deadbyte-mcp 0.15.27 → 0.15.29

package/src/runtime-coherence.mjs

@@ -0,0 +1,50 @@
+const SEMVER=/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+const HEX64=/^[0-9a-f]{64}$/;
+
+function parseSemver(value){
+  const match=SEMVER.exec(String(value??''));
+  if(!match) throw new Error(`runtime version invalid: ${String(value)}`);
+  return {major:Number(match[1]),minor:Number(match[2]),patch:Number(match[3]),prerelease:match[4]??null};
+}
+export function compareRuntimeVersions(a,b){
+  const left=parseSemver(a),right=parseSemver(b);
+  for(const key of ['major','minor','patch']) if(left[key]!==right[key]) return left[key]<right[key]?-1:1;
+  if(left.prerelease===right.prerelease) return 0;
+  if(left.prerelease===null) return 1;
+  if(right.prerelease===null) return -1;
+  return left.prerelease.localeCompare(right.prerelease,'en',{numeric:true,sensitivity:'case'});
+}
+function assertManifest(value,label){
+  if(!HEX64.test(String(value??''))) throw new Error(`${label} must be lowercase SHA-256`);
+  return value;
+}
+export async function ensureRuntimeCoherence({
+  cliVersion,packageManifestSha256,readActive,disarmPrivileged,activateCurrentPackage,onEvent=()=>{}
+}={}){
+  parseSemver(cliVersion);assertManifest(packageManifestSha256,'package manifest');
+  if(typeof readActive!=='function'||typeof disarmPrivileged!=='function'||typeof activateCurrentPackage!=='function'||typeof onEvent!=='function') {
+    throw new Error('runtime coherence callbacks invalid');
+  }
+  const initial=await readActive();
+  if(!initial) return {status:'unbound',active:null};
+  const activeVersion=String(initial.version??'');
+  const relation=compareRuntimeVersions(cliVersion,activeVersion);
+  if(relation===0){
+    if(String(initial.manifest_sha256??'')!==packageManifestSha256) {
+      throw new Error(`runtime manifest skew for ${cliVersion}: package ${packageManifestSha256}; active ${String(initial.manifest_sha256??'missing')}`);
+    }
+    return {status:'coherent',active:initial};
+  }
+  if(relation<0) throw new Error(`active runtime ${activeVersion} is newer than CLI package ${cliVersion}; refusing automatic downgrade`);
+  onEvent({phase:'upgrade_start',from_version:activeVersion,to_version:cliVersion,from_release_id:initial.release_id??null});
+  await disarmPrivileged();
+  await activateCurrentPackage();
+  const active=await readActive();
+  if(!active) throw new Error('runtime coherence activation completed without active release pointer');
+  if(String(active.version??'')!==cliVersion) throw new Error(`runtime coherence activation version mismatch: expected ${cliVersion}, found ${String(active.version??'missing')}`);
+  if(String(active.manifest_sha256??'')!==packageManifestSha256) {
+    throw new Error(`runtime coherence activation manifest mismatch: expected ${packageManifestSha256}, found ${String(active.manifest_sha256??'missing')}`);
+  }
+  onEvent({phase:'upgrade_complete',from_version:activeVersion,to_version:cliVersion,release_id:active.release_id??null});
+  return {status:'upgraded',active};
+}

package/src/runtime-update.mjs

@@ -704,7 +704,7 @@ async function captureRuntime(ctx){
   const bridge=await readLedger(ctx,'bridge'); const cloud=await readLedger(ctx,'cloud'); const core=coreProcess(ctx.core_root,bridge);
   return {status,status_text:statusText.trim(),bridge,cloud,core};
 }
-async function capturePredecessor(ctx,recoverOfflinePredecessor){
+export async function capturePredecessor(ctx,recoverOfflinePredecessor){
   let statusText,status;
   try{
     statusText=controllerCaptured(ctx,'status',15000);
@@ -738,7 +738,13 @@ async function capturePredecessor(ctx,recoverOfflinePredecessor){
   }
   if(!recoverOfflinePredecessor) throw new Error(`slot update requires ONLINE runtime: ${statusText}`);
   if(!status.offline||status.bridge_pid||status.cloud_pid||status.local_ready) throw new Error(`offline predecessor recovery requires clean OFFLINE controller state: ${statusText}`);
-  if(status.host_armed) throw new Error('offline predecessor recovery requires host plane DISARMED');
+  if(status.host_armed){
+    controllerCaptured(ctx,'disarmhost',15000);
+    statusText=controllerCaptured(ctx,'status',15000);
+    status=parseControllerStatus(statusText);
+    if(!status.offline||status.bridge_pid||status.cloud_pid||status.local_ready) throw new Error(`offline predecessor recovery changed controller state while revoking Host authority: ${statusText}`);
+    if(status.host_armed) throw new Error('offline predecessor recovery requires host plane DISARMED');
+  }
   if(status.autonomous_armed&&!status.coding_armed) throw new Error('invalid runtime authority: autonomous armed without coding');
   return {mode:'offline-recovery',status,status_text:statusText.trim(),runtime:null};
 }

