deadbyte-mcp 0.15.25 → 0.15.27

package/test/autonomous-desktop-r40.test.mjs

@@ -11,7 +11,7 @@ const POLICY=H('desktop-policy');
 const WIN={hwnd:'0x1234',pid:77,process_image_sha256:H('desktop-app'),title_sha256:H('desktop-title')};
 
 function fakeDesktopRuntime({armed=false,unknown=false}={}){
-  const calls={status:0,observe:0,ground:0,action:0,verify:0};
+  const calls={status:0,observe:0,wait:0,ground:0,action:0,verify:0};
   const receipts=new Map();
   let seq=0;
   const issue=kind=>{
@@ -28,6 +28,9 @@ function fakeDesktopRuntime({armed=false,unknown=false}={}){
     async status(){calls.status++;return {status:'ok',configured:true,armed,reason:armed?'standing-grant':'disarmed',
       action_kinds:armed?['click_primary']:[],policy_sha256:POLICY,observer_backend:'fake'};},
     async observe(){calls.observe++;const r=issue('desktop_observation');return {status:'ok',frame:frame(FRAME),backend:'fake',byte_length:4,...r};},
+    async wait({baselineFrameId,until}){calls.wait++;assert.equal(baselineFrameId,FRAME);assert.equal(until,'frame_changed');
+      const r=issue('desktop_wait_observation');return {status:'ok',condition:until,satisfied:true,timed_out:false,attempts:2,elapsed_ms:100,
+        baseline_frame_id:FRAME,frame:frame(GROUNDED_FRAME),match:null,...r};},
     async ground({frameId,query}){calls.ground++;assert.equal(frameId,FRAME);assert.equal(query.kind,'root');
       const r=issue('desktop_grounding');return {status:'ok',frame:frame(GROUNDED_FRAME),
         target:{target_id:TARGET,frame_id:GROUNDED_FRAME,rect:{left:100,top:100,width:200,height:80},source:'uia'},
@@ -99,6 +102,29 @@ test('T7 read-only Desktop observe works while Desktop mutation authority is DIS
   }finally{await f.cleanup();}
 });
 
+test('successor autonomous Desktop wait replaces fixed sleep and verifies signed observation evidence',async()=>{
+  const d=fakeDesktopRuntime({armed:false});
+  const f=await createR34Fixture({desktopRuntime:d});
+  try{
+    const goal=await f.runtime.submit({submissionId:'desktop-bounded-wait',rootId:'project',title:'desktop wait',goal:'wait for visual change',acceptance:'signed bounded wait'});
+    let result=await f.runtime.run({goalId:goal.goal_id,maxCycles:2});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,plan(['observe','wait']));
+    result=await toAct(f,goal,result);
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{kind:'desktop_observe'}});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,complete('observe','wait-observe-proof'));
+    result=await toAct(f,goal,result);
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{
+      kind:'desktop_wait',baseline_frame_id:FRAME,until:'frame_changed',uia_query:null,timeout_ms:1000,poll_ms:100
+    }});
+    assert.equal(result.loop.phase,'VERIFYING');
+    assert.equal(d.calls.wait,1);assert.equal(d.calls.action,0);assert.equal(d.calls.verify,2);
+    const journal=await f.runtime.events({goalId:goal.goal_id,fromSeq:1,limit:200});
+    const completed=journal.events.find(e=>e.type==='delegated_action_completed'&&e.payload?.operation?.kind==='desktop_wait');
+    assert.equal(completed.payload.capability_id,'desktop.wait');
+    assert.equal(completed.payload.evidence.receipts[0].kind,'desktop_wait_observation');
+  }finally{await f.cleanup();}
+});
+
 test('T7 Autonomous authority cannot substitute for missing Desktop mutation grant',async()=>{
   const d=fakeDesktopRuntime({armed:false});
   const f=await createR34Fixture({desktopRuntime:d});

package/test/desktop-mcp-tools-r40.test.mjs

@@ -1,7 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import {
-  desktopActionInputSchema,desktopControlInputSchema,desktopTargetInputSchema,registerDesktopTools
+  desktopActionInputSchema,desktopControlInputSchema,desktopTargetInputSchema,desktopWaitInputSchema,registerDesktopTools
 } from '../src/desktop-mcp-tools-r40.mjs';
 
 const H=c=>c.repeat(64);
@@ -30,11 +30,26 @@ test('R40 T5 target schema supports local UIA query without arbitrary dispatch',
   assert.equal(desktopControlInputSchema.safeParse({op:'target',frame_id:frame,uia_query:{kind:'control_type',value:'button',max_results:4,ordinal:0}}).success,true);
 });
 
