deadbyte-mcp 0.15.34 → 0.15.36

package/src/capability-resolver.mjs

@@ -146,7 +146,8 @@ export async function resolveCapabilityStates({
   desktopPolicy = null,
   autonomousRuntime = null,
   skillRuntime = null,
-  hostPolicy = null
+  hostPolicy = null,
+  runtimePlanes = null
 } = {}) {
   const capabilities = ledger?.entries ?? [];
   const resolved = [];
@@ -201,9 +202,26 @@ export async function resolveCapabilityStates({
     let state = CAPABILITY_STATES.AVAILABLE;
     let ready = true;
     let diagnostic = null;
+    const livePlane = cap.runtime_flag && runtimePlanes && typeof runtimePlanes === 'object'
+      ? runtimePlanes[cap.runtime_flag] ?? null
+      : null;
 
-    // 1. Runtime Flag Disabled check
-    if (cap.runtime_flag && env[cap.runtime_flag] === '0') {
+    // 1. A live plane overlay may only reduce availability declared by the
+    // signed ledger. It cannot create a capability or bypass later authority
+    // checks.
+    if (livePlane && livePlane.ready !== true) {
+      const observed=String(livePlane.state??'UNAVAILABLE');
+      state=observed==='DEGRADED'?CAPABILITY_STATES.DEGRADED:
+        observed==='DISABLED'?CAPABILITY_STATES.DISABLED:CAPABILITY_STATES.UNAVAILABLE;
+      ready=false;
+      diagnostic={
+        code:String(livePlane.diagnostic?.code??`RUNTIME_PLANE_${observed}`).slice(0,128),
+        reason:String(livePlane.diagnostic?.reason??`Runtime plane ${cap.runtime_flag} is ${observed}`).slice(0,1024),
+        recoverable:livePlane.diagnostic?.recoverable===true
+      };
+    }
+    // 2. Runtime Flag Disabled check
+    else if (cap.runtime_flag && env[cap.runtime_flag] === '0') {
       state = CAPABILITY_STATES.DISABLED;
       ready = false;
       diagnostic = {
@@ -212,7 +230,7 @@ export async function resolveCapabilityStates({
         recoverable: false
       };
     }
-    // 2. Tool presence check
+    // 3. Tool presence check
     else if (!catalogSet.has(activeTool)) {
       state = CAPABILITY_STATES.UNAVAILABLE;
       ready = false;
@@ -222,7 +240,7 @@ export async function resolveCapabilityStates({
         recoverable: false
       };
     }
-    // 3. Subsystem runtime instantiation check
+    // 4. Subsystem runtime instantiation check
     else if (cap.id.startsWith('machine_fs.') && !machineFsRuntime) {
       state = CAPABILITY_STATES.UNAVAILABLE;
       ready = false;
@@ -256,7 +274,7 @@ export async function resolveCapabilityStates({
         recoverable: true
       };
     }
-    // 4. Session Authority Checks
+    // 5. Session Authority Checks
     else if (requires.includes('coding_session.armed') && !codingStatus?.armed) {
       state = CAPABILITY_STATES.DENIED;
       ready = false;
@@ -298,7 +316,7 @@ export async function resolveCapabilityStates({
         recoverable: true
       };
     }
-    // 5. Subsystem Health Probes (e.g. Skill Plane envelope verification)
+    // 6. Subsystem Health Probes (e.g. Skill Plane envelope verification)
     else if (cap.id === 'skill.catalog') {
       if (skillListResult?.invalid_skills && skillListResult.invalid_skills.length > 0) {
         state = CAPABILITY_STATES.DEGRADED;

package/src/capability-snapshot.mjs

@@ -0,0 +1,52 @@
+import { createHash } from 'node:crypto';
+
+const HEX64=/^[0-9a-f]{64}$/;
+function canonicalJson(value){
+  if(value===null||typeof value!=='object') return JSON.stringify(value);
+  if(Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
+  return `{${Object.keys(value).sort((a,b)=>a.localeCompare(b,'en')).map(key=>`${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(',')}}`;
+}
+const sha=value=>createHash('sha256').update(canonicalJson(value),'utf8').digest('hex');
+function iso(ms){return new Date(ms).toISOString();}
+function boundedPlaneState(raw){
+  const diagnostic=raw?.diagnostic&&typeof raw.diagnostic==='object'?{
+    code:String(raw.diagnostic.code??'UNKNOWN').slice(0,128),
+    reason:String(raw.diagnostic.reason??'').replace(/[\r\n\t]+/g,' ').slice(0,512),
+    recoverable:raw.diagnostic.recoverable===true
+  }:null;
+  return Object.freeze({state:String(raw?.state??'UNAVAILABLE'),ready:raw?.ready===true,
+    policy_sha256:HEX64.test(String(raw?.policy_sha256??''))?raw.policy_sha256:null,diagnostic});
+}
+
+export function createCapabilitySnapshotTracker({clock=Date.now,ttlMs=5000}={}){
+  if(typeof clock!=='function'||!Number.isInteger(ttlMs)||ttlMs<1000||ttlMs>15000) throw new Error('capability snapshot tracker options invalid');
+  let lastFingerprint=null,stateEpoch=0,lastSnapshotId=null;
+  function snapshot({profile,ledger,toolCatalog,catalogSha256,resolution,bindings={},planes={}}){
+    if(!ledger||!HEX64.test(String(ledger.ledger_sha256??''))||!Array.isArray(ledger.entries)) throw new Error('capability snapshot ledger invalid');
+    if(!Array.isArray(toolCatalog)||toolCatalog.some(name=>typeof name!=='string')||new Set(toolCatalog).size!==toolCatalog.length) throw new Error('capability snapshot catalog invalid');
+    if(!resolution||!Array.isArray(resolution.capabilities)) throw new Error('capability snapshot resolution invalid');
+    const signedIds=new Set(ledger.entries.map(entry=>entry.id));
+    for(const capability of resolution.capabilities) if(!signedIds.has(capability.id)) throw new Error(`capability '${capability.id}' is outside signed ledger`);
+    const safePlanes=Object.freeze(Object.fromEntries(Object.entries(planes).sort(([a],[b])=>a.localeCompare(b,'en')).map(([id,value])=>[id,boundedPlaneState(value)])));
+    const capabilities=resolution.capabilities.map(capability=>Object.freeze({...capability,
+      selected_route:Object.freeze({tool:capability.tool,operations:[...(capability.operations??[])]})
+    }));
+    const safeBindings={
+      release_id:typeof bindings.release_id==='string'?bindings.release_id:null,
+      release_manifest_sha256:HEX64.test(String(bindings.release_manifest_sha256??''))?bindings.release_manifest_sha256:null,
+      generation_manifest_sha256:HEX64.test(String(bindings.generation_manifest_sha256??''))?bindings.generation_manifest_sha256:null
+    };
+    const body={profile,ledger_sha256:ledger.ledger_sha256,tool_catalog:[...toolCatalog],tool_count:toolCatalog.length,
+      catalog_sha256:catalogSha256,capabilities,effective_capabilities:[...(resolution.effective_capabilities??[])],
+      unavailable_capabilities:[...(resolution.unavailable_capabilities??[])],degraded_capabilities:[...(resolution.degraded_capabilities??[])],
+      bindings:safeBindings,planes:safePlanes};
+    const fingerprint=sha(body);
+    if(fingerprint!==lastFingerprint){stateEpoch++;lastFingerprint=fingerprint;lastSnapshotId=sha({fingerprint,state_epoch:stateEpoch});}
+    const observed=Number(clock());
+    if(!Number.isFinite(observed)) throw new Error('capability snapshot clock invalid');
+    return Object.freeze({schema:'deadbyte.capability-manifest.v3',...body,snapshot_id:lastSnapshotId,state_epoch:stateEpoch,
+      observed_at_utc:iso(observed),valid_until_utc:iso(observed+ttlMs)});
+  }
+  return Object.freeze({snapshot});
+}
+

