deadbyte-mcp 0.15.38 → 0.15.39

package/scripts/gate-windows-r62-prepublish.ps1

@@ -0,0 +1,45 @@
+param(
+  [ValidateSet('all','preflight','focused','full','manifest','doctor')]
+  [string]$Stage='all'
+)
+
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version 3.0
+$root=Split-Path $PSScriptRoot -Parent
+Set-Location -LiteralPath $root
+
+function Invoke-Npm([string]$Name,[string[]]$NpmArgs){
+  Write-Host "==== $Name ===="
+  & npm.cmd @NpmArgs
+  if($LASTEXITCODE -ne 0){ throw "R62 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+
+$stateRoot=if(-not [string]::IsNullOrWhiteSpace($env:DEADBYTE_STATE_ROOT)){
+  [IO.Path]::GetFullPath($env:DEADBYTE_STATE_ROOT)
+}else{ Join-Path $env:USERPROFILE '.deadbyte-mcp' }
+$pointer=Join-Path $stateRoot 'active-release.json'
+if(-not (Test-Path -LiteralPath $pointer -PathType Leaf)){ throw "R62 predecessor pointer missing: $pointer" }
+$active=Get-Content -LiteralPath $pointer -Raw | ConvertFrom-Json
+if($active.release_id -ne 'v0.15.38-917901b3fcb2a77f'){ throw "R62 predecessor release mismatch: $($active.release_id)" }
+if($active.manifest_sha256 -ne '917901b3fcb2a77f696fedc539bd97c567d9dc59345779906fc633d11ea4bcfb'){ throw 'R62 predecessor manifest mismatch' }
+if($active.generation_manifest_sha256 -ne '9d320a8af1ba8e9e6a23552f35263da2670c00af1355464820552d849d9033c6'){ throw 'R62 predecessor generation mismatch' }
+if($Stage -eq 'preflight'){Write-Host '==== R62 WINDOWS GATE: PASS preflight ====';return}
+
+if($Stage -eq 'all' -or $Stage -eq 'focused'){
+  Invoke-Npm 'r62-focused' @('run','r62:focused:test')
+  if($Stage -eq 'focused'){Write-Host '==== R62 WINDOWS GATE: PASS focused ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'full'){
+  Invoke-Npm 'full-regression' @('test')
+  if($Stage -eq 'full'){Write-Host '==== R62 WINDOWS GATE: PASS full ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'manifest'){
+  Invoke-Npm 'manifest-write' @('run','manifest:write')
+  Invoke-Npm 'manifest-verify' @('run','manifest:verify')
+  if($Stage -eq 'manifest'){Write-Host '==== R62 WINDOWS GATE: PASS manifest ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'doctor'){
+  Invoke-Npm 'doctor' @('run','doctor')
+  if($Stage -eq 'doctor'){Write-Host '==== R62 WINDOWS GATE: PASS doctor ====';return}
+}
+Write-Host '==== R62 PREPUBLISH WINDOWS GATE: PASS ===='

package/scripts/r62-focused.ps1

@@ -0,0 +1,9 @@
+$ErrorActionPreference='Stop'
+$root=Split-Path -Parent $PSScriptRoot
+Push-Location $root
+try {
+  & npm.cmd run r62:focused:test
+  if($LASTEXITCODE -ne 0){ exit $LASTEXITCODE }
+} finally {
+  Pop-Location
+}

package/scripts/r62-full.ps1

@@ -0,0 +1,9 @@
+$ErrorActionPreference='Stop'
+$root=Split-Path -Parent $PSScriptRoot
+Push-Location $root
+try {
+  & npm.cmd test
+  $code=$LASTEXITCODE
+  Write-Host ("R62_FULL_EXIT="+$code)
+  exit $code
+} finally { Pop-Location }

package/scripts/r62-live-transaction-audit.mjs

@@ -0,0 +1,17 @@
+import {inspectDoctorTransactions} from '../src/doctor-transactions-r58.mjs';
+
+const result=await inspectDoctorTransactions();
+const summary=result.findings.find(item=>item.evidence?.receipt_verification_performed===true)?.evidence??null;
+const unresolved=result.findings
+ .filter(item=>item.level==='WARN'&&item.evidence?.recorded_phase)
+ .map(item=>({schema:item.evidence.schema,phase:item.evidence.recorded_phase,state_sha256:item.evidence.state_sha256}));
+const phases={};
+for(const item of unresolved) phases[item.phase]=(phases[item.phase]??0)+1;
+console.log(JSON.stringify({
+ status:result.status,
+ summary,
+ unresolved_count:unresolved.length,
+ unresolved_phases:phases,
+ fail_count:result.findings.filter(item=>item.level==='FAIL').length,
+ inventory_warning:result.findings.some(item=>item.evidence?.inventory_complete===false)
+},null,2));

