deadbyte-mcp 0.15.46 → 0.15.48

package/src/atomic-mutation.mjs

@@ -1,6 +1,8 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { open, rename, rm, stat } from 'node:fs/promises';
+import { open, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import path from 'node:path';
+import {performance} from 'node:perf_hooks';
+import {acquireKernelExclusiveLock, verifyKernelLockBinary} from './kernel-lock-r74.mjs';
 
 const sha256Bytes = bytes => createHash('sha256').update(bytes).digest('hex');
 const LOCK_WAIT_MS = 10;
@@ -9,20 +11,90 @@ const LOCK_STALE_MS = 120000;
 
 async function acquireMutationLock(target) {
   const lock = `${target}.deadbyte-mutation.lock`;
-  const started = Date.now();
+  const kernelLock = `${target}.deadbyte-mutation.lock.kernel`;
+  const ownership = `${process.pid}:${Date.now()}:${randomBytes(16).toString('hex')}`;
+  const verified = await verifyKernelLockBinary();
+
+  if (verified.ok && process.env.DEADBYTE_R74_KERNEL_LOCK !== '0') {
+    try {
+      const existing = await readFile(lock, 'utf8').catch(() => null);
+      if (existing && existing.includes('abandoned')) {
+        throw new Error('atomic mutation lock abandoned; reconciliation required');
+      }
+    } catch (err) {
+      if (err.message.includes('abandoned')) throw err;
+    }
+
+    const releaseKernel = await acquireKernelExclusiveLock(kernelLock, {
+      timeoutMs: LOCK_TIMEOUT_MS,
+      pollMs: LOCK_WAIT_MS
+    });
+
+    try {
+      await writeFile(lock, ownership);
+    } catch (err) {
+      await releaseKernel().catch(() => {});
+      throw err;
+    }
+
+    return async () => {
+      let ownershipLost = false;
+      try {
+        const onDisk = await readFile(lock, 'utf8').catch(() => null);
+        if (onDisk !== ownership) {
+          ownershipLost = true;
+        }
+      } finally {
+        await releaseKernel().catch(() => {});
+        await rm(kernelLock, {force: true}).catch(() => {});
+        if (!ownershipLost) {
+          await rm(lock, {force: true}).catch(() => {});
+        }
+      }
+      if (ownershipLost) {
+        throw new Error('atomic mutation lock ownership lost');
+      }
+    };
+  }
+
+  const started = performance.now();
   while (true) {
     try {
       const handle = await open(lock, 'wx', 0o600);
-      await handle.writeFile(`${process.pid}\\n${Date.now()}\\n`);
-      await handle.sync();
-      await handle.close();
-      return async () => { await rm(lock, { force: true }).catch(() => {}); };
+      try {
+        await handle.writeFile(ownership);
+        await handle.sync();
+        await handle.close();
+      } catch (error) {
+        await handle.close().catch(() => {});
+        try { await rm(lock, {force:true}); }
+        catch { error.lock_cleanup_failed = true; }
+        throw error;
+      }
+      return async () => {
+        if (await readFile(lock, 'utf8').catch(() => null) !== ownership)
+          throw new Error('atomic mutation lock ownership lost');
+        await rm(lock, { force: true });
+      };
     } catch (error) {
       if (error?.code !== 'EEXIST') throw error;
-      if (Date.now() - started >= LOCK_TIMEOUT_MS) throw new Error('atomic mutation lock timed out');
+      if (performance.now() - started >= LOCK_TIMEOUT_MS) throw new Error('atomic mutation lock timed out');
       try {
         const info = await stat(lock);
-        if (Date.now() - info.mtimeMs > LOCK_STALE_MS) await rm(lock, { force: true }).catch(() => {});
+        if (Date.now() - info.mtimeMs > LOCK_STALE_MS) {
+          const contents = await readFile(lock, 'utf8').catch(() => null);
+          const owner = Number(/^\d+/.exec(contents??'')?.[0]);
+          let ownerAlive = true;
+          if (Number.isSafeInteger(owner) && owner > 0) {
+            try { process.kill(owner, 0); }
+            catch (error) { ownerAlive = error?.code !== 'ESRCH'; }
+          }
+          if (!ownerAlive) {
+            // A check-then-unlink race can remove a *new* writer's lock. Without
+            // an atomic compare-and-delete primitive, preserve evidence and stop.
+            throw new Error('atomic mutation lock abandoned; reconciliation required');
+          }
+        }
       } catch (statError) {
         if (statError?.code !== 'ENOENT') throw statError;
       }
@@ -47,6 +119,8 @@ export async function atomicMutation({
     throw new Error('atomic mutation requires readState and assertExpected');
   }
   const releaseLock = await acquireMutationLock(target);
+  let committed = false;
+  let operationFailure = null;
   try {
     const before = await readState(target);
     assertExpected(before, expected);
@@ -68,6 +142,7 @@ export async function atomicMutation({
       if (authorityCheck) await authorityCheck();
 
