deadbyte-mcp 0.15.35 → 0.15.37

package/scripts/full-regression-r60.mjs

@@ -0,0 +1,32 @@
+import { readdir, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const testDir=path.join(root,'test');
+const excluded=new Set(['full-max-catalog-r44.test.mjs','full-max-catalog-r45.test.mjs','full-max-catalog-r46.test.mjs']);
+const files=(await readdir(testDir,{withFileTypes:true}))
+  .filter(entry=>entry.isFile()&&entry.name.endsWith('.test.mjs')&&!excluded.has(entry.name));
+const weighted=[];
+for(const entry of files) weighted.push({path:path.join('test',entry.name),size:(await stat(path.join(testDir,entry.name))).size});
+weighted.sort((a,b)=>b.size-a.size||a.path.localeCompare(b.path,'en'));
+const batchCount=16;
+const batches=Array.from({length:batchCount},()=>[]);
+weighted.forEach((entry,index)=>batches[index%batchCount].push(entry.path));
+const match=process.argv.slice(2).map(String).find(arg=>/^--batch=\d+$/.test(arg));
+const selected=match?Number(match.slice('--batch='.length)):null;
+if(selected!==null&&(!Number.isInteger(selected)||selected<1||selected>batchCount))throw new Error(`R60 regression batch must be 1..${batchCount}`);
+const indexes=selected===null?[...Array(batchCount).keys()]:[selected-1];
+let total=0;
+for(const index of indexes){
+  const batch=batches[index].sort((a,b)=>a.localeCompare(b,'en'));
+  console.log(`R60-BOUNDED-REGRESSION batch=${index+1}/${batchCount} files=${batch.length}`);
+  const result=spawnSync(process.execPath,['--test','--test-concurrency=1',...batch],{cwd:root,stdio:'inherit',windowsHide:true,shell:false});
+  if(result.error)throw result.error;
+  if(result.signal)throw new Error(`R60 regression batch ${index+1} terminated by ${result.signal}`);
+  if(result.status!==0)throw new Error(`R60 regression batch ${index+1} failed with exit code ${result.status}`);
+  total+=batch.length;
+}
+console.log(`R60-BOUNDED-REGRESSION PASS files=${total} batches=${indexes.length}`);

package/scripts/gate-windows-r59-prepublish.ps1

@@ -0,0 +1,41 @@
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version 3.0
+$root=Split-Path $PSScriptRoot -Parent
+Set-Location -LiteralPath $root
+
+function Invoke-NodeTest([string]$Name,[string[]]$Files){
+  Write-Host "==== $Name ===="
+  & node.exe --test --test-concurrency=1 @Files
+  if($LASTEXITCODE -ne 0){ throw "R59 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+function Invoke-Npm([string]$Name,[string[]]$NpmArgs){
+  Write-Host "==== $Name ===="
+  & npm.cmd @NpmArgs
+  if($LASTEXITCODE -ne 0){ throw "R59 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+
+$active=Get-Content -LiteralPath (Join-Path $env:USERPROFILE '.deadbyte-mcp\active-release.json') -Raw | ConvertFrom-Json
+if($active.release_id -ne 'v0.15.35-1b5715b276facbc0'){ throw "R59 predecessor release mismatch: $($active.release_id)" }
+if($active.manifest_sha256 -ne '1b5715b276facbc00f8e341a554472cb4829e5af60e221c357c41b66053af9d4'){ throw 'R59 predecessor manifest mismatch' }
+if($active.generation_manifest_sha256 -ne '047e73b62d7b7819b84201a221a09b7e647cacf21f82101ebed4fbd7e23fc430'){ throw 'R59 predecessor generation mismatch' }
+
+Invoke-NodeTest 'r59-contracts' @(
+ 'test/capability-snapshot-r59.test.mjs',
+ 'test/capability-resolver.test.mjs',
+ 'test/runtime-plane-registry-r59.test.mjs',
+ 'test/optional-plane-degraded-r59.test.mjs',
+ 'test/bridge-runtime-r59.test.mjs',
+ 'test/controller-policy-preflight-r59.test.mjs',
+ 'test/r59-tool-surface-compat.test.mjs',
+ 'test/r58-controller-state-coherence.test.mjs'
+)
+
+$proof=Get-Content -LiteralPath (Join-Path $root 'proof\r59-full-regression-current.json') -Raw | ConvertFrom-Json
+if($proof.schema -ne 'deadbyte.r59-full-regression-capture.v1' -or -not $proof.pass -or $proof.exit_code -ne 0){ throw 'R59 full regression proof is not green' }
+if($proof.stderr_bytes -ne 0){ throw 'R59 full regression stderr is non-empty' }
+
+Invoke-Npm 'manifest-write' @('run','manifest:write')
+Invoke-Npm 'manifest-verify' @('run','manifest:verify')
+Invoke-Npm 'doctor' @('run','doctor')
+
+Write-Host '==== R59 PREPUBLISH WINDOWS GATE: PASS ===='