package/scripts/r62-unresolved-transaction-inspect.mjs

@@ -0,0 +1,54 @@
+import {opendir,lstat,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createHash} from 'node:crypto';
+
+const state=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const root=path.join(state,'evidence','updates');
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const terminal=new Set(['completed','superseded','failed_receipted']);
+const rows=[];
+for await(const entry of await opendir(root)){
+  if(!entry.isDirectory()||entry.isSymbolicLink()) continue;
+  const dir=path.join(root,entry.name),stateFile=path.join(dir,'state.json');
+  let stateBytes,body;
+  try{
+    const info=await lstat(stateFile);
+    if(!info.isFile()||info.isSymbolicLink()||info.size>1048576) continue;
+    stateBytes=await readFile(stateFile);
+    body=JSON.parse(stateBytes.toString('utf8').replace(/^\uFEFF/,''));
+  }catch{continue;}
+  if(!['deadbyte.r27-slot-update-state.v1','deadbyte.r31-slot-rollback-state.v1'].includes(body?.schema)) continue;
+  const has=async name=>{try{const st=await lstat(path.join(dir,name));return st.isFile()&&!st.isSymbolicLink();}catch{return false;}};
+  if(terminal.has(body.phase)||await has('receipt.json')||await has('failure-receipt.json')) continue;
+  const handoff=await has('handoff.json');
+  let handoffSummary=null;
+  if(handoff){
+    try{
+      const h=JSON.parse((await readFile(path.join(dir,'handoff.json'),'utf8')).replace(/^\uFEFF/,''));
+      handoffSummary={schema:h?.body?.schema??h?.schema??null,body:h?.body??h};
+    }catch(error){handoffSummary={parse_error:String(error?.message??error)};}
+  }
+  rows.push({
+    entry:entry.name,
+    entry_sha256:sha(Buffer.from(entry.name,'utf8')),
+    state_sha256:sha(stateBytes),
+    schema:body.schema,
+    phase:body.phase,
+    update_id:body.update_id??null,
+    rollback_id:body.rollback_id??null,
+    prior_pointer:body.prior_pointer??null,
+    new_pointer:body.new_pointer??null,
+    active_pointer:body.active_pointer??null,
+    old_runtime:body.old_runtime??null,
+    new_runtime:body.new_runtime??null,
+    error:body.error??null,
+    recovery:body.recovery??null,
+    has_handoff:handoff,
+    handoff:handoffSummary
+  });
+}
+rows.sort((a,b)=>a.entry.localeCompare(b.entry));
+let active=null;
+try{active=JSON.parse(await readFile(path.join(state,'active-release.json'),'utf8'));}catch{}
+console.log(JSON.stringify({state_root:state,active_pointer:active,unresolved_count:rows.length,rows},null,2));

package/src/doctor-transactions-r58.mjs

@@ -1,10 +1,37 @@
 import {lstat,opendir,readFile} from 'node:fs/promises';
 import path from 'node:path';
-import {createHash} from 'node:crypto';
+import {createHash,createPublicKey} from 'node:crypto';
 import {resolveStateRoot} from './state-root.mjs';
+import {verifySlotUpdateEnvelope} from './runtime-update.mjs';
 