       await rename(temp, target);
+      committed = true;
     } catch (error) {
       if (handle) await handle.close().catch(() => {});
       await rm(temp, { force: true }).catch(() => {});
@@ -87,7 +162,22 @@ export async function atomicMutation({
       failure.expected_after_sha256 = expectedAfter;
       throw failure;
     }
+  } catch (error) {
+    operationFailure = error;
+    throw error;
   } finally {
-    await releaseLock();
+    try { await releaseLock(); }
+    catch (error) {
+      if (operationFailure) operationFailure.lock_cleanup_failed = true;
+      else {
+        error.lock_cleanup_failed = true;
+        if (committed) {
+          error.outcome = 'FAILED_AFTER_UNKNOWN_EFFECT';
+          error.side_effect_state = 'unknown';
+          error.expected_after_sha256 = sha256Bytes(bytes);
+        }
+        throw error;
+      }
+    }
   }
 }

package/src/authority-continuity-r65.mjs

@@ -1,5 +1,5 @@
 import {createHash,createPrivateKey,createPublicKey,randomBytes,sign as cryptoSign,verify as cryptoVerify} from 'node:crypto';
-import {mkdir,open,readFile,readdir,rename,rm,writeFile} from 'node:fs/promises';
+import {lstat,mkdir,open,readFile,readdir,rename,rm,writeFile} from 'node:fs/promises';
 import path from 'node:path';
 import {canonicalJson} from './canonical-json.mjs';
 import {decodeUtf8Strict} from './text-policy.mjs';
@@ -271,38 +271,159 @@ function processAlive(pid){
   if(pid===process.pid)return true;
   try{process.kill(pid,0);return true;}catch(error){return error?.code==='EPERM';}
 }
-async function atomicJsonWrite(file,value){
+let cachedEpochOwnerIdentity=null;
+async function windowsEpochOwnerIdentity(pid){
+  const {queryForegroundIdentity,validForegroundIdentity}=await import('./foreground-process-identity.mjs');
+  const identity=queryForegroundIdentity(pid);
+  if(identity!==null&&!validForegroundIdentity(identity))throw new Error('authority epoch owner process identity incomplete');
+  return identity;
+}
+async function currentEpochOwnerIdentity(){
+  if(process.platform!=='win32')return null;
+  if(!cachedEpochOwnerIdentity)cachedEpochOwnerIdentity=await windowsEpochOwnerIdentity(process.pid);
+  if(!cachedEpochOwnerIdentity||cachedEpochOwnerIdentity.pid!==process.pid)
+    throw new Error('authority epoch owner process identity unavailable');
+  return cachedEpochOwnerIdentity;
+}
+// R80: A successful file write is not a durability barrier. Flush the exact
+// open file handle BEFORE publishing an event or replacing the signed head.
+// Node on Windows does not expose a verified directory-metadata flush: keep
+// that limitation explicit instead of treating rename() as a power-loss proof.
+export function authorityEpochDurabilityAssessment(){
+  return Object.freeze({
+    event_file:'FLUSH_REQUIRED',head_temp_file:'FLUSH_REQUIRED',
+    directory_metadata:process.platform==='win32'?'UNVERIFIED_ON_WINDOWS':'FSYNC_REQUIRED',
+    power_loss:'NOT_VERIFIED_BY_TESTS'
+  });
+}
+async function syncDirectoryMetadata(dir){
+  if(process.platform==='win32')return false; // No verified Node directory FlushFileBuffers contract.
+  const handle=await open(dir,'r');
+  try{await handle.sync();}
+  finally{await handle.close();}
+  return true;
+}
+async function writeDurableEvent(file,bytes,{stage=async()=>{}}={}){
+  const handle=await open(file,'wx'); // immutable identity, exclusive creation
+  try{
+    await stage('event_created');
+    await handle.writeFile(bytes);
+    await stage('event_written');
+    await handle.sync(); // event bytes must be flushed BEFORE head visibility
+    await stage('event_file_synced');
