deadbyte-mcp 0.15.27 → 0.15.29

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.27",
-  "train": "R50",
+  "version": "0.15.29",
+  "train": "R52",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",
@@ -10,28 +10,136 @@
     "schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
   },
   "required": [
-    {"id":"package-boundary","command":"node --test test/package-boundary.test.mjs","expected":"PASS canonical top-level DEADBYTE-MCP.cmd included; local/shadow wrappers excluded"},
-    {"id":"release-smoke","command":"node --test test/release-smoke-isolation.test.mjs","expected":"PASS"},
-    {"id":"capability-authority-truth","command":"node --test test/capability-resolver.test.mjs","expected":"PASS authority-state manifest truth"},
-    {"id":"compact-authority-truth","command":"node --test test/compact-max-catalog-r45.test.mjs","expected":"PASS real compact stdio authority-state manifest truth"},
-    {"id":"native-windows-observation","command":"powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1","expected":"PASS native Windows observation build/query gate"},
-    {"id":"r49-donor-proof","command":"node --test test/r49-remote-control-donors.test.mjs","expected":"PASS six pinned donor decisions"},
-    {"id":"r49-desktop-wait","command":"node --test test/desktop-runtime-r40.test.mjs test/desktop-mcp-tools-r40.test.mjs test/autonomous-desktop-r40.test.mjs","expected":"PASS bounded semantic wait and signed evidence"},
-    {"id":"r49-catalog","command":"npm run r48:catalog:test","expected":"PASS 117-tool full catalog; compact remains 43"},
-    {"id":"commander-hardening","command":"npm run r47:hardening:test","expected":"PASS"},
-    {"id":"commander-protocol-adversarial","command":"node --test test/commander-protocol-adversarial-r48.test.mjs","expected":"PASS malformed JSON, invalid request, unknown method/tool, duplicate IDs and concurrent correlation"},
-    {"id":"r48-release","command":"npm run r48:release:test","expected":"PASS"},
-    {"id":"full-regression","command":"npm run r48:full:test","expected":"PASS"},
-    {"id":"runtime-update","command":"node --test test/runtime-self-update.test.mjs","expected":"PASS"},
-    {"id":"audit","command":"npm audit --omit=dev","expected":"0 vulnerabilities"},
-    {"id":"activation","command":"npx -y deadbyte-mcp@0.15.27 remote status","expected":"active runtime 0.15.27 with no VERSION SKEW"},
-    {"id":"machine-truth","command":"signed machine_ping","expected":"release_id and manifests bind activated 0.15.27 generation"},
-    {"id":"rollback-restore","command":"immutable slot rollback/restore","expected":"0.15.27 -> exact 0.15.26 -> exact 0.15.27"}
+    {
+      "id": "r52-focused",
+      "command": "npm run r52:focused:test",
+      "expected": "PASS offline predecessor stale Host grant is revoked before capture; R51 coherence/single-flight/livelog and runtime-update contracts remain green"
+    },
+    {
+      "id": "r51-remote-session",
+      "command": "node --test test/remote-session-cli.test.mjs",
+      "expected": "PASS foreground lifecycle, Desktop/Host fail-closed cleanup, guardian and live timeline"
+    },
+    {
+      "id": "package-boundary",
+      "command": "node --test test/package-boundary.test.mjs",
+      "expected": "PASS canonical top-level DEADBYTE-MCP.cmd included; local/shadow wrappers excluded"
+    },
+    {
+      "id": "release-smoke",
+      "command": "node --test test/release-smoke-isolation.test.mjs",
+      "expected": "PASS"
+    },
+    {
+      "id": "capability-authority-truth",
+      "command": "node --test test/capability-resolver.test.mjs",
+      "expected": "PASS authority-state manifest truth"
+    },
+    {
+      "id": "compact-authority-truth",
+      "command": "node --test test/compact-max-catalog-r45.test.mjs",
+      "expected": "PASS real compact stdio authority-state manifest truth"
+    },
+    {
+      "id": "native-windows-observation",
+      "command": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
+      "expected": "PASS native Windows observation build/query gate"
