deadbyte-mcp 0.15.38 → 0.15.41

package/scripts/r62-full.ps1

@@ -0,0 +1,9 @@
+$ErrorActionPreference='Stop'
+$root=Split-Path -Parent $PSScriptRoot
+Push-Location $root
+try {
+  & npm.cmd test
+  $code=$LASTEXITCODE
+  Write-Host ("R62_FULL_EXIT="+$code)
+  exit $code
+} finally { Pop-Location }

package/scripts/r62-live-transaction-audit.mjs

@@ -0,0 +1,17 @@
+import {inspectDoctorTransactions} from '../src/doctor-transactions-r58.mjs';
+
+const result=await inspectDoctorTransactions();
+const summary=result.findings.find(item=>item.evidence?.receipt_verification_performed===true)?.evidence??null;
+const unresolved=result.findings
+ .filter(item=>item.level==='WARN'&&item.evidence?.recorded_phase)
+ .map(item=>({schema:item.evidence.schema,phase:item.evidence.recorded_phase,state_sha256:item.evidence.state_sha256}));
+const phases={};
+for(const item of unresolved) phases[item.phase]=(phases[item.phase]??0)+1;
+console.log(JSON.stringify({
+ status:result.status,
+ summary,
+ unresolved_count:unresolved.length,
+ unresolved_phases:phases,
+ fail_count:result.findings.filter(item=>item.level==='FAIL').length,
+ inventory_warning:result.findings.some(item=>item.evidence?.inventory_complete===false)
+},null,2));

package/scripts/r62-unresolved-transaction-inspect.mjs

@@ -0,0 +1,54 @@
+import {opendir,lstat,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createHash} from 'node:crypto';
+
+const state=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const root=path.join(state,'evidence','updates');
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const terminal=new Set(['completed','superseded','failed_receipted']);
+const rows=[];
+for await(const entry of await opendir(root)){
+  if(!entry.isDirectory()||entry.isSymbolicLink()) continue;
+  const dir=path.join(root,entry.name),stateFile=path.join(dir,'state.json');
+  let stateBytes,body;
+  try{
+    const info=await lstat(stateFile);
+    if(!info.isFile()||info.isSymbolicLink()||info.size>1048576) continue;
+    stateBytes=await readFile(stateFile);
+    body=JSON.parse(stateBytes.toString('utf8').replace(/^\uFEFF/,''));
+  }catch{continue;}
+  if(!['deadbyte.r27-slot-update-state.v1','deadbyte.r31-slot-rollback-state.v1'].includes(body?.schema)) continue;
+  const has=async name=>{try{const st=await lstat(path.join(dir,name));return st.isFile()&&!st.isSymbolicLink();}catch{return false;}};
+  if(terminal.has(body.phase)||await has('receipt.json')||await has('failure-receipt.json')) continue;
+  const handoff=await has('handoff.json');
+  let handoffSummary=null;
+  if(handoff){
+    try{
+      const h=JSON.parse((await readFile(path.join(dir,'handoff.json'),'utf8')).replace(/^\uFEFF/,''));
+      handoffSummary={schema:h?.body?.schema??h?.schema??null,body:h?.body??h};
+    }catch(error){handoffSummary={parse_error:String(error?.message??error)};}
+  }
+  rows.push({
+    entry:entry.name,
+    entry_sha256:sha(Buffer.from(entry.name,'utf8')),
+    state_sha256:sha(stateBytes),
+    schema:body.schema,
+    phase:body.phase,
+    update_id:body.update_id??null,
+    rollback_id:body.rollback_id??null,
+    prior_pointer:body.prior_pointer??null,
+    new_pointer:body.new_pointer??null,
+    active_pointer:body.active_pointer??null,
+    old_runtime:body.old_runtime??null,
+    new_runtime:body.new_runtime??null,
+    error:body.error??null,
+    recovery:body.recovery??null,
+    has_handoff:handoff,
+    handoff:handoffSummary
+  });
+}
+rows.sort((a,b)=>a.entry.localeCompare(b.entry));
+let active=null;
+try{active=JSON.parse(await readFile(path.join(state,'active-release.json'),'utf8'));}catch{}
+console.log(JSON.stringify({state_root:state,active_pointer:active,unresolved_count:rows.length,rows},null,2));

