_bytes:maxBytes,max_file_bytes:maxFileBytes,state:'pending',cancel_requested:false,
-      results:[],files_scanned:0,bytes_scanned:0,truncated:false,result_head_sha256:ZERO,error:null,receipt_id:null,receipt_sha256:null,
-      created_at_ms:Number(clockMs()),completed_at_ms:null,request_sha256:requestSha(policy,'machine_search_start',args)};
+      snapshot_id:randomBytes(32).toString('hex'),snapshot_expires_at_ms:Number(clockMs())+searchSessionTtlMs,
+      results:[],files_scanned:0,bytes_scanned:0,truncated:false,overflow:{occurred:false,reason:null,emitted:0,dropped:0,resume_supported:true},result_head_sha256:ZERO,error:null,receipt_id:null,receipt_sha256:null,
+      created_at_ms:Number(clockMs()),completed_at_ms:null,max_ack_position:0,last_cursor:null,last_cursor_response:null,request_sha256:requestSha(policy,'machine_search_start',args)};
+    searchCursorSecrets.set(session.search_id,randomBytes(32));
     searches.set(session.search_id,session); setImmediate(()=>{ void executeSearch(session); });
-    return {status:'accepted',search_id:session.search_id,state:session.state,request_sha256:session.request_sha256};
+    return {status:'accepted',search_id:session.search_id,snapshot_id:session.snapshot_id,state:session.state,request_sha256:session.request_sha256};
   }
   async function searchStatus({searchId}){
-    const s=searchFor(searchId); return {status:'ok',search_id:s.search_id,state:s.state,result_count:s.results.length,files_scanned:s.files_scanned,
-      bytes_scanned:s.bytes_scanned,truncated:s.truncated,request_sha256:s.request_sha256,result_head_sha256:s.result_head_sha256,
+    const s=searchFor(searchId); return {status:'ok',search_id:s.search_id,snapshot_id:s.snapshot_id,state:s.state,result_count:s.results.length,files_scanned:s.files_scanned,
+      bytes_scanned:s.bytes_scanned,truncated:s.truncated,overflow:s.overflow,request_sha256:s.request_sha256,result_head_sha256:s.result_head_sha256,
       receipt_id:s.receipt_id,receipt_sha256:s.receipt_sha256,error:s.error};
   }
   async function searchCancel({searchId}){
@@ -241,12 +250,33 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
   }
   async function searchPage({searchId,limit=100,cursor=null}){
     const s=searchFor(searchId);
+    const now=Number(clockMs());
+    if(now>=s.snapshot_expires_at_ms) throw new Error('search snapshot expired');
     if(!Number.isInteger(limit)||limit<1||limit>500) throw new Error('search page limit must be in [1,500]');
-    let index=0;
-    if(cursor!==null){ const parsed=decodeCursor(cursor); if(parsed.search_id!==searchId||!Number.isInteger(parsed.index)||parsed.index<0) throw new Error('search cursor mismatch'); index=parsed.index; }
-    const results=s.results.slice(index,index+limit); const next=index+results.length<s.results.length?encodeCursor({search_id:searchId,index:index+results.length}):null;
-    return {status:'ok',search_id:s.search_id,state:s.state,results,next_cursor:next,result_head_sha256:s.result_head_sha256,
-      request_sha256:s.request_sha256,receipt_id:s.receipt_id,receipt_sha256:s.receipt_sha256};
+    let position=0, nextSequence=1;
+    if(cursor!==null){
+      const parsed=decodeCursor(cursor);
+      const body={schema:SEARCH_CURSOR_SCHEMA,search_id:parsed.search_id,snapshot_id:parsed.snapshot_id,next_sequence:parsed.next_sequence,position:parsed.position};
+      const secret=searchCursorSecrets.get(searchId);
+      if(!secret||parsed.search_id!==searchId||parsed.snapshot_id!==s.snapshot_id||!Number.isInteger(parsed.next_sequence)||!Number.isInteger(parsed.position)||parsed.position<0||parsed.next_sequence<1||parsed.next_sequence!==parsed.position+1||parsed.integrity!==cursorTag(secret,body)){
+        throw new Error('invalid, tampered, rewound, or mismatched search cursor');
+      }
+      position=parsed.position; nextSequence=parsed.next_sequence;
+    }
+    if(position>s.results.length) throw new Error('search cursor is ahead of producer boundary');
+    if(position<s.max_ack_position){
+      if(cursor!==null && cursor===s.last_cursor && s.last_cursor_response) return s.last_cursor_response;
+      throw new Error('rewound search cursor rejected');
+    }
+    const results=s.results.slice(position,position+limit);
+    const nextPosition=position+results.length;
+    s.max_ack_position=Math.max(s.max_ack_position,nextPosition);
+    const next=nextPosition<s.results.length ? (()=>{ const body={schema:SEARCH_CURSOR_SCHEMA,search_id:s.search_id,snapshot_id:s.snapshot_id,next_sequence:nextPosition+1,position:nextPosition}; const integrity=cursorTag(searchCursorSecrets.get(searchId),body); return encodeCursor({...body,integrity}); })() : null;
