deadbyte-mcp 0.15.41 → 0.15.43

package/controller/deadbyte-controller.ps1

@@ -937,6 +937,47 @@ function Assert-PolicyRootsAvailable($Policy, [string]$Plane) {
     return $rootIds
 }
 
+function Get-AuthorityEpochStatus($Cfg, [string]$Plane, [string]$GrantFile, [string]$GrantNonce) {
+    if ([string]::IsNullOrWhiteSpace($GrantNonce) -or $GrantNonce -cnotmatch '^[0-9a-f]{64}$') {
+        return [pscustomobject]@{ Trusted=$false; Reason='epoch-grant-nonce-invalid'; Seq=$null; Action=$null; EventSha256=$null }
+    }
+    try {
+        $verified = Invoke-AuthorityEpochCommand $Cfg $Plane 'status' $GrantFile
+        if (-not $verified.trusted) {
+            return [pscustomobject]@{ Trusted=$false; Reason=[string]$verified.reason; Seq=$verified.seq; Action=$verified.action; EventSha256=$verified.event_sha256 }
+        }
+        return [pscustomobject]@{ Trusted=$true; Reason=[string]$verified.reason; Seq=$verified.seq; Action=$verified.action; EventSha256=$verified.event_sha256 }
+    } catch {
+        return [pscustomobject]@{ Trusted=$false; Reason='authority-epoch-verifier-unavailable'; Seq=$null; Action=$null; EventSha256=$null }
+    }
+}
+
+function Invoke-AuthorityEpochCommand($Cfg, [string]$Plane, [string]$Action, [string]$GrantFile, [string]$UpdateId = '', [string]$ExpectedHead = '') {
+    $cli = Join-Path ([string]$Cfg.CoreRoot) 'src\authority-epoch-cli-r65.mjs'
+    if (-not (Test-Path -LiteralPath $cli -PathType Leaf)) { Fail "authority epoch CLI missing: $cli" }
+    $node = [string]$Cfg.Bridge.FilePath
+    if ([string]::IsNullOrWhiteSpace($node) -or -not (Test-Path -LiteralPath $node -PathType Leaf)) { Fail 'authority epoch Node executable unavailable' }
+    $policyFile = switch ($Plane) {
+        'process' { [string]$Cfg.ProcessPolicyFile }
+        'coding' { [string]$Cfg.CodingPolicyFile }
+        'autonomous' { [string]$Cfg.AutonomousPolicyFile }
+        'desktop' { [string]$Cfg.DesktopPolicyFile }
+        'host' { [string]$Cfg.HostPolicyFile }
+        default { Fail "authority epoch plane invalid: $Plane" }
+    }
+    if ([string]::IsNullOrWhiteSpace($policyFile) -or -not (Test-Path -LiteralPath $policyFile -PathType Leaf)) { Fail "authority epoch policy unavailable for $Plane" }
+    $args = @($cli, $Action, '--plane', $Plane, '--grant-file', $GrantFile, '--policy-file', $policyFile)
+    if ($Action -in @('transaction-revoke','transaction-restore')) {
+        if ([string]::IsNullOrWhiteSpace($UpdateId) -or $ExpectedHead -cnotmatch '^[0-9a-f]{64}$') { Fail 'authority epoch transaction binding invalid' }
+        $args += @('--update-id', $UpdateId, '--expected-head', $ExpectedHead)
+    }
+    $output = @(& $node @args)
+    $exit = $LASTEXITCODE
+    if ($exit -ne 0) { Fail "authority epoch command '$Action' failed for $Plane (exit=$exit)" }
+    try { return (($output -join [Environment]::NewLine) | ConvertFrom-Json) }
+    catch { Fail "authority epoch command '$Action' returned invalid JSON for $Plane" }
+}
+
 function Get-HostPolicyMetadata($Cfg) {
     if ([string]::IsNullOrWhiteSpace([string]$Cfg.HostPolicyFile)) { Fail 'privileged host plane is not configured' }
     $policyPath = [string]$Cfg.HostPolicyFile
@@ -961,7 +1002,10 @@ function Get-HostArmStatus($Cfg) {
     try { $arm = Get-Content -LiteralPath $meta.ArmFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
     if ($arm.schema -ne 'deadbyte.host-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
     if ([string]$arm.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant' }
+    if ([string]$arm.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'host' $meta.ArmFile ([string]$arm.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
 }
 
 function Arm-Host($Cfg) {
@@ -981,15 +1025,23 @@ function Arm-Host($Cfg) {
     $tmp = $meta.ArmFile + '.tmp'
     $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
     Move-Item -LiteralPath $tmp -Destination $meta.ArmFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'host' 'grant' $meta.ArmFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.ArmFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
     Write-Host 'PRIVILEGED HOST PLANE ENABLED UNTIL EXPLICIT REVOKE'
 }
 
 function Disarm-Host($Cfg) {
     $meta = Get-HostPolicyMetadata $Cfg
+    $epochError = $null
     if (Test-Path -LiteralPath $meta.ArmFile) {
-        Remove-Item -LiteralPath $meta.ArmFile -Force -ErrorAction Stop
+        try { Invoke-AuthorityEpochCommand $Cfg 'host' 'user-revoke' $meta.ArmFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $meta.ArmFile -Force -ErrorAction SilentlyContinue
     }
     if (Test-Path -LiteralPath $meta.ArmFile) { throw 'Host authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
     Write-Host 'PRIVILEGED HOST PLANE DISARMED'
 }
 
