deadbyte-mcp 0.15.44 → 0.15.46

package/controller/deadbyte-controller.ps1

@@ -1,1771 +1,1873 @@
-#requires -Version 5.1
-[CmdletBinding()]
-param(
-    [Parameter(Position=0)]
-    [ValidateSet('menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest','armprocess','disarmprocess','processstatus','armhost','disarmhost','hoststatus','hosttest','armcoding','disarmcoding','codingstatus','codingtest','armautonomous','disarmautonomous','autonomousstatus','autonomoustest','supervisorstart','supervisorstop','supervisorstatus','supervisorrecover','armdesktop','disarmdesktop','desktopstatus')]
-    [string]$Command = 'menu',
-    [switch]$Json
-)
-
-Set-StrictMode -Version 3.0
-$ErrorActionPreference = 'Stop'
-
-$ControllerSchema = 'deadbyte.controller.v1'
-$Root = Split-Path -Parent $MyInvocation.MyCommand.Path
-$RuntimeDir = if ($env:DEADBYTE_CONTROLLER_RUNTIME_ROOT) { [System.IO.Path]::GetFullPath([string]$env:DEADBYTE_CONTROLLER_RUNTIME_ROOT) } else { Join-Path $Root 'runtime' }
-$LogDir = Join-Path $RuntimeDir 'logs'
-$ConfigPath = if ($env:DEADBYTE_CONTROLLER_CONFIG) { $env:DEADBYTE_CONTROLLER_CONFIG } else { Join-Path $Root 'deadbyte-controller.config.psd1' }
-
-function Fail([string]$Message) { throw "DEADBYTE controller: $Message" }
-if ($Json -and $Command -ne 'status') { Fail 'JSON observation is available only for status' }
-
-function Get-ControllerMutationMutexName {
-    $normalized = ([System.IO.Path]::GetFullPath($RuntimeDir)).TrimEnd('\\').ToLowerInvariant()
-    $sha = [System.Security.Cryptography.SHA256]::Create()
-    try {
-        $bytes = [System.Text.Encoding]::UTF8.GetBytes($normalized)
-        $digest = $sha.ComputeHash($bytes)
-    } finally {
-        $sha.Dispose()
-    }
-    $hex = ([System.BitConverter]::ToString($digest)).Replace('-', '').ToLowerInvariant().Substring(0, 24)
-    return "Local\DEADBYTE-MCP-Controller-$hex"
-}
-
-function Invoke-WithControllerMutationLock([string]$Name, [scriptblock]$Body) {
-    $mutexName = Get-ControllerMutationMutexName
-    $mutex = New-Object System.Threading.Mutex($false, $mutexName)
-    $held = $false
-    try {
-        try {
-            $held = $mutex.WaitOne([TimeSpan]::FromSeconds(180))
-        } catch [System.Threading.AbandonedMutexException] {
-            $held = $true
-        }
-        if (-not $held) { Fail "controller mutation lock timeout for '$Name'" }
-        & $Body
-    } finally {
-        if ($held) {
-            try { $mutex.ReleaseMutex() } catch {}
-        }
-        $mutex.Dispose()
-    }
-}
-
-function Ensure-Directory([string]$Path) { if (-not (Test-Path -LiteralPath $Path -PathType Container)) { New-Item -ItemType Directory -Path $Path -Force | Out-Null } }
-function Ledger-Path([string]$Name) { Join-Path $RuntimeDir ("{0}.instance.json" -f $Name.ToLowerInvariant()) }
-function Log-Path([string]$Name, [string]$Kind) { Join-Path $LogDir ("{0}.{1}.log" -f $Name.ToLowerInvariant(), $Kind) }
-function Controller-StartFailurePath { Join-Path $RuntimeDir 'controller-start-failure.json' }
-function Read-LogTailBounded([string]$Path, [int]$MaxChars = 8192) {
-    if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return '' }
-    try {
-        $text = (@(Get-Content -LiteralPath $Path -Encoding UTF8 -Tail 80 -ErrorAction Stop) -join [Environment]::NewLine)
-        if ($text.Length -gt $MaxChars) { return $text.Substring($text.Length - $MaxChars) }
-        return $text
-    } catch { return '' }
-}
-function Write-ControllerStartFailure([string]$Name, [System.Exception]$Exception) {
-    Ensure-Directory $RuntimeDir; Ensure-Directory $LogDir
-    $body = [ordered]@{
-        schema = 'deadbyte.controller-start-failure.v1'
-        command = $Name
-        failed_at_utc = [DateTime]::UtcNow.ToString('o')
-        message = [string]$Exception.Message
-        bridge_stdout_tail = Read-LogTailBounded (Log-Path 'Bridge' 'stdout')
-        bridge_stderr_tail = Read-LogTailBounded (Log-Path 'Bridge' 'stderr')
-        cloud_stdout_tail = Read-LogTailBounded (Log-Path 'Cloud' 'stdout')
-        cloud_stderr_tail = Read-LogTailBounded (Log-Path 'Cloud' 'stderr')
-    }
-    $path = Controller-StartFailurePath
-    $tmp = $path + '.tmp'
-    $json = $body | ConvertTo-Json -Depth 4
-    [System.IO.File]::WriteAllText($tmp, $json, (New-Object System.Text.UTF8Encoding($false)))
-    Move-Item -LiteralPath $tmp -Destination $path -Force
-}
-
-
-function Read-TextFileSafe([string]$Path) {
-    if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return '' }
-    $text = Get-Content -LiteralPath $Path -Raw -Encoding UTF8
-    if ($null -eq $text) { return '' }
-    return [string]$text
-}
-
-function Get-Config {
-    if (-not (Test-Path -LiteralPath $ConfigPath -PathType Leaf)) {
-        Fail "missing trusted config '$ConfigPath'; copy deadbyte-controller.config.psd1.example and set exact long-lived executable paths"
-    }
-    $cfg = Import-PowerShellDataFile -LiteralPath $ConfigPath
-    if ($cfg.Schema -ne $ControllerSchema) { Fail 'controller config schema mismatch' }
-    $coreRoot = if ($cfg.ContainsKey('CoreRoot') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.CoreRoot)) { [string]$cfg.CoreRoot } else { Split-Path -Parent $Root }
-    $coreRoot = [System.IO.Path]::GetFullPath($coreRoot)
-    if (-not (Test-Path -LiteralPath (Join-Path $coreRoot 'package.json') -PathType Leaf) -or -not (Test-Path -LiteralPath (Join-Path $coreRoot 'src\mcp-server.mjs') -PathType Leaf)) {
-        Fail "CoreRoot is not a DEADBYTE MCP package: $coreRoot"
-    }
-    $cfg['CoreRoot'] = $coreRoot
-    $workspaceRoot = if ($cfg.ContainsKey('WorkspaceRoot') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.WorkspaceRoot)) { [string]$cfg.WorkspaceRoot } else { Join-Path $coreRoot 'workspaces' }
-    $workspaceRoot = [System.IO.Path]::GetFullPath($workspaceRoot)
-    if (-not (Test-Path -LiteralPath $workspaceRoot -PathType Container)) { Fail "WorkspaceRoot missing: $workspaceRoot" }
-    $cfg['WorkspaceRoot'] = $workspaceRoot
-    if ($cfg.ContainsKey('AutonomousSupervisorEnabled')) {
-        if ($cfg.AutonomousSupervisorEnabled -isnot [bool]) { Fail 'AutonomousSupervisorEnabled must be boolean' }
-    } else {
-        $cfg['AutonomousSupervisorEnabled'] = $false
-    }
-    $componentNames = @('Bridge','Cloud')
-    if ([bool]$cfg.AutonomousSupervisorEnabled) { $componentNames += 'Supervisor' }
-    foreach ($name in $componentNames) {
-        $spec = $cfg[$name]
-        if (-not $spec -or -not $spec.ContainsKey('FilePath') -or [string]::IsNullOrWhiteSpace([string]$spec.FilePath)) { Fail "$name FilePath missing" }
-        if (-not $spec.ContainsKey('Arguments')) { Fail "$name Arguments field missing" }
-        if (-not $spec.ContainsKey('WorkingDirectory')) { Fail "$name WorkingDirectory field missing" }
-        if (-not (Test-Path -LiteralPath $spec.FilePath -PathType Leaf)) { Fail "$name executable missing: $($spec.FilePath)" }
-        if (-not $spec.ContainsKey('FileSha256') -or [string]$spec.FileSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail "$name FileSha256 invalid" }
-        $componentExecutableHash = Get-ExecutableHash ([string]$spec.FilePath)
-        if ($componentExecutableHash -ne [string]$spec.FileSha256) { Fail "$name executable hash mismatch: expected $($spec.FileSha256), found $componentExecutableHash" }
-        if ([string]::IsNullOrWhiteSpace([string]$spec.WorkingDirectory) -or -not (Test-Path -LiteralPath $spec.WorkingDirectory -PathType Container)) {
-            Fail "$name WorkingDirectory missing: $($spec.WorkingDirectory)"
-        }
-        Normalize-ComponentDependencies $name $spec
-        if ($name -eq 'Cloud' -and $spec.ContainsKey('Transport')) {
-            $transport = [string]$spec.Transport
-            $dependencyCount = @($spec.Dependencies).Count
-            if ($transport -eq 'deadbyte.named-tunnel.v1') {
-                if ($dependencyCount -ne 3) { Fail 'deadbyte.named-tunnel.v1 requires exactly three pinned dependencies' }
-            } elseif ($transport -eq 'deadbyte.named-tunnel.v2') {
-                if ($dependencyCount -ne 2) { Fail 'deadbyte.named-tunnel.v2 requires exactly cloudflared plus token-file pins' }
-            } else { Fail 'Cloud Transport unsupported' }
-        }
-        if ($name -in @('Bridge','Supervisor')) {
-            if (-not $spec.ContainsKey('ScriptPath') -or [string]::IsNullOrWhiteSpace([string]$spec.ScriptPath)) { Fail "$name ScriptPath missing" }
-            if (-not $spec.ContainsKey('ScriptSha256') -or [string]$spec.ScriptSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail "$name ScriptSha256 invalid" }
-            $scriptPath = [System.IO.Path]::GetFullPath([string]$spec.ScriptPath)
-            if (-not (Test-Path -LiteralPath $scriptPath -PathType Leaf)) { Fail "$name ScriptPath missing: $scriptPath" }
-            if ($name -eq 'Supervisor' -and [System.IO.Path]::GetFileName($scriptPath) -ne 'autonomous-supervisor-host.mjs') { Fail 'Supervisor ScriptPath must target autonomous-supervisor-host.mjs' }
-            $scriptHash = Get-ExecutableHash $scriptPath
-            if ($scriptHash -ne [string]$spec.ScriptSha256) { Fail "$name script hash mismatch: expected $($spec.ScriptSha256), found $scriptHash" }
-            $spec['ScriptPath'] = $scriptPath
-        }
-    }
-    $cloudTransport = if ($cfg.Cloud.ContainsKey('Transport')) { [string]$cfg.Cloud.Transport } else { '' }
-    if ($cloudTransport -eq 'deadbyte.named-tunnel.v2') {
-        if (-not $cfg.ContainsKey('McpUrlFile') -or [string]::IsNullOrWhiteSpace([string]$cfg.McpUrlFile)) { Fail 'deadbyte.named-tunnel.v2 requires McpUrlFile' }
-        if (-not $cfg.ContainsKey('McpUrlFileSha256') -or [string]$cfg.McpUrlFileSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail 'deadbyte.named-tunnel.v2 requires McpUrlFileSha256' }
-        $mcpUrlFile = [System.IO.Path]::GetFullPath([string]$cfg.McpUrlFile)
-        if (-not (Test-Path -LiteralPath $mcpUrlFile -PathType Leaf)) { Fail "McpUrlFile missing: $mcpUrlFile" }
-        $mcpUrlItem = Get-Item -LiteralPath $mcpUrlFile -Force
-        if (($mcpUrlItem.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { Fail 'McpUrlFile must not be a reparse point' }
-        $mcpUrlHash = Get-ExecutableHash $mcpUrlFile
-        if ($mcpUrlHash -ne [string]$cfg.McpUrlFileSha256) { Fail "McpUrlFile SHA-256 mismatch: expected $($cfg.McpUrlFileSha256), found $mcpUrlHash" }
-        $cfg['McpUrlFile'] = $mcpUrlFile
-    }
-    if ($cfg.ContainsKey('HostPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.HostPolicyFile)) {
-        $hostPolicy = [System.IO.Path]::GetFullPath([string]$cfg.HostPolicyFile)
-        if (-not (Test-Path -LiteralPath $hostPolicy -PathType Leaf)) { Fail "HostPolicyFile missing: $hostPolicy" }
-        $cfg['HostPolicyFile'] = $hostPolicy
-    } else {
-        $cfg['HostPolicyFile'] = ''
-    }
-    if ($cfg.ContainsKey('MachineRuntimeEnabled')) {
-        if ($cfg.MachineRuntimeEnabled -isnot [bool]) { Fail 'MachineRuntimeEnabled must be boolean' }
-    } else {
-        $cfg['MachineRuntimeEnabled'] = $true
-    }
-    if ($cfg.ContainsKey('AgentRuntimeEnabled')) {
-        if ($cfg.AgentRuntimeEnabled -isnot [bool]) { Fail 'AgentRuntimeEnabled must be boolean' }
-    } else {
-        $cfg['AgentRuntimeEnabled'] = $false
-    }
-    if ($cfg.ContainsKey('ProcessRuntimeEnabled')) {
-        if ($cfg.ProcessRuntimeEnabled -isnot [bool]) { Fail 'ProcessRuntimeEnabled must be boolean' }
-    } else {
-        $cfg['ProcessRuntimeEnabled'] = $false
-    }
-    if ($cfg.ContainsKey('ProcessPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.ProcessPolicyFile)) {
-        $processPolicy = [System.IO.Path]::GetFullPath([string]$cfg.ProcessPolicyFile)
-        if (-not (Test-Path -LiteralPath $processPolicy -PathType Leaf)) { Fail "ProcessPolicyFile missing: $processPolicy" }
-        $cfg['ProcessPolicyFile'] = $processPolicy
-    } else {
-        $cfg['ProcessPolicyFile'] = ''
-    }
+#requires -Version 5.1
+[CmdletBinding()]
+param(
+    [Parameter(Position=0)]
+    [ValidateSet('menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest','armprocess','disarmprocess','processstatus','armhost','disarmhost','hoststatus','hosttest','armcoding','disarmcoding','codingstatus','codingtest','armautonomous','disarmautonomous','autonomousstatus','autonomoustest','supervisorstart','supervisorstop','supervisorstatus','supervisorrecover','armdesktop','disarmdesktop','desktopstatus')]
+    [string]$Command = 'menu',
+    [switch]$Json
+)
+
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = 'Stop'
+
+$ControllerSchema = 'deadbyte.controller.v1'
+$Root = Split-Path -Parent $MyInvocation.MyCommand.Path
+$RuntimeDir = if ($env:DEADBYTE_CONTROLLER_RUNTIME_ROOT) { [System.IO.Path]::GetFullPath([string]$env:DEADBYTE_CONTROLLER_RUNTIME_ROOT) } else { Join-Path $Root 'runtime' }
+$LogDir = Join-Path $RuntimeDir 'logs'
+$ConfigPath = if ($env:DEADBYTE_CONTROLLER_CONFIG) { $env:DEADBYTE_CONTROLLER_CONFIG } else { Join-Path $Root 'deadbyte-controller.config.psd1' }
+
+function Fail([string]$Message) { throw "DEADBYTE controller: $Message" }
+if ($Json -and $Command -ne 'status') { Fail 'JSON observation is available only for status' }
+
+function Get-ControllerMutationMutexName {
+    $normalized = ([System.IO.Path]::GetFullPath($RuntimeDir)).TrimEnd('\\').ToLowerInvariant()
+    $sha = [System.Security.Cryptography.SHA256]::Create()
+    try {
+        $bytes = [System.Text.Encoding]::UTF8.GetBytes($normalized)
+        $digest = $sha.ComputeHash($bytes)
+    } finally {
+        $sha.Dispose()
+    }
+    $hex = ([System.BitConverter]::ToString($digest)).Replace('-', '').ToLowerInvariant().Substring(0, 24)
+    return "Local\DEADBYTE-MCP-Controller-$hex"
+}
+
+function Invoke-WithControllerMutationLock([string]$Name, [scriptblock]$Body) {
+    $mutexName = Get-ControllerMutationMutexName
+    $mutex = New-Object System.Threading.Mutex($false, $mutexName)
+    $held = $false
+    try {
+        try {
+            $held = $mutex.WaitOne([TimeSpan]::FromSeconds(180))
+        } catch [System.Threading.AbandonedMutexException] {
+            $held = $true
+        }
+        if (-not $held) { Fail "controller mutation lock timeout for '$Name'" }
+        & $Body
+    } finally {
+        if ($held) {
+            try { $mutex.ReleaseMutex() } catch {}
+        }
+        $mutex.Dispose()
+    }
+}
+
+function Ensure-Directory([string]$Path) { if (-not (Test-Path -LiteralPath $Path -PathType Container)) { New-Item -ItemType Directory -Path $Path -Force | Out-Null } }
+function Ledger-Path([string]$Name) { Join-Path $RuntimeDir ("{0}.instance.json" -f $Name.ToLowerInvariant()) }
+function Log-Path([string]$Name, [string]$Kind) { Join-Path $LogDir ("{0}.{1}.log" -f $Name.ToLowerInvariant(), $Kind) }
+function Controller-StartFailurePath { Join-Path $RuntimeDir 'controller-start-failure.json' }
+function Read-LogTailBounded([string]$Path, [int]$MaxChars = 8192) {
+    if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return '' }
+    try {
+        $text = (@(Get-Content -LiteralPath $Path -Encoding UTF8 -Tail 80 -ErrorAction Stop) -join [Environment]::NewLine)
+        if ($text.Length -gt $MaxChars) { return $text.Substring($text.Length - $MaxChars) }
+        return $text
+    } catch { return '' }
+}
+function Write-ControllerStartFailure([string]$Name, [System.Exception]$Exception) {
+    Ensure-Directory $RuntimeDir; Ensure-Directory $LogDir
+    $body = [ordered]@{
+        schema = 'deadbyte.controller-start-failure.v1'
+        command = $Name
+        failed_at_utc = [DateTime]::UtcNow.ToString('o')
+        message = [string]$Exception.Message
+        bridge_stdout_tail = Read-LogTailBounded (Log-Path 'Bridge' 'stdout')
+        bridge_stderr_tail = Read-LogTailBounded (Log-Path 'Bridge' 'stderr')
+        cloud_stdout_tail = Read-LogTailBounded (Log-Path 'Cloud' 'stdout')
+        cloud_stderr_tail = Read-LogTailBounded (Log-Path 'Cloud' 'stderr')
+    }
+    $path = Controller-StartFailurePath
+    $tmp = $path + '.tmp'
+    $json = $body | ConvertTo-Json -Depth 4
+    [System.IO.File]::WriteAllText($tmp, $json, (New-Object System.Text.UTF8Encoding($false)))
+    Move-Item -LiteralPath $tmp -Destination $path -Force
+}
+
+
+function Read-TextFileSafe([string]$Path) {
+    if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return '' }
+    $text = Get-Content -LiteralPath $Path -Raw -Encoding UTF8
+    if ($null -eq $text) { return '' }
+    return [string]$text
+}
+
+function Get-Config {
+    if (-not (Test-Path -LiteralPath $ConfigPath -PathType Leaf)) {
+        Fail "missing trusted config '$ConfigPath'; copy deadbyte-controller.config.psd1.example and set exact long-lived executable paths"
+    }
+    $cfg = Import-PowerShellDataFile -LiteralPath $ConfigPath
+    if ($cfg.Schema -ne $ControllerSchema) { Fail 'controller config schema mismatch' }
+    $coreRoot = if ($cfg.ContainsKey('CoreRoot') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.CoreRoot)) { [string]$cfg.CoreRoot } else { Split-Path -Parent $Root }
+    $coreRoot = [System.IO.Path]::GetFullPath($coreRoot)
+    if (-not (Test-Path -LiteralPath (Join-Path $coreRoot 'package.json') -PathType Leaf) -or -not (Test-Path -LiteralPath (Join-Path $coreRoot 'src\mcp-server.mjs') -PathType Leaf)) {
+        Fail "CoreRoot is not a DEADBYTE MCP package: $coreRoot"
+    }
+    $cfg['CoreRoot'] = $coreRoot
+    $workspaceRoot = if ($cfg.ContainsKey('WorkspaceRoot') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.WorkspaceRoot)) { [string]$cfg.WorkspaceRoot } else { Join-Path $coreRoot 'workspaces' }
+    $workspaceRoot = [System.IO.Path]::GetFullPath($workspaceRoot)
+    if (-not (Test-Path -LiteralPath $workspaceRoot -PathType Container)) { Fail "WorkspaceRoot missing: $workspaceRoot" }
+    $cfg['WorkspaceRoot'] = $workspaceRoot
+    if ($cfg.ContainsKey('AutonomousSupervisorEnabled')) {
+        if ($cfg.AutonomousSupervisorEnabled -isnot [bool]) { Fail 'AutonomousSupervisorEnabled must be boolean' }
+    } else {
+        $cfg['AutonomousSupervisorEnabled'] = $false
+    }
+    $componentNames = @('Bridge','Cloud')
+    if ([bool]$cfg.AutonomousSupervisorEnabled) { $componentNames += 'Supervisor' }
+    foreach ($name in $componentNames) {
+        $spec = $cfg[$name]
+        if (-not $spec -or -not $spec.ContainsKey('FilePath') -or [string]::IsNullOrWhiteSpace([string]$spec.FilePath)) { Fail "$name FilePath missing" }
+        if (-not $spec.ContainsKey('Arguments')) { Fail "$name Arguments field missing" }
+        if (-not $spec.ContainsKey('WorkingDirectory')) { Fail "$name WorkingDirectory field missing" }
+        if (-not (Test-Path -LiteralPath $spec.FilePath -PathType Leaf)) { Fail "$name executable missing: $($spec.FilePath)" }
+        if (-not $spec.ContainsKey('FileSha256') -or [string]$spec.FileSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail "$name FileSha256 invalid" }
+        $componentExecutableHash = Get-ExecutableHash ([string]$spec.FilePath)
+        if ($componentExecutableHash -ne [string]$spec.FileSha256) { Fail "$name executable hash mismatch: expected $($spec.FileSha256), found $componentExecutableHash" }
+        if ([string]::IsNullOrWhiteSpace([string]$spec.WorkingDirectory) -or -not (Test-Path -LiteralPath $spec.WorkingDirectory -PathType Container)) {
+            Fail "$name WorkingDirectory missing: $($spec.WorkingDirectory)"
+        }
+        Normalize-ComponentDependencies $name $spec
+        if ($name -eq 'Cloud' -and $spec.ContainsKey('Transport')) {
+            $transport = [string]$spec.Transport
+            $dependencyCount = @($spec.Dependencies).Count
+            if ($transport -eq 'deadbyte.named-tunnel.v1') {
+                if ($dependencyCount -ne 3) { Fail 'deadbyte.named-tunnel.v1 requires exactly three pinned dependencies' }
+            } elseif ($transport -eq 'deadbyte.named-tunnel.v2') {
+                if ($dependencyCount -ne 2) { Fail 'deadbyte.named-tunnel.v2 requires exactly cloudflared plus token-file pins' }
+            } else { Fail 'Cloud Transport unsupported' }
+        }
+        if ($name -in @('Bridge','Supervisor')) {
+            if (-not $spec.ContainsKey('ScriptPath') -or [string]::IsNullOrWhiteSpace([string]$spec.ScriptPath)) { Fail "$name ScriptPath missing" }
+            if (-not $spec.ContainsKey('ScriptSha256') -or [string]$spec.ScriptSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail "$name ScriptSha256 invalid" }
+            $scriptPath = [System.IO.Path]::GetFullPath([string]$spec.ScriptPath)
+            if (-not (Test-Path -LiteralPath $scriptPath -PathType Leaf)) { Fail "$name ScriptPath missing: $scriptPath" }
+            if ($name -eq 'Supervisor' -and [System.IO.Path]::GetFileName($scriptPath) -ne 'autonomous-supervisor-host.mjs') { Fail 'Supervisor ScriptPath must target autonomous-supervisor-host.mjs' }
+            $scriptHash = Get-ExecutableHash $scriptPath
+            if ($scriptHash -ne [string]$spec.ScriptSha256) { Fail "$name script hash mismatch: expected $($spec.ScriptSha256), found $scriptHash" }
+            $spec['ScriptPath'] = $scriptPath
+        }
+    }
+    $cloudTransport = if ($cfg.Cloud.ContainsKey('Transport')) { [string]$cfg.Cloud.Transport } else { '' }
+    if ($cloudTransport -eq 'deadbyte.named-tunnel.v2') {
+        if (-not $cfg.ContainsKey('McpUrlFile') -or [string]::IsNullOrWhiteSpace([string]$cfg.McpUrlFile)) { Fail 'deadbyte.named-tunnel.v2 requires McpUrlFile' }
+        if (-not $cfg.ContainsKey('McpUrlFileSha256') -or [string]$cfg.McpUrlFileSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail 'deadbyte.named-tunnel.v2 requires McpUrlFileSha256' }
+        $mcpUrlFile = [System.IO.Path]::GetFullPath([string]$cfg.McpUrlFile)
+        if (-not (Test-Path -LiteralPath $mcpUrlFile -PathType Leaf)) { Fail "McpUrlFile missing: $mcpUrlFile" }
+        $mcpUrlItem = Get-Item -LiteralPath $mcpUrlFile -Force
+        if (($mcpUrlItem.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { Fail 'McpUrlFile must not be a reparse point' }
+        $mcpUrlHash = Get-ExecutableHash $mcpUrlFile
+        if ($mcpUrlHash -ne [string]$cfg.McpUrlFileSha256) { Fail "McpUrlFile SHA-256 mismatch: expected $($cfg.McpUrlFileSha256), found $mcpUrlHash" }
+        $cfg['McpUrlFile'] = $mcpUrlFile
+    }
+    if ($cfg.ContainsKey('HostPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.HostPolicyFile)) {
+        $hostPolicy = [System.IO.Path]::GetFullPath([string]$cfg.HostPolicyFile)
+        if (-not (Test-Path -LiteralPath $hostPolicy -PathType Leaf)) { Fail "HostPolicyFile missing: $hostPolicy" }
+        $cfg['HostPolicyFile'] = $hostPolicy
+    } else {
+        $cfg['HostPolicyFile'] = ''
+    }
+    if ($cfg.ContainsKey('MachineRuntimeEnabled')) {
+        if ($cfg.MachineRuntimeEnabled -isnot [bool]) { Fail 'MachineRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['MachineRuntimeEnabled'] = $true
+    }
+    if ($cfg.ContainsKey('AgentRuntimeEnabled')) {
+        if ($cfg.AgentRuntimeEnabled -isnot [bool]) { Fail 'AgentRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['AgentRuntimeEnabled'] = $false
+    }
+    if ($cfg.ContainsKey('ProcessRuntimeEnabled')) {
+        if ($cfg.ProcessRuntimeEnabled -isnot [bool]) { Fail 'ProcessRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['ProcessRuntimeEnabled'] = $false
+    }
+    if ($cfg.ContainsKey('ProcessPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.ProcessPolicyFile)) {
+        $processPolicy = [System.IO.Path]::GetFullPath([string]$cfg.ProcessPolicyFile)
+        if (-not (Test-Path -LiteralPath $processPolicy -PathType Leaf)) { Fail "ProcessPolicyFile missing: $processPolicy" }
+        $cfg['ProcessPolicyFile'] = $processPolicy
+    } else {
+        $cfg['ProcessPolicyFile'] = ''
+    }
     if ([bool]$cfg.ProcessRuntimeEnabled -and [string]::IsNullOrWhiteSpace([string]$cfg.ProcessPolicyFile)) { Fail 'ProcessRuntimeEnabled requires ProcessPolicyFile' }
-    if ($cfg.ContainsKey('CodingRuntimeEnabled')) {
-        if ($cfg.CodingRuntimeEnabled -isnot [bool]) { Fail 'CodingRuntimeEnabled must be boolean' }
-    } else {
-        $cfg['CodingRuntimeEnabled'] = $false
-    }
-    if ($cfg.ContainsKey('CodingPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.CodingPolicyFile)) {
-        $codingPolicy = [System.IO.Path]::GetFullPath([string]$cfg.CodingPolicyFile)
-        if (-not (Test-Path -LiteralPath $codingPolicy -PathType Leaf)) { Fail "CodingPolicyFile missing: $codingPolicy" }
-        $cfg['CodingPolicyFile'] = $codingPolicy
-    } else {
-        $cfg['CodingPolicyFile'] = ''
-    }
-    if ([bool]$cfg.CodingRuntimeEnabled -and [string]::IsNullOrWhiteSpace([string]$cfg.CodingPolicyFile)) { Fail 'CodingRuntimeEnabled requires CodingPolicyFile' }
-    $semanticConfigFile = if ($cfg.ContainsKey('SemanticLspConfigFile')) { [string]$cfg.SemanticLspConfigFile } else { '' }
-    $semanticConfigSha = if ($cfg.ContainsKey('SemanticLspConfigSha256')) { ([string]$cfg.SemanticLspConfigSha256).ToLowerInvariant() } else { '' }
-    if ([string]::IsNullOrWhiteSpace($semanticConfigFile) -ne [string]::IsNullOrWhiteSpace($semanticConfigSha)) { Fail 'SemanticLspConfigFile and SemanticLspConfigSha256 must be supplied together' }
-    if (-not [string]::IsNullOrWhiteSpace($semanticConfigFile)) {
-        if (-not [bool]$cfg.CodingRuntimeEnabled) { Fail 'SemanticLspConfigFile requires CodingRuntimeEnabled' }
-        if ($semanticConfigSha -cnotmatch '^[0-9a-f]{64}$') { Fail 'SemanticLspConfigSha256 invalid' }
-        $semanticConfigFile = [System.IO.Path]::GetFullPath($semanticConfigFile)
-        if (-not (Test-Path -LiteralPath $semanticConfigFile -PathType Leaf)) { Fail "SemanticLspConfigFile missing: $semanticConfigFile" }
-        $semanticItem = Get-Item -LiteralPath $semanticConfigFile -Force
-        if (($semanticItem.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { Fail 'SemanticLspConfigFile must not be a reparse point' }
-        $semanticObserved = Get-ExecutableHash $semanticConfigFile
-        if ($semanticObserved -ne $semanticConfigSha) { Fail "semantic LSP config SHA-256 mismatch: expected $semanticConfigSha, found $semanticObserved" }
-        $cfg['SemanticLspConfigFile'] = $semanticConfigFile
-        $cfg['SemanticLspConfigSha256'] = $semanticConfigSha
-    } else {
-        $cfg['SemanticLspConfigFile'] = ''
-        $cfg['SemanticLspConfigSha256'] = ''
-    }
-    if ($cfg.ContainsKey('MachineFsRuntimeEnabled')) {
-        if ($cfg.MachineFsRuntimeEnabled -isnot [bool]) { Fail 'MachineFsRuntimeEnabled must be boolean' }
-    } else {
-        $cfg['MachineFsRuntimeEnabled'] = $false
-    }
-    if ([bool]$cfg.MachineFsRuntimeEnabled -and -not [bool]$cfg.CodingRuntimeEnabled) { Fail 'MachineFsRuntimeEnabled requires CodingRuntimeEnabled' }
-    if ($cfg.ContainsKey('ObservationRuntimeEnabled')) {
-        if ($cfg.ObservationRuntimeEnabled -isnot [bool]) { Fail 'ObservationRuntimeEnabled must be boolean' }
-    } else {
-        $cfg['ObservationRuntimeEnabled'] = $false
-    }
-    if ([bool]$cfg.ObservationRuntimeEnabled -and -not [bool]$cfg.MachineRuntimeEnabled) { Fail 'ObservationRuntimeEnabled requires MachineRuntimeEnabled' }
-    if ([bool]$cfg.ObservationRuntimeEnabled -and -not [bool]$cfg.CodingRuntimeEnabled) { Fail 'ObservationRuntimeEnabled requires CodingRuntimeEnabled' }
-    if ($cfg.ContainsKey('DesktopRuntimeEnabled')) {
-        if ($cfg.DesktopRuntimeEnabled -isnot [bool]) { Fail 'DesktopRuntimeEnabled must be boolean' }
-    } else {
-        $cfg['DesktopRuntimeEnabled'] = $false
-    }
-    if ($cfg.ContainsKey('DesktopPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.DesktopPolicyFile)) {