package/scripts/gate-windows-r60-prepublish.ps1

@@ -0,0 +1,74 @@
+# R60 staged gate revision 3: final pre-package metadata seal identity
+param(
+  [ValidateSet('all','preflight','focused','full-batch','manifest','doctor')]
+  [string]$Stage='all',
+  [ValidateRange(1,16)]
+  [int]$Batch=1
+)
+
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version 3.0
+$root=Split-Path $PSScriptRoot -Parent
+Set-Location -LiteralPath $root
+
+function Invoke-NodeTest([string]$Name,[string[]]$Files){
+  Write-Host "==== $Name ===="
+  & node.exe --test --test-concurrency=1 @Files
+  if($LASTEXITCODE -ne 0){ throw "R60 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+function Invoke-Npm([string]$Name,[string[]]$NpmArgs){
+  Write-Host "==== $Name ===="
+  & npm.cmd @NpmArgs
+  if($LASTEXITCODE -ne 0){ throw "R60 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+function Assert-R60Predecessor {
+  $active=Get-Content -LiteralPath (Join-Path $env:USERPROFILE '.deadbyte-mcp\active-release.json') -Raw | ConvertFrom-Json
+  if($active.release_id -ne 'v0.15.36-090d9db3e0679c0d'){ throw "R60 predecessor release mismatch: $($active.release_id)" }
+  if($active.manifest_sha256 -ne '090d9db3e0679c0d4943f3229ecab7b9fcccbe4f767348a568c9f3bb60d1b431'){ throw 'R60 predecessor manifest mismatch' }
+  if($active.generation_manifest_sha256 -ne '6134f9f26b680e13ed545da4ab5f3020f411ea2569062fb9c154c8a7e036c9dc'){ throw 'R60 predecessor generation mismatch' }
+}
+
+Assert-R60Predecessor
+if($Stage -eq 'preflight'){
+  Write-Host '==== R60 PREPUBLISH WINDOWS GATE STAGE: PASS preflight ===='
+  return
+}
+
+if($Stage -eq 'all' -or $Stage -eq 'focused'){
+  Invoke-Npm 'r60-focused' @('run','r60:focused:test')
+  if($Stage -eq 'focused'){
+    Write-Host '==== R60 PREPUBLISH WINDOWS GATE STAGE: PASS focused ===='
+    return
+  }
+}
+
+if($Stage -eq 'full-batch'){
+  Write-Host "==== r60-full-regression-batch-$Batch ===="
+  & node.exe scripts/full-regression-r60.mjs "--batch=$Batch"
+  if($LASTEXITCODE -ne 0){ throw "R60 prepublish gate failed at full-batch-$Batch exit=$LASTEXITCODE" }
+  Write-Host "==== R60 PREPUBLISH WINDOWS GATE STAGE: PASS full-batch-$Batch ===="
+  return
+}
+
+if($Stage -eq 'all'){
+  Invoke-Npm 'r60-full-regression' @('run','r60:full:test')
+}
+
+if($Stage -eq 'all' -or $Stage -eq 'manifest'){
+  Invoke-Npm 'manifest-write' @('run','manifest:write')
+  Invoke-Npm 'manifest-verify' @('run','manifest:verify')
+  if($Stage -eq 'manifest'){
+    Write-Host '==== R60 PREPUBLISH WINDOWS GATE STAGE: PASS manifest ===='
+    return
+  }
+}
+
+if($Stage -eq 'all' -or $Stage -eq 'doctor'){
+  Invoke-Npm 'doctor' @('run','doctor')
+  if($Stage -eq 'doctor'){
+    Write-Host '==== R60 PREPUBLISH WINDOWS GATE STAGE: PASS doctor ===='
+    return
+  }
+}
+
+Write-Host '==== R60 PREPUBLISH WINDOWS GATE: PASS ===='

package/scripts/r59-full-regression-capture.mjs

@@ -0,0 +1,35 @@
+import { createHash } from 'node:crypto';
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const proofDir=path.join(root,'proof');
+await mkdir(proofDir,{recursive:true});
+const started=new Date().toISOString();
+const child=spawnSync(process.execPath,[path.join(root,'scripts','full-regression-r48.mjs')],{
+  cwd:root,encoding:'utf8',windowsHide:true,shell:false,maxBuffer:64*1024*1024
+});
+const stdout=child.stdout??'';
+const stderr=child.stderr??'';
+const sha=s=>createHash('sha256').update(s,'utf8').digest('hex');
+const result={
+  schema:'deadbyte.r59-full-regression-capture.v1',
+  started_at_utc:started,
+  finished_at_utc:new Date().toISOString(),
+  exit_code:child.status,
+  signal:child.signal??null,
+  error:child.error?String(child.error.message??child.error):null,
+  stdout_sha256:sha(stdout),
+  stderr_sha256:sha(stderr),
+  stdout_bytes:Buffer.byteLength(stdout),
+  stderr_bytes:Buffer.byteLength(stderr),
+  pass:child.status===0&&!child.signal&&!child.error
+};
+await writeFile(path.join(proofDir,'r59-full-regression-current.stdout.log'),stdout,'utf8');
+await writeFile(path.join(proofDir,'r59-full-regression-current.stderr.log'),stderr,'utf8');
+await writeFile(path.join(proofDir,'r59-full-regression-current.json'),JSON.stringify(result,null,2)+'\n','utf8');
+console.log(JSON.stringify(result));
+if(!result.pass) process.exitCode=1;