-export async function inspectDoctorTransactions(explicitRoot,{maxEntries=256}={}){
- if(!Number.isSafeInteger(maxEntries)||maxEntries<1||maxEntries>256)throw new Error('doctor transaction budget invalid');
+const UPDATE_RECEIPT='deadbyte.r27-slot-update-receipt.v1';
+const FAILURE_RECEIPT='deadbyte.r27-slot-update-failure.v1';
+const ROLLBACK_RECEIPT='deadbyte.r31-slot-rollback-receipt.v1';
+const ROLLBACK_FAILURE_RECEIPT='deadbyte.r31-slot-rollback-failure.v1';
+
+async function readReceipt(file){
+ const info=await lstat(file);
+ if(!info.isFile()||info.isSymbolicLink()||info.size>1048576)throw new Error('unsafe transaction receipt');
+ const bytes=await readFile(file);
+ if(bytes.length>1048576)throw new Error('transaction receipt budget');
+ return JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));
+}
+
+function receiptSubjectMatches(state,envelope,kind){
+ const body=envelope?.body;
+ if(state.schema==='deadbyte.r27-slot-update-state.v1'){
+  if(kind==='success')return body?.schema===UPDATE_RECEIPT&&body?.update_id===state.update_id&&body?.rollback_performed===false;
+  return body?.schema===FAILURE_RECEIPT&&body?.update_id===state.update_id;
+ }
+ if(state.schema==='deadbyte.r31-slot-rollback-state.v1'){
+  if(kind==='success')return body?.schema===ROLLBACK_RECEIPT&&body?.rollback_id===state.rollback_id&&body?.rollback_performed===true;
+  return body?.schema===ROLLBACK_FAILURE_RECEIPT&&body?.rollback_id===state.rollback_id;
+ }
+ return false;
+}
+
+export async function inspectDoctorTransactions(explicitRoot,{maxEntries=1024}={}){
+ if(!Number.isSafeInteger(maxEntries)||maxEntries<1||maxEntries>1024)throw new Error('doctor transaction budget invalid');
  const state=resolveStateRoot(explicitRoot),root=path.join(state,'evidence','updates'),findings=[];
  const next='Retain transaction evidence; inspect the exact signed receipt/handoff and current pointer before any supported recovery. Doctor never launches recovery.';
  const add=(level,what,evidence)=>findings.push({id:'transaction_residue',level,what,evidence,next_action:level==='PASS'?null:next});
@@ -17,24 +44,68 @@ export async function inspectDoctorTransactions(explicitRoot,{maxEntries=256}={}
   else add('FAIL','Update evidence directory cannot be safely inspected.',{error_code:error?.code??'VALIDATION_FAILED'});
   return {status:findings[0].level,findings};
  }
- let entries=0,checked=0,terminal=0;
+ let publicKey=null;
+ const loadPublicKey=async()=>{
+  if(publicKey)return publicKey;
+  const keyFile=path.join(state,'trust','ed25519-public.pem');
+  const info=await lstat(keyFile);
+  if(!info.isFile()||info.isSymbolicLink()||info.size>65536)throw new Error('unsafe transaction trust key');
+  publicKey=createPublicKey(await readFile(keyFile));
+  if(publicKey.asymmetricKeyType!=='ed25519')throw new Error('transaction trust key must be Ed25519');
+  return publicKey;
+ };
+ let entries=0,checked=0,terminal=0,verifiedTerminalReceipts=0,verifiedSuccessReceipts=0,verifiedFailureReceipts=0,unresolved=0,inventoryComplete=true;
  try{
   for await(const entry of directory){
-   if(++entries>maxEntries){add('WARN','Transaction inventory budget reached; unobserved entries remain.',{max_entries:maxEntries,states_checked:checked,inventory_complete:false});break;}
+   if(++entries>maxEntries){inventoryComplete=false;add('WARN','Transaction inventory budget reached; unobserved entries remain.',{max_entries:maxEntries,states_checked:checked,inventory_complete:false});break;}
    if(entry.isSymbolicLink()){add('FAIL','Transaction evidence contains a link; it was not followed.',{entry_name_sha256:createHash('sha256').update(entry.name).digest('hex')});continue;}
    if(!entry.isDirectory())continue;
-   const file=path.join(root,entry.name,'state.json');let bytes;
+   const dir=path.join(root,entry.name),file=path.join(dir,'state.json');let bytes;