-        $desktopPolicy = [System.IO.Path]::GetFullPath([string]$cfg.DesktopPolicyFile)
-        if (-not (Test-Path -LiteralPath $desktopPolicy -PathType Leaf)) { Fail "DesktopPolicyFile missing: $desktopPolicy" }
-        $cfg['DesktopPolicyFile'] = $desktopPolicy
-    } else {
-        $cfg['DesktopPolicyFile'] = ''
-    }
-    if ([bool]$cfg.DesktopRuntimeEnabled -and [string]::IsNullOrWhiteSpace([string]$cfg.DesktopPolicyFile)) { Fail 'DesktopRuntimeEnabled requires DesktopPolicyFile' }
-    if ($cfg.ContainsKey('AutonomousRuntimeEnabled')) {
-        if ($cfg.AutonomousRuntimeEnabled -isnot [bool]) { Fail 'AutonomousRuntimeEnabled must be boolean' }
-    } else {
-        $cfg['AutonomousRuntimeEnabled'] = $false
-    }
-    if ($cfg.ContainsKey('AutonomousPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.AutonomousPolicyFile)) {
-        $autonomousPolicy = [System.IO.Path]::GetFullPath([string]$cfg.AutonomousPolicyFile)
-        if (-not (Test-Path -LiteralPath $autonomousPolicy -PathType Leaf)) { Fail "AutonomousPolicyFile missing: $autonomousPolicy" }
-        $cfg['AutonomousPolicyFile'] = $autonomousPolicy
-    } else {
-        $cfg['AutonomousPolicyFile'] = ''
-    }
-    if ([bool]$cfg.AutonomousRuntimeEnabled -and -not [bool]$cfg.CodingRuntimeEnabled) { Fail 'AutonomousRuntimeEnabled requires CodingRuntimeEnabled' }
-    if ([bool]$cfg.AutonomousRuntimeEnabled -and [string]::IsNullOrWhiteSpace([string]$cfg.AutonomousPolicyFile)) { Fail 'AutonomousRuntimeEnabled requires AutonomousPolicyFile' }
-    if ([bool]$cfg.AutonomousSupervisorEnabled -and -not [bool]$cfg.AutonomousRuntimeEnabled) { Fail 'AutonomousSupervisorEnabled requires AutonomousRuntimeEnabled' }
-    if ([int]$cfg.StartTimeoutSeconds -lt 1 -or [int]$cfg.StartTimeoutSeconds -gt 120) { Fail 'StartTimeoutSeconds out of range' }
-    if ([int]$cfg.ProbeTimeoutSeconds -lt 1 -or [int]$cfg.ProbeTimeoutSeconds -gt 15) { Fail 'ProbeTimeoutSeconds out of range' }
-    return $cfg
-}
-
-function Assert-ControllerRootBound($Cfg) {
-    $expected = [System.IO.Path]::GetFullPath((Join-Path ([string]$Cfg.CoreRoot) 'controller')).TrimEnd('\')
-    $actual = [System.IO.Path]::GetFullPath($Root).TrimEnd('\')
-    if (-not [string]::Equals($actual, $expected, [System.StringComparison]::OrdinalIgnoreCase)) {
-        Fail "controller root mismatch: running '$actual', expected '$expected'; use canonical DEADBYTE-MCP.cmd"
-    }
-}
-
-function Get-ExecutableHash([string]$Path) {
-    (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()
-}
-
-function Normalize-ComponentDependencies([string]$Name, $Spec) {
-    if (-not $Spec.ContainsKey('Dependencies')) { $Spec['Dependencies'] = @(); return }
-    $dependencies = @($Spec.Dependencies)
-    if ($dependencies.Count -gt 16) { Fail "$Name dependency count exceeds 16" }
-    $normalized = @()
-    foreach ($dependency in $dependencies) {
-        $depPath = [System.IO.Path]::GetFullPath([string]$dependency.Path)
-        $depHash = ([string]$dependency.Sha256).ToLowerInvariant()
-        if ([string]::IsNullOrWhiteSpace($depPath) -or -not (Test-Path -LiteralPath $depPath -PathType Leaf)) { Fail "$Name dependency missing: $depPath" }
-        if ($depHash -cnotmatch '^[0-9a-f]{64}$') { Fail "$Name dependency SHA-256 invalid: $depPath" }
-        $item = Get-Item -LiteralPath $depPath -Force
-        if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { Fail "$Name dependency must not be a reparse point: $depPath" }
-        $actual = Get-ExecutableHash $depPath
-        if ($actual -ne $depHash) { Fail "$Name dependency hash mismatch in trusted config: $depPath" }
-        $depName = if ([string]::IsNullOrWhiteSpace([string]$dependency.Name)) { [System.IO.Path]::GetFileName($depPath) } else { [string]$dependency.Name }
-        $normalized += [ordered]@{ Name=$depName; Path=$depPath; Sha256=$depHash }
-    }
-    $Spec['Dependencies'] = $normalized
-}
-
-function Assert-ComponentDependencies([string]$Name, $Spec, [string]$Phase) {
-    foreach ($dependency in @($Spec.Dependencies)) {
-        $depPath = [string]$dependency.Path
-        $expected = [string]$dependency.Sha256
-        if (-not (Test-Path -LiteralPath $depPath -PathType Leaf)) { Fail "$Name dependency missing ${Phase}: $depPath" }
-        $actual = Get-ExecutableHash $depPath
-        if ($actual -ne $expected) { Fail "$Name dependency hash mismatch ${Phase}: $depPath expected $expected found $actual" }
-    }
-}
-
-function Get-LimitedProcessImagePath([int]$ProcessId) {
-    if (-not ('DeadbyteProcessQuery' -as [type])) {
-        $source = @'
-using System;
-using System.Text;
-using System.Runtime.InteropServices;
-public static class DeadbyteProcessQuery {
- [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access, bool inheritHandle, int processId);
- [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool QueryFullProcessImageName(IntPtr process, uint flags, StringBuilder path, ref int size);
- [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
- public static string GetImagePath(int processId) { const uint PROCESS_QUERY_LIMITED_INFORMATION=0x1000; IntPtr h=OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION,false,processId); if(h==IntPtr.Zero)return null; try { var b=new StringBuilder(32768); int n=b.Capacity; return QueryFullProcessImageName(h,0,b,ref n)?b.ToString():null; } finally { CloseHandle(h); } }
-}
-'@
-        Add-Type -TypeDefinition $source -Language CSharp -ErrorAction Stop
-    }
-    try { $path=[DeadbyteProcessQuery]::GetImagePath($ProcessId); if ($null -eq $path) { return '' }; return [string]$path } catch { return '' }
-}
-
-function Get-ProcessObservation([int]$ProcessId) {
-    try { $p = Get-Process -Id $ProcessId -ErrorAction Stop } catch { return $null }
-    $image = ''
-    try {
-        $cim = Get-CimInstance Win32_Process -Filter ("ProcessId={0}" -f $ProcessId) -ErrorAction Stop
-        if ($cim -and -not [string]::IsNullOrWhiteSpace([string]$cim.ExecutablePath)) {
-            $image = [string]$cim.ExecutablePath
-        }
-    } catch {}
-    if ([string]::IsNullOrWhiteSpace($image)) {
-        try { $image = [string]$p.Path } catch {}
-    }
-    if ([string]::IsNullOrWhiteSpace($image)) {
-        try { $image = Get-LimitedProcessImagePath $ProcessId } catch {}
-    }
-    if ([string]::IsNullOrWhiteSpace($image)) {
-        try { $image = [string]$p.MainModule.FileName } catch {}
-    }
-    if ([string]::IsNullOrWhiteSpace($image)) { return $null }
-    try { $image = [System.IO.Path]::GetFullPath($image) } catch { return $null }
-    if (-not (Test-Path -LiteralPath $image -PathType Leaf)) { return $null }
-    try { $imageHash = Get-ExecutableHash $image } catch { return $null }
-    [pscustomobject]@{
-        pid = [int]$p.Id
-        creation_time_utc = $p.StartTime.ToUniversalTime().ToString('o')
-        image_path = $image
-        image_sha256 = $imageHash
-    }
-}
-
-function Read-Ledger([string]$Name) {
-    $path = Ledger-Path $Name
-    if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { return $null }
-    try { return (Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json) } catch { return [pscustomobject]@{ corrupt = $true; path = $path } }
-}
-
-function Test-OwnedInstance([string]$Name) {
-    $ledger = Read-Ledger $Name
-    if (-not $ledger) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='no-ledger'; Ledger=$null; Observation=$null } }
-    if ($ledger.PSObject.Properties.Name -contains 'corrupt' -and $ledger.corrupt -eq $true) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='corrupt-ledger'; Ledger=$ledger; Observation=$null } }
-    if ($ledger.schema -ne $ControllerSchema -or -not $ledger.instance_nonce) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='ledger-schema'; Ledger=$ledger; Observation=$null } }
-    if ($Name -in @('Bridge','Supervisor')) {
-        if (-not ($ledger.PSObject.Properties.Name -contains 'script_path') -or -not ($ledger.PSObject.Properties.Name -contains 'script_sha256')) {
-            return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='ledger-schema'; Ledger=$ledger; Observation=$null }
-        }
-        $scriptPath = [string]$ledger.script_path
-        $scriptHash = [string]$ledger.script_sha256
-        if ([string]::IsNullOrWhiteSpace($scriptPath) -or $scriptHash -cnotmatch '^[0-9a-f]{64}$' -or -not (Test-Path -LiteralPath $scriptPath -PathType Leaf)) {
-            return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='script-hash-mismatch'; Ledger=$ledger; Observation=$null }
-        }
-        try { $observedScriptHash = Get-ExecutableHash $scriptPath } catch { $observedScriptHash = '' }
-        if ($observedScriptHash -ne $scriptHash) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='script-hash-mismatch'; Ledger=$ledger; Observation=$null } }
-    }
-    if ($ledger.PSObject.Properties.Name -contains 'dependencies') {
-        foreach ($dependency in @($ledger.dependencies)) {
-            $depPath = [string]$dependency.path
-            $depHash = [string]$dependency.sha256
-            if ([string]::IsNullOrWhiteSpace($depPath) -or $depHash -cnotmatch '^[0-9a-f]{64}$' -or -not (Test-Path -LiteralPath $depPath -PathType Leaf)) {
-                return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='dependency-hash-mismatch'; Ledger=$ledger; Observation=$null }
-            }
-            try { $observedDependencyHash = Get-ExecutableHash $depPath } catch { $observedDependencyHash = '' }
-            if ($observedDependencyHash -ne $depHash) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='dependency-hash-mismatch'; Ledger=$ledger; Observation=$null } }
-        }
-    }
-    $obs = Get-ProcessObservation ([int]$ledger.pid)
-    if (-not $obs) { try { [void](Get-Process -Id ([int]$ledger.pid) -ErrorAction Stop); return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='process-unobservable'; Ledger=$ledger; Observation=$null } } catch { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='process-missing'; Ledger=$ledger; Observation=$null } } }
-    if ($obs.creation_time_utc -ne [string]$ledger.creation_time_utc) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='pid-reused'; Ledger=$ledger; Observation=$obs } }
-    if (-not [string]::Equals($obs.image_path, [string]$ledger.image_path, [System.StringComparison]::OrdinalIgnoreCase)) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='image-path-mismatch'; Ledger=$ledger; Observation=$obs } }
-    if ($obs.image_sha256 -ne [string]$ledger.image_sha256) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='image-hash-mismatch'; Ledger=$ledger; Observation=$obs } }
-    [pscustomobject]@{ Name=$Name; Alive=$true; Reason='verified'; Ledger=$ledger; Observation=$obs }
-}
-
-function Reconcile-PidReusedLedger([string]$Name, $Ownership) {
-    if ($null -eq $Ownership -or [string]$Ownership.Reason -ne 'pid-reused') { Fail "$Name PID-reuse reconcile requires pid-reused ownership state" }
-    if ($null -eq $Ownership.Ledger -or $null -eq $Ownership.Observation) { Fail "$Name PID-reuse reconcile requires stale ledger and current process observation" }
-    $ledger = $Ownership.Ledger
-    $observed = $Ownership.Observation
-    if ([int]$ledger.pid -ne [int]$observed.pid) { Fail "$Name PID-reuse reconcile PID mismatch" }
-    if ([string]$ledger.creation_time_utc -eq [string]$observed.creation_time_utc) { Fail "$Name PID-reuse reconcile requires creation-time mismatch" }
-    $ledgerPath = Ledger-Path $Name
-    if (-not (Test-Path -LiteralPath $ledgerPath -PathType Leaf)) { Fail "$Name PID-reuse stale ledger disappeared before archive" }
-    $ledgerSha256 = (Get-FileHash -Algorithm SHA256 -LiteralPath $ledgerPath).Hash.ToLowerInvariant()
-    if ($ledgerSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail "$Name PID-reuse stale ledger SHA-256 invalid" }
-    $evidenceDir = Join-Path $RuntimeDir 'ownership-evidence'
-    Ensure-Directory $evidenceDir
-    $archivePath = Join-Path $evidenceDir ("{0}.stale.{1}.json" -f $Name.ToLowerInvariant(), $ledgerSha256)
-    if (Test-Path -LiteralPath $archivePath -PathType Leaf) {
-        $existingSha256 = (Get-FileHash -Algorithm SHA256 -LiteralPath $archivePath).Hash.ToLowerInvariant()
-        if ($existingSha256 -ne $ledgerSha256) { Fail "$Name PID-reuse evidence archive hash conflict" }
-    } else {
-        Copy-Item -LiteralPath $ledgerPath -Destination $archivePath
-    }
-    $archiveSha256 = (Get-FileHash -Algorithm SHA256 -LiteralPath $archivePath).Hash.ToLowerInvariant()
-    if ($archiveSha256 -ne $ledgerSha256) { Fail "$Name PID-reuse evidence archive verification failed" }
-    $receipt = [ordered]@{
-        schema = 'deadbyte.ownership-recovery.v1'
-        component = $Name.ToLowerInvariant()
-        reason = 'pid-reused'
-        stale_ledger_sha256 = $ledgerSha256
-        stale_ledger_archive = $archivePath
-        stale_pid = [int]$ledger.pid
-        stale_creation_time_utc = [string]$ledger.creation_time_utc
-        stale_image_path = [string]$ledger.image_path
-        stale_image_sha256 = [string]$ledger.image_sha256
-        observed_pid = [int]$observed.pid
-        observed_creation_time_utc = [string]$observed.creation_time_utc
-        observed_image_path = [string]$observed.image_path
-        observed_image_sha256 = [string]$observed.image_sha256
-        reconciled_at_utc = [DateTime]::UtcNow.ToString('o')
-        action = 'archive-stale-ledger-remove-metadata-no-process-kill'
-    }
-    $receiptPath = Join-Path $evidenceDir ("{0}.recovery.{1}.json" -f $Name.ToLowerInvariant(), $ledgerSha256)
-    $receiptTemp = $receiptPath + '.tmp'
-    $receiptJson = $receipt | ConvertTo-Json -Depth 5
-    [System.IO.File]::WriteAllText($receiptTemp, $receiptJson, (New-Object System.Text.UTF8Encoding($false)))
-    Move-Item -LiteralPath $receiptTemp -Destination $receiptPath -Force
-    Remove-Item -LiteralPath (Ledger-Path $Name) -Force
-    if (Test-Path -LiteralPath (Ledger-Path $Name) -PathType Leaf) { Fail "$Name PID-reuse stale ownership metadata removal failed" }
-    return [pscustomobject]@{ Name=$Name; Reason='pid-reused-reconciled'; LedgerSha256=$ledgerSha256; ArchivePath=$archivePath; ReceiptPath=$receiptPath }
-}
-
-function Write-Ledger([string]$Name, $Observation, [string]$Nonce, $Spec = $null) {
-    Ensure-Directory $RuntimeDir
-    $body = [ordered]@{
-        schema = $ControllerSchema
-        component = $Name.ToLowerInvariant()
-        instance_nonce = $Nonce
-        pid = [int]$Observation.pid
-        creation_time_utc = [string]$Observation.creation_time_utc
-        image_path = [string]$Observation.image_path
-        image_sha256 = [string]$Observation.image_sha256
-    }
-    if ($Name -in @('Bridge','Supervisor')) {
-        if (-not $Spec) { Fail "$Name ledger requires launch specification" }
-        $body['script_path'] = [string]$Spec.ScriptPath
-        $body['script_sha256'] = [string]$Spec.ScriptSha256
-    }
-    if ($Spec -and @($Spec.Dependencies).Count -gt 0) {
-        $body['dependencies'] = @($Spec.Dependencies | ForEach-Object { [ordered]@{ name=[string]$_.Name; path=[string]$_.Path; sha256=[string]$_.Sha256 } })
-    }
-    $tmp = (Ledger-Path $Name) + '.tmp'
-    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
-    Move-Item -LiteralPath $tmp -Destination (Ledger-Path $Name) -Force
-}
-
-function Start-OwnedComponent([string]$Name, $Spec, $Cfg = $null) {
-    $current = Test-OwnedInstance $Name
-    if ($current.Alive) { return $current }
-    if ($current.Reason -eq 'pid-reused') {
-        Reconcile-PidReusedLedger $Name $current | Out-Null
-        $current = Test-OwnedInstance $Name
-        if ($current.Reason -ne 'no-ledger') { Fail "$Name PID-reuse reconcile did not clear stale ownership metadata" }
-    }
-    if ($current.Reason -in @('process-unobservable','image-path-mismatch','image-hash-mismatch','script-hash-mismatch','dependency-hash-mismatch','corrupt-ledger','ledger-schema')) {
-        Fail "$Name ownership conflict: $($current.Reason); refusing to attach or kill an unverified process"
-    }
-    Remove-Item -LiteralPath (Ledger-Path $Name) -Force -ErrorAction SilentlyContinue
-    if ($Name -eq 'Cloud') { Remove-Item -LiteralPath (Join-Path $RuntimeDir 'current-origin.txt') -Force -ErrorAction SilentlyContinue }
-    Ensure-Directory $LogDir
-    $stdout = Log-Path $Name 'stdout'
-    $stderr = Log-Path $Name 'stderr'
-    Remove-Item -LiteralPath $stdout,$stderr -Force -ErrorAction SilentlyContinue
-    $nonceBytes = New-Object byte[] 32
-    [System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($nonceBytes)
-    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
-    $componentExecutableHash = Get-ExecutableHash ([string]$Spec.FilePath)
-    if ($componentExecutableHash -ne [string]$Spec.FileSha256) { Fail "$Name executable hash mismatch before start: expected $($Spec.FileSha256), found $componentExecutableHash" }
-    Assert-ComponentDependencies $Name $Spec 'before start'
-    if ($Name -in @('Bridge','Supervisor')) {
-        $scriptHash = Get-ExecutableHash ([string]$Spec.ScriptPath)
-        if ($scriptHash -ne [string]$Spec.ScriptSha256) { Fail "$Name script hash mismatch before start: expected $($Spec.ScriptSha256), found $scriptHash" }
-    }
-    $args = [string]$Spec.Arguments
-    $start = @{ FilePath=[string]$Spec.FilePath; WorkingDirectory=[string]$Spec.WorkingDirectory; PassThru=$true; WindowStyle='Hidden'; RedirectStandardOutput=$stdout; RedirectStandardError=$stderr }
-    if (-not [string]::IsNullOrWhiteSpace($args)) { $start.ArgumentList = $args }
-    $hadCoreRootEnv = Test-Path Env:DEADBYTE_CORE_ROOT
-    $previousCoreRootEnv = $env:DEADBYTE_CORE_ROOT
-    $hadHostPolicyEnv = Test-Path Env:DEADBYTE_PRIVILEGED_POLICY
-    $previousHostPolicyEnv = $env:DEADBYTE_PRIVILEGED_POLICY
-    $hadWorkspaceRootEnv = Test-Path Env:DEADBYTE_WORKSPACE_ROOT
-    $previousWorkspaceRootEnv = $env:DEADBYTE_WORKSPACE_ROOT
-    $hadAuditRuntimeEnv = Test-Path Env:DEADBYTE_AUDIT_RUNTIME
-    $previousAuditRuntimeEnv = $env:DEADBYTE_AUDIT_RUNTIME
-    $hadMachineRuntimeEnv = Test-Path Env:DEADBYTE_MACHINE_RUNTIME
-    $previousMachineRuntimeEnv = $env:DEADBYTE_MACHINE_RUNTIME
-    $hadAgentRuntimeEnv = Test-Path Env:DEADBYTE_AGENT_RUNTIME
-    $previousAgentRuntimeEnv = $env:DEADBYTE_AGENT_RUNTIME
-    $hadProcessRuntimeEnv = Test-Path Env:DEADBYTE_PROCESS_RUNTIME
-    $previousProcessRuntimeEnv = $env:DEADBYTE_PROCESS_RUNTIME
-    $hadProcessPolicyEnv = Test-Path Env:DEADBYTE_PROCESS_POLICY
-    $previousProcessPolicyEnv = $env:DEADBYTE_PROCESS_POLICY
-    $hadCodingRuntimeEnv = Test-Path Env:DEADBYTE_CODING_RUNTIME
-    $previousCodingRuntimeEnv = $env:DEADBYTE_CODING_RUNTIME
-    $hadMachineFsRuntimeEnv = Test-Path Env:DEADBYTE_MACHINE_FS_RUNTIME
-    $previousMachineFsRuntimeEnv = $env:DEADBYTE_MACHINE_FS_RUNTIME
-    $hadObservationRuntimeEnv = Test-Path Env:DEADBYTE_OBSERVATION_RUNTIME
-    $previousObservationRuntimeEnv = $env:DEADBYTE_OBSERVATION_RUNTIME
-    $hadDesktopRuntimeEnv = Test-Path Env:DEADBYTE_DESKTOP_RUNTIME
-    $previousDesktopRuntimeEnv = $env:DEADBYTE_DESKTOP_RUNTIME
-    $hadDesktopPolicyEnv = Test-Path Env:DEADBYTE_DESKTOP_POLICY
-    $previousDesktopPolicyEnv = $env:DEADBYTE_DESKTOP_POLICY
-    $hadCodingPolicyEnv = Test-Path Env:DEADBYTE_CODING_POLICY
-    $previousCodingPolicyEnv = $env:DEADBYTE_CODING_POLICY
-    $hadSemanticConfigEnv = Test-Path Env:DEADBYTE_SEMANTIC_LSP_CONFIG
-    $previousSemanticLspConfigEnv = $env:DEADBYTE_SEMANTIC_LSP_CONFIG
-    $hadSemanticConfigShaEnv = Test-Path Env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256
-    $previousSemanticLspConfigShaEnv = $env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256
-    $hadAutonomousRuntimeEnv = Test-Path Env:DEADBYTE_AUTONOMOUS_RUNTIME
-    $previousAutonomousRuntimeEnv = $env:DEADBYTE_AUTONOMOUS_RUNTIME
-    $hadAutonomousPolicyEnv = Test-Path Env:DEADBYTE_AUTONOMOUS_POLICY
-    $previousAutonomousPolicyEnv = $env:DEADBYTE_AUTONOMOUS_POLICY
-    $hadSupervisorOnceEnv = Test-Path Env:DEADBYTE_SUPERVISOR_ONCE
-    $previousSupervisorOnceEnv = $env:DEADBYTE_SUPERVISOR_ONCE
-    $hadSupervisorMarkerEnv = Test-Path Env:DEADBYTE_SUPERVISOR_MARKER
-    $previousSupervisorMarkerEnv = $env:DEADBYTE_SUPERVISOR_MARKER
-    $hadAutonomousSupervisorModeEnv = Test-Path Env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE
-    $previousAutonomousSupervisorModeEnv = $env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE
-    $hadCapabilityProfileEnv = Test-Path Env:DEADBYTE_CAPABILITY_PROFILE
-    $previousCapabilityProfileEnv = $env:DEADBYTE_CAPABILITY_PROFILE
-    try {
-        if ($Name -eq 'Bridge' -and $Cfg) {
-            $env:DEADBYTE_CAPABILITY_PROFILE = 'compact'
-            $env:DEADBYTE_AUDIT_RUNTIME = '1'
-            $env:DEADBYTE_CORE_ROOT = [string]$Cfg.CoreRoot
-            $env:DEADBYTE_WORKSPACE_ROOT = [string]$Cfg.WorkspaceRoot
-            $env:DEADBYTE_MACHINE_RUNTIME = if ([bool]$Cfg.MachineRuntimeEnabled) { '1' } else { '0' }
+    if ($cfg.ContainsKey('CodingRuntimeEnabled')) {
+        if ($cfg.CodingRuntimeEnabled -isnot [bool]) { Fail 'CodingRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['CodingRuntimeEnabled'] = $false
+    }
+    if ($cfg.ContainsKey('CodingPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.CodingPolicyFile)) {
+        $codingPolicy = [System.IO.Path]::GetFullPath([string]$cfg.CodingPolicyFile)
+        if (-not (Test-Path -LiteralPath $codingPolicy -PathType Leaf)) { Fail "CodingPolicyFile missing: $codingPolicy" }
+        $cfg['CodingPolicyFile'] = $codingPolicy
+    } else {
+        $cfg['CodingPolicyFile'] = ''
+    }
+    if ([bool]$cfg.CodingRuntimeEnabled -and [string]::IsNullOrWhiteSpace([string]$cfg.CodingPolicyFile)) { Fail 'CodingRuntimeEnabled requires CodingPolicyFile' }
+    $semanticConfigFile = if ($cfg.ContainsKey('SemanticLspConfigFile')) { [string]$cfg.SemanticLspConfigFile } else { '' }
+    $semanticConfigSha = if ($cfg.ContainsKey('SemanticLspConfigSha256')) { ([string]$cfg.SemanticLspConfigSha256).ToLowerInvariant() } else { '' }
+    if ([string]::IsNullOrWhiteSpace($semanticConfigFile) -ne [string]::IsNullOrWhiteSpace($semanticConfigSha)) { Fail 'SemanticLspConfigFile and SemanticLspConfigSha256 must be supplied together' }
+    if (-not [string]::IsNullOrWhiteSpace($semanticConfigFile)) {
+        if (-not [bool]$cfg.CodingRuntimeEnabled) { Fail 'SemanticLspConfigFile requires CodingRuntimeEnabled' }
+        if ($semanticConfigSha -cnotmatch '^[0-9a-f]{64}$') { Fail 'SemanticLspConfigSha256 invalid' }
+        $semanticConfigFile = [System.IO.Path]::GetFullPath($semanticConfigFile)
+        if (-not (Test-Path -LiteralPath $semanticConfigFile -PathType Leaf)) { Fail "SemanticLspConfigFile missing: $semanticConfigFile" }
+        $semanticItem = Get-Item -LiteralPath $semanticConfigFile -Force
+        if (($semanticItem.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { Fail 'SemanticLspConfigFile must not be a reparse point' }
+        $semanticObserved = Get-ExecutableHash $semanticConfigFile
+        if ($semanticObserved -ne $semanticConfigSha) { Fail "semantic LSP config SHA-256 mismatch: expected $semanticConfigSha, found $semanticObserved" }
+        $cfg['SemanticLspConfigFile'] = $semanticConfigFile
+        $cfg['SemanticLspConfigSha256'] = $semanticConfigSha
+    } else {
+        $cfg['SemanticLspConfigFile'] = ''
+        $cfg['SemanticLspConfigSha256'] = ''
+    }
+    if ($cfg.ContainsKey('MachineFsRuntimeEnabled')) {
+        if ($cfg.MachineFsRuntimeEnabled -isnot [bool]) { Fail 'MachineFsRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['MachineFsRuntimeEnabled'] = $false
+    }
+    if ([bool]$cfg.MachineFsRuntimeEnabled -and -not [bool]$cfg.CodingRuntimeEnabled) { Fail 'MachineFsRuntimeEnabled requires CodingRuntimeEnabled' }
+    if ($cfg.ContainsKey('ObservationRuntimeEnabled')) {
+        if ($cfg.ObservationRuntimeEnabled -isnot [bool]) { Fail 'ObservationRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['ObservationRuntimeEnabled'] = $false
+    }
+    if ([bool]$cfg.ObservationRuntimeEnabled -and -not [bool]$cfg.MachineRuntimeEnabled) { Fail 'ObservationRuntimeEnabled requires MachineRuntimeEnabled' }
+    if ([bool]$cfg.ObservationRuntimeEnabled -and -not [bool]$cfg.CodingRuntimeEnabled) { Fail 'ObservationRuntimeEnabled requires CodingRuntimeEnabled' }
+    if ($cfg.ContainsKey('DesktopRuntimeEnabled')) {
+        if ($cfg.DesktopRuntimeEnabled -isnot [bool]) { Fail 'DesktopRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['DesktopRuntimeEnabled'] = $false
+    }
+    if ($cfg.ContainsKey('DesktopPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.DesktopPolicyFile)) {
+        $desktopPolicy = [System.IO.Path]::GetFullPath([string]$cfg.DesktopPolicyFile)
+        if (-not (Test-Path -LiteralPath $desktopPolicy -PathType Leaf)) { Fail "DesktopPolicyFile missing: $desktopPolicy" }
+        $cfg['DesktopPolicyFile'] = $desktopPolicy
+    } else {
+        $cfg['DesktopPolicyFile'] = ''
+    }
+    if ([bool]$cfg.DesktopRuntimeEnabled -and [string]::IsNullOrWhiteSpace([string]$cfg.DesktopPolicyFile)) { Fail 'DesktopRuntimeEnabled requires DesktopPolicyFile' }
+    if ($cfg.ContainsKey('AutonomousRuntimeEnabled')) {
+        if ($cfg.AutonomousRuntimeEnabled -isnot [bool]) { Fail 'AutonomousRuntimeEnabled must be boolean' }
+    } else {
+        $cfg['AutonomousRuntimeEnabled'] = $false
+    }
+    if ($cfg.ContainsKey('AutonomousPolicyFile') -and -not [string]::IsNullOrWhiteSpace([string]$cfg.AutonomousPolicyFile)) {
+        $autonomousPolicy = [System.IO.Path]::GetFullPath([string]$cfg.AutonomousPolicyFile)
+        if (-not (Test-Path -LiteralPath $autonomousPolicy -PathType Leaf)) { Fail "AutonomousPolicyFile missing: $autonomousPolicy" }
+        $cfg['AutonomousPolicyFile'] = $autonomousPolicy
+    } else {
+        $cfg['AutonomousPolicyFile'] = ''
+    }
+    if ([bool]$cfg.AutonomousRuntimeEnabled -and -not [bool]$cfg.CodingRuntimeEnabled) { Fail 'AutonomousRuntimeEnabled requires CodingRuntimeEnabled' }
+    if ([bool]$cfg.AutonomousRuntimeEnabled -and [string]::IsNullOrWhiteSpace([string]$cfg.AutonomousPolicyFile)) { Fail 'AutonomousRuntimeEnabled requires AutonomousPolicyFile' }
+    if ([bool]$cfg.AutonomousSupervisorEnabled -and -not [bool]$cfg.AutonomousRuntimeEnabled) { Fail 'AutonomousSupervisorEnabled requires AutonomousRuntimeEnabled' }
+    if ([int]$cfg.StartTimeoutSeconds -lt 1 -or [int]$cfg.StartTimeoutSeconds -gt 120) { Fail 'StartTimeoutSeconds out of range' }
+    if ([int]$cfg.ProbeTimeoutSeconds -lt 1 -or [int]$cfg.ProbeTimeoutSeconds -gt 15) { Fail 'ProbeTimeoutSeconds out of range' }
+    return $cfg
+}
+
+function Assert-ControllerRootBound($Cfg) {
+    $expected = [System.IO.Path]::GetFullPath((Join-Path ([string]$Cfg.CoreRoot) 'controller')).TrimEnd('\')
+    $actual = [System.IO.Path]::GetFullPath($Root).TrimEnd('\')
+    if (-not [string]::Equals($actual, $expected, [System.StringComparison]::OrdinalIgnoreCase)) {
+        Fail "controller root mismatch: running '$actual', expected '$expected'; use canonical DEADBYTE-MCP.cmd"
+    }
+}
+
+function Get-ExecutableHash([string]$Path) {
+    (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()
+}
+
+function Normalize-ComponentDependencies([string]$Name, $Spec) {
+    if (-not $Spec.ContainsKey('Dependencies')) { $Spec['Dependencies'] = @(); return }
+    $dependencies = @($Spec.Dependencies)
+    if ($dependencies.Count -gt 16) { Fail "$Name dependency count exceeds 16" }
+    $normalized = @()
+    foreach ($dependency in $dependencies) {
+        $depPath = [System.IO.Path]::GetFullPath([string]$dependency.Path)