package/scripts/r64-predecessor-reproducer.mjs

@@ -0,0 +1,32 @@
+import {mkdtemp,mkdir,writeFile,rm} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {pathToFileURL} from 'node:url';
+
+const sourceRoot=process.argv[2];
+if(!sourceRoot||!path.isAbsolute(sourceRoot))throw new Error('absolute predecessor root required');
+const load=name=>import(pathToFileURL(path.join(sourceRoot,name)).href);
+const [{loadCodingPolicy},{createMachineFsRuntime},{generateTrustKeypair},{machineFsGatewayInputSchema},{registerMachineFsTools}]=await Promise.all([
+  load('src/coding-plane.mjs'),load('src/machine-fs.mjs'),load('src/trust.mjs'),
+  load('src/compact-gateway-mcp-tools.mjs'),load('src/machine-fs-mcp-tools.mjs')
+]);
+const root=await mkdtemp(path.join(tmpdir(),'deadbyte-r64-red-'));
+try{
+  const project=path.join(root,'project');await mkdir(project);
+  await writeFile(path.join(project,'large.bin'),Buffer.alloc(4*1024*1024+64,0x52));
+  const policyPath=path.join(root,'policy.json');
+  await writeFile(policyPath,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,lease_file:path.join(root,'grant.json'),evidence_dir:path.join(root,'evidence'),roots:{project:{path:project,read:true,write:false,exec:false,deny_paths:[]}},commands:{},max_read_bytes:4*1024*1024,max_write_bytes:65536}));
+  const policy=await loadCodingPolicy(policyPath);
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(root,'private.pem'),publicKeyPath:path.join(root,'public.pem')});
+  const runtime=createMachineFsRuntime({policy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  const first=await runtime.read({rootId:'project',relativePath:'large.bin',offset:2,maxBytes:4*1024*1024});
+  const args={root_id:'project',path:'large.bin',offset:first.next_offset,max_bytes:64,hash_file:false,timeout_ms:30000};
+  const server={registerTool(name,definition){if(name==='machine_fs_read')this.read=definition;}};
+  registerMachineFsTools(server,{runtime:{}});
+  let runtimeError=null;
+  try{await runtime.read({rootId:'project',relativePath:'large.bin',offset:first.next_offset,maxBytes:64});}
+  catch(error){runtimeError=String(error?.message||error);}
+  const result={source_root:sourceRoot,page_two_offset:first.next_offset,full_schema_accepts:server.read.inputSchema.safeParse(args).success,compact_schema_accepts:machineFsGatewayInputSchema.safeParse({op:'read',...args}).success,runtime_error:runtimeError};
+  console.log(JSON.stringify(result));
+  if(result.full_schema_accepts||result.compact_schema_accepts||!runtimeError)process.exitCode=1;
+}finally{await rm(root,{recursive:true,force:true});}

package/scripts/r64-read-benchmark.mjs

@@ -0,0 +1,84 @@
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,rm,writeFile} from 'node:fs/promises';
+import {performance} from 'node:perf_hooks';
+import path from 'node:path';
+import {pathToFileURL} from 'node:url';
+
+const [beforeRoot,afterRoot,scratchRoot,outputPath]=process.argv.slice(2);
+if([beforeRoot,afterRoot,scratchRoot,outputPath].some(value=>!value||!path.isAbsolute(value)))throw new Error('four absolute paths required: R63 R64 scratch output');
+const rounds=7,operations=400,concurrency=4;
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const percentile=(values,p)=>[...values].sort((a,b)=>a-b)[Math.ceil(values.length*p)-1];
+await mkdir(scratchRoot,{recursive:true});
+const scratch=await mkdtemp(path.join(scratchRoot,'read-bench-'));
+try{
+  const project=path.join(scratch,'project');
+  await mkdir(project);
+  const file=path.join(project,'fixture.bin');
+  const content=Buffer.alloc(4*1024*1024+131072,0x52);
+  await writeFile(file,content);
+  const policyPath=path.join(scratch,'policy.json');
+  await writeFile(policyPath,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,
+    lease_file:path.join(scratch,'grant.json'),evidence_dir:path.join(scratch,'evidence'),
+    roots:{project:{path:project,read:true,write:false,exec:false,deny_paths:[]}},
+    commands:{},max_read_bytes:4*1024*1024,max_write_bytes:65536}));
+  const rows=[];
+  for(let round=0;round<rounds;round++){
+    for(const [label,root] of (round%2?[['after',afterRoot],['before',beforeRoot]]:[['before',beforeRoot],['after',afterRoot]])){
+      const url=name=>pathToFileURL(path.join(root,name)).href;
+      const [{loadCodingPolicy},{createMachineFsRuntime},{generateTrustKeypair},{createBridgeGovernor}]=await Promise.all([
+        import(url('src/coding-plane.mjs')),import(url('src/machine-fs.mjs')),
+        import(url('src/trust.mjs')),import(url('bridge/src/r40-governor.mjs'))
+      ]);
+      const keys=await generateTrustKeypair({privateKeyPath:path.join(scratch,`private-${label}-${round}.pem`),publicKeyPath:path.join(scratch,`public-${label}-${round}.pem`)});
+      const policy=await loadCodingPolicy(policyPath);
+      const runtime=createMachineFsRuntime({policy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+      const governor=createBridgeGovernor();
+      const latencies=[],control=[],errors=[];
+      let next=0,peakRss=process.memoryUsage().rss;
+      const started=performance.now();
+      async function bulkWorker(){
+        for(;;){
+          const index=next++;
+          if(index>=operations)return;
+          const mark=performance.now();
+          const ticket=await governor.acquire('machine_fs',{op:'read'});
+          try{
+            const result=await runtime.read({rootId:'project',relativePath:'fixture.bin',offset:(index%32)*65536,maxBytes:65536});
+            if(result.status!=='ok'||Buffer.from(result.data_base64,'base64').length!==65536)throw new Error('read oracle failed');
+          }catch(error){errors.push(String(error));}
+          finally{ticket.release();latencies.push(performance.now()-mark);peakRss=Math.max(peakRss,process.memoryUsage().rss);}
+        }
+      }
+      async function controlWorker(){
+        for(let index=0;index<operations;index++){
+          const mark=performance.now();
+          const ticket=await governor.acquire(index%2?'machine_status':'machine_ping');
+          try{if(index%2)await readFile(policyPath);else sha(Buffer.from(`ping-${index}`));}
+          finally{ticket.release();control.push(performance.now()-mark);}
+        }
+      }
+      await Promise.all([...Array.from({length:concurrency},()=>bulkWorker()),controlWorker()]);
+      const elapsed=performance.now()-started;
+      await governor.close();
+      const boundaryStart=performance.now();
+      let boundary={status:'unknown'};
+      try{
+        const first=await runtime.read({rootId:'project',relativePath:'fixture.bin',offset:65536,maxBytes:4*1024*1024});
+        const second=await runtime.read({rootId:'project',relativePath:'fixture.bin',offset:first.next_offset,maxBytes:65536});
+        if(first.next_offset<=4*1024*1024||second.eof!==true||Buffer.from(second.data_base64,'base64').length!==65536)throw new Error('cross-boundary oracle failed');
+        boundary={status:'pass',page_two_offset:first.next_offset,elapsed_ms:performance.now()-boundaryStart};
+      }catch(error){boundary={status:'rejected',reason:String(error?.message||error),elapsed_ms:performance.now()-boundaryStart};}
+      if(label==='before'&&boundary.status!=='rejected')errors.push('R63 unexpectedly accepted page two');
+      if(label==='after'&&boundary.status!=='pass')errors.push('R64 cross-boundary paging failed');
+      rows.push({round,label,source_sha256:sha(await readFile(path.join(root,'src/machine-fs.mjs'))),
+        ops:latencies.length,ops_per_second:operations*1000/elapsed,p50_ms:percentile(latencies,.5),p95_ms:percentile(latencies,.95),
+        control_p95_ms:percentile(control,.95),peak_rss_bytes:peakRss,boundary,errors});
+    }
+  }
+  const report={schema:'deadbyte.r64.read-benchmark.v1',node:process.version,rounds,operations_per_round:operations,concurrency,
+    source_roots:{before:beforeRoot,after:afterRoot},rows,
+    limitations:['same-host sequential alternating runs; OS scheduling noise remains','comparable throughput rows use inherited sub-4-MiB reads; boundary timings are separate because R63 cannot execute page two','control probe uses governor and local read/hash, not public MCP machine_ping or machine_status']};
+  await writeFile(outputPath,JSON.stringify(report,null,2)+'\n',{flag:'wx'});
+  console.log(JSON.stringify({output_path:outputPath,rows:rows.length,errors:rows.reduce((sum,row)=>sum+row.errors.length,0)}));
+}finally{await rm(scratch,{recursive:true,force:true});}

