deadbyte-mcp 0.15.37 → 0.15.39

package/test/bridge-runtime-r59.test.mjs

@@ -12,21 +12,21 @@ const limits={
 
 test('R59 bridge governor removes cancelled queued work and drains without replay',async()=>{
   const governor=createBridgeGovernor({limits});
-  const first=await governor.acquire('machine_status');
+  const first=await governor.acquire('coding_file_read');
   const abort=new AbortController();
-  const queued=governor.acquire('machine_ping',{signal:abort.signal});
+  const queued=governor.acquire('coding_file_read',{signal:abort.signal});
   abort.abort(new Error('caller disconnected'));
   await assert.rejects(queued,/caller disconnected|aborted/);
   assert.equal(governor.snapshot().normal.queued,0);
   assert.equal(governor.snapshot().normal.cancelled,1);
-  const queuedDuringRecovery=governor.acquire('machine_ping');
+  const queuedDuringRecovery=governor.acquire('coding_file_read');
   assert.equal(governor.reconcile('core generation changed'),1);
   await assert.rejects(queuedDuringRecovery,/core generation changed/);
   first.release();
-  const after=await governor.acquire('machine_status');
+  const after=await governor.acquire('coding_file_read');
   after.release();
   const drain=governor.close('bridge reconciling');
-  await assert.rejects(governor.acquire('machine_status'),/closed/);
+  await assert.rejects(governor.acquire('coding_file_read'),/closed/);
   await drain;
   assert.equal(governor.snapshot().normal.active,0);
 });

package/test/commander-schema-differential-r48.test.mjs

@@ -5,7 +5,7 @@ import {readFile} from 'node:fs/promises';
 import {createCommanderWireAdapter} from '../src/commander-wire-adapter-r47.mjs';
 import {registerCommanderExtendedBridge} from '../src/commander-extended-bridge-r47.mjs';
 
-const referencePath='D:\\Projects\\desktop-commander-stage-20260922\\desktop-commander\\dist\\tools\\schemas.js';
+const referencePath='D:\\Projects\\deadbyte-mcp\\references\\desktop-commander\\dist\\tools\\schemas.js';
 const expectedHash='f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140';
 async function referenceSchemas(){
   let source=await readFile(referencePath,'utf8');

package/test/r58-doctor-transactions.test.mjs

@@ -10,12 +10,12 @@ test('R58 bounded transaction inventory flags residue without recovering or over
  assert.equal((await inspectDoctorTransactions(root)).status,'PASS');assert.deepEqual(await readdir(root),[]);
  const transactions=path.join(root,'evidence','updates');await mkdir(transactions,{recursive:true});
  const write=async(name,body)=>{const dir=path.join(transactions,name);await mkdir(dir);const file=path.join(dir,'state.json'),bytes=JSON.stringify(body);await writeFile(file,bytes);return {file,bytes};};
- const done=await write('done',{schema:'deadbyte.r27-slot-update-state.v1',phase:'completed'});
+ const done=await write('done',{schema:'deadbyte.r27-slot-update-state.v1',phase:'superseded'});
  assert.equal((await inspectDoctorTransactions(root)).status,'PASS');
  const pending=await write('pending',{schema:'deadbyte.r31-slot-rollback-state.v1',phase:'prior_pointer_restored',supervisor_pid:process.pid});
  const result=await inspectDoctorTransactions(root);assert.equal(result.status,'WARN');assert.ok(result.findings.some(f=>f.evidence.recorded_phase==='prior_pointer_restored'));
  for(const item of [done,pending])assert.equal(await readFile(item.file,'utf8'),item.bytes);
  const bounded=await inspectDoctorTransactions(root,{maxEntries:1});assert.equal(bounded.status,'WARN');assert.ok(bounded.findings.some(f=>f.evidence.inventory_complete===false));
  const corrupt=await write('corrupt',{schema:'INVALID',phase:'completed'});assert.equal((await inspectDoctorTransactions(root)).status,'FAIL');assert.equal(await readFile(corrupt.file,'utf8'),corrupt.bytes);
- await assert.rejects(inspectDoctorTransactions(root,{maxEntries:257}),/budget invalid/);
+ await assert.rejects(inspectDoctorTransactions(root,{maxEntries:1025}),/budget invalid/);
 });