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.27';
+export const DEADBYTE_VERSION = '0.15.29';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/coding-runtime.test.mjs

@@ -7,6 +7,75 @@ import path from 'node:path';
 import { generateTrustKeypair } from '../src/trust.mjs';
 import { assertCodingArmed, createCodingRuntime, loadCodingPolicy, recheckCodingAuthority } from '../src/coding-plane.mjs';
 import { createCodingTaskRuntime } from '../src/coding-task-runtime.mjs';
+import { fork } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+test('R52 caller disconnect retains one durable execution, status, attempts and terminal receipt',async()=>{
+  const f=await fixture();
+  let server;
+  try{
+    const script=path.join(f.project,'disconnect.mjs');
+    await writeFile(script,"import {appendFileSync} from 'node:fs';appendFileSync('disconnect-runs.txt',process.pid+'\\n');await new Promise(r=>setTimeout(r,750));process.stdout.write('survived-disconnect');");
+    const submission={submissionId:'caller-disconnect',steps:[{step_id:'gate',kind:'command',root_id:'project',command_id:'node_script',script_path:'disconnect.mjs',script_sha256:await sha256File(script),timeout_ms:10000}]};
+    const task=await f.tasks.submit(submission);
+    server=fork(fileURLToPath(new URL('./helpers/coding-disconnect-server.mjs',import.meta.url)),
+      [f.policyPath,f.keys.privateKeyPath,f.keys.publicKeyPath],{stdio:['ignore','ignore','ignore','ipc'],windowsHide:true,execArgv:[]});
+    const closed=new Promise(resolve=>server.once('exit',resolve));
+    server.send({taskId:task.task_id});
+    const deadline=Date.now()+10000;
+    let started=false;
+    while(Date.now()<deadline){
+      try{await readFile(path.join(f.project,'disconnect-runs.txt'));started=true;break;}catch{}
+      await new Promise(r=>setTimeout(r,20));
+    }
+    assert.ok(started,'independent runtime did not start');
+    server.disconnect(); // Caller transport goes away; execution owner stays live.
+    assert.doesNotThrow(()=>process.kill(server.pid,0));
+    const duplicate=await f.tasks.submit(submission);
+    assert.equal(duplicate.task_id,task.task_id);
+    assert.equal(duplicate.status,'existing');
+    assert.equal((await f.tasks.status({taskId:task.task_id})).steps[0].attempts,1);
+    await closed;
+    assert.equal(server.exitCode,0);
+    const recovered=createCodingTaskRuntime({codingRuntime:f.runtime,signingKeyPath:f.keys.privateKeyPath,verifyKeyPath:f.keys.publicKeyPath});
+    const status=await recovered.status({taskId:task.task_id});
+    assert.equal(status.state,'succeeded');
+    assert.equal(status.steps[0].attempts,1);
+    assert.equal((await recovered.verify({taskId:task.task_id})).ok,true);
+    assert.equal((await recovered.run({taskId:task.task_id})).status,'terminal');
+    assert.equal((await readFile(path.join(f.project,'disconnect-runs.txt'),'utf8')).trim().split(/\r?\n/).length,1);
+  }finally{if(server?.exitCode===null){server.kill();}await rm(f.root,{recursive:true,force:true});}
+});
+
+test('R52 cancelling a running durable command stops its owned descendants before terminal state',async()=>{
+  const f=await fixture();
+  let running;
+  try{
+    const script=path.join(f.project,'cancel-tree.mjs');
+    await writeFile(script,"import {spawn} from 'node:child_process'; import {writeFileSync} from 'node:fs'; const child=spawn(process.execPath,['-e',\"setTimeout(()=>require('node:fs').writeFileSync('escaped.txt','escaped'),4000)\"],{stdio:'inherit'}); writeFileSync('started.txt',String(child.pid)); setTimeout(()=>{},4000);");
+    const submission={submissionId:'cancel-running-tree',steps:[{step_id:'gate',kind:'command',root_id:'project',command_id:'node_script',script_path:'cancel-tree.mjs',script_sha256:await sha256File(script),timeout_ms:10000}]};
+    const task=await f.tasks.submit(submission);
+    running=f.tasks.run({taskId:task.task_id});
+    let descendant;
+    const deadline=Date.now()+3000;
+    while(Date.now()<deadline){
+      try{descendant=Number(await readFile(path.join(f.project,'started.txt'),'utf8'));break;}catch{}
+      await new Promise(r=>setTimeout(r,20));
+    }
+    assert.ok(descendant,'fixture did not start descendant');
+    const cancelledAt=Date.now();
+    await f.tasks.cancel({taskId:task.task_id,reason:'owned-tree-test'});
+    const result=await running;
+    assert.equal(result.status,'cancelled');
+    assert.ok(Date.now()-cancelledAt<2000,'cancellation waited for command to finish');
+    assert.throws(()=>process.kill(descendant,0),'owned descendant is still alive after terminal cancellation');
+    await assert.rejects(readFile(path.join(f.project,'escaped.txt')),e=>e.code==='ENOENT');
+    const status=await f.tasks.status({taskId:task.task_id});
+    assert.equal(status.steps[0].attempts,1);
+    const executionReceipt=await f.runtime.receiptVerify({receiptId:status.steps[0].receipt_id});
+    assert.equal(executionReceipt.ok,true,'cancelled execution must retain its signed terminal observation');
+  }finally{await running?.catch(()=>{});await rm(f.root,{recursive:true,force:true});}
+});
 