+    },
+    {
+      "id": "r49-donor-proof",
+      "command": "node --test test/r49-remote-control-donors.test.mjs",
+      "expected": "PASS six pinned donor decisions"
+    },
+    {
+      "id": "r49-desktop-wait",
+      "command": "node --test test/desktop-runtime-r40.test.mjs test/desktop-mcp-tools-r40.test.mjs test/autonomous-desktop-r40.test.mjs",
+      "expected": "PASS bounded semantic wait and signed evidence"
+    },
+    {
+      "id": "r49-catalog",
+      "command": "npm run r48:catalog:test",
+      "expected": "PASS 117-tool full catalog; compact remains 43"
+    },
+    {
+      "id": "commander-hardening",
+      "command": "npm run r47:hardening:test",
+      "expected": "PASS"
+    },
+    {
+      "id": "commander-protocol-adversarial",
+      "command": "node --test test/commander-protocol-adversarial-r48.test.mjs",
+      "expected": "PASS malformed JSON, invalid request, unknown method/tool, duplicate IDs and concurrent correlation"
+    },
+    {
+      "id": "r48-release",
+      "command": "npm run r48:release:test",
+      "expected": "PASS"
+    },
+    {
+      "id": "full-regression",
+      "command": "npm run r48:full:test",
+      "expected": "PASS"
+    },
+    {
+      "id": "runtime-update",
+      "command": "node --test test/runtime-self-update.test.mjs",
+      "expected": "PASS"
+    },
+    {
+      "id": "audit",
+      "command": "npm audit --omit=dev",
+      "expected": "0 vulnerabilities"
+    },
+    {
+      "id": "activation",
+      "command": "npx -y deadbyte-mcp@0.15.29 remote",
+      "expected": "active runtime auto-synchronizes from exact 0.15.27 runtime rollback target to exact 0.15.29 package manifest; published lineage parent is exact 0.15.28; offline predecessor Host authority is revoked before capture"
+    },
+    {
+      "id": "machine-truth",
+      "command": "signed machine_ping",
+      "expected": "release_id and manifests bind activated 0.15.29 generation"
+    },
+    {
+      "id": "rollback-restore",
+      "command": "immutable slot rollback/restore",
+      "expected": "0.15.29 -> exact 0.15.27 -> exact 0.15.29"
+    }
   ],
   "focused_proof": {
-    "raw_mcp_protocol": {"tests":3,"pass":3,"fail":0},
-    "commander_hardening": {"tests":139,"pass":139,"fail":0,"skip":0},
-    "npm_audit_production_vulnerabilities": 0
+    "raw_mcp_protocol": {
+      "tests": 3,
+      "pass": 3,
+      "fail": 0
+    },
+    "commander_hardening": {
+      "tests": 139,
+      "pass": 139,
+      "fail": 0,
+      "skip": 0
+    },
+    "npm_audit_production_vulnerabilities": 0,
+    "r51_behavioral": {
+      "tests": 56,
+      "pass": 56,
+      "fail": 0,
+      "components": [
+        "release-contract",
+        "runtime-coherence",
+        "live-log-polling",
+        "coding-runtime",
+        "remote-live-log",
+        "remote-session-cli"
+      ]
+    },
+    "r52_behavioral": {
+      "tests": 1,
+      "pass": 1,
+      "fail": 0,
+      "components": [
+        "offline-predecessor-host-revocation"
+      ]
+    }
   },
   "predecessor_r48_full_regression_partition_proof": {
     "files": 211,
@@ -46,7 +154,23 @@
   "performance": {
     "fresh_cross_reference_status": "PASS_PINNED_REFERENCE_RUNTIME",
     "reason": "A test-only copy of the byte-pinned 0.2.51 reference was installed with scripts, audit, and dev dependencies disabled; production has no reference dependency.",
-    "historical_sample_only": false
+    "historical_sample_only": false,
+    "r51": {
+      "coding_command_singleflight": true,
+      "completed_result_cache": {
+        "ttl_ms": 300000,
+        "max_entries": 16
+      },
+      "live_log_poll_ms": 250,
+      "live_log_discovery_interval_ms": 1000,
+      "max_audit_segments_polled": 2,
+      "audit_json_parse_per_line": 1
+    },
+    "r52": {
+      "offline_predecessor_host_revoke_before_capture": true,
+      "status_reread_required": true,
+      "fail_closed_if_host_remains_armed": true
+    }
   },
   "non_win32": {
     "portable_tests": "supported where platform-independent",