package/src/compact-gateway-mcp-tools.mjs

@@ -28,7 +28,7 @@ export const codingInspectInputSchema=z.discriminatedUnion('op',[
 export const machineFsGatewayInputSchema=z.discriminatedUnion('op',[
   z.strictObject({op:z.literal('stat'),root_id:id,path:rel.default('.'),hash:z.boolean().default(false)}),
   z.strictObject({op:z.literal('list'),root_id:id,path:rel.default('.'),cursor,limit:z.number().int().min(1).max(1000).default(100),hash_files:z.boolean().default(false)}),
-  z.strictObject({op:z.literal('read'),root_id:id,path:rel,offset:z.number().int().min(-4*1024*1024).max(4*1024*1024).default(0),max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536),hash_file:z.boolean().default(false),timeout_ms:z.number().int().min(100).max(180000).default(30000)}),
+  z.strictObject({op:z.literal('read'),root_id:id,path:rel,offset:z.number().int().min(-4*1024*1024).max(Number.MAX_SAFE_INTEGER).default(0),max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536),hash_file:z.boolean().default(false),timeout_ms:z.number().int().min(100).max(180000).default(30000)}),
   z.strictObject({op:z.literal('write'),root_id:id,path:rel,content:z.string().max(12*1024*1024),encoding:z.enum(['utf8','base64']).default('utf8'),expected_sha256:z.string().regex(/^(?:absent|[0-9a-f]{64})$/)}),
   z.strictObject({op:z.literal('edit_exact'),root_id:id,path:rel,expected_sha256:hex64,old_string:z.string().min(1).max(262144),new_string:z.string().max(524288),expected_replacements:z.number().int().min(1).max(64).default(1)}),
   z.strictObject({op:z.literal('mkdir'),root_id:id,path:rel}),

package/src/deadbyte-cli.mjs

@@ -20,7 +20,7 @@ import { windowsPowerShellEnvironment } from './runtime-update.mjs';
 import { resolveStateRoot } from './state-root.mjs';
 import {foregroundIdentityMatches,queryForegroundIdentity,validForegroundIdentity} from './foreground-process-identity.mjs';
 import {acquireForegroundSessionLock} from './foreground-session-lock.mjs';
-import { AUTHORITY_PLANES, authorityVector, parseAuthorityObservation, assertAuthorityVector, assertRuntimeReadyObservation, authorityBanner } from './remote-authority.mjs';
+import { AUTHORITY_PLANES, authorityVector, authorityRestorePlan, parseAuthorityObservation, assertAuthorityVector, assertRuntimeReadyObservation, authorityBanner } from './remote-authority.mjs';
 import { decodeRemoteLogBytes, boundedRemoteDiagnostic, safeRemoteLogPrefixLength } from './remote-log-decode-r60.mjs';
 
