deadbyte-mcp 0.15.41 → 0.15.42

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.15.41 / R64 BOUNDED LARGE-FILE READS
+DEADBYTE MCP V0.15.42 / R65 RELEASE CONTROL + AUTHORITY CONTINUITY HARDENING
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -7,12 +7,21 @@ NPX PRIMARY OPERATOR UX
 ------------------------
 Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
 
-  npx -y deadbyte-mcp@0.15.41 mcp
-  npx -y deadbyte-mcp@0.15.41 remote
-  npx -y deadbyte-mcp@0.15.41 remote status
-  npx -y deadbyte-mcp@0.15.41 remote restart
-  npx -y deadbyte-mcp@0.15.41 audit status
-  npx -y deadbyte-mcp@0.15.41 audit verify
+Run npx/npm exec from a directory outside a DEADBYTE source or release tree.
+On Windows the tree also contains DEADBYTE-MCP.cmd; cmd.exe can resolve that
+same-name compatibility launcher before npm's requested package bin. From a
+source tree, use `node src/deadbyte-cli.mjs` to select that source explicitly.
+To request an exact published version, change to a neutral directory first and
+check `--version` before issuing a stateful command. The compatibility CMD
+fails with an explanation when npm is detected rather than forwarding the
+wrong command to the controller.
+
+  npx -y deadbyte-mcp@0.15.42 mcp
+  npx -y deadbyte-mcp@0.15.42 remote
+  npx -y deadbyte-mcp@0.15.42 remote status
+  npx -y deadbyte-mcp@0.15.42 remote restart
+  npx -y deadbyte-mcp@0.15.42 audit status
+  npx -y deadbyte-mcp@0.15.42 audit verify
 
 MAJOR MCP CLIENT STDIO CONFIGS
 -------------------------------
@@ -23,7 +32,7 @@ CLAUDE DESKTOP
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.41", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.42", "mcp"]
       }
     }
   }
@@ -35,7 +44,7 @@ Save as .cursor/mcp.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.41", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.42", "mcp"]
       }
     }
   }
@@ -48,7 +57,7 @@ Save as .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.41", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.42", "mcp"]
       }
     }
   }
@@ -58,7 +67,7 @@ Add to the Codex MCP configuration:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.15.41", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.42", "mcp"]
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.
@@ -346,7 +355,7 @@ CONTROLLER
 ----------
 Primary operator entry point:
 
-  npx -y deadbyte-mcp@0.15.41 remote
+  npx -y deadbyte-mcp@0.15.42 remote
 
 The legacy CMD entry remains compatibility-only for R33 rollback safety.
 
@@ -407,7 +416,7 @@ MCP CLIENT CONFIGURATION
 ------------------------
 The local stdio entry point is quiet and suitable for MCP hosts:
 
-  npx -y deadbyte-mcp@0.15.41 mcp
+  npx -y deadbyte-mcp@0.15.42 mcp
 
 CLAUDE DESKTOP
 Use the standard local-server entry in claude_desktop_config.json:
@@ -416,7 +425,7 @@ Use the standard local-server entry in claude_desktop_config.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.41", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.42", "mcp"]
       }
     }
   }
@@ -429,7 +438,7 @@ Create .cursor/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.41", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.42", "mcp"]
       }
     }
   }
@@ -442,7 +451,7 @@ Create .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.41", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.42", "mcp"]
       }
     }
   }
@@ -452,9 +461,9 @@ Add this to ~/.codex/config.toml:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.15.41", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.42", "mcp"]
 
-The remote device path remains `npx -y deadbyte-mcp@0.15.41 remote`. Remote public MCP uses the
+The remote device path remains `npx -y deadbyte-mcp@0.15.42 remote`. Remote public MCP uses the
 verified HTTPS named-tunnel URL selected by the active generation; do not commit a private device
 URL or tunnel token into a repository.
 