package/src/capability-resolver.mjs

@@ -146,7 +146,8 @@ export async function resolveCapabilityStates({
   desktopPolicy = null,
   autonomousRuntime = null,
   skillRuntime = null,
-  hostPolicy = null
+  hostPolicy = null,
+  runtimePlanes = null
 } = {}) {
   const capabilities = ledger?.entries ?? [];
   const resolved = [];
@@ -201,9 +202,26 @@ export async function resolveCapabilityStates({
     let state = CAPABILITY_STATES.AVAILABLE;
     let ready = true;
     let diagnostic = null;
+    const livePlane = cap.runtime_flag && runtimePlanes && typeof runtimePlanes === 'object'
+      ? runtimePlanes[cap.runtime_flag] ?? null
+      : null;
 
-    // 1. Runtime Flag Disabled check
-    if (cap.runtime_flag && env[cap.runtime_flag] === '0') {
+    // 1. A live plane overlay may only reduce availability declared by the
+    // signed ledger. It cannot create a capability or bypass later authority
+    // checks.
+    if (livePlane && livePlane.ready !== true) {
+      const observed=String(livePlane.state??'UNAVAILABLE');
+      state=observed==='DEGRADED'?CAPABILITY_STATES.DEGRADED:
+        observed==='DISABLED'?CAPABILITY_STATES.DISABLED:CAPABILITY_STATES.UNAVAILABLE;
+      ready=false;
+      diagnostic={
+        code:String(livePlane.diagnostic?.code??`RUNTIME_PLANE_${observed}`).slice(0,128),
+        reason:String(livePlane.diagnostic?.reason??`Runtime plane ${cap.runtime_flag} is ${observed}`).slice(0,1024),
+        recoverable:livePlane.diagnostic?.recoverable===true
+      };
+    }
+    // 2. Runtime Flag Disabled check
+    else if (cap.runtime_flag && env[cap.runtime_flag] === '0') {
       state = CAPABILITY_STATES.DISABLED;
       ready = false;
       diagnostic = {
@@ -212,7 +230,7 @@ export async function resolveCapabilityStates({
         recoverable: false
       };
     }
-    // 2. Tool presence check
+    // 3. Tool presence check
     else if (!catalogSet.has(activeTool)) {
       state = CAPABILITY_STATES.UNAVAILABLE;
       ready = false;
@@ -222,7 +240,7 @@ export async function resolveCapabilityStates({
         recoverable: false
       };
     }
-    // 3. Subsystem runtime instantiation check
+    // 4. Subsystem runtime instantiation check
     else if (cap.id.startsWith('machine_fs.') && !machineFsRuntime) {
       state = CAPABILITY_STATES.UNAVAILABLE;
       ready = false;
@@ -256,7 +274,7 @@ export async function resolveCapabilityStates({
         recoverable: true
       };
     }
-    // 4. Session Authority Checks
+    // 5. Session Authority Checks
     else if (requires.includes('coding_session.armed') && !codingStatus?.armed) {
       state = CAPABILITY_STATES.DENIED;
       ready = false;
@@ -298,7 +316,7 @@ export async function resolveCapabilityStates({
         recoverable: true
       };
     }
-    // 5. Subsystem Health Probes (e.g. Skill Plane envelope verification)
+    // 6. Subsystem Health Probes (e.g. Skill Plane envelope verification)
     else if (cap.id === 'skill.catalog') {
       if (skillListResult?.invalid_skills && skillListResult.invalid_skills.length > 0) {
         state = CAPABILITY_STATES.DEGRADED;