package/src/compact-gateway-mcp-tools.mjs

@@ -3,6 +3,7 @@ import * as z from 'zod/v4';
 import { compactGatewayOutputSchema, compactGatewayResult } from './compact-gateway-output-contracts.mjs';
 import { desktopControlInputSchema,invokeDesktopOperation } from './desktop-mcp-tools-r40.mjs';
 import { resolveCapabilityStates } from './capability-resolver.mjs';
+import { createCapabilitySnapshotTracker } from './capability-snapshot.mjs';
 
 const id=z.string().regex(/^[A-Za-z0-9._-]{1,64}$/);
 const rel=z.string().min(1).max(2048);
@@ -71,7 +72,7 @@ function unavailable(op,name){return compactGatewayResult({status:'unavailable',
 async function invoke(op,runtime,name,call){
   if(!runtime) return unavailable(op,name);
   try{return compactGatewayResult({status:'ok',op,result:await call(runtime)},false);}
-  catch(error){return compactGatewayResult({status:'denied',op,error:String(error)},true);}
+  catch(error){return compactGatewayResult({status:error?.code==='DEADBYTE_RUNTIME_UNAVAILABLE'?'unavailable':'denied',op,error:String(error)},true);}
 }
 
 async function codingInspect(args,codingRuntime,semanticRuntime){
@@ -138,27 +139,25 @@ async function machineObserve(args,machineRuntime,observationRuntime){
   return invoke(args.op,observationRuntime,'observation',map[args.op]);
 }
 
-export function registerCompactGatewayTools(server,{profile,ledger,codingRuntime,semanticRuntime,machineFsRuntime,processRuntime,observationRuntime,machineRuntime,desktopRuntime,skillRuntime,autonomousRuntime,hostPolicy,env=process.env,catalogProvider}){
+export function registerCompactGatewayTools(server,{profile,ledger,codingRuntime,semanticRuntime,machineFsRuntime,processRuntime,observationRuntime,machineRuntime,desktopRuntime,skillRuntime,autonomousRuntime,hostPolicy,env=process.env,catalogProvider,runtimePlanes=null,releaseBindingProvider=null}){
   if(!server) throw new Error('compact gateway registration requires server');
   if(profile!=='compact') return;
   if(typeof catalogProvider!=='function') throw new Error('compact gateway requires catalogProvider');
+  const capabilitySnapshots=createCapabilitySnapshotTracker({ttlMs:5000});
   server.registerTool('capability_manifest',{description:'Read the canonical capability ledger and exact active compact tool catalog with runtime-aware resolution.',inputSchema:capabilityManifestInputSchema,outputSchema:compactGatewayOutputSchema},async()=>{
     const toolCatalog=[...catalogProvider()].map(String).sort();
     if(toolCatalog.length<1||new Set(toolCatalog).size!==toolCatalog.length) throw new Error('compact catalog provider returned invalid catalog');
     const catalogSha256=createHash('sha256').update(JSON.stringify(toolCatalog),'utf8').digest('hex');
+    const livePlanes=typeof runtimePlanes==='function'?await runtimePlanes():runtimePlanes;
     const dynamicResolution = await resolveCapabilityStates({
       ledger, toolCatalog, profile, env,
       codingRuntime, processRuntime, machineFsRuntime, observationRuntime, desktopRuntime,
-      autonomousRuntime, skillRuntime, hostPolicy
+      autonomousRuntime, skillRuntime, hostPolicy, runtimePlanes:livePlanes
     });
-    return compactGatewayResult({status:'ok',op:'manifest',result:{
-      schema:'deadbyte.capability-manifest.v2',profile,ledger_sha256:ledger?.ledger_sha256??null,
-      tool_catalog:toolCatalog,tool_count:toolCatalog.length,catalog_sha256:catalogSha256,
-      capabilities:dynamicResolution.capabilities,
-      effective_capabilities:dynamicResolution.effective_capabilities,
-      unavailable_capabilities:dynamicResolution.unavailable_capabilities,
-      degraded_capabilities:dynamicResolution.degraded_capabilities
-    }},false);
+    const bindings=typeof releaseBindingProvider==='function'?await releaseBindingProvider():{};
+    return compactGatewayResult({status:'ok',op:'manifest',result:capabilitySnapshots.snapshot({
+      profile,ledger,toolCatalog,catalogSha256,resolution:dynamicResolution,bindings,planes:livePlanes??{}
+    })},false);
   });
   server.registerTool('coding_inspect',{description:'Typed compact coding inspection and semantic navigation gateway. No arbitrary tool dispatch.',inputSchema:codingInspectInputSchema,outputSchema:compactGatewayOutputSchema},args=>codingInspect(args,codingRuntime,semanticRuntime));
   server.registerTool('machine_fs',{description:'Typed compact machine filesystem gateway preserving root policy and mutation preconditions.',inputSchema:machineFsGatewayInputSchema,outputSchema:compactGatewayOutputSchema},args=>machineFs(args,machineFsRuntime));