 function sha256Bytes(bytes) { return createHash('sha256').update(bytes).digest('hex'); }
 async function sha256File(file) { return sha256Bytes(await readFile(file)); }
@@ -39,7 +108,7 @@ async function fixture({ armed = true } = {}) {
   }
   const runtime = createCodingRuntime({ policy, signingKeyPath: keys.privateKeyPath, verifyKeyPath: keys.publicKeyPath });
   const tasks = createCodingTaskRuntime({ codingRuntime: runtime, signingKeyPath: keys.privateKeyPath, verifyKeyPath: keys.publicKeyPath });
-  return { root, project, policy, runtime, tasks };
+  return { root, project, policyPath, policy, runtime, tasks, keys };
 }
 test('coding plane edits files under lease and verifies signed action receipts', async () => {
   const f = await fixture();
@@ -233,3 +302,37 @@ test('coding task rejects recomputed journal content without the private signing
     await assert.rejects(() => f.tasks.status({ taskId: submitted.task_id }), /signature verification failed|hash-chain mismatch/);
   } finally { await rm(f.root, { recursive: true, force: true }); }
 });
+
+
+test('R51 coding command retries reuse one in-flight execution and completed receipt', async () => {
+  const f = await fixture();
+  try {
+    const script = path.join(f.project, 'dedup.mjs');
+    await writeFile(script, "import { appendFileSync } from 'node:fs'; appendFileSync('runs.txt', process.pid+'\\n'); await new Promise(r=>setTimeout(r,250)); process.stdout.write('dedup-ok');");
+    const args={rootId:'project',commandId:'node_script',scriptPath:'dedup.mjs',scriptSha256:await sha256File(script),timeoutMs:5000};
+    const [a,b]=await Promise.all([f.runtime.commandRun(args),f.runtime.commandRun(args)]);
+    assert.equal(a.status,'passed',a.stderr);assert.equal(b.status,'passed',b.stderr);
+    assert.equal(a.request_sha256,b.request_sha256);
+    assert.equal(a.receipt_id,b.receipt_id,'same logical request must reuse the same signed execution receipt');
+    const c=await f.runtime.commandRun(args);
+    assert.equal(c.receipt_id,a.receipt_id,'completed retry must reuse bounded cached execution result');
+    const runs=(await readFile(path.join(f.project,'runs.txt'),'utf8')).trim().split(/\\r?\\n/).filter(Boolean);
+    assert.equal(runs.length,1,'retry spawned duplicate child process');
+  } finally { await rm(f.root,{recursive:true,force:true}); }
+});
+
+test('R51 coding command single-flight spans independent runtime instances sharing evidence state', async () => {
+  const f = await fixture();
+  try {
+    const script = path.join(f.project, 'cross-runtime-dedup.mjs');
+    await writeFile(script, "import { appendFileSync } from 'node:fs'; appendFileSync('cross-runs.txt', process.pid+'\\n'); await new Promise(r=>setTimeout(r,500)); process.stdout.write('cross-ok');");
+    const second = createCodingRuntime({ policy:f.policy, signingKeyPath:f.keys.privateKeyPath, verifyKeyPath:f.keys.publicKeyPath });
+    const args={rootId:'project',commandId:'node_script',scriptPath:'cross-runtime-dedup.mjs',scriptSha256:await sha256File(script),timeoutMs:5000};
+    const [a,b]=await Promise.all([f.runtime.commandRun(args),second.commandRun(args)]);
+    assert.equal(a.status,'passed',a.stderr);assert.equal(b.status,'passed',b.stderr);
+    assert.equal(a.request_sha256,b.request_sha256);
+    assert.equal(a.receipt_id,b.receipt_id,'shared evidence state must converge on one signed execution receipt');
+    const runs=(await readFile(path.join(f.project,'cross-runs.txt'),'utf8')).trim().split(/\\r?\\n/).filter(Boolean);
+    assert.equal(runs.length,1,'independent runtime instances spawned duplicate child processes');
+  } finally { await rm(f.root,{recursive:true,force:true}); }
+});