package/RELEASE.json

@@ -1,28 +1,28 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.41",
-  "train": "R64",
-  "label": "BOUNDED LARGE-FILE READS",
+  "version": "0.15.42",
+  "train": "R65",
+  "label": "RELEASE CONTROL AND AUTHORITY CONTINUITY HARDENING",
   "protocol_revision": "2026-07-28",
   "parent": {
-    "version": "0.15.39",
-    "release_id": "v0.15.39-3cda3b1c65b7b7c5",
-    "manifest_sha256": "3cda3b1c65b7b7c561c5a8617156ab87d69cf162f447f3e99a4cb4a76471b3de",
-    "generation_manifest_sha256": "f47cb96083679e764725df1bde6eda53169a39f55772c173ab22f89a1dfaa7ab",
+    "version": "0.15.41",
+    "release_id": "v0.15.41-63a78ad159ad3003",
+    "manifest_sha256": "63a78ad159ad3003db3fefafcd468bef22599c829a867f4f10a46c7a20748b3e",
+    "generation_manifest_sha256": "19ae2efcdcde9f80c474f0e55851d4ada51c22813d3e05af03b11acb28c3fca5",
     "activation_status": "PRODUCTION_ACTIVE"
   },
   "runtime_predecessor": {
-    "release_id": "v0.15.39-3cda3b1c65b7b7c5",
-    "manifest_sha256": "3cda3b1c65b7b7c561c5a8617156ab87d69cf162f447f3e99a4cb4a76471b3de",
-    "generation_manifest_sha256": "f47cb96083679e764725df1bde6eda53169a39f55772c173ab22f89a1dfaa7ab"
+    "release_id": "v0.15.41-63a78ad159ad3003",
+    "manifest_sha256": "63a78ad159ad3003db3fefafcd468bef22599c829a867f4f10a46c7a20748b3e",
+    "generation_manifest_sha256": "19ae2efcdcde9f80c474f0e55851d4ada51c22813d3e05af03b11acb28c3fca5"
   },
   "source_predecessor": {
-    "version": "0.15.40",
-    "source_path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.40-r63",
-    "manifest_file_sha256": "d6f75feada9ad0ae2c248b3a833ac9cf0e04150d2430ddaa70b3dfb64a0b0a86",
-    "manifest_file_count": 2227,
-    "release_status": "NOT_PROVEN_RELEASED"
+    "version": "0.15.41",
+    "source_path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.41-r64",
+    "manifest_file_sha256": "63a78ad159ad3003db3fefafcd468bef22599c829a867f4f10a46c7a20748b3e",
+    "manifest_file_count": 2234,
+    "release_status": "PRODUCTION_RELEASED"
   },
   "consolidation": {
     "frontend_status_vocabulary": true,
@@ -276,5 +276,33 @@
     "package_verification": "PENDING",
     "publication_activation": "PROHIBITED_THIS_TRAIN",
     "release_ready": false
+  },
+  "r65_release_control_hardening": {
+    "public_surface_tool_count": 43,
+    "new_public_tools": 0,
+    "new_authority_scopes": 0,
+    "npm_publication_reconciliation": true,
+    "deterministic_precondition_terminal_receipts": true,
+    "canonical_cli_invocation_regression": true,
+    "durable_per_plane_authority_epoch": true,
+    "policy_security_envelope_binding": true,
+    "epoch_native_cross_generation_restore": true,
+    "legacy_r64_auto_restore": false,
+    "epoch_native_restore_requires_continuity_proof": true,
+    "explicit_revoke_wins": true,
+    "replacement_grant_wins": true,
+    "revoked_nonce_resurrection": false,
+    "restored_grant_requires_fresh_nonce": true,
+    "coding_dependency_protects_autonomous": true,
+    "focused_tests": "PASS_71_OF_71_PRE_METADATA_REFRESH",
+    "full_regression": "PASS_1360_TESTS_1319_PASS_41_DOCUMENTED_SKIP_0_FAIL_PRE_METADATA_REFRESH",
+    "production_mutations": 0,
+    "npm_publications": 0,
+    "stable_final_claim": false,
+    "restored_safe_semantics": "PASS_RED_2_OF_2_THEN_GREEN_2_OF_2",
+    "restored_safe_red_receipt_sha256": "f15f57a54aeb046e366292c4e91bc0b045be0f6a0780eb47fb5fbac596741eee",
+    "restored_safe_green_receipt_sha256": "d859409d33f9f1a165889c5ce4360f2f83b8f4bb66f5b6ab63980b8464678a72",
+    "final_gate_evidence_location": "D:\\Projects\\deadbyte-mcp\\testing\\0.15.42-r65",
+    "final_gate_receipts_external_to_candidate": true
   }
 }

package/SBOM.cdx.json

@@ -1,13 +1,13 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:cdx:deadbyte-mcp:r64:0.15.41",
+  "serialNumber": "urn:cdx:deadbyte-mcp:r65:0.15.42",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "deadbyte-mcp",
-      "version": "0.15.41"
+      "version": "0.15.42"
     }
   },
   "components": [