    try{
     const info=await lstat(file);if(!info.isFile()||info.isSymbolicLink()||info.size>1048576)throw new Error('unsafe transaction state');
     bytes=await readFile(file);if(bytes.length>1048576)throw new Error('transaction state budget');
     const body=JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));checked++;
     const digest=createHash('sha256').update(bytes).digest('hex');
     if(!['deadbyte.r27-slot-update-state.v1','deadbyte.r31-slot-rollback-state.v1'].includes(body?.schema)||typeof body.phase!=='string'||!/^[a-z_]{1,64}$/.test(body.phase)){add('FAIL','Transaction state schema or phase is invalid.',{state_sha256:digest,check:'transaction_schema'});continue;}
-    if(['completed','superseded','failed_receipted'].includes(body.phase)){terminal++;continue;}
+    const receiptPath=path.join(dir,'receipt.json'),failurePath=path.join(dir,'failure-receipt.json');
+    let receiptExists=false,failureExists=false;
+    try{const st=await lstat(receiptPath);receiptExists=st.isFile()&&!st.isSymbolicLink();}catch(error){if(error?.code!=='ENOENT')throw error;}
+    try{const st=await lstat(failurePath);failureExists=st.isFile()&&!st.isSymbolicLink();}catch(error){if(error?.code!=='ENOENT')throw error;}
+    if(receiptExists&&failureExists){add('FAIL','Transaction contains conflicting terminal receipts.',{state_sha256:digest,check:'terminal_receipt_conflict'});continue;}
+    const terminalPath=receiptExists?receiptPath:failureExists?failurePath:null;
+    if(terminalPath){
+      const kind=receiptExists?'success':'failure';
+      const envelope=await readReceipt(terminalPath);
+      const key=await loadPublicKey();
+      if(!verifySlotUpdateEnvelope(envelope,key)||!receiptSubjectMatches(body,envelope,kind)){
+        add('FAIL','Transaction terminal receipt is invalid or not subject-bound to its journal.',{state_sha256:digest,check:'terminal_receipt_verification',receipt_kind:kind});
+        continue;
+      }
+      terminal++;verifiedTerminalReceipts++;
+      if(kind==='success')verifiedSuccessReceipts++;else verifiedFailureReceipts++;
+      continue;
+    }
+
+    if(body.phase==='superseded'){terminal++;continue;}
+    if(body.phase==='failed_receipted'){
+      add('FAIL','Transaction journal claims a signed failure receipt but the receipt is missing.',{state_sha256:digest,check:'missing_failure_receipt',recorded_phase:body.phase});
+      continue;
+    }
+    unresolved++;
     add('WARN','Nonterminal or unresolved transaction record remains; liveness/outcome is not inferred from its age or PID.',{state_sha256:digest,schema:body.schema,recorded_phase:body.phase});
    }catch(error){if(error?.code==='ENOENT')continue;add('FAIL','Transaction state cannot be safely parsed or inspected.',{error_code:error?.code??'VALIDATION_FAILED'});}
   }
  }catch(error){add('FAIL','Transaction inventory observation failed.',{error_code:error?.code??'OBSERVATION_FAILED'});}
- add('PASS','Recorded terminal transaction phases counted; signatures and desired outcomes are not established by this inventory.',{states_checked:checked,recorded_terminal_states:terminal,receipt_verification_performed:false});
+ add('PASS','Recorded terminal transaction outcomes counted; signed receipts are verified when they reconcile stale journal phases.',{
+  states_checked:checked,
+  recorded_terminal_states:terminal,
+  verified_terminal_receipts:verifiedTerminalReceipts,
+  verified_success_receipts:verifiedSuccessReceipts,
+  verified_failure_receipts:verifiedFailureReceipts,
+  unresolved_transactions:unresolved,
+  inventory_complete:inventoryComplete,
+  max_entries:maxEntries,
+  receipt_verification_performed:true
+ });
  return {status:findings.some(f=>f.level==='FAIL')?'FAIL':findings.some(f=>f.level==='WARN')?'WARN':'PASS',findings};
 }