package/test/helpers/coding-disconnect-server.mjs

@@ -0,0 +1,11 @@
+import { loadCodingPolicy,createCodingRuntime } from '../../src/coding-plane.mjs';
+import { createCodingTaskRuntime } from '../../src/coding-task-runtime.mjs';
+const [policyPath,signingKeyPath,verifyKeyPath]=process.argv.slice(2);
+const policy=await loadCodingPolicy(policyPath);
+const codingRuntime=createCodingRuntime({policy,signingKeyPath,verifyKeyPath});
+const tasks=createCodingTaskRuntime({codingRuntime,signingKeyPath,verifyKeyPath});
+process.once('message',async({taskId})=>{
+  try{await tasks.run({taskId});process.exitCode=0;}
+  catch(error){console.error(error);process.exitCode=1;}
+  finally{if(process.connected)process.disconnect();}
+});

package/test/production-docs.test.mjs

@@ -3,15 +3,17 @@ import assert from 'node:assert/strict';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { DEADBYTE_VERSION } from '../src/version.mjs';
 
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const readme=()=>readFile(path.join(root,'README.txt'),'utf8');
+const versionPattern=DEADBYTE_VERSION.replace(/[.*+?^$()|[\]\\]/g,'\\$&');
 
 test('production README documents one-command stdio configs for major MCP clients',async()=>{
   const text=await readme();
-  assert.match(text,/npx -y deadbyte-mcp@0\.15\.5 mcp/);
+  assert.match(text,new RegExp(`npx -y deadbyte-mcp@${versionPattern} mcp`));
   assert.match(text,/CLAUDE DESKTOP/);
-  assert.match(text,/"mcpServers"[\s\S]*?"command"\s*:\s*"npx"[\s\S]*?"-y"[\s\S]*?"deadbyte-mcp@0\.15\.5"[\s\S]*?"mcp"/);
+  assert.match(text,new RegExp(`"mcpServers"[\\s\\S]*?"command"\\s*:\\s*"npx"[\\s\\S]*?"-y"[\\s\\S]*?"deadbyte-mcp@${versionPattern}"[\\s\\S]*?"mcp"`));
   assert.match(text,/CURSOR/);
   assert.match(text,/\.cursor\/mcp\.json/);
   assert.match(text,/VS CODE/);
@@ -20,7 +22,7 @@ test('production README documents one-command stdio configs for major MCP client
   assert.match(text,/CODEX/);
   assert.match(text,/\[mcp_servers\.deadbyte\]/);
   assert.match(text,/command\s*=\s*"npx"/);
-  assert.match(text,/args\s*=\s*\["-y",\s*"deadbyte-mcp@0\.15\.5",\s*"mcp"\]/);
+  assert.match(text,new RegExp(`args\\s*=\\s*\\["-y",\\s*"deadbyte-mcp@${versionPattern}",\\s*"mcp"\\]`));
 });
 
 test('production README records tracer bullet, semantic scope, remote UX, safety and document extension',async()=>{

package/test/r48-release-contract.test.mjs

@@ -5,37 +5,18 @@ import { DEADBYTE_VERSION } from '../src/version.mjs';
 
 const root = new URL('../', import.meta.url);
 const read = rel => readFile(new URL(rel, root), 'utf8');
+const json = rel => read(rel).then(JSON.parse);
 