+    const response=Object.freeze({status:'ok',search_id:s.search_id,snapshot_id:s.snapshot_id,state:s.state,results,next_cursor:next,
+      sequence:nextSequence+results.length-1,overflow:s.overflow,result_head_sha256:s.result_head_sha256,
+      request_sha256:s.request_sha256,receipt_id:s.receipt_id,receipt_sha256:s.receipt_sha256});
+    if(cursor!==null) { s.last_cursor=cursor; s.last_cursor_response=response; }
+    return response;
   }
   async function captureProcessSnapshot(includeExternal){
     const observedAt=nowUtc(); const rows=await processSnapshotProvider();

package/src/operation-history.mjs

@@ -0,0 +1,95 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { canonicalJson } from './canonical-json.mjs';
+
+const ZERO_HASH='0'.repeat(64);
+const sha256=value=>createHash('sha256').update(value).digest('hex');
+const objectHash=value=>sha256(Buffer.from(canonicalJson(value),'utf8'));
+
+export const OPERATION_HISTORY_SCHEMA='deadbyte.operation-history.v1';
+
+export function createOperationHistory({maxEvents=1024,maxBytes=1024*1024,clockMs=()=>Date.now(),operationId=randomBytes(16).toString('hex')}={}){
+  if(!Number.isInteger(maxEvents)||maxEvents<1||maxEvents>100000) throw new Error('maxEvents out of range');
+  if(!Number.isInteger(maxBytes)||maxBytes<1024||maxBytes>64*1024*1024) throw new Error('maxBytes out of range');
+  if(typeof clockMs!=='function') throw new Error('clockMs must be a function');
+  if(typeof operationId!=='string'||operationId.length<1||operationId.length>128) throw new Error('invalid operationId');
+  const events=[];
+  let bytes=0,sequence=0,head=ZERO_HASH;
+  let overflow={occurred:false,reason:null,dropped:0,dropped_bytes:0,resume_supported:true};
+
+  function append(eventType,payload={}){
+    if(typeof eventType!=='string'||eventType.length<1||eventType.length>128) throw new Error('invalid eventType');
+    const payloadDigest=objectHash(payload);
+    const body={
+      schema:OPERATION_HISTORY_SCHEMA,
+      operation_id:operationId,
+      sequence:++sequence,
+      event_type:eventType,
+      at_ms:Number(clockMs()),
+      payload_digest:payloadDigest,
+      previous_event_hash:head
+    };
+    const eventHash=objectHash(body);
+    const frozenPayload=JSON.parse(canonicalJson(payload));
+    const event=Object.freeze({...body,event_hash:eventHash,payload:Object.freeze(frozenPayload)});
+    const size=Buffer.byteLength(canonicalJson(event),'utf8');
+    if(size>maxBytes) throw new Error('operation history event exceeds byte cap');
+    while(events.length&&bytes+size>maxBytes){
+      const dropped=events.shift();
+      bytes-=dropped.__bytes;
+      overflow={occurred:true,reason:'byte_cap',dropped:overflow.dropped+1,dropped_bytes:overflow.dropped_bytes+dropped.__bytes,resume_supported:false};
+    }
+    events.push(Object.freeze({...event,__bytes:size}));
+    bytes+=size; head=eventHash;
+    if(events.length>maxEvents){
+      const dropped=events.shift();
+      bytes-=dropped.__bytes;
+      overflow={occurred:true,reason:'event_cap',dropped:overflow.dropped+1,dropped_bytes:overflow.dropped_bytes+dropped.__bytes,resume_supported:false};
+    }
+    return event;
+  }
+
+  function read({afterSequence=0,limit=100}={}){
+    if(!Number.isInteger(afterSequence)||afterSequence<0) throw new Error('invalid history cursor');
+    if(!Number.isInteger(limit)||limit<1||limit>1000) throw new Error('history limit out of range');
+    const earliest=events[0]?.sequence??sequence+1;
+    if(afterSequence<earliest-1&&events.length) throw new Error('history cursor expired by bounded retention');
+    const selected=events.filter(e=>e.sequence>afterSequence).slice(0,limit).map(({__bytes,...e})=>e);
+    return {
+      schema:OPERATION_HISTORY_SCHEMA,operation_id:operationId,events:selected,
+      next_sequence:selected.length?selected.at(-1).sequence:afterSequence,
+      head_event_hash:head,earliest_sequence:earliest,
+      overflow:Object.freeze({...overflow})
+    };
+  }
+
+  function verify(){
+    let previous=events.length&&overflow.occurred ? events[0].previous_event_hash : ZERO_HASH;
+    for(let i=0;i<events.length;i++){
+      const {event_hash,payload,__bytes,...body}=events[i];
+      if(body.operation_id!==operationId||body.sequence!==events[i].sequence||body.previous_event_hash!==previous) return {ok:false,reason:'continuity_mismatch'};
