deadbyte-mcp 0.15.37 → 0.15.39

package/scripts/npm-release-r48.mjs

@@ -1,4 +1,5 @@
 import { spawnSync } from 'node:child_process';
+import { verifyPublishedTarballIdentity } from './npm-artifact-identity-r61.mjs';
 import { mkdtemp, readFile, rm, unlink } from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
@@ -58,6 +59,8 @@ const allowedUnmanifested = new Set([
 
 async function main() {
   const isVerifyOnly = process.argv.includes('--verify-only') || process.argv.includes('--dry-run');
+  const publishOnly = process.argv.includes('--publish-only');
+  if (isVerifyOnly && publishOnly) throw new Error('--publish-only conflicts with verify-only mode');
 
   console.log(`[1/7] Reading package.json and checking registry publication status... ${isVerifyOnly ? '(MODE: VERIFY-ONLY / DRY-RUN)' : '(MODE: PUBLISH)'}`);
   const pkg = JSON.parse(await readFile(path.join(root, 'package.json'), 'utf8'));
@@ -180,6 +183,8 @@ async function main() {
       return;
     }
 
+    const localBytes = await readFile(tarball);
+
     console.log('[6/7] Publishing artifact to npm registry...');
     publishAttempted = true;
     let publishOut;
@@ -193,8 +198,15 @@ async function main() {
       }
       throw publishError;
     }
-    const published = parseJson(runNpm(['view', `deadbyte-mcp@${version}`, 'version', 'dist.integrity', 'dist.tarball', '--json'], { timeout: 120000 }));
+    const viewed = parseJson(runNpm(['view', `deadbyte-mcp@${version}`, 'version', 'dist.integrity', 'dist.shasum', 'dist.tarball', '--json'], { timeout: 120000 }));
+    const published = Array.isArray(viewed) ? viewed[0] : viewed;
+    const dist = published?.dist ?? published;
+    if(typeof dist?.tarball !== 'string')throw new Error('published registry tarball URL missing');
+    const registryResponse = await fetch(dist.tarball,{signal:AbortSignal.timeout(120000)});
+    if(!registryResponse.ok) throw new Error(`registry tarball fetch failed status=${registryResponse.status}`);
+    const registryBytes = Buffer.from(await registryResponse.arrayBuffer());
     const tags = parseJson(runNpm(['view', 'deadbyte-mcp', 'dist-tags', '--json'], { timeout: 120000 }));
+    const identity=verifyPublishedTarballIdentity({version,localBytes,registryBytes,published,tags});
 
     console.log('[7/7] Post-publish external registry smoke test (executed outside repo in temp)...');
     const tempDir = os.tmpdir();
@@ -211,16 +223,20 @@ async function main() {
       timeout: 300000,
     });
 
-    console.log('[8/8] Activating the published release into the live immutable slot and waiting for verified handoff...');
-    run(node, [path.join(root, 'scripts', 'deploy-r48.mjs')], { cwd: root, timeout: 900000 });
+    if(!publishOnly){
+      console.log('[8/8] Activating the published release into the live immutable slot and waiting for verified handoff...');
+      run(node, [path.join(root, 'scripts', 'deploy-r48.mjs')], { cwd: root, timeout: 900000 });
+    }else console.log('[8/8] Publication verified; activation deliberately deferred to the separate production gate.');
 
     releaseSucceeded = true;
     console.log('\nRELEASE SUCCESSFUL:');
     console.log(JSON.stringify({
-      status: 'published',
+      status: publishOnly?'published_verified_activation_pending':'published',
       name: pkg.name,
       version,
       tarball: filename,
+      tarball_sha256: identity.tarball_sha256,
+      npm_integrity: identity.npm_integrity,
       published,
       published_output_tail: publishOut.slice(-2000),
       dist_tags: tags,
@@ -231,7 +247,7 @@ async function main() {
     }, null, 2));
 
   } finally {
-    if (releaseSucceeded || !publishAttempted) {
+    if ((releaseSucceeded && !publishOnly) || !publishAttempted) {
       await unlink(tarball).catch(() => {});
     } else {
       console.error('Release artifact preserved after failure: ' + tarball);