+        $depHash = ([string]$dependency.Sha256).ToLowerInvariant()
+        if ([string]::IsNullOrWhiteSpace($depPath) -or -not (Test-Path -LiteralPath $depPath -PathType Leaf)) { Fail "$Name dependency missing: $depPath" }
+        if ($depHash -cnotmatch '^[0-9a-f]{64}$') { Fail "$Name dependency SHA-256 invalid: $depPath" }
+        $item = Get-Item -LiteralPath $depPath -Force
+        if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { Fail "$Name dependency must not be a reparse point: $depPath" }
+        $actual = Get-ExecutableHash $depPath
+        if ($actual -ne $depHash) { Fail "$Name dependency hash mismatch in trusted config: $depPath" }
+        $depName = if ([string]::IsNullOrWhiteSpace([string]$dependency.Name)) { [System.IO.Path]::GetFileName($depPath) } else { [string]$dependency.Name }
+        $normalized += [ordered]@{ Name=$depName; Path=$depPath; Sha256=$depHash }
+    }
+    $Spec['Dependencies'] = $normalized
+}
+
+function Assert-ComponentDependencies([string]$Name, $Spec, [string]$Phase) {
+    foreach ($dependency in @($Spec.Dependencies)) {
+        $depPath = [string]$dependency.Path
+        $expected = [string]$dependency.Sha256
+        if (-not (Test-Path -LiteralPath $depPath -PathType Leaf)) { Fail "$Name dependency missing ${Phase}: $depPath" }
+        $actual = Get-ExecutableHash $depPath
+        if ($actual -ne $expected) { Fail "$Name dependency hash mismatch ${Phase}: $depPath expected $expected found $actual" }
+    }
+}
+
+function Get-LimitedProcessImagePath([int]$ProcessId) {
+    if (-not ('DeadbyteProcessQuery' -as [type])) {
+        $source = @'
+using System;
+using System.Text;
+using System.Runtime.InteropServices;
+public static class DeadbyteProcessQuery {
+ [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access, bool inheritHandle, int processId);
+ [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool QueryFullProcessImageName(IntPtr process, uint flags, StringBuilder path, ref int size);
+ [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+ public static string GetImagePath(int processId) { const uint PROCESS_QUERY_LIMITED_INFORMATION=0x1000; IntPtr h=OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION,false,processId); if(h==IntPtr.Zero)return null; try { var b=new StringBuilder(32768); int n=b.Capacity; return QueryFullProcessImageName(h,0,b,ref n)?b.ToString():null; } finally { CloseHandle(h); } }
+}
+'@
+        Add-Type -TypeDefinition $source -Language CSharp -ErrorAction Stop
+    }
+    try { $path=[DeadbyteProcessQuery]::GetImagePath($ProcessId); if ($null -eq $path) { return '' }; return [string]$path } catch { return '' }
+}
+
+function Get-ProcessObservation([int]$ProcessId) {
+    try { $p = Get-Process -Id $ProcessId -ErrorAction Stop } catch { return $null }
+    $image = ''
+    try {
+        $cim = Get-CimInstance Win32_Process -Filter ("ProcessId={0}" -f $ProcessId) -ErrorAction Stop
+        if ($cim -and -not [string]::IsNullOrWhiteSpace([string]$cim.ExecutablePath)) {
+            $image = [string]$cim.ExecutablePath
+        }
+    } catch {}
+    if ([string]::IsNullOrWhiteSpace($image)) {
+        try { $image = [string]$p.Path } catch {}
+    }
+    if ([string]::IsNullOrWhiteSpace($image)) {
+        try { $image = Get-LimitedProcessImagePath $ProcessId } catch {}
+    }
+    if ([string]::IsNullOrWhiteSpace($image)) {
+        try { $image = [string]$p.MainModule.FileName } catch {}
+    }
+    if ([string]::IsNullOrWhiteSpace($image)) { return $null }
+    try { $image = [System.IO.Path]::GetFullPath($image) } catch { return $null }
+    if (-not (Test-Path -LiteralPath $image -PathType Leaf)) { return $null }
+    try { $imageHash = Get-ExecutableHash $image } catch { return $null }
+    [pscustomobject]@{
+        pid = [int]$p.Id
+        creation_time_utc = $p.StartTime.ToUniversalTime().ToString('o')
+        image_path = $image
+        image_sha256 = $imageHash
+    }
+}
+
+function Read-Ledger([string]$Name) {
+    $path = Ledger-Path $Name
+    if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { return $null }
+    try { return (Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json) } catch { return [pscustomobject]@{ corrupt = $true; path = $path } }
+}
+
+function Test-OwnedInstance([string]$Name) {
+    $ledger = Read-Ledger $Name
+    if (-not $ledger) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='no-ledger'; Ledger=$null; Observation=$null } }
+    if ($ledger.PSObject.Properties.Name -contains 'corrupt' -and $ledger.corrupt -eq $true) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='corrupt-ledger'; Ledger=$ledger; Observation=$null } }
+    if ($ledger.schema -ne $ControllerSchema -or -not $ledger.instance_nonce) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='ledger-schema'; Ledger=$ledger; Observation=$null } }
+    if ($Name -in @('Bridge','Supervisor')) {
+        if (-not ($ledger.PSObject.Properties.Name -contains 'script_path') -or -not ($ledger.PSObject.Properties.Name -contains 'script_sha256')) {
+            return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='ledger-schema'; Ledger=$ledger; Observation=$null }
+        }
+        $scriptPath = [string]$ledger.script_path
+        $scriptHash = [string]$ledger.script_sha256
+        if ([string]::IsNullOrWhiteSpace($scriptPath) -or $scriptHash -cnotmatch '^[0-9a-f]{64}$' -or -not (Test-Path -LiteralPath $scriptPath -PathType Leaf)) {
+            return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='script-hash-mismatch'; Ledger=$ledger; Observation=$null }
+        }
+        try { $observedScriptHash = Get-ExecutableHash $scriptPath } catch { $observedScriptHash = '' }
+        if ($observedScriptHash -ne $scriptHash) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='script-hash-mismatch'; Ledger=$ledger; Observation=$null } }
+    }
+    if ($ledger.PSObject.Properties.Name -contains 'dependencies') {
+        foreach ($dependency in @($ledger.dependencies)) {
+            $depPath = [string]$dependency.path
+            $depHash = [string]$dependency.sha256
+            if ([string]::IsNullOrWhiteSpace($depPath) -or $depHash -cnotmatch '^[0-9a-f]{64}$' -or -not (Test-Path -LiteralPath $depPath -PathType Leaf)) {
+                return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='dependency-hash-mismatch'; Ledger=$ledger; Observation=$null }
+            }
+            try { $observedDependencyHash = Get-ExecutableHash $depPath } catch { $observedDependencyHash = '' }
+            if ($observedDependencyHash -ne $depHash) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='dependency-hash-mismatch'; Ledger=$ledger; Observation=$null } }
+        }
+    }
+    $obs = Get-ProcessObservation ([int]$ledger.pid)
+    if (-not $obs) { try { [void](Get-Process -Id ([int]$ledger.pid) -ErrorAction Stop); return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='process-unobservable'; Ledger=$ledger; Observation=$null } } catch { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='process-missing'; Ledger=$ledger; Observation=$null } } }
+    if ($obs.creation_time_utc -ne [string]$ledger.creation_time_utc) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='pid-reused'; Ledger=$ledger; Observation=$obs } }
+    if (-not [string]::Equals($obs.image_path, [string]$ledger.image_path, [System.StringComparison]::OrdinalIgnoreCase)) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='image-path-mismatch'; Ledger=$ledger; Observation=$obs } }
+    if ($obs.image_sha256 -ne [string]$ledger.image_sha256) { return [pscustomobject]@{ Name=$Name; Alive=$false; Reason='image-hash-mismatch'; Ledger=$ledger; Observation=$obs } }
+    [pscustomobject]@{ Name=$Name; Alive=$true; Reason='verified'; Ledger=$ledger; Observation=$obs }
+}
+
+function Reconcile-PidReusedLedger([string]$Name, $Ownership) {
+    if ($null -eq $Ownership -or [string]$Ownership.Reason -ne 'pid-reused') { Fail "$Name PID-reuse reconcile requires pid-reused ownership state" }
+    if ($null -eq $Ownership.Ledger -or $null -eq $Ownership.Observation) { Fail "$Name PID-reuse reconcile requires stale ledger and current process observation" }
+    $ledger = $Ownership.Ledger
+    $observed = $Ownership.Observation
+    if ([int]$ledger.pid -ne [int]$observed.pid) { Fail "$Name PID-reuse reconcile PID mismatch" }
+    if ([string]$ledger.creation_time_utc -eq [string]$observed.creation_time_utc) { Fail "$Name PID-reuse reconcile requires creation-time mismatch" }
+    $ledgerPath = Ledger-Path $Name
+    if (-not (Test-Path -LiteralPath $ledgerPath -PathType Leaf)) { Fail "$Name PID-reuse stale ledger disappeared before archive" }
+    $ledgerSha256 = (Get-FileHash -Algorithm SHA256 -LiteralPath $ledgerPath).Hash.ToLowerInvariant()
+    if ($ledgerSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail "$Name PID-reuse stale ledger SHA-256 invalid" }
+    $evidenceDir = Join-Path $RuntimeDir 'ownership-evidence'
+    Ensure-Directory $evidenceDir
+    $archivePath = Join-Path $evidenceDir ("{0}.stale.{1}.json" -f $Name.ToLowerInvariant(), $ledgerSha256)
+    if (Test-Path -LiteralPath $archivePath -PathType Leaf) {
+        $existingSha256 = (Get-FileHash -Algorithm SHA256 -LiteralPath $archivePath).Hash.ToLowerInvariant()
+        if ($existingSha256 -ne $ledgerSha256) { Fail "$Name PID-reuse evidence archive hash conflict" }
+    } else {
+        Copy-Item -LiteralPath $ledgerPath -Destination $archivePath
+    }
+    $archiveSha256 = (Get-FileHash -Algorithm SHA256 -LiteralPath $archivePath).Hash.ToLowerInvariant()
+    if ($archiveSha256 -ne $ledgerSha256) { Fail "$Name PID-reuse evidence archive verification failed" }
+    $receipt = [ordered]@{
+        schema = 'deadbyte.ownership-recovery.v1'
+        component = $Name.ToLowerInvariant()
+        reason = 'pid-reused'
+        stale_ledger_sha256 = $ledgerSha256
+        stale_ledger_archive = $archivePath
+        stale_pid = [int]$ledger.pid
+        stale_creation_time_utc = [string]$ledger.creation_time_utc
+        stale_image_path = [string]$ledger.image_path
+        stale_image_sha256 = [string]$ledger.image_sha256
+        observed_pid = [int]$observed.pid
+        observed_creation_time_utc = [string]$observed.creation_time_utc
+        observed_image_path = [string]$observed.image_path
+        observed_image_sha256 = [string]$observed.image_sha256
+        reconciled_at_utc = [DateTime]::UtcNow.ToString('o')
+        action = 'archive-stale-ledger-remove-metadata-no-process-kill'
+    }
+    $receiptPath = Join-Path $evidenceDir ("{0}.recovery.{1}.json" -f $Name.ToLowerInvariant(), $ledgerSha256)
+    $receiptTemp = $receiptPath + '.tmp'
+    $receiptJson = $receipt | ConvertTo-Json -Depth 5
+    [System.IO.File]::WriteAllText($receiptTemp, $receiptJson, (New-Object System.Text.UTF8Encoding($false)))
+    Move-Item -LiteralPath $receiptTemp -Destination $receiptPath -Force
+    Remove-Item -LiteralPath (Ledger-Path $Name) -Force
+    if (Test-Path -LiteralPath (Ledger-Path $Name) -PathType Leaf) { Fail "$Name PID-reuse stale ownership metadata removal failed" }
+    return [pscustomobject]@{ Name=$Name; Reason='pid-reused-reconciled'; LedgerSha256=$ledgerSha256; ArchivePath=$archivePath; ReceiptPath=$receiptPath }
+}
+
+function Write-Ledger([string]$Name, $Observation, [string]$Nonce, $Spec = $null) {
+    Ensure-Directory $RuntimeDir
+    $body = [ordered]@{
+        schema = $ControllerSchema
+        component = $Name.ToLowerInvariant()
+        instance_nonce = $Nonce
+        pid = [int]$Observation.pid
+        creation_time_utc = [string]$Observation.creation_time_utc
+        image_path = [string]$Observation.image_path
+        image_sha256 = [string]$Observation.image_sha256
+    }
+    if ($Name -in @('Bridge','Supervisor')) {
+        if (-not $Spec) { Fail "$Name ledger requires launch specification" }
+        $body['script_path'] = [string]$Spec.ScriptPath
+        $body['script_sha256'] = [string]$Spec.ScriptSha256
+    }
+    if ($Spec -and @($Spec.Dependencies).Count -gt 0) {
+        $body['dependencies'] = @($Spec.Dependencies | ForEach-Object { [ordered]@{ name=[string]$_.Name; path=[string]$_.Path; sha256=[string]$_.Sha256 } })
+    }
+    $tmp = (Ledger-Path $Name) + '.tmp'
+    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
+    Move-Item -LiteralPath $tmp -Destination (Ledger-Path $Name) -Force
+}
+
+function Start-OwnedComponent([string]$Name, $Spec, $Cfg = $null) {
+    $current = Test-OwnedInstance $Name
+    if ($current.Alive) { return $current }
+    if ($current.Reason -eq 'pid-reused') {
+        Reconcile-PidReusedLedger $Name $current | Out-Null
+        $current = Test-OwnedInstance $Name
+        if ($current.Reason -ne 'no-ledger') { Fail "$Name PID-reuse reconcile did not clear stale ownership metadata" }
+    }
+    if ($current.Reason -in @('process-unobservable','image-path-mismatch','image-hash-mismatch','script-hash-mismatch','dependency-hash-mismatch','corrupt-ledger','ledger-schema')) {
+        Fail "$Name ownership conflict: $($current.Reason); refusing to attach or kill an unverified process"
+    }
+    Remove-Item -LiteralPath (Ledger-Path $Name) -Force -ErrorAction SilentlyContinue
+    if ($Name -eq 'Cloud') { Remove-Item -LiteralPath (Join-Path $RuntimeDir 'current-origin.txt') -Force -ErrorAction SilentlyContinue }
+    Ensure-Directory $LogDir
+    $stdout = Log-Path $Name 'stdout'
+    $stderr = Log-Path $Name 'stderr'
+    Remove-Item -LiteralPath $stdout,$stderr -Force -ErrorAction SilentlyContinue
+    $nonceBytes = New-Object byte[] 32
+    [System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($nonceBytes)
+    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
+    $componentExecutableHash = Get-ExecutableHash ([string]$Spec.FilePath)
+    if ($componentExecutableHash -ne [string]$Spec.FileSha256) { Fail "$Name executable hash mismatch before start: expected $($Spec.FileSha256), found $componentExecutableHash" }
+    Assert-ComponentDependencies $Name $Spec 'before start'
+    if ($Name -in @('Bridge','Supervisor')) {
+        $scriptHash = Get-ExecutableHash ([string]$Spec.ScriptPath)
+        if ($scriptHash -ne [string]$Spec.ScriptSha256) { Fail "$Name script hash mismatch before start: expected $($Spec.ScriptSha256), found $scriptHash" }
+    }
+    $args = [string]$Spec.Arguments
+    $start = @{ FilePath=[string]$Spec.FilePath; WorkingDirectory=[string]$Spec.WorkingDirectory; PassThru=$true; WindowStyle='Hidden'; RedirectStandardOutput=$stdout; RedirectStandardError=$stderr }
+    if (-not [string]::IsNullOrWhiteSpace($args)) { $start.ArgumentList = $args }
+    $hadCoreRootEnv = Test-Path Env:DEADBYTE_CORE_ROOT
+    $previousCoreRootEnv = $env:DEADBYTE_CORE_ROOT
+    $hadHostPolicyEnv = Test-Path Env:DEADBYTE_PRIVILEGED_POLICY
+    $previousHostPolicyEnv = $env:DEADBYTE_PRIVILEGED_POLICY
+    $hadWorkspaceRootEnv = Test-Path Env:DEADBYTE_WORKSPACE_ROOT
+    $previousWorkspaceRootEnv = $env:DEADBYTE_WORKSPACE_ROOT
+    $hadAuditRuntimeEnv = Test-Path Env:DEADBYTE_AUDIT_RUNTIME
+    $previousAuditRuntimeEnv = $env:DEADBYTE_AUDIT_RUNTIME
+    $hadMachineRuntimeEnv = Test-Path Env:DEADBYTE_MACHINE_RUNTIME
+    $previousMachineRuntimeEnv = $env:DEADBYTE_MACHINE_RUNTIME
+    $hadAgentRuntimeEnv = Test-Path Env:DEADBYTE_AGENT_RUNTIME
+    $previousAgentRuntimeEnv = $env:DEADBYTE_AGENT_RUNTIME
+    $hadProcessRuntimeEnv = Test-Path Env:DEADBYTE_PROCESS_RUNTIME
+    $previousProcessRuntimeEnv = $env:DEADBYTE_PROCESS_RUNTIME
+    $hadProcessPolicyEnv = Test-Path Env:DEADBYTE_PROCESS_POLICY
+    $previousProcessPolicyEnv = $env:DEADBYTE_PROCESS_POLICY
+    $hadCodingRuntimeEnv = Test-Path Env:DEADBYTE_CODING_RUNTIME
+    $previousCodingRuntimeEnv = $env:DEADBYTE_CODING_RUNTIME
+    $hadMachineFsRuntimeEnv = Test-Path Env:DEADBYTE_MACHINE_FS_RUNTIME
+    $previousMachineFsRuntimeEnv = $env:DEADBYTE_MACHINE_FS_RUNTIME
+    $hadObservationRuntimeEnv = Test-Path Env:DEADBYTE_OBSERVATION_RUNTIME
+    $previousObservationRuntimeEnv = $env:DEADBYTE_OBSERVATION_RUNTIME
+    $hadDesktopRuntimeEnv = Test-Path Env:DEADBYTE_DESKTOP_RUNTIME
+    $previousDesktopRuntimeEnv = $env:DEADBYTE_DESKTOP_RUNTIME
+    $hadDesktopPolicyEnv = Test-Path Env:DEADBYTE_DESKTOP_POLICY
+    $previousDesktopPolicyEnv = $env:DEADBYTE_DESKTOP_POLICY
+    $hadCodingPolicyEnv = Test-Path Env:DEADBYTE_CODING_POLICY
+    $previousCodingPolicyEnv = $env:DEADBYTE_CODING_POLICY
+    $hadSemanticConfigEnv = Test-Path Env:DEADBYTE_SEMANTIC_LSP_CONFIG
+    $previousSemanticLspConfigEnv = $env:DEADBYTE_SEMANTIC_LSP_CONFIG
+    $hadSemanticConfigShaEnv = Test-Path Env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256
+    $previousSemanticLspConfigShaEnv = $env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256
+    $hadAutonomousRuntimeEnv = Test-Path Env:DEADBYTE_AUTONOMOUS_RUNTIME
+    $previousAutonomousRuntimeEnv = $env:DEADBYTE_AUTONOMOUS_RUNTIME
+    $hadAutonomousPolicyEnv = Test-Path Env:DEADBYTE_AUTONOMOUS_POLICY
+    $previousAutonomousPolicyEnv = $env:DEADBYTE_AUTONOMOUS_POLICY
+    $hadSupervisorOnceEnv = Test-Path Env:DEADBYTE_SUPERVISOR_ONCE
+    $previousSupervisorOnceEnv = $env:DEADBYTE_SUPERVISOR_ONCE
+    $hadSupervisorMarkerEnv = Test-Path Env:DEADBYTE_SUPERVISOR_MARKER
+    $previousSupervisorMarkerEnv = $env:DEADBYTE_SUPERVISOR_MARKER
+    $hadAutonomousSupervisorModeEnv = Test-Path Env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE
+    $previousAutonomousSupervisorModeEnv = $env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE
+    $hadCapabilityProfileEnv = Test-Path Env:DEADBYTE_CAPABILITY_PROFILE
+    $previousCapabilityProfileEnv = $env:DEADBYTE_CAPABILITY_PROFILE
+    try {
+        if ($Name -eq 'Bridge' -and $Cfg) {
+            $env:DEADBYTE_CAPABILITY_PROFILE = 'compact'
+            $env:DEADBYTE_AUDIT_RUNTIME = '1'
+            $env:DEADBYTE_CORE_ROOT = [string]$Cfg.CoreRoot
+            $env:DEADBYTE_WORKSPACE_ROOT = [string]$Cfg.WorkspaceRoot
+            $env:DEADBYTE_MACHINE_RUNTIME = if ([bool]$Cfg.MachineRuntimeEnabled) { '1' } else { '0' }
             $env:DEADBYTE_AGENT_RUNTIME = if ([bool]$Cfg.AgentRuntimeEnabled) { '1' } else { '0' }
-            $env:DEADBYTE_PROCESS_RUNTIME = if ([bool]$Cfg.ProcessRuntimeEnabled) { '1' } else { '0' }
-            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.ProcessPolicyFile)) {
-                $env:DEADBYTE_PROCESS_POLICY = [string]$Cfg.ProcessPolicyFile
-            }
-            $env:DEADBYTE_CODING_RUNTIME = if ([bool]$Cfg.CodingRuntimeEnabled) { '1' } else { '0' }
-            $env:DEADBYTE_MACHINE_FS_RUNTIME = if ([bool]$Cfg.MachineFsRuntimeEnabled) { '1' } else { '0' }
-            $env:DEADBYTE_OBSERVATION_RUNTIME = if ([bool]$Cfg.ObservationRuntimeEnabled) { '1' } else { '0' }
-            $env:DEADBYTE_DESKTOP_RUNTIME = if ([bool]$Cfg.DesktopRuntimeEnabled) { '1' } else { '0' }
-            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.DesktopPolicyFile)) {
-                $env:DEADBYTE_DESKTOP_POLICY = [string]$Cfg.DesktopPolicyFile
-            } else {
-                Remove-Item Env:DEADBYTE_DESKTOP_POLICY -ErrorAction SilentlyContinue
-            }
-            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.CodingPolicyFile)) {
-                $env:DEADBYTE_CODING_POLICY = [string]$Cfg.CodingPolicyFile
-            }
-            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.SemanticLspConfigFile)) {
-                $env:DEADBYTE_SEMANTIC_LSP_CONFIG = [string]$Cfg.SemanticLspConfigFile
-                $env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256 = [string]$Cfg.SemanticLspConfigSha256
-            } else {
-                Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG -ErrorAction SilentlyContinue
-                Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256 -ErrorAction SilentlyContinue
-            }
-            $env:DEADBYTE_AUTONOMOUS_RUNTIME = if ([bool]$Cfg.AutonomousRuntimeEnabled) { '1' } else { '0' }
-            $env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE = if ([bool]$Cfg.AutonomousSupervisorEnabled) { 'external' } else { 'in_process' }
-            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) {
-                $env:DEADBYTE_AUTONOMOUS_POLICY = [string]$Cfg.AutonomousPolicyFile
-            }
-            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.HostPolicyFile)) {
-                $env:DEADBYTE_PRIVILEGED_POLICY = [string]$Cfg.HostPolicyFile
-            }
-        } elseif ($Name -eq 'Supervisor' -and $Cfg) {
-            Remove-Item Env:DEADBYTE_CAPABILITY_PROFILE -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_AUDIT_RUNTIME -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_PRIVILEGED_POLICY -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_MACHINE_RUNTIME -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_AGENT_RUNTIME -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_PROCESS_RUNTIME -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_PROCESS_POLICY -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_MACHINE_FS_RUNTIME -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_OBSERVATION_RUNTIME -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_DESKTOP_RUNTIME -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_DESKTOP_POLICY -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256 -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE -ErrorAction SilentlyContinue
-            $env:DEADBYTE_CODING_RUNTIME = '1'
-            $env:DEADBYTE_AUTONOMOUS_RUNTIME = '1'
-            $env:DEADBYTE_CODING_POLICY = [string]$Cfg.CodingPolicyFile
-            $env:DEADBYTE_AUTONOMOUS_POLICY = [string]$Cfg.AutonomousPolicyFile
-            $env:DEADBYTE_SUPERVISOR_ONCE = '0'
-            $env:DEADBYTE_SUPERVISOR_MARKER = Join-Path $RuntimeDir 'autonomous-supervisor-owner.json'
-        } else {
-            Remove-Item Env:DEADBYTE_CAPABILITY_PROFILE -ErrorAction SilentlyContinue
-            Remove-Item Env:DEADBYTE_AUDIT_RUNTIME -ErrorAction SilentlyContinue
-        }
-        $proc = Start-Process @start
-    } finally {
-        if ($hadCoreRootEnv) { $env:DEADBYTE_CORE_ROOT = $previousCoreRootEnv }
-        else { Remove-Item Env:DEADBYTE_CORE_ROOT -ErrorAction SilentlyContinue }
-        if ($hadHostPolicyEnv) { $env:DEADBYTE_PRIVILEGED_POLICY = $previousHostPolicyEnv }
-        else { Remove-Item Env:DEADBYTE_PRIVILEGED_POLICY -ErrorAction SilentlyContinue }
-        if ($hadWorkspaceRootEnv) { $env:DEADBYTE_WORKSPACE_ROOT = $previousWorkspaceRootEnv }
-        else { Remove-Item Env:DEADBYTE_WORKSPACE_ROOT -ErrorAction SilentlyContinue }
-        if ($hadAuditRuntimeEnv) { $env:DEADBYTE_AUDIT_RUNTIME = $previousAuditRuntimeEnv }
-        else { Remove-Item Env:DEADBYTE_AUDIT_RUNTIME -ErrorAction SilentlyContinue }
-        if ($hadMachineRuntimeEnv) { $env:DEADBYTE_MACHINE_RUNTIME = $previousMachineRuntimeEnv }
-        else { Remove-Item Env:DEADBYTE_MACHINE_RUNTIME -ErrorAction SilentlyContinue }
-        if ($hadAgentRuntimeEnv) { $env:DEADBYTE_AGENT_RUNTIME = $previousAgentRuntimeEnv }
-        else { Remove-Item Env:DEADBYTE_AGENT_RUNTIME -ErrorAction SilentlyContinue }
-        if ($hadProcessRuntimeEnv) { $env:DEADBYTE_PROCESS_RUNTIME = $previousProcessRuntimeEnv }
-        else { Remove-Item Env:DEADBYTE_PROCESS_RUNTIME -ErrorAction SilentlyContinue }
-        if ($hadProcessPolicyEnv) { $env:DEADBYTE_PROCESS_POLICY = $previousProcessPolicyEnv }
-        else { Remove-Item Env:DEADBYTE_PROCESS_POLICY -ErrorAction SilentlyContinue }
-        if ($hadCodingRuntimeEnv) { $env:DEADBYTE_CODING_RUNTIME = $previousCodingRuntimeEnv }
-        else { Remove-Item Env:DEADBYTE_CODING_RUNTIME -ErrorAction SilentlyContinue }
-        if ($hadMachineFsRuntimeEnv) { $env:DEADBYTE_MACHINE_FS_RUNTIME = $previousMachineFsRuntimeEnv }
-        else { Remove-Item Env:DEADBYTE_MACHINE_FS_RUNTIME -ErrorAction SilentlyContinue }
-        if ($hadObservationRuntimeEnv) { $env:DEADBYTE_OBSERVATION_RUNTIME = $previousObservationRuntimeEnv }
-        else { Remove-Item Env:DEADBYTE_OBSERVATION_RUNTIME -ErrorAction SilentlyContinue }
-        if ($hadDesktopRuntimeEnv) { $env:DEADBYTE_DESKTOP_RUNTIME = $previousDesktopRuntimeEnv }
-        else { Remove-Item Env:DEADBYTE_DESKTOP_RUNTIME -ErrorAction SilentlyContinue }
-        if ($hadDesktopPolicyEnv) { $env:DEADBYTE_DESKTOP_POLICY = $previousDesktopPolicyEnv }
-        else { Remove-Item Env:DEADBYTE_DESKTOP_POLICY -ErrorAction SilentlyContinue }
-        if ($hadCodingPolicyEnv) { $env:DEADBYTE_CODING_POLICY = $previousCodingPolicyEnv }
-        else { Remove-Item Env:DEADBYTE_CODING_POLICY -ErrorAction SilentlyContinue }
-        if ($hadSemanticConfigEnv) { $env:DEADBYTE_SEMANTIC_LSP_CONFIG = $previousSemanticLspConfigEnv }
-        else { Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG -ErrorAction SilentlyContinue }
-        if ($hadSemanticConfigShaEnv) { $env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256 = $previousSemanticLspConfigShaEnv }
-        else { Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256 -ErrorAction SilentlyContinue }
-        if ($hadAutonomousRuntimeEnv) { $env:DEADBYTE_AUTONOMOUS_RUNTIME = $previousAutonomousRuntimeEnv }
-        else { Remove-Item Env:DEADBYTE_AUTONOMOUS_RUNTIME -ErrorAction SilentlyContinue }
-        if ($hadAutonomousPolicyEnv) { $env:DEADBYTE_AUTONOMOUS_POLICY = $previousAutonomousPolicyEnv }
-        else { Remove-Item Env:DEADBYTE_AUTONOMOUS_POLICY -ErrorAction SilentlyContinue }
-        if ($hadSupervisorOnceEnv) { $env:DEADBYTE_SUPERVISOR_ONCE = $previousSupervisorOnceEnv }
-        else { Remove-Item Env:DEADBYTE_SUPERVISOR_ONCE -ErrorAction SilentlyContinue }
-        if ($hadSupervisorMarkerEnv) { $env:DEADBYTE_SUPERVISOR_MARKER = $previousSupervisorMarkerEnv }
-        else { Remove-Item Env:DEADBYTE_SUPERVISOR_MARKER -ErrorAction SilentlyContinue }
-        if ($hadAutonomousSupervisorModeEnv) { $env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE = $previousAutonomousSupervisorModeEnv }
-        else { Remove-Item Env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE -ErrorAction SilentlyContinue }
-        if ($hadCapabilityProfileEnv) { $env:DEADBYTE_CAPABILITY_PROFILE = $previousCapabilityProfileEnv }
-        else { Remove-Item Env:DEADBYTE_CAPABILITY_PROFILE -ErrorAction SilentlyContinue }
-    }
-    Start-Sleep -Milliseconds 150
-    $obs = Get-ProcessObservation ([int]$proc.Id)
-    if (-not $obs) { Fail "$Name exited before identity capture; see $stderr" }
-    $expected = [System.IO.Path]::GetFullPath([string]$Spec.FilePath)
-    if (-not [string]::Equals($obs.image_path, $expected, [System.StringComparison]::OrdinalIgnoreCase)) {
-        try { Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } catch {}
-        Fail "$Name spawned a wrapper instead of the configured long-lived executable; observed '$($obs.image_path)'"
-    }
-    if ($obs.image_sha256 -ne (Get-ExecutableHash $expected)) {
-        try { Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } catch {}
-        Fail "$Name executable changed during start"
-    }
-    Write-Ledger $Name $obs $nonce $Spec
-    return Test-OwnedInstance $Name
-}
-
-function Stop-OwnedComponent([string]$Name) {
-    $owned = Test-OwnedInstance $Name
-    if (-not $owned.Ledger) { return }
-    if (-not $owned.Alive) {
-        if ($owned.Reason -eq 'process-missing') { Remove-Item -LiteralPath (Ledger-Path $Name) -Force -ErrorAction SilentlyContinue; return }
-        if ($owned.Reason -eq 'pid-reused') { Reconcile-PidReusedLedger $Name $owned | Out-Null; return }
-        Fail "$Name is not provably owned ($($owned.Reason)); refusing Stop-Process"