package/controller/deadbyte-controller.ps1

@@ -920,7 +920,10 @@ function Arm-Host($Cfg) {
 
 function Disarm-Host($Cfg) {
     $meta = Get-HostPolicyMetadata $Cfg
-    Remove-Item -LiteralPath $meta.ArmFile -Force -ErrorAction SilentlyContinue
+    if (Test-Path -LiteralPath $meta.ArmFile) {
+        Remove-Item -LiteralPath $meta.ArmFile -Force -ErrorAction Stop
+    }
+    if (Test-Path -LiteralPath $meta.ArmFile) { throw 'Host authority revocation failed: grant remains present' }
     Write-Host 'PRIVILEGED HOST PLANE DISARMED'
 }
 

package/controller/deadbyte-process-policy.json

@@ -5,7 +5,7 @@
   "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\controller\\runtime\\process-state",
   "native_host": {
     "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r42-agentic-dev\\bin\\deadbyte-process-host.exe",
-    "sha256": "59ea2026c39a1266c0d645a4cf39d7955ac2cf905f7cda812f546dfc9de636fb"
+    "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {

package/docs/R51-PROVENANCE.json

@@ -0,0 +1,18 @@
+{
+  "schema": "deadbyte.provenance.v1",
+  "version": "0.15.28",
+  "builder": "deadbyte-r51-runtime-coherence-singleflight-livelog-hardening",
+  "source_model": "immutable published 0.15.27 parent -> registry SHA-1/local tarball byte identity -> VERSION SKEW RED -> runtime/package auto-coherence -> coding command single-flight/result dedup -> Desktop/Host foreground fail-closed cleanup -> bounded single-parse live logs -> focused GREEN -> full R51 regression -> MANIFEST.SHA256 -> isolated npm artifact -> immutable release slot -> signed machine truth",
+  "signing": "ed25519",
+  "parent_release_id": "v0.15.27-1b1dbe24b45ad06a",
+  "parent_manifest_sha256": "1b1dbe24b45ad06a62771d15f510662952f3d7c3e5aa08053c6c61511c523e47",
+  "parent_generation_manifest_sha256": "f87a1637b3c55ba050d079d8a5e0862a2244b306be7e985880708e0d8ded3db0",
+  "source_predecessor_version": "0.15.27",
+  "source_predecessor_tarball_sha256": "e728031d097d8678dfef80f8648cce65e72a96611052c31969c80f884506d1d7",
+  "source_predecessor_manifest_file_sha256": "1b1dbe24b45ad06a62771d15f510662952f3d7c3e5aa08053c6c61511c523e47",
+  "commander_reference_version": "0.2.51",
+  "commander_reference_server_sha256": "dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305",
+  "commander_reference_schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140",
+  "predecessor_r48_full_regression_task_receipt_sha256": "7711039e4807f6c2af02bbda897d0032b067e0a6631f789fd3bf801258160d3f",
+  "reproducibility": "candidate source bound to exact immutable published 0.15.27 predecessor; R51 focused coherence/single-flight/livelog proofs plus fresh full regression, manifest, package isolation, registry round-trip and activation machine truth are mandatory before release"
+}