package/test/r60-release-contract.test.mjs

@@ -4,6 +4,7 @@ import {readFile} from 'node:fs/promises';
 
 const read=rel=>readFile(new URL('../'+rel,import.meta.url),'utf8');
 const json=rel=>read(rel).then(raw=>JSON.parse(raw.replace(/^\uFEFF/,'')));
+const currentPackage=await json('package.json');
 
 const PARENT=Object.freeze({
   version:'0.15.36',
@@ -12,7 +13,7 @@ const PARENT=Object.freeze({
   generation_manifest_sha256:'6134f9f26b680e13ed545da4ab5f3020f411ea2569062fb9c154c8a7e036c9dc'
 });
 
-test('R60 identity is coherent and binds the exact production-accepted 0.15.36 predecessor',async()=>{
+test('R60 identity is coherent and binds the exact production-accepted 0.15.36 predecessor',{skip:currentPackage.version!=='0.15.37'},async()=>{
   const [pkg,lock,release,prov,matrix,sbom,version,bridgePkg,contract]=await Promise.all([
     json('package.json'),json('package-lock.json'),json('RELEASE.json'),json('PROVENANCE.json'),
     json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs'),json('bridge/package.json'),
@@ -46,7 +47,7 @@ test('R60 identity is coherent and binds the exact production-accepted 0.15.36 p
   assert.match(contract,/0\.15\.37/);
 });
 
-test('R60 release contract exposes the proven remote truth semantics without widening dependencies',async()=>{
+test('R60 release contract exposes the proven remote truth semantics without widening dependencies',{skip:currentPackage.version!=='0.15.37'},async()=>{
   const [pkg,release,matrix]=await Promise.all([json('package.json'),json('RELEASE.json'),json('TEST-MATRIX.json')]);
   assert.equal(Object.keys(pkg.dependencies??{}).length,4);
   assert.equal(release.r60_remote_hardening.authority_truth_coherence,true);
@@ -69,7 +70,7 @@ test('R60 release contract exposes the proven remote truth semantics without wid
   assert.equal(matrix.observed_pre_release_evidence.r60_package.status,'PASS_VERIFY_ONLY_PRE_FINAL_SEAL');
 });
 
-test('R60 package scripts bind the new focused, full-regression and Windows-gate entrypoints',async()=>{
+test('R60 package scripts bind the new focused, full-regression and Windows-gate entrypoints',{skip:currentPackage.version!=='0.15.37'},async()=>{
   const [pkg,gate]=await Promise.all([json('package.json'),read('scripts/gate-windows-r60-prepublish.ps1')]);
   assert.match(pkg.scripts['r60:focused:test'],/r60-authority-coherence\.test\.mjs/);
   assert.match(pkg.scripts['r60:focused:test'],/r60-remote-call-recovery\.test\.mjs/);