-    }
-    Stop-Process -Id ([int]$owned.Ledger.pid) -Force -ErrorAction Stop
-    try { Wait-Process -Id ([int]$owned.Ledger.pid) -Timeout 5 -ErrorAction SilentlyContinue } catch {}
-    Remove-Item -LiteralPath (Ledger-Path $Name) -Force -ErrorAction SilentlyContinue
-}
-
-function Get-LocalHealth($Cfg) {
-    $response = $null
-    try {
-        $request = [System.Net.HttpWebRequest]::Create([string]$Cfg.LocalReadyUri)
-        $request.Timeout = [int]$Cfg.ProbeTimeoutSeconds * 1000
-        $request.ReadWriteTimeout = [int]$Cfg.ProbeTimeoutSeconds * 1000
-        $response = $request.GetResponse()
-    } catch [System.Net.WebException] {
-        $response = $_.Exception.Response
-        if ($null -eq $response) { return [pscustomobject]@{ State='UNREACHABLE'; StatusCode=0; Diagnostic='readiness endpoint unreachable' } }
-    } catch { return [pscustomobject]@{ State='UNREACHABLE'; StatusCode=0; Diagnostic='readiness probe failed' } }
-    try {
-        $status = [int]$response.StatusCode
-        $reader = New-Object System.IO.StreamReader($response.GetResponseStream())
-        try { $body = $reader.ReadToEnd() } finally { $reader.Dispose() }
-        try { $parsed = $body | ConvertFrom-Json } catch { return [pscustomobject]@{ State='INVALID'; StatusCode=$status; Diagnostic='readiness response JSON invalid' } }
-        if ($parsed.schema -ne 'deadbyte.bridge-health.v1' -or [string]$parsed.state -notin @('STARTING','READY','DEGRADED','RECONCILING','STOPPING')) {
-            return [pscustomobject]@{ State='INVALID'; StatusCode=$status; Diagnostic='readiness response schema invalid' }
-        }
-        return [pscustomobject]@{ State=[string]$parsed.state; StatusCode=$status; Diagnostic=[string]$parsed.diagnostic }
-    } finally { if ($null -ne $response) { $response.Dispose() } }
-}
-function Test-LocalReady($Cfg) {
-    $health = Get-LocalHealth $Cfg
-    return ($health.State -eq 'READY' -and $health.StatusCode -ge 200 -and $health.StatusCode -lt 300)
-}
-function Get-LocalReadyListenerOwners($Cfg) {
-    try { $uri = [Uri]([string]$Cfg.LocalReadyUri) } catch { Fail 'LocalReadyUri is invalid' }
-    if (-not $uri.IsLoopback) { Fail 'LocalReadyUri must be loopback for owned readiness attribution' }
-    try {
-        $listeners = @(Get-NetTCPConnection -State Listen -ErrorAction Stop | Where-Object {
-            [int]$_.LocalPort -eq [int]$uri.Port -and (
-                [string]$_.LocalAddress -eq [string]$uri.Host -or
-            [string]$_.LocalAddress -eq '0.0.0.0' -or
-            [string]$_.LocalAddress -eq '::'
-            )
-        })
-    } catch { Fail "cannot inspect listener ownership for local readiness endpoint: $($_.Exception.Message)" }
-    return @($listeners | ForEach-Object { [int]$_.OwningProcess } | Sort-Object -Unique)
-}
-
-function Assert-LocalReadyPortAvailable($Cfg) {
-    $owners = @(Get-LocalReadyListenerOwners $Cfg)
-    if ($owners.Count -gt 0) {
-        Fail ("local readiness endpoint already has listener pid(s)={0}; refusing to start an unverified Bridge" -f ($owners -join ','))
-    }
-}
-
-function Test-LocalReadyOwned($Cfg, $Bridge) {
-    if (-not $Bridge -or -not $Bridge.Alive) { return $false }
-    $owners = @(Get-LocalReadyListenerOwners $Cfg)
-    if ($owners.Count -ne 1 -or $owners[0] -ne [int]$Bridge.Ledger.pid) { return $false }
-    return (Test-LocalReady $Cfg)
-}
-function Get-LocalHealthOwned($Cfg, $Bridge) {
-    if (-not $Bridge -or -not $Bridge.Alive) { return [pscustomobject]@{ State='UNREACHABLE'; StatusCode=0; Diagnostic='bridge not alive' } }
-    $owners = @(Get-LocalReadyListenerOwners $Cfg)
-    if ($owners.Count -ne 1 -or $owners[0] -ne [int]$Bridge.Ledger.pid) { return [pscustomobject]@{ State='UNATTRIBUTED'; StatusCode=0; Diagnostic='readiness listener ownership mismatch' } }
-    return (Get-LocalHealth $Cfg)
-}
-
-function Get-ObservedState($Cfg) {
-    $bridge = Test-OwnedInstance 'Bridge'
-    $cloud = Test-OwnedInstance 'Cloud'
-    $core = Get-DownstreamCoreObservation $Cfg $bridge
-    $health = if ($bridge.Alive -and $core.alive) { try { Get-LocalHealthOwned $Cfg $bridge } catch { [pscustomobject]@{ State='UNREACHABLE'; StatusCode=0; Diagnostic='readiness attribution failed' } } } else { [pscustomobject]@{ State='UNREACHABLE'; StatusCode=0; Diagnostic='core not alive' } }
-    $ready = $health.State -eq 'READY'
-    $state = if (-not $bridge.Alive -and -not $cloud.Alive) { 'OFFLINE' }
-             elseif (-not $bridge.Alive -and $cloud.Alive) { 'PARKED' }
-             elseif ($bridge.Alive -and $cloud.Alive -and $ready) { 'ONLINE' }
-             elseif ($bridge.Alive -and $cloud.Alive -and $core.alive -and $health.State -eq 'DEGRADED') { 'DEGRADED' }
-             elseif ($bridge.Alive -and $core.reason -eq 'startup-zero-child') { 'STARTING' }
-             else { 'FAILED' }
-    [pscustomobject]@{ State=$state; Bridge=$bridge; Core=$core; Cloud=$cloud; LocalReady=$ready; LocalHealth=$health }
-}
-
-function Wait-LocalOperational($Cfg) {
-    $deadline = [DateTime]::UtcNow.AddSeconds([int]$Cfg.StartTimeoutSeconds)
-    do {
-        $bridge = Test-OwnedInstance 'Bridge'
-        if (-not $bridge.Alive) { return $null }
-        $core = Get-DownstreamCoreObservation $Cfg $bridge
-        if (-not $core.alive -and $core.reason -ne 'startup-zero-child') { return $null }
-        if ($core.alive) {
-            $health = Get-LocalHealthOwned $Cfg $bridge
-            if ($health.State -in @('READY','DEGRADED')) { return $health }
-        }
-        if ([DateTime]::UtcNow -ge $deadline) { return $null }
-        Start-Sleep -Milliseconds 250
-    } while ([DateTime]::UtcNow -lt $deadline)
-    return $null
-}
-
-function Wait-LocalReady($Cfg) {
-    $deadline = [DateTime]::UtcNow.AddSeconds([int]$Cfg.StartTimeoutSeconds)
-    do {
-        $bridge = Test-OwnedInstance 'Bridge'
-        if (-not $bridge.Alive) { return $false }
-        $core = Get-DownstreamCoreObservation $Cfg $bridge
-        if (-not $core.alive -and $core.reason -ne 'startup-zero-child') { return $false }
-        if ($core.alive -and (Test-LocalReadyOwned $Cfg $bridge)) { return $true }
-        if ([DateTime]::UtcNow -ge $deadline) { return $false }
-        Start-Sleep -Milliseconds 250
-    } while ([DateTime]::UtcNow -lt $deadline)
-    return $false
-}
-
-function Wait-PublicDnsReady($Cfg, [string]$Url) {
-    try { $uri = [Uri]$Url } catch { Fail 'public MCP URL is invalid' }
-    if ($uri.Scheme -ne 'https') { Fail 'public MCP URL must be HTTPS' }
-    $deadline = [DateTime]::UtcNow.AddSeconds([int]$Cfg.StartTimeoutSeconds)
-    $requiredConsecutive = 3
-    $consecutive = 0
-    do {
-        try {
-            $addresses = @([System.Net.Dns]::GetHostAddresses($uri.DnsSafeHost))
-            if ($addresses.Count -gt 0) { $consecutive += 1 } else { $consecutive = 0 }
-        } catch { $consecutive = 0 }
-        if ($consecutive -ge $requiredConsecutive) { return }
-        Start-Sleep -Milliseconds 750
-    } while ([DateTime]::UtcNow -lt $deadline)
-    Fail 'public endpoint DNS did not become stably resolvable before gate'
-}
-
-function Get-CurrentUrl($Cfg) {
-    if ($Cfg.ContainsKey('McpUrlFile') -and -not [string]::IsNullOrWhiteSpace([string]$Cfg.McpUrlFile)) {
-        $fullFile = [string]$Cfg.McpUrlFile
-        if (-not (Test-Path -LiteralPath $fullFile -PathType Leaf)) { Fail "McpUrlFile missing: $fullFile" }
-        $transport = if ($Cfg.Cloud.ContainsKey('Transport')) { [string]$Cfg.Cloud.Transport } else { '' }
-        if ($transport -eq 'deadbyte.named-tunnel.v2') {
-            if (-not $Cfg.ContainsKey('McpUrlFileSha256') -or [string]$Cfg.McpUrlFileSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail 'deadbyte.named-tunnel.v2 requires McpUrlFileSha256' }
-            $fullHash = Get-ExecutableHash $fullFile
-            if ($fullHash -ne [string]$Cfg.McpUrlFileSha256) { Fail "McpUrlFile SHA-256 mismatch: expected $($Cfg.McpUrlFileSha256), found $fullHash" }
-        }
-        $full = (Read-TextFileSafe $fullFile).Trim()
-        if ($full -notmatch '^https://') { Fail 'McpUrlFile must contain one HTTPS MCP endpoint' }
-        if ($transport -eq 'deadbyte.named-tunnel.v2') {
-            try { $fullUri = [System.Uri]$full } catch { Fail 'McpUrlFile must contain one valid HTTPS MCP endpoint' }
-            if ($fullUri.DnsSafeHost.ToLowerInvariant().EndsWith('.trycloudflare.com')) { Fail 'trycloudflare endpoint forbidden for deadbyte.named-tunnel.v2' }
-        }
-        return $full
-    }
-    $cloud = Test-OwnedInstance 'Cloud'
-    if (-not $cloud.Alive) { return $null }
-    $originFile = Join-Path $RuntimeDir 'current-origin.txt'
-    $origin = (Read-TextFileSafe $originFile).Trim()
-    if (-not $origin) {
-        $pattern = [string]$Cfg.UrlRegex
-        foreach ($file in @((Log-Path 'Cloud' 'stdout'), (Log-Path 'Cloud' 'stderr'))) {
-            $text = Read-TextFileSafe $file
-            $m = [regex]::Matches($text, $pattern)
-            if ($m.Count -gt 0) { $origin = $m[$m.Count - 1].Value }
-        }
-        if (-not $origin) { return $null }
-        Set-Content -LiteralPath $originFile -Value $origin -Encoding ASCII
-    }
-    $suffix = ''
-    if ($Cfg.ContainsKey('McpPathFile') -and -not [string]::IsNullOrWhiteSpace([string]$Cfg.McpPathFile)) {
-        $pathFile = [string]$Cfg.McpPathFile
-        if (-not (Test-Path -LiteralPath $pathFile -PathType Leaf)) { Fail "McpPathFile missing: $pathFile" }
-        $suffix = (Read-TextFileSafe $pathFile).Trim()
-        if ($suffix -and -not $suffix.StartsWith('/')) { Fail 'MCP path file must contain an absolute URL path beginning with slash' }
-        if ($suffix -match '[\r\n]') { Fail 'MCP path file contains newline data' }
-    }
-    return $origin.TrimEnd('/') + $suffix
-}
-
-function Wait-CurrentUrl($Cfg) {
-    $deadline = [DateTime]::UtcNow.AddSeconds([int]$Cfg.StartTimeoutSeconds)
-    do {
-        $cloud = Test-OwnedInstance 'Cloud'
-        if (-not $cloud.Alive) { return $null }
-        $url = Get-CurrentUrl $Cfg
-        if ($url) { return $url }
-        Start-Sleep -Milliseconds 250
-    } while ([DateTime]::UtcNow -lt $deadline)
-    return $null
-}
-
-function Invoke-CoreGate($Cfg, [string]$ScriptName, [string[]]$ExtraArguments = @()) {
-    $coreRoot = [string]$Cfg.CoreRoot
-    $script = Join-Path (Join-Path $coreRoot 'src') $ScriptName
-    if (-not (Test-Path -LiteralPath $script -PathType Leaf)) { Fail "core gate script missing: $script" }
-    $node = (Get-Command node.exe -ErrorAction Stop).Source
-    $stdout = Log-Path 'CoreGate' 'stdout'
-    $stderr = Log-Path 'CoreGate' 'stderr'
-    Remove-Item -LiteralPath $stdout,$stderr -Force -ErrorAction SilentlyContinue
-    $argv = @(('"{0}"' -f $script))
-    foreach ($arg in $ExtraArguments) {
-        if ($arg -match '[\r\n"]') { Fail 'core gate argument contains forbidden quoting/newline data' }
-        $argv += ('"{0}"' -f $arg)
-    }
-    $proc = Start-Process -FilePath $node -ArgumentList $argv -WorkingDirectory $coreRoot -Wait -PassThru -WindowStyle Hidden -RedirectStandardOutput $stdout -RedirectStandardError $stderr
-    if ($proc.ExitCode -ne 0) {
-        $detail = if (Test-Path -LiteralPath $stderr) { (Get-Content -LiteralPath $stderr -Raw -Encoding UTF8).Trim() } else { '' }
-        Fail "core gate $ScriptName failed exit=$($proc.ExitCode): $detail"
-    }
-    Write-Host (Get-Content -LiteralPath $stdout -Raw -Encoding UTF8)
-}
-
-function Start-Deadbyte($Cfg) {
-    $state = Get-ObservedState $Cfg
-    if ($state.State -in @('ONLINE','DEGRADED')) { return $state }
-    if ($state.State -in @('FAILED','STARTING')) { Fail "runtime is $($state.State); inspect status and reconcile verified owned components before restart" }
-    $cloudWasAlive = [bool]$state.Cloud.Alive
-    Assert-LocalReadyPortAvailable $Cfg
-    try {
-        Start-OwnedComponent 'Bridge' $Cfg.Bridge $Cfg | Out-Null
-        $localHealth = Wait-LocalOperational $Cfg
-        if ($null -eq $localHealth) { Fail 'bridge started but owned local readiness gate failed' }
-        Start-OwnedComponent 'Cloud' $Cfg.Cloud $Cfg | Out-Null
-        if (-not (Wait-CurrentUrl $Cfg)) { Fail 'public endpoint metadata did not become available before timeout' }
-        $final = Get-ObservedState $Cfg
-        if ($final.State -notin @('ONLINE','DEGRADED')) { Fail "start gate failed: observed $($final.State)" }
-        return $final
-    } catch {
-        try { Stop-OwnedComponent 'Bridge' } catch {}
-        if (-not $cloudWasAlive) { try { Stop-OwnedComponent 'Cloud' } catch {} }
-        throw
-    }
-}
-
-function Park-Deadbyte($Cfg) {
-    Disarm-Desktop $Cfg -Quiet
-    Stop-OwnedComponent 'Bridge'
-    $s = Get-ObservedState $Cfg
-    if ($s.State -notin @('PARKED','OFFLINE')) { Fail "park gate failed: observed $($s.State)" }
-    return $s
-}
-
-function Stop-Deadbyte($Cfg) {
-    Disarm-Desktop $Cfg -Quiet
-    Stop-OwnedComponent 'Bridge'
-    Stop-OwnedComponent 'Cloud'
-    Remove-Item -LiteralPath (Join-Path $RuntimeDir 'current-origin.txt') -Force -ErrorAction SilentlyContinue
-    $s = Get-ObservedState $Cfg
-    if ($s.State -ne 'OFFLINE') { Fail "stop gate failed: observed $($s.State)" }
-    return $s
-}
-
-function Assert-PolicyRootsAvailable($Policy, [string]$Plane) {
-    $rootIds = @($Policy.roots.PSObject.Properties.Name)
-    if ($rootIds.Count -lt 1) { Fail "$Plane policy requires at least one root" }
-    foreach ($rootId in $rootIds) {
-        $raw = [string]$Policy.roots.$rootId.path
-        if ([string]::IsNullOrWhiteSpace($raw)) { Fail "$Plane policy root '$rootId' path missing" }
-        try { $full = [System.IO.Path]::GetFullPath($raw) } catch { Fail "$Plane policy root '$rootId' path invalid" }
-        if (-not (Test-Path -LiteralPath $full -PathType Container)) { Fail "$Plane policy root '$rootId' missing: $full" }
-    }
-    return $rootIds
-}
-
-function Get-AuthorityEpochStatus($Cfg, [string]$Plane, [string]$GrantFile, [string]$GrantNonce) {
-    if ([string]::IsNullOrWhiteSpace($GrantNonce) -or $GrantNonce -cnotmatch '^[0-9a-f]{64}$') {
-        return [pscustomobject]@{ Trusted=$false; Reason='epoch-grant-nonce-invalid'; Seq=$null; Action=$null; EventSha256=$null }
-    }
-    try {
-        $verified = Invoke-AuthorityEpochCommand $Cfg $Plane 'status' $GrantFile
-        if (-not $verified.trusted) {
-            return [pscustomobject]@{ Trusted=$false; Reason=[string]$verified.reason; Seq=$verified.seq; Action=$verified.action; EventSha256=$verified.event_sha256 }
-        }
-        return [pscustomobject]@{ Trusted=$true; Reason=[string]$verified.reason; Seq=$verified.seq; Action=$verified.action; EventSha256=$verified.event_sha256 }
-    } catch {
-        return [pscustomobject]@{ Trusted=$false; Reason='authority-epoch-verifier-unavailable'; Seq=$null; Action=$null; EventSha256=$null }
-    }
-}
-
-function Invoke-AuthorityEpochCommand($Cfg, [string]$Plane, [string]$Action, [string]$GrantFile, [string]$UpdateId = '', [string]$ExpectedHead = '') {
-    $cli = Join-Path ([string]$Cfg.CoreRoot) 'src\authority-epoch-cli-r65.mjs'
-    if (-not (Test-Path -LiteralPath $cli -PathType Leaf)) { Fail "authority epoch CLI missing: $cli" }
-    $node = [string]$Cfg.Bridge.FilePath
-    if ([string]::IsNullOrWhiteSpace($node) -or -not (Test-Path -LiteralPath $node -PathType Leaf)) { Fail 'authority epoch Node executable unavailable' }
-    $policyFile = switch ($Plane) {
-        'process' { [string]$Cfg.ProcessPolicyFile }
-        'coding' { [string]$Cfg.CodingPolicyFile }
-        'autonomous' { [string]$Cfg.AutonomousPolicyFile }
-        'desktop' { [string]$Cfg.DesktopPolicyFile }
-        'host' { [string]$Cfg.HostPolicyFile }
-        default { Fail "authority epoch plane invalid: $Plane" }
-    }
-    if ([string]::IsNullOrWhiteSpace($policyFile) -or -not (Test-Path -LiteralPath $policyFile -PathType Leaf)) { Fail "authority epoch policy unavailable for $Plane" }
-    $args = @($cli, $Action, '--plane', $Plane, '--grant-file', $GrantFile, '--policy-file', $policyFile)
-    if ($Action -in @('transaction-revoke','transaction-restore')) {
-        if ([string]::IsNullOrWhiteSpace($UpdateId) -or $ExpectedHead -cnotmatch '^[0-9a-f]{64}$') { Fail 'authority epoch transaction binding invalid' }
-        $args += @('--update-id', $UpdateId, '--expected-head', $ExpectedHead)
-    }
-    $output = @(& $node @args)
-    $exit = $LASTEXITCODE
-    if ($exit -ne 0) { Fail "authority epoch command '$Action' failed for $Plane (exit=$exit)" }
-    try { return (($output -join [Environment]::NewLine) | ConvertFrom-Json) }
-    catch { Fail "authority epoch command '$Action' returned invalid JSON for $Plane" }
-}
-
-function Get-HostPolicyMetadata($Cfg) {
-    if ([string]::IsNullOrWhiteSpace([string]$Cfg.HostPolicyFile)) { Fail 'privileged host plane is not configured' }
-    $policyPath = [string]$Cfg.HostPolicyFile
-    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid host policy JSON: $policyPath" }
-    if (@('deadbyte.host-policy.v1','deadbyte.host-policy.v2') -notcontains [string]$policy.schema -or $policy.enabled -ne $true) { Fail 'host policy schema/enabled mismatch' }
-    if ([string]::IsNullOrWhiteSpace([string]$policy.arm_file)) { Fail 'host policy arm_file missing' }
-    $armFile = [System.IO.Path]::GetFullPath([string]$policy.arm_file)
-    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
-    if (-not $armFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'host policy arm_file must live under controller runtime directory' }
-    Assert-PolicyRootsAvailable $policy 'host' | Out-Null
-    [pscustomobject]@{
-        Path = $policyPath
-        Sha256 = Get-ExecutableHash $policyPath
-        ArmFile = $armFile
-    }
-}
-
-function Get-HostArmStatus($Cfg) {
-    if ([string]::IsNullOrWhiteSpace([string]$Cfg.HostPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy' } }
-    try { $meta = Get-HostPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message } }
-    if (-not (Test-Path -LiteralPath $meta.ArmFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed' } }
-    try { $arm = Get-Content -LiteralPath $meta.ArmFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
-    if ($arm.schema -ne 'deadbyte.host-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
-    if ([string]$arm.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
-    if ([string]$arm.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
-    $epoch = Get-AuthorityEpochStatus $Cfg 'host' $meta.ArmFile ([string]$arm.instance_nonce)
-    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
-}
-
-function Arm-Host($Cfg) {
-    $meta = Get-HostPolicyMetadata $Cfg
-    Ensure-Directory $RuntimeDir
-    $nonceBytes = New-Object byte[] 32
-    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
-    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
-    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
-    $now = [DateTime]::UtcNow
-    $body = [ordered]@{
-        schema = 'deadbyte.host-grant.v2'
-        policy_sha256 = [string]$meta.Sha256
-        instance_nonce = $nonce
-        granted_at_utc = $now.ToString('o')
-    }
-    $tmp = $meta.ArmFile + '.tmp'
-    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
-    Move-Item -LiteralPath $tmp -Destination $meta.ArmFile -Force
-    try { Invoke-AuthorityEpochCommand $Cfg 'host' 'grant' $meta.ArmFile | Out-Null }
-    catch {
-        Remove-Item -LiteralPath $meta.ArmFile -Force -ErrorAction SilentlyContinue
-        throw
-    }
-    Write-Host 'PRIVILEGED HOST PLANE ENABLED UNTIL EXPLICIT REVOKE'
-}
-
-function Disarm-Host($Cfg) {
-    $meta = Get-HostPolicyMetadata $Cfg
-    $epochError = $null
-    if (Test-Path -LiteralPath $meta.ArmFile) {
-        try { Invoke-AuthorityEpochCommand $Cfg 'host' 'user-revoke' $meta.ArmFile | Out-Null } catch { $epochError = $_.Exception }
-        Remove-Item -LiteralPath $meta.ArmFile -Force -ErrorAction SilentlyContinue
-    }
-    if (Test-Path -LiteralPath $meta.ArmFile) { throw 'Host authority revocation failed: grant remains present' }
-    if ($null -ne $epochError) { throw $epochError }
-    Write-Host 'PRIVILEGED HOST PLANE DISARMED'
-}
-
-function Show-HostStatus($Cfg) {
-    $h = Get-HostArmStatus $Cfg
-    Write-Host ("Host plane    : {0} [{1}]" -f $(if ($h.Armed) { 'ARMED' } elseif ($h.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $h.Reason)
-    return $h
-}
-
-function Get-ProcessPolicyMetadata($Cfg) {
-    if ([string]::IsNullOrWhiteSpace([string]$Cfg.ProcessPolicyFile)) { Fail 'process plane is not configured' }
-    $policyPath = [string]$Cfg.ProcessPolicyFile
-    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid process policy JSON: $policyPath" }
-    if ($policy.schema -ne 'deadbyte.process-policy.v1' -or $policy.enabled -ne $true) { Fail 'process policy schema/enabled mismatch' }
-    if ([string]::IsNullOrWhiteSpace([string]$policy.grant_file)) { Fail 'process policy grant_file missing' }
-    $grantFile = [System.IO.Path]::GetFullPath([string]$policy.grant_file)
-    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
-    if (-not $grantFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'process policy grant_file must live under controller runtime directory' }
-    $profileIds = @($policy.profiles.PSObject.Properties.Name)
-    $rootIds = @(Assert-PolicyRootsAvailable $policy 'process')
-    if ($profileIds.Count -lt 1 -or $rootIds.Count -lt 1) { Fail 'process policy requires profiles and roots' }
-    [pscustomobject]@{ Path=$policyPath; Sha256=Get-ExecutableHash $policyPath; GrantFile=$grantFile; ProfileIds=$profileIds; RootIds=$rootIds }
-}
-
-function Get-ProcessGrantStatus($Cfg) {
-    if ([string]::IsNullOrWhiteSpace([string]$Cfg.ProcessPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy' } }
-    try { $meta = Get-ProcessPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message } }
-    if (-not (Test-Path -LiteralPath $meta.GrantFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed' } }
-    try { $grant = Get-Content -LiteralPath $meta.GrantFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
-    if ($grant.schema -ne 'deadbyte.process-grant.v1') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
-    if ([string]$grant.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
-    if ([string]$grant.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
-    $profiles = @($grant.profile_ids); $roots = @($grant.root_ids)
-    if ($profiles.Count -lt 1 -or @($profiles | Where-Object { $_ -notin $meta.ProfileIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='profiles-invalid' } }
-    if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
-    $epoch = Get-AuthorityEpochStatus $Cfg 'process' $meta.GrantFile ([string]$grant.instance_nonce)
-    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
-}
-
-function Arm-Process($Cfg) {
-    $meta = Get-ProcessPolicyMetadata $Cfg
-    Ensure-Directory $RuntimeDir
-    $nonceBytes = New-Object byte[] 32
-    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
-    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
-    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
-    $body = [ordered]@{
-        schema = 'deadbyte.process-grant.v1'
-        policy_sha256 = [string]$meta.Sha256
-        instance_nonce = $nonce
-        profile_ids = @($meta.ProfileIds)
-        root_ids = @($meta.RootIds)
-        granted_at_utc = [DateTime]::UtcNow.ToString('o')
-    }
-    $tmp = $meta.GrantFile + '.tmp'
-    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
-    Move-Item -LiteralPath $tmp -Destination $meta.GrantFile -Force
-    try { Invoke-AuthorityEpochCommand $Cfg 'process' 'grant' $meta.GrantFile | Out-Null }
-    catch {
-        Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
-        throw
-    }
-    Write-Host 'PROCESS PLANE ENABLED UNTIL EXPLICIT REVOKE'
-}
-
-function Disarm-Process($Cfg) {
-    $meta = Get-ProcessPolicyMetadata $Cfg
-    $epochError = $null
-    if (Test-Path -LiteralPath $meta.GrantFile -PathType Leaf) {
-        try { Invoke-AuthorityEpochCommand $Cfg 'process' 'user-revoke' $meta.GrantFile | Out-Null } catch { $epochError = $_.Exception }
-        Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
-    }
-    if (Test-Path -LiteralPath $meta.GrantFile) { throw 'Process authority revocation failed: grant remains present' }
-    if ($null -ne $epochError) { throw $epochError }
-    Write-Host 'PROCESS PLANE DISARMED'
-}
-
-function Show-ProcessStatus($Cfg) {
-    $p = Get-ProcessGrantStatus $Cfg
-    Write-Host ("Process plane  : {0} [{1}]" -f $(if ($p.Armed) { 'ARMED' } elseif ($p.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $p.Reason)
-    return $p
-}
-
-function Get-CodingPolicyMetadata($Cfg) {
-    if ([string]::IsNullOrWhiteSpace([string]$Cfg.CodingPolicyFile)) { Fail 'coding plane is not configured' }
-    $policyPath = [string]$Cfg.CodingPolicyFile
-    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid coding policy JSON: $policyPath" }
-    if ($policy.schema -ne 'deadbyte.coding-policy.v1' -or $policy.enabled -ne $true) { Fail 'coding policy schema/enabled mismatch' }
-    if ([string]::IsNullOrWhiteSpace([string]$policy.lease_file)) { Fail 'coding policy lease_file missing' }
-    $leaseFile = [System.IO.Path]::GetFullPath([string]$policy.lease_file)
-    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
-    if (-not $leaseFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'coding policy lease_file must live under controller runtime directory' }
-    $rootIds = @(Assert-PolicyRootsAvailable $policy 'coding')
-    [pscustomobject]@{ Path=$policyPath; Sha256=Get-ExecutableHash $policyPath; LeaseFile=$leaseFile; RootIds=$rootIds }
-}
-
-function Get-CodingLeaseStatus($Cfg) {
-    if ([string]::IsNullOrWhiteSpace([string]$Cfg.CodingPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy' } }
-    try { $meta = Get-CodingPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message } }
-    if (-not (Test-Path -LiteralPath $meta.LeaseFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed' } }
-    try { $lease = Get-Content -LiteralPath $meta.LeaseFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
-    if ($lease.schema -ne 'deadbyte.coding-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
-    if ([string]$lease.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
-    if ([string]$lease.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
-    $roots = @($lease.root_ids)
-    if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
-    $epoch = Get-AuthorityEpochStatus $Cfg 'coding' $meta.LeaseFile ([string]$lease.instance_nonce)
-    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
-}
-
-function Arm-Coding($Cfg) {
-    $meta = Get-CodingPolicyMetadata $Cfg
-    Ensure-Directory $RuntimeDir
-    $nonceBytes = New-Object byte[] 32
-    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
-    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
-    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
-    $now = [DateTime]::UtcNow
-    $body = [ordered]@{
-        schema = 'deadbyte.coding-grant.v2'
-        policy_sha256 = [string]$meta.Sha256
-        instance_nonce = $nonce
-        root_ids = @($meta.RootIds)
-        granted_at_utc = $now.ToString('o')
-    }
-    $tmp = $meta.LeaseFile + '.tmp'
-    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
-    Move-Item -LiteralPath $tmp -Destination $meta.LeaseFile -Force
-    try { Invoke-AuthorityEpochCommand $Cfg 'coding' 'grant' $meta.LeaseFile | Out-Null }
-    catch {
-        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
-        throw
-    }