package/docs/R51-RELEASE.json

@@ -0,0 +1,115 @@
+{
+  "schema": "deadbyte.release.v1",
+  "name": "deadbyte-mcp",
+  "version": "0.15.28",
+  "train": "R51",
+  "label": "RUNTIME COHERENCE + SINGLE-FLIGHT + LIVELOG HARDENING",
+  "protocol_revision": "2026-07-28",
+  "parent": {
+    "release_id": "v0.15.27-1b1dbe24b45ad06a",
+    "manifest_sha256": "1b1dbe24b45ad06a62771d15f510662952f3d7c3e5aa08053c6c61511c523e47",
+    "generation_manifest_sha256": "f87a1637b3c55ba050d079d8a5e0862a2244b306be7e985880708e0d8ded3db0"
+  },
+  "source_predecessor": {
+    "version": "0.15.27",
+    "tarball_sha256": "e728031d097d8678dfef80f8648cce65e72a96611052c31969c80f884506d1d7",
+    "manifest_file_sha256": "1b1dbe24b45ad06a62771d15f510662952f3d7c3e5aa08053c6c61511c523e47",
+    "reference_package": "@wonderwhy-er/desktop-commander@0.2.51",
+    "reference_server_sha256": "dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305",
+    "reference_schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
+  },
+  "platform": {
+    "primary": "win32",
+    "architectures": [
+      "x64"
+    ]
+  },
+  "capabilities": {
+    "host_execution_modes": [
+      "script",
+      "inline",
+      "native"
+    ],
+    "hardware_queries": [
+      "cpu",
+      "gpu",
+      "memory",
+      "storage",
+      "network",
+      "pci"
+    ],
+    "compact_tool_count": 43,
+    "full_tool_count": 117,
+    "full_tool_catalog": {
+      "path": "docs/R49-FULL-TOOL-CATALOG.json",
+      "base_sha256": "259fdc97a24575aff3f094911b5e86e4f512b07be7c2cc1286b0fd200d03a8c9"
+    },
+    "historical_r46_full_tool_count": 84,
+    "commander_reference_public_tool_count": 26,
+    "commander_additive_tool_count": 14,
+    "commander_drop_in": true,
+    "commander_rich_pdf": true,
+    "commander_incremental_pdf_revisions": true,
+    "commander_docx": true,
+    "commander_docx_header_footer_search": true,
+    "commander_xlsx": true,
+    "commander_url_read": true,
+    "commander_external_process_identity": true,
+    "commander_directory_read_fallback": true,
+    "commander_binary_detection": true,
+    "commander_protocol_adversarial": true,
+    "atomic_mutation_unknown_effect": true,
+    "package_slot_version_coherence": true,
+    "pid_reuse_self_recovery": true,
+    "bounded_controller_failure_evidence": true,
+    "durable_task_events_preserve_signed_envelope": true,
+    "capability_manifest_authority_truth": true,
+    "capability_manifest_host_grant_truth": true,
+    "process_profiles": [
+      "ping_hold",
+      "powershell",
+      "powershell_repl"
+    ],
+    "powershell_fileless": true,
+    "powershell_source_max_arg_bytes": 8192,
+    "powershell_persistent_repl": true,
+    "process_raw_input_profile_opt_in": true,
+    "process_tail_reads": true,
+    "process_wait_reads": true,
+    "process_chunked_output_ring": true,
+    "remote_reachability_ttl": true,
+    "remote_probe_timeout_retry": true,
+    "remote_dispatch_timeout_no_retry": true,
+    "observation_search_session_ttl": true,
+    "observation_search_session_cap": 128,
+    "windows_queries": [
+      "registry",
+      "services",
+      "drivers",
+      "sockets",
+      "volumes",
+      "usb",
+      "wsl"
+    ],
+    "machine_fs_list_entry_fault_isolation": true,
+    "native_windows_observation": true,
+    "desktop_bounded_semantic_wait": true,
+    "desktop_wait_signed_final_observation": true,
+    "desktop_wait_autonomous_goal_binding": true,
+    "native_windows_observer_sha256": "c9b46fc497b55b8f0ad1564c8e15f9c1cdf2a07f206b3c8fa7966c892058e920",
+    "human_livelog_visual_opcode": true,
+    "human_livelog_absolute_root_paths": true,
+    "human_livelog_trace_span": true,
+    "human_livelog_presentation_filter": true,
+    "human_livelog_tty_in_place_rewrite": true,
+    "human_livelog_expanded_summary": true,
+    "runtime_package_auto_coherence": true,
+    "coding_command_singleflight": true,
+    "coding_command_result_dedup_cache": true,
+    "foreground_desktop_host_fail_closed": true,
+    "human_livelog_slow_call_marker": true,
+    "human_livelog_peak_inflight": true,
+    "human_livelog_bounded_discovery": true,
+    "human_livelog_single_parse": true
+  }
+}