 const REMOTE_COMMANDS=new Set([
@@ -137,6 +137,20 @@ async function synchronizeForegroundRuntime(ctx,{displayMode='unicode'}={}){
     }
   });
 }
+async function synchronizeOneShotRuntime(ctx,{displayMode='ascii'}={}){
+  const active=await readActiveRuntimeBinding(ctx.root);
+  if(!active||active.version===DEADBYTE_VERSION) return synchronizeForegroundRuntime(ctx,{displayMode});
+  const before=observedAuthority(ctx);
+  const expected=Object.fromEntries(AUTHORITY_PLANES.map(plane=>[plane,before.authority[plane].armed]));
+  const result=await synchronizeForegroundRuntime(ctx,{displayMode});
+  if(result.status!=='upgraded') return result;
+  for(const command of authorityRestorePlan(before)){
+    const restored=invokeController(ctx,command,{capture:true,allowFailure:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+    if(restored.status!==0) throw new Error(`runtime coherence authority restore '${command}' failed exit=${restored.status}`);
+  }
+  assertAuthorityVector(observedAuthority(ctx),expected);
+  return result;
+}
 async function readControllerStartFailure(root,command,{maxChars=2048}={}){
   const file=path.join(root,'runtime','controller-start-failure.json');
   let raw;
@@ -629,7 +643,7 @@ async function runRemote(args){
   if(positional.length>1) throw new Error('remote accepts one controller command');
   const command=positional[0];if(!REMOTE_COMMANDS.has(command)) throw new Error(`unsupported remote command '${command}'`);
   const ctx=await remoteContext();
-  await reportVersionCoherence(ctx.root,{displayMode:'ascii'});
+  await synchronizeOneShotRuntime(ctx,{displayMode:'ascii'});
   const result=invokeController(ctx,command,{allowFailure:true});
   process.exitCode=result.status;
 }

package/src/doctor-transactions-r58.mjs

@@ -1,10 +1,37 @@
 import {lstat,opendir,readFile} from 'node:fs/promises';
 import path from 'node:path';
-import {createHash} from 'node:crypto';
+import {createHash,createPublicKey} from 'node:crypto';
 import {resolveStateRoot} from './state-root.mjs';
+import {verifySlotUpdateEnvelope} from './runtime-update.mjs';
 