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.41",
-  "train": "R64",
+  "version": "0.15.42",
+  "train": "R65",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",
@@ -11,29 +11,24 @@
   },
   "required": [
     {
-      "id": "r64-focused",
-      "command": "npm run r64:focused:test",
-      "expected": "PASS R64 release identity, large-file pagination, bounds, replacement visibility, inherited machine fs and bridge/control contracts"
+      "id": "r65-focused",
+      "command": "npm run r65:focused:test",
+      "expected": "PASS R65 publication reconciliation, activation continuity, epoch durability, legacy migration, crash/race and transaction terminality contracts"
     },
     {
-      "id": "r64-full-regression",
+      "id": "r65-full-regression",
       "command": "npm test",
-      "expected": "PASS complete current R64 regression with only documented historical/platform skips"
+      "expected": "PASS complete R65 regression with only documented historical/platform skips"
     },
     {
       "id": "windows-gate",
       "command": "npm run gate:windows",
-      "expected": "PASS exact R63 source manifest and active 0.15.39 runtime predecessor, R64 focused/full regression, manifest verify and doctor"
+      "expected": "PASS exact sealed R64 parent identity, R65 focused/full regression, manifest verify and isolated doctor"
     },
     {
       "id": "package-verify",
       "command": "node scripts/npm-release-r48.mjs --verify-only",
-      "expected": "PASS exact packed surface and isolated package version/doctor execution"
-    },
-    {
-      "id": "r64-read-benchmark",
-      "command": "node scripts/r64-read-benchmark.mjs <R63> <R64> <scratch> <output>",
-      "expected": "PASS alternating same-host R63/R64 read and control-lane measurements without unexplained material regression"
+      "expected": "PASS exact packed surface, registry-safe release checks, isolated package version and doctor without publish"
     }
   ],
   "observed_pre_release_evidence": {
@@ -243,6 +238,72 @@
       "registry": "PENDING",
       "activation_rollback_restore": "PENDING",
       "focused_receipt_sha256": "010db961ecbe0aff98edfa7ee8f7db953f462c94a8e6cf0aaf6c5df229274ba7"
+    },
+    "r65_restored_safe_tdd": {
+      "status": "PASS_RED_THEN_GREEN",
+      "red": {
+        "tests": 2,
+        "passed": 0,
+        "failed": 2,
+        "receipt_id": "092a4b944c7bb653e63908e4",
+        "receipt_sha256": "f15f57a54aeb046e366292c4e91bc0b045be0f6a0780eb47fb5fbac596741eee"
+      },
+      "green": {
+        "tests": 2,
+        "passed": 2,
+        "failed": 0,
+        "receipt_id": "10e1e5a46d1673dd1d0636e7",
+        "receipt_sha256": "d859409d33f9f1a165889c5ce4360f2f83b8f4bb66f5b6ab63980b8464678a72"
+      }
+    },
+    "r65_focused_pre_final_metadata_freeze": {
+      "status": "PASS_PRE_FINAL_METADATA_FREEZE",
+      "tests": 74,
+      "passed": 74,
+      "failed": 0,
+      "skipped": 0,
+      "receipt_id": "ab40025003536ec1cb96692d",
+      "receipt_sha256": "4a6b3c0ecef62f29f1c3b386df56afd711428ab8f2d4db6d081ef3eca1278466",
+      "request_sha256": "86351d039db5c617b49a80c863b1d9880a71c297945f19ff50406638f86b34b3"
+    },