@@ -1021,10 +1073,13 @@ function Get-ProcessGrantStatus($Cfg) {
     try { $grant = Get-Content -LiteralPath $meta.GrantFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
     if ($grant.schema -ne 'deadbyte.process-grant.v1') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
     if ([string]$grant.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
+    if ([string]$grant.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
     $profiles = @($grant.profile_ids); $roots = @($grant.root_ids)
     if ($profiles.Count -lt 1 -or @($profiles | Where-Object { $_ -notin $meta.ProfileIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='profiles-invalid' } }
     if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant' }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'process' $meta.GrantFile ([string]$grant.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
 }
 
 function Arm-Process($Cfg) {
@@ -1045,12 +1100,23 @@ function Arm-Process($Cfg) {
     $tmp = $meta.GrantFile + '.tmp'
     $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
     Move-Item -LiteralPath $tmp -Destination $meta.GrantFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'process' 'grant' $meta.GrantFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
     Write-Host 'PROCESS PLANE ENABLED UNTIL EXPLICIT REVOKE'
 }
 
 function Disarm-Process($Cfg) {
     $meta = Get-ProcessPolicyMetadata $Cfg
-    Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
+    $epochError = $null
+    if (Test-Path -LiteralPath $meta.GrantFile -PathType Leaf) {
+        try { Invoke-AuthorityEpochCommand $Cfg 'process' 'user-revoke' $meta.GrantFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
+    }
+    if (Test-Path -LiteralPath $meta.GrantFile) { throw 'Process authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
     Write-Host 'PROCESS PLANE DISARMED'
 }
 
@@ -1080,9 +1146,12 @@ function Get-CodingLeaseStatus($Cfg) {
     try { $lease = Get-Content -LiteralPath $meta.LeaseFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
     if ($lease.schema -ne 'deadbyte.coding-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
     if ([string]$lease.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
+    if ([string]$lease.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
     $roots = @($lease.root_ids)
     if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant' }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'coding' $meta.LeaseFile ([string]$lease.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
 }
 
 function Arm-Coding($Cfg) {
@@ -1103,13 +1172,27 @@ function Arm-Coding($Cfg) {
     $tmp = $meta.LeaseFile + '.tmp'
     $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
     Move-Item -LiteralPath $tmp -Destination $meta.LeaseFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'coding' 'grant' $meta.LeaseFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
     Write-Host 'CODING PLANE ENABLED UNTIL EXPLICIT REVOKE'
 }
 
 function Disarm-Coding($Cfg) {
     $meta = Get-CodingPolicyMetadata $Cfg
-    Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
-    try { Disarm-Autonomous $Cfg -Quiet } catch { Write-Warning "autonomous lease cleanup failed after coding revocation: $($_.Exception.Message)" }
+    $epochError = $null
+    if (Test-Path -LiteralPath $meta.LeaseFile -PathType Leaf) {
+        try { Invoke-AuthorityEpochCommand $Cfg 'coding' 'user-revoke' $meta.LeaseFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+    }
+    try { Disarm-Autonomous $Cfg -Quiet } catch {
+        if ($null -eq $epochError) { $epochError = $_.Exception }
+        else { Write-Warning "autonomous lease cleanup failed after coding revocation: $($_.Exception.Message)" }
+    }
+    if (Test-Path -LiteralPath $meta.LeaseFile) { throw 'Coding authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
     Write-Host 'CODING PLANE DISARMED; AUTONOMOUS AUTHORITY REVOKED'
 }
 
@@ -1145,9 +1228,12 @@ function Get-AutonomousLeaseStatus($Cfg) {
     if ($lease.schema -ne 'deadbyte.autonomous-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
     if ([string]$lease.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
     if ([string]$lease.coding_policy_sha256 -ne [string]$meta.CodingPolicySha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='coding-policy-digest' } }
+    if ([string]$lease.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
     $roots = @($lease.root_ids)
     if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant' }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'autonomous' $meta.LeaseFile ([string]$lease.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
 }
 
 function Arm-Autonomous($Cfg) {
@@ -1164,13 +1250,24 @@ function Arm-Autonomous($Cfg) {
     $tmp = $meta.LeaseFile + '.tmp'
     $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
     Move-Item -LiteralPath $tmp -Destination $meta.LeaseFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'autonomous' 'grant' $meta.LeaseFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
     Write-Host 'AUTONOMOUS PLANE ENABLED UNTIL EXPLICIT REVOKE'
 }
 
 function Disarm-Autonomous($Cfg, [switch]$Quiet) {
     if ([string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) { return }
     $meta = Get-AutonomousPolicyMetadata $Cfg
-    Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+    $epochError = $null
+    if (Test-Path -LiteralPath $meta.LeaseFile -PathType Leaf) {
+        try { Invoke-AuthorityEpochCommand $Cfg 'autonomous' 'user-revoke' $meta.LeaseFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+    }
+    if (Test-Path -LiteralPath $meta.LeaseFile) { throw 'Autonomous authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
     if (-not $Quiet) { Write-Host 'AUTONOMOUS PLANE DISARMED' }
 }
 