-export async function inspectDoctorTransactions(explicitRoot,{maxEntries=256}={}){
- if(!Number.isSafeInteger(maxEntries)||maxEntries<1||maxEntries>256)throw new Error('doctor transaction budget invalid');
+const UPDATE_RECEIPT='deadbyte.r27-slot-update-receipt.v1';
+const FAILURE_RECEIPT='deadbyte.r27-slot-update-failure.v1';
+const ROLLBACK_RECEIPT='deadbyte.r31-slot-rollback-receipt.v1';
+const ROLLBACK_FAILURE_RECEIPT='deadbyte.r31-slot-rollback-failure.v1';
+
+async function readReceipt(file){
+ const info=await lstat(file);
+ if(!info.isFile()||info.isSymbolicLink()||info.size>1048576)throw new Error('unsafe transaction receipt');
+ const bytes=await readFile(file);
+ if(bytes.length>1048576)throw new Error('transaction receipt budget');
+ return JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));
+}
+
+function receiptSubjectMatches(state,envelope,kind){
+ const body=envelope?.body;
+ if(state.schema==='deadbyte.r27-slot-update-state.v1'){
+  if(kind==='success')return body?.schema===UPDATE_RECEIPT&&body?.update_id===state.update_id&&body?.rollback_performed===false;
+  return body?.schema===FAILURE_RECEIPT&&body?.update_id===state.update_id;
+ }
+ if(state.schema==='deadbyte.r31-slot-rollback-state.v1'){
+  if(kind==='success')return body?.schema===ROLLBACK_RECEIPT&&body?.rollback_id===state.rollback_id&&body?.rollback_performed===true;
+  return body?.schema===ROLLBACK_FAILURE_RECEIPT&&body?.rollback_id===state.rollback_id;
+ }
+ return false;
+}
+
+export async function inspectDoctorTransactions(explicitRoot,{maxEntries=1024}={}){
+ if(!Number.isSafeInteger(maxEntries)||maxEntries<1||maxEntries>1024)throw new Error('doctor transaction budget invalid');
  const state=resolveStateRoot(explicitRoot),root=path.join(state,'evidence','updates'),findings=[];
  const next='Retain transaction evidence; inspect the exact signed receipt/handoff and current pointer before any supported recovery. Doctor never launches recovery.';
  const add=(level,what,evidence)=>findings.push({id:'transaction_residue',level,what,evidence,next_action:level==='PASS'?null:next});
@@ -17,24 +44,68 @@ export async function inspectDoctorTransactions(explicitRoot,{maxEntries=256}={}
   else add('FAIL','Update evidence directory cannot be safely inspected.',{error_code:error?.code??'VALIDATION_FAILED'});
   return {status:findings[0].level,findings};
  }
- let entries=0,checked=0,terminal=0;
+ let publicKey=null;
+ const loadPublicKey=async()=>{
+  if(publicKey)return publicKey;
+  const keyFile=path.join(state,'trust','ed25519-public.pem');
+  const info=await lstat(keyFile);
+  if(!info.isFile()||info.isSymbolicLink()||info.size>65536)throw new Error('unsafe transaction trust key');
+  publicKey=createPublicKey(await readFile(keyFile));
+  if(publicKey.asymmetricKeyType!=='ed25519')throw new Error('transaction trust key must be Ed25519');
+  return publicKey;
+ };
+ let entries=0,checked=0,terminal=0,verifiedTerminalReceipts=0,verifiedSuccessReceipts=0,verifiedFailureReceipts=0,unresolved=0,inventoryComplete=true;
  try{
   for await(const entry of directory){
-   if(++entries>maxEntries){add('WARN','Transaction inventory budget reached; unobserved entries remain.',{max_entries:maxEntries,states_checked:checked,inventory_complete:false});break;}
+   if(++entries>maxEntries){inventoryComplete=false;add('WARN','Transaction inventory budget reached; unobserved entries remain.',{max_entries:maxEntries,states_checked:checked,inventory_complete:false});break;}
    if(entry.isSymbolicLink()){add('FAIL','Transaction evidence contains a link; it was not followed.',{entry_name_sha256:createHash('sha256').update(entry.name).digest('hex')});continue;}
    if(!entry.isDirectory())continue;
-   const file=path.join(root,entry.name,'state.json');let bytes;
+   const dir=path.join(root,entry.name),file=path.join(dir,'state.json');let bytes;
    try{
     const info=await lstat(file);if(!info.isFile()||info.isSymbolicLink()||info.size>1048576)throw new Error('unsafe transaction state');
     bytes=await readFile(file);if(bytes.length>1048576)throw new Error('transaction state budget');
     const body=JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));checked++;
     const digest=createHash('sha256').update(bytes).digest('hex');
     if(!['deadbyte.r27-slot-update-state.v1','deadbyte.r31-slot-rollback-state.v1'].includes(body?.schema)||typeof body.phase!=='string'||!/^[a-z_]{1,64}$/.test(body.phase)){add('FAIL','Transaction state schema or phase is invalid.',{state_sha256:digest,check:'transaction_schema'});continue;}
-    if(['completed','superseded','failed_receipted'].includes(body.phase)){terminal++;continue;}
+    const receiptPath=path.join(dir,'receipt.json'),failurePath=path.join(dir,'failure-receipt.json');
+    let receiptExists=false,failureExists=false;
+    try{const st=await lstat(receiptPath);receiptExists=st.isFile()&&!st.isSymbolicLink();}catch(error){if(error?.code!=='ENOENT')throw error;}
+    try{const st=await lstat(failurePath);failureExists=st.isFile()&&!st.isSymbolicLink();}catch(error){if(error?.code!=='ENOENT')throw error;}
+    if(receiptExists&&failureExists){add('FAIL','Transaction contains conflicting terminal receipts.',{state_sha256:digest,check:'terminal_receipt_conflict'});continue;}
+    const terminalPath=receiptExists?receiptPath:failureExists?failurePath:null;
+    if(terminalPath){
+      const kind=receiptExists?'success':'failure';
+      const envelope=await readReceipt(terminalPath);
+      const key=await loadPublicKey();
+      if(!verifySlotUpdateEnvelope(envelope,key)||!receiptSubjectMatches(body,envelope,kind)){
+        add('FAIL','Transaction terminal receipt is invalid or not subject-bound to its journal.',{state_sha256:digest,check:'terminal_receipt_verification',receipt_kind:kind});
+        continue;
+      }
+      terminal++;verifiedTerminalReceipts++;
+      if(kind==='success')verifiedSuccessReceipts++;else verifiedFailureReceipts++;
+      continue;
+    }
+
+    if(body.phase==='superseded'){terminal++;continue;}
+    if(body.phase==='failed_receipted'){
+      add('FAIL','Transaction journal claims a signed failure receipt but the receipt is missing.',{state_sha256:digest,check:'missing_failure_receipt',recorded_phase:body.phase});
+      continue;
+    }
+    unresolved++;
     add('WARN','Nonterminal or unresolved transaction record remains; liveness/outcome is not inferred from its age or PID.',{state_sha256:digest,schema:body.schema,recorded_phase:body.phase});
    }catch(error){if(error?.code==='ENOENT')continue;add('FAIL','Transaction state cannot be safely parsed or inspected.',{error_code:error?.code??'VALIDATION_FAILED'});}
   }
  }catch(error){add('FAIL','Transaction inventory observation failed.',{error_code:error?.code??'OBSERVATION_FAILED'});}
- add('PASS','Recorded terminal transaction phases counted; signatures and desired outcomes are not established by this inventory.',{states_checked:checked,recorded_terminal_states:terminal,receipt_verification_performed:false});
+ add('PASS','Recorded terminal transaction outcomes counted; signed receipts are verified when they reconcile stale journal phases.',{
+  states_checked:checked,
+  recorded_terminal_states:terminal,
+  verified_terminal_receipts:verifiedTerminalReceipts,
+  verified_success_receipts:verifiedSuccessReceipts,
+  verified_failure_receipts:verifiedFailureReceipts,
+  unresolved_transactions:unresolved,
+  inventory_complete:inventoryComplete,
+  max_entries:maxEntries,
+  receipt_verification_performed:true
+ });
  return {status:findings.some(f=>f.level==='FAIL')?'FAIL':findings.some(f=>f.level==='WARN')?'WARN':'PASS',findings};
 }

package/src/machine-fs-mcp-tools.mjs

@@ -38,7 +38,7 @@ export function registerMachineFsTools(server, { runtime }) {
   });
   server.registerTool('machine_fs_read', {
     description:'Read one bounded byte range from a root-relative regular file.',
-    inputSchema:z.strictObject({ root_id:id, path:rel, offset:z.number().int().min(-4*1024*1024).max(4*1024*1024).default(0), max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536), hash_file:z.boolean().default(false), timeout_ms:z.number().int().min(100).max(180000).default(30000) }),
+    inputSchema:z.strictObject({ root_id:id, path:rel, offset:z.number().int().min(-4*1024*1024).max(Number.MAX_SAFE_INTEGER).default(0), max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536), hash_file:z.boolean().default(false), timeout_ms:z.number().int().min(100).max(180000).default(30000) }),
     outputSchema:machineFsReadOutputSchema
   }, async ({root_id,path,offset,max_bytes,hash_file,timeout_ms}) => {
     try { return ok(machineFsReadOutputSchema, await runtime.read({rootId:root_id,relativePath:path,offset,maxBytes:max_bytes,hashFile:hash_file,timeoutMs:timeout_ms})); }