+  }finally{await handle.close();}
+  await syncDirectoryMetadata(path.dirname(file));
+  await stage('event_directory_barrier');
+}
+async function atomicJsonWrite(file,value,{stage=async()=>{}}={}){
   const dir=path.dirname(file);
   await mkdir(dir,{recursive:true});
   const tmp=`${file}.tmp-${process.pid}-${randomBytes(8).toString('hex')}`;
   try{
-    await writeFile(tmp,canonicalJson(value),{encoding:'utf8',flag:'wx'});
+    const handle=await open(tmp,'wx');
+    try{
+      await stage('head_temp_created');
+      await handle.writeFile(Buffer.from(canonicalJson(value),'utf8'));
+      await stage('head_temp_written');
+      await handle.sync(); // temp head content flushed BEFORE rename
+      await stage('head_temp_file_synced');
+    }finally{await handle.close();}
     await rename(tmp,file);
+    await stage('head_renamed'); // rename succeeded: caller outcome may now be ambiguous
+    await syncDirectoryMetadata(dir);
+    await stage('head_directory_barrier');
   }finally{
     await rm(tmp,{force:true}).catch(()=>{});
   }
 }
-async function acquireEpochLock(dir){
+// R82: On Windows, lock reclamation/release MUST be conditional on the
+// exact observed lock bytes and must dispose through one pinned native handle.
+// The R78 implementation also pins every non-reparse ancestor directory.
+// R83: Windows lock snapshots now bind owner bytes + native FileIdInfo to
+// the same pinned handle. The later pinned deletion compares BOTH identity
+// and content before disposition, defeating byte-identical file replacement.
+// POSIX remains legacy/unsupported against adversarial lock-path replacement.
+async function epochLockSnapshot(lockPath){
+  if(process.platform==='win32'){
+    const {readPinnedEpochLockSnapshot}=await import('./foreground-marker-cas-win32.mjs');
+    return readPinnedEpochLockSnapshot(lockPath);
+  }
+  try{return {bytes:await readFile(lockPath),fileId:null};}
+  catch(error){if(error?.code==='ENOENT')return null;throw error;}
+}
+async function disposeObservedEpochLock(lockPath,snapshot){
+  if(process.platform==='win32'){
+    if(!snapshot?.fileId)throw new Error('epoch lock native identity snapshot is required');
+    const {deletePinnedRemoteMarker}=await import('./foreground-marker-cas-win32.mjs');
+    return deletePinnedRemoteMarker(lockPath,hashBytes(snapshot.bytes),{expectedFileId:snapshot.fileId});
+  }
+  throw new Error('authority epoch POSIX lock disposition unsupported');
+}
+
+async function acquireEpochLock(dir,{allowStaleRecovery=true,onLockDispositionStage=null}={}){
+  // POSIX open('wx') protects creation, but a later read/check followed by
+  // unlink(path) cannot atomically prove the pathname still denotes our lock.
+  // Until a kernel-held, identity-bound POSIX protocol exists, no authority
+  // epoch mutation may start there. Read-only head verification remains usable.
+  if(process.platform!=='win32')
+    throw new Error('authority epoch POSIX mutation unsupported: lock pathname cannot be disposed atomically');
   await mkdir(dir,{recursive:true});
   const lockPath=path.join(dir,'.lock');
+  const stage=async label=>{if(onLockDispositionStage)await onLockDispositionStage(label,lockPath);};
   for(let attempt=0;attempt<2;attempt++){
     const token=randomBytes(16).toString('hex');
     try{
-      const handle=await open(lockPath,'wx');
-      try{await handle.writeFile(canonicalJson({schema:'deadbyte.authority-epoch-lock.r65.v1',pid:process.pid,token,created_at_utc:new Date().toISOString()}),'utf8');}
-      finally{await handle.close();}
-      return async()=>{
-        try{
