deadbyte-mcp 0.15.36 → 0.15.37

package/docs/R59-package-lock.json

@@ -0,0 +1,184 @@
+{
+  "name": "deadbyte-mcp",
+  "version": "0.15.36",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "deadbyte-mcp",
+      "version": "0.15.36",
+      "bundleDependencies": [
+        "@modelcontextprotocol/server",
+        "@modelcontextprotocol/client",
+        "typescript",
+        "zod"
+      ],
+      "dependencies": {
+        "@modelcontextprotocol/client": "2.1.0",
+        "@modelcontextprotocol/server": "2.1.0",
+        "typescript": "5.9.3",
+        "zod": "4.4.3"
+      },
+      "bin": {
+        "deadbyte-mcp": "src/deadbyte-cli.mjs"
+      },
+      "engines": {
+        "node": ">=22"
+      }
+    },
+    "node_modules/@modelcontextprotocol/client": {
+      "version": "2.1.0",
+      "inBundle": true,
+      "license": "MIT",
+      "dependencies": {
+        "@modelcontextprotocol/core": "2.1.0",
+        "cross-spawn": "^7.0.5",
+        "eventsource": "^3.0.2",
+        "eventsource-parser": "^3.0.0",
+        "jose": "^6.1.3",
+        "pkce-challenge": "^5.0.0",
+        "zod": "^4.2.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@modelcontextprotocol/core": {
+      "version": "2.1.0",
+      "inBundle": true,
+      "license": "MIT",
+      "dependencies": {
+        "zod": "^4.2.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@modelcontextprotocol/server": {
+      "version": "2.1.0",
+      "inBundle": true,
+      "license": "MIT",
+      "dependencies": {
+        "@modelcontextprotocol/core": "2.1.0",
+        "zod": "^4.2.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "inBundle": true,
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/eventsource": {
+      "version": "3.0.7",
+      "inBundle": true,
+      "license": "MIT",
+      "dependencies": {
+        "eventsource-parser": "^3.0.1"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/eventsource-parser": {
+      "version": "3.1.1",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "inBundle": true,
+      "license": "ISC"
+    },
+    "node_modules/jose": {
+      "version": "6.2.10",
+      "inBundle": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/pkce-challenge": {
+      "version": "5.0.1",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "inBundle": true,
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "inBundle": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "inBundle": true,
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/zod": {
+      "version": "4.4.3",
+      "inBundle": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    }
+  }
+}