package/src/runtime-update.mjs

@@ -26,6 +26,7 @@ const UPDATE_SCHEMA='deadbyte.r27-slot-update-receipt.v1';
 const HANDOFF_SCHEMA='deadbyte.r27-slot-update-handoff.v1';
 const FAILURE_SCHEMA='deadbyte.r27-slot-update-failure.v1';
 const ROLLBACK_SCHEMA='deadbyte.r31-slot-rollback-receipt.v1';
+const ROLLBACK_FAILURE_SCHEMA='deadbyte.r31-slot-rollback-failure.v1';
 const DEFAULT_STATE_ROOT=undefined;
 const TOP_LAUNCHER=path.join(os.homedir(),'Downloads','DEADBYTE-MCP.cmd');
 const RUNTIME_STABILITY_MS=12000;
@@ -1762,7 +1763,7 @@ export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_S
   const currentCtx=slotContext(state,pointerInfo.pointer),currentRuntime=await captureRuntime(currentCtx);
   const revoked=await revokeAuthority(currentCtx,currentRuntime.status);
   const rollbackId=`r31-rollback-${activationEnvelope.receipt_sha256.slice(0,16)}-${Date.now().toString(36)}-${randomBytes(4).toString('hex')}`;
-  const evidenceDir=path.join(state,'evidence','updates',rollbackId),statePath=path.join(evidenceDir,'state.json'),receiptPath=path.join(evidenceDir,'receipt.json');
+  const evidenceDir=path.join(state,'evidence','updates',rollbackId),statePath=path.join(evidenceDir,'state.json'),receiptPath=path.join(evidenceDir,'receipt.json'),failurePath=path.join(evidenceDir,'failure-receipt.json');
   await mkdir(evidenceDir,{recursive:true});
   const journal={schema:'deadbyte.r31-slot-rollback-state.v1',rollback_id:rollbackId,activation_receipt:path.resolve(receiptFile),
     activation_receipt_sha256:activationEnvelope.receipt_sha256,handoff_path:handoffPath,
@@ -1807,8 +1808,19 @@ export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_S
       }
       try { await startAndVerify(currentCtx,currentRuntime); recovery.successor_runtime_restarted=true; } catch(recoveryError){ recovery.errors.push(`restart-successor:${recoveryError.message}`); }
     }
-    await writeState(statePath,journal,'failed',{error:{name:error?.name??'Error',message:String(error?.message??error)},recovery}).catch(()=>{});
-    const wrapped=new Error(`R31 slot rollback failed: ${error?.message??error}`); wrapped.cause=error; wrapped.statePath=statePath; throw wrapped;
+    const failure={schema:ROLLBACK_FAILURE_SCHEMA,rollback_id:rollbackId,activation_receipt_sha256:activationEnvelope.receipt_sha256,
+      failed_at_utc:new Date().toISOString(),phase:journal.phase??'unknown',from_pointer:publicPointer(activePointer),to_pointer:publicPointer(priorPointer),
+      error:{name:error?.name??'Error',message:String(error?.message??error)},recovery};
+    await writeState(statePath,journal,'failed',{error:failure.error,recovery}).catch(()=>{});
+    let failureReceipt=null;
+    try{
+      failureReceipt=await writeEnvelope(failurePath,failure,key);
+      await writeState(statePath,journal,'failed_receipted',{failure_receipt_path:failurePath,failure_receipt_sha256:failureReceipt.receipt_sha256});
+    }catch(receiptError){
+      recovery.errors.push('failure-receipt:'+receiptError.message);
+      await writeState(statePath,journal,'failed_unreceipted',{recovery,failure_receipt_error:String(receiptError?.message??receiptError)}).catch(()=>{});
+    }
+    const wrapped=new Error(`R31 slot rollback failed: ${error?.message??error}`); wrapped.cause=error; wrapped.statePath=statePath; wrapped.failureReceiptPath=failureReceipt?failurePath:null; throw wrapped;
   }
 }
 

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.38';
+export const DEADBYTE_VERSION = '0.15.39';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/r58-doctor-transactions.test.mjs

@@ -10,12 +10,12 @@ test('R58 bounded transaction inventory flags residue without recovering or over
  assert.equal((await inspectDoctorTransactions(root)).status,'PASS');assert.deepEqual(await readdir(root),[]);
  const transactions=path.join(root,'evidence','updates');await mkdir(transactions,{recursive:true});
  const write=async(name,body)=>{const dir=path.join(transactions,name);await mkdir(dir);const file=path.join(dir,'state.json'),bytes=JSON.stringify(body);await writeFile(file,bytes);return {file,bytes};};
- const done=await write('done',{schema:'deadbyte.r27-slot-update-state.v1',phase:'completed'});
+ const done=await write('done',{schema:'deadbyte.r27-slot-update-state.v1',phase:'superseded'});
  assert.equal((await inspectDoctorTransactions(root)).status,'PASS');
  const pending=await write('pending',{schema:'deadbyte.r31-slot-rollback-state.v1',phase:'prior_pointer_restored',supervisor_pid:process.pid});
  const result=await inspectDoctorTransactions(root);assert.equal(result.status,'WARN');assert.ok(result.findings.some(f=>f.evidence.recorded_phase==='prior_pointer_restored'));
  for(const item of [done,pending])assert.equal(await readFile(item.file,'utf8'),item.bytes);
  const bounded=await inspectDoctorTransactions(root,{maxEntries:1});assert.equal(bounded.status,'WARN');assert.ok(bounded.findings.some(f=>f.evidence.inventory_complete===false));
  const corrupt=await write('corrupt',{schema:'INVALID',phase:'completed'});assert.equal((await inspectDoctorTransactions(root)).status,'FAIL');assert.equal(await readFile(corrupt.file,'utf8'),corrupt.bytes);
- await assert.rejects(inspectDoctorTransactions(root,{maxEntries:257}),/budget invalid/);
+ await assert.rejects(inspectDoctorTransactions(root,{maxEntries:1025}),/budget invalid/);
 });

package/test/r61-release-contract.test.mjs

@@ -4,13 +4,14 @@ import {readFile} from 'node:fs/promises';
 
 const read=rel=>readFile(new URL('../'+rel,import.meta.url),'utf8');
 const json=rel=>read(rel).then(raw=>JSON.parse(raw.replace(/^\uFEFF/,'')));
+const currentPackage=await json('package.json');
 const PARENT={
   release_id:'v0.15.37-1cfecd7889419da7',
   manifest_sha256:'1cfecd7889419da7800814e3a2a4ffa93d48dfdb0c344a5b7b91fe8d093230aa',
   generation_manifest_sha256:'54842021c75f01bf7ecbd5b10ab8a482ecf107765b45c46f9d39b12bab65eac4'
 };
 