+    "r65_full_regression_pre_final_metadata_freeze": {
+      "status": "PASS_PRE_FINAL_METADATA_FREEZE",
+      "tests": 1363,
+      "passed": 1322,
+      "failed": 0,
+      "skipped": 41,
+      "receipt_id": "b645ec173577da59ff540270",
+      "receipt_sha256": "778638208d42e9b18d7df2d5f9f59ab2623d754a90adcaab859abdab6a251379",
+      "request_sha256": "8ac5a56b5f16f7d0859de91bae7b487fdfa533b8ee6bc27544e7d512b83c43db"
+    },
+    "final_gate_evidence_contract": {
+      "status": "PENDING",
+      "location": "D:\\Projects\\deadbyte-mcp\\testing\\0.15.42-r65",
+      "note": "Final focused/full/Windows/package signed receipts are intentionally external to candidate release bytes to avoid self-referential evidence."
+    },
+    "r65_focused_pre_metadata_refresh_current": {
+      "status": "PASS_PRE_METADATA_REFRESH",
+      "tests": 71,
+      "passed": 71,
+      "failed": 0,
+      "skipped": 0,
+      "receipt_id": "795ac2683d544675eec1388c",
+      "receipt_sha256": "a772ecdaffa32098eaf67bfaca7555ec971e4fa889f25329cb321a65f2f4a0ad",
+      "request_sha256": "2b4a5dc8e01e0207fa930a3c648415443046090628c649514e889b92d32b0ca6"
+    },
+    "r65_full_regression_pre_metadata_refresh_current": {
+      "status": "PASS_PRE_METADATA_REFRESH",
+      "tests": 1360,
+      "passed": 1319,
+      "failed": 0,
+      "skipped": 41,
+      "task_id": "4c2dfd186e985fd446db26e22357f0695a5873932b8f39c446331e35b57ee4f9",
+      "receipt_id": "93dd39c895029a299f5999c7",
+      "receipt_sha256": "424d264ac50c37ce0ef385df7a6d288ba3c22eda2588af0d40f245f8692659dc",
+      "request_sha256": "7467766fdb18558701cc115d4398f6f6e779d5f9a75b24c619333a9e12a918d2",
+      "result_file_sha256": "47a835df560e303bcd15a9cc87f53be88676be421c9cc2addd594ead44cbcd7d",
+      "stdout_sha256": "b96de9c3f24e289b3656c861368333c021c020ba5a6e1e53d502c5b8bb3ed115",
+      "stderr_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
     }
   },
   "inherited_parent_evidence": {
@@ -353,5 +414,36 @@
     "clean_machine": "WAIVED_BY_OPERATOR",
     "reason": "Operator explicitly requested immediate deployment without further testing.",
     "stable_final_claim": false
+  },
+  "r65": {
+    "parent_version": "0.15.41",
+    "parent_release_id": "v0.15.41-63a78ad159ad3003",
+    "parent_manifest_sha256": "63a78ad159ad3003db3fefafcd468bef22599c829a867f4f10a46c7a20748b3e",
+    "parent_generation_manifest_sha256": "19ae2efcdcde9f80c474f0e55851d4ada51c22813d3e05af03b11acb28c3fca5",
+    "public_surface_tool_count": 43,
+    "new_public_tools": 0,
+    "new_authority_scopes": 0,
+    "legacy_r64_auto_restore": false,
+    "epoch_native_restore_requires_continuity_proof": true,
+    "focused_pre_identity": "PASS_69_OF_69",
+    "full_regression_pre_identity": {
+      "tests": 1359,
+      "passed": 1317,
+      "failed": 2,
+      "skipped": 40,
+      "failures": [
+        "r64 historical release-contract harness drift",
+        "r65 expected identity not yet bumped"
+      ]
+    },
+    "prepublish_only": true,
+    "focused_post_identity": "PASS_69_OF_69",
+    "full_regression_post_identity": {
+      "tests": 1361,
+      "passed": 1320,
+      "failed": 0,
+      "skipped": 41,
+      "status": "PASS"
+    }
   }
 }