package/docs/R51-TEST-MATRIX.json

@@ -0,0 +1,166 @@
+{
+  "schema": "deadbyte.test-matrix.v1",
+  "version": "0.15.28",
+  "train": "R51",
+  "primary_platform": "win32-x64",
+  "reference": {
+    "package": "@wonderwhy-er/desktop-commander",
+    "version": "0.2.51",
+    "server_sha256": "dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305",
+    "schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
+  },
+  "required": [
+    {
+      "id": "r51-focused",
+      "command": "npm run r51:focused:test",
+      "expected": "PASS runtime coherence, command single-flight/result reuse, authority cleanup and live-log optimizer contracts"
+    },
+    {
+      "id": "r51-remote-session",
+      "command": "node --test test/remote-session-cli.test.mjs",
+      "expected": "PASS foreground lifecycle, Desktop/Host fail-closed cleanup, guardian and live timeline"
+    },
+    {
+      "id": "package-boundary",
+      "command": "node --test test/package-boundary.test.mjs",
+      "expected": "PASS canonical top-level DEADBYTE-MCP.cmd included; local/shadow wrappers excluded"
+    },
+    {
+      "id": "release-smoke",
+      "command": "node --test test/release-smoke-isolation.test.mjs",
+      "expected": "PASS"
+    },
+    {
+      "id": "capability-authority-truth",
+      "command": "node --test test/capability-resolver.test.mjs",
+      "expected": "PASS authority-state manifest truth"
+    },
+    {
+      "id": "compact-authority-truth",
+      "command": "node --test test/compact-max-catalog-r45.test.mjs",
+      "expected": "PASS real compact stdio authority-state manifest truth"
+    },
+    {
+      "id": "native-windows-observation",
+      "command": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
+      "expected": "PASS native Windows observation build/query gate"
+    },
+    {
+      "id": "r49-donor-proof",
+      "command": "node --test test/r49-remote-control-donors.test.mjs",
+      "expected": "PASS six pinned donor decisions"
+    },
+    {
+      "id": "r49-desktop-wait",
+      "command": "node --test test/desktop-runtime-r40.test.mjs test/desktop-mcp-tools-r40.test.mjs test/autonomous-desktop-r40.test.mjs",
+      "expected": "PASS bounded semantic wait and signed evidence"
+    },
+    {
+      "id": "r49-catalog",
+      "command": "npm run r48:catalog:test",
+      "expected": "PASS 117-tool full catalog; compact remains 43"
+    },
+    {
+      "id": "commander-hardening",
+      "command": "npm run r47:hardening:test",
+      "expected": "PASS"
+    },
+    {
+      "id": "commander-protocol-adversarial",
+      "command": "node --test test/commander-protocol-adversarial-r48.test.mjs",
+      "expected": "PASS malformed JSON, invalid request, unknown method/tool, duplicate IDs and concurrent correlation"
+    },
+    {
+      "id": "r48-release",
+      "command": "npm run r48:release:test",
+      "expected": "PASS"
+    },
+    {
+      "id": "full-regression",
+      "command": "npm run r48:full:test",
+      "expected": "PASS"
+    },
+    {
+      "id": "runtime-update",
+      "command": "node --test test/runtime-self-update.test.mjs",
+      "expected": "PASS"
+    },
+    {
+      "id": "audit",
+      "command": "npm audit --omit=dev",
+      "expected": "0 vulnerabilities"
+    },
+    {
+      "id": "activation",
+      "command": "npx -y deadbyte-mcp@0.15.28 remote",
+      "expected": "active runtime auto-synchronizes to exact 0.15.28 package manifest before foreground readiness; no VERSION SKEW reuse"
+    },
+    {
+      "id": "machine-truth",
+      "command": "signed machine_ping",
+      "expected": "release_id and manifests bind activated 0.15.28 generation"
+    },
+    {
+      "id": "rollback-restore",
+      "command": "immutable slot rollback/restore",
+      "expected": "0.15.28 -> exact 0.15.27 -> exact 0.15.28"
+    }
+  ],
+  "focused_proof": {
+    "raw_mcp_protocol": {
+      "tests": 3,
+      "pass": 3,
+      "fail": 0
+    },
+    "commander_hardening": {
+      "tests": 139,
+      "pass": 139,
+      "fail": 0,
+      "skip": 0
+    },
+    "npm_audit_production_vulnerabilities": 0,
+    "r51_behavioral": {
+      "tests": 56,
+      "pass": 56,
+      "fail": 0,
+      "components": [
+        "release-contract",
+        "runtime-coherence",
+        "live-log-polling",
+        "coding-runtime",
+        "remote-live-log",
+        "remote-session-cli"
+      ]
+    }
+  },
+  "predecessor_r48_full_regression_partition_proof": {
+    "files": 211,
+    "batches": 8,
+    "fail": 0,
+    "elapsed_ms": 196997.218,
+    "coding_task_id": "a1a10fff1520b37ac674f1861cd9e53e64e350d5a0766639036aefe5e096e235",
+    "task_receipt_sha256": "7711039e4807f6c2af02bbda897d0032b067e0a6631f789fd3bf801258160d3f",
+    "action_receipt_sha256": "095c5eb4d959b9105a769649aa196a1d33f5097b899031dd16997e5ba1b352e6",
+    "not_valid_as_r50_proof": true
+  },
+  "performance": {
+    "fresh_cross_reference_status": "PASS_PINNED_REFERENCE_RUNTIME",
+    "reason": "A test-only copy of the byte-pinned 0.2.51 reference was installed with scripts, audit, and dev dependencies disabled; production has no reference dependency.",
+    "historical_sample_only": false,
+    "r51": {
+      "coding_command_singleflight": true,
+      "completed_result_cache": {
+        "ttl_ms": 300000,
+        "max_entries": 16
+      },
+      "live_log_poll_ms": 250,
+      "live_log_discovery_interval_ms": 1000,
+      "max_audit_segments_polled": 2,
+      "audit_json_parse_per_line": 1
+    }
+  },
+  "non_win32": {
+    "portable_tests": "supported where platform-independent",
+    "windows_native_tests": "SKIP/unsupported"
+  }
+}