package/src/capability-snapshot.mjs

@@ -0,0 +1,56 @@
+import { createHash } from 'node:crypto';
+
+const HEX64=/^[0-9a-f]{64}$/;
+function canonicalJson(value){
+  if(value===null||typeof value!=='object') return JSON.stringify(value);
+  if(Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
+  return `{${Object.keys(value).sort((a,b)=>a.localeCompare(b,'en')).map(key=>`${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(',')}}`;
+}
+const sha=value=>createHash('sha256').update(canonicalJson(value),'utf8').digest('hex');
+function iso(ms){return new Date(ms).toISOString();}
+function boundedPlaneState(raw){
+  const diagnostic=raw?.diagnostic&&typeof raw.diagnostic==='object'?{
+    code:String(raw.diagnostic.code??'UNKNOWN').slice(0,128),
+    reason:String(raw.diagnostic.reason??'').replace(/[\r\n\t]+/g,' ').slice(0,512),
+    recoverable:raw.diagnostic.recoverable===true
+  }:null;
+  return Object.freeze({state:String(raw?.state??'UNAVAILABLE'),ready:raw?.ready===true,
+    policy_sha256:HEX64.test(String(raw?.policy_sha256??''))?raw.policy_sha256:null,diagnostic});
+}
+
+export function createCapabilitySnapshotTracker({clock=Date.now,ttlMs=5000}={}){
+  if(typeof clock!=='function'||!Number.isInteger(ttlMs)||ttlMs<1000||ttlMs>15000) throw new Error('capability snapshot tracker options invalid');
+  let lastFingerprint=null,stateEpoch=0,lastSnapshotId=null;
+  function snapshot({profile,ledger,toolCatalog,catalogSha256,resolution,bindings={},planes={}}){
+    if(!ledger||!HEX64.test(String(ledger.ledger_sha256??''))||!Array.isArray(ledger.entries)) throw new Error('capability snapshot ledger invalid');
+    if(!Array.isArray(toolCatalog)||toolCatalog.some(name=>typeof name!=='string')||new Set(toolCatalog).size!==toolCatalog.length) throw new Error('capability snapshot catalog invalid');
+    if(!resolution||!Array.isArray(resolution.capabilities)) throw new Error('capability snapshot resolution invalid');
+    const signedIds=new Set(ledger.entries.map(entry=>entry.id));
+    for(const capability of resolution.capabilities) if(!signedIds.has(capability.id)) throw new Error(`capability '${capability.id}' is outside signed ledger`);
+    const safePlanes=Object.freeze(Object.fromEntries(Object.entries(planes).sort(([a],[b])=>a.localeCompare(b,'en')).map(([id,value])=>[id,boundedPlaneState(value)])));
+    const capabilities=resolution.capabilities.map(capability=>Object.freeze({...capability,
+      selected_route:Object.freeze({tool:capability.tool,operations:[...(capability.operations??[])]})
+    }));
+    const safeBindings={
+      release_id:typeof bindings.release_id==='string'?bindings.release_id:null,
+      release_manifest_sha256:HEX64.test(String(bindings.release_manifest_sha256??''))?bindings.release_manifest_sha256:null,
+      generation_manifest_sha256:HEX64.test(String(bindings.generation_manifest_sha256??''))?bindings.generation_manifest_sha256:null
+    };
+    const body={profile,ledger_sha256:ledger.ledger_sha256,tool_catalog:[...toolCatalog],tool_count:toolCatalog.length,
+      catalog_sha256:catalogSha256,capabilities,effective_capabilities:[...(resolution.effective_capabilities??[])],
+      unavailable_capabilities:[...(resolution.unavailable_capabilities??[])],degraded_capabilities:[...(resolution.degraded_capabilities??[])],
+      bindings:safeBindings,planes:safePlanes,
+      // Informational transport contract, not an authority-bearing ledger entry.
+      remote_dispatch_contract:Object.freeze({scope:'bridge_ingress_only',schema:'deadbyte.remote-dispatch.v1',
+        keyed_mutation:'same stable key and canonical payload: no duplicate dispatch; unknown post-dispatch outcome is not retried',
+        read_only_recovery:'a proven read-only interrupted call may re-execute under its original deadline',
+        keyless_mutation:'cross-reconnect logical retry safety unavailable; ambiguous outcome is not auto-replayed'})};
+    const fingerprint=sha(body);
+    if(fingerprint!==lastFingerprint){stateEpoch++;lastFingerprint=fingerprint;lastSnapshotId=sha({fingerprint,state_epoch:stateEpoch});}
+    const observed=Number(clock());
+    if(!Number.isFinite(observed)) throw new Error('capability snapshot clock invalid');
+    return Object.freeze({schema:'deadbyte.capability-manifest.v3',...body,snapshot_id:lastSnapshotId,state_epoch:stateEpoch,
+      observed_at_utc:iso(observed),valid_until_utc:iso(observed+ttlMs)});
+  }
+  return Object.freeze({snapshot});
+}

package/src/compact-gateway-mcp-tools.mjs

@@ -3,6 +3,7 @@ import * as z from 'zod/v4';
 import { compactGatewayOutputSchema, compactGatewayResult } from './compact-gateway-output-contracts.mjs';
 import { desktopControlInputSchema,invokeDesktopOperation } from './desktop-mcp-tools-r40.mjs';
 import { resolveCapabilityStates } from './capability-resolver.mjs';
+import { createCapabilitySnapshotTracker } from './capability-snapshot.mjs';
 
 const id=z.string().regex(/^[A-Za-z0-9._-]{1,64}$/);
 const rel=z.string().min(1).max(2048);
@@ -71,7 +72,7 @@ function unavailable(op,name){return compactGatewayResult({status:'unavailable',
 async function invoke(op,runtime,name,call){
   if(!runtime) return unavailable(op,name);
   try{return compactGatewayResult({status:'ok',op,result:await call(runtime)},false);}
-  catch(error){return compactGatewayResult({status:'denied',op,error:String(error)},true);}
+  catch(error){return compactGatewayResult({status:error?.code==='DEADBYTE_RUNTIME_UNAVAILABLE'?'unavailable':'denied',op,error:String(error)},true);}
 }
 
 async function codingInspect(args,codingRuntime,semanticRuntime){
@@ -138,27 +139,25 @@ async function machineObserve(args,machineRuntime,observationRuntime){
   return invoke(args.op,observationRuntime,'observation',map[args.op]);
 }
 