package/test/r61-control-lane.test.mjs

@@ -0,0 +1,154 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createBridgeGovernor,bridgeToolClass} from '../bridge/src/r40-governor.mjs';
+
+test('control MCP execution is admitted while unrelated bulk work saturates',async()=>{
+  const governor=createBridgeGovernor();
+  const bulk=[];
+  let control=null;
+  try{
+    for(let i=0;i<8;i++)bulk.push(await governor.acquire('coding_search'));
+    const abort=new AbortController();
+    const pending=governor.acquire('machine_ping',{signal:abort.signal});
+    const observed=await Promise.race([
+      pending.then(ticket=>({kind:'admitted',ticket})),
+      new Promise(resolve=>setTimeout(()=>resolve({kind:'blocked'}),25))
+    ]);
+    if(observed.kind==='admitted')control=observed.ticket;
+    else abort.abort(new Error('control blocked behind bulk'));
+    assert.equal(observed.kind,'admitted','control plane must not queue behind bulk');
+    assert.equal(governor.snapshot().control.active,1);
+  }finally{
+    control?.release();
+    for(const ticket of bulk)ticket.release();
+    await governor.close();
+  }
+});
+
+test('compact routes use argument operation and never promote bulk to control',()=>{
+  assert.equal(bridgeToolClass('machine_observe',{op:'machine_status'}),'control');
+  assert.equal(bridgeToolClass('machine_observe',{op:'search_page'}),'bulk');
+  assert.equal(bridgeToolClass('process_session',{op:'read'}),'bulk');
+  assert.equal(bridgeToolClass('desktop_control',{op:'action'}),'desktop_action');
+  assert.equal(bridgeToolClass('coding_file_write',{root_id:'scratch'}),'normal');
+});
+
+test('control queue saturates, cancels and drains without admitting cancelled work',async()=>{
+  const governor=createBridgeGovernor({limits:{control:{max_active:1,max_queue:1,queue_timeout_ms:100}}});
+  const first=await governor.acquire('machine_ping');
+  const abort=new AbortController();
+  const queued=governor.acquire('machine_status',{signal:abort.signal});
+  await assert.rejects(governor.acquire('machine_ping'),/queue full/);
+  assert.equal(governor.snapshot().control.queued,1);
+  abort.abort(new Error('client cancelled'));
+  await assert.rejects(queued,/client cancelled/);
+  assert.equal(governor.snapshot().control.queued,0);
+  const timed=governor.acquire('machine_status');
+  await assert.rejects(timed,/queue timeout/);
+  assert.equal(governor.snapshot().control.timed_out,1);
+  first.release();
+  const after=await governor.acquire('machine_status');
+  after.release();
+  await governor.close();
+  assert.equal(governor.snapshot().control.active,0);
+});
+test('mixed normal and bulk lanes share one bounded downstream budget while control retains a reserved slot',async()=>{
+  const governor=createBridgeGovernor();
+  const work=[];
+  let control=null;
+  let queuedTicket=null;
+  try{
+    for(let i=0;i<4;i++)work.push(await governor.acquire('coding_search'));
+    for(let i=0;i<4;i++)work.push(await governor.acquire('coding_file_read'));
+
+    const saturated=governor.snapshot();
+    assert.equal(saturated.shared.active,8);
+    assert.equal(saturated.shared.non_control_active,8);
+    assert.equal(saturated.shared.max_active,9);
+    assert.equal(saturated.shared.max_non_control_active,8);
+
+    const pendingWork=governor.acquire('coding_file_read');
+    const observedWork=await Promise.race([
+      pendingWork.then(ticket=>({kind:'admitted',ticket})),
+      new Promise(resolve=>setTimeout(()=>resolve({kind:'blocked'}),25))
+    ]);
+    assert.equal(observedWork.kind,'blocked','ninth non-control call must respect shared budget');
+
+    control=await governor.acquire('machine_ping');
+    assert.equal(governor.snapshot().shared.active,9,'control uses reserved downstream slot');
+    assert.equal(governor.snapshot().control.active,1);
+    control.release();
+    control=null;
+
+    const released=work.shift();
+    released.release();
+
+    queuedTicket=await pendingWork;
+    assert.equal(governor.snapshot().shared.non_control_active,8);
+  }finally{
+    control?.release();
+    queuedTicket?.release();
+    for(const ticket of work)ticket.release();
+    await governor.close();
+  }
+
+  const final=governor.snapshot();
+  assert.equal(final.shared.active,0);
+  assert.equal(final.shared.non_control_active,0);
+});
+test('oldest admissible waiter is not starved by control backlog',async()=>{
+  const governor=createBridgeGovernor({
+    shared:{max_active:3,max_non_control_active:2}
+  });
+  const held=[];
+  const resolved=[];
+  const normalAbort=new AbortController();
+  const controlAbort=new AbortController();
+  let normalPending=null;
+  let controlPending=null;
+
+  try{
+    held.push(await governor.acquire('coding_search'));
+    held.push(await governor.acquire('coding_search'));
+    held.push(await governor.acquire('machine_ping'));
+
+    normalPending=governor.acquire(
+      'coding_file_read',
+      {signal:normalAbort.signal}
+    ).then(ticket=>{
+      resolved.push(ticket);
+      return ticket;
+    });
+
+    controlPending=governor.acquire(
+      'machine_status',
+      {signal:controlAbort.signal}
+    ).then(ticket=>{
+      resolved.push(ticket);
+      return ticket;
+    });
+
+    const releasedBulk=held.shift();
+    releasedBulk.release();
+
+    await new Promise(resolve=>setImmediate(resolve));
+
+    assert.equal(
+      governor.snapshot().normal.active,
+      1,
+      'older non-control waiter must win the newly available admissible slot'
+    );
+  }finally{
+    normalAbort.abort(new Error('test cleanup'));
+    controlAbort.abort(new Error('test cleanup'));
+
+    await Promise.allSettled(
+      [normalPending,controlPending].filter(Boolean)
+    );
+
+    for(const ticket of resolved)ticket.release();
+    for(const ticket of held)ticket.release();
+
+    await governor.close();
+  }
+});