-test('R50 0.15.27 successor binds exact published immutable 0.15.26 parent', async () => {
+test('R48 compatibility release contract remains coherent in the current successor', async () => {
   const [pkg, lock, release, provenance, matrix] = await Promise.all([
-    read('package.json').then(JSON.parse),
-    read('package-lock.json').then(JSON.parse),
-    read('RELEASE.json').then(JSON.parse),
-    read('PROVENANCE.json').then(JSON.parse),
-    read('TEST-MATRIX.json').then(JSON.parse)
+    json('package.json'), json('package-lock.json'), json('RELEASE.json'),
+    json('PROVENANCE.json'), json('TEST-MATRIX.json')
   ]);
 
   for (const value of [
-    pkg.version,
-    lock.version,
-    lock.packages[''].version,
-    DEADBYTE_VERSION,
-    release.version,
-    provenance.version,
-    matrix.version
-  ]) assert.equal(value, '0.15.27');
-
-  assert.equal(release.train, 'R50');
-  assert.equal(release.label, 'PUBLIC PACKAGE BOUNDARY HOTFIX');
-  assert.equal(release.parent.release_id, 'v0.15.26-669ea65d2307ee2c');
-  assert.equal(release.parent.manifest_sha256, '669ea65d2307ee2cce06be960e0a8c7243dc6135f7f129a88d99f53096433cc8');
-  assert.equal(release.parent.generation_manifest_sha256, '08364adaf1dab9730c314e29121632c6371ed76fc677e83cb7f6aa6b244eab94');
-
-  assert.equal(release.source_predecessor.version, '0.15.26');
-  assert.equal(release.source_predecessor.tarball_sha256, '3272679e3a18610d47e83dc8d3161e949d75a57da145a43c2ab50c865a83bb86');
-  assert.equal(release.source_predecessor.manifest_file_sha256, '669ea65d2307ee2cce06be960e0a8c7243dc6135f7f129a88d99f53096433cc8');
-  assert.equal(release.source_predecessor.reference_server_sha256, 'dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305');
-  assert.equal(release.source_predecessor.reference_schemas_sha256, 'f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140');
+    pkg.version, lock.version, lock.packages[''].version, DEADBYTE_VERSION,
+    release.version, provenance.version, matrix.version
+  ]) assert.equal(value, DEADBYTE_VERSION);
 
   assert.equal(release.capabilities.full_tool_count, 117);
   assert.equal(release.capabilities.desktop_bounded_semantic_wait, true);
@@ -50,8 +31,4 @@ test('R50 0.15.27 successor binds exact published immutable 0.15.26 parent', asy
   assert.equal(provenance.parent_manifest_sha256, release.parent.manifest_sha256);
   assert.equal(provenance.parent_generation_manifest_sha256, release.parent.generation_manifest_sha256);
   assert.equal(provenance.source_predecessor_tarball_sha256, release.source_predecessor.tarball_sha256);
-
-  assert.equal(matrix.train, 'R50');
-  assert.equal(matrix.predecessor_r48_full_regression_partition_proof.files, 211);
-  assert.equal(matrix.predecessor_r48_full_regression_partition_proof.not_valid_as_r50_proof, true);
 });

package/test/r49-windows-gate.test.mjs

@@ -4,27 +4,33 @@ import test from 'node:test';
 
 const read = path => readFile(new URL(`../${path}`, import.meta.url), 'utf8');
 