@@ -1244,7 +1341,9 @@ function Get-DesktopGrantStatus($Cfg) {
     $unique = @($actions | Sort-Object -Unique)
     if ($actions.Count -lt 1 -or $actions.Count -ne $unique.Count) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='actions-invalid'; ActionKinds=@() } }
     if (@($actions | Where-Object { $_ -notin $meta.ActionKinds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='actions-outside-policy'; ActionKinds=@() } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; ActionKinds=$actions }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'desktop' $meta.GrantFile ([string]$grant.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason; ActionKinds=$actions } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; ActionKinds=$actions; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
 }
 
 function Arm-Desktop($Cfg) {
@@ -1265,13 +1364,24 @@ function Arm-Desktop($Cfg) {
     $tmp = $meta.GrantFile + '.tmp'
     $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
     Move-Item -LiteralPath $tmp -Destination $meta.GrantFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'desktop' 'grant' $meta.GrantFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
     Write-Host ("DESKTOP PLANE ENABLED UNTIL EXPLICIT REVOKE [{0}]" -f ($meta.ActionKinds -join ','))
 }
 
 function Disarm-Desktop($Cfg, [switch]$Quiet) {
     $grantFile = Get-DesktopGrantFileForRevoke $Cfg
     if ([string]::IsNullOrWhiteSpace([string]$grantFile)) { return }
-    Remove-Item -LiteralPath $grantFile -Force -ErrorAction SilentlyContinue
+    $epochError = $null
+    if (Test-Path -LiteralPath $grantFile -PathType Leaf) {
+        try { Invoke-AuthorityEpochCommand $Cfg 'desktop' 'user-revoke' $grantFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $grantFile -Force -ErrorAction SilentlyContinue
+    }
+    if (Test-Path -LiteralPath $grantFile) { throw 'Desktop authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
     if (-not $Quiet) { Write-Host 'DESKTOP PLANE DISARMED' }
 }
 
@@ -1346,7 +1456,17 @@ function Convert-OwnedObservation($Owned) {
 }
 
 function Convert-AuthorityObservation($Authority) {
-    [ordered]@{ configured=[bool]$Authority.Configured; armed=[bool]$Authority.Armed; reason=(Get-BoundedObservationReason $Authority.Reason) }
+    $out = [ordered]@{ configured=[bool]$Authority.Configured; armed=[bool]$Authority.Armed; reason=(Get-BoundedObservationReason $Authority.Reason) }
+    $seqProp = $Authority.PSObject.Properties['EpochSeq']
+    $shaProp = $Authority.PSObject.Properties['EpochSha256']
+    if ($null -ne $seqProp -or $null -ne $shaProp) {
+        if ($null -eq $seqProp -or $null -eq $shaProp -or [int64]$seqProp.Value -lt 1 -or [string]$shaProp.Value -cnotmatch '^[0-9a-f]{64}$') {
+            Fail 'authority epoch observation incomplete or invalid'
+        }
+        $out['epoch_seq'] = [int64]$seqProp.Value
+        $out['epoch_sha256'] = [string]$shaProp.Value
+    }
+    return $out
 }
 
 function Get-DownstreamCoreObservation($Cfg, $Bridge) {

package/controller/deadbyte-process-policy.json

@@ -1,15 +1,15 @@
 {
   "schema": "deadbyte.process-policy.v1",
   "enabled": true,
-  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.41-r64\\controller\\runtime\\process-grant.json",
-  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.41-r64\\controller\\runtime\\process-state",
+  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.43-r66\\controller\\runtime\\process-grant.json",
+  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.43-r66\\controller\\runtime\\process-state",
   "native_host": {
-    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.41-r64\\bin\\deadbyte-process-host.exe",
+    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.43-r66\\bin\\deadbyte-process-host.exe",
     "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {
-      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.41-r64",
+      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.43-r66",
       "deny_paths": [
         "node_modules",
         "controller/runtime",