-export function registerCompactGatewayTools(server,{profile,ledger,codingRuntime,semanticRuntime,machineFsRuntime,processRuntime,observationRuntime,machineRuntime,desktopRuntime,skillRuntime,autonomousRuntime,hostPolicy,env=process.env,catalogProvider}){
+export function registerCompactGatewayTools(server,{profile,ledger,codingRuntime,semanticRuntime,machineFsRuntime,processRuntime,observationRuntime,machineRuntime,desktopRuntime,skillRuntime,autonomousRuntime,hostPolicy,env=process.env,catalogProvider,runtimePlanes=null,releaseBindingProvider=null}){
   if(!server) throw new Error('compact gateway registration requires server');
   if(profile!=='compact') return;
   if(typeof catalogProvider!=='function') throw new Error('compact gateway requires catalogProvider');
+  const capabilitySnapshots=createCapabilitySnapshotTracker({ttlMs:5000});
   server.registerTool('capability_manifest',{description:'Read the canonical capability ledger and exact active compact tool catalog with runtime-aware resolution.',inputSchema:capabilityManifestInputSchema,outputSchema:compactGatewayOutputSchema},async()=>{
     const toolCatalog=[...catalogProvider()].map(String).sort();
     if(toolCatalog.length<1||new Set(toolCatalog).size!==toolCatalog.length) throw new Error('compact catalog provider returned invalid catalog');
     const catalogSha256=createHash('sha256').update(JSON.stringify(toolCatalog),'utf8').digest('hex');
+    const livePlanes=typeof runtimePlanes==='function'?await runtimePlanes():runtimePlanes;
     const dynamicResolution = await resolveCapabilityStates({
       ledger, toolCatalog, profile, env,
       codingRuntime, processRuntime, machineFsRuntime, observationRuntime, desktopRuntime,
-      autonomousRuntime, skillRuntime, hostPolicy
+      autonomousRuntime, skillRuntime, hostPolicy, runtimePlanes:livePlanes
     });
-    return compactGatewayResult({status:'ok',op:'manifest',result:{
-      schema:'deadbyte.capability-manifest.v2',profile,ledger_sha256:ledger?.ledger_sha256??null,
-      tool_catalog:toolCatalog,tool_count:toolCatalog.length,catalog_sha256:catalogSha256,
-      capabilities:dynamicResolution.capabilities,
-      effective_capabilities:dynamicResolution.effective_capabilities,
-      unavailable_capabilities:dynamicResolution.unavailable_capabilities,
-      degraded_capabilities:dynamicResolution.degraded_capabilities
-    }},false);
+    const bindings=typeof releaseBindingProvider==='function'?await releaseBindingProvider():{};
+    return compactGatewayResult({status:'ok',op:'manifest',result:capabilitySnapshots.snapshot({
+      profile,ledger,toolCatalog,catalogSha256,resolution:dynamicResolution,bindings,planes:livePlanes??{}
+    })},false);
   });
   server.registerTool('coding_inspect',{description:'Typed compact coding inspection and semantic navigation gateway. No arbitrary tool dispatch.',inputSchema:codingInspectInputSchema,outputSchema:compactGatewayOutputSchema},args=>codingInspect(args,codingRuntime,semanticRuntime));
   server.registerTool('machine_fs',{description:'Typed compact machine filesystem gateway preserving root policy and mutation preconditions.',inputSchema:machineFsGatewayInputSchema,outputSchema:compactGatewayOutputSchema},args=>machineFs(args,machineFsRuntime));

package/src/deadbyte-cli.mjs

@@ -20,6 +20,8 @@ import { windowsPowerShellEnvironment } from './runtime-update.mjs';
 import { resolveStateRoot } from './state-root.mjs';
 import {foregroundIdentityMatches,queryForegroundIdentity,validForegroundIdentity} from './foreground-process-identity.mjs';
 import {acquireForegroundSessionLock} from './foreground-session-lock.mjs';
+import { AUTHORITY_PLANES, authorityVector, parseAuthorityObservation, assertAuthorityVector, assertRuntimeReadyObservation, authorityBanner } from './remote-authority.mjs';
+import { decodeRemoteLogBytes, boundedRemoteDiagnostic, safeRemoteLogPrefixLength } from './remote-log-decode-r60.mjs';
 