package/src/machine-fs.mjs

@@ -21,10 +21,10 @@ const MAX_DIRECTORY_IDENTITY_ENTRIES = 4096;
 const sha256Bytes = bytes => createHash('sha256').update(bytes).digest('hex');
 const sha256Object = value => sha256Bytes(Buffer.from(canonicalJson(value), 'utf8'));
 const nowUtc = () => new Date().toISOString();
-async function sha256File(file) {
+async function sha256File(file, signal = undefined) {
   const hash = createHash('sha256');
   await new Promise((resolve, reject) => {
-    const stream = createReadStream(file);
+    const stream = createReadStream(file, { signal });
     stream.on('data', chunk => hash.update(chunk));
     stream.once('error', reject);
     stream.once('end', resolve);
@@ -35,11 +35,13 @@ async function sha256File(file) {
 const machineFsReadWorkerPath = fileURLToPath(new URL('./machine-fs-read-worker.mjs', import.meta.url));
 async function boundedReadInProcess({ file, offset, length, hashFile, timeoutMs }) {
   const handle = await open(file, 'r');
+  const abortController = new AbortController();
   let timer;
   let settled = false;
   const abort = new Promise((_, reject) => {
     timer = setTimeout(() => {
       settled = true;
+      abortController.abort();
       void handle.close().catch(() => {});
       reject(new Error(`machine fs read timed out after ${timeoutMs}ms`));
     }, timeoutMs);
@@ -50,7 +52,7 @@ async function boundedReadInProcess({ file, offset, length, hashFile, timeoutMs
       const buffer = Buffer.alloc(length);
       const result = length ? await handle.read(buffer, 0, length, offset) : { bytesRead: 0 };
       let fileSha256 = null;
-      if (hashFile) fileSha256 = await sha256File(file);
+      if (hashFile) fileSha256 = await sha256File(file, abortController.signal);
       return { schema: 'deadbyte.machine-fs-read-worker.v1', bytes_read: result.bytesRead,
         data_base64: buffer.subarray(0, result.bytesRead).toString('base64'), file_sha256: fileSha256 };
     })();
@@ -408,13 +410,14 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath,
     return { status: 'ok', root_id: rootId, path: found.relative, entries, next_cursor: nextCursor };
   }
   async function readRange({ rootId, relativePath, offset = 0, maxBytes = 65536, hashFile = false, timeoutMs = 30000 }) {
-    if (!Number.isInteger(offset) || offset < -policy.max_read_bytes || offset > policy.max_read_bytes) throw new Error(`machine fs read offset must be in [-${policy.max_read_bytes}, ${policy.max_read_bytes}]`);
+    if (!Number.isSafeInteger(offset) || offset < -policy.max_read_bytes) throw new Error(`machine fs read offset must be a safe integer >= -${policy.max_read_bytes}`);
     if (!Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > policy.max_read_bytes) throw new Error(`machine fs max_bytes must be in [1, ${policy.max_read_bytes}]`);
     if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 180000) throw new Error('machine fs read timeout_ms must be in [100, 180000]');
     const grant = await assertCodingReadAllowed(policy, rootId);
     const found = await resolveExisting(policy, grant, rootId, relativePath, 'read', false);
     const info = await lstat(found.resolved);
     if (!info.isFile()) throw new Error('machine fs read target must be a regular file');
+    if (!Number.isSafeInteger(info.size)) throw new Error('machine fs read file size exceeds safe integer range');
     const effectiveOffset = offset < 0 ? Math.max(0, info.size + offset) : offset;
     if (effectiveOffset > info.size) throw new Error('machine fs read offset exceeds file size');
     const length = Math.min(maxBytes, info.size - effectiveOffset);

package/src/remote-authority.mjs

@@ -11,6 +11,16 @@ export function authorityVector(mode='default'){
   });
 }
 
+export function authorityRestorePlan(snapshot){
+  const disarm=[],arm=[];
+  for(const plane of AUTHORITY_PLANES){
+    const entry=snapshot?.authority?.[plane];
+    if(!entry||typeof entry.armed!=='boolean') throw new Error(`authority ${plane} observation invalid`);
+    (entry.armed?arm:disarm).push(`${entry.armed?'arm':'disarm'}${plane}`);
+  }
+  return Object.freeze([...disarm,...arm]);
+}
+
 export function parseAuthorityObservation(raw){
   let value;
   try{value=typeof raw==='string'?JSON.parse(raw.replace(/^\uFEFF/,'')):raw;}