-test('R61 identity binds exact sealed 0.15.37 predecessor without a public surface expansion',async()=>{
+test('R61 identity binds exact sealed 0.15.37 predecessor without a public surface expansion',{skip:currentPackage.version!=='0.15.38'},async()=>{
   const [pkg,lock,bridge,release,provenance,matrix,sbom,version,gate]=await Promise.all([
     json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs'),

package/test/r62-doctor-receipt-semantics.test.mjs

@@ -0,0 +1,50 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdir,mkdtemp,writeFile} from 'node:fs/promises';
+import {generateKeyPairSync,createHash,sign} from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import {inspectDoctorTransactions} from '../src/doctor-transactions-r58.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+ ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
+const canonicalJson=value=>JSON.stringify(canonical(value));
+const domain=Buffer.from('DEADBYTE-R27-SLOT-UPDATE-V1\0');
+function envelope(body,keys){
+ const bodyBytes=Buffer.from(canonicalJson(body),'utf8');
+ const unsigned={body,body_sha256:sha(bodyBytes),attestation:{
+  algorithm:'ed25519',domain:'DEADBYTE-R27-SLOT-UPDATE-V1',
+  key_id:sha(keys.publicKey.export({type:'spki',format:'der'})),
+  signature_base64:sign(null,Buffer.concat([domain,bodyBytes]),keys.privateKey).toString('base64')
+ }};
+ return {...unsigned,receipt_sha256:sha(Buffer.from(canonicalJson(unsigned),'utf8'))};
+}
+
+test('R62 doctor rejects signed success receipts whose rollback semantics contradict their schema',async()=>{
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r62-doctor-receipt-semantics-'));
+ const trust=path.join(root,'trust'),updates=path.join(root,'evidence','updates');
+ await mkdir(trust,{recursive:true});await mkdir(updates,{recursive:true});
+ const keys=generateKeyPairSync('ed25519');
+ await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}));
+
+ const updateDir=path.join(updates,'bad-update-success');await mkdir(updateDir);
+ await writeFile(path.join(updateDir,'state.json'),JSON.stringify({
+  schema:'deadbyte.r27-slot-update-state.v1',update_id:'bad-update-success',phase:'completed'
+ }));
+ await writeFile(path.join(updateDir,'receipt.json'),JSON.stringify(envelope({
+  schema:'deadbyte.r27-slot-update-receipt.v1',update_id:'bad-update-success',rollback_performed:true
+ },keys)));
+
+ const rollbackDir=path.join(updates,'bad-rollback-success');await mkdir(rollbackDir);
+ await writeFile(path.join(rollbackDir,'state.json'),JSON.stringify({
+  schema:'deadbyte.r31-slot-rollback-state.v1',rollback_id:'bad-rollback-success',phase:'completed'
+ }));
+ await writeFile(path.join(rollbackDir,'receipt.json'),JSON.stringify(envelope({
+  schema:'deadbyte.r31-slot-rollback-receipt.v1',rollback_id:'bad-rollback-success',rollback_performed:false
+ },keys)));
+
+ const result=await inspectDoctorTransactions(root);
+ assert.equal(result.status,'FAIL');
+ assert.equal(result.findings.filter(f=>f.evidence?.check==='terminal_receipt_verification').length,2);
+});