 const REMOTE_COMMANDS=new Set([
   'menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest',
@@ -27,17 +29,9 @@ const REMOTE_COMMANDS=new Set([
   'armdesktop','disarmdesktop','desktopstatus',
   'armcoding','disarmcoding','codingstatus','codingtest','armautonomous','disarmautonomous','autonomousstatus','autonomoustest'
 ]);
-const SESSION_ARM=['armprocess','armcoding','armautonomous'];
 const REMOTE_STATUS_TIMEOUT_MS=30000;
 const REMOTE_START_TIMEOUT_MS=150000;
-const SESSION_STATUS=[
-  ['processstatus',/^Process plane\s*:\s*ARMED\b/m],
-  ['codingstatus',/^Coding plane\s*:\s*ARMED\b/m],
-  ['autonomousstatus',/^Autonomous\s*:\s*ARMED\b/m],
-  ['desktopstatus',/^Desktop plane\s*:\s*DISARMED\b/m],
-  ['hoststatus',/^Host plane\s*:\s*DISARMED\b/m]
-];
-const SESSION_CLEANUP=['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost','park'];
+const SESSION_CLEANUP=['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost'];
 const SUPERVISOR_COMMANDS=Object.freeze({
   start:'supervisorstart',stop:'supervisorstop',status:'supervisorstatus',recover:'supervisorrecover'
 });
@@ -55,6 +49,9 @@ function printHelp(){
     `  npx -y ${exact} doctor              # verify current package/release truth`,
     `  npx -y ${exact} mcp                 # stdio MCP server for local clients`,
     `  npx -y ${exact} remote              # unified foreground device session + live timeline`,
+    `  npx -y ${exact} remote --desktop    # session with Desktop authority; Host remains disarmed`,
+    `  npx -y ${exact} remote --host       # session with Host authority; Desktop remains disarmed`,
+    `  npx -y ${exact} remote --full       # explicit five-plane foreground session`,
     `  npx -y ${exact} remote --resume <cursor> # replay missed results, then reconnect`,
     `  npx -y ${exact} remote --trace           # show trace/span identity without payload detail`,
     `  npx -y ${exact} remote --filter <expr>   # presentation filter: tool/category/status/trace`,
@@ -75,8 +72,7 @@ async function remoteContext(){
   return {root,launcher,powershell};
 }
 function boundedSingleLine(value,maxChars=2048){
-  const line=String(value??'').replace(/[\r\n\t]+/g,' ').replace(/\s{2,}/g,' ').trim();
-  return line.length<=maxChars?line:`${line.slice(0,maxChars)}...`;
+  return boundedRemoteDiagnostic(value,maxChars);
 }
 async function readActiveRuntimeBinding(root){
   const file=path.join(root,'active-release.json');
@@ -158,11 +154,16 @@ async function readTailBounded(file,maxBytes=4096){
     if(length===0) return '';
     const buffer=Buffer.alloc(length);
     const handle=await open(file,'r');
-    try{await handle.read(buffer,0,length,info.size-length);}finally{await handle.close();}
-    return boundedSingleLine(buffer.toString('utf8'),maxBytes);
+    let encoding=null;
+    try{
+      const header=Buffer.alloc(2);await handle.read(header,0,2,0);
+      if(header[0]===0xff&&header[1]===0xfe)encoding='utf16le';
+      await handle.read(buffer,0,length,info.size-length);
+    }finally{await handle.close();}
+    return boundedSingleLine(decodeRemoteLogBytes(file,buffer,{encoding}),maxBytes);
   }catch(error){if(error?.code==='ENOENT') return '';throw error;}
 }
-function invokeController(ctx,command,{capture=false,allowFailure=false,echoCaptured=true,timeoutMs=null,discardOutput=false,redirectOutput=null}={}){
+function invokeController(ctx,command,{capture=false,allowFailure=false,echoCaptured=true,timeoutMs=null,discardOutput=false,redirectOutput=null,json=false,probeMode=null}={}){
   if(capture&&discardOutput) throw new Error('invokeController cannot capture and discard output together');
   if(capture&&redirectOutput) throw new Error('invokeController cannot capture and redirect output together');
   if(discardOutput&&redirectOutput) throw new Error('invokeController cannot discard and redirect output together');
@@ -175,9 +176,10 @@ function invokeController(ctx,command,{capture=false,allowFailure=false,echoCapt
       stderrFd=openSync(redirectOutput.stderr_path,'w');
       stdio=['ignore',stdoutFd,stderrFd];
     }else stdio=capture?['ignore','pipe','pipe']:'inherit';
-    const options={stdio,encoding:capture?'utf8':undefined,windowsHide:false,shell:false,env:windowsPowerShellEnvironment()};
+    const options={stdio,encoding:capture?'utf8':undefined,windowsHide:false,shell:false,
+      env:windowsPowerShellEnvironment(probeMode?{...process.env,DEADBYTE_REMOTE_PROBE_MODE:probeMode}:process.env)};
     if(Number.isInteger(timeoutMs)&&timeoutMs>0) options.timeout=timeoutMs;
-    result=spawnSync(ctx.powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',ctx.launcher,command],options);
+    result=spawnSync(ctx.powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',ctx.launcher,command,...(json?['-Json']:[])],options);
   }finally{
     if(stdoutFd!==null) closeSync(stdoutFd);
     if(stderrFd!==null) closeSync(stderrFd);