-test('R40 full desktop surface registers four narrow typed tools',()=>{
+test('successor desktop wait schema is bounded, semantic, and rejects action-shaped fields',()=>{
+  assert.equal(desktopWaitInputSchema.safeParse({
+    baseline_frame_id:frame,until:'frame_changed',timeout_ms:5000,poll_ms:100,preview:false
+  }).success,true);
+  assert.equal(desktopWaitInputSchema.safeParse({
+    baseline_frame_id:frame,until:'uia_present',uia_query:{kind:'name_exact',value:'Ready',max_results:8,ordinal:0},timeout_ms:5000,poll_ms:100,preview:false
+  }).success,true);
+  assert.equal(desktopWaitInputSchema.safeParse({
+    baseline_frame_id:frame,until:'uia_present',timeout_ms:5000,poll_ms:100,preview:false
+  }).success,false);
+  assert.equal(desktopControlInputSchema.safeParse({
+    op:'wait',baseline_frame_id:frame,until:'frame_changed',timeout_ms:5000,poll_ms:100,preview:false,point:{x:1,y:2}
+  }).success,false);
+});
+
+test('successor full desktop surface registers bounded semantic wait without mutation authority',()=>{
   const server=fakeServer();
-  const runtime={status(){},observe(){},target(){},action(){}};
+  const runtime={status(){},observe(){},wait(){},target(){},action(){}};
   registerDesktopTools(server,{runtime});
-  assert.deepEqual([...server.tools.keys()].sort(),['desktop_action','desktop_observe','desktop_status','desktop_target']);
+  assert.deepEqual([...server.tools.keys()].sort(),['desktop_action','desktop_observe','desktop_status','desktop_target','desktop_wait']);
 });
 
 test('R40 public desktop action output removes raw text while preserving content and action hashes',async()=>{

package/test/desktop-runtime-r40.test.mjs

@@ -19,7 +19,7 @@ function F(at,image=H('same'),window=WIN){
     bounds:{left:0,top:0,width:1000,height:800},activeWindow:window,imageSha256:image
   });
 }
-async function fixture({grantActions=['click_primary','text_input'],captureFrames=null,times=null,inputProvider=null,grounderProvider=null}={}){
+async function fixture({grantActions=['click_primary','text_input'],captureFrames=null,times=null,inputProvider=null,grounderProvider=null,clockMs=null,sleeper=null}={}){
   const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r40-desktop-runtime-'));
   const grant=path.join(root,'grant.json'),evidence=path.join(root,'evidence');
   const policy={
@@ -59,7 +59,7 @@ async function fixture({grantActions=['click_primary','text_input'],captureFrame
     '2026-09-19T02:00:01.000Z'
   ])];
   const now=()=>clock.length?clock.shift():'2026-09-19T02:00:01.000Z';
-  const runtime=createDesktopRuntime({policy,observerRuntime,inputProvider:provider,grounderProvider,privateKey,keyId:'test-key',evidenceDir:evidence,now});
+  const runtime=createDesktopRuntime({policy,observerRuntime,inputProvider:provider,grounderProvider,privateKey,keyId:'test-key',evidenceDir:evidence,now,clockMs:clockMs??undefined,sleeper:sleeper??undefined});
   return {root,grant,evidence,policy,expected,runtime,calls,publicKey};
 }
 
@@ -242,6 +242,47 @@ test('read-only observe works independently of desktop mutation grant',async()=>
   assert.match(observed.receipt_sha256,/^[0-9a-f]{64}$/);
 });
 