package/docs/R52-ACTIVATION-FORENSICS.md

@@ -0,0 +1,85 @@
+# R52 activation investigation
+
+Observed 2026-09-30. This record distinguishes reproduced defects from
+historical facts that the retained evidence cannot establish.
+
+## Failed 0.15.28 transition
+
+Transaction `r27-b879bdff63478f28-muo5kmwo-33426318` started at
+13:40:29.304Z from registry/npx package 0.15.28. Its prior pointer was exact
+0.15.27 (`1b1dbe24b45ad06a62771d15f510662952f3d7c3e5aa08053c6c61511c523e47`).
+It prepared immutable candidate 0.15.28 and its generation, then failed
+at `candidate_prepared`, at 13:40:34.362Z, with
+`offline predecessor recovery requires host plane DISARMED`.
+No predecessor capture, supervisor handoff, pointer commit, or rollback was
+recorded. A prepared `new_pointer` is not evidence of activation.
+
+The receipt's canonical envelope identity is
+`090f165c96da0d5a8e9c0815fd389fe94e8fe36c23a6878ee825b8f46bfb0bc2`.
+The formatted receipt file's SHA-256 is separately
+`e5de685f96b325388b27af3570175aa5fa7ebcc7f15b4bf27754eb96b20a81f5`.
+These hashes have different subjects and must not be conflated.
+
+The source path is CLI remote -> coherence -> privileged revocation ->
+deploy -> candidate preparation -> capturePredecessor -> offline Host check.
+The CLI checked revocation exit codes, not a post-revocation authority snapshot.
+The controller's former Disarm-Host suppressed removal errors and printed
+DISARMED regardless of whether the grant remained. Get-HostArmStatus treats
+a policy-matching standing grant as ARMED even when the runtime is OFFLINE.
+Thus runtime liveness and persisted authority are distinct.
+
+The retained failure does not contain the grant bytes, revocation result,
+actor identity, or an intervening authority-event trace. It cannot distinguish
+failed removal, concurrent rearming, or another state change. The historical
+actor/root cause is **not proven**. Do not call the grant merely stale or
+claim a specific rearming actor.
+
+## Separate observed state drift
+
+Earlier transaction `r27-b879bdff63478f28-muo5hf8w-bcc78637` captured an
+offline predecessor, spawned its supervisor, and then failed because
+`cloud.instance.json` was present at the next offline check. This is a
+different failure boundary. It proves capture is not a lifetime guarantee;
+it does not identify the writer or justify deleting ownership evidence.
+
+## Reproduced fixes and remaining acceptance
+
+The R52 offline recovery test exercises explicit Host revocation followed
+by fresh status, retaining the Host DISARMED invariant. It rejects failed
+revocation, successful-return-with-grant-remaining, and missing recovery opt-in.
+
+A new maintained-controller behavioral test was observed RED: failed grant
+removal returned success and printed DISARMED. The minimal fix uses terminating
+removal errors and verifies absence before reporting success. GREEN additionally
+covers absent grants, actual successful deletion, and nominal success with a
+remaining grant. No authority is armed by this fix.
+
+Release lineage parent is published 0.15.28; known-good 0.15.27 remains a
+separate runtime rollback target. A failed 0.15.28 generation is not a proven
+live parent generation.
+
+Focused GREEN does not establish durable caller-disconnect survival, owned-tree
+cancellation, the full Windows gate, registry round-trip, rollback/recovery, or
+actual latest remote activation. Those remain mandatory independent outcomes.
+
+## Subsequent long-run proof
+
+The added cancellation test was observed RED: a signed cancellation request
+waited for the running command to finish, and its descendant could perform a
+later write. Cancellation had only been consumed between task steps.
+
+Windows coding command execution now uses the existing package-pinned native
+process host's kill-on-close Job Object in pipe-quiet mode. Quiet mode suppresses
+only the host's control records, preserving raw stdout/stderr; no caller chooses
+the host, PID, input channel, or executable outside the existing coding policy.
+Signed cancellation is polled while a step runs, and terminal cancellation is
+reported after the owned host closes. The native host was rebuilt canonically
+and its process-policy digest refreshed. This is an internal implementation
+repair of the requested ownership contract, not a new public execution tool.
+
+Observed GREEN covers a real running parent and descendant, prompt cancellation,
+descendant absence and no delayed descendant write. A separate independent
+runtime process survived loss of its caller IPC transport, completed exactly one
+execution, retained attempts=1, and exposed a verifiable terminal task receipt
+to a fresh runtime instance. This does not claim survival of the execution owner
+itself being killed or prove public HTTP parity; those are different scopes.