package/scripts/r61-mixed-lane-benchmark.mjs

@@ -0,0 +1,98 @@
+import {mkdtemp,mkdir,readFile,readdir,stat,writeFile,open,rm} from 'node:fs/promises';
+import {spawn} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import {monitorEventLoopDelay,performance} from 'node:perf_hooks';
+import {pathToFileURL} from 'node:url';
+import os from 'node:os';
+import path from 'node:path';
+
+const roots=process.argv.slice(2);
+if(roots.length!==2||roots.some(item=>!path.isAbsolute(item)))throw new Error('two absolute governor module paths required');
+const levels=(process.env.DEADBYTE_R61_BENCH_LEVELS??'1,2,4,8,16,32').split(',').map(Number);
+if(!levels.length||levels.some(level=>![1,2,4,8,16,32].includes(level))||new Set(levels).size!==levels.length)throw new Error('benchmark levels invalid');
+const ROUNDS=Number(process.env.DEADBYTE_R61_BENCH_ROUNDS??3),OPS=160;
+if(!Number.isInteger(ROUNDS)||ROUNDS<3||ROUNDS>15)throw new Error('benchmark rounds must be 3..15');
+const scratchRoot=process.env.DEADBYTE_R61_SCRATCH_ROOT;
+if(!scratchRoot||!path.isAbsolute(scratchRoot))throw new Error('explicit absolute DEADBYTE_R61_SCRATCH_ROOT required');
+const quant=(values,p)=>{const ordered=[...values].sort((a,b)=>a-b);return ordered[Math.max(0,Math.ceil(ordered.length*p)-1)]};
+const sha=value=>createHash('sha256').update(value).digest('hex');
+
+async function childOutput(){
+  const child=spawn(process.execPath,['-e','process.stdout.write("R61_CHILD_OK")'],{windowsHide:true,stdio:['ignore','pipe','pipe']});
+  let output='';for await(const chunk of child.stdout)output+=chunk;
+  const exit=await new Promise(resolve=>child.once('close',resolve));
+  if(exit!==0||output!=='R61_CHILD_OK')throw new Error('bounded child process oracle failed');
+}
+
+async function runCase(modulePath,level,round){
+  const {createBridgeGovernor}=await import(pathToFileURL(modulePath).href);
+  await mkdir(scratchRoot,{recursive:true});
+  const scratch=await mkdtemp(path.join(scratchRoot,'deadbyte-r61-bench-'));
+  const fixture=path.join(scratch,'fixture'),audit=path.join(scratch,'presentation.jsonl');
+  await mkdir(fixture);
+  const sample='deadbyte bounded corpus สวัสดี\n'.repeat(512);
+  for(let i=0;i<16;i++)await writeFile(path.join(fixture,`f${i}.txt`),sample);
+  const governor=createBridgeGovernor();
+  const calls=[],control=[],counts={error:0,unknown:0},peak={rss:process.memoryUsage().rss,queue:0,active:0};
+  const delay=monitorEventLoopDelay({resolution:20});delay.enable();
+  let next=0;
+  const started=performance.now();
+  async function worker(){
+    while(next<OPS){
+      const i=next++;
+      const kind=i%16;
+      const tool=kind<3?(kind===0?'machine_ping':'machine_status'):
+        kind<5?'capability_manifest':kind<8?'machine_fs_read':kind<10?'coding_search':
+        kind<12?'machine_fs_write':kind===12?'process_session_start':kind<15?'coding_file_read':'machine_process_list';
+      const t=performance.now();let ticket;
+      try{
+        ticket=await governor.acquire(tool);
+        if(tool==='machine_ping')sha(`nonce-${round}-${i}`);
+        else if(tool==='machine_status')await stat(fixture);
+        else if(tool==='capability_manifest')sha(await readFile(roots[0]));
+        else if(tool==='coding_search'){
+          const names=await readdir(fixture);
+          for(const name of names)if((await readFile(path.join(fixture,name),'utf8')).includes('bounded'))break;
+        }else if(tool==='machine_fs_write')await writeFile(path.join(scratch,`out-${i}.txt`),sample.slice(0,128));
+        else if(tool==='process_session_start')await childOutput();
+        else if(tool==='machine_process_list')os.cpus().length;
+        else await readFile(path.join(fixture,`f${i%16}.txt`));
+        const line=JSON.stringify({kind,at:i,hash:sha(String(i))})+'\n';
+        const handle=await open(audit,'a');try{await handle.writeFile(line);await handle.sync();}finally{await handle.close();}
+      }catch(error){counts.error++;throw error;}
+      finally{
+        ticket?.release();
+        const elapsed=performance.now()-t;
+        calls.push(elapsed);if(kind<3)control.push(elapsed);
+        const state=governor.snapshot();
+        peak.rss=Math.max(peak.rss,process.memoryUsage().rss);
+        peak.queue=Math.max(peak.queue,...Object.values(state).map(value=>value.queued));
+        peak.active=Math.max(peak.active,...Object.values(state).map(value=>value.active));
+      }
+    }
+  }
+  try{
+    await Promise.all(Array.from({length:level},()=>worker()));
+    await governor.close();
+    const total=performance.now()-started;
+    return {level,round,n:calls.length,throughput_ops_s:OPS*1000/total,p50_ms:quant(calls,.5),p95_ms:quant(calls,.95),
+      p99_ms:quant(calls,.99),max_ms:Math.max(...calls),control_p95_ms:quant(control,.95),
+      event_loop_p95_ms:delay.percentile(95)/1e6,peak_rss_bytes:peak.rss,peak_queue:peak.queue,
+      peak_active:peak.active,errors:counts.error,unknown:counts.unknown};
+  }finally{delay.disable();await rm(scratch,{recursive:true,force:true});}
+}
+
+const results=[];
+for(const level of levels)for(let round=0;round<ROUNDS;round++){
+  const order=round%2===0?[0,1]:[1,0];
+  for(const index of order)results.push({target:index,...await runCase(roots[index],level,round)});
+}
+const report={schema:'deadbyte.r61.mixed-lane-benchmark.v1',node:process.version,platform:process.platform,
+  governor_sha256:await Promise.all(roots.map(async value=>sha(await readFile(value)))),levels,rounds:ROUNDS,operations_per_run:OPS,
+  limitations:['direct governor and real scratch I/O, not full MCP transport','presentation traffic is fsynced fixture data, not signed audit'],results};
+const outputPath=process.env.DEADBYTE_R61_BENCH_OUTPUT;
+if(outputPath){
+  if(!path.isAbsolute(outputPath))throw new Error('benchmark output must be absolute');
+  await writeFile(outputPath,JSON.stringify(report,null,2)+'\n',{flag:'wx'});
+  console.log(JSON.stringify({schema:report.schema,output_path:outputPath,result_count:results.length,governor_sha256:report.governor_sha256}));
+}else console.log(JSON.stringify(report,null,2));