+      if(body.payload_digest!==objectHash(payload)||event_hash!==objectHash(body)) return {ok:false,reason:'event_hash_mismatch'};
+      previous=event_hash;
+    }
+    return {ok:true,head_event_hash:head,earliest_sequence:events[0]?.sequence??sequence+1,next_sequence:sequence+1,overflow:{...overflow}};
+  }
+
+  return Object.freeze({
+    operationId,
+    append,
+    read,
+    verify,
+    snapshot:()=>read({afterSequence:Math.max(0,(events[0]?.sequence??sequence+1)-1),limit:Math.min(maxEvents,1000)})
+  });
+}
+export function operationHistoryReceipt(history){
+  const verified=history.verify();
+  if(!verified.ok) throw new Error('operation history integrity verification failed');
+  return Object.freeze({
+    schema:OPERATION_HISTORY_SCHEMA,
+    operation_id:history.operationId,
+    head_event_hash:verified.head_event_hash,
+    earliest_sequence:verified.earliest_sequence,
+    next_sequence:verified.next_sequence,
+    overflow:verified.overflow
+  });
+}

package/src/operation-lifecycle.mjs

@@ -0,0 +1,63 @@
+import { randomBytes } from 'node:crypto';
+import { createOperationHistory, operationHistoryReceipt } from './operation-history.mjs';
+
+export const OPERATION_LIFECYCLE_SCHEMA='deadbyte.operation-lifecycle.v1';
+const TERMINAL=new Set(['success','failure','cancelled','timed_out']);
+const ACTIVE=new Set(['start','running','cancel_requested','canceling','output','error']);
+const ALLOWED=new Map([
+  ['start',new Set(['running','cancel_requested','output','error','success','failure','cancelled','timed_out'])],
+  ['running',new Set(['running','cancel_requested','canceling','output','error','success','failure','cancelled','timed_out'])],
+  ['cancel_requested',new Set(['canceling','cancelled','timed_out','output','error'])],
+  ['canceling',new Set(['cancelled','timed_out','output','error'])],
+  ['output',new Set(['running','cancel_requested','canceling','output','error','success','failure','cancelled','timed_out'])],
+  ['error',new Set(['running','cancel_requested','canceling','success','failure','cancelled','timed_out','error'])],
+  ['success',new Set()], ['failure',new Set()], ['cancelled',new Set()], ['timed_out',new Set()]
+]);
+
+export function createOperationLifecycle({operationId=randomBytes(32).toString('hex'),clockMs=()=>Date.now(),maxEvents=1024,maxBytes=1024*1024}={}){
+  const history=createOperationHistory({operationId,clockMs,maxEvents,maxBytes});
+  let state='new';
+  let terminalSequence=null;
+  let terminalEventHash=null;
+  let terminalType=null;
+
+  function emit(type,payload={}){
+    if(typeof type!=='string'||(!ACTIVE.has(type)&&!TERMINAL.has(type))) throw new Error('invalid lifecycle event');
+    if(terminalType) {
+      if(TERMINAL.has(type)) throw new Error('terminal transition already committed');
+      throw new Error('late operation event rejected after terminal');
+    }
+    if(type==='start' && state!=='new') throw new Error('duplicate operation start');
+    const allowed=state==='new' ? new Set(['start']) : ALLOWED.get(state);
+    if(!allowed?.has(type)) throw new Error('invalid operation transition '+state+' -> '+type);
+    const event=history.append(type,payload);
+    state=type;
+    if(TERMINAL.has(type)){ terminalSequence=event.sequence; terminalEventHash=event.event_hash; terminalType=type; }
+    return Object.freeze({schema:OPERATION_LIFECYCLE_SCHEMA,operation_id:operationId,state,event});
+  }
+
+  function terminal(type,payload={}) {
+    if(!TERMINAL.has(type)) throw new Error('terminal type required');
+    return emit(type,payload);
+  }
+
+  function snapshot(){
+    const verified=history.verify();
+    return Object.freeze({
+      schema:OPERATION_LIFECYCLE_SCHEMA,operation_id:operationId,state,
+      terminal:{type:terminalType,sequence:terminalSequence,event_hash:terminalEventHash},
+      history_head_sha256:verified.head_event_hash,
+      next_sequence:verified.next_sequence,
+      overflow:verified.overflow
+    });
+  }
+
+  function receipt(){
+    if(!terminalType) throw new Error('terminal receipt unavailable before terminal transition');
+    const h=operationHistoryReceipt(history);
+    if(h.next_sequence!==terminalSequence+1 || h.head_event_hash!==terminalEventHash) throw new Error('terminal receipt/history mismatch');
+    return Object.freeze({...h,terminal_type:terminalType,terminal_sequence:terminalSequence,terminal_event_hash:terminalEventHash});
+  }
+
+  return Object.freeze({operationId,history,emit,terminal,snapshot,receipt,isTerminal:()=>Boolean(terminalType)});
+}