package/docs/R65-AUTHORITY-CONTINUITY-DESIGN.json

@@ -0,0 +1,27 @@
+{
+  "schema": "deadbyte.r65-authority-continuity-design.v1",
+  "status": "PARTIAL_IMPLEMENTATION",
+  "authority": "Current R65 candidate source and read-only R64 generation policies; production remains immutable.",
+  "observed_contracts": {
+    "controller": "controller/deadbyte-controller.ps1 Get-*GrantStatus checks schema and policy_sha256; Process/Coding/Autonomous/Desktop additionally carry scope and instance_nonce; Host carries nonce but no explicit scope.",
+    "process": "src/process-policy.mjs rechecks policy hash, nonce, profile_ids and root_ids; grant schema deadbyte.process-grant.v1.",
+    "coding": "src/coding-plane.mjs rechecks policy hash, nonce and root_ids; standing grant schema deadbyte.coding-grant.v2.",
+    "autonomous": "controller/deadbyte-controller.ps1 requires a Coding grant, coding_policy_sha256 and root_ids; grant schema deadbyte.autonomous-grant.v2.",
+    "desktop": "src/desktop-policy-r40.mjs and controller validate policy hash, nonce and action_kinds; grant schema deadbyte.desktop-grant.v1.",
+    "host": "controller/deadbyte-controller.ps1 validates policy hash; grant schema deadbyte.host-grant.v2 includes instance_nonce and granted_at_utc but no scoped IDs.",
+    "revocation": "R64 controller arm/disarm replace/delete grant files but expose no durable monotonic per-plane revocation epoch or transaction-owned temporary revoke. An absent grant after temporary revoke cannot prove no independent user revoke occurred."
+  },
+  "selected_method": {
+    "policy_envelope": "Derive canonical authority-bearing fields from each known policy schema; omit only operational grant/evidence storage paths and presentation descriptions. Unknown fields fail closed. Raw policy SHA remains evidence, not the sole ceiling comparator.",
+    "comparison": "EQUAL, NARROWER, WIDER, UNVERIFIED. Added capabilities, relaxed deny rules and larger ceilings are WIDER. Changed executable/native pins or disjoint roots are UNVERIFIED. Both deny automatic restoration.",
+    "r64_predecessor_continuity": "Because R64 has no durable revocation epoch, an armed predecessor cannot receive automatic cross-generation restoration. Outcome must be REAUTH_REQUIRED and disarmed unless a later explicit user grant is observed.",
+    "updater_boundary": "One restoration engine is required. The current inner updater's Process/Coding/Autonomous re-arm must be disabled or constrained by a verified continuity plan before any R65 activation with standing authority is permitted.",
+    "current_safety_guard": "scripts/deploy-r48.mjs --preflight returns AUTHORITY_POLICY_UNVERIFIED for armed vectors before opening an update transaction. This guard must not be removed until continuity integration is proven."
+  },
+  "acceptance_open": [
+    "Read-only capture of exact grant bytes and scope, bound to predecessor release/generation and candidate manifest.",
+    "Durable transaction-owned revocation epoch with crash-safe exclusion of external revocation/replacement.",
+    "Single restoration decision path across updater and deploy; separate runtime and authority outcomes.",
+    "Isolated end-to-end activation, interruption, rollback and independent receipt verification."
+  ]
+}