+test('successor desktop wait observes until a frame changes and publishes signed final evidence',async()=>{
+  let tick=0;
+  const same={frame:F('2026-09-19T02:00:00.600Z'),backend:'fake',byte_length:4};
+  const changed={frame:F('2026-09-19T02:00:00.900Z',H('changed')),backend:'fake',byte_length:4};
+  const fx=await fixture({
+    captureFrames:[same,changed],clockMs:()=>tick,sleeper:async ms=>{tick+=ms;},
+    times:['2026-09-19T02:00:01.000Z']
+  });
+  await writeFile(fx.grant,'{}');
+  const result=await fx.runtime.wait({baselineFrameId:fx.expected.frame_id,until:'frame_changed',timeoutMs:1000,pollMs:100});
+  assert.equal(result.satisfied,true);
+  assert.equal(result.timed_out,false);
+  assert.equal(result.attempts,2);
+  assert.equal(result.frame.frame_id,changed.frame.frame_id);
+  assert.match(result.receipt_sha256,/^[0-9a-f]{64}$/);
+  const receipt=JSON.parse(await readFile(path.join(fx.evidence,`${result.receipt_id}.json`),'utf8'));
+  assert.equal(receipt.kind,'desktop_wait_observation');
+  assert.equal(receipt.payload.condition,'frame_changed');
+  assert.equal(receipt.payload.satisfied,true);
+  assert.equal(fx.calls.length,0);
+});
+
+test('successor desktop wait uses local UIA matching without leaking query text or dispatching input',async()=>{
+  let tick=0,queries=0;
+  const first={frame:F('2026-09-19T02:00:00.600Z'),backend:'fake',byte_length:4};
+  const second={frame:F('2026-09-19T02:00:00.900Z'),backend:'fake',byte_length:4};
+  const grounderProvider=async({query})=>{
+    queries++;
+    return {status:'ok',query_sha256:H('wait-query'),query_kind:query.kind,ordinal:0,visited:4,truncated:false,
+      matches:queries===1?[]:[{rect:{left:1,top:2,width:3,height:4},control_type:50000,enabled:true,offscreen:false}],
+      provider_receipt_sha256:H('wait-provider')};
+  };
+  const fx=await fixture({captureFrames:[first,second],grounderProvider,clockMs:()=>tick,sleeper:async ms=>{tick+=ms;},times:['2026-09-19T02:00:01.000Z']});
+  const result=await fx.runtime.wait({baselineFrameId:fx.expected.frame_id,until:'uia_present',query:{kind:'name_exact',value:'SECRET READY',max_results:8,ordinal:0},timeoutMs:1000,pollMs:100});
+  assert.equal(result.satisfied,true);
+  assert.equal(result.match.actionable,true);
+  assert.equal(result.match.query_sha256,H('wait-query'));
+  assert.equal(JSON.stringify(result).includes('SECRET READY'),false);
+  assert.equal(fx.calls.length,0);
+});
+
 
 test('desktop runtime enforces policy max_text_bytes before observation or input effect',async()=>{
   const fx=await fixture({grantActions:['text_input']});

package/test/full-max-catalog-r48.test.mjs

@@ -7,6 +7,7 @@ import { fileURLToPath } from 'node:url';
 import { Client } from '@modelcontextprotocol/client';
 import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
 import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+import { expectedFullCatalogForEnv } from '../src/runtime-catalog-expectation.mjs';
 
 const here=path.dirname(fileURLToPath(import.meta.url));
 const repoRoot=path.resolve(here,'..');
@@ -15,7 +16,7 @@ const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy
 const catalogPath=path.join(repoRoot,'docs','R48-FULL-TOOL-CATALOG.json');
 const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
 
-test('R48 runtime full stdio catalog exactly matches canonical registration surface',async()=>{
+test('R49 runtime full stdio catalog exactly matches sealed R48 base plus reviewed overlay',async()=>{
   const canonical=JSON.parse(await readFile(catalogPath,'utf8'));
   assert.equal(canonical.schema,'deadbyte.r48-full-catalog.v1');
   assert.equal(canonical.train,'R48');
@@ -61,15 +62,16 @@ test('R48 runtime full stdio catalog exactly matches canonical registration surf
     DEADBYTE_AUTONOMOUS_RUNTIME:'1',DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
     DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
   };
+  const expected=await expectedFullCatalogForEnv(env);
   const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
   try{
     await client.connect(transport);
     const listed=await client.listTools();
     const names=listed.tools.map(t=>t.name).sort();
-    assert.deepEqual(names,canonical.tools);
+    assert.deepEqual(names,expected);
     assert.equal(new Set(names).size,names.length,'runtime duplicate tool names');
     for(const tool of listed.tools) if(tool.outputSchema!==undefined) assert.equal(tool.outputSchema?.additionalProperties,false,'non-strict output '+tool.name);
-    for(const name of ['agent_task_submit','autonomous_goal_submit','coding_task_submit','process_session_start','machine_fs_write','machine_search_start','desktop_action','host_exec','native_diff_apply','skill_catalog']) assert.ok(names.includes(name),'missing R48 surface '+name);
+    for(const name of ['agent_task_submit','autonomous_goal_submit','coding_task_submit','process_session_start','machine_fs_write','machine_search_start','desktop_wait','desktop_action','host_exec','native_diff_apply','skill_catalog']) assert.ok(names.includes(name),'missing R49 surface '+name);
   } finally {
     await client.close().catch(()=>{});
     for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority file appeared during catalog probe: '+q);