package/bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-chatgpt-bridge",
-  "version": "0.15.41",
+  "version": "0.15.42",
   "private": true,
   "type": "module",
   "engines": {

package/controller/deadbyte-controller.ps1

@@ -937,6 +937,47 @@ function Assert-PolicyRootsAvailable($Policy, [string]$Plane) {
     return $rootIds
 }
 
+function Get-AuthorityEpochStatus($Cfg, [string]$Plane, [string]$GrantFile, [string]$GrantNonce) {
+    if ([string]::IsNullOrWhiteSpace($GrantNonce) -or $GrantNonce -cnotmatch '^[0-9a-f]{64}$') {
+        return [pscustomobject]@{ Trusted=$false; Reason='epoch-grant-nonce-invalid'; Seq=$null; Action=$null; EventSha256=$null }
+    }
+    try {
+        $verified = Invoke-AuthorityEpochCommand $Cfg $Plane 'status' $GrantFile
+        if (-not $verified.trusted) {
+            return [pscustomobject]@{ Trusted=$false; Reason=[string]$verified.reason; Seq=$verified.seq; Action=$verified.action; EventSha256=$verified.event_sha256 }
+        }
+        return [pscustomobject]@{ Trusted=$true; Reason=[string]$verified.reason; Seq=$verified.seq; Action=$verified.action; EventSha256=$verified.event_sha256 }
+    } catch {
+        return [pscustomobject]@{ Trusted=$false; Reason='authority-epoch-verifier-unavailable'; Seq=$null; Action=$null; EventSha256=$null }
+    }
+}
+
+function Invoke-AuthorityEpochCommand($Cfg, [string]$Plane, [string]$Action, [string]$GrantFile, [string]$UpdateId = '', [string]$ExpectedHead = '') {
+    $cli = Join-Path ([string]$Cfg.CoreRoot) 'src\authority-epoch-cli-r65.mjs'
+    if (-not (Test-Path -LiteralPath $cli -PathType Leaf)) { Fail "authority epoch CLI missing: $cli" }
+    $node = [string]$Cfg.Bridge.FilePath
+    if ([string]::IsNullOrWhiteSpace($node) -or -not (Test-Path -LiteralPath $node -PathType Leaf)) { Fail 'authority epoch Node executable unavailable' }
+    $policyFile = switch ($Plane) {
+        'process' { [string]$Cfg.ProcessPolicyFile }
+        'coding' { [string]$Cfg.CodingPolicyFile }
+        'autonomous' { [string]$Cfg.AutonomousPolicyFile }
+        'desktop' { [string]$Cfg.DesktopPolicyFile }
+        'host' { [string]$Cfg.HostPolicyFile }
+        default { Fail "authority epoch plane invalid: $Plane" }
+    }
+    if ([string]::IsNullOrWhiteSpace($policyFile) -or -not (Test-Path -LiteralPath $policyFile -PathType Leaf)) { Fail "authority epoch policy unavailable for $Plane" }
+    $args = @($cli, $Action, '--plane', $Plane, '--grant-file', $GrantFile, '--policy-file', $policyFile)
+    if ($Action -in @('transaction-revoke','transaction-restore')) {
+        if ([string]::IsNullOrWhiteSpace($UpdateId) -or $ExpectedHead -cnotmatch '^[0-9a-f]{64}$') { Fail 'authority epoch transaction binding invalid' }
+        $args += @('--update-id', $UpdateId, '--expected-head', $ExpectedHead)
+    }
+    $output = @(& $node @args)
+    $exit = $LASTEXITCODE
+    if ($exit -ne 0) { Fail "authority epoch command '$Action' failed for $Plane (exit=$exit)" }
+    try { return (($output -join [Environment]::NewLine) | ConvertFrom-Json) }
+    catch { Fail "authority epoch command '$Action' returned invalid JSON for $Plane" }
+}
+
 function Get-HostPolicyMetadata($Cfg) {
     if ([string]::IsNullOrWhiteSpace([string]$Cfg.HostPolicyFile)) { Fail 'privileged host plane is not configured' }
     $policyPath = [string]$Cfg.HostPolicyFile
@@ -961,7 +1002,10 @@ function Get-HostArmStatus($Cfg) {
     try { $arm = Get-Content -LiteralPath $meta.ArmFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
     if ($arm.schema -ne 'deadbyte.host-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
     if ([string]$arm.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant' }
+    if ([string]$arm.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'host' $meta.ArmFile ([string]$arm.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
 }
 
 function Arm-Host($Cfg) {
@@ -981,15 +1025,23 @@ function Arm-Host($Cfg) {
     $tmp = $meta.ArmFile + '.tmp'
     $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
     Move-Item -LiteralPath $tmp -Destination $meta.ArmFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'host' 'grant' $meta.ArmFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.ArmFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
     Write-Host 'PRIVILEGED HOST PLANE ENABLED UNTIL EXPLICIT REVOKE'
 }
 
 function Disarm-Host($Cfg) {
     $meta = Get-HostPolicyMetadata $Cfg
+    $epochError = $null
     if (Test-Path -LiteralPath $meta.ArmFile) {
-        Remove-Item -LiteralPath $meta.ArmFile -Force -ErrorAction Stop
+        try { Invoke-AuthorityEpochCommand $Cfg 'host' 'user-revoke' $meta.ArmFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $meta.ArmFile -Force -ErrorAction SilentlyContinue
     }
     if (Test-Path -LiteralPath $meta.ArmFile) { throw 'Host authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
     Write-Host 'PRIVILEGED HOST PLANE DISARMED'
 }
 