@@ -193,6 +195,10 @@ function invokeController(ctx,command,{capture=false,allowFailure=false,echoCapt
   if(status!==0&&!allowFailure) throw new Error(`remote controller '${command}' failed exit=${status}`);
   return {status,stdout,stderr};
 }
+function observedAuthority(ctx){
+  const result=invokeController(ctx,'status',{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS,json:true});
+  return parseAuthorityObservation(result.stdout);
+}
 function controllerRuntimeReady(text){
   const value=String(text||'');
   return /^DEADBYTE MCP\s*=\s*ONLINE\s*$/m.test(value)&&
@@ -278,13 +284,23 @@ async function replayRemoteResults(root,cursor,{displayMode='unicode'}={}){
 async function readAppend(file,offset){
   let info;try{info=await stat(file);}catch(error){if(error?.code==='ENOENT') return {offset:0,text:''};throw error;}
   let start=offset;
-  if(info.size<start) start=0;
+  const reset=info.size<start;
+  if(reset) start=0;
   if(info.size===start) return {offset:start,text:''};
-  const length=info.size-start;
-  const buffer=Buffer.alloc(length);
   const handle=await open(file,'r');
-  try{await handle.read(buffer,0,length,start);}finally{await handle.close();}
-  return {offset:info.size,text:buffer.toString('utf8')};
+  let encoding=null,buffer,bytesRead=0;
+  try{
+    const header=Buffer.alloc(2);await handle.read(header,0,2,0);
+    if(header[0]===0xff&&header[1]===0xfe&&/\.log$/i.test(file)){
+      encoding='utf16le';if(start%2!==0)start=Math.max(0,start-1);
+    }
+    const length=Math.min(1024*1024,info.size-start);
+    if(length===0)return {offset:start,text:''};
+    buffer=Buffer.alloc(length);
+    ({bytesRead}=await handle.read(buffer,0,length,start));
+  }finally{await handle.close();}
+  const complete=safeRemoteLogPrefixLength(buffer.subarray(0,bytesRead),encoding??'utf8');
+  return {offset:start+complete,text:decodeRemoteLogBytes(file,buffer.subarray(0,complete),{encoding}),reset};
 }
 async function snapshotRemoteLogOffsets(root){
   const offsets=new Map();
@@ -314,6 +330,7 @@ async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTra
     ? '[LOG] Verbose live timeline. Full sanitized request detail enabled; Ctrl+C disconnects and revokes authority.\n'
     : '[LOG] Human live timeline. Transport IN/OUT hidden; full replay/audit detail remains on disk. Ctrl+C disconnects and revokes authority.\n');
   const activeOffsets=offsets??await snapshotRemoteLogOffsets(root);
+  const partialLines=new Map();
   let liveFiles=[...activeOffsets.keys()];
   let nextDiscoveryAt=0;
   while(!signal.aborted){
@@ -326,7 +343,13 @@ async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTra
       const prior=activeOffsets.has(file)?activeOffsets.get(file):0;
       const next=await readAppend(file,prior);
       activeOffsets.set(file,next.offset);
-      for(const line of next.text.split(/\r?\n/)){
+      if(next.reset)partialLines.delete(file);
+      if(!next.text)continue;
+      const lines=((partialLines.get(file)??'')+next.text).split(/\r?\n/);
+      partialLines.set(file,lines.pop()??'');
+      if(Buffer.byteLength(partialLines.get(file),'utf8')>1024*1024) throw new Error(`remote log line exceeds bounded decode limit: ${path.basename(file)}`);
+      for(const line of lines){
+        if(Buffer.byteLength(line,'utf8')>1024*1024) throw new Error(`remote log line exceeds bounded decode limit: ${path.basename(file)}`);
         const auditEvent=parseAuditLogLine(file,line);
         const timeline=auditTimelineRecord(file,line,auditEvent);
         let recorded=null;
@@ -363,6 +386,15 @@ async function cleanupRemoteSession(ctx,{displayMode='unicode'}={}){
     catch(error){failed.push(command);writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command}: ${String(error?.message||error)}\n`,displayMode);}
   }
   if(failed.length) throw new Error(`remote session cleanup failed; ownership marker retained: ${failed.join(',')}`);
+  let snapshot;
+  try{snapshot=assertAuthorityVector(observedAuthority(ctx),Object.fromEntries(AUTHORITY_PLANES.map(plane=>[plane,false])));}
+  catch(error){throw new Error(`remote session cleanup verification failed; ownership marker retained: ${String(error?.message||error)}`);}
+  if(snapshot.state==='ONLINE'){
+    try{invokeController(ctx,'machinetest',{capture:true,echoCaptured:false,timeoutMs:REMOTE_START_TIMEOUT_MS,probeMode:'revoked'});}
+    catch(error){throw new Error(`remote session enforcement cleanup verification failed; ownership marker retained: ${String(error?.message||error)}`);}
+  }
+  const parked=invokeController(ctx,'park',{allowFailure:true,capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+  if(parked.status!==0) throw new Error(`remote session park failed exit=${parked.status}; ownership marker retained`);
 }
 const GUARDIAN_SCRIPT=fileURLToPath(new URL('./remote-session-guardian.mjs',import.meta.url));
 function remoteSessionMarker(root){return path.join(root,'runtime','remote-session.json');}