-test('R50 canonical Windows gate is successor-bound and preserves R49/R48 historical gates', async () => {
-  const [pkgText, gate, evidence, historicalR49, historicalR48, deferred] = await Promise.all([
+test('R52 canonical Windows gate is successor-bound and preserves R51/R50/R49 historical gates', async () => {
+  const [pkgText, gate, evidence, historicalR51, historicalEvidenceR51, historicalR50, historicalR49, deferred] = await Promise.all([
     read('package.json'),
+    read('scripts/gate-windows-r52.ps1'),
+    read('scripts/windows-gate-evidence-r52.mjs'),
+    read('scripts/gate-windows-r51.ps1'),
+    read('scripts/windows-gate-evidence-r51.mjs'),
     read('scripts/gate-windows-r50.ps1'),
-    read('scripts/windows-gate-evidence-r50.mjs'),
     read('scripts/gate-windows-r49.ps1'),
-    read('scripts/gate-windows-r48.ps1'),
     read('scripts/deferred-slot-operation-r46.mjs')
   ]);
   const pkg = JSON.parse(pkgText);
-  assert.match(pkg.scripts['gate:windows'], /gate-windows-r50\.ps1$/);
-  assert.match(gate, /DEADBYTE 0\.15\.27 \/ R50 WINDOWS GATE: PASS/);
-  assert.match(gate, /r50-package-boundary/);
+  assert.match(pkg.scripts['gate:windows'], /gate-windows-r52\.ps1$/);
+  assert.match(gate, /DEADBYTE 0\.15\.29 \/ R52 WINDOWS GATE: PASS/);
+  assert.match(gate, /r52-package-boundary/);
+  assert.match(gate, /r52-focused-contracts/);
   assert.match(gate, /r49-remote-control-donors\.test\.mjs/);
   assert.match(gate, /desktop-runtime-r40\.test\.mjs/);
   assert.match(gate, /manifest-final-verify/);
-  assert.match(evidence, /deadbyte\.r50-windows-gate\.v1/);
-  assert.match(evidence, /pkg\.version === '0\.15\.27'/);
-  assert.match(evidence, /release\.train === 'R50'/);
+  assert.match(evidence, /deadbyte\.r52-windows-gate\.v1/);
+  assert.match(evidence, /pkg\.version === '0\.15\.29'/);
+  assert.match(evidence, /release\.train === 'R52'/);
+  assert.match(evidence, /source_predecessor\.version === '0\.15\.28'/);
+  assert.match(historicalR51, /DEADBYTE 0\.15\.28 \/ R51 WINDOWS GATE: PASS/);
+  assert.match(historicalEvidenceR51, /deadbyte\.r51-windows-gate\.v1/);
+  assert.match(historicalR50, /DEADBYTE 0\.15\.27 \/ R50 WINDOWS GATE: PASS/);
   assert.match(historicalR49, /DEADBYTE 0\.15\.26 \/ R49 WINDOWS GATE: PASS/);
-  assert.match(historicalR48, /DEADBYTE 0\.15\.25 \/ R48 WINDOWS GATE: PASS/);
   assert.match(deferred, /const expectedVersion=packageIdentity\.version/);
   assert.match(deferred, /'--expected-version',expectedVersion/);
   assert.match(deferred, /async function awaitHandoffCompletion/);

package/test/r51-live-log-polling.test.mjs

@@ -0,0 +1,28 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { selectLiveLogNames } from '../src/remote-live-log.mjs';
+import { readFile } from 'node:fs/promises';
+
+test('R51 live log discovery tails only current and previous audit segments plus runtime logs',()=>{
+  const selected=selectLiveLogNames({
+    auditNames:['segment-00000001.jsonl','junk.txt','segment-00000003.jsonl','segment-00000002.jsonl'],
+    runtimeNames:['bridge.stdout.log','bridge.stderr.log','note.txt']
+  });
+  assert.deepEqual(selected.audit,['segment-00000002.jsonl','segment-00000003.jsonl']);
+  assert.deepEqual(selected.runtime,['bridge.stderr.log','bridge.stdout.log']);
+});
+
+test('R51 live tail caches directory discovery instead of rescanning every 250ms poll',async()=>{
+  const cli=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+  assert.match(cli,/LIVE_LOG_DISCOVERY_INTERVAL_MS\s*=\s*1000/);
+  assert.match(cli,/nextDiscoveryAt/);
+  assert.doesNotMatch(cli,/for\(const file of await listLogFiles\(root\)\)/);
+});
+
+test('R51 live tail parses each audit line once and reuses the decoded event',async()=>{
+  const cli=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+  assert.match(cli,/parseAuditLogLine/);
+  assert.match(cli,/auditEvent/);
+  assert.match(cli,/auditTimelineRecord\(file,line,auditEvent\)/);
+  assert.match(cli,/formatLogLine\(file,line,\{auditEvent,/);
+});