package/scripts/r62-focused.ps1

@@ -0,0 +1,9 @@
+$ErrorActionPreference='Stop'
+$root=Split-Path -Parent $PSScriptRoot
+Push-Location $root
+try {
+  & npm.cmd run r62:focused:test
+  if($LASTEXITCODE -ne 0){ exit $LASTEXITCODE }
+} finally {
+  Pop-Location
+}

package/scripts/r62-full.ps1

@@ -0,0 +1,9 @@
+$ErrorActionPreference='Stop'
+$root=Split-Path -Parent $PSScriptRoot
+Push-Location $root
+try {
+  & npm.cmd test
+  $code=$LASTEXITCODE
+  Write-Host ("R62_FULL_EXIT="+$code)
+  exit $code
+} finally { Pop-Location }

package/scripts/r62-live-transaction-audit.mjs

@@ -0,0 +1,17 @@
+import {inspectDoctorTransactions} from '../src/doctor-transactions-r58.mjs';
+
+const result=await inspectDoctorTransactions();
+const summary=result.findings.find(item=>item.evidence?.receipt_verification_performed===true)?.evidence??null;
+const unresolved=result.findings
+ .filter(item=>item.level==='WARN'&&item.evidence?.recorded_phase)
+ .map(item=>({schema:item.evidence.schema,phase:item.evidence.recorded_phase,state_sha256:item.evidence.state_sha256}));
+const phases={};
+for(const item of unresolved) phases[item.phase]=(phases[item.phase]??0)+1;
+console.log(JSON.stringify({
+ status:result.status,
+ summary,
+ unresolved_count:unresolved.length,
+ unresolved_phases:phases,
+ fail_count:result.findings.filter(item=>item.level==='FAIL').length,
+ inventory_warning:result.findings.some(item=>item.evidence?.inventory_complete===false)
+},null,2));

package/scripts/r62-unresolved-transaction-inspect.mjs

@@ -0,0 +1,54 @@
+import {opendir,lstat,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createHash} from 'node:crypto';
+
+const state=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const root=path.join(state,'evidence','updates');
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const terminal=new Set(['completed','superseded','failed_receipted']);
+const rows=[];
+for await(const entry of await opendir(root)){
+  if(!entry.isDirectory()||entry.isSymbolicLink()) continue;
+  const dir=path.join(root,entry.name),stateFile=path.join(dir,'state.json');
+  let stateBytes,body;
+  try{
+    const info=await lstat(stateFile);
+    if(!info.isFile()||info.isSymbolicLink()||info.size>1048576) continue;
+    stateBytes=await readFile(stateFile);
+    body=JSON.parse(stateBytes.toString('utf8').replace(/^\uFEFF/,''));
+  }catch{continue;}
+  if(!['deadbyte.r27-slot-update-state.v1','deadbyte.r31-slot-rollback-state.v1'].includes(body?.schema)) continue;
+  const has=async name=>{try{const st=await lstat(path.join(dir,name));return st.isFile()&&!st.isSymbolicLink();}catch{return false;}};
+  if(terminal.has(body.phase)||await has('receipt.json')||await has('failure-receipt.json')) continue;
+  const handoff=await has('handoff.json');
+  let handoffSummary=null;
+  if(handoff){
+    try{
+      const h=JSON.parse((await readFile(path.join(dir,'handoff.json'),'utf8')).replace(/^\uFEFF/,''));
+      handoffSummary={schema:h?.body?.schema??h?.schema??null,body:h?.body??h};
+    }catch(error){handoffSummary={parse_error:String(error?.message??error)};}
+  }
+  rows.push({
+    entry:entry.name,
+    entry_sha256:sha(Buffer.from(entry.name,'utf8')),
+    state_sha256:sha(stateBytes),
+    schema:body.schema,
+    phase:body.phase,
+    update_id:body.update_id??null,
+    rollback_id:body.rollback_id??null,
+    prior_pointer:body.prior_pointer??null,
+    new_pointer:body.new_pointer??null,
+    active_pointer:body.active_pointer??null,
+    old_runtime:body.old_runtime??null,
+    new_runtime:body.new_runtime??null,
+    error:body.error??null,
+    recovery:body.recovery??null,
+    has_handoff:handoff,
+    handoff:handoffSummary
+  });
+}
+rows.sort((a,b)=>a.entry.localeCompare(b.entry));
+let active=null;
+try{active=JSON.parse(await readFile(path.join(state,'active-release.json'),'utf8'));}catch{}
+console.log(JSON.stringify({state_root:state,active_pointer:active,unresolved_count:rows.length,rows},null,2));