package/src/deadbyte-cli.mjs

@@ -18,6 +18,8 @@ import { prepareRemoteConsole, remoteDisplayText } from './remote-console.mjs';
 import { ensureRuntimeCoherence } from './runtime-coherence.mjs';
 import { windowsPowerShellEnvironment } from './runtime-update.mjs';
 import { resolveStateRoot } from './state-root.mjs';
+import {foregroundIdentityMatches,queryForegroundIdentity,validForegroundIdentity} from './foreground-process-identity.mjs';
+import {acquireForegroundSessionLock} from './foreground-session-lock.mjs';
 
 const REMOTE_COMMANDS=new Set([
   'menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest',
@@ -200,7 +202,7 @@ function controllerRuntimeReady(text){
     /^Loop supervisor:\s*RUNNING\s+\[verified\]\s*$/m.test(value);
 }
 function controllerRuntimeDegraded(text){
-  return /^DEADBYTE MCP\s*=\s*DEGRADED\s*$/m.test(String(text||''));
+  return /^DEADBYTE MCP\s*=\s*(?:DEGRADED|FAILED)\s*$/m.test(String(text||''));
 }
 async function listLogFiles(root){
   const auditDir=path.join(root,'audit');
@@ -352,17 +354,20 @@ function remoteTag(kind,displayMode){
 }
 function writeRemote(stream,text,displayMode){stream.write(remoteDisplayText(text,displayMode));}
 async function cleanupRemoteSession(ctx,{displayMode='unicode'}={}){
+  const failed=[];
   for(const command of SESSION_CLEANUP){
     try{
-      const result=invokeController(ctx,command,{allowFailure:true,capture:true,echoCaptured:false});
-      if(result.status!==0) writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command} exit=${result.status}\n`,displayMode);
+      const result=invokeController(ctx,command,{allowFailure:true,capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+      if(result.status!==0){failed.push(command);writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command} exit=${result.status}\n`,displayMode);}
     }
-    catch(error){writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command}: ${String(error?.message||error)}\n`,displayMode);}
+    catch(error){failed.push(command);writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command}: ${String(error?.message||error)}\n`,displayMode);}
   }
+  if(failed.length) throw new Error(`remote session cleanup failed; ownership marker retained: ${failed.join(',')}`);
 }
 const GUARDIAN_SCRIPT=fileURLToPath(new URL('./remote-session-guardian.mjs',import.meta.url));
 function remoteSessionMarker(root){return path.join(root,'runtime','remote-session.json');}
 function pidAlive(pid){
+  if(!Number.isInteger(pid)||pid<1)return false;
   try{process.kill(pid,0);return true;}
   catch(error){return error?.code!=='ESRCH';}
 }
@@ -376,9 +381,10 @@ async function readRemoteSessionMarker(root){
     return value;
   }
   if(value?.schema==='deadbyte.remote-session.v2'){
+    for(const key of ['owner_identity','guardian_identity'])if(value[key]!==undefined&&!validForegroundIdentity(value[key]))throw new Error('remote session ownership identity invalid');
     if(!Number.isInteger(value?.owner_pid)||value.owner_pid<1||
        !/^[0-9a-f]{64}$/.test(String(value?.session_nonce||''))||
-       !Number.isInteger(value?.guardian_pid)||value.guardian_pid<1||
+       !Number.isInteger(value?.guardian_pid)||value.guardian_pid<0||
        (value.result_session_id!==undefined&&!/^[0-9a-f]{24}$/.test(String(value.result_session_id)))) throw new Error('remote session marker schema invalid');
     return value;
   }
@@ -388,8 +394,18 @@ async function recoverRemoteSession(ctx,{displayMode='unicode'}={}){
   let prior=await readRemoteSessionMarker(ctx.root);
   if(!prior) return;
   const ownerPid=remoteOwnerPid(prior);
-  if(pidAlive(ownerPid)) throw new Error(`remote session already active pid=${ownerPid}`);
-  if(prior.schema==='deadbyte.remote-session.v2'&&pidAlive(prior.guardian_pid)){
+  if(pidAlive(ownerPid)){
+    if(!prior.owner_identity)throw new Error(`remote session ownership unverified for legacy pid=${ownerPid}; marker retained`);
+    if(prior.owner_identity.pid!==ownerPid)throw new Error('remote session owner identity PID binding mismatch');
+    if(foregroundIdentityMatches(prior.owner_identity,queryForegroundIdentity(ownerPid)))throw new Error(`remote session already active pid=${ownerPid}`);
+  }
+  let guardianAlive=prior.schema==='deadbyte.remote-session.v2'&&pidAlive(prior.guardian_pid);
+  if(guardianAlive){
+    if(!prior.guardian_identity)throw new Error('remote guardian ownership unverified; marker retained');
+    if(prior.guardian_identity.pid!==prior.guardian_pid)throw new Error('remote guardian identity PID binding mismatch');
+    guardianAlive=foregroundIdentityMatches(prior.guardian_identity,queryForegroundIdentity(prior.guardian_pid));
+  }
+  if(guardianAlive){
     const deadline=Date.now()+3000;
     while(Date.now()<deadline){
       await sleep(100);
@@ -409,18 +425,23 @@ async function claimRemoteSession(ctx){
   const resultSessionId=randomBytes(12).toString('hex');
   const marker={schema:'deadbyte.remote-session.v2',owner_pid:process.pid,guardian_pid:0,session_nonce:nonce,
     result_session_id:resultSessionId,started_at_utc:new Date().toISOString()};
+  marker.owner_identity=queryForegroundIdentity(process.pid);
+  if(!marker.owner_identity)throw new Error('remote foreground identity unavailable');
   const markerPath=remoteSessionMarker(ctx.root);
   try{await writeFile(markerPath,`${JSON.stringify(marker)}\n`,{encoding:'utf8',flag:'wx'});}
   catch(error){if(error?.code==='EEXIST') throw new Error('remote session already claimed');throw error;}
   let guardian=null;
   try{
-    guardian=spawn(process.execPath,[GUARDIAN_SCRIPT,'--state-root',ctx.root,'--owner-pid',String(process.pid),'--session-nonce',nonce],{
-      detached:true,stdio:'ignore',windowsHide:true,shell:false,env:process.env
+    guardian=spawn(process.execPath,[GUARDIAN_SCRIPT,'--state-root',ctx.root,'--owner-pid',String(process.pid),'--session-nonce',nonce,'--owner-channel','ipc'],{
+      detached:true,stdio:['ignore','ignore','ignore','ipc'],windowsHide:true,shell:false,env:process.env
     });
     if(!Number.isInteger(guardian.pid)||guardian.pid<1) throw new Error('remote session guardian did not start');
     marker.guardian_pid=guardian.pid;
+    marker.guardian_identity=queryForegroundIdentity(guardian.pid);
+    if(!marker.guardian_identity||marker.guardian_identity.parent_pid!==process.pid)throw new Error('remote guardian parent identity mismatch');
     await writeFile(markerPath,`${JSON.stringify(marker)}\n`,'utf8');
     guardian.unref();
+    guardian.channel?.unref();
     return marker;
   }catch(error){
     try{guardian?.kill();}catch{}
@@ -439,8 +460,15 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
   const ctx=await remoteContext();
   if(displayMode==='ascii') writeRemote(process.stdout,`[DISPLAY] ASCII fallback: ${display.reason}\n`,displayMode);
   if(resumeCursor!==null) await replayRemoteResults(ctx.root,resumeCursor,{displayMode});
-  await recoverRemoteSession(ctx,{displayMode});
-  const marker=await claimRemoteSession(ctx);
+  const startupLock=await acquireForegroundSessionLock({root:ctx.root,powershell:ctx.powershell});
+  let marker;
+  try{
+    startupLock.assertHeld();
+    await recoverRemoteSession(ctx,{displayMode});
+    startupLock.assertHeld();
+    marker=await claimRemoteSession(ctx);
+    startupLock.assertHeld();
+  }finally{await startupLock.release();}
   try{
     await synchronizeForegroundRuntime(ctx,{displayMode});
   }catch(error){
@@ -475,7 +503,7 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
       process.stdout.write('[BOOT] Runtime already ONLINE; reusing verified bridge/cloud/supervisor.\n');
     }else{
       const recovery=preflight.status===0&&controllerRuntimeDegraded(preflight.stdout);
-      process.stdout.write(recovery?'[RECOVERY] Runtime DEGRADED; restarting verified owned components...\n':'[BOOT] Starting bridge/runtime...\n');
+      process.stdout.write(recovery?'[RECOVERY] Runtime failed readiness; restarting verified owned components...\n':'[BOOT] Starting bridge/runtime...\n');
       const startCommand=recovery?'restart':'start';
       const controllerLogDir=path.join(ctx.root,'runtime','logs');
       await mkdir(controllerLogDir,{recursive:true});