package/docs/R59-package.json

@@ -0,0 +1,106 @@
+{
+  "name": "deadbyte-mcp",
+  "version": "0.15.36",
+  "private": false,
+  "type": "module",
+  "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "manifest:write": "node scripts/release-manifest.mjs write",
+    "manifest:verify": "node scripts/release-manifest.mjs verify",
+    "r41:parent:verify": "node scripts/verify-r41-parent.mjs",
+    "r41:memory:verify": "node scripts/verify-memory-r41.mjs",
+    "r42:parent:verify": "node scripts/verify-r42-parent.mjs",
+    "r42:eval": "node scripts/agent-eval-r42.mjs",
+    "self-update:runtime": "node scripts/runtime-self-update.mjs",
+    "self-update:deferred": "node scripts/deferred-slot-operation-r46.mjs",
+    "release:parity": "node scripts/release-parity-r46.mjs",
+    "release:final:write": "node scripts/final-closure-r46.mjs",
+    "release:final:verify": "node scripts/final-closure-verify-r46.mjs",
+    "proof": "node src/proof-cli.mjs workspaces/demo input.txt",
+    "verify": "node src/verifier-cli.mjs workspaces/demo evidence/latest.json",
+    "trust:init": "node src/trust-init.mjs",
+    "mcp": "node src/mcp-server.mjs",
+    "mcp:smoke": "node src/mcp-smoke-client.mjs",
+    "mcp:agent:smoke": "node --test test/agent-runtime.test.mjs test/agent-runtime-adversarial.test.mjs test/agent-runtime-crash.test.mjs test/agent-task-receipt.test.mjs",
+    "mcp:coding:smoke": "node --test test/coding-plane.test.mjs test/coding-plane-adversarial.test.mjs test/coding-runtime.test.mjs test/coding-crash.test.mjs",
+    "mcp:machine-fs:smoke": "node src/machine-fs-smoke-client.mjs",
+    "mcp:observation:smoke": "node src/observation-smoke-client.mjs",
+    "mcp:process:smoke": "node src/process-smoke-client.mjs",
+    "process:policy:refresh": "node scripts/refresh-process-policy.mjs",
+    "mcp:autonomous:smoke": "node --test test/autonomous-runtime.test.mjs test/autonomous-loop.test.mjs test/autonomous-adversarial.test.mjs test/autonomous-supervisor-integration.test.mjs test/native-diff.test.mjs",
+    "containment:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-containment.ps1",
+    "containment:smoke": "node src/containment-smoke.mjs appcontainer",
+    "containment:bootstrap": "node src/containment-bootstrap.mjs",
+    "containment:smoke:lpac": "node src/containment-smoke.mjs lpac",
+    "containment:smoke:appcontainer": "node src/containment-smoke.mjs appcontainer",
+    "containment:construction": "node src/containment-construction.mjs",
+    "containment:child-control": "node src/containment-child-control.mjs",
+    "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
+    "contained:smoke": "node src/contained-smoke.mjs",
+    "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r59-prepublish.ps1",
+    "authority:smoke": "node src/authority-smoke.mjs",
+    "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
+    "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
+    "host:policy:init": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-host-policy.ps1",
+    "mcp:remote:host:smoke": "node src/remote-mcp-host-smoke-client.mjs",
+    "mcp:remote:autonomous:smoke": "node src/remote-mcp-autonomous-smoke-client.mjs",
+    "mcp:tunnel-compat:smoke": "node src/tunnel-stdio-compat-smoke.mjs",
+    "audit:verify": "node src/deadbyte-cli.mjs audit verify",
+    "audit:status": "node src/deadbyte-cli.mjs audit status",
+    "desktop:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-desktop-r40.ps1",
+    "desktop:policy:refresh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/init-desktop-policy-r40.ps1",
+    "r43:parent:verify": "node scripts/verify-r43-parent.mjs",
+    "r43:full:test": "node scripts/full-regression-r43.mjs",
+    "r44:parent:verify": "node scripts/verify-r44-parent.mjs",
+    "r44:full:test": "node scripts/full-regression-r44.mjs",
+    "finalize:r44": "node scripts/finalize-r44.mjs",
+    "hardware:build": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-hardware-r45.ps1",
+    "doctor": "node src/deadbyte-cli.mjs doctor",
+    "r45:parent:verify": "node scripts/verify-r45-parent.mjs",
+    "r45:full:test": "node scripts/full-regression-r45.mjs",
+    "finalize:r45": "node scripts/finalize-r45.mjs",
+    "r46:fileless:test": "node --test --test-concurrency=1 test/process-policy.test.mjs test/process-policy-refresh.test.mjs test/release-generation.test.mjs test/process-runtime.test.mjs test/process-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-ledger-r36.test.mjs test/remote-device-r44.test.mjs test/observation-runtime.test.mjs test/observation-mcp-tools.test.mjs",