package/src/deadbyte-cli.mjs

@@ -226,12 +226,12 @@ function parseAuditLogLine(file,line){
   if(!/^segment-\d{8}\.jsonl$/.test(path.basename(file))||!line) return null;
   try{return JSON.parse(line);}catch{return null;}
 }
-function formatLogLine(file,line,{auditEvent=null,activityTracker=null,sequence=null,verbose=false,displayMode='unicode'}={}){
+function formatLogLine(file,line,{auditEvent=null,activityTracker=null,sequence=null,sourceSequence=null,verbose=false,displayMode='unicode'}={}){
   if(!line) return null;
   if(/^segment-\d{8}\.jsonl$/.test(path.basename(file))){
     const event=auditEvent??parseAuditLogLine(file,line);
     if(!event) return null;
-    return activityTracker?activityTracker.observe(event,{sequence}):formatCompactAuditEvent(event);
+    return activityTracker?activityTracker.observe(event,{sequence,sourceSequence}):formatCompactAuditEvent(event);
   }
   return formatRuntimeDiagnosticLine(file,line,{verbose,displayMode});
 }
@@ -328,7 +328,7 @@ function timelineFilterEvent(timeline){
 async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTracker=null,timelineFilter=null,timelineWriter=null,verbose=false,displayMode='unicode'}={}){
   process.stdout.write(verbose
     ? '[LOG] Verbose live timeline. Full sanitized request detail enabled; Ctrl+C disconnects and revokes authority.\n'
-    : '[LOG] Human live timeline. Transport IN/OUT hidden; full replay/audit detail remains on disk. Ctrl+C disconnects and revokes authority.\n');
+    : '[LOG] Human live timeline. Transport IN/OUT hidden; full replay/audit detail remains on disk. START/DONE retained; heartbeat bursts folded; Ctrl+C disconnects and revokes authority.\n');
   const activeOffsets=offsets??await snapshotRemoteLogOffsets(root);
   const partialLines=new Map();
   let liveFiles=[...activeOffsets.keys()];
@@ -358,7 +358,8 @@ async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTra
           : await journal.recordTerminal(timeline);
         if(recorded?.duplicate) continue;
         const accepted=timelineFilter&&timeline?timelineFilter.accept(timelineFilterEvent(timeline)):true;
-        const formatted=formatLogLine(file,line,{auditEvent,activityTracker,sequence:recorded?.event?.seq??null,verbose,displayMode});
+        const formatted=formatLogLine(file,line,{auditEvent,activityTracker,sequence:recorded?.event?.seq??null,
+          sourceSequence:Number.isSafeInteger(auditEvent?.seq)?auditEvent.seq:null,verbose,displayMode});
         if(!formatted||!accepted) continue;
         const output=Array.isArray(formatted)?formatted:[formatted];
         for(const item of output) if(item){
@@ -512,9 +513,9 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     filePath:remoteResultJournalPath(ctx.root,marker.result_session_id),sessionId:marker.result_session_id,maxEntries:2048
   });
   const rootPaths=await readLiveRootPaths(ctx.root);
-  const activityTracker=createLiveTimelineTracker({verbose,displayMode,rootPaths,trace});
+  const activityTracker=createLiveTimelineTracker({verbose,displayMode,rootPaths,trace,foldHeartbeats:!verbose});
   const timelineFilter=filterExpression?createLiveTimelineFilter(filterExpression):null;
-  const timelineWriter=createLiveTimelineWriter({stream:process.stdout,displayMode,rewrite:!verbose});
+  const timelineWriter=createLiveTimelineWriter({stream:process.stdout,displayMode,rewrite:false});
   const aborter=new AbortController();
   const abort=()=>aborter.abort();
   const watchStdin=!process.stdin.isTTY;
@@ -588,6 +589,8 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     if(logTask) await logTask.catch(()=>{});
     timelineWriter.flush();
     for(const line of activityTracker.reconcileInterrupted('session_end')) process.stdout.write(`${line}\n`);
+    const filterRetention=timelineFilter?.retention();
+    if(filterRetention?.evicted>0) process.stdout.write(`[WARN] LIVELOG filter evicted ${filterRetention.evicted} presentation identities; full audit remains on disk.\n`);
     process.stdout.write(`${activityTracker.summary()}\n`);
     process.removeListener('SIGINT',abort);process.removeListener('SIGTERM',abort);
     if(watchStdin){process.stdin.removeListener('end',abort);process.stdin.removeListener('close',abort);process.stdin.pause();}

package/src/doctor-transactions-r58.mjs

@@ -1,10 +1,37 @@
 import {lstat,opendir,readFile} from 'node:fs/promises';
 import path from 'node:path';
-import {createHash} from 'node:crypto';
+import {createHash,createPublicKey} from 'node:crypto';
 import {resolveStateRoot} from './state-root.mjs';
+import {verifySlotUpdateEnvelope} from './runtime-update.mjs';
 