package/test/package-boundary.test.mjs

@@ -42,3 +42,9 @@ test('publish boundary excludes live state, private keys, grants and non-example
   const forbidden=files.filter(rel=>rel.startsWith('tmp/')||rel.startsWith('.deadbyte-machine-fs-recovery/')||/(^|\/)(active-release\.json|runtime\/|audit\/|evidence\/)|\.pem$|(^|\/)deadbyte-controller\.config\.psd1$|(^|\/)deadbyte-host-policy\.json$|(^|\/)[^/]*(?:grant|arm)\.json$/i.test(rel));
   assert.deepEqual(forbidden,[]);
 });
+
+test('publish boundary includes only the canonical top-level Windows launcher',()=>{
+  const files=packFiles();
+  const launchers=files.filter(rel=>/^DEADBYTE-MCP.*\.cmd$/i.test(rel));
+  assert.deepEqual(launchers,['DEADBYTE-MCP.cmd']);
+});

package/test/r48-release-contract.test.mjs

@@ -3,46 +3,55 @@ import assert from 'node:assert/strict';
 import { readFile } from 'node:fs/promises';
 import { DEADBYTE_VERSION } from '../src/version.mjs';
 
-const root=new URL('../',import.meta.url);
-const read=rel=>readFile(new URL(rel,root),'utf8');
+const root = new URL('../', import.meta.url);
+const read = rel => readFile(new URL(rel, root), 'utf8');
 