package/docs/R65-REFERENCE-GAP-MATRIX.json

@@ -0,0 +1,22 @@
+{
+  "schema": "deadbyte.r65-reference-gap-matrix.v1",
+  "purpose": "Release/control-plane mechanisms only; donor source is read-only and no donor bytes are copied.",
+  "license_review": {
+    "better-remote-commander": "package.json declares MIT; no source bytes copied",
+    "cua": "pyproject.toml declares MIT; no source bytes copied",
+    "desktop-commander": "root LICENSE declares MIT; no source bytes copied",
+    "open-remote-mcp": "no root LICENSE or package declaration confirmed in this pass; architecture principle only, no source bytes copied",
+    "remcp": "package.json declares MIT; no source bytes copied",
+    "secure-host-mcp": "package.json declares MIT; no source bytes copied",
+    "winremote-mcp": "pyproject.toml declares MIT; no source bytes copied"
+  },
+  "decisions": [
+    {"reference":"better-remote-commander","evidence_path":"packages/agent/src/transport/ws-client.ts","mechanism":"bounded exponential reconnect and explicit unauthorized branch","deadbyte_comparison":"R64 has remote guardian and recovery, but npm visibility after accepted publish was not reconciled","decision":"ADAPT","r65_action":"bounded registry availability polling and terminal/unknown classification; no relay or multi-device import"},
+    {"reference":"cua","evidence_path":"rfcs/3007-cua-driver-lifecycle-sessions.md","mechanism":"idempotent lifecycle cleanup and host-held resume identity","deadbyte_comparison":"DEADBYTE has owned supervisor and signed transaction evidence; deterministic precondition failures still need terminality","decision":"ADAPT","r65_action":"preflight/transaction boundary tests and exact ownership preservation; no desktop redesign"},
+    {"reference":"desktop-commander","evidence_path":"dist/utils/toolHistory.js","mechanism":"bounded presentation history and trim target","deadbyte_comparison":"DEADBYTE evidence durability and bounded LIVELOG are stronger for authoritative release receipts","decision":"KEEP-OURS","r65_action":"do not batch or trim authoritative transaction journals"},
+    {"reference":"open-remote-mcp","evidence_path":"docs/ARCHITECTURE.md","mechanism":"relay policy may narrow but local device remains final enforcement","deadbyte_comparison":"DEADBYTE already enforces local authority planes; activation restore must preserve exact vector","decision":"KEEP-OURS","r65_action":"regress no-widening during activation orchestration"},
+    {"reference":"remcp","evidence_path":"packages/client/test/cli-update-runtime.test.mjs","mechanism":"separate client/runtime update and coherence checks","deadbyte_comparison":"DEADBYTE has immutable slots and version binding; exact-version npm invocation needs reproducible tests","decision":"ADAPT","r65_action":"CLI/package resolution matrix and isolated install test without runtime dependency"},
+    {"reference":"secure-host-mcp","evidence_path":"src/runtime.ts","mechanism":"explicit bounded runtime state vocabulary","deadbyte_comparison":"DEADBYTE has verified identities but activation preflight was not a separate read-only state classification","decision":"ADAPT","r65_action":"typed preflight classification; reject dirty/unknown state before mutation"},
+    {"reference":"winremote-mcp","evidence_path":"src/winremote/process_mgr.py","mechanism":"Windows process enumeration with stale-process handling","deadbyte_comparison":"DEADBYTE ledger binds PID to creation identity and hash, stronger than PID/name kill paths","decision":"SKIP","r65_action":"retain verified ownership; never adopt caller-selected PID/name termination"}
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.41",
+  "version": "0.15.43",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
@@ -8,7 +8,7 @@
     "node": ">=22"
   },
   "scripts": {
-    "test": "node --test test/*.test.mjs",
+    "test": "node --test --test-concurrency=4 test/*.test.mjs",
     "manifest:write": "node scripts/release-manifest.mjs write",
     "manifest:verify": "node scripts/release-manifest.mjs verify",
     "r41:parent:verify": "node scripts/verify-r41-parent.mjs",
@@ -42,7 +42,7 @@
     "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
     "contained:smoke": "node src/contained-smoke.mjs",
     "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r64-prepublish.ps1",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r66-prepublish.ps1",
     "authority:smoke": "node src/authority-smoke.mjs",
     "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
     "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
@@ -89,7 +89,9 @@
     "r61:focused:test": "node --test --test-concurrency=1 test/r61-release-contract.test.mjs test/r61-release-bridge-binding.test.mjs test/r61-control-lane.test.mjs test/r61-live-timeline-bounds.test.mjs test/r61-npm-artifact-identity.test.mjs test/remote-live-log-r37.test.mjs test/bridge-runtime-r59.test.mjs test/commander-schema-differential-r48.test.mjs test/package-boundary.test.mjs test/r60-bridge-dispatch.test.mjs test/r60-authority-enforcement.test.mjs",
     "r62:focused:test": "node --test --test-concurrency=1 test/r62-release-contract.test.mjs test/r62-doctor-transactions-reconcile.test.mjs test/r62-doctor-receipt-semantics.test.mjs test/r62-rollback-failure-receipt.test.mjs test/r58-doctor-transactions.test.mjs test/r58-completed-update-receipt.test.mjs test/runtime-self-update.test.mjs test/r56-rollback-launcher-restore.test.mjs",
     "r63:focused:test": "node --test --test-concurrency=1 test/r63-release-contract.test.mjs test/r63-one-shot-coherence.test.mjs test/r51-runtime-coherence.test.mjs test/remote-session-cli.test.mjs",
-    "r64:focused:test": "node --test --test-concurrency=1 test/r64-release-contract.test.mjs test/r64-machine-fs-large-read.test.mjs test/machine-fs-runtime.test.mjs test/compact-gateway-r36.test.mjs test/r61-control-lane.test.mjs test/r60-bridge-dispatch.test.mjs"
+    "r64:focused:test": "node --test --test-concurrency=1 test/r64-release-contract.test.mjs test/r64-machine-fs-large-read.test.mjs test/machine-fs-runtime.test.mjs test/compact-gateway-r36.test.mjs test/r61-control-lane.test.mjs test/r60-bridge-dispatch.test.mjs",
+    "r65:focused:test": "node scripts/r65-focused.mjs",
+    "r66:focused:test": "node --test --test-concurrency=1 test/r66-release-contract.test.mjs test/r58-doctor-runtime.test.mjs test/r58-doctor-foreground.test.mjs test/r58-doctor-installation.test.mjs test/r65-controller-authority-epoch.test.mjs test/r65-authority-observation-epoch.test.mjs"
   },
   "bundleDependencies": [
     "@modelcontextprotocol/server",