package/src/doctor-foreground-r58.mjs

@@ -0,0 +1,44 @@
+import {lstat,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {resolveStateRoot} from './state-root.mjs';
+import {validForegroundIdentity,foregroundIdentityMatches,queryForegroundIdentity} from './foreground-process-identity.mjs';
+
+export async function inspectDoctorForeground(explicitRoot,{queryIdentity=queryForegroundIdentity}={}){
+ const state=resolveStateRoot(explicitRoot),runtime=path.join(state,'runtime');
+ const markerPath=path.join(runtime,'remote-session.json');
+ const findings=[];
+ const add=(id,level,what,evidence,next_action=null)=>findings.push({id,level,what,evidence,next_action});
+ const inspect='Retain ownership evidence; inspect the foreground session and use supported remote lifecycle commands. Do not kill or re-arm based on PID alone.';
+ let marker;
+ try{
+  for(const dir of [state,runtime]){const info=await lstat(dir);if(!info.isDirectory()||info.isSymbolicLink())throw new Error('unsafe marker parent');}
+  const info=await lstat(markerPath);
+  if(!info.isFile()||info.isSymbolicLink()||info.size>16384)throw new Error('invalid marker file');
+  marker=JSON.parse(await readFile(markerPath,'utf8'));
+ }catch(error){
+  if(error?.code==='ENOENT')add('foreground_marker','PASS','No foreground session marker in this state root.',{present:false});
+  else add('foreground_marker','FAIL','Foreground marker cannot be safely read or parsed.',{check:'regular_bounded_json',error_code:error?.code??'VALIDATION_FAILED'},inspect);
+  return {status:findings[0].level,findings};
+ }
+ if(marker?.schema==='deadbyte.remote-session.v1'&&Number.isSafeInteger(marker.pid)&&marker.pid>0){
+  add('foreground_marker','WARN','Legacy foreground marker has no verified owner/guardian binding.',{schema:marker.schema,pid:marker.pid},inspect);
+  return {status:'WARN',findings};
+ }
+ if(marker?.schema!=='deadbyte.remote-session.v2'||!Number.isSafeInteger(marker.owner_pid)||marker.owner_pid<1||!Number.isSafeInteger(marker.guardian_pid)||marker.guardian_pid<0||typeof marker.session_nonce!=='string'||!/^[0-9a-f]{64}$/.test(marker.session_nonce)||(marker.result_session_id!==undefined&&!/^[0-9a-f]{24}$/.test(marker.result_session_id))){
+  add('foreground_marker','FAIL','Foreground marker schema, nonce or PID fields are invalid.',{check:'foreground_marker_schema'},inspect);
+  return {status:'FAIL',findings};
+ }
+ add('foreground_marker','PASS','Foreground marker fields are valid.',{schema:marker.schema,owner_pid:marker.owner_pid,guardian_pid:marker.guardian_pid});
+ for(const [role,pid,identity]of [['owner',marker.owner_pid,marker.owner_identity],['guardian',marker.guardian_pid,marker.guardian_identity]]){
+  const id='foreground_'+role;
+  if(identity===undefined){add(id,'WARN',`${role} identity is unverified; PID alone is insufficient.`,{pid,binding_present:false},inspect);continue;}
+  if(!validForegroundIdentity(identity)||identity.pid!==pid){add(id,'FAIL',`${role} identity is malformed or disagrees with the marker PID.`,{pid,check:'identity_pid_binding'},inspect);continue;}
+  if(role==='guardian'&&identity.parent_pid!==marker.owner_pid){add(id,'FAIL','Guardian identity does not bind to the declared owner.',{pid,check:'guardian_parent_binding'},inspect);continue;}
+  try{
+   const observed=await queryIdentity(pid);
+   if(foregroundIdentityMatches(identity,observed))add(id,'PASS',`${role} process matches the recorded birth/executable/command identity.`,{pid,creation_utc:identity.creation_utc,identity_verified:true});
+   else add(id,'WARN',`${role} binding is stale; process is absent or its identity changed.`,{pid,observed_present:observed!==null,identity_verified:false},inspect);
+  }catch(error){add(id,'FAIL',`${role} process identity observation failed; liveness is unknown.`,{pid,check:'process_identity',error_code:error?.code??'OBSERVATION_FAILED'},inspect);}
+ }
+ return {status:findings.some(f=>f.level==='FAIL')?'FAIL':findings.some(f=>f.level==='WARN')?'WARN':'PASS',findings};
+}