-test('R48 0.15.25 successor binds exact active immutable 0.15.24 parent',async()=>{
-  const [pkg,lock,release,provenance,matrix]=await Promise.all([
+test('R50 0.15.27 successor binds exact published immutable 0.15.26 parent', async () => {
+  const [pkg, lock, release, provenance, matrix] = await Promise.all([
     read('package.json').then(JSON.parse),
     read('package-lock.json').then(JSON.parse),
     read('RELEASE.json').then(JSON.parse),
     read('PROVENANCE.json').then(JSON.parse),
     read('TEST-MATRIX.json').then(JSON.parse)
   ]);
-  assert.equal(pkg.version,'0.15.25');
-  assert.equal(lock.version,'0.15.25');
-  assert.equal(lock.packages[''].version,'0.15.25');
-  assert.equal(DEADBYTE_VERSION,'0.15.25');
-  assert.equal(release.version,'0.15.25');
-  assert.equal(provenance.version,'0.15.25');
-  assert.equal(matrix.version,'0.15.25');
-  assert.equal(release.train,'R48');
-  assert.equal(release.label,'COMMANDER DIFFERENTIAL + PROTOCOL HARDENING BASELINE');
-  assert.equal(release.parent.release_id,'v0.15.24-c33fcbc449562285');
-  assert.equal(release.parent.manifest_sha256,'c33fcbc449562285b4a03e95a6d282d359859f266773043b34db35723dfad54e');
-  assert.equal(release.parent.generation_manifest_sha256,'6b81c4a5b940a6ef525b7d0ce8e7ff5e6b9fc9b8048d9522ea8852fa29b85395');
-  assert.equal(release.source_predecessor.version,'0.15.24');
-  assert.equal(release.source_predecessor.tarball_sha256,'23ea53fb4f331873c742c810f815d5ad18291f74c1bda1fd1d8c08475dbbd4ad');
-  assert.equal(release.source_predecessor.manifest_file_sha256,'c33fcbc449562285b4a03e95a6d282d359859f266773043b34db35723dfad54e');
-  assert.equal(release.source_predecessor.reference_server_sha256,'dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305');
-  assert.equal(release.source_predecessor.reference_schemas_sha256,'f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140');
-  assert.equal(release.capabilities.full_tool_count,116);
-  assert.equal(release.capabilities.commander_incremental_pdf_revisions,true);
-  assert.equal(release.capabilities.commander_docx_header_footer_search,true);
-  assert.equal(release.capabilities.commander_directory_read_fallback,true);
-  assert.equal(release.capabilities.commander_binary_detection,true);
-  assert.equal(release.capabilities.commander_protocol_adversarial,true);
-  assert.equal(release.capabilities.atomic_mutation_unknown_effect,true);
-  assert.equal(provenance.parent_release_id,release.parent.release_id);
-  assert.equal(provenance.parent_manifest_sha256,release.parent.manifest_sha256);
-  assert.equal(provenance.parent_generation_manifest_sha256,release.parent.generation_manifest_sha256);
-  assert.equal(provenance.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
-  assert.equal(matrix.full_regression_partition_proof.files,211);
-  assert.equal(matrix.full_regression_partition_proof.fail,0);
-  assert.equal(matrix.full_regression_partition_proof.task_receipt_sha256,'7711039e4807f6c2af02bbda897d0032b067e0a6631f789fd3bf801258160d3f');
+
+  for (const value of [
+    pkg.version,
+    lock.version,
+    lock.packages[''].version,
+    DEADBYTE_VERSION,
+    release.version,
+    provenance.version,
+    matrix.version
+  ]) assert.equal(value, '0.15.27');
+
+  assert.equal(release.train, 'R50');
+  assert.equal(release.label, 'PUBLIC PACKAGE BOUNDARY HOTFIX');
+  assert.equal(release.parent.release_id, 'v0.15.26-669ea65d2307ee2c');
+  assert.equal(release.parent.manifest_sha256, '669ea65d2307ee2cce06be960e0a8c7243dc6135f7f129a88d99f53096433cc8');
+  assert.equal(release.parent.generation_manifest_sha256, '08364adaf1dab9730c314e29121632c6371ed76fc677e83cb7f6aa6b244eab94');
+
+  assert.equal(release.source_predecessor.version, '0.15.26');
+  assert.equal(release.source_predecessor.tarball_sha256, '3272679e3a18610d47e83dc8d3161e949d75a57da145a43c2ab50c865a83bb86');
+  assert.equal(release.source_predecessor.manifest_file_sha256, '669ea65d2307ee2cce06be960e0a8c7243dc6135f7f129a88d99f53096433cc8');
+  assert.equal(release.source_predecessor.reference_server_sha256, 'dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305');
+  assert.equal(release.source_predecessor.reference_schemas_sha256, 'f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140');
+
+  assert.equal(release.capabilities.full_tool_count, 117);
+  assert.equal(release.capabilities.desktop_bounded_semantic_wait, true);
+  assert.equal(release.capabilities.commander_incremental_pdf_revisions, true);
+  assert.equal(release.capabilities.commander_docx_header_footer_search, true);
+  assert.equal(release.capabilities.commander_directory_read_fallback, true);
+  assert.equal(release.capabilities.commander_binary_detection, true);
+  assert.equal(release.capabilities.commander_protocol_adversarial, true);
+  assert.equal(release.capabilities.atomic_mutation_unknown_effect, true);
+
+  assert.equal(provenance.parent_release_id, release.parent.release_id);
+  assert.equal(provenance.parent_manifest_sha256, release.parent.manifest_sha256);
+  assert.equal(provenance.parent_generation_manifest_sha256, release.parent.generation_manifest_sha256);
+  assert.equal(provenance.source_predecessor_tarball_sha256, release.source_predecessor.tarball_sha256);
+
+  assert.equal(matrix.train, 'R50');
+  assert.equal(matrix.predecessor_r48_full_regression_partition_proof.files, 211);
+  assert.equal(matrix.predecessor_r48_full_regression_partition_proof.not_valid_as_r50_proof, true);
 });