-export async function inspectDoctorTransactions(explicitRoot,{maxEntries=256}={}){
- if(!Number.isSafeInteger(maxEntries)||maxEntries<1||maxEntries>256)throw new Error('doctor transaction budget invalid');
+const UPDATE_RECEIPT='deadbyte.r27-slot-update-receipt.v1';
+const FAILURE_RECEIPT='deadbyte.r27-slot-update-failure.v1';
+const ROLLBACK_RECEIPT='deadbyte.r31-slot-rollback-receipt.v1';
+const ROLLBACK_FAILURE_RECEIPT='deadbyte.r31-slot-rollback-failure.v1';
+
+async function readReceipt(file){
+ const info=await lstat(file);
+ if(!info.isFile()||info.isSymbolicLink()||info.size>1048576)throw new Error('unsafe transaction receipt');
+ const bytes=await readFile(file);
+ if(bytes.length>1048576)throw new Error('transaction receipt budget');
+ return JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));
+}
+
+function receiptSubjectMatches(state,envelope,kind){
+ const body=envelope?.body;
+ if(state.schema==='deadbyte.r27-slot-update-state.v1'){
+  if(kind==='success')return body?.schema===UPDATE_RECEIPT&&body?.update_id===state.update_id&&body?.rollback_performed===false;
+  return body?.schema===FAILURE_RECEIPT&&body?.update_id===state.update_id;
+ }
+ if(state.schema==='deadbyte.r31-slot-rollback-state.v1'){
+  if(kind==='success')return body?.schema===ROLLBACK_RECEIPT&&body?.rollback_id===state.rollback_id&&body?.rollback_performed===true;
+  return body?.schema===ROLLBACK_FAILURE_RECEIPT&&body?.rollback_id===state.rollback_id;
+ }
+ return false;
+}
+
+export async function inspectDoctorTransactions(explicitRoot,{maxEntries=1024}={}){
+ if(!Number.isSafeInteger(maxEntries)||maxEntries<1||maxEntries>1024)throw new Error('doctor transaction budget invalid');
  const state=resolveStateRoot(explicitRoot),root=path.join(state,'evidence','updates'),findings=[];
  const next='Retain transaction evidence; inspect the exact signed receipt/handoff and current pointer before any supported recovery. Doctor never launches recovery.';
  const add=(level,what,evidence)=>findings.push({id:'transaction_residue',level,what,evidence,next_action:level==='PASS'?null:next});
@@ -17,24 +44,68 @@ export async function inspectDoctorTransactions(explicitRoot,{maxEntries=256}={}
   else add('FAIL','Update evidence directory cannot be safely inspected.',{error_code:error?.code??'VALIDATION_FAILED'});
   return {status:findings[0].level,findings};
  }
- let entries=0,checked=0,terminal=0;
+ let publicKey=null;
+ const loadPublicKey=async()=>{
+  if(publicKey)return publicKey;
+  const keyFile=path.join(state,'trust','ed25519-public.pem');
+  const info=await lstat(keyFile);
+  if(!info.isFile()||info.isSymbolicLink()||info.size>65536)throw new Error('unsafe transaction trust key');
+  publicKey=createPublicKey(await readFile(keyFile));
+  if(publicKey.asymmetricKeyType!=='ed25519')throw new Error('transaction trust key must be Ed25519');
+  return publicKey;
+ };
+ let entries=0,checked=0,terminal=0,verifiedTerminalReceipts=0,verifiedSuccessReceipts=0,verifiedFailureReceipts=0,unresolved=0,inventoryComplete=true;
  try{
   for await(const entry of directory){
-   if(++entries>maxEntries){add('WARN','Transaction inventory budget reached; unobserved entries remain.',{max_entries:maxEntries,states_checked:checked,inventory_complete:false});break;}
+   if(++entries>maxEntries){inventoryComplete=false;add('WARN','Transaction inventory budget reached; unobserved entries remain.',{max_entries:maxEntries,states_checked:checked,inventory_complete:false});break;}
    if(entry.isSymbolicLink()){add('FAIL','Transaction evidence contains a link; it was not followed.',{entry_name_sha256:createHash('sha256').update(entry.name).digest('hex')});continue;}
    if(!entry.isDirectory())continue;
-   const file=path.join(root,entry.name,'state.json');let bytes;
+   const dir=path.join(root,entry.name),file=path.join(dir,'state.json');let bytes;
    try{
     const info=await lstat(file);if(!info.isFile()||info.isSymbolicLink()||info.size>1048576)throw new Error('unsafe transaction state');
     bytes=await readFile(file);if(bytes.length>1048576)throw new Error('transaction state budget');
     const body=JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));checked++;
     const digest=createHash('sha256').update(bytes).digest('hex');
     if(!['deadbyte.r27-slot-update-state.v1','deadbyte.r31-slot-rollback-state.v1'].includes(body?.schema)||typeof body.phase!=='string'||!/^[a-z_]{1,64}$/.test(body.phase)){add('FAIL','Transaction state schema or phase is invalid.',{state_sha256:digest,check:'transaction_schema'});continue;}
-    if(['completed','superseded','failed_receipted'].includes(body.phase)){terminal++;continue;}
+    const receiptPath=path.join(dir,'receipt.json'),failurePath=path.join(dir,'failure-receipt.json');
+    let receiptExists=false,failureExists=false;
+    try{const st=await lstat(receiptPath);receiptExists=st.isFile()&&!st.isSymbolicLink();}catch(error){if(error?.code!=='ENOENT')throw error;}
+    try{const st=await lstat(failurePath);failureExists=st.isFile()&&!st.isSymbolicLink();}catch(error){if(error?.code!=='ENOENT')throw error;}
+    if(receiptExists&&failureExists){add('FAIL','Transaction contains conflicting terminal receipts.',{state_sha256:digest,check:'terminal_receipt_conflict'});continue;}
+    const terminalPath=receiptExists?receiptPath:failureExists?failurePath:null;
+    if(terminalPath){
+      const kind=receiptExists?'success':'failure';
+      const envelope=await readReceipt(terminalPath);
+      const key=await loadPublicKey();
+      if(!verifySlotUpdateEnvelope(envelope,key)||!receiptSubjectMatches(body,envelope,kind)){
+        add('FAIL','Transaction terminal receipt is invalid or not subject-bound to its journal.',{state_sha256:digest,check:'terminal_receipt_verification',receipt_kind:kind});
+        continue;
+      }
+      terminal++;verifiedTerminalReceipts++;
+      if(kind==='success')verifiedSuccessReceipts++;else verifiedFailureReceipts++;
+      continue;
+    }
+
+    if(body.phase==='superseded'){terminal++;continue;}
+    if(body.phase==='failed_receipted'){
+      add('FAIL','Transaction journal claims a signed failure receipt but the receipt is missing.',{state_sha256:digest,check:'missing_failure_receipt',recorded_phase:body.phase});
+      continue;
+    }
+    unresolved++;
     add('WARN','Nonterminal or unresolved transaction record remains; liveness/outcome is not inferred from its age or PID.',{state_sha256:digest,schema:body.schema,recorded_phase:body.phase});
    }catch(error){if(error?.code==='ENOENT')continue;add('FAIL','Transaction state cannot be safely parsed or inspected.',{error_code:error?.code??'VALIDATION_FAILED'});}
   }
  }catch(error){add('FAIL','Transaction inventory observation failed.',{error_code:error?.code??'OBSERVATION_FAILED'});}
- add('PASS','Recorded terminal transaction phases counted; signatures and desired outcomes are not established by this inventory.',{states_checked:checked,recorded_terminal_states:terminal,receipt_verification_performed:false});
+ add('PASS','Recorded terminal transaction outcomes counted; signed receipts are verified when they reconcile stale journal phases.',{
+  states_checked:checked,
+  recorded_terminal_states:terminal,
+  verified_terminal_receipts:verifiedTerminalReceipts,
+  verified_success_receipts:verifiedSuccessReceipts,
+  verified_failure_receipts:verifiedFailureReceipts,
+  unresolved_transactions:unresolved,
+  inventory_complete:inventoryComplete,
+  max_entries:maxEntries,
+  receipt_verification_performed:true
+ });
  return {status:findings.some(f=>f.level==='FAIL')?'FAIL':findings.some(f=>f.level==='WARN')?'WARN':'PASS',findings};
 }