-    Write-Host 'CODING PLANE ENABLED UNTIL EXPLICIT REVOKE'
-}
-
-function Disarm-Coding($Cfg) {
-    $meta = Get-CodingPolicyMetadata $Cfg
-    $epochError = $null
-    if (Test-Path -LiteralPath $meta.LeaseFile -PathType Leaf) {
-        try { Invoke-AuthorityEpochCommand $Cfg 'coding' 'user-revoke' $meta.LeaseFile | Out-Null } catch { $epochError = $_.Exception }
-        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
-    }
-    try { Disarm-Autonomous $Cfg -Quiet } catch {
-        if ($null -eq $epochError) { $epochError = $_.Exception }
-        else { Write-Warning "autonomous lease cleanup failed after coding revocation: $($_.Exception.Message)" }
-    }
-    if (Test-Path -LiteralPath $meta.LeaseFile) { throw 'Coding authority revocation failed: grant remains present' }
-    if ($null -ne $epochError) { throw $epochError }
-    Write-Host 'CODING PLANE DISARMED; AUTONOMOUS AUTHORITY REVOKED'
-}
-
-function Show-CodingStatus($Cfg) {
-    $c = Get-CodingLeaseStatus $Cfg
-    Write-Host ("Coding plane  : {0} [{1}]" -f $(if ($c.Armed) { 'ARMED' } elseif ($c.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $c.Reason)
-    return $c
-}
-
-function Get-AutonomousPolicyMetadata($Cfg) {
-    if ([string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) { Fail 'autonomous plane is not configured' }
-    $policyPath = [string]$Cfg.AutonomousPolicyFile
-    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid autonomous policy JSON: $policyPath" }
-    if ($policy.schema -ne 'deadbyte.autonomous-policy.v1' -or $policy.enabled -ne $true) { Fail 'autonomous policy schema/enabled mismatch' }
-    if ([string]::IsNullOrWhiteSpace([string]$policy.lease_file)) { Fail 'autonomous policy lease_file missing' }
-    $leaseFile = [System.IO.Path]::GetFullPath([string]$policy.lease_file)
-    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
-    if (-not $leaseFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'autonomous policy lease_file must live under controller runtime directory' }
-    $codingMeta = Get-CodingPolicyMetadata $Cfg
-    if ([string]$policy.coding_policy_sha256 -ne [string]$codingMeta.Sha256) { Fail 'autonomous policy coding_policy_sha256 mismatch' }
-    $rootIds = @($policy.root_ids)
-    if ($rootIds.Count -lt 1) { Fail 'autonomous policy requires at least one root' }
-    [pscustomobject]@{ Path=$policyPath; Sha256=Get-ExecutableHash $policyPath; LeaseFile=$leaseFile; RootIds=$rootIds; CodingPolicySha256=$codingMeta.Sha256 }
-}
-
-function Get-AutonomousLeaseStatus($Cfg) {
-    if ([string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy' } }
-    try { $meta = Get-AutonomousPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message } }
-    $coding = Get-CodingLeaseStatus $Cfg
-    if (-not $coding.Armed) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='coding-disarmed' } }
-    if (-not (Test-Path -LiteralPath $meta.LeaseFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed' } }
-    try { $lease = Get-Content -LiteralPath $meta.LeaseFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
-    if ($lease.schema -ne 'deadbyte.autonomous-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
-    if ([string]$lease.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
-    if ([string]$lease.coding_policy_sha256 -ne [string]$meta.CodingPolicySha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='coding-policy-digest' } }
-    if ([string]$lease.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
-    $roots = @($lease.root_ids)
-    if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
-    $epoch = Get-AuthorityEpochStatus $Cfg 'autonomous' $meta.LeaseFile ([string]$lease.instance_nonce)
-    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
-}
-
-function Arm-Autonomous($Cfg) {
-    $coding = Get-CodingLeaseStatus $Cfg
-    if (-not $coding.Armed) { Fail 'autonomous plane requires an active coding lease; run armcoding first' }
-    $meta = Get-AutonomousPolicyMetadata $Cfg
-    Ensure-Directory $RuntimeDir
-    $nonceBytes = New-Object byte[] 32
-    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
-    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
-    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
-    $now = [DateTime]::UtcNow
-    $body = [ordered]@{ schema='deadbyte.autonomous-grant.v2'; policy_sha256=[string]$meta.Sha256; coding_policy_sha256=[string]$meta.CodingPolicySha256; instance_nonce=$nonce; root_ids=@($meta.RootIds); granted_at_utc=$now.ToString('o') }
-    $tmp = $meta.LeaseFile + '.tmp'
-    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
-    Move-Item -LiteralPath $tmp -Destination $meta.LeaseFile -Force
-    try { Invoke-AuthorityEpochCommand $Cfg 'autonomous' 'grant' $meta.LeaseFile | Out-Null }
-    catch {
-        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
-        throw
-    }
-    Write-Host 'AUTONOMOUS PLANE ENABLED UNTIL EXPLICIT REVOKE'
-}
-
-function Disarm-Autonomous($Cfg, [switch]$Quiet) {
-    if ([string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) { return }
-    $meta = Get-AutonomousPolicyMetadata $Cfg
-    $epochError = $null
-    if (Test-Path -LiteralPath $meta.LeaseFile -PathType Leaf) {
-        try { Invoke-AuthorityEpochCommand $Cfg 'autonomous' 'user-revoke' $meta.LeaseFile | Out-Null } catch { $epochError = $_.Exception }
-        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
-    }
-    if (Test-Path -LiteralPath $meta.LeaseFile) { throw 'Autonomous authority revocation failed: grant remains present' }
-    if ($null -ne $epochError) { throw $epochError }
-    if (-not $Quiet) { Write-Host 'AUTONOMOUS PLANE DISARMED' }
-}
-
-function Show-AutonomousStatus($Cfg) {
-    $a = Get-AutonomousLeaseStatus $Cfg
-    Write-Host ("Autonomous     : {0} [{1}]" -f $(if ($a.Armed) { 'ARMED' } elseif ($a.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $a.Reason)
-    return $a
-}
-
-function Get-DesktopPolicyMetadata($Cfg) {
-    if ([string]::IsNullOrWhiteSpace([string]$Cfg.DesktopPolicyFile)) { Fail 'desktop plane is not configured' }
-    $policyPath = [string]$Cfg.DesktopPolicyFile
-    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid desktop policy JSON: $policyPath" }
-    if ($policy.schema -ne 'deadbyte.desktop-policy.v1' -or $policy.enabled -ne $true) { Fail 'desktop policy schema/enabled mismatch' }
-    if ([string]::IsNullOrWhiteSpace([string]$policy.grant_file)) { Fail 'desktop policy grant_file missing' }
-    if ([string]::IsNullOrWhiteSpace([string]$policy.evidence_dir)) { Fail 'desktop policy evidence_dir missing' }
-    $grantFile = [System.IO.Path]::GetFullPath([string]$policy.grant_file)
-    $evidenceDir = [System.IO.Path]::GetFullPath([string]$policy.evidence_dir)
-    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
-    if (-not $grantFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'desktop policy grant_file must live under controller runtime directory' }
-    if (-not ($evidenceDir.TrimEnd('\') + '\').StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'desktop policy evidence_dir must live under controller runtime directory' }
-    $knownActions = @('pointer_move','click_primary','click_secondary','double_click_primary','scroll','key_chord','text_input')
-    $actionKinds = @($policy.allowed_actions)
-    $uniqueActions = @($actionKinds | Sort-Object -Unique)
-    if ($actionKinds.Count -lt 1 -or $actionKinds.Count -ne $uniqueActions.Count -or @($actionKinds | Where-Object { $_ -notin $knownActions }).Count -gt 0) { Fail 'desktop policy allowed_actions invalid' }
-    if (-not $policy.observer -or [string]::IsNullOrWhiteSpace([string]$policy.observer.executable) -or [string]$policy.observer.sha256 -cnotmatch '^[0-9a-f]{64}$') { Fail 'desktop observer metadata invalid' }
-    if (-not $policy.input -or [string]::IsNullOrWhiteSpace([string]$policy.input.executable) -or [string]$policy.input.sha256 -cnotmatch '^[0-9a-f]{64}$') { Fail 'desktop input metadata invalid' }
-    if (-not $policy.grounder -or [string]::IsNullOrWhiteSpace([string]$policy.grounder.executable) -or [string]$policy.grounder.sha256 -cnotmatch '^[0-9a-f]{64}$') { Fail 'desktop grounder metadata invalid' }
-    $observerPath = [System.IO.Path]::GetFullPath([string]$policy.observer.executable)
-    $inputPath = [System.IO.Path]::GetFullPath([string]$policy.input.executable)
-    $grounderPath = [System.IO.Path]::GetFullPath([string]$policy.grounder.executable)
-    foreach ($provider in @(
-        [pscustomobject]@{ Name='observer'; Path=$observerPath; Sha256=([string]$policy.observer.sha256).ToLowerInvariant() },
-        [pscustomobject]@{ Name='input'; Path=$inputPath; Sha256=([string]$policy.input.sha256).ToLowerInvariant() },
-        [pscustomobject]@{ Name='grounder'; Path=$grounderPath; Sha256=([string]$policy.grounder.sha256).ToLowerInvariant() }
-    )) {
-        if (-not (Test-Path -LiteralPath $provider.Path -PathType Leaf)) { Fail "desktop $($provider.Name) executable missing: $($provider.Path)" }
-        $item = Get-Item -LiteralPath $provider.Path -Force
-        if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { Fail "desktop $($provider.Name) executable must not be a reparse point" }
-        $actual = Get-ExecutableHash $provider.Path
-        if ($actual -ne $provider.Sha256) { Fail "desktop $($provider.Name) executable SHA-256 mismatch: expected $($provider.Sha256), found $actual" }
-    }
-    [pscustomobject]@{
-        Path=$policyPath; Sha256=Get-ExecutableHash $policyPath; GrantFile=$grantFile; EvidenceDir=$evidenceDir;
-        ActionKinds=$actionKinds; ObserverPath=$observerPath; ObserverSha256=([string]$policy.observer.sha256).ToLowerInvariant();
-        InputPath=$inputPath; InputSha256=([string]$policy.input.sha256).ToLowerInvariant();
-        GrounderPath=$grounderPath; GrounderSha256=([string]$policy.grounder.sha256).ToLowerInvariant()
-    }
-}
-
-function Get-DesktopGrantFileForRevoke($Cfg) {
-    if ([string]::IsNullOrWhiteSpace([string]$Cfg.DesktopPolicyFile)) { return '' }
-    $policyPath = [string]$Cfg.DesktopPolicyFile
-    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid desktop policy JSON during revoke: $policyPath" }
-    if ([string]::IsNullOrWhiteSpace([string]$policy.grant_file)) { Fail 'desktop policy grant_file missing during revoke' }
-    $grantFile = [System.IO.Path]::GetFullPath([string]$policy.grant_file)
-    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
-    if (-not $grantFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'desktop policy grant_file must live under controller runtime directory' }
-    return $grantFile
-}
-
-function Get-DesktopGrantStatus($Cfg) {
-    if ([string]::IsNullOrWhiteSpace([string]$Cfg.DesktopPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy'; ActionKinds=@() } }
-    try { $meta = Get-DesktopPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message; ActionKinds=@() } }
-    if (-not (Test-Path -LiteralPath $meta.GrantFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed'; ActionKinds=@() } }
-    try { $grant = Get-Content -LiteralPath $meta.GrantFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant'; ActionKinds=@() } }
-    if ($grant.schema -ne 'deadbyte.desktop-grant.v1') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema'; ActionKinds=@() } }
-    if ([string]$grant.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest'; ActionKinds=@() } }
-    if ([string]$grant.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid'; ActionKinds=@() } }
-    $actions = @($grant.action_kinds)
-    $unique = @($actions | Sort-Object -Unique)
-    if ($actions.Count -lt 1 -or $actions.Count -ne $unique.Count) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='actions-invalid'; ActionKinds=@() } }
-    if (@($actions | Where-Object { $_ -notin $meta.ActionKinds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='actions-outside-policy'; ActionKinds=@() } }
-    $epoch = Get-AuthorityEpochStatus $Cfg 'desktop' $meta.GrantFile ([string]$grant.instance_nonce)
-    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason; ActionKinds=$actions } }
-    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; ActionKinds=$actions; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
-}
-
-function Arm-Desktop($Cfg) {
-    $meta = Get-DesktopPolicyMetadata $Cfg
-    Ensure-Directory $RuntimeDir
-    Ensure-Directory $meta.EvidenceDir
-    $nonceBytes = New-Object byte[] 32
-    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
-    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
-    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
-    $body = [ordered]@{
-        schema = 'deadbyte.desktop-grant.v1'
-        policy_sha256 = [string]$meta.Sha256
-        instance_nonce = $nonce
-        action_kinds = @($meta.ActionKinds)
-        granted_at_utc = [DateTime]::UtcNow.ToString('o')
-    }
-    $tmp = $meta.GrantFile + '.tmp'
-    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
-    Move-Item -LiteralPath $tmp -Destination $meta.GrantFile -Force
-    try { Invoke-AuthorityEpochCommand $Cfg 'desktop' 'grant' $meta.GrantFile | Out-Null }
-    catch {
-        Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
-        throw
-    }
-    Write-Host ("DESKTOP PLANE ENABLED UNTIL EXPLICIT REVOKE [{0}]" -f ($meta.ActionKinds -join ','))
-}
-
-function Disarm-Desktop($Cfg, [switch]$Quiet) {
-    $grantFile = Get-DesktopGrantFileForRevoke $Cfg
-    if ([string]::IsNullOrWhiteSpace([string]$grantFile)) { return }
-    $epochError = $null
-    if (Test-Path -LiteralPath $grantFile -PathType Leaf) {
-        try { Invoke-AuthorityEpochCommand $Cfg 'desktop' 'user-revoke' $grantFile | Out-Null } catch { $epochError = $_.Exception }
-        Remove-Item -LiteralPath $grantFile -Force -ErrorAction SilentlyContinue
-    }
-    if (Test-Path -LiteralPath $grantFile) { throw 'Desktop authority revocation failed: grant remains present' }
-    if ($null -ne $epochError) { throw $epochError }
-    if (-not $Quiet) { Write-Host 'DESKTOP PLANE DISARMED' }
-}
-
-function Show-DesktopStatus($Cfg) {
-    $d = Get-DesktopGrantStatus $Cfg
-    Write-Host ("Desktop plane : {0} [{1}]" -f $(if ($d.Armed) { 'ARMED' } elseif ($d.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $d.Reason)
-    return $d
-}
-
-function Get-AutonomousSupervisorStatus($Cfg) {
-    if (-not [bool]$Cfg.AutonomousSupervisorEnabled) { return [pscustomobject]@{ Configured=$false; Running=$false; Reason='disabled'; Owned=$null } }
-    $owned = Test-OwnedInstance 'Supervisor'
-    [pscustomobject]@{ Configured=$true; Running=[bool]$owned.Alive; Reason=[string]$owned.Reason; Owned=$owned }
-}
-
-function Start-AutonomousSupervisor($Cfg) {
-    if (-not [bool]$Cfg.AutonomousSupervisorEnabled) { Fail 'autonomous supervisor is disabled by trusted config' }
-    if (-not [bool]$Cfg.AutonomousRuntimeEnabled) { Fail 'autonomous supervisor requires AutonomousRuntimeEnabled' }
-    Start-OwnedComponent 'Supervisor' $Cfg.Supervisor $Cfg | Out-Null
-    $status = Get-AutonomousSupervisorStatus $Cfg
-    if (-not $status.Running) { Fail "autonomous supervisor start failed: $($status.Reason)" }
-    return $status
-}
-
-function Stop-AutonomousSupervisor($Cfg) {
-    if (-not [bool]$Cfg.AutonomousSupervisorEnabled) { return Get-AutonomousSupervisorStatus $Cfg }
-    Stop-OwnedComponent 'Supervisor'
-    return Get-AutonomousSupervisorStatus $Cfg
-}
-
-function Show-AutonomousSupervisorStatus($Cfg) {
-    $s = Get-AutonomousSupervisorStatus $Cfg
-    $label = if (-not $s.Configured) { 'DISABLED' } elseif ($s.Running) { 'RUNNING' } else { 'STOPPED' }
-    Write-Host ("Loop supervisor: {0} [{1}]" -f $label, $s.Reason)
-    return $s
-}
-
-function Recover-AutonomousSupervisor($Cfg) {
-    if (-not [bool]$Cfg.AutonomousSupervisorEnabled) { Fail 'autonomous supervisor recovery requires AutonomousSupervisorEnabled' }
-    Disarm-Desktop $Cfg -Quiet
-    Start-Deadbyte $Cfg | Out-Null
-    try { Disarm-Autonomous $Cfg -Quiet } catch {}
-    try { Disarm-Coding $Cfg } catch {}
-    try { Disarm-Process $Cfg } catch {}
-    try { Disarm-Host $Cfg } catch {}
-    $runtime = Get-ObservedState $Cfg
-    if ($runtime.State -ne 'ONLINE') { Fail "supervisor recovery requires ONLINE runtime; observed $($runtime.State)" }
-    $process = Get-ProcessGrantStatus $Cfg
-    $coding = Get-CodingLeaseStatus $Cfg
-    $autonomous = Get-AutonomousLeaseStatus $Cfg
-    $desktop = Get-DesktopGrantStatus $Cfg
-    $hostStatus = Get-HostArmStatus $Cfg
-    if ($process.Armed -or $coding.Armed -or $autonomous.Armed -or $desktop.Armed -or $hostStatus.Armed) { Fail 'supervisor recovery final authority is not fully disarmed' }
-    $supervisor = Start-AutonomousSupervisor $Cfg
-    Write-Host 'AUTONOMOUS SUPERVISOR RECOVERY PASS: runtime ONLINE; privileged planes DISARMED.'
-    return [pscustomobject]@{ Runtime=$runtime; Supervisor=$supervisor; Process=$process; Coding=$coding; Autonomous=$autonomous; Desktop=$desktop; Host=$hostStatus }
-}
-
-function Get-BoundedObservationReason($Value) {
-    $reason = [string]$Value
-    if ($reason -cmatch '^[a-z][a-z0-9-]{0,63}$') { return $reason }
-    return 'unverified'
-}
-
-function Convert-OwnedObservation($Owned) {
-    $pidValue = $null; $birth = $null
-    if ($Owned.Alive -and $Owned.Ledger) {
-        $pidValue = [int]$Owned.Ledger.pid
-        $birth = [string]$Owned.Ledger.creation_time_utc
-    }
-    [ordered]@{ alive=[bool]$Owned.Alive; reason=(Get-BoundedObservationReason $Owned.Reason); pid=$pidValue; creation_time_utc=$birth }
-}
-
-function Convert-AuthorityObservation($Authority) {
-    $out = [ordered]@{ configured=[bool]$Authority.Configured; armed=[bool]$Authority.Armed; reason=(Get-BoundedObservationReason $Authority.Reason) }
-    $seqProp = $Authority.PSObject.Properties['EpochSeq']
-    $shaProp = $Authority.PSObject.Properties['EpochSha256']
-    if ($null -ne $seqProp -or $null -ne $shaProp) {
-        if ($null -eq $seqProp -or $null -eq $shaProp -or [int64]$seqProp.Value -lt 1 -or [string]$shaProp.Value -cnotmatch '^[0-9a-f]{64}$') {
-            Fail 'authority epoch observation incomplete or invalid'
-        }
-        $out['epoch_seq'] = [int64]$seqProp.Value
-        $out['epoch_sha256'] = [string]$shaProp.Value
-    }
-    return $out
-}
-
-function Get-DownstreamCoreObservation($Cfg, $Bridge) {
-    $out = [ordered]@{ alive=$false; reason='bridge-unavailable'; pid=$null; parent_pid=$null; creation_time_utc=$null; identity_basis=$null }
-    if (-not $Bridge.Alive) { return $out }
-    $bridgePid = [int]$Bridge.Ledger.pid
-    if (-not [string]::Equals([IO.Path]::GetFullPath([string]$Bridge.Ledger.script_path), [IO.Path]::GetFullPath([string]$Cfg.Bridge.ScriptPath), [StringComparison]::OrdinalIgnoreCase) -or [string]$Bridge.Ledger.script_sha256 -ne [string]$Cfg.Bridge.ScriptSha256) {
-        $out.reason='bridge-config-mismatch'; return $out
-    }
-    try {
-        $children = @(Get-CimInstance Win32_Process -Filter ("ParentProcessId={0} AND Name='node.exe'" -f $bridgePid) -ErrorAction Stop)
-        if ($children.Count -eq 0) { $out.reason='startup-zero-child'; return $out }
-        if ($children.Count -ne 1) { $out.reason='ambiguous-core'; return $out }
-        $child = $children[0]
-        if ([int]$child.ParentProcessId -ne $bridgePid -or [int]$child.ProcessId -lt 1 -or $null -eq $child.CreationDate) { $out.reason='core-identity-incomplete'; return $out }
-        if (-not [string]::IsNullOrWhiteSpace([string]$child.ExecutablePath) -and -not [string]::Equals([string]$child.ExecutablePath,[string]$Cfg.Bridge.FilePath,[StringComparison]::OrdinalIgnoreCase)) { $out.reason='core-image-mismatch'; return $out }
-        $command = [string]$child.CommandLine
-        $needle = (Join-Path ([string]$Cfg.CoreRoot) 'src\mcp-server.mjs').Replace('/','\').ToLowerInvariant()
-        if ([string]::IsNullOrWhiteSpace($command)) { $basis='verified-bridge-single-opaque-node-child' }
-        elseif ($command.Replace('/','\').ToLowerInvariant().Contains($needle)) { $basis='command-line' }
-        else { $out.reason='wrong-core-generation'; return $out }
-        $out.alive=$true; $out.reason='verified'; $out.pid=[int]$child.ProcessId; $out.parent_pid=$bridgePid
-        $out.creation_time_utc=$child.CreationDate.ToUniversalTime().ToString('o'); $out.identity_basis=$basis
-        return $out
-    } catch { $out.reason='core-observation-failed'; return $out }
-}
-
-function Get-StructuredObservation($Cfg) {
-    $s = Get-ObservedState $Cfg
-    $supervisor = Get-AutonomousSupervisorStatus $Cfg
-    [ordered]@{
-        schema='deadbyte.controller-observation.v1'
-        observed_at_utc=[DateTime]::UtcNow.ToString('o')
-        state=[string]$s.State
-        core_root=[string]$Cfg.CoreRoot
-        local_ready=[bool]$s.LocalReady
-        bridge=(Convert-OwnedObservation $s.Bridge)
-        core=$s.Core
-        cloud=(Convert-OwnedObservation $s.Cloud)
-        supervisor=[ordered]@{ configured=[bool]$supervisor.Configured; running=[bool]$supervisor.Running; reason=(Get-BoundedObservationReason $supervisor.Reason) }
-        authority=[ordered]@{
-            process=(Convert-AuthorityObservation (Get-ProcessGrantStatus $Cfg))
-            coding=(Convert-AuthorityObservation (Get-CodingLeaseStatus $Cfg))
-            autonomous=(Convert-AuthorityObservation (Get-AutonomousLeaseStatus $Cfg))
-            desktop=(Convert-AuthorityObservation (Get-DesktopGrantStatus $Cfg))
-            host=(Convert-AuthorityObservation (Get-HostArmStatus $Cfg))
-        }
-    }
-}
-
-function Show-State($Cfg) {
-    $s = Get-ObservedState $Cfg
-    $bp = if ($s.Bridge.Alive) { $s.Bridge.Ledger.pid } else { '-' }
-    $cp = if ($s.Cloud.Alive) { $s.Cloud.Ledger.pid } else { '-' }
-    $url = Get-CurrentUrl $Cfg
-    Write-Host ("DEADBYTE MCP = {0}" -f $s.State)
-    Write-Host ("Bridge PID   : {0} [{1}]" -f $bp, $s.Bridge.Reason)
-    Write-Host ("Core PID     : {0} [{1}]" -f $(if ($s.Core.alive) { $s.Core.pid } else { '-' }), $s.Core.reason)
-    Write-Host ("Cloud PID    : {0} [{1}]" -f $cp, $s.Cloud.Reason)
-    Write-Host ("Local ready  : {0}" -f $s.LocalReady)
-    Write-Host ("URL          : {0}" -f $(if ($url) { $url } else { '<unknown>' }))
-    Write-Host ("Machine runtime: {0}" -f $(if ([bool]$Cfg.MachineRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
-    Write-Host ("Agent runtime : {0}" -f $(if ([bool]$Cfg.AgentRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
-    Write-Host ("Process rt    : {0}" -f $(if ([bool]$Cfg.ProcessRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
-    Write-Host ("Coding runtime: {0}" -f $(if ([bool]$Cfg.CodingRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
-    Write-Host ("Machine FS rt : {0}" -f $(if ([bool]$Cfg.MachineFsRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
-    Write-Host ("Observation rt: {0}" -f $(if ([bool]$Cfg.ObservationRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
-    Write-Host ("Desktop runtime: {0}" -f $(if ([bool]$Cfg.DesktopRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
-    Write-Host ("Autonomous rt : {0}" -f $(if ([bool]$Cfg.AutonomousRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
-    Show-AutonomousSupervisorStatus $Cfg | Out-Null
-    Show-ProcessStatus $Cfg | Out-Null
-    Show-CodingStatus $Cfg | Out-Null
-    Show-AutonomousStatus $Cfg | Out-Null
-    Show-DesktopStatus $Cfg | Out-Null
-    Show-HostStatus $Cfg | Out-Null
-    return $s
-}
-
-function Invoke-MachineSmoke($Cfg) {
-    if (-not [bool]$Cfg.MachineRuntimeEnabled) { Fail 'machinetest requires MachineRuntimeEnabled' }
-    $s = Get-ObservedState $Cfg
-    if ($s.State -ne 'ONLINE') { Fail "machinetest requires ONLINE; observed $($s.State)" }
-    $url = Get-CurrentUrl $Cfg
-    if (-not $url) { Fail 'public MCP URL unavailable' }
-    Wait-PublicDnsReady $Cfg $url
-    $probeArgs = @($url)
-    if (-not [string]::IsNullOrWhiteSpace([string]$env:DEADBYTE_REMOTE_PROBE_MODE)) {
-        if ([string]$env:DEADBYTE_REMOTE_PROBE_MODE -notin @('default','desktop','host','full','revoked')) { Fail 'invalid remote enforcement probe mode' }
-        $probeArgs += [string]$env:DEADBYTE_REMOTE_PROBE_MODE
-    }
-    Invoke-CoreGate $Cfg 'remote-mcp-machine-smoke-client.mjs' $probeArgs
-    Write-Host 'MACHINE IDENTITY LIVE GATE PASS: public status/list + SPKI identity + signed Ed25519 ping verified.'
-}
-
-function Invoke-Smoke($Cfg, [bool]$Full) {
-    $s = Get-ObservedState $Cfg
-    if ($s.State -ne 'ONLINE') { Fail "MCP test requires ONLINE; observed $($s.State)" }
-    if (-not (Test-LocalReady $Cfg)) { Fail 'local readiness probe failed' }
-    $url = Get-CurrentUrl $Cfg
-    if (-not $url) { Fail 'public MCP URL unavailable; configure McpUrlFile or McpPathFile' }
-    Wait-PublicDnsReady $Cfg $url
-    Invoke-CoreGate $Cfg 'remote-mcp-smoke-client.mjs' @($url, $(if ($Full) { 'full' } else { 'smoke' }))
-    if ($Full) {
-        Invoke-CoreGate $Cfg 'mcp-contained-smoke-client.mjs'
-        Write-Host 'FULL GATE PASS: public modern MCP + proof + public contained proof + local canonical 3-operation AppContainer/replay/evidence gate.'
-    } else {
-        Write-Host 'MCP SMOKE PASS: public modern MCP + exact tool catalog + signed proof + independent verification.'
-    }
-}
-
-function Invoke-HostSmoke($Cfg) {
-    $h = Get-HostArmStatus $Cfg
-    if (-not $h.Armed) { Fail 'hosttest requires an active local arm lease; run armhost first' }
-    $s = Get-ObservedState $Cfg
-    if ($s.State -ne 'ONLINE') { Fail "hosttest requires ONLINE; observed $($s.State)" }
-    $url = Get-CurrentUrl $Cfg
-    if (-not $url) { Fail 'public MCP URL unavailable' }
-    Wait-PublicDnsReady $Cfg $url
-    Invoke-CoreGate $Cfg 'remote-mcp-host-smoke-client.mjs' @($url)
-    Write-Host 'HOST PLANE LIVE GATE PASS: public host write + hash readback + hash-pinned exec + cleanup.'
-}
-
-function Invoke-CodingSmoke($Cfg) {
-    $c = Get-CodingLeaseStatus $Cfg
-    if (-not $c.Armed) { Fail 'codingtest requires an active local coding lease; run armcoding first' }
-    $s = Get-ObservedState $Cfg
-    if ($s.State -ne 'ONLINE') { Fail "codingtest requires ONLINE; observed $($s.State)" }
-    $url = Get-CurrentUrl $Cfg
-    if (-not $url) { Fail 'public MCP URL unavailable' }
-    Wait-PublicDnsReady $Cfg $url
-    Invoke-CoreGate $Cfg 'remote-mcp-coding-smoke-client.mjs' @($url)
-    Write-Host 'CODING PLANE LIVE GATE PASS: public edit + command + benchmark + durable coding-task receipt verification.'
-}
-
-function Invoke-AutonomousSmoke($Cfg) {
-    $a = Get-AutonomousLeaseStatus $Cfg
-    if (-not $a.Armed) { Fail 'autonomoustest requires active coding + autonomous leases; run armcoding then armautonomous' }
-    $s = Get-ObservedState $Cfg
-    if ($s.State -ne 'ONLINE') { Fail "autonomoustest requires ONLINE; observed $($s.State)" }
-    $url = Get-CurrentUrl $Cfg
-    if (-not $url) { Fail 'public MCP URL unavailable' }
-    Wait-PublicDnsReady $Cfg $url
-    Invoke-CoreGate $Cfg 'remote-mcp-autonomous-smoke-client.mjs' @($url)
-    Write-Host 'AUTONOMOUS PRODUCTION LIVE GATE PASS: public sampling MRTR + native diff + fail/diagnose/replan + build/test/benchmark + signed release gate.'
-}
-
-function Clean-Stale {
-    Ensure-Directory $RuntimeDir
-    foreach ($name in @('Bridge','Cloud','Supervisor')) {
-        $o = Test-OwnedInstance $name
-        if ($o.Ledger -and -not $o.Alive -and $o.Reason -eq 'process-missing') {
-            Remove-Item -LiteralPath (Ledger-Path $name) -Force -ErrorAction SilentlyContinue
-        } elseif ($o.Ledger -and -not $o.Alive -and $o.Reason -ne 'no-ledger') {
-            Write-Warning "$name ledger retained: $($o.Reason). No unverified process was killed."