+    "r46:full:test": "node scripts/full-regression-r46.mjs",
+    "r47:full:test": "node scripts/full-regression-r47.mjs",
+    "r47:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r47.test.mjs",
+    "r47:hardening:test": "node scripts/commander-hardening-gate-r47.mjs",
+    "r48:full:test": "node scripts/full-regression-r48.mjs",
+    "r48:release:test": "node --test --test-concurrency=1 test/r48-release-contract.test.mjs test/commander-reference-contract-r48.test.mjs test/commander-extended-wire-r48.test.mjs test/commander-external-process-r48.test.mjs test/commander-office-reader-r48.test.mjs test/commander-pdf-r48.test.mjs test/commander-url-reader-r48.test.mjs test/commander-wire-contract-r47.test.mjs test/commander-protocol-adversarial-r48.test.mjs",
+    "r48:catalog:test": "node --test --test-concurrency=1 test/full-max-catalog-r48.test.mjs",
+    "release:npm": "node scripts/npm-release-r48.mjs",
+    "r51:focused:test": "node --test --test-concurrency=1 test/r51-release-contract.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs",
+    "r52:focused:test": "node --test --test-concurrency=1 test/r52-release-contract.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/r52-host-revocation.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs test/runtime-self-update.test.mjs",
+    "r53:focused:test": "node --test --test-concurrency=1 test/r53-release-contract.test.mjs test/stabilization-update-child-root.test.mjs test/stabilization-state-root.test.mjs test/stabilization-guardian.test.mjs test/stabilization-semver.test.mjs test/stabilization-powershell.test.mjs test/release-slot.test.mjs test/runtime-self-update.test.mjs test/r51-runtime-coherence.test.mjs test/remote-session-cli.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/r52-host-revocation.test.mjs",
+    "r54:focused:test": "node --test --test-concurrency=1 test/r54-release-contract.test.mjs test/r54-offline-predecessor-self-exclusion.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/runtime-self-update.test.mjs test/r51-runtime-coherence.test.mjs test/remote-session-cli.test.mjs",
+    "r55:focused:test": "node --test --test-concurrency=1 test/r55-release-contract.test.mjs test/r55-offline-predecessor-guardian-family.test.mjs test/r54-offline-predecessor-self-exclusion.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/runtime-self-update.test.mjs test/r51-runtime-coherence.test.mjs test/remote-session-cli.test.mjs",
+    "r56:focused:test": "node --test --test-concurrency=1 test/r56-release-contract.test.mjs test/r56-rollback-launcher-restore.test.mjs test/r55-offline-predecessor-guardian-family.test.mjs test/r54-offline-predecessor-self-exclusion.test.mjs test/runtime-self-update.test.mjs test/release-slot.test.mjs test/r51-runtime-coherence.test.mjs",
+    "r57:focused:test": "node --test --test-concurrency=1 test/r57-release-contract.test.mjs test/r57-core-startup-race.test.mjs test/r56-rollback-launcher-restore.test.mjs test/r55-offline-predecessor-guardian-family.test.mjs test/r54-offline-predecessor-self-exclusion.test.mjs test/runtime-self-update.test.mjs test/release-slot.test.mjs test/r51-runtime-coherence.test.mjs test/remote-session-cli.test.mjs",
+    "r58:focused:test": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/r58-focused.ps1",
+    "r58:cross-plane:test": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/r58-cross-plane.ps1",
+    "r59:focused:test": "node --test --test-concurrency=1 test/capability-snapshot-r59.test.mjs test/capability-resolver.test.mjs test/runtime-plane-registry-r59.test.mjs test/optional-plane-degraded-r59.test.mjs test/bridge-runtime-r59.test.mjs test/controller-policy-preflight-r59.test.mjs test/r59-tool-surface-compat.test.mjs test/r58-controller-state-coherence.test.mjs",
+    "r59:release:test": "node --test --test-concurrency=1 test/r59-release-contract.test.mjs test/r59-tool-surface-compat.test.mjs test/bridge-runtime-r59.test.mjs test/controller-policy-preflight-r59.test.mjs"
+  },
+  "bundleDependencies": [
+    "@modelcontextprotocol/server",
+    "@modelcontextprotocol/client",
+    "typescript",
+    "zod"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/client": "2.1.0",
+    "@modelcontextprotocol/server": "2.1.0",
+    "typescript": "5.9.3",
+    "zod": "4.4.3"
+  },
+  "bin": {
+    "deadbyte-mcp": "src/deadbyte-cli.mjs"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/docs/R59-version.mjs