package/test/r61-live-timeline-bounds.test.mjs

@@ -0,0 +1,31 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createLiveTimelineTracker,createLiveTimelineFilter} from '../src/remote-live-log.mjs';
+
+test('long LIVELOG session retains bounded presentation identities and suppresses old audit replay',()=>{
+  const tracker=createLiveTimelineTracker({clock:()=>1000});
+  let sourceSequence=0;
+  for(let i=0;i<12000;i++){
+    const id=`bounded-${i}`;
+    tracker.observe({event_type:'tool.request',tool:'machine_status',request_id:id,args:{}},
+      {sourceSequence:++sourceSequence});
+    tracker.observe({event_type:'tool.result',tool:'machine_status',request_id:id,
+      outcome:{is_error:false,duration_ms:1}},{sourceSequence:++sourceSequence});
+  }
+  const stats=tracker.retention();
+  assert.ok(stats.completed<=4096,JSON.stringify(stats));
+  assert.equal(stats.pending,0);
+  const replay=tracker.observe({event_type:'tool.result',tool:'machine_status',request_id:'bounded-0',
+    outcome:{is_error:false,duration_ms:1}},{sourceSequence:2});
+  assert.equal(replay,null,'old source sequence cannot reappear as a duplicate terminal line');
+  assert.match(tracker.summary(),/12000 calls \| 12000 ok/);
+});
+
+test('filtered long session retains bounded request presentation state',()=>{
+  const filter=createLiveTimelineFilter('status=error,trace=goal-r61');
+  for(let i=0;i<12000;i++)filter.accept({event_type:'tool.request',tool:'coding_file_write',request_id:`pending-${i}`,
+    args:{goal_id:'goal-r61',root_id:'scratch',path:'x.txt'}});
+  assert.ok(filter.retention().pending<=4096);
+  const latest=filter.accept({event_type:'tool.result',tool:'coding_file_write',request_id:'pending-11999',outcome:{is_error:true}});
+  assert.equal(latest,true);
+});

package/test/r61-npm-artifact-identity.test.mjs

@@ -0,0 +1,17 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {verifyPublishedTarballIdentity} from '../scripts/npm-artifact-identity-r61.mjs';
+
+const bytes=Buffer.from('deadbyte-r61-exact-tarball-fixture');
+const sha=(name,value)=>createHash(name).update(value).digest(name==='sha512'?'base64':'hex');
+const published={version:'0.15.38',dist:{integrity:'sha512-'+sha('sha512',bytes),shasum:sha('sha1',bytes),tarball:'https://registry.npmjs.org/deadbyte-mcp/-/deadbyte-mcp-0.15.38.tgz'}};
+
+test('R61 npm round trip requires exact registry bytes, metadata, version and latest tag',()=>{
+  const accepted=verifyPublishedTarballIdentity({version:'0.15.38',localBytes:bytes,registryBytes:Buffer.from(bytes),published,tags:{latest:'0.15.38'}});
+  assert.equal(accepted.tarball_sha256,sha('sha256',bytes));
+  assert.equal(accepted.npm_integrity,published.dist.integrity);
+  assert.throws(()=>verifyPublishedTarballIdentity({version:'0.15.38',localBytes:bytes,registryBytes:Buffer.from('different'),published,tags:{latest:'0.15.38'}}),/registry tarball bytes differ/);
+  assert.throws(()=>verifyPublishedTarballIdentity({version:'0.15.38',localBytes:bytes,registryBytes:bytes,published:{...published,dist:{...published.dist,integrity:'sha512-false'}},tags:{latest:'0.15.38'}}),/registry metadata/);
+  assert.throws(()=>verifyPublishedTarballIdentity({version:'0.15.38',localBytes:bytes,registryBytes:bytes,published,tags:{latest:'0.15.37'}}),/latest tag/);
+});