package/src/doctor-installation-r58.mjs

@@ -0,0 +1,63 @@
+import { lstat, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { parseActivePointer, parseManifest, sha256Bytes, verifyManifestTree } from './release-slot.mjs';
+import { verifyGenerationBundle } from './release-generation.mjs';
+import { resolveStateRoot } from './state-root.mjs';
+
+async function regularPath(state, target, directory=false) {
+  const relative=path.relative(state,target);
+  if(!relative||relative.startsWith('..'+path.sep)||relative==='..'||path.isAbsolute(relative))throw new Error('containment');
+  let cursor=state;
+  const parts=relative.split(path.sep);
+  for(let i=-1;i<parts.length;i++){
+    if(i>=0)cursor=path.join(cursor,parts[i]);
+    const info=await lstat(cursor);
+    if(info.isSymbolicLink()||((i<parts.length-1||directory)?!info.isDirectory():!info.isFile()))throw new Error('regular path');
+  }
+}
+
+export async function inspectDoctorInstallation(rawPointer, explicitRoot){
+  const state=resolveStateRoot(explicitRoot);
+  const pointer=parseActivePointer(JSON.stringify(rawPointer));
+  const findings=[];
+  const check=async(id,what,nextAction,operation)=>{
+    try{const evidence=await operation();findings.push({id,level:'PASS',what,evidence,next_action:null});}
+    catch(error){findings.push({id,level:'FAIL',what,evidence:{check:id,error_code:error?.code??'VALIDATION_FAILED'},next_action:nextAction});}
+  };
+  const next='Do not activate or arm authority; inspect the signed update receipt and use supported recovery for this state root.';
+  const expectedRelease=path.join(state,'releases',pointer.release_id);
+  const generation=path.resolve(pointer.generation_root);
+  const expectedGenerationParent=path.join(state,'generations');
+  await check('active_paths','Active release/generation/config paths match the state store.',next,async()=>{
+    if(!path.isAbsolute(pointer.release_root)||path.resolve(pointer.release_root)!==expectedRelease)throw new Error('release path');
+    if(!path.isAbsolute(pointer.generation_root)||path.dirname(generation)!==expectedGenerationParent)throw new Error('generation path');
+    if(!path.isAbsolute(pointer.config_path)||path.resolve(pointer.config_path)!==path.join(generation,'controller-config.psd1'))throw new Error('config path');
+    await regularPath(state,expectedRelease,true);await regularPath(state,generation,true);
+    return {release_id:pointer.release_id,generation_id:path.basename(generation)};
+  });
+  // Never follow unverified pointer paths, even just for diagnostics.
+  if(findings[0].level==='FAIL')return {status:'FAIL',findings};
+  await check('active_release','Installed release bytes match the pointer manifest and package identity.',next,async()=>{
+    const file=path.join(expectedRelease,'MANIFEST.SHA256');await regularPath(state,file);
+    const bytes=await readFile(file);if(sha256Bytes(bytes)!==pointer.manifest_sha256)throw new Error('manifest digest');
+    const manifest=parseManifest(bytes.toString('utf8'));if(!manifest.size||!manifest.has('package.json'))throw new Error('manifest package missing');
+    await verifyManifestTree(expectedRelease,manifest);
+    const pkg=JSON.parse(await readFile(path.join(expectedRelease,'package.json'),'utf8'));
+    if(pkg.name!=='deadbyte-mcp'||pkg.version!==pointer.version)throw new Error('package identity');
+    return {manifest_sha256:pointer.manifest_sha256,verified_files:manifest.size,version:pkg.version};
+  });
+  await check('active_generation','Generation bytes and config are bound to the active pointer.',next,async()=>{
+    await regularPath(state,path.join(generation,'GENERATION.SHA256'));await regularPath(state,pointer.config_path);
+    const bytes=await readFile(path.join(generation,'GENERATION.SHA256'));
+    const entries=parseManifest(bytes.toString('utf8'));
+    if(!entries.has('controller-config.psd1'))throw new Error('unbound config');
+    for(const relative of entries.keys())await regularPath(state,path.resolve(generation,...relative.split('/')));
+    return await verifyGenerationBundle(generation,pointer.generation_manifest_sha256);
+  });
+  await check('active_launcher','Stable launcher bytes match the active pointer.',next,async()=>{
+    const file=path.join(state,'bin','DEADBYTE-MCP.ps1');await regularPath(state,file);
+    const actual=sha256Bytes(await readFile(file));if(actual!==pointer.launcher_sha256)throw new Error('launcher digest');
+    return {sha256:actual};
+  });
+  return {status:findings.some(item=>item.level==='FAIL')?'FAIL':'PASS',findings};
+}