@@ -0,0 +1,6 @@
+export const DEADBYTE_VERSION = '0.15.36';
+export const MCP_PROTOCOL_VERSION = '2026-07-28';
+export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
+export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';
+export const RECEIPT_REQUEST_SCHEMA = 'deadbyte.request.v1';
+export const RUNTIME_IDENTITY_SCHEMA = 'deadbyte.runtime.v1';

package/docs/R60-TASK-CONTRACT.md

@@ -0,0 +1,22 @@
+# R60 Task Contract
+
+- TASK_ID: deadbyte-r60-remote-truth-resilience
+- OBJECTIVE: Produce backward-compatible DEADBYTE MCP 0.15.37 with one observed authority truth, execution-backed readiness, durable keyed mutation idempotency, fail-closed keyless ambiguity, bounded reconnect recovery, and low-noise human timeline without audit loss.
+- PARENT_RUNTIME: exact production-accepted 0.15.36 release v0.15.36-090d9db3e0679c0d, release manifest 090d9db3e0679c0d4943f3229ecab7b9fcccbe4f767348a568c9f3bb60d1b431, generation manifest 6134f9f26b680e13ed545da4ab5f3020f411ea2569062fb9c154c8a7e036c9dc.
+- TARGET: deadbyte-mcp@0.15.37, train R60, label REMOTE TRUTH + RESILIENCE HARDENING.
+- METHOD: RED -> smallest fix -> GREEN -> affected regression -> full regression -> Windows gate -> package proof -> activation rollback restore -> registry verification.
+- AUTHORITY: default remote arms Process, Coding, Autonomous only; Desktop and Host stay DISARMED. --desktop, --host and --full widen only the explicitly requested session authority and must read back enforcement before READY.
+- READY: transport presence alone is insufficient; Bridge, Cloud, exact Core generation, MCP execution probe, capability attestation and selected authority vector must all be observed.
+- IDEMPOTENCY: stable idempotency_key plus canonical payload receives durable no-duplicate dispatch semantics across reconnect. Same key with different payload is a hard conflict.
+- LEGACY_MUTATION: keyless requests remain compatible but receive no cross-reconnect exactly-once claim; ambiguous post-dispatch effects fail closed and are never blindly replayed.
+- READ_ONLY_RECOVERY: only explicitly classified read-only operations may re-execute after interruption and only under their original validity and deadline contract.
+- RECONNECT: bounded, jittered, shutdown-aware, one in-flight recovery per component; terminal faults are not retried.
+- CLOCK: wall clock is evidence time; monotonic clocks own elapsed and retry decisions. No global Date.now monkeypatch.
+- HUMAN_TIMELINE: unchanged capability_manifest polling may be suppressed only from presentation; immutable audit and replay keep every event.
+- WINDOWS_TEXT: deterministic BOM and known-source decoding; no heuristic corruption repair.
+- DEPENDENCIES: keep the existing four runtime dependencies. No Supabase, Tiptap, Sharp, ExcelJS, generic shell surface, telemetry, or new framework.
+- PUBLIC_SURFACE: compact public tool count remains 43; R60 hardening is implemented behind existing typed gateways.
+- NON_GOALS: document or UI feature expansion, arbitrary shell convenience, mandatory container runtime.
+- CURRENT_EVIDENCE: R60 focused 38 of 38 PASS; pre-freeze full behavioral regression 1236 total, 1205 PASS, 31 historical or platform SKIP, 0 FAIL.
+- PENDING_BEFORE_FINAL: post-freeze full regression, Windows gate, manifest and doctor, deterministic package, isolated packed-artifact smoke, production activation rollback restore, registry round-trip, final signed machine binding.
+- FINAL_RULE: stable_final_claim remains false until every mandatory pending gate is fresh and green.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.36",
+  "version": "0.15.37",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
@@ -42,7 +42,7 @@
     "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
     "contained:smoke": "node src/contained-smoke.mjs",
     "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r59-prepublish.ps1",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r60-prepublish.ps1",
     "authority:smoke": "node src/authority-smoke.mjs",
     "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
     "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
@@ -83,7 +83,9 @@
     "r58:focused:test": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/r58-focused.ps1",
     "r58:cross-plane:test": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/r58-cross-plane.ps1",
     "r59:focused:test": "node --test --test-concurrency=1 test/capability-snapshot-r59.test.mjs test/capability-resolver.test.mjs test/runtime-plane-registry-r59.test.mjs test/optional-plane-degraded-r59.test.mjs test/bridge-runtime-r59.test.mjs test/controller-policy-preflight-r59.test.mjs test/r59-tool-surface-compat.test.mjs test/r58-controller-state-coherence.test.mjs",
-    "r59:release:test": "node --test --test-concurrency=1 test/r59-release-contract.test.mjs test/r59-tool-surface-compat.test.mjs test/bridge-runtime-r59.test.mjs test/controller-policy-preflight-r59.test.mjs"
+    "r59:release:test": "node --test --test-concurrency=1 test/r59-release-contract.test.mjs test/r59-tool-surface-compat.test.mjs test/bridge-runtime-r59.test.mjs test/controller-policy-preflight-r59.test.mjs",
+    "r60:focused:test": "node --test --test-concurrency=1 test/r60-authority-coherence.test.mjs test/r60-authority-enforcement.test.mjs test/r60-bridge-dispatch.test.mjs test/r60-clock-discipline.test.mjs test/r60-live-timeline.test.mjs test/r60-reconnect-errors.test.mjs test/r60-reconnect-jitter.test.mjs test/r60-remote-call-recovery.test.mjs test/r60-windows-log-decode.test.mjs test/r60-release-contract.test.mjs",
+    "r60:full:test": "node scripts/full-regression-r60.mjs"
   },
   "bundleDependencies": [
     "@modelcontextprotocol/server",