package/native/deadbyte-process-host.cpp

@@ -170,9 +170,11 @@ int wmain(int argc, wchar_t** argv) {
     const wchar_t* cwd = argv[2];
     const wchar_t* job_id = argv[3];
     bool pipeTransport = false;
+    bool quietTransport = false;
     int firstChildArg = 4;
     if (argc > 4 && wcsncmp(argv[4], L"--deadbyte-transport=", 21) == 0) {
         if (wcscmp(argv[4], L"--deadbyte-transport=pipe") == 0) pipeTransport = true;
+        else if (wcscmp(argv[4], L"--deadbyte-transport=pipe-quiet") == 0) { pipeTransport = true; quietTransport = true; }
         else if (wcscmp(argv[4], L"--deadbyte-transport=conpty") != 0) {
             fwprintf(stderr, L"DEADBYTE process host: invalid transport\n");
             return 65;
@@ -306,8 +308,8 @@ int wmain(int argc, wchar_t** argv) {
     const int readyLength = snprintf(ready, sizeof(ready),
         "DEADBYTE_PROCESS_HOST_READY {\"child_pid\":%lu,\"creation_filetime\":\"%llu\",\"job_id\":\"%ls\"}\n",
         pi.dwProcessId, filetime_value(creation), job_id);
-    if (readyLength <= 0 || readyLength >= static_cast<int>(sizeof(ready)) ||
-        !write_all(GetStdHandle(STD_OUTPUT_HANDLE), ready, static_cast<DWORD>(readyLength))) {
+    if (!quietTransport && (readyLength <= 0 || readyLength >= static_cast<int>(sizeof(ready)) ||
+        !write_all(GetStdHandle(STD_OUTPUT_HANDLE), ready, static_cast<DWORD>(readyLength)))) {
         TerminateProcess(process.value, 113);
         if (hpc) ClosePseudoConsole(hpc);
         return fail_win32(L"WriteFile(ready)");
@@ -333,7 +335,7 @@ int wmain(int argc, wchar_t** argv) {
     const int doneLength = snprintf(done, sizeof(done),
         "\nDEADBYTE_PROCESS_HOST_EXIT {\"child_pid\":%lu,\"exit_code\":%lu}\n",
         pi.dwProcessId, exitCode);
-    if (doneLength > 0 && doneLength < static_cast<int>(sizeof(done))) {
+    if (!quietTransport && doneLength > 0 && doneLength < static_cast<int>(sizeof(done))) {
         write_all(GetStdHandle(STD_OUTPUT_HANDLE), done, static_cast<DWORD>(doneLength));
     }
     return wait == WAIT_OBJECT_0 ? static_cast<int>(exitCode) : 114;