package/src/runtime-update.mjs

@@ -26,6 +26,7 @@ const UPDATE_SCHEMA='deadbyte.r27-slot-update-receipt.v1';
 const HANDOFF_SCHEMA='deadbyte.r27-slot-update-handoff.v1';
 const FAILURE_SCHEMA='deadbyte.r27-slot-update-failure.v1';
 const ROLLBACK_SCHEMA='deadbyte.r31-slot-rollback-receipt.v1';
+const ROLLBACK_FAILURE_SCHEMA='deadbyte.r31-slot-rollback-failure.v1';
 const DEFAULT_STATE_ROOT=undefined;
 const TOP_LAUNCHER=path.join(os.homedir(),'Downloads','DEADBYTE-MCP.cmd');
 const RUNTIME_STABILITY_MS=12000;
@@ -1762,7 +1763,7 @@ export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_S
   const currentCtx=slotContext(state,pointerInfo.pointer),currentRuntime=await captureRuntime(currentCtx);
   const revoked=await revokeAuthority(currentCtx,currentRuntime.status);
   const rollbackId=`r31-rollback-${activationEnvelope.receipt_sha256.slice(0,16)}-${Date.now().toString(36)}-${randomBytes(4).toString('hex')}`;
-  const evidenceDir=path.join(state,'evidence','updates',rollbackId),statePath=path.join(evidenceDir,'state.json'),receiptPath=path.join(evidenceDir,'receipt.json');
+  const evidenceDir=path.join(state,'evidence','updates',rollbackId),statePath=path.join(evidenceDir,'state.json'),receiptPath=path.join(evidenceDir,'receipt.json'),failurePath=path.join(evidenceDir,'failure-receipt.json');
   await mkdir(evidenceDir,{recursive:true});
   const journal={schema:'deadbyte.r31-slot-rollback-state.v1',rollback_id:rollbackId,activation_receipt:path.resolve(receiptFile),
     activation_receipt_sha256:activationEnvelope.receipt_sha256,handoff_path:handoffPath,
@@ -1807,8 +1808,19 @@ export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_S
       }
       try { await startAndVerify(currentCtx,currentRuntime); recovery.successor_runtime_restarted=true; } catch(recoveryError){ recovery.errors.push(`restart-successor:${recoveryError.message}`); }
     }
-    await writeState(statePath,journal,'failed',{error:{name:error?.name??'Error',message:String(error?.message??error)},recovery}).catch(()=>{});
-    const wrapped=new Error(`R31 slot rollback failed: ${error?.message??error}`); wrapped.cause=error; wrapped.statePath=statePath; throw wrapped;
+    const failure={schema:ROLLBACK_FAILURE_SCHEMA,rollback_id:rollbackId,activation_receipt_sha256:activationEnvelope.receipt_sha256,
+      failed_at_utc:new Date().toISOString(),phase:journal.phase??'unknown',from_pointer:publicPointer(activePointer),to_pointer:publicPointer(priorPointer),
+      error:{name:error?.name??'Error',message:String(error?.message??error)},recovery};
+    await writeState(statePath,journal,'failed',{error:failure.error,recovery}).catch(()=>{});
+    let failureReceipt=null;
+    try{
+      failureReceipt=await writeEnvelope(failurePath,failure,key);
+      await writeState(statePath,journal,'failed_receipted',{failure_receipt_path:failurePath,failure_receipt_sha256:failureReceipt.receipt_sha256});
+    }catch(receiptError){
+      recovery.errors.push('failure-receipt:'+receiptError.message);
+      await writeState(statePath,journal,'failed_unreceipted',{recovery,failure_receipt_error:String(receiptError?.message??receiptError)}).catch(()=>{});
+    }
+    const wrapped=new Error(`R31 slot rollback failed: ${error?.message??error}`); wrapped.cause=error; wrapped.statePath=statePath; wrapped.failureReceiptPath=failureReceipt?failurePath:null; throw wrapped;
   }
 }
 

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.38';
+export const DEADBYTE_VERSION = '0.15.41';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/r58-doctor-transactions.test.mjs

@@ -10,12 +10,12 @@ test('R58 bounded transaction inventory flags residue without recovering or over
  assert.equal((await inspectDoctorTransactions(root)).status,'PASS');assert.deepEqual(await readdir(root),[]);
  const transactions=path.join(root,'evidence','updates');await mkdir(transactions,{recursive:true});
  const write=async(name,body)=>{const dir=path.join(transactions,name);await mkdir(dir);const file=path.join(dir,'state.json'),bytes=JSON.stringify(body);await writeFile(file,bytes);return {file,bytes};};
- const done=await write('done',{schema:'deadbyte.r27-slot-update-state.v1',phase:'completed'});
+ const done=await write('done',{schema:'deadbyte.r27-slot-update-state.v1',phase:'superseded'});
  assert.equal((await inspectDoctorTransactions(root)).status,'PASS');
  const pending=await write('pending',{schema:'deadbyte.r31-slot-rollback-state.v1',phase:'prior_pointer_restored',supervisor_pid:process.pid});
  const result=await inspectDoctorTransactions(root);assert.equal(result.status,'WARN');assert.ok(result.findings.some(f=>f.evidence.recorded_phase==='prior_pointer_restored'));
  for(const item of [done,pending])assert.equal(await readFile(item.file,'utf8'),item.bytes);
  const bounded=await inspectDoctorTransactions(root,{maxEntries:1});assert.equal(bounded.status,'WARN');assert.ok(bounded.findings.some(f=>f.evidence.inventory_complete===false));
  const corrupt=await write('corrupt',{schema:'INVALID',phase:'completed'});assert.equal((await inspectDoctorTransactions(root)).status,'FAIL');assert.equal(await readFile(corrupt.file,'utf8'),corrupt.bytes);
- await assert.rejects(inspectDoctorTransactions(root,{maxEntries:257}),/budget invalid/);
+ await assert.rejects(inspectDoctorTransactions(root,{maxEntries:1025}),/budget invalid/);
 });