package/scripts/full-regression-r60.mjs

@@ -0,0 +1,32 @@
+import { readdir, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const testDir=path.join(root,'test');
+const excluded=new Set(['full-max-catalog-r44.test.mjs','full-max-catalog-r45.test.mjs','full-max-catalog-r46.test.mjs']);
+const files=(await readdir(testDir,{withFileTypes:true}))
+  .filter(entry=>entry.isFile()&&entry.name.endsWith('.test.mjs')&&!excluded.has(entry.name));
+const weighted=[];
+for(const entry of files) weighted.push({path:path.join('test',entry.name),size:(await stat(path.join(testDir,entry.name))).size});
+weighted.sort((a,b)=>b.size-a.size||a.path.localeCompare(b.path,'en'));
+const batchCount=16;
+const batches=Array.from({length:batchCount},()=>[]);
+weighted.forEach((entry,index)=>batches[index%batchCount].push(entry.path));
+const match=process.argv.slice(2).map(String).find(arg=>/^--batch=\d+$/.test(arg));
+const selected=match?Number(match.slice('--batch='.length)):null;
+if(selected!==null&&(!Number.isInteger(selected)||selected<1||selected>batchCount))throw new Error(`R60 regression batch must be 1..${batchCount}`);
+const indexes=selected===null?[...Array(batchCount).keys()]:[selected-1];
+let total=0;
+for(const index of indexes){
+  const batch=batches[index].sort((a,b)=>a.localeCompare(b,'en'));
+  console.log(`R60-BOUNDED-REGRESSION batch=${index+1}/${batchCount} files=${batch.length}`);
+  const result=spawnSync(process.execPath,['--test','--test-concurrency=1',...batch],{cwd:root,stdio:'inherit',windowsHide:true,shell:false});
+  if(result.error)throw result.error;
+  if(result.signal)throw new Error(`R60 regression batch ${index+1} terminated by ${result.signal}`);
+  if(result.status!==0)throw new Error(`R60 regression batch ${index+1} failed with exit code ${result.status}`);
+  total+=batch.length;
+}
+console.log(`R60-BOUNDED-REGRESSION PASS files=${total} batches=${indexes.length}`);