package/src/doctor-r45.mjs

@@ -5,12 +5,22 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { DEADBYTE_VERSION, MCP_PROTOCOL_VERSION } from './version.mjs';
 import { resolveStateRoot } from './state-root.mjs';
+import { parseActivePointer } from './release-slot.mjs';
+import { inspectDoctorRuntime } from './doctor-runtime-r58.mjs';
+import { inspectDoctorForeground } from './doctor-foreground-r58.mjs';
+import { inspectDoctorTransactions } from './doctor-transactions-r58.mjs';
 
 const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
-const stateRoot=()=>resolveStateRoot();
 const sha256=b=>createHash('sha256').update(b).digest('hex');
 async function jsonOrNull(file){try{return JSON.parse((await readFile(file,'utf8')).replace(/^\uFEFF/,''));}catch(e){if(e?.code==='ENOENT')return null;throw e;}}
 async function fileHash(file){return sha256(await readFile(file));}
+export async function readDoctorActivePointer(explicitRoot){
+ const pointerPath=path.join(resolveStateRoot(explicitRoot),'active-release.json');
+ let text;
+ try {text=await readFile(pointerPath,'utf8');}
+ catch(error){if(error?.code==='ENOENT')return null;throw error;}
+ return parseActivePointer(text.replace(/^\uFEFF/,''));
+}
 function parseManifest(text){
  const rows=[];
  for(const [index,line] of text.split(/\r?\n/).entries()){
@@ -48,11 +58,18 @@ export async function doctor(){
  const hardwareStat=await lstat(hardware);
  if(!hardwareStat.isFile()||hardwareStat.isSymbolicLink()) throw new Error('hardware observer must be a regular file');
  const hardwareSha256=await fileHash(hardware);
- const active=await jsonOrNull(path.join(stateRoot(),'active-release.json'));
+ const active=await readDoctorActivePointer();
+ const installation=active?await inspectDoctorRuntime(active):{status:'PASS',findings:[{id:'active_pointer',level:'PASS',what:'No active installation in this state root.',evidence:{pointer_present:false},next_action:null}]};
+ const foreground=await inspectDoctorForeground();
+ const transactions=await inspectDoctorTransactions();
+ const findings=[...installation.findings,...foreground.findings,...transactions.findings];
+ const assessment=findings.some(item=>item.level==='FAIL')?'FAIL':findings.some(item=>item.level==='WARN')?'WARN':'PASS';
  const hostPolicy=await jsonOrNull(path.join(root,'controller','deadbyte-host-policy.json'));
  if(hostPolicy&&release?.train==='R45'&&process.platform==='win32'&&hostPolicy.schema!=='deadbyte.host-policy.v2') throw new Error('R45 doctor rejects non-v2 generated host policy');
  return {
-  schema:'deadbyte.doctor.v1',status:'ok',package_version:DEADBYTE_VERSION,protocol_revision:MCP_PROTOCOL_VERSION,
+  schema:'deadbyte.doctor.v1',status:assessment==='FAIL'?'fail':assessment==='WARN'?'warn':'ok',package_version:DEADBYTE_VERSION,protocol_revision:MCP_PROTOCOL_VERSION,
+  assessment,findings,
+  runtime_availability:installation.availability??null,
   platform:{current:process.platform,architecture:process.arch,primary:'win32',supported:process.platform==='win32'},
   manifest:{sha256:manifestSha256,entries:rows.length,verified_entries:verified,verified:true},
   release_metadata:metadata,
@@ -63,4 +80,4 @@ export async function doctor(){
   known_unsupported:process.platform==='win32'?[]:['native_hardware_observation','windows_controller','desktop_native']
  };
 }
-export async function printDoctor(){const value=await doctor();process.stdout.write(JSON.stringify(value,null,2)+'\n');return value;}
+export async function printDoctor(){const value=await doctor();process.stdout.write(JSON.stringify(value,null,2)+'\n');if(value.assessment==='FAIL')process.exitCode=1;return value;}