package/test/r62-doctor-transactions-reconcile.test.mjs

@@ -0,0 +1,208 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdir,mkdtemp,writeFile,readFile} from 'node:fs/promises';
+import {generateKeyPairSync,createHash,sign} from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import {inspectDoctorTransactions} from '../src/doctor-transactions-r58.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+ ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
+const canonicalJson=value=>JSON.stringify(canonical(value));
+const domain=Buffer.from('DEADBYTE-R27-SLOT-UPDATE-V1\0');
+
+function envelope(body,keys){
+ const bodyBytes=Buffer.from(canonicalJson(body),'utf8');
+ const unsigned={
+  body,
+  body_sha256:sha(bodyBytes),
+  attestation:{
+   algorithm:'ed25519',
+   domain:'DEADBYTE-R27-SLOT-UPDATE-V1',
+   key_id:sha(keys.publicKey.export({type:'spki',format:'der'})),
+   signature_base64:sign(null,Buffer.concat([domain,bodyBytes]),keys.privateKey).toString('base64')
+  }
+ };
+ return {...unsigned,receipt_sha256:sha(Buffer.from(canonicalJson(unsigned),'utf8'))};
+}
+
+test('R62 doctor reconciles signed terminal receipts instead of warning on stale nonterminal journal phases',async()=>{
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r62-doctor-reconcile-'));
+ const trust=path.join(root,'trust');
+ const updates=path.join(root,'evidence','updates');
+ await mkdir(trust,{recursive:true});
+ await mkdir(updates,{recursive:true});
+ const keys=generateKeyPairSync('ed25519');
+ await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}));
+
+ const writeTransaction=async(name,state,receiptName,receiptBody)=>{
+  const dir=path.join(updates,name);
+  await mkdir(dir);
+  const statePath=path.join(dir,'state.json');
+  const stateBytes=JSON.stringify(state);
+  await writeFile(statePath,stateBytes);
+  await writeFile(path.join(dir,receiptName),JSON.stringify(envelope(receiptBody,keys)));
+  return {statePath,stateBytes};
+ };
+
+ const success=await writeTransaction(
+  'success',
+  {schema:'deadbyte.r27-slot-update-state.v1',update_id:'success',phase:'pointer_committed'},
+  'receipt.json',
+  {schema:'deadbyte.r27-slot-update-receipt.v1',update_id:'success',rollback_performed:false}
+ );
+ const failure=await writeTransaction(
+  'failure',
+  {schema:'deadbyte.r27-slot-update-state.v1',update_id:'failure',phase:'candidate_prepared'},
+  'failure-receipt.json',
+  {schema:'deadbyte.r27-slot-update-failure.v1',update_id:'failure',failed_at_utc:'2026-10-04T00:00:00.000Z'}
+ );
+
+ const result=await inspectDoctorTransactions(root);
+ assert.equal(result.status,'PASS');
+ assert.equal(result.findings.some(f=>f.level==='WARN'),false);
+ const summary=result.findings.find(f=>f.evidence?.receipt_verification_performed===true);
+ assert.ok(summary,'doctor must report signed receipt verification');
+ assert.equal(summary.evidence.verified_terminal_receipts,2);
+ assert.equal(summary.evidence.unresolved_transactions,0);
+ assert.equal(await readFile(success.statePath,'utf8'),success.stateBytes);
+ assert.equal(await readFile(failure.statePath,'utf8'),failure.stateBytes);
+});
+
+
+test('R62 doctor default transaction budget covers more than the legacy 256-entry ceiling while remaining bounded',async()=>{
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r62-doctor-budget-'));
+ const updates=path.join(root,'evidence','updates');
+ await mkdir(updates,{recursive:true});
+ for(let index=0;index<300;index++){
+  const dir=path.join(updates,`tx-${String(index).padStart(3,'0')}`);
+  await mkdir(dir);
+  await writeFile(path.join(dir,'state.json'),JSON.stringify({
+   schema:'deadbyte.r27-slot-update-state.v1',
+   update_id:`tx-${index}`,
+   phase:'superseded'
+  }));
+ }
+ const result=await inspectDoctorTransactions(root);
+ assert.equal(result.status,'PASS');
+ assert.equal(result.findings.some(f=>f.evidence?.inventory_complete===false),false);
+ const summary=result.findings.find(f=>f.evidence?.receipt_verification_performed===true);
+ assert.ok(summary);
+ assert.equal(summary.evidence.states_checked,300);
+ await assert.rejects(inspectDoctorTransactions(root,{maxEntries:1025}),/budget invalid/);
+});
+
+
+test('R62 doctor verifies signed receipts even when the journal already claims a terminal phase',async()=>{
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r62-doctor-terminal-proof-'));
+ const trust=path.join(root,'trust');
+ const updates=path.join(root,'evidence','updates');
+ await mkdir(trust,{recursive:true});