package/test/r61-release-bridge-binding.test.mjs

@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,readFile,rm,writeFile} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import os from 'node:os';
+import {prepareReleaseBridgeSpec} from '../src/runtime-update.mjs';
+
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+test('R61 update binds Bridge script and local dependencies to immutable release slot',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'r61-bridge-slot-'));
+  const source=path.join(root,'source','bridge'),slot=path.join(root,'releases','v0.15.38-test'),releaseBridge=path.join(slot,'bridge');
+  const script='import "./dep.mjs";\n';
+  try{
+    for(const bridge of [source,releaseBridge]){
+      await mkdir(path.join(bridge,'src'),{recursive:true});
+      await writeFile(path.join(bridge,'package.json'),'{"name":"deadbyte-chatgpt-bridge","version":"0.15.38"}\n');
+      await writeFile(path.join(bridge,'src','bridge.mjs'),script);
+      await writeFile(path.join(bridge,'src','dep.mjs'),'export const bound=true;\n');
+    }
+    const config={Bridge:{FilePath:process.execPath,FileSha256:sha(await readFile(process.execPath)),
+      Arguments:'src\\bridge.mjs',WorkingDirectory:source},Cloud:{}};
+    const result=await prepareReleaseBridgeSpec(config,{root:source,scriptSha256:sha(script)},slot);
+    assert.equal(result.Bridge.WorkingDirectory,releaseBridge);
+    assert.equal(result.Bridge.ScriptPath,path.join(releaseBridge,'src','bridge.mjs'));
+    assert.ok(result.Bridge.Dependencies.length>=1);
+    for(const dependency of result.Bridge.Dependencies)assert.ok(dependency.Path.startsWith(path.join(releaseBridge,'src')+path.sep));
+    await writeFile(path.join(releaseBridge,'src','bridge.mjs'),'changed\n');
+    await assert.rejects(prepareReleaseBridgeSpec(config,{root:source,scriptSha256:sha(script)},slot),/bridge script SHA-256 mismatch/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/r61-release-contract.test.mjs

@@ -0,0 +1,45 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+
+const read=rel=>readFile(new URL('../'+rel,import.meta.url),'utf8');
+const json=rel=>read(rel).then(raw=>JSON.parse(raw.replace(/^\uFEFF/,'')));
+const currentPackage=await json('package.json');
+const PARENT={
+  release_id:'v0.15.37-1cfecd7889419da7',
+  manifest_sha256:'1cfecd7889419da7800814e3a2a4ffa93d48dfdb0c344a5b7b91fe8d093230aa',
+  generation_manifest_sha256:'54842021c75f01bf7ecbd5b10ab8a482ecf107765b45c46f9d39b12bab65eac4'
+};
+
+test('R61 identity binds exact sealed 0.15.37 predecessor without a public surface expansion',{skip:currentPackage.version!=='0.15.38'},async()=>{
+  const [pkg,lock,bridge,release,provenance,matrix,sbom,version,gate]=await Promise.all([
+    json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
+    json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs'),
+    read('scripts/gate-windows-r61-prepublish.ps1')
+  ]);
+  assert.equal(pkg.version,'0.15.38');
+  assert.equal(lock.version,pkg.version);
+  assert.equal(lock.packages[''].version,pkg.version);
+  assert.equal(bridge.version,pkg.version);
+  assert.match(version,/DEADBYTE_VERSION = '0\.15\.38'/);
+  assert.equal(release.version,pkg.version);
+  assert.equal(release.train,'R61');
+  assert.equal(release.parent.version,'0.15.37');
+  for(const [key,value] of Object.entries(PARENT)){
+    assert.equal(release.parent[key],value);
+    assert.equal(release.runtime_predecessor[key],value);
+    assert.equal(provenance.runtime_predecessor[key],value);
+  }
+  assert.equal(provenance.version,pkg.version);
+  assert.equal(matrix.version,pkg.version);
+  assert.equal(matrix.train,'R61');
+  assert.equal(sbom.metadata.component.version,pkg.version);
+  assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r61:0.15.38');
+  assert.equal(Object.keys(pkg.dependencies??{}).length,4);
+  assert.equal(release.r61_multi_workload.public_surface_tool_count,43);
+  assert.equal(release.r61_multi_workload.new_authority_scopes,0);
+  assert.equal(release.r61_multi_workload.bridge_bound_to_immutable_slot,true);
+  assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r61-prepublish.ps1');
+  assert.match(gate,/v0\.15\.37-1cfecd7889419da7/);
+  assert.doesNotMatch(gate,/v0\.15\.36-090d9db3e0679c0d/);
+});