package/test/r51-release-contract.test.mjs

@@ -0,0 +1,58 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+
+const root=new URL('../',import.meta.url);
+const read=rel=>readFile(new URL(rel,root));
+const json=rel=>read(rel).then(bytes=>JSON.parse(bytes.toString('utf8')));
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+test('R51 historical release metadata remains byte-frozen at published 0.15.28',async()=>{
+  const [releaseBytes,provenanceBytes,matrixBytes]=await Promise.all([
+    read('docs/R51-RELEASE.json'),
+    read('docs/R51-PROVENANCE.json'),
+    read('docs/R51-TEST-MATRIX.json')
+  ]);
+  assert.equal(sha256(releaseBytes),'b89d0eaf4f07d704d2170782f10e4647daec55b5c5bdc70473865c0dae88650b');
+  assert.equal(sha256(provenanceBytes),'78e6798e92c2d9134b2e66557b2de7863367124efbcecdd5c91012bfed19a48f');
+  assert.equal(sha256(matrixBytes),'eb4d8047fe4ead69a73b3d89f2d443b6fdd88bd39bd8455b80ecaf512cb49abf');
+  const release=JSON.parse(releaseBytes.toString('utf8'));
+  const provenance=JSON.parse(provenanceBytes.toString('utf8'));
+  const matrix=JSON.parse(matrixBytes.toString('utf8'));
+  assert.equal(release.version,'0.15.28');
+  assert.equal(release.train,'R51');
+  assert.equal(provenance.version,'0.15.28');
+  assert.equal(matrix.version,'0.15.28');
+  assert.equal(matrix.train,'R51');
+});
+
+test('R51 historical lineage binds exact 0.15.27 parent and 0.15.27 source predecessor',async()=>{
+  const [release,provenance]=await Promise.all([json('docs/R51-RELEASE.json'),json('docs/R51-PROVENANCE.json')]);
+  const expected={
+    release_id:'v0.15.27-1b1dbe24b45ad06a',
+    manifest_sha256:'1b1dbe24b45ad06a62771d15f510662952f3d7c3e5aa08053c6c61511c523e47',
+    generation_manifest_sha256:'f87a1637b3c55ba050d079d8a5e0862a2244b306be7e985880708e0d8ded3db0'
+  };
+  assert.deepEqual(release.parent,expected);
+  assert.equal(release.source_predecessor.version,'0.15.27');
+  assert.equal(release.source_predecessor.tarball_sha256,'e728031d097d8678dfef80f8648cce65e72a96611052c31969c80f884506d1d7');
+  assert.equal(release.source_predecessor.manifest_file_sha256,expected.manifest_sha256);
+  assert.equal(provenance.parent_release_id,expected.release_id);
+  assert.equal(provenance.parent_manifest_sha256,expected.manifest_sha256);
+  assert.equal(provenance.parent_generation_manifest_sha256,expected.generation_manifest_sha256);
+});
+
+test('R51 historical capability claims remain frozen',async()=>{
+  const release=await json('docs/R51-RELEASE.json');
+  for(const key of [
+    'runtime_package_auto_coherence',
+    'coding_command_singleflight',
+    'coding_command_result_dedup_cache',
+    'foreground_desktop_host_fail_closed',
+    'human_livelog_slow_call_marker',
+    'human_livelog_peak_inflight',
+    'human_livelog_bounded_discovery',
+    'human_livelog_single_parse'
+  ]) assert.equal(release.capabilities[key],true,key);
+});

package/test/r51-runtime-coherence.test.mjs

@@ -0,0 +1,59 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { ensureRuntimeCoherence } from '../src/runtime-coherence.mjs';
+
+const hex=value=>value.repeat(64).slice(0,64);
+
+test('R51 runtime coherence upgrades older active slot exactly once and verifies final identity',async()=>{
+  let active={version:'0.15.27',manifest_sha256:hex('1'),release_id:'old'};
+  let disarms=0,activations=0;
+  const events=[];
+  const result=await ensureRuntimeCoherence({
+    cliVersion:'0.15.28',packageManifestSha256:hex('2'),
+    readActive:async()=>active,
+    disarmPrivileged:async()=>{disarms++;},
+    activateCurrentPackage:async()=>{activations++;active={version:'0.15.28',manifest_sha256:hex('2'),release_id:'new'};},
+    onEvent:event=>events.push(event)
+  });
+  assert.equal(result.status,'upgraded');
+  assert.equal(result.active.version,'0.15.28');
+  assert.equal(disarms,1);assert.equal(activations,1);
+  assert.deepEqual(events.map(event=>event.phase),['upgrade_start','upgrade_complete']);
+});
+
+test('R51 runtime coherence is non-mutating when version and manifest already match',async()=>{
+  let mutations=0;
+  const active={version:'0.15.28',manifest_sha256:hex('a'),release_id:'same'};
+  const result=await ensureRuntimeCoherence({cliVersion:'0.15.28',packageManifestSha256:hex('a'),readActive:async()=>active,
+    disarmPrivileged:async()=>{mutations++;},activateCurrentPackage:async()=>{mutations++;}});
+  assert.equal(result.status,'coherent');assert.equal(mutations,0);
+});
+
+test('R51 runtime coherence refuses downgrade and same-version manifest drift',async()=>{
+  await assert.rejects(()=>ensureRuntimeCoherence({cliVersion:'0.15.28',packageManifestSha256:hex('a'),
+    readActive:async()=>({version:'0.15.29',manifest_sha256:hex('b')}),disarmPrivileged:async()=>{},activateCurrentPackage:async()=>{}}),/newer than CLI/i);
+  await assert.rejects(()=>ensureRuntimeCoherence({cliVersion:'0.15.28',packageManifestSha256:hex('a'),
+    readActive:async()=>({version:'0.15.28',manifest_sha256:hex('b')}),disarmPrivileged:async()=>{},activateCurrentPackage:async()=>{}}),/manifest skew/i);
+});
+
+
+test('R51 bare remote wires coherence before live generation binding and deploy honors state root override',async()=>{
+  const {readFile}=await import('node:fs/promises');
+  const cli=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+  const deploy=await readFile(new URL('../scripts/deploy-r48.mjs',import.meta.url),'utf8');
+  assert.match(cli,/ensureRuntimeCoherence/);
+  assert.match(cli,/synchronizeForegroundRuntime/);
+  const syncAt=cli.indexOf('await synchronizeForegroundRuntime');
+  const rootsAt=cli.indexOf('await readLiveRootPaths');
+  assert.ok(syncAt>=0&&rootsAt>syncAt,'runtime coherence must complete before binding generation root paths');
+  assert.match(deploy,/process\.env\.DEADBYTE_STATE_ROOT/);
+});
+
+
+test('R51 foreground authority contract explicitly verifies and cleans desktop plus host',async()=>{
+  const {readFile}=await import('node:fs/promises');
+  const cli=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+  assert.match(cli,/\['desktopstatus',\/\^Desktop plane/);
+  assert.match(cli,/SESSION_CLEANUP=.*disarmdesktop.*disarmhost/s);
+  assert.match(cli,/desktop, host DISARMED/);
+});