package/src/doctor-runtime-r58.mjs

@@ -0,0 +1,82 @@
+import {readFile} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {resolveStateRoot} from './state-root.mjs';
+import {inspectDoctorInstallation} from './doctor-installation-r58.mjs';
+import {parseActivePointer,parseManifest,sha256Bytes} from './release-slot.mjs';
+import {windowsPowerShellEnvironment} from './runtime-update.mjs';
+
+function object(value,keys){
+ if(!value||typeof value!=='object'||Array.isArray(value)||Object.keys(value).length!==keys.length||keys.some(k=>!Object.hasOwn(value,k)))throw new Error('controller observation fields invalid');
+}
+const reason=value=>typeof value==='string'&&/^[a-z][a-z0-9-]{0,63}$/.test(value);
+const date=value=>typeof value==='string'&&/^\d{4}-\d\d-\d\dT.*Z$/.test(value)&&Number.isFinite(Date.parse(value));
+const pid=value=>Number.isSafeInteger(value)&&value>0;
+export function validateDoctorControllerObservation(value,expectedCoreRoot){
+ object(value,['schema','observed_at_utc','state','core_root','local_ready','bridge','core','cloud','supervisor','authority']);
+ if(value.schema!=='deadbyte.controller-observation.v1'||!date(value.observed_at_utc)||!['OFFLINE','PARKED','ONLINE','STARTING','FAILED','DEGRADED'].includes(value.state)||typeof value.local_ready!=='boolean'||typeof value.core_root!=='string'||!path.isAbsolute(value.core_root)||path.resolve(value.core_root)!==path.resolve(expectedCoreRoot))throw new Error('controller observation identity invalid');
+ for(const key of ['bridge','cloud']){
+  const item=value[key];object(item,['alive','reason','pid','creation_time_utc']);
+  if(typeof item.alive!=='boolean'||!reason(item.reason)||(item.alive?(!pid(item.pid)||!date(item.creation_time_utc)||item.reason!=='verified'):(item.pid!==null||item.creation_time_utc!==null)))throw new Error('controller component observation invalid');
+ }
+ const core=value.core;object(core,['alive','reason','pid','parent_pid','creation_time_utc','identity_basis']);
+ if(typeof core.alive!=='boolean'||!reason(core.reason))throw new Error('core observation invalid');
+ if(core.alive){
+  if(!value.bridge.alive||!pid(core.pid)||core.parent_pid!==value.bridge.pid||!date(core.creation_time_utc)||core.reason!=='verified'||!['command-line','verified-bridge-single-opaque-node-child'].includes(core.identity_basis))throw new Error('core topology binding invalid');
+ }else if(core.pid!==null||core.parent_pid!==null||core.creation_time_utc!==null||core.identity_basis!==null)throw new Error('failed core observation carries live identity');
+ object(value.supervisor,['configured','running','reason']);
+ if(typeof value.supervisor.configured!=='boolean'||typeof value.supervisor.running!=='boolean'||!reason(value.supervisor.reason)||(!value.supervisor.configured&&value.supervisor.running))throw new Error('supervisor observation invalid');
+ object(value.authority,['process','coding','autonomous','desktop','host']);
+ for(const item of Object.values(value.authority)){
+  object(item,['configured','armed','reason']);
+  if(typeof item.configured!=='boolean'||typeof item.armed!=='boolean'||!reason(item.reason)||(!item.configured&&item.armed)||(item.armed&&item.reason!=='standing-grant'))throw new Error('authority observation invalid');
+ }
+ return value;
+}
+
+export function classifyDoctorControllerObservation(raw,expectedCoreRoot){
+ const value=validateDoctorControllerObservation(raw,expectedCoreRoot),findings=[];
+ const add=(id,level,what,evidence,next_action=null)=>findings.push({id,level,what,evidence,next_action});
+ const inspect='Retain evidence and inspect exact controller/config/runtime bindings; use supported lifecycle recovery only after reconciling ownership.';
+ for(const name of ['bridge','cloud']){
+  const component=value[name];
+  const level=component.alive||component.reason==='no-ledger'?'PASS':component.reason==='process-missing'?'WARN':'FAIL';
+  add('runtime_'+name,level,`${name} ownership observation: ${component.reason}.`,{alive:component.alive,pid:component.pid,reason:component.reason},level==='PASS'?null:inspect);
+ }
+ const core=value.core;
+ const coreLevel=core.alive||(!value.bridge.alive&&core.reason==='bridge-unavailable')?'PASS':core.reason==='startup-zero-child'?'WARN':'FAIL';
+ add('runtime_core',coreLevel,`Downstream core observation: ${core.reason}.`,{alive:core.alive,pid:core.pid,parent_pid:core.parent_pid,identity_basis:core.identity_basis},coreLevel==='PASS'?null:inspect);
+ const localHealthy=value.bridge.alive&&core.alive&&value.local_ready;
+ const state=localHealthy&&value.cloud.alive?'ONLINE':!value.bridge.alive&&!value.cloud.alive?'OFFLINE':!value.bridge.alive&&value.cloud.alive?'PARKED':core.reason==='startup-zero-child'?'STARTING':'FAILED';
+ const contradiction=value.state==='ONLINE'&&state!=='ONLINE';
+ const availabilityLevel=contradiction?(state==='STARTING'?'WARN':'FAIL'):state==='ONLINE'||state==='OFFLINE'?'PASS':'WARN';
+ add('runtime_availability',availabilityLevel,`Observed availability is ${state}; local and remote availability are separate.`,{state,controller_state:value.state,local_healthy:localHealthy,remote_connected:value.cloud.alive,local_ready:value.local_ready},availabilityLevel==='PASS'?null:inspect);
+ if(value.supervisor.configured&&!value.supervisor.running)add('runtime_supervisor','WARN','Configured supervisor is not verified running.',{reason:value.supervisor.reason},inspect);
+ else add('runtime_supervisor','PASS','Supervisor observation is consistent.',{configured:value.supervisor.configured,running:value.supervisor.running});
+ for(const [plane,authority]of Object.entries(value.authority)){
+  const valid=authority.armed||['no-policy','disabled','disarmed','coding-disarmed'].includes(authority.reason);
+  const level=!valid?'FAIL':authority.armed&&(['host','desktop'].includes(plane)||state==='OFFLINE')?'WARN':'PASS';
+  add('authority_'+plane,level,`${plane} authority observation: ${authority.armed?'ARMED':'DISARMED'} (${authority.reason}).`,{configured:authority.configured,armed:authority.armed,reason:authority.reason},level==='PASS'?null:'Inspect the pinned policy/grant and revoke through the supported launcher if unintended; doctor never changes authority.');
+ }
+ if(value.authority.autonomous.armed&&!value.authority.coding.armed)add('authority_dependency','FAIL','Autonomous is armed while coding is not.',{autonomous_armed:true,coding_armed:false},inspect);
+ return {status:findings.some(f=>f.level==='FAIL')?'FAIL':findings.some(f=>f.level==='WARN')?'WARN':'PASS',findings,availability:{state,local_healthy:localHealthy,remote_connected:value.cloud.alive}};
+}
+
+export async function inspectDoctorRuntime(rawPointer,explicitRoot){
+ const pointer=parseActivePointer(JSON.stringify(rawPointer)),state=resolveStateRoot(explicitRoot);
+ const installation=await inspectDoctorInstallation(pointer,state);
+ if(installation.status==='FAIL')return installation;
+ const controller=path.join(pointer.release_root,'controller','deadbyte-controller.ps1');
+ const sourceBytes=await readFile(controller),manifestBytes=await readFile(path.join(pointer.release_root,'MANIFEST.SHA256'));
+ if(sha256Bytes(manifestBytes)!==pointer.manifest_sha256||parseManifest(manifestBytes.toString('utf8')).get('controller/deadbyte-controller.ps1')!==sha256Bytes(sourceBytes))throw new Error('doctor controller is not manifest-bound');
+ const source=sourceBytes.toString('utf8');
+ if(!source.includes('[switch]$Json'))return {status:'WARN',findings:[...installation.findings,{id:'runtime_observation',level:'WARN',what:'Installed predecessor does not support read-only structured observation.',evidence:{release_id:pointer.release_id,structured_observation_supported:false},next_action:'Use the accepted predecessor evidence and supported status command; do not bypass controller root binding or rewrite the sealed parent.'}]};
+ const nativeRoot=process.env.SystemRoot||process.env.WINDIR;
+ const result=spawnSync(path.join(nativeRoot,'System32/WindowsPowerShell/v1.0/powershell.exe'),['-NoLogo','-NoProfile','-File',controller,'status','-Json'],{cwd:pointer.release_root,encoding:'utf8',windowsHide:true,timeout:20000,maxBuffer:262144,env:windowsPowerShellEnvironment({...process.env,DEADBYTE_STATE_ROOT:state,DEADBYTE_CONTROLLER_CONFIG:pointer.config_path,DEADBYTE_CONTROLLER_RUNTIME_ROOT:path.join(state,'runtime')})});
+ let runtime;
+ try{
+  if(result.error||result.status!==0)throw new Error('controller observation failed');
+  runtime=classifyDoctorControllerObservation(JSON.parse(result.stdout),pointer.release_root);
+ }catch{runtime={status:'FAIL',findings:[{id:'runtime_observation',level:'FAIL',what:'Read-only controller observation failed or its structured contract/binding is invalid.',evidence:{exit_code:result.status??null,error_code:result.error?.code??'OBSERVATION_FAILED'},next_action:'Inspect the exact release/generation and supported controller status; do not auto-repair or retry effects.'}]};}
+ return {...runtime,findings:[...installation.findings,...runtime.findings]};
+}