-        }
-    }
-}
-
-function Run-CommandCore([string]$Name) {
-    $cfg = Get-Config
-    Assert-ControllerRootBound $cfg
-    $readOnly = $Name -in @('status','url','hoststatus','processstatus','codingstatus','autonomousstatus','desktopstatus','supervisorstatus')
-    if (-not $readOnly) { Ensure-Directory $RuntimeDir; Ensure-Directory $LogDir }
-    switch ($Name) {
-        'start'   { Start-Deadbyte $cfg | Out-Null; if ([bool]$cfg.AutonomousSupervisorEnabled) { Start-AutonomousSupervisor $cfg | Out-Null }; Show-State $cfg | Out-Null }
-        'resume'  { Start-Deadbyte $cfg | Out-Null; if ([bool]$cfg.AutonomousSupervisorEnabled) { Start-AutonomousSupervisor $cfg | Out-Null }; Show-State $cfg | Out-Null }
-        'park'    { Park-Deadbyte $cfg | Out-Null; Show-State $cfg | Out-Null }
-        'stop'    { if ([bool]$cfg.AutonomousSupervisorEnabled) { Stop-AutonomousSupervisor $cfg | Out-Null }; Stop-Deadbyte $cfg | Out-Null; Show-State $cfg | Out-Null }
-        'restart' { if ([bool]$cfg.AutonomousSupervisorEnabled) { Stop-AutonomousSupervisor $cfg | Out-Null }; Stop-Deadbyte $cfg | Out-Null; Start-Deadbyte $cfg | Out-Null; if ([bool]$cfg.AutonomousSupervisorEnabled) { Start-AutonomousSupervisor $cfg | Out-Null }; Show-State $cfg | Out-Null }
-        'status'  { if ($Json) { Get-StructuredObservation $cfg | ConvertTo-Json -Depth 6 -Compress | Write-Output } else { Show-State $cfg | Out-Null } }
-        'url'     { $u=Get-CurrentUrl $cfg; if (-not $u) { Fail 'URL unavailable' }; Write-Output $u }
-        'test'    { Invoke-Smoke $cfg $false }
-        'fulltest'{ Invoke-Smoke $cfg $true }
-        'toggle'  { $s=Get-ObservedState $cfg; if ($s.State -eq 'ONLINE') { Park-Deadbyte $cfg | Out-Null } elseif ($s.State -in @('PARKED','OFFLINE')) { Start-Deadbyte $cfg | Out-Null } else { Fail 'toggle refuses DEGRADED state' }; Show-State $cfg | Out-Null }
-        'clean'   { Clean-Stale; Show-State $cfg | Out-Null }
-        'machinetest' { Invoke-MachineSmoke $cfg }
-        'armhost' { Arm-Host $cfg; Show-HostStatus $cfg | Out-Null }
-        'disarmhost' { Disarm-Host $cfg; Show-HostStatus $cfg | Out-Null }
-        'hoststatus' { Show-HostStatus $cfg | Out-Null }
-        'hosttest' { Invoke-HostSmoke $cfg }
-        'armprocess' { Arm-Process $cfg; Show-ProcessStatus $cfg | Out-Null }
-        'disarmprocess' { Disarm-Process $cfg; Show-ProcessStatus $cfg | Out-Null }
-        'processstatus' { Show-ProcessStatus $cfg | Out-Null }
-        'armcoding' { Arm-Coding $cfg; Show-CodingStatus $cfg | Out-Null }
-        'disarmcoding' { Disarm-Coding $cfg; Show-CodingStatus $cfg | Out-Null; Show-AutonomousStatus $cfg | Out-Null }
-        'codingstatus' { Show-CodingStatus $cfg | Out-Null }
-        'codingtest' { Invoke-CodingSmoke $cfg }
-        'armautonomous' { Arm-Autonomous $cfg; Show-AutonomousStatus $cfg | Out-Null }
-        'disarmautonomous' { Disarm-Autonomous $cfg; Show-AutonomousStatus $cfg | Out-Null }
-        'autonomousstatus' { Show-AutonomousStatus $cfg | Out-Null }
-        'autonomoustest' { Invoke-AutonomousSmoke $cfg }
-        'armdesktop' { Arm-Desktop $cfg; Show-DesktopStatus $cfg | Out-Null }
-        'disarmdesktop' { Disarm-Desktop $cfg; Show-DesktopStatus $cfg | Out-Null }
-        'desktopstatus' { Show-DesktopStatus $cfg | Out-Null }
-        'supervisorstart' { Start-AutonomousSupervisor $cfg | Out-Null; Show-AutonomousSupervisorStatus $cfg | Out-Null }
-        'supervisorstop' { Stop-AutonomousSupervisor $cfg | Out-Null; Show-AutonomousSupervisorStatus $cfg | Out-Null }
-        'supervisorstatus' { Show-AutonomousSupervisorStatus $cfg | Out-Null }
-        'supervisorrecover' { Recover-AutonomousSupervisor $cfg | Out-Null; Show-State $cfg | Out-Null }
-        default   { Fail "unknown command '$Name'" }
-    }
-}
-
-function Run-Command([string]$Name) {
-    $mutating = $Name -in @(
-        'start','resume','park','stop','restart','toggle','clean',
-        'armhost','disarmhost','armprocess','disarmprocess','armcoding','disarmcoding',
-        'armautonomous','disarmautonomous','armdesktop','disarmdesktop',
-        'supervisorstart','supervisorstop','supervisorrecover'
-    )
-    if (-not $mutating) {
-        Run-CommandCore $Name
-        return
-    }
-    Invoke-WithControllerMutationLock $Name { Run-CommandCore $Name }
-}
-
-if ($Command -ne 'menu') {
-    $recordsStartFailure = $Command -in @('start','resume','restart')
-    if ($recordsStartFailure) { Remove-Item -LiteralPath (Controller-StartFailurePath) -Force -ErrorAction SilentlyContinue }
-    try {
-        Run-Command $Command
-        exit 0
-    } catch {
-        if ($recordsStartFailure) {
-            try { Write-ControllerStartFailure $Command $_.Exception } catch {}
-        }
-        throw
-    }
-}
-
-while ($true) {
-    Clear-Host
-    $cfg = Get-Config
-    Assert-ControllerRootBound $cfg
-    Write-Host 'DEADBYTE MCP ON-DEMAND CONTROLLER V0.15.5 / R46'
-    Write-Host '======================================'
-    Show-State $cfg | Out-Null
-    Write-Host ''
-    Write-Host '[1] Start / Resume'
-    Write-Host '[2] Park'
-    Write-Host '[3] Full Stop'
-    Write-Host '[4] Restart'
-    Write-Host '[5] Transport smoke test'
-    Write-Host '[6] Public transport gate'
-    Write-Host '[7] Show current URL'
-    Write-Host '[8] Clean stale ledgers'
-    Write-Host '[9] Enable privileged host plane (standing grant)'
-    Write-Host '[10] Revoke privileged host plane'
-    Write-Host '[11] Host plane status'
-    Write-Host '[12] Host plane LIVE gate (requires grant)'
-    Write-Host '[13] Enable coding plane (standing grant)'
-    Write-Host '[14] Revoke coding plane'
-    Write-Host '[15] Coding plane status'
-    Write-Host '[16] Coding plane LIVE gate (requires grant)'
-    Write-Host '[17] Enable autonomous plane (standing grant)'
-    Write-Host '[18] Revoke autonomous plane'
-    Write-Host '[19] Autonomous plane status'
-    Write-Host '[20] Autonomous production LIVE gate'
-    Write-Host '[21] Machine identity LIVE gate (non-mutating)'
-    Write-Host '[22] Enable process plane (standing grant)'
-    Write-Host '[23] Revoke process plane'
-    Write-Host '[24] Process plane status'
-    Write-Host '[25] Enable desktop plane (standing grant; never auto-armed)'
-    Write-Host '[26] Revoke desktop plane'
-    Write-Host '[27] Desktop plane status'
-    Write-Host '[0] Exit controller (runtime stays as-is)'
-    $choice = Read-Host 'Select'
-    try {
-        switch ($choice) {
-            '1' { Run-Command 'start' }
-            '2' { Run-Command 'park' }
-            '3' { Run-Command 'stop' }
-            '4' { Run-Command 'restart' }
-            '5' { Run-Command 'test' }
-            '6' { Run-Command 'fulltest' }
-            '7' { Run-Command 'url' }
-            '8' { Run-Command 'clean' }
-            '9' { Run-Command 'armhost' }
-            '10' { Run-Command 'disarmhost' }
-            '11' { Run-Command 'hoststatus' }
-            '12' { Run-Command 'hosttest' }
-            '13' { Run-Command 'armcoding' }
-            '14' { Run-Command 'disarmcoding' }
-            '15' { Run-Command 'codingstatus' }
-            '16' { Run-Command 'codingtest' }
-            '17' { Run-Command 'armautonomous' }
-            '18' { Run-Command 'disarmautonomous' }
-            '19' { Run-Command 'autonomousstatus' }
-            '20' { Run-Command 'autonomoustest' }
-            '21' { Run-Command 'machinetest' }
-            '22' { Run-Command 'armprocess' }
-            '23' { Run-Command 'disarmprocess' }
-            '24' { Run-Command 'processstatus' }
-            '25' { Run-Command 'armdesktop' }
-            '26' { Run-Command 'disarmdesktop' }
-            '27' { Run-Command 'desktopstatus' }
-            '0' { exit 0 }
-            default { Write-Warning 'invalid selection' }
-        }
-    } catch { Write-Host $_.Exception.Message -ForegroundColor Red }
-    if ($choice -ne '0') { [void](Read-Host 'Press Enter') }
-}
+            $env:DEADBYTE_PROCESS_RUNTIME = if ([bool]$Cfg.ProcessRuntimeEnabled) { '1' } else { '0' }
+            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.ProcessPolicyFile)) {
+                $env:DEADBYTE_PROCESS_POLICY = [string]$Cfg.ProcessPolicyFile
+            }
+            $env:DEADBYTE_CODING_RUNTIME = if ([bool]$Cfg.CodingRuntimeEnabled) { '1' } else { '0' }
+            $env:DEADBYTE_MACHINE_FS_RUNTIME = if ([bool]$Cfg.MachineFsRuntimeEnabled) { '1' } else { '0' }
+            $env:DEADBYTE_OBSERVATION_RUNTIME = if ([bool]$Cfg.ObservationRuntimeEnabled) { '1' } else { '0' }
+            $env:DEADBYTE_DESKTOP_RUNTIME = if ([bool]$Cfg.DesktopRuntimeEnabled) { '1' } else { '0' }
+            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.DesktopPolicyFile)) {
+                $env:DEADBYTE_DESKTOP_POLICY = [string]$Cfg.DesktopPolicyFile
+            } else {
+                Remove-Item Env:DEADBYTE_DESKTOP_POLICY -ErrorAction SilentlyContinue
+            }
+            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.CodingPolicyFile)) {
+                $env:DEADBYTE_CODING_POLICY = [string]$Cfg.CodingPolicyFile
+            }
+            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.SemanticLspConfigFile)) {
+                $env:DEADBYTE_SEMANTIC_LSP_CONFIG = [string]$Cfg.SemanticLspConfigFile
+                $env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256 = [string]$Cfg.SemanticLspConfigSha256
+            } else {
+                Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG -ErrorAction SilentlyContinue
+                Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256 -ErrorAction SilentlyContinue
+            }
+            $env:DEADBYTE_AUTONOMOUS_RUNTIME = if ([bool]$Cfg.AutonomousRuntimeEnabled) { '1' } else { '0' }
+            $env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE = if ([bool]$Cfg.AutonomousSupervisorEnabled) { 'external' } else { 'in_process' }
+            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) {
+                $env:DEADBYTE_AUTONOMOUS_POLICY = [string]$Cfg.AutonomousPolicyFile
+            }
+            if (-not [string]::IsNullOrWhiteSpace([string]$Cfg.HostPolicyFile)) {
+                $env:DEADBYTE_PRIVILEGED_POLICY = [string]$Cfg.HostPolicyFile
+            }
+        } elseif ($Name -eq 'Supervisor' -and $Cfg) {
+            Remove-Item Env:DEADBYTE_CAPABILITY_PROFILE -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_AUDIT_RUNTIME -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_PRIVILEGED_POLICY -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_MACHINE_RUNTIME -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_AGENT_RUNTIME -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_PROCESS_RUNTIME -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_PROCESS_POLICY -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_MACHINE_FS_RUNTIME -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_OBSERVATION_RUNTIME -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_DESKTOP_RUNTIME -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_DESKTOP_POLICY -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256 -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE -ErrorAction SilentlyContinue
+            $env:DEADBYTE_CODING_RUNTIME = '1'
+            $env:DEADBYTE_AUTONOMOUS_RUNTIME = '1'
+            $env:DEADBYTE_CODING_POLICY = [string]$Cfg.CodingPolicyFile
+            $env:DEADBYTE_AUTONOMOUS_POLICY = [string]$Cfg.AutonomousPolicyFile
+            $env:DEADBYTE_SUPERVISOR_ONCE = '0'
+            $env:DEADBYTE_SUPERVISOR_MARKER = Join-Path $RuntimeDir 'autonomous-supervisor-owner.json'
+        } else {
+            Remove-Item Env:DEADBYTE_CAPABILITY_PROFILE -ErrorAction SilentlyContinue
+            Remove-Item Env:DEADBYTE_AUDIT_RUNTIME -ErrorAction SilentlyContinue
+        }
+        $proc = Start-Process @start
+    } finally {
+        if ($hadCoreRootEnv) { $env:DEADBYTE_CORE_ROOT = $previousCoreRootEnv }
+        else { Remove-Item Env:DEADBYTE_CORE_ROOT -ErrorAction SilentlyContinue }
+        if ($hadHostPolicyEnv) { $env:DEADBYTE_PRIVILEGED_POLICY = $previousHostPolicyEnv }
+        else { Remove-Item Env:DEADBYTE_PRIVILEGED_POLICY -ErrorAction SilentlyContinue }
+        if ($hadWorkspaceRootEnv) { $env:DEADBYTE_WORKSPACE_ROOT = $previousWorkspaceRootEnv }
+        else { Remove-Item Env:DEADBYTE_WORKSPACE_ROOT -ErrorAction SilentlyContinue }
+        if ($hadAuditRuntimeEnv) { $env:DEADBYTE_AUDIT_RUNTIME = $previousAuditRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_AUDIT_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadMachineRuntimeEnv) { $env:DEADBYTE_MACHINE_RUNTIME = $previousMachineRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_MACHINE_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadAgentRuntimeEnv) { $env:DEADBYTE_AGENT_RUNTIME = $previousAgentRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_AGENT_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadProcessRuntimeEnv) { $env:DEADBYTE_PROCESS_RUNTIME = $previousProcessRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_PROCESS_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadProcessPolicyEnv) { $env:DEADBYTE_PROCESS_POLICY = $previousProcessPolicyEnv }
+        else { Remove-Item Env:DEADBYTE_PROCESS_POLICY -ErrorAction SilentlyContinue }
+        if ($hadCodingRuntimeEnv) { $env:DEADBYTE_CODING_RUNTIME = $previousCodingRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_CODING_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadMachineFsRuntimeEnv) { $env:DEADBYTE_MACHINE_FS_RUNTIME = $previousMachineFsRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_MACHINE_FS_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadObservationRuntimeEnv) { $env:DEADBYTE_OBSERVATION_RUNTIME = $previousObservationRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_OBSERVATION_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadDesktopRuntimeEnv) { $env:DEADBYTE_DESKTOP_RUNTIME = $previousDesktopRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_DESKTOP_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadDesktopPolicyEnv) { $env:DEADBYTE_DESKTOP_POLICY = $previousDesktopPolicyEnv }
+        else { Remove-Item Env:DEADBYTE_DESKTOP_POLICY -ErrorAction SilentlyContinue }
+        if ($hadCodingPolicyEnv) { $env:DEADBYTE_CODING_POLICY = $previousCodingPolicyEnv }
+        else { Remove-Item Env:DEADBYTE_CODING_POLICY -ErrorAction SilentlyContinue }
+        if ($hadSemanticConfigEnv) { $env:DEADBYTE_SEMANTIC_LSP_CONFIG = $previousSemanticLspConfigEnv }
+        else { Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG -ErrorAction SilentlyContinue }
+        if ($hadSemanticConfigShaEnv) { $env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256 = $previousSemanticLspConfigShaEnv }
+        else { Remove-Item Env:DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256 -ErrorAction SilentlyContinue }
+        if ($hadAutonomousRuntimeEnv) { $env:DEADBYTE_AUTONOMOUS_RUNTIME = $previousAutonomousRuntimeEnv }
+        else { Remove-Item Env:DEADBYTE_AUTONOMOUS_RUNTIME -ErrorAction SilentlyContinue }
+        if ($hadAutonomousPolicyEnv) { $env:DEADBYTE_AUTONOMOUS_POLICY = $previousAutonomousPolicyEnv }
+        else { Remove-Item Env:DEADBYTE_AUTONOMOUS_POLICY -ErrorAction SilentlyContinue }
+        if ($hadSupervisorOnceEnv) { $env:DEADBYTE_SUPERVISOR_ONCE = $previousSupervisorOnceEnv }
+        else { Remove-Item Env:DEADBYTE_SUPERVISOR_ONCE -ErrorAction SilentlyContinue }
+        if ($hadSupervisorMarkerEnv) { $env:DEADBYTE_SUPERVISOR_MARKER = $previousSupervisorMarkerEnv }
+        else { Remove-Item Env:DEADBYTE_SUPERVISOR_MARKER -ErrorAction SilentlyContinue }
+        if ($hadAutonomousSupervisorModeEnv) { $env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE = $previousAutonomousSupervisorModeEnv }
+        else { Remove-Item Env:DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE -ErrorAction SilentlyContinue }
+        if ($hadCapabilityProfileEnv) { $env:DEADBYTE_CAPABILITY_PROFILE = $previousCapabilityProfileEnv }
+        else { Remove-Item Env:DEADBYTE_CAPABILITY_PROFILE -ErrorAction SilentlyContinue }
+    }
+    Start-Sleep -Milliseconds 150
+    $obs = Get-ProcessObservation ([int]$proc.Id)
+    if (-not $obs) { Fail "$Name exited before identity capture; see $stderr" }
+    $expected = [System.IO.Path]::GetFullPath([string]$Spec.FilePath)
+    if (-not [string]::Equals($obs.image_path, $expected, [System.StringComparison]::OrdinalIgnoreCase)) {
+        try { Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } catch {}
+        Fail "$Name spawned a wrapper instead of the configured long-lived executable; observed '$($obs.image_path)'"
+    }
+    if ($obs.image_sha256 -ne (Get-ExecutableHash $expected)) {
+        try { Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue } catch {}
+        Fail "$Name executable changed during start"
+    }
+    Write-Ledger $Name $obs $nonce $Spec
+    return Test-OwnedInstance $Name
+}
+
+function Stop-OwnedComponent([string]$Name) {
+    $owned = Test-OwnedInstance $Name
+    if (-not $owned.Ledger) { return }
+    if (-not $owned.Alive) {
+        if ($owned.Reason -eq 'process-missing') { Remove-Item -LiteralPath (Ledger-Path $Name) -Force -ErrorAction SilentlyContinue; return }
+        if ($owned.Reason -eq 'pid-reused') { Reconcile-PidReusedLedger $Name $owned | Out-Null; return }
+        Fail "$Name is not provably owned ($($owned.Reason)); refusing Stop-Process"
+    }
+    Stop-Process -Id ([int]$owned.Ledger.pid) -Force -ErrorAction Stop
+    try { Wait-Process -Id ([int]$owned.Ledger.pid) -Timeout 5 -ErrorAction SilentlyContinue } catch {}
+    Remove-Item -LiteralPath (Ledger-Path $Name) -Force -ErrorAction SilentlyContinue
+}
+
+function Get-LocalHealth($Cfg) {
+    $response = $null
+    try {
+        $request = [System.Net.HttpWebRequest]::Create([string]$Cfg.LocalReadyUri)
+        $request.Timeout = [int]$Cfg.ProbeTimeoutSeconds * 1000
+        $request.ReadWriteTimeout = [int]$Cfg.ProbeTimeoutSeconds * 1000
+        $response = $request.GetResponse()
+    } catch [System.Net.WebException] {
+        $response = $_.Exception.Response
+        if ($null -eq $response) { return [pscustomobject]@{ State='UNREACHABLE'; StatusCode=0; Diagnostic='readiness endpoint unreachable' } }
+    } catch { return [pscustomobject]@{ State='UNREACHABLE'; StatusCode=0; Diagnostic='readiness probe failed' } }
+    try {
+        $status = [int]$response.StatusCode
+        $reader = New-Object System.IO.StreamReader($response.GetResponseStream())
+        try { $body = $reader.ReadToEnd() } finally { $reader.Dispose() }
+        try { $parsed = $body | ConvertFrom-Json } catch { return [pscustomobject]@{ State='INVALID'; StatusCode=$status; Diagnostic='readiness response JSON invalid' } }
+        if ($parsed.schema -ne 'deadbyte.bridge-health.v1' -or [string]$parsed.state -notin @('STARTING','READY','DEGRADED','RECONCILING','STOPPING')) {
+            return [pscustomobject]@{ State='INVALID'; StatusCode=$status; Diagnostic='readiness response schema invalid' }
+        }
+        return [pscustomobject]@{ State=[string]$parsed.state; StatusCode=$status; Diagnostic=[string]$parsed.diagnostic }
+    } finally { if ($null -ne $response) { $response.Dispose() } }
+}
+function Test-LocalReady($Cfg) {
+    $health = Get-LocalHealth $Cfg
+    return ($health.State -eq 'READY' -and $health.StatusCode -ge 200 -and $health.StatusCode -lt 300)
+}
+function Get-LocalReadyListenerOwners($Cfg) {
+    try { $uri = [Uri]([string]$Cfg.LocalReadyUri) } catch { Fail 'LocalReadyUri is invalid' }
+    if (-not $uri.IsLoopback) { Fail 'LocalReadyUri must be loopback for owned readiness attribution' }
+    try {
+        $listeners = @(Get-NetTCPConnection -State Listen -ErrorAction Stop | Where-Object {
+            [int]$_.LocalPort -eq [int]$uri.Port -and (
+                [string]$_.LocalAddress -eq [string]$uri.Host -or
+            [string]$_.LocalAddress -eq '0.0.0.0' -or
+            [string]$_.LocalAddress -eq '::'
+            )
+        })
+    } catch { Fail "cannot inspect listener ownership for local readiness endpoint: $($_.Exception.Message)" }
+    return @($listeners | ForEach-Object { [int]$_.OwningProcess } | Sort-Object -Unique)
+}
+
+function Assert-LocalReadyPortAvailable($Cfg) {
+    $owners = @(Get-LocalReadyListenerOwners $Cfg)
+    if ($owners.Count -gt 0) {
+        Fail ("local readiness endpoint already has listener pid(s)={0}; refusing to start an unverified Bridge" -f ($owners -join ','))
+    }
+}
+
+function Test-LocalReadyOwned($Cfg, $Bridge) {
+    if (-not $Bridge -or -not $Bridge.Alive) { return $false }
+    $owners = @(Get-LocalReadyListenerOwners $Cfg)
+    if ($owners.Count -ne 1 -or $owners[0] -ne [int]$Bridge.Ledger.pid) { return $false }
+    return (Test-LocalReady $Cfg)
+}
+function Get-LocalHealthOwned($Cfg, $Bridge) {
+    if (-not $Bridge -or -not $Bridge.Alive) { return [pscustomobject]@{ State='UNREACHABLE'; StatusCode=0; Diagnostic='bridge not alive' } }
+    $owners = @(Get-LocalReadyListenerOwners $Cfg)
+    if ($owners.Count -ne 1 -or $owners[0] -ne [int]$Bridge.Ledger.pid) { return [pscustomobject]@{ State='UNATTRIBUTED'; StatusCode=0; Diagnostic='readiness listener ownership mismatch' } }
+    return (Get-LocalHealth $Cfg)
+}
+
+function Get-ObservedState($Cfg) {
+    $bridge = Test-OwnedInstance 'Bridge'
+    $cloud = Test-OwnedInstance 'Cloud'
+    $core = Get-DownstreamCoreObservation $Cfg $bridge
+    $health = if ($bridge.Alive -and $core.alive) { try { Get-LocalHealthOwned $Cfg $bridge } catch { [pscustomobject]@{ State='UNREACHABLE'; StatusCode=0; Diagnostic='readiness attribution failed' } } } else { [pscustomobject]@{ State='UNREACHABLE'; StatusCode=0; Diagnostic='core not alive' } }
+    $ready = $health.State -eq 'READY'
+    $state = if (-not $bridge.Alive -and -not $cloud.Alive) { 'OFFLINE' }
+             elseif (-not $bridge.Alive -and $cloud.Alive) { 'PARKED' }
+             elseif ($bridge.Alive -and $cloud.Alive -and $ready) { 'ONLINE' }
+             elseif ($bridge.Alive -and $cloud.Alive -and $core.alive -and $health.State -eq 'DEGRADED') { 'DEGRADED' }
+             elseif ($bridge.Alive -and $core.reason -eq 'startup-zero-child') { 'STARTING' }
+             else { 'FAILED' }
+    [pscustomobject]@{ State=$state; Bridge=$bridge; Core=$core; Cloud=$cloud; LocalReady=$ready; LocalHealth=$health }
+}
+
+function Wait-LocalOperational($Cfg) {
+    $deadline = [DateTime]::UtcNow.AddSeconds([int]$Cfg.StartTimeoutSeconds)
+    do {
+        $bridge = Test-OwnedInstance 'Bridge'
+        if (-not $bridge.Alive) { return $null }
+        $core = Get-DownstreamCoreObservation $Cfg $bridge
+        if (-not $core.alive -and $core.reason -ne 'startup-zero-child') { return $null }
+        if ($core.alive) {
+            $health = Get-LocalHealthOwned $Cfg $bridge
+            if ($health.State -in @('READY','DEGRADED')) { return $health }
+        }
+        if ([DateTime]::UtcNow -ge $deadline) { return $null }
+        Start-Sleep -Milliseconds 250
+    } while ([DateTime]::UtcNow -lt $deadline)
+    return $null
+}
+
+function Wait-LocalReady($Cfg) {
+    $deadline = [DateTime]::UtcNow.AddSeconds([int]$Cfg.StartTimeoutSeconds)
+    do {
+        $bridge = Test-OwnedInstance 'Bridge'
+        if (-not $bridge.Alive) { return $false }
+        $core = Get-DownstreamCoreObservation $Cfg $bridge
+        if (-not $core.alive -and $core.reason -ne 'startup-zero-child') { return $false }
+        if ($core.alive -and (Test-LocalReadyOwned $Cfg $bridge)) { return $true }
+        if ([DateTime]::UtcNow -ge $deadline) { return $false }
+        Start-Sleep -Milliseconds 250
+    } while ([DateTime]::UtcNow -lt $deadline)
+    return $false
+}
+
+function Wait-PublicDnsReady($Cfg, [string]$Url) {
+    try { $uri = [Uri]$Url } catch { Fail 'public MCP URL is invalid' }
+    if ($uri.Scheme -ne 'https') { Fail 'public MCP URL must be HTTPS' }
+    $deadline = [DateTime]::UtcNow.AddSeconds([int]$Cfg.StartTimeoutSeconds)
+    $requiredConsecutive = 3
+    $consecutive = 0
+    do {
+        try {
+            $addresses = @([System.Net.Dns]::GetHostAddresses($uri.DnsSafeHost))
+            if ($addresses.Count -gt 0) { $consecutive += 1 } else { $consecutive = 0 }
+        } catch { $consecutive = 0 }
+        if ($consecutive -ge $requiredConsecutive) { return }
+        Start-Sleep -Milliseconds 750
+    } while ([DateTime]::UtcNow -lt $deadline)
+    Fail 'public endpoint DNS did not become stably resolvable before gate'
+}
+
+function Get-CurrentUrl($Cfg) {
+    if ($Cfg.ContainsKey('McpUrlFile') -and -not [string]::IsNullOrWhiteSpace([string]$Cfg.McpUrlFile)) {
+        $fullFile = [string]$Cfg.McpUrlFile
+        if (-not (Test-Path -LiteralPath $fullFile -PathType Leaf)) { Fail "McpUrlFile missing: $fullFile" }
+        $transport = if ($Cfg.Cloud.ContainsKey('Transport')) { [string]$Cfg.Cloud.Transport } else { '' }
+        if ($transport -eq 'deadbyte.named-tunnel.v2') {
+            if (-not $Cfg.ContainsKey('McpUrlFileSha256') -or [string]$Cfg.McpUrlFileSha256 -cnotmatch '^[0-9a-f]{64}$') { Fail 'deadbyte.named-tunnel.v2 requires McpUrlFileSha256' }
+            $fullHash = Get-ExecutableHash $fullFile
+            if ($fullHash -ne [string]$Cfg.McpUrlFileSha256) { Fail "McpUrlFile SHA-256 mismatch: expected $($Cfg.McpUrlFileSha256), found $fullHash" }
+        }
+        $full = (Read-TextFileSafe $fullFile).Trim()
+        if ($full -notmatch '^https://') { Fail 'McpUrlFile must contain one HTTPS MCP endpoint' }
+        if ($transport -eq 'deadbyte.named-tunnel.v2') {
+            try { $fullUri = [System.Uri]$full } catch { Fail 'McpUrlFile must contain one valid HTTPS MCP endpoint' }
+            if ($fullUri.DnsSafeHost.ToLowerInvariant().EndsWith('.trycloudflare.com')) { Fail 'trycloudflare endpoint forbidden for deadbyte.named-tunnel.v2' }
+        }
+        return $full
+    }
+    $cloud = Test-OwnedInstance 'Cloud'
+    if (-not $cloud.Alive) { return $null }
+    $originFile = Join-Path $RuntimeDir 'current-origin.txt'
+    $origin = (Read-TextFileSafe $originFile).Trim()
+    if (-not $origin) {
+        $pattern = [string]$Cfg.UrlRegex
+        foreach ($file in @((Log-Path 'Cloud' 'stdout'), (Log-Path 'Cloud' 'stderr'))) {
+            $text = Read-TextFileSafe $file
+            $m = [regex]::Matches($text, $pattern)
+            if ($m.Count -gt 0) { $origin = $m[$m.Count - 1].Value }
+        }
+        if (-not $origin) { return $null }
+        Set-Content -LiteralPath $originFile -Value $origin -Encoding ASCII
+    }
+    $suffix = ''
+    if ($Cfg.ContainsKey('McpPathFile') -and -not [string]::IsNullOrWhiteSpace([string]$Cfg.McpPathFile)) {
+        $pathFile = [string]$Cfg.McpPathFile
+        if (-not (Test-Path -LiteralPath $pathFile -PathType Leaf)) { Fail "McpPathFile missing: $pathFile" }
+        $suffix = (Read-TextFileSafe $pathFile).Trim()
+        if ($suffix -and -not $suffix.StartsWith('/')) { Fail 'MCP path file must contain an absolute URL path beginning with slash' }
+        if ($suffix -match '[\r\n]') { Fail 'MCP path file contains newline data' }
+    }
+    return $origin.TrimEnd('/') + $suffix
+}
+
+function Wait-CurrentUrl($Cfg) {
+    $deadline = [DateTime]::UtcNow.AddSeconds([int]$Cfg.StartTimeoutSeconds)
+    do {
+        $cloud = Test-OwnedInstance 'Cloud'
+        if (-not $cloud.Alive) { return $null }
+        $url = Get-CurrentUrl $Cfg
+        if ($url) { return $url }
+        Start-Sleep -Milliseconds 250
+    } while ([DateTime]::UtcNow -lt $deadline)
+    return $null
+}
+
+function Invoke-CoreGate($Cfg, [string]$ScriptName, [string[]]$ExtraArguments = @()) {
+    $coreRoot = [string]$Cfg.CoreRoot