package/scripts/gate-windows-r60-prepublish.ps1

@@ -0,0 +1,74 @@
+# R60 staged gate revision 3: final pre-package metadata seal identity
+param(
+  [ValidateSet('all','preflight','focused','full-batch','manifest','doctor')]
+  [string]$Stage='all',
+  [ValidateRange(1,16)]
+  [int]$Batch=1
+)
+
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version 3.0
+$root=Split-Path $PSScriptRoot -Parent
+Set-Location -LiteralPath $root
+
+function Invoke-NodeTest([string]$Name,[string[]]$Files){
+  Write-Host "==== $Name ===="
+  & node.exe --test --test-concurrency=1 @Files
+  if($LASTEXITCODE -ne 0){ throw "R60 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+function Invoke-Npm([string]$Name,[string[]]$NpmArgs){
+  Write-Host "==== $Name ===="
+  & npm.cmd @NpmArgs
+  if($LASTEXITCODE -ne 0){ throw "R60 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+function Assert-R60Predecessor {
+  $active=Get-Content -LiteralPath (Join-Path $env:USERPROFILE '.deadbyte-mcp\active-release.json') -Raw | ConvertFrom-Json
+  if($active.release_id -ne 'v0.15.36-090d9db3e0679c0d'){ throw "R60 predecessor release mismatch: $($active.release_id)" }
+  if($active.manifest_sha256 -ne '090d9db3e0679c0d4943f3229ecab7b9fcccbe4f767348a568c9f3bb60d1b431'){ throw 'R60 predecessor manifest mismatch' }
+  if($active.generation_manifest_sha256 -ne '6134f9f26b680e13ed545da4ab5f3020f411ea2569062fb9c154c8a7e036c9dc'){ throw 'R60 predecessor generation mismatch' }
+}
+
+Assert-R60Predecessor
+if($Stage -eq 'preflight'){
+  Write-Host '==== R60 PREPUBLISH WINDOWS GATE STAGE: PASS preflight ===='
+  return
+}
+
+if($Stage -eq 'all' -or $Stage -eq 'focused'){
+  Invoke-Npm 'r60-focused' @('run','r60:focused:test')
+  if($Stage -eq 'focused'){
+    Write-Host '==== R60 PREPUBLISH WINDOWS GATE STAGE: PASS focused ===='
+    return
+  }
+}
+
+if($Stage -eq 'full-batch'){
+  Write-Host "==== r60-full-regression-batch-$Batch ===="
+  & node.exe scripts/full-regression-r60.mjs "--batch=$Batch"
+  if($LASTEXITCODE -ne 0){ throw "R60 prepublish gate failed at full-batch-$Batch exit=$LASTEXITCODE" }
+  Write-Host "==== R60 PREPUBLISH WINDOWS GATE STAGE: PASS full-batch-$Batch ===="
+  return
+}
+
+if($Stage -eq 'all'){
+  Invoke-Npm 'r60-full-regression' @('run','r60:full:test')
+}
+
+if($Stage -eq 'all' -or $Stage -eq 'manifest'){
+  Invoke-Npm 'manifest-write' @('run','manifest:write')
+  Invoke-Npm 'manifest-verify' @('run','manifest:verify')
+  if($Stage -eq 'manifest'){
+    Write-Host '==== R60 PREPUBLISH WINDOWS GATE STAGE: PASS manifest ===='
+    return
+  }
+}
+
+if($Stage -eq 'all' -or $Stage -eq 'doctor'){
+  Invoke-Npm 'doctor' @('run','doctor')
+  if($Stage -eq 'doctor'){
+    Write-Host '==== R60 PREPUBLISH WINDOWS GATE STAGE: PASS doctor ===='
+    return
+  }
+}
+
+Write-Host '==== R60 PREPUBLISH WINDOWS GATE: PASS ===='

package/src/capability-snapshot.mjs

@@ -39,7 +39,12 @@ export function createCapabilitySnapshotTracker({clock=Date.now,ttlMs=5000}={}){
     const body={profile,ledger_sha256:ledger.ledger_sha256,tool_catalog:[...toolCatalog],tool_count:toolCatalog.length,
       catalog_sha256:catalogSha256,capabilities,effective_capabilities:[...(resolution.effective_capabilities??[])],
       unavailable_capabilities:[...(resolution.unavailable_capabilities??[])],degraded_capabilities:[...(resolution.degraded_capabilities??[])],
-      bindings:safeBindings,planes:safePlanes};
+      bindings:safeBindings,planes:safePlanes,
+      // Informational transport contract, not an authority-bearing ledger entry.
+      remote_dispatch_contract:Object.freeze({scope:'bridge_ingress_only',schema:'deadbyte.remote-dispatch.v1',
+        keyed_mutation:'same stable key and canonical payload: no duplicate dispatch; unknown post-dispatch outcome is not retried',
+        read_only_recovery:'a proven read-only interrupted call may re-execute under its original deadline',
+        keyless_mutation:'cross-reconnect logical retry safety unavailable; ambiguous outcome is not auto-replayed'})};
     const fingerprint=sha(body);
     if(fingerprint!==lastFingerprint){stateEpoch++;lastFingerprint=fingerprint;lastSnapshotId=sha({fingerprint,state_epoch:stateEpoch});}
     const observed=Number(clock());
@@ -49,4 +54,3 @@ export function createCapabilitySnapshotTracker({clock=Date.now,ttlMs=5000}={}){
   }
   return Object.freeze({snapshot});
 }
-