package/src/doctor-transactions-r58.mjs

@@ -0,0 +1,40 @@
+import {lstat,opendir,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {resolveStateRoot} from './state-root.mjs';
+
+export async function inspectDoctorTransactions(explicitRoot,{maxEntries=256}={}){
+ if(!Number.isSafeInteger(maxEntries)||maxEntries<1||maxEntries>256)throw new Error('doctor transaction budget invalid');
+ const state=resolveStateRoot(explicitRoot),root=path.join(state,'evidence','updates'),findings=[];
+ const next='Retain transaction evidence; inspect the exact signed receipt/handoff and current pointer before any supported recovery. Doctor never launches recovery.';
+ const add=(level,what,evidence)=>findings.push({id:'transaction_residue',level,what,evidence,next_action:level==='PASS'?null:next});
+ let directory;
+ try{
+  for(const dir of [state,path.join(state,'evidence'),root]){const st=await lstat(dir);if(!st.isDirectory()||st.isSymbolicLink())throw new Error('unsafe evidence parent');}
+  directory=await opendir(root);
+ }catch(error){
+  if(error?.code==='ENOENT')add('PASS','No update evidence directory in this state root.',{present:false,states_checked:0});
+  else add('FAIL','Update evidence directory cannot be safely inspected.',{error_code:error?.code??'VALIDATION_FAILED'});
+  return {status:findings[0].level,findings};
+ }
+ let entries=0,checked=0,terminal=0;
+ try{
+  for await(const entry of directory){
+   if(++entries>maxEntries){add('WARN','Transaction inventory budget reached; unobserved entries remain.',{max_entries:maxEntries,states_checked:checked,inventory_complete:false});break;}
+   if(entry.isSymbolicLink()){add('FAIL','Transaction evidence contains a link; it was not followed.',{entry_name_sha256:createHash('sha256').update(entry.name).digest('hex')});continue;}
+   if(!entry.isDirectory())continue;
+   const file=path.join(root,entry.name,'state.json');let bytes;
+   try{
+    const info=await lstat(file);if(!info.isFile()||info.isSymbolicLink()||info.size>1048576)throw new Error('unsafe transaction state');
+    bytes=await readFile(file);if(bytes.length>1048576)throw new Error('transaction state budget');
+    const body=JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));checked++;
+    const digest=createHash('sha256').update(bytes).digest('hex');
+    if(!['deadbyte.r27-slot-update-state.v1','deadbyte.r31-slot-rollback-state.v1'].includes(body?.schema)||typeof body.phase!=='string'||!/^[a-z_]{1,64}$/.test(body.phase)){add('FAIL','Transaction state schema or phase is invalid.',{state_sha256:digest,check:'transaction_schema'});continue;}
+    if(['completed','superseded','failed_receipted'].includes(body.phase)){terminal++;continue;}
+    add('WARN','Nonterminal or unresolved transaction record remains; liveness/outcome is not inferred from its age or PID.',{state_sha256:digest,schema:body.schema,recorded_phase:body.phase});
+   }catch(error){if(error?.code==='ENOENT')continue;add('FAIL','Transaction state cannot be safely parsed or inspected.',{error_code:error?.code??'VALIDATION_FAILED'});}
+  }
+ }catch(error){add('FAIL','Transaction inventory observation failed.',{error_code:error?.code??'OBSERVATION_FAILED'});}
+ add('PASS','Recorded terminal transaction phases counted; signatures and desired outcomes are not established by this inventory.',{states_checked:checked,recorded_terminal_states:terminal,receipt_verification_performed:false});
+ return {status:findings.some(f=>f.level==='FAIL')?'FAIL':findings.some(f=>f.level==='WARN')?'WARN':'PASS',findings};
+}