package/test/r49-remote-control-donors.test.mjs

@@ -0,0 +1,24 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+
+const artifact=new URL('../docs/R49-REMOTE-CONTROL-DONORS.json',import.meta.url);
+
+test('R49 remote-control donor evidence pins all requested sources and records bounded native adoption',async()=>{
+  const value=JSON.parse(await readFile(artifact,'utf8'));
+  assert.equal(value.schema,'deadbyte.r49-remote-control-donors.v1');
+  assert.equal(value.donors.length,6);
+  assert.deepEqual(value.donors.map(item=>item.repository),[
+    'https://github.com/shahidx0x/better-remote-commander',
+    'https://github.com/Jennifer9911/open-remote-mcp',
+    'https://github.com/Razewang/secure-host-mcp',
+    'https://github.com/dddabtc/winremote-mcp',
+    'https://github.com/getremcp/remcp',
+    'https://github.com/trycua/cua'
+  ]);
+  for(const donor of value.donors)assert.match(donor.commit,/^[0-9a-f]{40}$/);
+  assert.equal(value.adopted_checkpoint.capability,'desktop.wait');
+  assert.equal(value.adopted_checkpoint.authority,'none');
+  assert.ok(value.adopted_checkpoint.properties.includes('no input dispatch and no action retry'));
+  assert.ok(value.explicit_non_adoptions.includes('generic shell or caller-selected executable authority'));
+});

package/test/r49-windows-gate.test.mjs

@@ -0,0 +1,36 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import test from 'node:test';
+
+const read = path => readFile(new URL(`../${path}`, import.meta.url), 'utf8');
+
+test('R50 canonical Windows gate is successor-bound and preserves R49/R48 historical gates', async () => {
+  const [pkgText, gate, evidence, historicalR49, historicalR48, deferred] = await Promise.all([
+    read('package.json'),
+    read('scripts/gate-windows-r50.ps1'),
+    read('scripts/windows-gate-evidence-r50.mjs'),
+    read('scripts/gate-windows-r49.ps1'),
+    read('scripts/gate-windows-r48.ps1'),
+    read('scripts/deferred-slot-operation-r46.mjs')
+  ]);
+  const pkg = JSON.parse(pkgText);
+  assert.match(pkg.scripts['gate:windows'], /gate-windows-r50\.ps1$/);
+  assert.match(gate, /DEADBYTE 0\.15\.27 \/ R50 WINDOWS GATE: PASS/);
+  assert.match(gate, /r50-package-boundary/);
+  assert.match(gate, /r49-remote-control-donors\.test\.mjs/);
+  assert.match(gate, /desktop-runtime-r40\.test\.mjs/);
+  assert.match(gate, /manifest-final-verify/);
+  assert.match(evidence, /deadbyte\.r50-windows-gate\.v1/);
+  assert.match(evidence, /pkg\.version === '0\.15\.27'/);
+  assert.match(evidence, /release\.train === 'R50'/);
+  assert.match(historicalR49, /DEADBYTE 0\.15\.26 \/ R49 WINDOWS GATE: PASS/);
+  assert.match(historicalR48, /DEADBYTE 0\.15\.25 \/ R48 WINDOWS GATE: PASS/);
+  assert.match(deferred, /const expectedVersion=packageIdentity\.version/);
+  assert.match(deferred, /'--expected-version',expectedVersion/);
+  assert.match(deferred, /async function awaitHandoffCompletion/);
+  assert.match(deferred, /verifySlotUpdateEnvelope\(envelope,publicKey\)/);
+  assert.match(deferred, /active pointer does not match signed activation receipt/);
+  assert.match(deferred, /failure-receipt\.json/);
+  assert.match(deferred, /await awaitHandoffCompletion\(await runSlotUpdateCli/);
+  assert.doesNotMatch(deferred, /'--expected-version','0\.15\.5'/);
+});

package/test/remote-r24-catalog.test.mjs

@@ -32,6 +32,15 @@ test('R29 remote gate accepts machine plane as an exact optional catalog dimensi
   assert.match(source, /if \(machine\) items\.push\(\.\.\.machineTools\)/);
   assert.match(source, /machine_runtime: machineRuntime/);
 });
+
+test('R49 compact remote gate independently verifies signed machine ping', async () => {
+  const source = await readFile(sourcePath, 'utf8');
+  assert.match(source, /verifyMachinePingPublic/);
+  assert.match(source, /public_key_spki_base64/);
+  assert.match(source, /machine ping public Ed25519 verification failed/);
+  assert.match(source, /ping_signature_valid: true/);
+  assert.doesNotMatch(source, /ping_signature_valid: ping\.signature_valid === true/);
+});
 test('R46 remote gate accepts seven-tool process supervision as one exact optional catalog dimension', async () => {
   const source = await readFile(sourcePath, 'utf8');
   assert.match(source, /const processTools = \[/);