+ await mkdir(updates,{recursive:true});
+ const keys=generateKeyPairSync('ed25519');
+ await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}));
+
+ const provenDir=path.join(updates,'proven');
+ await mkdir(provenDir);
+ await writeFile(path.join(provenDir,'state.json'),JSON.stringify({
+  schema:'deadbyte.r27-slot-update-state.v1',
+  update_id:'proven',
+  phase:'completed'
+ }));
+ await writeFile(path.join(provenDir,'receipt.json'),JSON.stringify(envelope({
+  schema:'deadbyte.r27-slot-update-receipt.v1',
+  update_id:'proven',
+  rollback_performed:false
+ },keys)));
+
+ const proven=await inspectDoctorTransactions(root);
+ assert.equal(proven.status,'PASS');
+ const provenSummary=proven.findings.find(f=>f.evidence?.receipt_verification_performed===true);
+ assert.equal(provenSummary.evidence.verified_terminal_receipts,1);
+
+ const unprovenDir=path.join(updates,'unproven');
+ await mkdir(unprovenDir);
+ await writeFile(path.join(unprovenDir,'state.json'),JSON.stringify({
+  schema:'deadbyte.r27-slot-update-state.v1',
+  update_id:'unproven',
+  phase:'completed'
+ }));
+ const unproven=await inspectDoctorTransactions(root);
+ assert.equal(unproven.status,'WARN');
+ assert.ok(unproven.findings.some(f=>f.evidence?.recorded_phase==='completed'));
+});
+
+
+test('R62 doctor fails closed on tampered or missing claimed terminal receipts without mutating journals',async()=>{
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r62-doctor-adversarial-'));
+ const trust=path.join(root,'trust');
+ const updates=path.join(root,'evidence','updates');
+ await mkdir(trust,{recursive:true});
+ await mkdir(updates,{recursive:true});
+ const keys=generateKeyPairSync('ed25519');
+ await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}));
+
+ const tamperedDir=path.join(updates,'tampered');
+ await mkdir(tamperedDir);
+ const tamperedStatePath=path.join(tamperedDir,'state.json');
+ const tamperedState=JSON.stringify({
+  schema:'deadbyte.r27-slot-update-state.v1',
+  update_id:'tampered',
+  phase:'completed'
+ });
+ await writeFile(tamperedStatePath,tamperedState);
+ const good=envelope({
+  schema:'deadbyte.r27-slot-update-receipt.v1',
+  update_id:'tampered',
+  rollback_performed:false
+ },keys);
+ const bad={...good,attestation:{...good.attestation,signature_base64:Buffer.alloc(64).toString('base64')}};
+ await writeFile(path.join(tamperedDir,'receipt.json'),JSON.stringify(bad));
+
+ const missingDir=path.join(updates,'missing');
+ await mkdir(missingDir);
+ const missingStatePath=path.join(missingDir,'state.json');
+ const missingState=JSON.stringify({
+  schema:'deadbyte.r27-slot-update-state.v1',
+  update_id:'missing',
+  phase:'failed_receipted'
+ });
+ await writeFile(missingStatePath,missingState);
+
+ const result=await inspectDoctorTransactions(root);
+ assert.equal(result.status,'FAIL');
+ assert.ok(result.findings.some(f=>f.evidence?.check==='terminal_receipt_verification'));
+ assert.ok(result.findings.some(f=>f.evidence?.check==='missing_failure_receipt'));
+ assert.equal(await readFile(tamperedStatePath,'utf8'),tamperedState);
+ assert.equal(await readFile(missingStatePath,'utf8'),missingState);
+});
+
+
+test('R62 doctor reconciles a signed R31 rollback failure receipt by rollback_id',async()=>{
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r62-r31-failure-proof-'));
+ const trust=path.join(root,'trust');
+ const dir=path.join(root,'evidence','updates','rollback-failure');
+ await mkdir(trust,{recursive:true});
+ await mkdir(dir,{recursive:true});
+ const keys=generateKeyPairSync('ed25519');
+ await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}));
+ const rollbackId='r31-rollback-r62-fixture';
+ await writeFile(path.join(dir,'state.json'),JSON.stringify({
+  schema:'deadbyte.r31-slot-rollback-state.v1',
+  rollback_id:rollbackId,
+  phase:'failed'
+ }));
+ await writeFile(path.join(dir,'failure-receipt.json'),JSON.stringify(envelope({
+  schema:'deadbyte.r31-slot-rollback-failure.v1',
+  rollback_id:rollbackId,
+  failed_at_utc:'2026-10-04T00:00:00.000Z',
+  error:{name:'Error',message:'fixture'}
+ },keys)));
+ const result=await inspectDoctorTransactions(root);
+ assert.equal(result.status,'PASS');
+ const summary=result.findings.find(f=>f.evidence?.receipt_verification_performed===true);
+ assert.equal(summary.evidence.verified_terminal_receipts,1);
+ assert.equal(summary.evidence.verified_failure_receipts,1);
+ assert.equal(summary.evidence.unresolved_transactions,0);
+});