package/test/r62-doctor-receipt-semantics.test.mjs

@@ -0,0 +1,50 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdir,mkdtemp,writeFile} from 'node:fs/promises';
+import {generateKeyPairSync,createHash,sign} from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import {inspectDoctorTransactions} from '../src/doctor-transactions-r58.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+ ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
+const canonicalJson=value=>JSON.stringify(canonical(value));
+const domain=Buffer.from('DEADBYTE-R27-SLOT-UPDATE-V1\0');
+function envelope(body,keys){
+ const bodyBytes=Buffer.from(canonicalJson(body),'utf8');
+ const unsigned={body,body_sha256:sha(bodyBytes),attestation:{
+  algorithm:'ed25519',domain:'DEADBYTE-R27-SLOT-UPDATE-V1',
+  key_id:sha(keys.publicKey.export({type:'spki',format:'der'})),
+  signature_base64:sign(null,Buffer.concat([domain,bodyBytes]),keys.privateKey).toString('base64')
+ }};
+ return {...unsigned,receipt_sha256:sha(Buffer.from(canonicalJson(unsigned),'utf8'))};
+}
+
+test('R62 doctor rejects signed success receipts whose rollback semantics contradict their schema',async()=>{
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r62-doctor-receipt-semantics-'));
+ const trust=path.join(root,'trust'),updates=path.join(root,'evidence','updates');
+ await mkdir(trust,{recursive:true});await mkdir(updates,{recursive:true});
+ const keys=generateKeyPairSync('ed25519');
+ await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}));
+
+ const updateDir=path.join(updates,'bad-update-success');await mkdir(updateDir);
+ await writeFile(path.join(updateDir,'state.json'),JSON.stringify({
+  schema:'deadbyte.r27-slot-update-state.v1',update_id:'bad-update-success',phase:'completed'
+ }));
+ await writeFile(path.join(updateDir,'receipt.json'),JSON.stringify(envelope({
+  schema:'deadbyte.r27-slot-update-receipt.v1',update_id:'bad-update-success',rollback_performed:true
+ },keys)));
+
+ const rollbackDir=path.join(updates,'bad-rollback-success');await mkdir(rollbackDir);
+ await writeFile(path.join(rollbackDir,'state.json'),JSON.stringify({
+  schema:'deadbyte.r31-slot-rollback-state.v1',rollback_id:'bad-rollback-success',phase:'completed'
+ }));
+ await writeFile(path.join(rollbackDir,'receipt.json'),JSON.stringify(envelope({
+  schema:'deadbyte.r31-slot-rollback-receipt.v1',rollback_id:'bad-rollback-success',rollback_performed:false
+ },keys)));
+
+ const result=await inspectDoctorTransactions(root);
+ assert.equal(result.status,'FAIL');
+ assert.equal(result.findings.filter(f=>f.evidence?.check==='terminal_receipt_verification').length,2);
+});