package/src/remote-live-log.mjs

@@ -275,6 +275,8 @@ function toolFilterMatch(pattern,tool){
 export function createLiveTimelineFilter(expression=''){
   const spec=parseFilterExpression(expression);
   const pending=new Map();
+  const MAX_FILTER_IDENTITIES=4096;
+  let evicted=0;
   const baseMatch=meta=>(!spec.tool||toolFilterMatch(spec.tool,meta.tool))&&(!spec.category||spec.category===meta.category)&&(!spec.trace||spec.trace===meta.trace_id);
   return Object.freeze({
     accept(event){
@@ -284,6 +286,8 @@ export function createLiveTimelineFilter(expression=''){
       if(event.event_type==='tool.request'){
         const args=event.args??{};const tool=displayToolName(rawTool,args);const trace=traceIdentity(event,args);
         const meta={tool,category:categoryForTool(tool),trace_id:trace.trace_id};
+        if(pending.has(requestId))pending.delete(requestId);
+        if(pending.size>=MAX_FILTER_IDENTITIES){pending.delete(pending.keys().next().value);evicted++;}
         pending.set(requestId,meta);
         return spec.status?false:baseMatch(meta);
       }
@@ -294,7 +298,8 @@ export function createLiveTimelineFilter(expression=''){
       }
       return false;
     },
-    spec
+    spec,
+    retention(){return Object.freeze({pending:pending.size,evicted});}
   });
 }
 export function createLiveTimelineWriter({stream=process.stdout,displayMode='unicode',rewrite=true}={}){
@@ -330,10 +335,12 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
   if(!Number.isInteger(slowCallMs)||slowCallMs<100||slowCallMs>600000) throw new Error('live timeline slowCallMs invalid');
   const pending=new Map();
   const completed=new Set();
+  const MAX_PRESENTATION_IDENTITIES=4096;
   const toolCounts=new Map();
   const durationSamples=[];
   let resultCount=0,okCount=0,errorCount=0,unknownCount=0,mutationCount=0,totalDurationMs=0,slowest=null,burst=null,foldedHeartbeatLines=0,peakInFlight=0;
   let lastCapability=null,suppressedCapability=0,suppressedCapabilityReported=false;
+  let lastSourceSequence=0,pendingOverflow=0;
 