+    $script = Join-Path (Join-Path $coreRoot 'src') $ScriptName
+    if (-not (Test-Path -LiteralPath $script -PathType Leaf)) { Fail "core gate script missing: $script" }
+    $node = (Get-Command node.exe -ErrorAction Stop).Source
+    $stdout = Log-Path 'CoreGate' 'stdout'
+    $stderr = Log-Path 'CoreGate' 'stderr'
+    Remove-Item -LiteralPath $stdout,$stderr -Force -ErrorAction SilentlyContinue
+    $argv = @(('"{0}"' -f $script))
+    foreach ($arg in $ExtraArguments) {
+        if ($arg -match '[\r\n"]') { Fail 'core gate argument contains forbidden quoting/newline data' }
+        $argv += ('"{0}"' -f $arg)
+    }
+    $proc = Start-Process -FilePath $node -ArgumentList $argv -WorkingDirectory $coreRoot -Wait -PassThru -WindowStyle Hidden -RedirectStandardOutput $stdout -RedirectStandardError $stderr
+    if ($proc.ExitCode -ne 0) {
+        $detail = if (Test-Path -LiteralPath $stderr) { (Get-Content -LiteralPath $stderr -Raw -Encoding UTF8).Trim() } else { '' }
+        Fail "core gate $ScriptName failed exit=$($proc.ExitCode): $detail"
+    }
+    Write-Host (Get-Content -LiteralPath $stdout -Raw -Encoding UTF8)
+}
+
+function Start-Deadbyte($Cfg) {
+    $state = Get-ObservedState $Cfg
+    if ($state.State -in @('ONLINE','DEGRADED')) { return $state }
+    if ($state.State -in @('FAILED','STARTING')) { Fail "runtime is $($state.State); inspect status and reconcile verified owned components before restart" }
+    $cloudWasAlive = [bool]$state.Cloud.Alive
+    Assert-LocalReadyPortAvailable $Cfg
+    try {
+        Start-OwnedComponent 'Bridge' $Cfg.Bridge $Cfg | Out-Null
+        $localHealth = Wait-LocalOperational $Cfg
+        if ($null -eq $localHealth) { Fail 'bridge started but owned local readiness gate failed' }
+        Start-OwnedComponent 'Cloud' $Cfg.Cloud $Cfg | Out-Null
+        if (-not (Wait-CurrentUrl $Cfg)) { Fail 'public endpoint metadata did not become available before timeout' }
+        $final = Get-ObservedState $Cfg
+        if ($final.State -notin @('ONLINE','DEGRADED')) { Fail "start gate failed: observed $($final.State)" }
+        return $final
+    } catch {
+        try { Stop-OwnedComponent 'Bridge' } catch {}
+        if (-not $cloudWasAlive) { try { Stop-OwnedComponent 'Cloud' } catch {} }
+        throw
+    }
+}
+
+function Park-Deadbyte($Cfg) {
+    Disarm-Desktop $Cfg -Quiet
+    Stop-OwnedComponent 'Bridge'
+    $s = Get-ObservedState $Cfg
+    if ($s.State -notin @('PARKED','OFFLINE')) { Fail "park gate failed: observed $($s.State)" }
+    return $s
+}
+
+function Stop-Deadbyte($Cfg) {
+    Disarm-Desktop $Cfg -Quiet
+    Stop-OwnedComponent 'Bridge'
+    Stop-OwnedComponent 'Cloud'
+    Remove-Item -LiteralPath (Join-Path $RuntimeDir 'current-origin.txt') -Force -ErrorAction SilentlyContinue
+    $s = Get-ObservedState $Cfg
+    if ($s.State -ne 'OFFLINE') { Fail "stop gate failed: observed $($s.State)" }
+    return $s
+}
+
+function Assert-PolicyRootsAvailable($Policy, [string]$Plane) {
+    $rootIds = @($Policy.roots.PSObject.Properties.Name)
+    if ($rootIds.Count -lt 1) { Fail "$Plane policy requires at least one root" }
+    foreach ($rootId in $rootIds) {
+        $raw = [string]$Policy.roots.$rootId.path
+        if ([string]::IsNullOrWhiteSpace($raw)) { Fail "$Plane policy root '$rootId' path missing" }
+        try { $full = [System.IO.Path]::GetFullPath($raw) } catch { Fail "$Plane policy root '$rootId' path invalid" }
+        if (-not (Test-Path -LiteralPath $full -PathType Container)) { Fail "$Plane policy root '$rootId' missing: $full" }
+    }
+    return $rootIds
+}
+
+function Get-AuthorityEpochStatus($Cfg, [string]$Plane, [string]$GrantFile, [string]$GrantNonce) {
+    if ([string]::IsNullOrWhiteSpace($GrantNonce) -or $GrantNonce -cnotmatch '^[0-9a-f]{64}$') {
+        return [pscustomobject]@{ Trusted=$false; Reason='epoch-grant-nonce-invalid'; Seq=$null; Action=$null; EventSha256=$null }
+    }
+    try {
+        $verified = Invoke-AuthorityEpochCommand $Cfg $Plane 'status' $GrantFile
+        if (-not $verified.trusted) {
+            return [pscustomobject]@{ Trusted=$false; Reason=[string]$verified.reason; Seq=$verified.seq; Action=$verified.action; EventSha256=$verified.event_sha256 }
+        }
+        return [pscustomobject]@{ Trusted=$true; Reason=[string]$verified.reason; Seq=$verified.seq; Action=$verified.action; EventSha256=$verified.event_sha256 }
+    } catch {
+        return [pscustomobject]@{ Trusted=$false; Reason='authority-epoch-verifier-unavailable'; Seq=$null; Action=$null; EventSha256=$null }
+    }
+}
+
+function Invoke-AuthorityEpochCommand($Cfg, [string]$Plane, [string]$Action, [string]$GrantFile, [string]$UpdateId = '', [string]$ExpectedHead = '') {
+    $cli = Join-Path ([string]$Cfg.CoreRoot) 'src\authority-epoch-cli-r65.mjs'
+    if (-not (Test-Path -LiteralPath $cli -PathType Leaf)) { Fail "authority epoch CLI missing: $cli" }
+    $node = [string]$Cfg.Bridge.FilePath
+    if ([string]::IsNullOrWhiteSpace($node) -or -not (Test-Path -LiteralPath $node -PathType Leaf)) { Fail 'authority epoch Node executable unavailable' }
+    $policyFile = switch ($Plane) {
+        'process' { [string]$Cfg.ProcessPolicyFile }
+        'coding' { [string]$Cfg.CodingPolicyFile }
+        'autonomous' { [string]$Cfg.AutonomousPolicyFile }
+        'desktop' { [string]$Cfg.DesktopPolicyFile }
+        'host' { [string]$Cfg.HostPolicyFile }
+        default { Fail "authority epoch plane invalid: $Plane" }
+    }
+    if ([string]::IsNullOrWhiteSpace($policyFile) -or -not (Test-Path -LiteralPath $policyFile -PathType Leaf)) { Fail "authority epoch policy unavailable for $Plane" }
+    $args = @($cli, $Action, '--plane', $Plane, '--grant-file', $GrantFile, '--policy-file', $policyFile)
+    if ($Action -in @('transaction-revoke','transaction-restore')) {
+        if ([string]::IsNullOrWhiteSpace($UpdateId) -or $ExpectedHead -cnotmatch '^[0-9a-f]{64}$') { Fail 'authority epoch transaction binding invalid' }
+        $args += @('--update-id', $UpdateId, '--expected-head', $ExpectedHead)
+    }
+    $output = @(& $node @args)
+    $exit = $LASTEXITCODE
+    if ($exit -ne 0) { Fail "authority epoch command '$Action' failed for $Plane (exit=$exit)" }
+    try { return (($output -join [Environment]::NewLine) | ConvertFrom-Json) }
+    catch { Fail "authority epoch command '$Action' returned invalid JSON for $Plane" }
+}
+
+function Get-HostPolicyMetadata($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.HostPolicyFile)) { Fail 'privileged host plane is not configured' }
+    $policyPath = [string]$Cfg.HostPolicyFile
+    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid host policy JSON: $policyPath" }
+    if (@('deadbyte.host-policy.v1','deadbyte.host-policy.v2') -notcontains [string]$policy.schema -or $policy.enabled -ne $true) { Fail 'host policy schema/enabled mismatch' }
+    if ([string]::IsNullOrWhiteSpace([string]$policy.arm_file)) { Fail 'host policy arm_file missing' }
+    $armFile = [System.IO.Path]::GetFullPath([string]$policy.arm_file)
+    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
+    if (-not $armFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'host policy arm_file must live under controller runtime directory' }
+    Assert-PolicyRootsAvailable $policy 'host' | Out-Null
+    [pscustomobject]@{
+        Path = $policyPath
+        Sha256 = Get-ExecutableHash $policyPath
+        ArmFile = $armFile
+    }
+}
+
+function Get-HostArmStatus($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.HostPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy' } }
+    try { $meta = Get-HostPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message } }
+    if (-not (Test-Path -LiteralPath $meta.ArmFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed' } }
+    try { $arm = Get-Content -LiteralPath $meta.ArmFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
+    if ($arm.schema -ne 'deadbyte.host-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
+    if ([string]$arm.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
+    if ([string]$arm.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'host' $meta.ArmFile ([string]$arm.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
+}
+
+function Arm-Host($Cfg) {
+    $meta = Get-HostPolicyMetadata $Cfg
+    Ensure-Directory $RuntimeDir
+    $nonceBytes = New-Object byte[] 32
+    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
+    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
+    $now = [DateTime]::UtcNow
+    $body = [ordered]@{
+        schema = 'deadbyte.host-grant.v2'
+        policy_sha256 = [string]$meta.Sha256
+        instance_nonce = $nonce
+        granted_at_utc = $now.ToString('o')
+    }
+    $tmp = $meta.ArmFile + '.tmp'
+    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
+    Move-Item -LiteralPath $tmp -Destination $meta.ArmFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'host' 'grant' $meta.ArmFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.ArmFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
+    Write-Host 'PRIVILEGED HOST PLANE ENABLED UNTIL EXPLICIT REVOKE'
+}
+
+function Disarm-Host($Cfg) {
+    $meta = Get-HostPolicyMetadata $Cfg
+    $epochError = $null
+    if (Test-Path -LiteralPath $meta.ArmFile) {
+        try { Invoke-AuthorityEpochCommand $Cfg 'host' 'user-revoke' $meta.ArmFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $meta.ArmFile -Force -ErrorAction SilentlyContinue
+    }
+    if (Test-Path -LiteralPath $meta.ArmFile) { throw 'Host authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
+    Write-Host 'PRIVILEGED HOST PLANE DISARMED'
+}
+
+function Show-HostStatus($Cfg) {
+    $h = Get-HostArmStatus $Cfg
+    Write-Host ("Host plane    : {0} [{1}]" -f $(if ($h.Armed) { 'ARMED' } elseif ($h.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $h.Reason)
+    return $h
+}
+
+function Get-ProcessPolicyMetadata($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.ProcessPolicyFile)) { Fail 'process plane is not configured' }
+    $policyPath = [string]$Cfg.ProcessPolicyFile
+    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid process policy JSON: $policyPath" }
+    if ($policy.schema -ne 'deadbyte.process-policy.v1' -or $policy.enabled -ne $true) { Fail 'process policy schema/enabled mismatch' }
+    if ([string]::IsNullOrWhiteSpace([string]$policy.grant_file)) { Fail 'process policy grant_file missing' }
+    $grantFile = [System.IO.Path]::GetFullPath([string]$policy.grant_file)
+    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
+    if (-not $grantFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'process policy grant_file must live under controller runtime directory' }
+    $profileIds = @($policy.profiles.PSObject.Properties.Name)
+    $rootIds = @(Assert-PolicyRootsAvailable $policy 'process')
+    if ($profileIds.Count -lt 1 -or $rootIds.Count -lt 1) { Fail 'process policy requires profiles and roots' }
+    [pscustomobject]@{ Path=$policyPath; Sha256=Get-ExecutableHash $policyPath; GrantFile=$grantFile; ProfileIds=$profileIds; RootIds=$rootIds }
+}
+
+function Get-ProcessGrantStatus($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.ProcessPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy' } }
+    try { $meta = Get-ProcessPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message } }
+    if (-not (Test-Path -LiteralPath $meta.GrantFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed' } }
+    try { $grant = Get-Content -LiteralPath $meta.GrantFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
+    if ($grant.schema -ne 'deadbyte.process-grant.v1') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
+    if ([string]$grant.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
+    if ([string]$grant.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
+    $profiles = @($grant.profile_ids); $roots = @($grant.root_ids)
+    if ($profiles.Count -lt 1 -or @($profiles | Where-Object { $_ -notin $meta.ProfileIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='profiles-invalid' } }
+    if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'process' $meta.GrantFile ([string]$grant.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
+}
+
+function Arm-Process($Cfg) {
+    $meta = Get-ProcessPolicyMetadata $Cfg
+    Ensure-Directory $RuntimeDir
+    $nonceBytes = New-Object byte[] 32
+    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
+    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
+    $body = [ordered]@{
+        schema = 'deadbyte.process-grant.v1'
+        policy_sha256 = [string]$meta.Sha256
+        instance_nonce = $nonce
+        profile_ids = @($meta.ProfileIds)
+        root_ids = @($meta.RootIds)
+        granted_at_utc = [DateTime]::UtcNow.ToString('o')
+    }
+    $tmp = $meta.GrantFile + '.tmp'
+    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
+    Move-Item -LiteralPath $tmp -Destination $meta.GrantFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'process' 'grant' $meta.GrantFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
+    Write-Host 'PROCESS PLANE ENABLED UNTIL EXPLICIT REVOKE'
+}
+
+function Disarm-Process($Cfg) {
+    $meta = Get-ProcessPolicyMetadata $Cfg
+    $epochError = $null
+    if (Test-Path -LiteralPath $meta.GrantFile -PathType Leaf) {
+        try { Invoke-AuthorityEpochCommand $Cfg 'process' 'user-revoke' $meta.GrantFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
+    }
+    if (Test-Path -LiteralPath $meta.GrantFile) { throw 'Process authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
+    Write-Host 'PROCESS PLANE DISARMED'
+}
+
+function Show-ProcessStatus($Cfg) {
+    $p = Get-ProcessGrantStatus $Cfg
+    Write-Host ("Process plane  : {0} [{1}]" -f $(if ($p.Armed) { 'ARMED' } elseif ($p.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $p.Reason)
+    return $p
+}
+
+function Read-ControllerPolicySnapshot([string]$PolicyPath, [string]$Kind) {
+    try {
+        $bytes = [System.IO.File]::ReadAllBytes($PolicyPath)
+        $decoder = New-Object System.Text.UTF8Encoding($false, $true)
+        $text = $decoder.GetString($bytes)
+        if ($text.Length -gt 0 -and $text[0] -eq [char]0xFEFF) { $text = $text.Substring(1) }
+        $policy = $text | ConvertFrom-Json
+    } catch { Fail "invalid $Kind policy JSON: $PolicyPath" }
+    $sha = [System.Security.Cryptography.SHA256]::Create()
+    try { $digest = ([System.BitConverter]::ToString($sha.ComputeHash($bytes))).Replace('-', '').ToLowerInvariant() }
+    finally { $sha.Dispose() }
+    return [pscustomobject]@{ Policy=$policy; Sha256=$digest }
+}
+
+function Get-CodingPolicyMetadata($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.CodingPolicyFile)) { Fail 'coding plane is not configured' }
+    $policyPath = [string]$Cfg.CodingPolicyFile
+    $snapshot = Read-ControllerPolicySnapshot $policyPath 'coding'
+    $policy = $snapshot.Policy
+    if ($policy.schema -ne 'deadbyte.coding-policy.v1' -or $policy.enabled -ne $true) { Fail 'coding policy schema/enabled mismatch' }
+    if ([string]::IsNullOrWhiteSpace([string]$policy.lease_file)) { Fail 'coding policy lease_file missing' }
+    $leaseFile = [System.IO.Path]::GetFullPath([string]$policy.lease_file)
+    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
+    if (-not $leaseFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'coding policy lease_file must live under controller runtime directory' }
+    $rootIds = @(Assert-PolicyRootsAvailable $policy 'coding')
+    $rootPaths = @{}
+    $rootAccess = @{}
+    foreach ($rootId in $rootIds) {
+        $root = $policy.roots.$rootId
+        $rootPaths[$rootId] = [System.IO.Path]::GetFullPath([string]$root.path)
+        $rootAccess[$rootId] = [pscustomobject]@{ Read=($root.read -eq $true); Write=($root.write -eq $true); Exec=($root.exec -eq $true) }
+    }
+    [pscustomobject]@{ Path=$policyPath; Sha256=$snapshot.Sha256; LeaseFile=$leaseFile; RootIds=$rootIds; RootPaths=$rootPaths; RootAccess=$rootAccess }
+}
+
+function Get-CodingLeaseStatus($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.CodingPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy' } }
+    try { $meta = Get-CodingPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message } }
+    if (-not (Test-Path -LiteralPath $meta.LeaseFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed' } }
+    try { $lease = Get-Content -LiteralPath $meta.LeaseFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
+    if ($lease.schema -ne 'deadbyte.coding-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
+    if ([string]$lease.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
+    if ([string]$lease.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
+    $roots = @($lease.root_ids)
+    if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'coding' $meta.LeaseFile ([string]$lease.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; RootIds=$roots; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
+}
+
+function Arm-Coding($Cfg) {
+    $meta = Get-CodingPolicyMetadata $Cfg
+    Ensure-Directory $RuntimeDir
+    $nonceBytes = New-Object byte[] 32
+    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
+    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
+    $now = [DateTime]::UtcNow
+    $body = [ordered]@{
+        schema = 'deadbyte.coding-grant.v2'
+        policy_sha256 = [string]$meta.Sha256
+        instance_nonce = $nonce
+        root_ids = @($meta.RootIds)
+        granted_at_utc = $now.ToString('o')
+    }
+    $tmp = $meta.LeaseFile + '.tmp'
+    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
+    Move-Item -LiteralPath $tmp -Destination $meta.LeaseFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'coding' 'grant' $meta.LeaseFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
+    Write-Host 'CODING PLANE ENABLED UNTIL EXPLICIT REVOKE'
+}
+
+function Disarm-Coding($Cfg) {
+    $meta = Get-CodingPolicyMetadata $Cfg
+    $epochError = $null
+    if (Test-Path -LiteralPath $meta.LeaseFile -PathType Leaf) {
+        try { Invoke-AuthorityEpochCommand $Cfg 'coding' 'user-revoke' $meta.LeaseFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+    }
+    try { Disarm-Autonomous $Cfg -Quiet } catch {
+        if ($null -eq $epochError) { $epochError = $_.Exception }
+        else { Write-Warning "autonomous lease cleanup failed after coding revocation: $($_.Exception.Message)" }
+    }
+    if (Test-Path -LiteralPath $meta.LeaseFile) { throw 'Coding authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
+    Write-Host 'CODING PLANE DISARMED; AUTONOMOUS AUTHORITY REVOKED'
+}
+
+function Show-CodingStatus($Cfg) {
+    $c = Get-CodingLeaseStatus $Cfg
+    Write-Host ("Coding plane  : {0} [{1}]" -f $(if ($c.Armed) { 'ARMED' } elseif ($c.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $c.Reason)
+    return $c
+}
+
+function Get-AutonomousPolicyMetadata($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) { Fail 'autonomous plane is not configured' }
+    $policyPath = [string]$Cfg.AutonomousPolicyFile
+    $snapshot = Read-ControllerPolicySnapshot $policyPath 'autonomous'
+    $policy = $snapshot.Policy
+    if ($policy.schema -ne 'deadbyte.autonomous-policy.v1' -or $policy.enabled -ne $true) { Fail 'autonomous policy schema/enabled mismatch' }
+    if ([string]::IsNullOrWhiteSpace([string]$policy.lease_file)) { Fail 'autonomous policy lease_file missing' }
+    $leaseFile = [System.IO.Path]::GetFullPath([string]$policy.lease_file)
+    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
+    if (-not $leaseFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'autonomous policy lease_file must live under controller runtime directory' }
+    $codingMeta = Get-CodingPolicyMetadata $Cfg
+    if ([string]$policy.coding_policy_sha256 -ne [string]$codingMeta.Sha256) { Fail 'autonomous policy coding_policy_sha256 mismatch' }
+    $rootIds = @($policy.root_ids)
+    if ($rootIds.Count -lt 1) { Fail 'autonomous policy requires at least one root' }
+    foreach ($rootId in $rootIds) {
+        if ([string]$rootId -cnotin @($codingMeta.RootIds)) { Fail "autonomous policy root '$rootId' outside coding policy" }
+        $rootPath = [string]$codingMeta.RootPaths[[string]$rootId]
+        if ([string]::IsNullOrWhiteSpace($rootPath)) { Fail "autonomous policy root '$rootId' path missing" }
+        $fullRoot = [System.IO.Path]::GetFullPath($rootPath).TrimEnd('\')
+        $volumeRoot = [System.IO.Path]::GetPathRoot($rootPath).TrimEnd('\')
+        if ($fullRoot.Equals($volumeRoot, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'autonomous bootstrap requires a project-scoped root' }
+        try { $rootItem = Get-Item -LiteralPath $rootPath -Force -ErrorAction Stop }
+        catch { Fail "autonomous policy root '$rootId' must be a real project directory" }
+        if (-not $rootItem.PSIsContainer) { Fail "autonomous policy root '$rootId' must be a real project directory" }
+        $ancestor = [System.IO.DirectoryInfo]$rootItem
+        while ($null -ne $ancestor) {
+            if (($ancestor.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { Fail "autonomous policy root '$rootId' must be a real project directory" }
+            $ancestor = $ancestor.Parent
+        }
+    }
+    if ($null -eq $codingMeta.RootAccess) { Fail 'coding policy root access metadata unavailable' }
+    foreach ($codingRootId in @($codingMeta.RootIds)) {
+        $access = $codingMeta.RootAccess[[string]$codingRootId]
+        if ($null -eq $access) { Fail "coding policy root '$codingRootId' access metadata unavailable" }
+        if ($access.Read -eq $true -or $access.Write -eq $true -or $access.Exec -eq $true) {
+            $candidate = [string]$codingMeta.RootPaths[[string]$codingRootId]
+            if ([string]::IsNullOrWhiteSpace($candidate)) { Fail "coding policy root '$codingRootId' path missing" }
+            $candidateRoot = [System.IO.Path]::GetFullPath($candidate).TrimEnd('\')
+            $filesystemRoot = [System.IO.Path]::GetPathRoot($candidate).TrimEnd('\')
+            if ($candidateRoot.Equals($filesystemRoot, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'coding policy contains a broad filesystem root' }
+        }
+    }
+    [pscustomobject]@{ Path=$policyPath; Sha256=$snapshot.Sha256; LeaseFile=$leaseFile; RootIds=$rootIds; CodingPolicySha256=$codingMeta.Sha256 }
+}
+
+function Get-AutonomousLeaseStatus($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy' } }
+    try { $meta = Get-AutonomousPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message } }
+    $coding = Get-CodingLeaseStatus $Cfg
+    if (-not $coding.Armed) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='coding-disarmed' } }
+    if (-not (Test-Path -LiteralPath $meta.LeaseFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed' } }
+    try { $lease = Get-Content -LiteralPath $meta.LeaseFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant' } }
+    if ($lease.schema -ne 'deadbyte.autonomous-grant.v2') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema' } }
+    if ([string]$lease.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest' } }
+    if ([string]$lease.coding_policy_sha256 -ne [string]$meta.CodingPolicySha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='coding-policy-digest' } }
+    if ([string]$lease.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid' } }
+    $roots = @($lease.root_ids)
+    if ($roots.Count -lt 1 -or @($roots | Where-Object { $_ -notin $meta.RootIds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='roots-invalid' } }
+    if (@($roots | Where-Object { $_ -cnotin @($coding.RootIds) }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='coding-roots' } }
+    # R70 optional owner-bound expiry for v2 signed standing grants.
+    # Legacy grants without an expiry field remain subject to explicit revoke.
+    if ($null -ne $lease.PSObject.Properties['expires_at_utc']) {
+        $issuedText = [string]$lease.granted_at_utc
+        $expiryText = [string]$lease.expires_at_utc
+        $timePattern = '^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3,7}Z$'
+        if ($issuedText -cnotmatch $timePattern -or $expiryText -cnotmatch $timePattern) {
+            return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='expiry-invalid' }
+        }
+        try {
+            $issuedAt = [DateTimeOffset]::Parse($issuedText,[System.Globalization.CultureInfo]::InvariantCulture,[System.Globalization.DateTimeStyles]::RoundtripKind)
+            $expiresAt = [DateTimeOffset]::Parse($expiryText,[System.Globalization.CultureInfo]::InvariantCulture,[System.Globalization.DateTimeStyles]::RoundtripKind)
+        } catch {
+            return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='expiry-invalid' }
+        }
+        $duration = ($expiresAt - $issuedAt).TotalMilliseconds
+        if ($duration -le 0 -or $duration -gt 3600000) {
+            return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='expiry-window-invalid' }
+        }
+        if ([DateTimeOffset]::UtcNow -lt $issuedAt) {
+            return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='not-yet-valid' }
+        }
+        if ([DateTimeOffset]::UtcNow -ge $expiresAt) {
+            return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='expired' }
+        }
+    }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'autonomous' $meta.LeaseFile ([string]$lease.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
+}
+
+function Arm-Autonomous($Cfg) {
+    $coding = Get-CodingLeaseStatus $Cfg
+    if (-not $coding.Armed) { Fail 'autonomous plane requires an active coding lease; run armcoding first' }
+    $meta = Get-AutonomousPolicyMetadata $Cfg
+    if (@($meta.RootIds | Where-Object { $_ -cnotin @($coding.RootIds) }).Count -gt 0) { Fail 'autonomous roots exceed active coding grant' }
+    # R70 migration fence: updater approval is NOT controller-side grant approval.
+    # Until independent owner enrollment is verified at grant issuance, only
+    # the byte-identical pre-R70 known-good Autonomous policy can be armed.
+    # Root labels and self-asserted approval flags are never consent evidence.
+    $legacyOwnerPolicySha256 = '6274492644c303b38117541cc22a59e88e6ff5fdef7051a5d57ad336f45765f5'
+    $selectedRoots = @($meta.RootIds)
+    if ([string]$meta.Sha256 -cne $legacyOwnerPolicySha256 -or $selectedRoots.Count -ne 1 -or [string]$selectedRoots[0] -cne 'core') {
+        Fail 'R70_OWNER_ENROLLMENT_REQUIRED: project/successor Autonomous grant needs independent owner authorization before arm'
+    }
+    Ensure-Directory $RuntimeDir
+    $nonceBytes = New-Object byte[] 32
+    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
+    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
+    $now = [DateTime]::UtcNow
+    $body = [ordered]@{ schema='deadbyte.autonomous-grant.v2'; policy_sha256=[string]$meta.Sha256; coding_policy_sha256=[string]$meta.CodingPolicySha256; instance_nonce=$nonce; root_ids=@($meta.RootIds); granted_at_utc=$now.ToString('o'); expires_at_utc=$now.AddHours(1).ToString('o') }
+    $tmp = $meta.LeaseFile + '.tmp'
+    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
+    Move-Item -LiteralPath $tmp -Destination $meta.LeaseFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'autonomous' 'grant' $meta.LeaseFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.LeaseFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
+    Write-Host 'AUTONOMOUS PLANE ENABLED UNTIL EXPLICIT REVOKE'
+}
+
+function Get-AutonomousRevocationLeaseFile($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) { return $null }
+    # Revocation may not depend on approval/root checks used only for issuing grants.
+    # The source remains the bound policy snapshot, never a caller-supplied path.