package/test/r62-doctor-transactions-reconcile.test.mjs

@@ -0,0 +1,208 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdir,mkdtemp,writeFile,readFile} from 'node:fs/promises';
+import {generateKeyPairSync,createHash,sign} from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import {inspectDoctorTransactions} from '../src/doctor-transactions-r58.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+ ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
+const canonicalJson=value=>JSON.stringify(canonical(value));
+const domain=Buffer.from('DEADBYTE-R27-SLOT-UPDATE-V1\0');
+
+function envelope(body,keys){
+ const bodyBytes=Buffer.from(canonicalJson(body),'utf8');
+ const unsigned={
+  body,
+  body_sha256:sha(bodyBytes),
+  attestation:{
+   algorithm:'ed25519',
+   domain:'DEADBYTE-R27-SLOT-UPDATE-V1',
+   key_id:sha(keys.publicKey.export({type:'spki',format:'der'})),
+   signature_base64:sign(null,Buffer.concat([domain,bodyBytes]),keys.privateKey).toString('base64')
+  }
+ };
+ return {...unsigned,receipt_sha256:sha(Buffer.from(canonicalJson(unsigned),'utf8'))};
+}
+
+test('R62 doctor reconciles signed terminal receipts instead of warning on stale nonterminal journal phases',async()=>{
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r62-doctor-reconcile-'));
+ const trust=path.join(root,'trust');
+ const updates=path.join(root,'evidence','updates');
+ await mkdir(trust,{recursive:true});
+ await mkdir(updates,{recursive:true});
+ const keys=generateKeyPairSync('ed25519');
+ await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}));
+
+ const writeTransaction=async(name,state,receiptName,receiptBody)=>{
+  const dir=path.join(updates,name);
+  await mkdir(dir);
+  const statePath=path.join(dir,'state.json');
+  const stateBytes=JSON.stringify(state);
+  await writeFile(statePath,stateBytes);
+  await writeFile(path.join(dir,receiptName),JSON.stringify(envelope(receiptBody,keys)));
+  return {statePath,stateBytes};
+ };
+
+ const success=await writeTransaction(
+  'success',
+  {schema:'deadbyte.r27-slot-update-state.v1',update_id:'success',phase:'pointer_committed'},
+  'receipt.json',
+  {schema:'deadbyte.r27-slot-update-receipt.v1',update_id:'success',rollback_performed:false}
+ );
+ const failure=await writeTransaction(
+  'failure',
+  {schema:'deadbyte.r27-slot-update-state.v1',update_id:'failure',phase:'candidate_prepared'},
+  'failure-receipt.json',
+  {schema:'deadbyte.r27-slot-update-failure.v1',update_id:'failure',failed_at_utc:'2026-10-04T00:00:00.000Z'}
+ );
+
+ const result=await inspectDoctorTransactions(root);
+ assert.equal(result.status,'PASS');
+ assert.equal(result.findings.some(f=>f.level==='WARN'),false);
+ const summary=result.findings.find(f=>f.evidence?.receipt_verification_performed===true);
+ assert.ok(summary,'doctor must report signed receipt verification');
+ assert.equal(summary.evidence.verified_terminal_receipts,2);
+ assert.equal(summary.evidence.unresolved_transactions,0);
+ assert.equal(await readFile(success.statePath,'utf8'),success.stateBytes);
+ assert.equal(await readFile(failure.statePath,'utf8'),failure.stateBytes);
+});
+
+
+test('R62 doctor default transaction budget covers more than the legacy 256-entry ceiling while remaining bounded',async()=>{
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r62-doctor-budget-'));
+ const updates=path.join(root,'evidence','updates');
+ await mkdir(updates,{recursive:true});
+ for(let index=0;index<300;index++){
+  const dir=path.join(updates,`tx-${String(index).padStart(3,'0')}`);
+  await mkdir(dir);
+  await writeFile(path.join(dir,'state.json'),JSON.stringify({
+   schema:'deadbyte.r27-slot-update-state.v1',
+   update_id:`tx-${index}`,
+   phase:'superseded'
+  }));
+ }
+ const result=await inspectDoctorTransactions(root);
+ assert.equal(result.status,'PASS');
+ assert.equal(result.findings.some(f=>f.evidence?.inventory_complete===false),false);
+ const summary=result.findings.find(f=>f.evidence?.receipt_verification_performed===true);
+ assert.ok(summary);
+ assert.equal(summary.evidence.states_checked,300);
+ await assert.rejects(inspectDoctorTransactions(root,{maxEntries:1025}),/budget invalid/);
+});
+
+
+test('R62 doctor verifies signed receipts even when the journal already claims a terminal phase',async()=>{
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r62-doctor-terminal-proof-'));
+ const trust=path.join(root,'trust');
+ const updates=path.join(root,'evidence','updates');
+ await mkdir(trust,{recursive:true});