@@ -1021,10 +1073,13 @@ function Get-ProcessGrantStatus($Cfg) {
     try { $grant = Get-Content -LiteralPath $meta.GrantFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
     if ($grant.schema -ne 'deadbyte.process-grant.v1') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
     if ([string]$grant.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
+    if ([string]$grant.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
     $profiles = @($grant.profile_ids); $roots = @($grant.root_ids)
     if ($profiles.Count -lt 1 -or @($profiles | Where-Object { $_ -notin $meta.ProfileIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='profiles-invalid' } }
     if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant' }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'process' $meta.GrantFile ([string]$grant.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
 }
 
 function Arm-Process($Cfg) {
@@ -1045,12 +1100,23 @@ function Arm-Process($Cfg) {
     $tmp = $meta.GrantFile + '.tmp'
     $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
     Move-Item -LiteralPath $tmp -Destination $meta.GrantFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'process' 'grant' $meta.GrantFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
     Write-Host 'PROCESS PLANE ENABLED UNTIL EXPLICIT REVOKE'
 }
 
 function Disarm-Process($Cfg) {
     $meta = Get-ProcessPolicyMetadata $Cfg
-    Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
+    $epochError = $null
+    if (Test-Path -LiteralPath $meta.GrantFile -PathType Leaf) {
+        try { Invoke-AuthorityEpochCommand $Cfg 'process' 'user-revoke' $meta.GrantFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
+    }
+    if (Test-Path -LiteralPath $meta.GrantFile) { throw 'Process authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
     Write-Host 'PROCESS PLANE DISARMED'
 }
 
@@ -1080,9 +1146,12 @@ function Get-CodingLeaseStatus($Cfg) {
     try { $lease = Get-Content -LiteralPath $meta.LeaseFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
     if ($lease.schema -ne 'deadbyte.coding-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
     if ([string]$lease.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
+    if ([string]$lease.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
     $roots = @($lease.root_ids)
     if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant' }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'coding' $meta.LeaseFile ([string]$lease.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
 }
 
 function Arm-Coding($Cfg) {
@@ -1103,13 +1172,27 @@ function Arm-Coding($Cfg) {
     $tmp = $meta.LeaseFile + '.tmp'
     $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
     Move-Item -LiteralPath $tmp -Destination $meta.LeaseFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'coding' 'grant' $meta.LeaseFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
     Write-Host 'CODING PLANE ENABLED UNTIL EXPLICIT REVOKE'
 }
 
 function Disarm-Coding($Cfg) {
     $meta = Get-CodingPolicyMetadata $Cfg
-    Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
-    try { Disarm-Autonomous $Cfg -Quiet } catch { Write-Warning "autonomous lease cleanup failed after coding revocation: $($_.Exception.Message)" }
+    $epochError = $null
+    if (Test-Path -LiteralPath $meta.LeaseFile -PathType Leaf) {
+        try { Invoke-AuthorityEpochCommand $Cfg 'coding' 'user-revoke' $meta.LeaseFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+    }
+    try { Disarm-Autonomous $Cfg -Quiet } catch {
+        if ($null -eq $epochError) { $epochError = $_.Exception }
+        else { Write-Warning "autonomous lease cleanup failed after coding revocation: $($_.Exception.Message)" }
+    }
+    if (Test-Path -LiteralPath $meta.LeaseFile) { throw 'Coding authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
     Write-Host 'CODING PLANE DISARMED; AUTONOMOUS AUTHORITY REVOKED'
 }
 