+    $snapshot = Read-ControllerPolicySnapshot ([string]$Cfg.AutonomousPolicyFile) 'autonomous'
+    $policy = $snapshot.Policy
+    if ($policy.schema -ne 'deadbyte.autonomous-policy.v1' -or $policy.enabled -ne $true) { Fail 'autonomous policy schema/enabled mismatch' }
+    if ([string]::IsNullOrWhiteSpace([string]$policy.lease_file)) { Fail 'autonomous policy lease_file missing' }
+    $leaseFile = [System.IO.Path]::GetFullPath([string]$policy.lease_file)
+    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
+    if (-not $leaseFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'autonomous policy lease_file must live under controller runtime directory' }
+    return $leaseFile
+}
+
+function Disarm-Autonomous($Cfg, [switch]$Quiet) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.AutonomousPolicyFile)) { return }
+    $leaseFile = Get-AutonomousRevocationLeaseFile $Cfg
+    $epochError = $null
+    if (Test-Path -LiteralPath $leaseFile -PathType Leaf) {
+        try { Invoke-AuthorityEpochCommand $Cfg 'autonomous' 'user-revoke' $leaseFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $leaseFile -Force -ErrorAction SilentlyContinue
+    }
+    if (Test-Path -LiteralPath $leaseFile) { throw 'Autonomous authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
+    if (-not $Quiet) { Write-Host 'AUTONOMOUS PLANE DISARMED' }
+}
+
+function Show-AutonomousStatus($Cfg) {
+    $a = Get-AutonomousLeaseStatus $Cfg
+    Write-Host ("Autonomous     : {0} [{1}]" -f $(if ($a.Armed) { 'ARMED' } elseif ($a.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $a.Reason)
+    return $a
+}
+
+function Get-DesktopPolicyMetadata($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.DesktopPolicyFile)) { Fail 'desktop plane is not configured' }
+    $policyPath = [string]$Cfg.DesktopPolicyFile
+    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid desktop policy JSON: $policyPath" }
+    if ($policy.schema -ne 'deadbyte.desktop-policy.v1' -or $policy.enabled -ne $true) { Fail 'desktop policy schema/enabled mismatch' }
+    if ([string]::IsNullOrWhiteSpace([string]$policy.grant_file)) { Fail 'desktop policy grant_file missing' }
+    if ([string]::IsNullOrWhiteSpace([string]$policy.evidence_dir)) { Fail 'desktop policy evidence_dir missing' }
+    $grantFile = [System.IO.Path]::GetFullPath([string]$policy.grant_file)
+    $evidenceDir = [System.IO.Path]::GetFullPath([string]$policy.evidence_dir)
+    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
+    if (-not $grantFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'desktop policy grant_file must live under controller runtime directory' }
+    if (-not ($evidenceDir.TrimEnd('\') + '\').StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'desktop policy evidence_dir must live under controller runtime directory' }
+    $knownActions = @('pointer_move','click_primary','click_secondary','double_click_primary','scroll','key_chord','text_input')
+    $actionKinds = @($policy.allowed_actions)
+    $uniqueActions = @($actionKinds | Sort-Object -Unique)
+    if ($actionKinds.Count -lt 1 -or $actionKinds.Count -ne $uniqueActions.Count -or @($actionKinds | Where-Object { $_ -notin $knownActions }).Count -gt 0) { Fail 'desktop policy allowed_actions invalid' }
+    if (-not $policy.observer -or [string]::IsNullOrWhiteSpace([string]$policy.observer.executable) -or [string]$policy.observer.sha256 -cnotmatch '^[0-9a-f]{64}$') { Fail 'desktop observer metadata invalid' }
+    if (-not $policy.input -or [string]::IsNullOrWhiteSpace([string]$policy.input.executable) -or [string]$policy.input.sha256 -cnotmatch '^[0-9a-f]{64}$') { Fail 'desktop input metadata invalid' }
+    if (-not $policy.grounder -or [string]::IsNullOrWhiteSpace([string]$policy.grounder.executable) -or [string]$policy.grounder.sha256 -cnotmatch '^[0-9a-f]{64}$') { Fail 'desktop grounder metadata invalid' }
+    $observerPath = [System.IO.Path]::GetFullPath([string]$policy.observer.executable)
+    $inputPath = [System.IO.Path]::GetFullPath([string]$policy.input.executable)
+    $grounderPath = [System.IO.Path]::GetFullPath([string]$policy.grounder.executable)
+    foreach ($provider in @(
+        [pscustomobject]@{ Name='observer'; Path=$observerPath; Sha256=([string]$policy.observer.sha256).ToLowerInvariant() },
+        [pscustomobject]@{ Name='input'; Path=$inputPath; Sha256=([string]$policy.input.sha256).ToLowerInvariant() },
+        [pscustomobject]@{ Name='grounder'; Path=$grounderPath; Sha256=([string]$policy.grounder.sha256).ToLowerInvariant() }
+    )) {
+        if (-not (Test-Path -LiteralPath $provider.Path -PathType Leaf)) { Fail "desktop $($provider.Name) executable missing: $($provider.Path)" }
+        $item = Get-Item -LiteralPath $provider.Path -Force
+        if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { Fail "desktop $($provider.Name) executable must not be a reparse point" }
+        $actual = Get-ExecutableHash $provider.Path
+        if ($actual -ne $provider.Sha256) { Fail "desktop $($provider.Name) executable SHA-256 mismatch: expected $($provider.Sha256), found $actual" }
+    }
+    [pscustomobject]@{
+        Path=$policyPath; Sha256=Get-ExecutableHash $policyPath; GrantFile=$grantFile; EvidenceDir=$evidenceDir;
+        ActionKinds=$actionKinds; ObserverPath=$observerPath; ObserverSha256=([string]$policy.observer.sha256).ToLowerInvariant();
+        InputPath=$inputPath; InputSha256=([string]$policy.input.sha256).ToLowerInvariant();
+        GrounderPath=$grounderPath; GrounderSha256=([string]$policy.grounder.sha256).ToLowerInvariant()
+    }
+}
+
+function Get-DesktopGrantFileForRevoke($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.DesktopPolicyFile)) { return '' }
+    $policyPath = [string]$Cfg.DesktopPolicyFile
+    try { $policy = Get-Content -LiteralPath $policyPath -Raw -Encoding UTF8 | ConvertFrom-Json } catch { Fail "invalid desktop policy JSON during revoke: $policyPath" }
+    if ([string]::IsNullOrWhiteSpace([string]$policy.grant_file)) { Fail 'desktop policy grant_file missing during revoke' }
+    $grantFile = [System.IO.Path]::GetFullPath([string]$policy.grant_file)
+    $runtimeReal = [System.IO.Path]::GetFullPath($RuntimeDir).TrimEnd('\') + '\'
+    if (-not $grantFile.StartsWith($runtimeReal, [System.StringComparison]::OrdinalIgnoreCase)) { Fail 'desktop policy grant_file must live under controller runtime directory' }
+    return $grantFile
+}
+
+function Get-DesktopGrantStatus($Cfg) {
+    if ([string]::IsNullOrWhiteSpace([string]$Cfg.DesktopPolicyFile)) { return [pscustomobject]@{ Configured=$false; Armed=$false; Reason='no-policy'; ActionKinds=@() } }
+    try { $meta = Get-DesktopPolicyMetadata $Cfg } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=$_.Exception.Message; ActionKinds=@() } }
+    if (-not (Test-Path -LiteralPath $meta.GrantFile -PathType Leaf)) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='disarmed'; ActionKinds=@() } }
+    try { $grant = Get-Content -LiteralPath $meta.GrantFile -Raw -Encoding UTF8 | ConvertFrom-Json } catch { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='invalid-grant'; ActionKinds=@() } }
+    if ($grant.schema -ne 'deadbyte.desktop-grant.v1') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='grant-schema'; ActionKinds=@() } }
+    if ([string]$grant.policy_sha256 -ne [string]$meta.Sha256) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='policy-digest'; ActionKinds=@() } }
+    if ([string]$grant.instance_nonce -cnotmatch '^[0-9a-f]{64}$') { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='nonce-invalid'; ActionKinds=@() } }
+    $actions = @($grant.action_kinds)
+    $unique = @($actions | Sort-Object -Unique)
+    if ($actions.Count -lt 1 -or $actions.Count -ne $unique.Count) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='actions-invalid'; ActionKinds=@() } }
+    if (@($actions | Where-Object { $_ -notin $meta.ActionKinds }).Count -gt 0) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason='actions-outside-policy'; ActionKinds=@() } }
+    $epoch = Get-AuthorityEpochStatus $Cfg 'desktop' $meta.GrantFile ([string]$grant.instance_nonce)
+    if (-not $epoch.Trusted) { return [pscustomobject]@{ Configured=$true; Armed=$false; Reason=[string]$epoch.Reason; ActionKinds=$actions } }
+    return [pscustomobject]@{ Configured=$true; Armed=$true; Reason='standing-grant'; ActionKinds=$actions; EpochSeq=$epoch.Seq; EpochSha256=$epoch.EventSha256 }
+}
+
+function Arm-Desktop($Cfg) {
+    $meta = Get-DesktopPolicyMetadata $Cfg
+    Ensure-Directory $RuntimeDir
+    Ensure-Directory $meta.EvidenceDir
+    $nonceBytes = New-Object byte[] 32
+    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+    try { $rng.GetBytes($nonceBytes) } finally { $rng.Dispose() }
+    $nonce = -join ($nonceBytes | ForEach-Object { $_.ToString('x2') })
+    $body = [ordered]@{
+        schema = 'deadbyte.desktop-grant.v1'
+        policy_sha256 = [string]$meta.Sha256
+        instance_nonce = $nonce
+        action_kinds = @($meta.ActionKinds)
+        granted_at_utc = [DateTime]::UtcNow.ToString('o')
+    }
+    $tmp = $meta.GrantFile + '.tmp'
+    $body | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $tmp -Encoding UTF8
+    Move-Item -LiteralPath $tmp -Destination $meta.GrantFile -Force
+    try { Invoke-AuthorityEpochCommand $Cfg 'desktop' 'grant' $meta.GrantFile | Out-Null }
+    catch {
+        Remove-Item -LiteralPath $meta.GrantFile -Force -ErrorAction SilentlyContinue
+        throw
+    }
+    Write-Host ("DESKTOP PLANE ENABLED UNTIL EXPLICIT REVOKE [{0}]" -f ($meta.ActionKinds -join ','))
+}
+
+function Disarm-Desktop($Cfg, [switch]$Quiet) {
+    $grantFile = Get-DesktopGrantFileForRevoke $Cfg
+    if ([string]::IsNullOrWhiteSpace([string]$grantFile)) { return }
+    $epochError = $null
+    if (Test-Path -LiteralPath $grantFile -PathType Leaf) {
+        try { Invoke-AuthorityEpochCommand $Cfg 'desktop' 'user-revoke' $grantFile | Out-Null } catch { $epochError = $_.Exception }
+        Remove-Item -LiteralPath $grantFile -Force -ErrorAction SilentlyContinue
+    }
+    if (Test-Path -LiteralPath $grantFile) { throw 'Desktop authority revocation failed: grant remains present' }
+    if ($null -ne $epochError) { throw $epochError }
+    if (-not $Quiet) { Write-Host 'DESKTOP PLANE DISARMED' }
+}
+
+function Show-DesktopStatus($Cfg) {
+    $d = Get-DesktopGrantStatus $Cfg
+    Write-Host ("Desktop plane : {0} [{1}]" -f $(if ($d.Armed) { 'ARMED' } elseif ($d.Configured) { 'DISARMED' } else { 'UNCONFIGURED' }), $d.Reason)
+    return $d
+}
+
+function Get-AutonomousSupervisorStatus($Cfg) {
+    if (-not [bool]$Cfg.AutonomousSupervisorEnabled) { return [pscustomobject]@{ Configured=$false; Running=$false; Reason='disabled'; Owned=$null } }
+    $owned = Test-OwnedInstance 'Supervisor'
+    [pscustomobject]@{ Configured=$true; Running=[bool]$owned.Alive; Reason=[string]$owned.Reason; Owned=$owned }
+}
+
+function Start-AutonomousSupervisor($Cfg) {
+    if (-not [bool]$Cfg.AutonomousSupervisorEnabled) { Fail 'autonomous supervisor is disabled by trusted config' }
+    if (-not [bool]$Cfg.AutonomousRuntimeEnabled) { Fail 'autonomous supervisor requires AutonomousRuntimeEnabled' }
+    Start-OwnedComponent 'Supervisor' $Cfg.Supervisor $Cfg | Out-Null
+    $status = Get-AutonomousSupervisorStatus $Cfg
+    if (-not $status.Running) { Fail "autonomous supervisor start failed: $($status.Reason)" }
+    return $status
+}
+
+function Stop-AutonomousSupervisor($Cfg) {
+    if (-not [bool]$Cfg.AutonomousSupervisorEnabled) { return Get-AutonomousSupervisorStatus $Cfg }
+    Stop-OwnedComponent 'Supervisor'
+    return Get-AutonomousSupervisorStatus $Cfg
+}
+
+function Show-AutonomousSupervisorStatus($Cfg) {
+    $s = Get-AutonomousSupervisorStatus $Cfg
+    $label = if (-not $s.Configured) { 'DISABLED' } elseif ($s.Running) { 'RUNNING' } else { 'STOPPED' }
+    Write-Host ("Loop supervisor: {0} [{1}]" -f $label, $s.Reason)
+    return $s
+}
+
+function Recover-AutonomousSupervisor($Cfg) {
+    if (-not [bool]$Cfg.AutonomousSupervisorEnabled) { Fail 'autonomous supervisor recovery requires AutonomousSupervisorEnabled' }
+    Disarm-Desktop $Cfg -Quiet
+    Start-Deadbyte $Cfg | Out-Null
+    try { Disarm-Autonomous $Cfg -Quiet } catch {}
+    try { Disarm-Coding $Cfg } catch {}
+    try { Disarm-Process $Cfg } catch {}
+    try { Disarm-Host $Cfg } catch {}
+    $runtime = Get-ObservedState $Cfg
+    if ($runtime.State -ne 'ONLINE') { Fail "supervisor recovery requires ONLINE runtime; observed $($runtime.State)" }
+    $process = Get-ProcessGrantStatus $Cfg
+    $coding = Get-CodingLeaseStatus $Cfg
+    $autonomous = Get-AutonomousLeaseStatus $Cfg
+    $desktop = Get-DesktopGrantStatus $Cfg
+    $hostStatus = Get-HostArmStatus $Cfg
+    if ($process.Armed -or $coding.Armed -or $autonomous.Armed -or $desktop.Armed -or $hostStatus.Armed) { Fail 'supervisor recovery final authority is not fully disarmed' }
+    $supervisor = Start-AutonomousSupervisor $Cfg
+    Write-Host 'AUTONOMOUS SUPERVISOR RECOVERY PASS: runtime ONLINE; privileged planes DISARMED.'
+    return [pscustomobject]@{ Runtime=$runtime; Supervisor=$supervisor; Process=$process; Coding=$coding; Autonomous=$autonomous; Desktop=$desktop; Host=$hostStatus }
+}
+
+function Get-BoundedObservationReason($Value) {
+    $reason = [string]$Value
+    if ($reason -cmatch '^[a-z][a-z0-9-]{0,63}$') { return $reason }
+    return 'unverified'
+}
+
+function Convert-OwnedObservation($Owned) {
+    $pidValue = $null; $birth = $null
+    if ($Owned.Alive -and $Owned.Ledger) {
+        $pidValue = [int]$Owned.Ledger.pid
+        $birth = [string]$Owned.Ledger.creation_time_utc
+    }
+    [ordered]@{ alive=[bool]$Owned.Alive; reason=(Get-BoundedObservationReason $Owned.Reason); pid=$pidValue; creation_time_utc=$birth }
+}
+
+function Convert-AuthorityObservation($Authority) {
+    $out = [ordered]@{ configured=[bool]$Authority.Configured; armed=[bool]$Authority.Armed; reason=(Get-BoundedObservationReason $Authority.Reason) }
+    $seqProp = $Authority.PSObject.Properties['EpochSeq']
+    $shaProp = $Authority.PSObject.Properties['EpochSha256']
+    if ($null -ne $seqProp -or $null -ne $shaProp) {
+        if ($null -eq $seqProp -or $null -eq $shaProp -or [int64]$seqProp.Value -lt 1 -or [string]$shaProp.Value -cnotmatch '^[0-9a-f]{64}$') {
+            Fail 'authority epoch observation incomplete or invalid'
+        }
+        $out['epoch_seq'] = [int64]$seqProp.Value
+        $out['epoch_sha256'] = [string]$shaProp.Value
+    }
+    return $out
+}
+
+function Get-DownstreamCoreObservation($Cfg, $Bridge) {
+    $out = [ordered]@{ alive=$false; reason='bridge-unavailable'; pid=$null; parent_pid=$null; creation_time_utc=$null; identity_basis=$null }
+    if (-not $Bridge.Alive) { return $out }
+    $bridgePid = [int]$Bridge.Ledger.pid
+    if (-not [string]::Equals([IO.Path]::GetFullPath([string]$Bridge.Ledger.script_path), [IO.Path]::GetFullPath([string]$Cfg.Bridge.ScriptPath), [StringComparison]::OrdinalIgnoreCase) -or [string]$Bridge.Ledger.script_sha256 -ne [string]$Cfg.Bridge.ScriptSha256) {
+        $out.reason='bridge-config-mismatch'; return $out
+    }
+    try {
+        $children = @(Get-CimInstance Win32_Process -Filter ("ParentProcessId={0} AND Name='node.exe'" -f $bridgePid) -ErrorAction Stop)
+        if ($children.Count -eq 0) { $out.reason='startup-zero-child'; return $out }
+        if ($children.Count -ne 1) { $out.reason='ambiguous-core'; return $out }
+        $child = $children[0]
+        if ([int]$child.ParentProcessId -ne $bridgePid -or [int]$child.ProcessId -lt 1 -or $null -eq $child.CreationDate) { $out.reason='core-identity-incomplete'; return $out }
+        if (-not [string]::IsNullOrWhiteSpace([string]$child.ExecutablePath) -and -not [string]::Equals([string]$child.ExecutablePath,[string]$Cfg.Bridge.FilePath,[StringComparison]::OrdinalIgnoreCase)) { $out.reason='core-image-mismatch'; return $out }
+        $command = [string]$child.CommandLine
+        $needle = (Join-Path ([string]$Cfg.CoreRoot) 'src\mcp-server.mjs').Replace('/','\').ToLowerInvariant()
+        if ([string]::IsNullOrWhiteSpace($command)) { $basis='verified-bridge-single-opaque-node-child' }
+        elseif ($command.Replace('/','\').ToLowerInvariant().Contains($needle)) { $basis='command-line' }
+        else { $out.reason='wrong-core-generation'; return $out }
+        $out.alive=$true; $out.reason='verified'; $out.pid=[int]$child.ProcessId; $out.parent_pid=$bridgePid
+        $out.creation_time_utc=$child.CreationDate.ToUniversalTime().ToString('o'); $out.identity_basis=$basis
+        return $out
+    } catch { $out.reason='core-observation-failed'; return $out }
+}
+
+function Get-StructuredObservation($Cfg) {
+    $s = Get-ObservedState $Cfg
+    $supervisor = Get-AutonomousSupervisorStatus $Cfg
+    [ordered]@{
+        schema='deadbyte.controller-observation.v1'
+        observed_at_utc=[DateTime]::UtcNow.ToString('o')
+        state=[string]$s.State
+        core_root=[string]$Cfg.CoreRoot
+        local_ready=[bool]$s.LocalReady
+        bridge=(Convert-OwnedObservation $s.Bridge)
+        core=$s.Core
+        cloud=(Convert-OwnedObservation $s.Cloud)
+        supervisor=[ordered]@{ configured=[bool]$supervisor.Configured; running=[bool]$supervisor.Running; reason=(Get-BoundedObservationReason $supervisor.Reason) }
+        authority=[ordered]@{
+            process=(Convert-AuthorityObservation (Get-ProcessGrantStatus $Cfg))
+            coding=(Convert-AuthorityObservation (Get-CodingLeaseStatus $Cfg))
+            autonomous=(Convert-AuthorityObservation (Get-AutonomousLeaseStatus $Cfg))
+            desktop=(Convert-AuthorityObservation (Get-DesktopGrantStatus $Cfg))
+            host=(Convert-AuthorityObservation (Get-HostArmStatus $Cfg))
+        }
+    }
+}
+
+function Show-State($Cfg) {
+    $s = Get-ObservedState $Cfg
+    $bp = if ($s.Bridge.Alive) { $s.Bridge.Ledger.pid } else { '-' }
+    $cp = if ($s.Cloud.Alive) { $s.Cloud.Ledger.pid } else { '-' }
+    $url = Get-CurrentUrl $Cfg
+    Write-Host ("DEADBYTE MCP = {0}" -f $s.State)
+    Write-Host ("Bridge PID   : {0} [{1}]" -f $bp, $s.Bridge.Reason)
+    Write-Host ("Core PID     : {0} [{1}]" -f $(if ($s.Core.alive) { $s.Core.pid } else { '-' }), $s.Core.reason)
+    Write-Host ("Cloud PID    : {0} [{1}]" -f $cp, $s.Cloud.Reason)
+    Write-Host ("Local ready  : {0}" -f $s.LocalReady)
+    Write-Host ("URL          : {0}" -f $(if ($url) { $url } else { '<unknown>' }))
+    Write-Host ("Machine runtime: {0}" -f $(if ([bool]$Cfg.MachineRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Write-Host ("Agent runtime : {0}" -f $(if ([bool]$Cfg.AgentRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Write-Host ("Process rt    : {0}" -f $(if ([bool]$Cfg.ProcessRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Write-Host ("Coding runtime: {0}" -f $(if ([bool]$Cfg.CodingRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Write-Host ("Machine FS rt : {0}" -f $(if ([bool]$Cfg.MachineFsRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Write-Host ("Observation rt: {0}" -f $(if ([bool]$Cfg.ObservationRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Write-Host ("Desktop runtime: {0}" -f $(if ([bool]$Cfg.DesktopRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Write-Host ("Autonomous rt : {0}" -f $(if ([bool]$Cfg.AutonomousRuntimeEnabled) { 'ENABLED' } else { 'DISABLED' }))
+    Show-AutonomousSupervisorStatus $Cfg | Out-Null
+    Show-ProcessStatus $Cfg | Out-Null
+    Show-CodingStatus $Cfg | Out-Null
+    Show-AutonomousStatus $Cfg | Out-Null
+    Show-DesktopStatus $Cfg | Out-Null
+    Show-HostStatus $Cfg | Out-Null
+    return $s
+}
+
+function Invoke-MachineSmoke($Cfg) {
+    if (-not [bool]$Cfg.MachineRuntimeEnabled) { Fail 'machinetest requires MachineRuntimeEnabled' }
+    $s = Get-ObservedState $Cfg
+    if ($s.State -ne 'ONLINE') { Fail "machinetest requires ONLINE; observed $($s.State)" }
+    $url = Get-CurrentUrl $Cfg
+    if (-not $url) { Fail 'public MCP URL unavailable' }
+    Wait-PublicDnsReady $Cfg $url
+    $probeArgs = @($url)
+    if (-not [string]::IsNullOrWhiteSpace([string]$env:DEADBYTE_REMOTE_PROBE_MODE)) {
+        if ([string]$env:DEADBYTE_REMOTE_PROBE_MODE -notin @('default','operator','desktop','host','full','revoked')) { Fail 'invalid remote enforcement probe mode' }
+        $probeArgs += [string]$env:DEADBYTE_REMOTE_PROBE_MODE
+    }
+    Invoke-CoreGate $Cfg 'remote-mcp-machine-smoke-client.mjs' $probeArgs
+    Write-Host 'MACHINE IDENTITY LIVE GATE PASS: public status/list + SPKI identity + signed Ed25519 ping verified.'
+}
+
+function Invoke-Smoke($Cfg, [bool]$Full) {
+    $s = Get-ObservedState $Cfg
+    if ($s.State -ne 'ONLINE') { Fail "MCP test requires ONLINE; observed $($s.State)" }
+    if (-not (Test-LocalReady $Cfg)) { Fail 'local readiness probe failed' }
+    $url = Get-CurrentUrl $Cfg
+    if (-not $url) { Fail 'public MCP URL unavailable; configure McpUrlFile or McpPathFile' }
+    Wait-PublicDnsReady $Cfg $url
+    Invoke-CoreGate $Cfg 'remote-mcp-smoke-client.mjs' @($url, $(if ($Full) { 'full' } else { 'smoke' }))
+    if ($Full) {
+        Invoke-CoreGate $Cfg 'mcp-contained-smoke-client.mjs'
+        Write-Host 'FULL GATE PASS: public modern MCP + proof + public contained proof + local canonical 3-operation AppContainer/replay/evidence gate.'
+    } else {
+        Write-Host 'MCP SMOKE PASS: public modern MCP + exact tool catalog + signed proof + independent verification.'
+    }
+}
+
+function Invoke-HostSmoke($Cfg) {
+    $h = Get-HostArmStatus $Cfg
+    if (-not $h.Armed) { Fail 'hosttest requires an active local arm lease; run armhost first' }
+    $s = Get-ObservedState $Cfg
+    if ($s.State -ne 'ONLINE') { Fail "hosttest requires ONLINE; observed $($s.State)" }
+    $url = Get-CurrentUrl $Cfg
+    if (-not $url) { Fail 'public MCP URL unavailable' }
+    Wait-PublicDnsReady $Cfg $url
+    Invoke-CoreGate $Cfg 'remote-mcp-host-smoke-client.mjs' @($url)
+    Write-Host 'HOST PLANE LIVE GATE PASS: public host write + hash readback + hash-pinned exec + cleanup.'
+}
+
+function Invoke-CodingSmoke($Cfg) {
+    $c = Get-CodingLeaseStatus $Cfg
+    if (-not $c.Armed) { Fail 'codingtest requires an active local coding lease; run armcoding first' }
+    $s = Get-ObservedState $Cfg
+    if ($s.State -ne 'ONLINE') { Fail "codingtest requires ONLINE; observed $($s.State)" }
+    $url = Get-CurrentUrl $Cfg
+    if (-not $url) { Fail 'public MCP URL unavailable' }
+    Wait-PublicDnsReady $Cfg $url
+    Invoke-CoreGate $Cfg 'remote-mcp-coding-smoke-client.mjs' @($url)
+    Write-Host 'CODING PLANE LIVE GATE PASS: public edit + command + benchmark + durable coding-task receipt verification.'
+}
+
+function Invoke-AutonomousSmoke($Cfg) {
+    $a = Get-AutonomousLeaseStatus $Cfg
+    if (-not $a.Armed) { Fail 'autonomoustest requires active coding + autonomous leases; run armcoding then armautonomous' }
+    $s = Get-ObservedState $Cfg
+    if ($s.State -ne 'ONLINE') { Fail "autonomoustest requires ONLINE; observed $($s.State)" }
+    $url = Get-CurrentUrl $Cfg
+    if (-not $url) { Fail 'public MCP URL unavailable' }
+    Wait-PublicDnsReady $Cfg $url
+    Invoke-CoreGate $Cfg 'remote-mcp-autonomous-smoke-client.mjs' @($url)
+    Write-Host 'AUTONOMOUS PRODUCTION LIVE GATE PASS: public sampling MRTR + native diff + fail/diagnose/replan + build/test/benchmark + signed release gate.'
+}
+
+function Clean-Stale {
+    Ensure-Directory $RuntimeDir
+    foreach ($name in @('Bridge','Cloud','Supervisor')) {
+        $o = Test-OwnedInstance $name
+        if ($o.Ledger -and -not $o.Alive -and $o.Reason -eq 'process-missing') {
+            Remove-Item -LiteralPath (Ledger-Path $name) -Force -ErrorAction SilentlyContinue
+        } elseif ($o.Ledger -and -not $o.Alive -and $o.Reason -ne 'no-ledger') {
+            Write-Warning "$name ledger retained: $($o.Reason). No unverified process was killed."
+        }
+    }
+}
+
+function Run-CommandCore([string]$Name) {
+    $cfg = Get-Config
+    Assert-ControllerRootBound $cfg
+    $readOnly = $Name -in @('status','url','hoststatus','processstatus','codingstatus','autonomousstatus','desktopstatus','supervisorstatus')
+    if (-not $readOnly) { Ensure-Directory $RuntimeDir; Ensure-Directory $LogDir }
+    switch ($Name) {
+        'start'   { Start-Deadbyte $cfg | Out-Null; if ([bool]$cfg.AutonomousSupervisorEnabled) { Start-AutonomousSupervisor $cfg | Out-Null }; Show-State $cfg | Out-Null }
+        'resume'  { Start-Deadbyte $cfg | Out-Null; if ([bool]$cfg.AutonomousSupervisorEnabled) { Start-AutonomousSupervisor $cfg | Out-Null }; Show-State $cfg | Out-Null }
+        'park'    { Park-Deadbyte $cfg | Out-Null; Show-State $cfg | Out-Null }
+        'stop'    { if ([bool]$cfg.AutonomousSupervisorEnabled) { Stop-AutonomousSupervisor $cfg | Out-Null }; Stop-Deadbyte $cfg | Out-Null; Show-State $cfg | Out-Null }
+        'restart' { if ([bool]$cfg.AutonomousSupervisorEnabled) { Stop-AutonomousSupervisor $cfg | Out-Null }; Stop-Deadbyte $cfg | Out-Null; Start-Deadbyte $cfg | Out-Null; if ([bool]$cfg.AutonomousSupervisorEnabled) { Start-AutonomousSupervisor $cfg | Out-Null }; Show-State $cfg | Out-Null }
+        'status'  { if ($Json) { Get-StructuredObservation $cfg | ConvertTo-Json -Depth 6 -Compress | Write-Output } else { Show-State $cfg | Out-Null } }
+        'url'     { $u=Get-CurrentUrl $cfg; if (-not $u) { Fail 'URL unavailable' }; Write-Output $u }
+        'test'    { Invoke-Smoke $cfg $false }
+        'fulltest'{ Invoke-Smoke $cfg $true }
+        'toggle'  { $s=Get-ObservedState $cfg; if ($s.State -eq 'ONLINE') { Park-Deadbyte $cfg | Out-Null } elseif ($s.State -in @('PARKED','OFFLINE')) { Start-Deadbyte $cfg | Out-Null } else { Fail 'toggle refuses DEGRADED state' }; Show-State $cfg | Out-Null }
+        'clean'   { Clean-Stale; Show-State $cfg | Out-Null }
+        'machinetest' { Invoke-MachineSmoke $cfg }
+        'armhost' { Arm-Host $cfg; Show-HostStatus $cfg | Out-Null }
+        'disarmhost' { Disarm-Host $cfg; Show-HostStatus $cfg | Out-Null }
+        'hoststatus' { Show-HostStatus $cfg | Out-Null }
+        'hosttest' { Invoke-HostSmoke $cfg }
+        'armprocess' { Arm-Process $cfg; Show-ProcessStatus $cfg | Out-Null }
+        'disarmprocess' { Disarm-Process $cfg; Show-ProcessStatus $cfg | Out-Null }
+        'processstatus' { Show-ProcessStatus $cfg | Out-Null }
+        'armcoding' { Arm-Coding $cfg; Show-CodingStatus $cfg | Out-Null }
+        'disarmcoding' { Disarm-Coding $cfg; Show-CodingStatus $cfg | Out-Null; Show-AutonomousStatus $cfg | Out-Null }
+        'codingstatus' { Show-CodingStatus $cfg | Out-Null }
+        'codingtest' { Invoke-CodingSmoke $cfg }
+        'armautonomous' { Arm-Autonomous $cfg; Show-AutonomousStatus $cfg | Out-Null }
+        'disarmautonomous' { Disarm-Autonomous $cfg; Show-AutonomousStatus $cfg | Out-Null }
+        'autonomousstatus' { Show-AutonomousStatus $cfg | Out-Null }
+        'autonomoustest' { Invoke-AutonomousSmoke $cfg }
+        'armdesktop' { Arm-Desktop $cfg; Show-DesktopStatus $cfg | Out-Null }
+        'disarmdesktop' { Disarm-Desktop $cfg; Show-DesktopStatus $cfg | Out-Null }
+        'desktopstatus' { Show-DesktopStatus $cfg | Out-Null }
+        'supervisorstart' { Start-AutonomousSupervisor $cfg | Out-Null; Show-AutonomousSupervisorStatus $cfg | Out-Null }
+        'supervisorstop' { Stop-AutonomousSupervisor $cfg | Out-Null; Show-AutonomousSupervisorStatus $cfg | Out-Null }
+        'supervisorstatus' { Show-AutonomousSupervisorStatus $cfg | Out-Null }
+        'supervisorrecover' { Recover-AutonomousSupervisor $cfg | Out-Null; Show-State $cfg | Out-Null }
+        default   { Fail "unknown command '$Name'" }
+    }
+}
+
+function Run-Command([string]$Name) {
+    $mutating = $Name -in @(
+        'start','resume','park','stop','restart','toggle','clean',
+        'armhost','disarmhost','armprocess','disarmprocess','armcoding','disarmcoding',
+        'armautonomous','disarmautonomous','armdesktop','disarmdesktop',
+        'supervisorstart','supervisorstop','supervisorrecover'
+    )
+    if (-not $mutating) {
+        Run-CommandCore $Name
+        return
+    }
+    Invoke-WithControllerMutationLock $Name { Run-CommandCore $Name }
+}
+
+if ($Command -ne 'menu') {
+    $recordsStartFailure = $Command -in @('start','resume','restart')
+    if ($recordsStartFailure) { Remove-Item -LiteralPath (Controller-StartFailurePath) -Force -ErrorAction SilentlyContinue }
+    try {
+        Run-Command $Command
+        exit 0
+    } catch {
+        if ($recordsStartFailure) {
+            try { Write-ControllerStartFailure $Command $_.Exception } catch {}
+        }
+        throw
+    }
+}
+
+while ($true) {
+    Clear-Host
+    $cfg = Get-Config
+    Assert-ControllerRootBound $cfg
+    Write-Host 'DEADBYTE MCP ON-DEMAND CONTROLLER V0.15.5 / R46'
+    Write-Host '======================================'
+    Show-State $cfg | Out-Null
+    Write-Host ''
+    Write-Host '[1] Start / Resume'
+    Write-Host '[2] Park'
+    Write-Host '[3] Full Stop'
+    Write-Host '[4] Restart'
+    Write-Host '[5] Transport smoke test'
+    Write-Host '[6] Public transport gate'
+    Write-Host '[7] Show current URL'
+    Write-Host '[8] Clean stale ledgers'
+    Write-Host '[9] Enable privileged host plane (standing grant)'
+    Write-Host '[10] Revoke privileged host plane'
+    Write-Host '[11] Host plane status'
+    Write-Host '[12] Host plane LIVE gate (requires grant)'
+    Write-Host '[13] Enable coding plane (standing grant)'
+    Write-Host '[14] Revoke coding plane'
+    Write-Host '[15] Coding plane status'
+    Write-Host '[16] Coding plane LIVE gate (requires grant)'
+    Write-Host '[17] Enable autonomous plane (standing grant)'
+    Write-Host '[18] Revoke autonomous plane'
+    Write-Host '[19] Autonomous plane status'
+    Write-Host '[20] Autonomous production LIVE gate'
+    Write-Host '[21] Machine identity LIVE gate (non-mutating)'
+    Write-Host '[22] Enable process plane (standing grant)'
+    Write-Host '[23] Revoke process plane'
+    Write-Host '[24] Process plane status'
+    Write-Host '[25] Enable desktop plane (standing grant; never auto-armed)'
+    Write-Host '[26] Revoke desktop plane'
+    Write-Host '[27] Desktop plane status'
+    Write-Host '[0] Exit controller (runtime stays as-is)'
+    $choice = Read-Host 'Select'
+    try {
+        switch ($choice) {
+            '1' { Run-Command 'start' }
+            '2' { Run-Command 'park' }
+            '3' { Run-Command 'stop' }
+            '4' { Run-Command 'restart' }
+            '5' { Run-Command 'test' }
+            '6' { Run-Command 'fulltest' }
+            '7' { Run-Command 'url' }
+            '8' { Run-Command 'clean' }
+            '9' { Run-Command 'armhost' }
+            '10' { Run-Command 'disarmhost' }
+            '11' { Run-Command 'hoststatus' }
+            '12' { Run-Command 'hosttest' }
+            '13' { Run-Command 'armcoding' }
+            '14' { Run-Command 'disarmcoding' }
+            '15' { Run-Command 'codingstatus' }
+            '16' { Run-Command 'codingtest' }
+            '17' { Run-Command 'armautonomous' }
+            '18' { Run-Command 'disarmautonomous' }
+            '19' { Run-Command 'autonomousstatus' }
+            '20' { Run-Command 'autonomoustest' }
+            '21' { Run-Command 'machinetest' }
+            '22' { Run-Command 'armprocess' }
+            '23' { Run-Command 'disarmprocess' }
+            '24' { Run-Command 'processstatus' }
+            '25' { Run-Command 'armdesktop' }
+            '26' { Run-Command 'disarmdesktop' }
+            '27' { Run-Command 'desktopstatus' }
+            '0' { exit 0 }
+            default { Write-Warning 'invalid selection' }
+        }
+    } catch { Write-Host $_.Exception.Message -ForegroundColor Red }
+    if ($choice -ne '0') { [void](Read-Host 'Press Enter') }
+}