package/scripts/deploy-r48.mjs

@@ -1,17 +1,91 @@
-import { createHash } from 'node:crypto';
-import { readFile, access } from 'node:fs/promises';
+import { createHash,randomBytes } from 'node:crypto';
+import { readFile, access,open,mkdir,unlink,lstat } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { runSlotUpdateCli } from '../src/runtime-update.mjs';
+import { runSlotUpdateCli,windowsPowerShellEnvironment,loadPowerShellDataFile } from '../src/runtime-update.mjs';
 import { parseActivePointer } from '../src/release-slot.mjs';
+import {parseAuthorityObservation} from '../src/remote-authority.mjs';
+import {classifyActivationPreflight,classifyAuthorityContinuity,orchestrateActivation} from '../src/activation-preflight-r65.mjs';
+import {createEpochNativeContinuityEngine} from '../src/activation-continuity-engine-r65.mjs';
+import {createActivationClaimManager} from '../src/activation-lock-r65.mjs';
 
 const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
 const state=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
 const sha=async f=>createHash('sha256').update(await readFile(f)).digest('hex');
 const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
 
+async function writeExclusive(file,value){
+  const handle=await open(file,'wx',0o600);
+  try{await handle.writeFile(JSON.stringify(value)+'\n');await handle.sync();}
+  finally{await handle.close();}
+}
+
+const activationClaimManager=createActivationClaimManager({stateRoot:state});
+let activationClaimOperationId=null;
+
+async function claimActivation(subjectSha256){
+  const claim=await activationClaimManager.claim(subjectSha256);
+  activationClaimOperationId=claim.operation_id;
+  return claim.release;
+}
+
+async function activePolicyPaths(){
+  const active=parseActivePointer(await readFile(path.join(state,'active-release.json'),'utf8'));
+  const config=await loadPowerShellDataFile(active.config_path);
+  const fields={process:'ProcessPolicyFile',coding:'CodingPolicyFile',autonomous:'AutonomousPolicyFile',desktop:'DesktopPolicyFile',host:'HostPolicyFile'};
+  return Object.fromEntries(Object.entries(fields).map(([plane,key])=>{
+    const file=config[key];
+    return [plane,typeof file==='string'&&path.isAbsolute(file)?path.resolve(file):null];
+  }));
+}
+
+async function observeController(){
+  const launcher=path.join(state,'bin','DEADBYTE-MCP.ps1');
+  const powershell=path.join(process.env.SystemRoot||'C:\\Windows','System32','WindowsPowerShell','v1.0','powershell.exe');
+  const run=spawnSync(powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,'status','-Json'],{
+    cwd:root,env:windowsPowerShellEnvironment(),encoding:'utf8',timeout:20000,stdio:['ignore','pipe','pipe'],windowsHide:true});
+  if(run.error||run.status!==0)throw new Error(`activation preflight controller observation failed exit=${run.status} code=${run.error?.code??'none'}`);
+  const observed=parseAuthorityObservation(run.stdout);
+  const active=parseActivePointer(await readFile(path.join(state,'active-release.json'),'utf8'));
+  const policyPaths=await activePolicyPaths(),policySha256={};
+  for(const [plane,file] of Object.entries(policyPaths)){
+    if(!observed.authority[plane].configured){policySha256[plane]=null;continue;}
+    if(typeof file!=='string'||!path.isAbsolute(file))throw new Error(`activation ${plane} policy path missing`);
+    const info=await lstat(file);
+    if(!info.isFile()||info.isSymbolicLink())throw new Error(`activation ${plane} policy must be a regular file`);
+    policySha256[plane]=await sha(file);
+  }
+  return {...observed,policy_sha256:policySha256,policy_paths:policyPaths,active_release_id:active.release_id,active_manifest_sha256:active.manifest_sha256,
+    active_generation_manifest_sha256:active.generation_manifest_sha256};
+}
+
+function controllerCommand(command){
+  if(!/^(?:arm|disarm)(?:process|coding|autonomous|desktop|host)$|^supervisorstop$|^stop$/.test(command))throw new Error('activation controller command not declared');
+  const launcher=path.join(state,'bin','DEADBYTE-MCP.ps1');
+  const powershell=path.join(process.env.SystemRoot||'C:\\Windows','System32','WindowsPowerShell','v1.0','powershell.exe');
+  const run=spawnSync(powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,command],{
+    cwd:root,env:windowsPowerShellEnvironment(),encoding:'utf8',timeout:30000,stdio:['ignore','pipe','pipe'],windowsHide:true});
+  if(run.error||run.status!==0)throw new Error(`activation controller ${command} failed exit=${run.status} code=${run.error?.code??'none'}`);
+}
+
+async function activationPreflight(manifest,pkg,pointer){
+  const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
+  const observed=await observeController();
+  const result=classifyActivationPreflight({pointer,expectedParent:release.parent,
+    candidate:{version:pkg.version,manifest_sha256:manifest},
+    expectedCandidate:{version:release.version,manifest_sha256:manifest},observation:observed});
+  const continuity=classifyAuthorityContinuity(observed);
+  if(continuity.state==='UNVERIFIED')return {...result,state:'AUTHORITY_CONTINUITY_UNVERIFIED',safe_to_activate:false,