+ await mkdir(updates,{recursive:true});
+ const keys=generateKeyPairSync('ed25519');
+ await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}));
+
+ const provenDir=path.join(updates,'proven');
+ await mkdir(provenDir);
+ await writeFile(path.join(provenDir,'state.json'),JSON.stringify({
+  schema:'deadbyte.r27-slot-update-state.v1',
+  update_id:'proven',
+  phase:'completed'
+ }));
+ await writeFile(path.join(provenDir,'receipt.json'),JSON.stringify(envelope({
+  schema:'deadbyte.r27-slot-update-receipt.v1',
+  update_id:'proven',
+  rollback_performed:false
+ },keys)));
+
+ const proven=await inspectDoctorTransactions(root);
+ assert.equal(proven.status,'PASS');
+ const provenSummary=proven.findings.find(f=>f.evidence?.receipt_verification_performed===true);
+ assert.equal(provenSummary.evidence.verified_terminal_receipts,1);
+
+ const unprovenDir=path.join(updates,'unproven');
+ await mkdir(unprovenDir);
+ await writeFile(path.join(unprovenDir,'state.json'),JSON.stringify({
+  schema:'deadbyte.r27-slot-update-state.v1',
+  update_id:'unproven',
+  phase:'completed'
+ }));
+ const unproven=await inspectDoctorTransactions(root);
+ assert.equal(unproven.status,'WARN');
+ assert.ok(unproven.findings.some(f=>f.evidence?.recorded_phase==='completed'));
+});
+
+
+test('R62 doctor fails closed on tampered or missing claimed terminal receipts without mutating journals',async()=>{
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r62-doctor-adversarial-'));
+ const trust=path.join(root,'trust');
+ const updates=path.join(root,'evidence','updates');
+ await mkdir(trust,{recursive:true});
+ await mkdir(updates,{recursive:true});
+ const keys=generateKeyPairSync('ed25519');
+ await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}));
+
+ const tamperedDir=path.join(updates,'tampered');
+ await mkdir(tamperedDir);
+ const tamperedStatePath=path.join(tamperedDir,'state.json');
+ const tamperedState=JSON.stringify({
+  schema:'deadbyte.r27-slot-update-state.v1',
+  update_id:'tampered',
+  phase:'completed'
+ });
+ await writeFile(tamperedStatePath,tamperedState);
+ const good=envelope({
+  schema:'deadbyte.r27-slot-update-receipt.v1',
+  update_id:'tampered',
+  rollback_performed:false
+ },keys);
+ const bad={...good,attestation:{...good.attestation,signature_base64:Buffer.alloc(64).toString('base64')}};
+ await writeFile(path.join(tamperedDir,'receipt.json'),JSON.stringify(bad));
+
+ const missingDir=path.join(updates,'missing');
+ await mkdir(missingDir);
+ const missingStatePath=path.join(missingDir,'state.json');
+ const missingState=JSON.stringify({
+  schema:'deadbyte.r27-slot-update-state.v1',
+  update_id:'missing',
+  phase:'failed_receipted'
+ });
+ await writeFile(missingStatePath,missingState);
+
+ const result=await inspectDoctorTransactions(root);
+ assert.equal(result.status,'FAIL');
+ assert.ok(result.findings.some(f=>f.evidence?.check==='terminal_receipt_verification'));
+ assert.ok(result.findings.some(f=>f.evidence?.check==='missing_failure_receipt'));
+ assert.equal(await readFile(tamperedStatePath,'utf8'),tamperedState);
+ assert.equal(await readFile(missingStatePath,'utf8'),missingState);
+});
+
+
+test('R62 doctor reconciles a signed R31 rollback failure receipt by rollback_id',async()=>{
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r62-r31-failure-proof-'));
+ const trust=path.join(root,'trust');
+ const dir=path.join(root,'evidence','updates','rollback-failure');
+ await mkdir(trust,{recursive:true});
+ await mkdir(dir,{recursive:true});
+ const keys=generateKeyPairSync('ed25519');
+ await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}));
+ const rollbackId='r31-rollback-r62-fixture';
+ await writeFile(path.join(dir,'state.json'),JSON.stringify({
+  schema:'deadbyte.r31-slot-rollback-state.v1',
+  rollback_id:rollbackId,
+  phase:'failed'
+ }));
+ await writeFile(path.join(dir,'failure-receipt.json'),JSON.stringify(envelope({
+  schema:'deadbyte.r31-slot-rollback-failure.v1',
+  rollback_id:rollbackId,
+  failed_at_utc:'2026-10-04T00:00:00.000Z',
+  error:{name:'Error',message:'fixture'}
+ },keys)));
+ const result=await inspectDoctorTransactions(root);
+ assert.equal(result.status,'PASS');
+ const summary=result.findings.find(f=>f.evidence?.receipt_verification_performed===true);
+ assert.equal(summary.evidence.verified_terminal_receipts,1);
+ assert.equal(summary.evidence.verified_failure_receipts,1);
+ assert.equal(summary.evidence.unresolved_transactions,0);
+});