   function eventPrefix(event,sequence,{displayTool=null,icon=null}={}){
     const seq=Number.isSafeInteger(sequence)&&sequence>0?'#'+sequence+'  ':'';
@@ -362,10 +369,12 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
       error?(displayMode==='ascii'?'ERR':'✗'):
       ['write','edit','run'].includes(category)?(displayMode==='ascii'?'SUCCEEDED':'✅ SUCCEEDED'):
       (displayMode==='ascii'?'OK':'✓');
+    const rawStatus=safeAtom(event.outcome?.status);
+    const statusDetail=rawStatus&&!['ok','error'].includes(rawStatus)?'  status='+rawStatus:'';
     const prefixIcon=unknown?(displayMode==='ascii'?'WARN':'⚠️'):null;
     const evidence=receipt?'  '+(displayMode==='ascii'?'RECEIPT':'🧾 receipt')+(displayMode==='ascii'?'=':'=')+receipt:'';
     const reasonSep=displayMode==='ascii'?' - ':' — ';
-    return remoteDisplayText(eventPrefix(event,sequence,{displayTool,icon:prefixIcon})+traceSuffix(span?.trace_meta)+(summary?'  '+summary:'')+(duration?'  '+duration:'')+slow+'  '+marker+evidence+(reason?reasonSep+reason:''),displayMode);
+    return remoteDisplayText(eventPrefix(event,sequence,{displayTool,icon:prefixIcon})+traceSuffix(span?.trace_meta)+(summary?'  '+summary:'')+(duration?'  '+duration:'')+slow+'  '+marker+statusDetail+evidence+(reason?reasonSep+reason:''),displayMode);
   }
   function burstLine(value){
     if(!value) return null;
@@ -386,7 +395,8 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
   function addStats(event,span){
     resultCount++;
     const displayTool=span?.display_tool||event.tool;
-    toolCounts.set(displayTool,(toolCounts.get(displayTool)??0)+1);
+    const countKey=toolCounts.has(displayTool)||toolCounts.size<256?displayTool:'[other]';
+    toolCounts.set(countKey,(toolCounts.get(countKey)??0)+1);
     const outcome=outcomeClass(event);
     if(outcome==='unknown') unknownCount++;else if(outcome==='error') errorCount++;else okCount++;
     if(['write','edit','run'].includes(categoryForTool(displayTool))) mutationCount++;
@@ -397,8 +407,12 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
       if(!slowest||duration>slowest.duration_ms) slowest={tool:displayTool,duration_ms:duration};
     }
   }
-  function observe(event,{sequence=null}={}){
+  function observe(event,{sequence=null,sourceSequence=null}={}){
     if(!event||typeof event!=='object'||Array.isArray(event)) return null;
+    if(Number.isSafeInteger(sourceSequence)&&sourceSequence>0){
+      if(sourceSequence<=lastSourceSequence)return null;
+      lastSourceSequence=sourceSequence;
+    }
     const requestId=typeof event.request_id==='string'&&event.request_id?event.request_id:null;
     const tool=typeof event.tool==='string'&&event.tool?event.tool:null;
     if(event.event_type==='tool.request'&&requestId&&tool){
@@ -407,10 +421,17 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
       const displayTool=displayToolName(tool,args);
       const summary=summarizeLiveToolArgs(displayTool,args,{rootPaths});
       const traceMeta=traceIdentity(event,args);
+      if(pending.size>=MAX_PRESENTATION_IDENTITIES){
+        pendingOverflow++;
+        return pendingOverflow===1?remoteDisplayText('LIVELOG pending span cap reached; full audit remains on disk',displayMode):null;
+      }
       pending.set(requestId,{request_id:requestId,tool,display_tool:displayTool,summary,trace_meta:traceMeta,started_at_ms:clock()});
       peakInFlight=Math.max(peakInFlight,pending.size);
       if(verbose) return formatRemoteToolCall({...event,tool:displayTool},{clock,displayMode})+traceSuffix(traceMeta);
-      if(visibleStart(displayTool)) return eventPrefix(event,sequence,{displayTool})+traceSuffix(traceMeta)+(summary?'  '+summary:'')+'  …';
+      if(visibleStart(displayTool)){
+        const startMarker=displayMode==='ascii'?'START':'▶ START';
+        return remoteDisplayText(eventPrefix(event,sequence,{displayTool})+traceSuffix(traceMeta)+'  '+startMarker+(summary?'  '+summary:''),displayMode);
+      }
       return null;
     }
     if(event.event_type==='tool.result'&&requestId&&tool){
@@ -418,6 +439,7 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
       const span=pending.get(requestId)??null;
       pending.delete(requestId);
       completed.add(requestId);
+      if(completed.size>MAX_PRESENTATION_IDENTITIES)completed.delete(completed.values().next().value);
       addStats(event,span);
       const error=event.outcome?.is_error===true;
       const nowMs=eventMs(event,clock);
@@ -487,6 +509,7 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
   }
   return Object.freeze({
     observe,
+    retention(){return Object.freeze({pending:pending.size,completed:completed.size,pending_overflow:pendingOverflow,last_source_sequence:lastSourceSequence});},
     pending(){return [...pending.values()].map(({request_id,tool})=>({request_id,tool}));},
     reconcileInterrupted,
     summary

package/src/runtime-update.mjs

@@ -26,6 +26,7 @@ const UPDATE_SCHEMA='deadbyte.r27-slot-update-receipt.v1';
 const HANDOFF_SCHEMA='deadbyte.r27-slot-update-handoff.v1';
 const FAILURE_SCHEMA='deadbyte.r27-slot-update-failure.v1';
 const ROLLBACK_SCHEMA='deadbyte.r31-slot-rollback-receipt.v1';
+const ROLLBACK_FAILURE_SCHEMA='deadbyte.r31-slot-rollback-failure.v1';
 const DEFAULT_STATE_ROOT=undefined;
 const TOP_LAUNCHER=path.join(os.homedir(),'Downloads','DEADBYTE-MCP.cmd');
 const RUNTIME_STABILITY_MS=12000;
@@ -394,6 +395,18 @@ export async function prepareBridgeSpec(config,bootstrap){
   return next;
 }
 