@@ -1145,9 +1228,12 @@ function Get-AutonomousLeaseStatus($Cfg) {
     if ($lease.schema -ne 'deadbyte.autonomous-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
     if ([string]$lease.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
     if ([string]$lease.coding_policy_sha256 -ne [string]$meta.CodingPolicySha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='coding-policy-digest' } }
+    if ([string]$lease.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
     $roots = @($lease.root_ids)
     if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant' }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'autonomous' $meta.LeaseFile ([string]$lease.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
 }
 
 function Arm-Autonomous($Cfg) {
@@ -1164,13 +1250,24 @@ function Arm-Autonomous($Cfg) {
     $tmp = $meta.LeaseFile + '.tmp'
     $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
     Move-Item -LiteralPath $tmp -Destination $meta.LeaseFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'autonomous' 'grant' $meta.LeaseFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
     Write-Host 'AUTONOMOUS PLANE ENABLED UNTIL EXPLICIT REVOKE'
 }
 
 function Disarm-Autonomous($Cfg, [switch]$Quiet) {
     if ([string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) { return }
     $meta = Get-AutonomousPolicyMetadata $Cfg
-    Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+    $epochError = $null
+    if (Test-Path -LiteralPath $meta.LeaseFile -PathType Leaf) {
+        try { Invoke-AuthorityEpochCommand $Cfg 'autonomous' 'user-revoke' $meta.LeaseFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+    }
+    if (Test-Path -LiteralPath $meta.LeaseFile) { throw 'Autonomous authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
     if (-not $Quiet) { Write-Host 'AUTONOMOUS PLANE DISARMED' }
 }
 
@@ -1244,7 +1341,9 @@ function Get-DesktopGrantStatus($Cfg) {
     $unique = @($actions | Sort-Object -Unique)
     if ($actions.Count -lt 1 -or $actions.Count -ne $unique.Count) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='actions-invalid'; ActionKinds=@() } }
     if (@($actions | Where-Object { $_ -notin $meta.ActionKinds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='actions-outside-policy'; ActionKinds=@() } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; ActionKinds=$actions }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'desktop' $meta.GrantFile ([string]$grant.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason; ActionKinds=$actions } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; ActionKinds=$actions; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
 }
 
 function Arm-Desktop($Cfg) {
@@ -1265,13 +1364,24 @@ function Arm-Desktop($Cfg) {
     $tmp = $meta.GrantFile + '.tmp'
     $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
     Move-Item -LiteralPath $tmp -Destination $meta.GrantFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'desktop' 'grant' $meta.GrantFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
     Write-Host ("DESKTOP PLANE ENABLED UNTIL EXPLICIT REVOKE [{0}]" -f ($meta.ActionKinds -join ','))
 }
 
 function Disarm-Desktop($Cfg, [switch]$Quiet) {
     $grantFile = Get-DesktopGrantFileForRevoke $Cfg
     if ([string]::IsNullOrWhiteSpace([string]$grantFile)) { return }
-    Remove-Item -LiteralPath $grantFile -Force -ErrorAction SilentlyContinue
+    $epochError = $null
+    if (Test-Path -LiteralPath $grantFile -PathType Leaf) {
+        try { Invoke-AuthorityEpochCommand $Cfg 'desktop' 'user-revoke' $grantFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $grantFile -Force -ErrorAction SilentlyContinue
+    }
+    if (Test-Path -LiteralPath $grantFile) { throw 'Desktop authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
     if (-not $Quiet) { Write-Host 'DESKTOP PLANE DISARMED' }
 }
 
@@ -1346,7 +1456,17 @@ function Convert-OwnedObservation($Owned) {
 }
 
 function Convert-AuthorityObservation($Authority) {
-    [ordered]@{ configured=[bool]$Authority.Configured; armed=[bool]$Authority.Armed; reason=(Get-BoundedObservationReason $Authority.Reason) }
+    $out = [ordered]@{ configured=[bool]$Authority.Configured; armed=[bool]$Authority.Armed; reason=(Get-BoundedObservationReason $Authority.Reason) }
+    $seqProp = $Authority.PSObject.Properties['EpochSeq']
+    $shaProp = $Authority.PSObject.Properties['EpochSha256']
+    if ($null -ne $seqProp -or $null -ne $shaProp) {
+        if ($null -eq $seqProp -or $null -eq $shaProp -or [int64]$seqProp.Value -lt 1 -or [string]$shaProp.Value -cnotmatch '^[0-9a-f]{64}$') {
+            Fail 'authority epoch observation incomplete or invalid'
+        }
+        $out['epoch_seq'] = [int64]$seqProp.Value
+        $out['epoch_sha256'] = [string]$shaProp.Value
+    }
+    return $out
 }
 
 function Get-DownstreamCoreObservation($Cfg, $Bridge) {