@@ -454,7 +486,7 @@ async function releaseRemoteSession(ctx,marker,{displayMode='unicode'}={}){
   const same=current?.schema==='deadbyte.remote-session.v2'&&current.owner_pid===marker.owner_pid&&current.session_nonce===marker.session_nonce;
   if(same) await rm(remoteSessionMarker(ctx.root),{force:true});
 }
-async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,filterExpression=''}={}){
+async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,filterExpression='',mode='default'}={}){
   const display=prepareRemoteConsole();
   const displayMode=display.mode;
   const ctx=await remoteContext();
@@ -524,21 +556,31 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     }
     process.stdout.write(`${formatRemoteLifecycle('bridge_connected',{displayMode})}\n`);
     process.stdout.write(`${formatRemoteLifecycle('cloud_connected',{displayMode})}\n`);
-    for(const command of SESSION_ARM){
+    const desired=authorityVector(mode);
+    const priorAuthority=observedAuthority(ctx);
+    for(const plane of AUTHORITY_PLANES.filter(name=>!desired[name]&&priorAuthority.authority[name].armed)){
+      const command=`disarm${plane}`;
+      writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Revoking unwanted ${plane} authority...\n`,displayMode);
+      invokeController(ctx,command,{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+    }
+    for(const plane of AUTHORITY_PLANES.filter(name=>desired[name])){
+      const command=`arm${plane}`;
       writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Arming ${command.slice(3)}...\n`,displayMode);
       invokeController(ctx,command,{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
     }
     const url=startText.match(/^URL\s*:\s*(\S+)/m)?.[1]||'';
+    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Verifying exact ${mode} authority vector...\n`,displayMode);
+    const current=await readActiveRuntimeBinding(ctx.root);
+    const authority=assertAuthorityVector(assertRuntimeReadyObservation(observedAuthority(ctx),{
+      coreRoot:current?.release_root??null
+    }),desired);
+    process.stdout.write('[BOOT] Verifying public signed MCP execution path...\n');
+    invokeController(ctx,'machinetest',{capture:true,echoCaptured:false,timeoutMs:REMOTE_START_TIMEOUT_MS,probeMode:mode});
+    ready=true;
+    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} ${authorityBanner(authority)}\n`,displayMode);
     process.stdout.write('[OK] ONLINE\n');
     process.stdout.write(`${formatRemoteLifecycle('ready',{displayMode})}\n`);
     if(url) writeRemote(process.stdout,`URL: ${url}\n`,displayMode);
-    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Verifying process, coding, autonomous; desktop + host must stay DISARMED...\n`,displayMode);
-    for(const [command,pattern] of SESSION_STATUS){
-      const result=invokeController(ctx,command,{capture:true,echoCaptured:false});
-      if(!pattern.test(result.stdout)) throw new Error(`remote session authority verification failed: ${command} state mismatch`);
-    }
-    ready=true;
-    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} ARMED: process, coding, autonomous | desktop, host DISARMED\n`,displayMode);
     await logTask;
   }finally{
     const wasAborted=aborter.signal.aborted;
@@ -556,12 +598,16 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
   }
 }
 async function runRemote(args){
-  let verbose=false,trace=false,filterExpression='',resumeCursor=null;
+  let verbose=false,trace=false,filterExpression='',resumeCursor=null,mode='default';
   const positional=[];
   for(let index=0;index<args.length;index++){
     const arg=args[index];
     if(arg==='--verbose'||arg==='-v'){verbose=true;continue;}
     if(arg==='--trace'){trace=true;continue;}
+    if(['--desktop','--host','--full'].includes(arg)){
+      if(mode!=='default') throw new Error('remote authority modes are mutually exclusive');
+      mode=arg.slice(2);continue;
+    }
     if(arg==='--filter'){
       if(filterExpression) throw new Error('remote --filter may be specified once');
       if(index+1>=args.length) throw new Error('remote --filter requires an expression');
@@ -574,8 +620,8 @@ async function runRemote(args){
     }
     positional.push(arg);
   }
-  const presentation=verbose||trace||Boolean(filterExpression)||resumeCursor!==null;
-  if(positional.length===0){await runRemoteSession({resumeCursor,verbose,trace,filterExpression});return;}
+  const presentation=verbose||trace||Boolean(filterExpression)||resumeCursor!==null||mode!=='default';
+  if(positional.length===0){await runRemoteSession({resumeCursor,verbose,trace,filterExpression,mode});return;}
   if(presentation) throw new Error('remote presentation flags are valid only for foreground session');
   if(positional.length>1) throw new Error('remote accepts one controller command');
   const command=positional[0];if(!REMOTE_COMMANDS.has(command)) throw new Error(`unsupported remote command '${command}'`);