package/test/r59-tool-surface-compat.test.mjs

@@ -71,7 +71,7 @@ async function captureCurrentSurface(){
   }
 }
 
-test('R59 compact client-visible tool names and schemas match sealed 0.15.35 baseline',async()=>{
+test('R59 compact baseline changes only at the explicitly authorized R64 read-offset bound',async()=>{
   const raw=JSON.parse(await readFile(fixturePath,'utf8'));
   assert.equal(raw.schema,'deadbyte.tool-surface-baseline.v1');
   assert.equal(raw.release_id,'v0.15.35-1b5715b276facbc0');
@@ -82,9 +82,19 @@ test('R59 compact client-visible tool names and schemas match sealed 0.15.35 bas
   const diff=diffToolSurface(baseline,current);
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
-  assert.deepEqual(diff.schema_changed,[]);
-  assert.equal(diff.unchanged.length,43);
-  assert.equal(current.surface_sha256,baseline.surface_sha256);
+  const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
+  if(packageVersion==='0.15.41'){
+    assert.deepEqual(diff.schema_changed,['machine_fs']);
+    assert.equal(diff.unchanged.length,42);
+    const prior=baseline.tools.find(tool=>tool.name==='machine_fs');
+    const present=current.tools.find(tool=>tool.name==='machine_fs');
+    assert.equal(present.output_sha256,prior.output_sha256,'output contract must remain unchanged');
+    assert.notEqual(present.input_sha256,prior.input_sha256,'R64 must expose the widened read offset');
+  }else{
+    assert.deepEqual(diff.schema_changed,[]);
+    assert.equal(diff.unchanged.length,43);
+    assert.equal(current.surface_sha256,baseline.surface_sha256);
+  }
   console.log(JSON.stringify({baseline_release:raw.release_id,surface_sha256:current.surface_sha256,
     unchanged:diff.unchanged.length,added:diff.added,removed:diff.removed,schema_changed:diff.schema_changed}));
 });

package/test/r61-release-contract.test.mjs

@@ -4,13 +4,14 @@ import {readFile} from 'node:fs/promises';
 
 const read=rel=>readFile(new URL('../'+rel,import.meta.url),'utf8');
 const json=rel=>read(rel).then(raw=>JSON.parse(raw.replace(/^\uFEFF/,'')));
+const currentPackage=await json('package.json');
 const PARENT={
   release_id:'v0.15.37-1cfecd7889419da7',
   manifest_sha256:'1cfecd7889419da7800814e3a2a4ffa93d48dfdb0c344a5b7b91fe8d093230aa',
   generation_manifest_sha256:'54842021c75f01bf7ecbd5b10ab8a482ecf107765b45c46f9d39b12bab65eac4'
 };
 
-test('R61 identity binds exact sealed 0.15.37 predecessor without a public surface expansion',async()=>{
+test('R61 identity binds exact sealed 0.15.37 predecessor without a public surface expansion',{skip:currentPackage.version!=='0.15.38'},async()=>{
   const [pkg,lock,bridge,release,provenance,matrix,sbom,version,gate]=await Promise.all([
     json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs'),

package/test/r62-doctor-receipt-semantics.test.mjs

@@ -0,0 +1,50 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdir,mkdtemp,writeFile} from 'node:fs/promises';
+import {generateKeyPairSync,createHash,sign} from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import {inspectDoctorTransactions} from '../src/doctor-transactions-r58.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+ ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
+const canonicalJson=value=>JSON.stringify(canonical(value));
+const domain=Buffer.from('DEADBYTE-R27-SLOT-UPDATE-V1\0');
+function envelope(body,keys){
+ const bodyBytes=Buffer.from(canonicalJson(body),'utf8');
+ const unsigned={body,body_sha256:sha(bodyBytes),attestation:{
+  algorithm:'ed25519',domain:'DEADBYTE-R27-SLOT-UPDATE-V1',
+  key_id:sha(keys.publicKey.export({type:'spki',format:'der'})),
+  signature_base64:sign(null,Buffer.concat([domain,bodyBytes]),keys.privateKey).toString('base64')
+ }};
+ return {...unsigned,receipt_sha256:sha(Buffer.from(canonicalJson(unsigned),'utf8'))};
+}
+
+test('R62 doctor rejects signed success receipts whose rollback semantics contradict their schema',async()=>{
+ const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r62-doctor-receipt-semantics-'));
+ const trust=path.join(root,'trust'),updates=path.join(root,'evidence','updates');
+ await mkdir(trust,{recursive:true});await mkdir(updates,{recursive:true});
+ const keys=generateKeyPairSync('ed25519');
+ await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}));
+
+ const updateDir=path.join(updates,'bad-update-success');await mkdir(updateDir);
+ await writeFile(path.join(updateDir,'state.json'),JSON.stringify({
+  schema:'deadbyte.r27-slot-update-state.v1',update_id:'bad-update-success',phase:'completed'
+ }));
+ await writeFile(path.join(updateDir,'receipt.json'),JSON.stringify(envelope({
+  schema:'deadbyte.r27-slot-update-receipt.v1',update_id:'bad-update-success',rollback_performed:true
+ },keys)));
+
+ const rollbackDir=path.join(updates,'bad-rollback-success');await mkdir(rollbackDir);
+ await writeFile(path.join(rollbackDir,'state.json'),JSON.stringify({
+  schema:'deadbyte.r31-slot-rollback-state.v1',rollback_id:'bad-rollback-success',phase:'completed'
+ }));
+ await writeFile(path.join(rollbackDir,'receipt.json'),JSON.stringify(envelope({
+  schema:'deadbyte.r31-slot-rollback-receipt.v1',rollback_id:'bad-rollback-success',rollback_performed:false
+ },keys)));
+
+ const result=await inspectDoctorTransactions(root);
+ assert.equal(result.status,'FAIL');
+ assert.equal(result.findings.filter(f=>f.evidence?.check==='terminal_receipt_verification').length,2);
+});