package/test/r52-host-revocation.test.mjs

@@ -0,0 +1,65 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { spawnSync } from 'node:child_process';
+
+async function runRevoke(t,prelude){
+  if(process.platform!=='win32'){t.skip('Windows controller behavior');return;}
+  const source=await readFile(new URL('../controller/deadbyte-controller.ps1',import.meta.url),'utf8');
+  const begin=source.indexOf('function Disarm-Host(');
+  const end=source.indexOf('function Show-HostStatus(',begin);
+  assert.ok(begin>=0&&end>begin);
+  // Execute the maintained function, not a copied implementation. Simulate a
+  // filesystem that refuses deletion while Test-Path still sees the grant.
+  const script=`$ErrorActionPreference='Stop'
+function Get-HostPolicyMetadata($Cfg) { return @{ArmFile='fixture-host-grant'} }
+${prelude}
+${source.slice(begin,end)}
+try { Disarm-Host @{}; exit 0 } catch { Write-Output $_.Exception.Message; exit 7 }
+`;
+  return spawnSync('C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe',
+    ['-NoLogo','-NoProfile','-NonInteractive','-EncodedCommand',Buffer.from(script,'utf16le').toString('base64')],
+    {encoding:'utf8',windowsHide:true,timeout:15000});
+}
+
+test('R52 controller never reports successful Host revoke while grant removal failed',async t=>{
+  const result=await runRevoke(t,`
+function Remove-Item { param($LiteralPath,[switch]$Force,$ErrorAction) if($ErrorAction -eq 'Stop'){throw 'fixture access denied'} }
+function Test-Path { param($LiteralPath) return $true }
+`);
+  if(!result)return;
+  assert.equal(result.status,7,`Host revoke falsely succeeded: ${result.stdout} ${result.stderr}`);
+  assert.doesNotMatch(result.stdout,/PRIVILEGED HOST PLANE DISARMED/);
+});
+
+test('R52 controller rejects a grant that remains after nominally successful removal',async t=>{
+  const result=await runRevoke(t,`
+function Remove-Item { param($LiteralPath,[switch]$Force,$ErrorAction) }
+function Test-Path { param($LiteralPath) return $true }
+`);
+  if(!result)return;
+  assert.equal(result.status,7);
+  assert.match(result.stdout,/grant remains present/);
+  assert.doesNotMatch(result.stdout,/PRIVILEGED HOST PLANE DISARMED/);
+});
+
+test('R52 controller revocation is idempotent when no grant exists',async t=>{
+  const result=await runRevoke(t,`
+function Remove-Item { throw 'must not remove absent grant' }
+function Test-Path { param($LiteralPath) return $false }
+`);
+  if(!result)return;
+  assert.equal(result.status,0);
+  assert.match(result.stdout,/PRIVILEGED HOST PLANE DISARMED/);
+});
+
+test('R52 controller reports disarmed only after observing successful removal',async t=>{
+  const result=await runRevoke(t,`
+$script:present=$true
+function Remove-Item { param($LiteralPath,[switch]$Force,$ErrorAction) $script:present=$false }
+function Test-Path { param($LiteralPath) return $script:present }
+`);
+  if(!result)return;
+  assert.equal(result.status,0);
+  assert.match(result.stdout,/PRIVILEGED HOST PLANE DISARMED/);
+});