+    reason:continuity.reason??'authority continuity observation unverified',authority_continuity:'UNVERIFIED',reauth_planes:continuity.reauth_planes??[]};
+  if(continuity.state==='EPOCH_NATIVE')return {...result,authority_continuity:'EPOCH_NATIVE',
+    epoch_planes:continuity.epoch_planes??[],reauth_planes:[]};
+  if(continuity.state==='LEGACY_REAUTH_REQUIRED'||continuity.state==='MIXED_REAUTH_REQUIRED')
+    return {...result,authority_continuity:'REAUTH_REQUIRED',reauth_planes:continuity.reauth_planes??continuity.armed_planes??[]};
+  return {...result,authority_continuity:'NOT_APPLICABLE',reauth_planes:[]};
+}
+
 async function waitForActivation({handoffPath,expectedVersion,expectedManifest,timeoutMs=900000,pollMs=1000}){
   const evidenceDir=path.dirname(path.resolve(handoffPath));
   const statePath=path.join(evidenceDir,'state.json');
@@ -62,6 +136,15 @@ const bridgeRoot=path.join(root,'bridge');
 const bridgeScript=path.join(bridgeRoot,'src','bridge.mjs');
 const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
 const expectedVersion=pkg.version;
+const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
+const preflight=await activationPreflight(manifest,pkg,pointer);
+if(process.argv.includes('--preflight')){
+  console.log(JSON.stringify(preflight));
+  process.exit(0);
+}
+if(process.argv.length>2)throw new Error('deploy accepts only --preflight');
+if(!['ONLINE_READY','ONLINE_HOST_ARMED','PARKED_DIRTY','OFFLINE_CLEAN'].includes(preflight.state))
+  throw new Error(`activation preflight rejected: ${preflight.state} subject=${preflight.subject_sha256??'<incomplete>'}`);
 const args=[
   '--stage',root,'--development-root',root,'--expected-version',expectedVersion,'--expected-manifest',manifest,
   '--process-policy',path.join(root,'controller','deadbyte-process-policy.json'),'--process-policy-sha256',await sha(path.join(root,'controller','deadbyte-process-policy.json')),
@@ -70,9 +153,40 @@ const args=[
   '--bridge-root',bridgeRoot,'--bridge-script-sha256',await sha(bridgeScript),
   '--enable-machine-fs','--enable-observation','--enable-desktop','--enable-autonomous-supervisor','--recover-offline-predecessor'
 ];
-const result=await runSlotUpdateCli(args,{stateRoot:state});
-if(!result.handed_off) throw new Error('release activation unexpectedly completed inline; refusing to skip post-activation verification');
-const verification=await waitForActivation({handoffPath:result.handoff_path,expectedVersion,expectedManifest:manifest});
+let result=null,verification=null,activationOutcomePath=null;
+let continuityEngine=null,continuityUpdateId=null;
+
+async function recordActivationOutcome(outcome){
+  if(typeof activationClaimOperationId!=='string')throw new Error('activation claim operation id unavailable');
+  const outcomeFile=path.join(state,'evidence','updates',`r65-activation-outcome-${Date.now()}-${randomBytes(8).toString('hex')}.json`);
+  await writeExclusive(outcomeFile,{schema:'deadbyte.r65-activation-outcome.v1',claim_operation_id:activationClaimOperationId,
+    candidate_version:expectedVersion,candidate_manifest_sha256:manifest,
+    predecessor_release_id:pointer.release_id,preflight_subject_sha256:preflight.subject_sha256,outcome,
+    update_id:result?.update_id??null,continuity_update_id:continuityUpdateId,
+    state_path:result?.state_path??null,observed_at_utc:new Date().toISOString()});
+  activationOutcomePath=outcomeFile;
+}
+
+if(preflight.authority_continuity==='EPOCH_NATIVE'){
+  const predecessorObservation=await observeController();
+  continuityUpdateId=`r65-${randomBytes(16).toString('hex')}`;
+  continuityEngine=createEpochNativeContinuityEngine({stateRoot:state,predecessorPolicyPaths:predecessorObservation.policy_paths,
+    successorPolicyPaths:async()=>activePolicyPaths(),updateId:continuityUpdateId});
+}
+const outcome=await orchestrateActivation({pointer,expectedParent:release.parent,
+  candidate:{version:expectedVersion,manifest_sha256:manifest},expectedCandidate:{version:release.version,manifest_sha256:manifest},
+  observe:async()=>observeController(),command:async command=>controllerCommand(command),claim:claimActivation,continuityEngine,
+  recordOutcome:recordActivationOutcome,
+  activate:async()=>{
+    result=await runSlotUpdateCli(args,{stateRoot:state});
+    if(!result.handed_off)throw new Error('release activation unexpectedly completed inline');
+    verification=await waitForActivation({handoffPath:result.handoff_path,expectedVersion,expectedManifest:manifest});
+    return {verified:true,release_id:verification.release_id};
+  }});
+if(outcome.state!=='ACTIVATED'){
+  console.log(JSON.stringify({...outcome,update_id:result?.update_id??null,state_path:result?.state_path??null,outcome_path:activationOutcomePath}));
+  process.exitCode=2;
+}else{
 console.log(JSON.stringify({
   status:'activated',
   manifest_sha256:manifest,
@@ -81,5 +195,7 @@ console.log(JSON.stringify({
   supervisor_pid:result.supervisor_pid,
   release_id:verification.release_id,
   receipt_path:verification.receiptPath,
-  state_path:verification.statePath
+  state_path:verification.statePath,
+  outcome_path:activationOutcomePath
 },null,2));
+}