+export async function prepareReleaseBridgeSpec(config,bootstrap,releaseRoot){
+  if(!bootstrap) return structuredClone(config);
+  if(typeof releaseRoot!=='string'||!path.isAbsolute(releaseRoot))throw new Error('immutable release root required for Bridge binding');
+  // Verify the requested development input, then bind runtime paths only to
+  // the manifest-verified immutable slot produced from that same candidate.
+  const verifiedSource=await prepareBridgeSpec(config,bootstrap);
+  return prepareBridgeSpec(verifiedSource,{
+    root:path.join(path.resolve(releaseRoot),'bridge'),
+    scriptSha256:verifiedSource.Bridge.ScriptSha256
+  });
+}
+
 export async function prepareAutonomousSupervisorSpec(config,{releaseRoot,enable=false}={}){
   const next=structuredClone(config);
   if(!enable) return next;
@@ -1682,7 +1695,7 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
       if(!control.desktopPolicy) throw new Error('DesktopRuntimeEnabled requires pinned desktop policy bootstrap or existing policy');
       control.config.DesktopRuntimeEnabled=true;
     }
-    control.config=await prepareBridgeSpec(control.config,bridgeBootstrap);
+    control.config=await prepareReleaseBridgeSpec(control.config,bridgeBootstrap,slot.release_root);
     control.config=await prepareNamedTunnelCloudSpec(control.config,{releaseRoot:slot.release_root,bootstrap:cloudTransport});
     control.config=await prepareAutonomousSupervisorSpec(control.config,{releaseRoot:slot.release_root,enable:enableAutonomousSupervisor});
     authorityPreparation=await prepareAuthorityPolicies({hostPolicy:control.hostPolicy,codingPolicy:control.codingPolicy},{commandPins:hostCommandPins});
@@ -1750,7 +1763,7 @@ export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_S
   const currentCtx=slotContext(state,pointerInfo.pointer),currentRuntime=await captureRuntime(currentCtx);
   const revoked=await revokeAuthority(currentCtx,currentRuntime.status);
   const rollbackId=`r31-rollback-${activationEnvelope.receipt_sha256.slice(0,16)}-${Date.now().toString(36)}-${randomBytes(4).toString('hex')}`;
-  const evidenceDir=path.join(state,'evidence','updates',rollbackId),statePath=path.join(evidenceDir,'state.json'),receiptPath=path.join(evidenceDir,'receipt.json');
+  const evidenceDir=path.join(state,'evidence','updates',rollbackId),statePath=path.join(evidenceDir,'state.json'),receiptPath=path.join(evidenceDir,'receipt.json'),failurePath=path.join(evidenceDir,'failure-receipt.json');
   await mkdir(evidenceDir,{recursive:true});
   const journal={schema:'deadbyte.r31-slot-rollback-state.v1',rollback_id:rollbackId,activation_receipt:path.resolve(receiptFile),
     activation_receipt_sha256:activationEnvelope.receipt_sha256,handoff_path:handoffPath,
@@ -1795,8 +1808,19 @@ export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_S
       }
       try { await startAndVerify(currentCtx,currentRuntime); recovery.successor_runtime_restarted=true; } catch(recoveryError){ recovery.errors.push(`restart-successor:${recoveryError.message}`); }
     }
-    await writeState(statePath,journal,'failed',{error:{name:error?.name??'Error',message:String(error?.message??error)},recovery}).catch(()=>{});
-    const wrapped=new Error(`R31 slot rollback failed: ${error?.message??error}`); wrapped.cause=error; wrapped.statePath=statePath; throw wrapped;
+    const failure={schema:ROLLBACK_FAILURE_SCHEMA,rollback_id:rollbackId,activation_receipt_sha256:activationEnvelope.receipt_sha256,
+      failed_at_utc:new Date().toISOString(),phase:journal.phase??'unknown',from_pointer:publicPointer(activePointer),to_pointer:publicPointer(priorPointer),
+      error:{name:error?.name??'Error',message:String(error?.message??error)},recovery};
+    await writeState(statePath,journal,'failed',{error:failure.error,recovery}).catch(()=>{});
+    let failureReceipt=null;
+    try{
+      failureReceipt=await writeEnvelope(failurePath,failure,key);
+      await writeState(statePath,journal,'failed_receipted',{failure_receipt_path:failurePath,failure_receipt_sha256:failureReceipt.receipt_sha256});
+    }catch(receiptError){
+      recovery.errors.push('failure-receipt:'+receiptError.message);
+      await writeState(statePath,journal,'failed_unreceipted',{recovery,failure_receipt_error:String(receiptError?.message??receiptError)}).catch(()=>{});
+    }
+    const wrapped=new Error(`R31 slot rollback failed: ${error?.message??error}`); wrapped.cause=error; wrapped.statePath=statePath; wrapped.failureReceiptPath=failureReceipt?failurePath:null; throw wrapped;
   }
 }
 

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.37';
+export const DEADBYTE_VERSION = '0.15.39';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';