package/scripts/gate-windows-r65-prepublish.ps1

@@ -0,0 +1,65 @@
+param(
+  [ValidateSet('all','preflight','focused','full','manifest','doctor')]
+  [string]$Stage='all'
+)
+
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version 3.0
+$root=Split-Path $PSScriptRoot -Parent
+Set-Location -LiteralPath $root
+
+function Invoke-Npm([string]$Name,[string[]]$NpmArgs){
+  Write-Host "==== $Name ===="
+  & npm.cmd @NpmArgs
+  if($LASTEXITCODE -ne 0){ throw "R65 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+
+function Get-FileSha256([string]$File){
+  $hasher=[Security.Cryptography.SHA256]::Create()
+  try{
+    $bytes=[IO.File]::ReadAllBytes($File)
+    return (($hasher.ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') }) -join '')
+  }finally{ $hasher.Dispose() }
+}
+
+$sourceRoot='D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.41-r64'
+$sourceManifest='63a78ad159ad3003db3fefafcd468bef22599c829a867f4f10a46c7a20748b3e'
+if(-not (Test-Path -LiteralPath $sourceRoot -PathType Container)){ throw 'R65 source predecessor missing' }
+$observedSourceManifest=Get-FileSha256 (Join-Path $sourceRoot 'MANIFEST.SHA256')
+if($observedSourceManifest -ne $sourceManifest){ throw 'R65 source predecessor manifest identity mismatch' }
+& node (Join-Path $root 'scripts\\verify-r65-parent-source.mjs') --root $sourceRoot --expected-manifest-sha256 $sourceManifest
+if($LASTEXITCODE -ne 0){ throw 'R65 source predecessor declared-manifest verification failed' }
+
+$stateRoot=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$pointer=Join-Path $stateRoot 'active-release.json'
+if(-not (Test-Path -LiteralPath $pointer -PathType Leaf)){ throw "R65 runtime predecessor pointer missing: $pointer" }
+$active=Get-Content -LiteralPath $pointer -Raw | ConvertFrom-Json
+if($active.release_id -ne 'v0.15.41-63a78ad159ad3003'){ throw "R65 runtime predecessor release mismatch: $($active.release_id)" }
+if($active.manifest_sha256 -ne '63a78ad159ad3003db3fefafcd468bef22599c829a867f4f10a46c7a20748b3e'){ throw 'R65 runtime predecessor manifest mismatch' }
+if($active.generation_manifest_sha256 -ne '19ae2efcdcde9f80c474f0e55851d4ada51c22813d3e05af03b11acb28c3fca5'){ throw 'R65 runtime predecessor generation mismatch' }
+if($Stage -eq 'preflight'){Write-Host '==== R65 WINDOWS GATE: PASS preflight ====';return}
+
+if($Stage -eq 'all' -or $Stage -eq 'focused'){
+  Invoke-Npm 'r65-focused' @('run','r65:focused:test')
+  if($Stage -eq 'focused'){Write-Host '==== R65 WINDOWS GATE: PASS focused ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'full'){
+  Invoke-Npm 'full-regression' @('test')
+  if($Stage -eq 'full'){Write-Host '==== R65 WINDOWS GATE: PASS full ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'manifest'){
+  Invoke-Npm 'manifest-write' @('run','manifest:write')
+  Invoke-Npm 'manifest-verify' @('run','manifest:verify')
+  if($Stage -eq 'manifest'){Write-Host '==== R65 WINDOWS GATE: PASS manifest ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'doctor'){
+  $doctorRoot='D:\Projects\deadbyte-mcp\testing\0.15.42-r65\doctor-isolated-empty'
+  if(Test-Path -LiteralPath (Join-Path $doctorRoot 'active-release.json')){ throw 'R65 isolated doctor root unexpectedly contains a release pointer' }
+  $priorStateRoot=$env:DEADBYTE_STATE_ROOT
+  try{
+    $env:DEADBYTE_STATE_ROOT=$doctorRoot
+    Invoke-Npm 'doctor-isolated-empty-state' @('run','doctor')
+  }finally{ $env:DEADBYTE_STATE_ROOT=$priorStateRoot }
+  if($Stage -eq 'doctor'){Write-Host '==== R65 WINDOWS GATE: PASS doctor ====';return}
+}
+Write-Host '==== R65 PREPUBLISH WINDOWS GATE: PASS ===='