-          const current=JSON.parse(await readFile(lockPath,'utf8'));
-          if(current?.token===token)await rm(lockPath,{force:true});
-        }catch(error){if(error?.code!=='ENOENT')throw error;}
+      const ownerIdentity=await currentEpochOwnerIdentity();
+      const lockBytes=Buffer.from(canonicalJson({schema:'deadbyte.authority-epoch-lock.r65.v1',pid:process.pid,token,
+        created_at_utc:new Date().toISOString(),...(ownerIdentity?{owner_identity:ownerIdentity}:{})}),'utf8');
+      let nativeLease=null;
+      if(process.platform==='win32'){
+        const {acquireHeldEpochLock}=await import('./epoch-lock-r85.mjs');
+        nativeLease=await acquireHeldEpochLock(lockPath,lockBytes);
+        if(!nativeLease)throw Object.assign(new Error('authority epoch lock exists'),{code:'EEXIST'});
+      }else throw new Error('authority epoch POSIX mutation unsupported');
+      const verifyOwned=async()=>{
+        // On Windows the in-process native handle holds the leaf and every
+        // non-reparse ancestor through the mutation. No pathname recheck can
+        // improve that atomic ownership guarantee.
+        if(!nativeLease)throw new Error('authority epoch lock ownership unverified');
+        return null;
+      };
+      const release=async()=>{
+        if(nativeLease){
+          let stageError=null;
+          try{await stage('release_before_cas');}catch(error){stageError=error;}
+          let releaseError=null;
+          try{await nativeLease.release();}catch(error){releaseError=error;}
+          if(stageError&&releaseError)throw new AggregateError([stageError,releaseError],
+            'authority epoch release observer and native cleanup both failed');
+          if(stageError)throw stageError;
+          if(releaseError)throw releaseError;
+          return;
+        }
+        throw new Error('authority epoch lock release without native ownership denied');
       };
+      release.verifyOwned=verifyOwned;
+      return release;
     }catch(error){
       if(error?.code!=='EEXIST')throw error;
+      const snapshot=await epochLockSnapshot(lockPath);
       let owner=null;
-      try{owner=JSON.parse(await readFile(lockPath,'utf8'));}catch{}
-      if(attempt===0&&owner&&Number.isInteger(owner.pid)&&!processAlive(owner.pid)){
-        await rm(lockPath,{force:true});
+      try{if(snapshot)owner=JSON.parse(snapshot.bytes.toString('utf8'));}catch{}
+      if(attempt===0&&allowStaleRecovery&&snapshot&&owner&&Number.isInteger(owner.pid)&&owner.pid>0){
+        if(process.platform!=='win32')throw new Error('authority epoch mutation locked (POSIX automatic recovery disabled)');
+        const {validForegroundIdentity,foregroundIdentityMatches}=await import('./foreground-process-identity.mjs');
+        if(!validForegroundIdentity(owner.owner_identity)||owner.owner_identity.pid!==owner.pid)
+          throw new Error('authority epoch mutation locked (owner identity unverified)');
+        const observed=await windowsEpochOwnerIdentity(owner.pid);
+        if(observed){
+          if(!foregroundIdentityMatches(owner.owner_identity,observed))
+            throw new Error('authority epoch mutation locked (owner process birth changed)');
+          throw new Error('authority epoch mutation locked (owner still active)');
+        }
+        await stage('stale_before_cas');
+        const disposition=await disposeObservedEpochLock(lockPath,snapshot);
+        if(disposition!=='REMOVED')throw new Error(`authority epoch mutation locked (stale owner changed: ${disposition})`);
         continue;
       }
       throw new Error('authority epoch mutation locked');
@@ -310,7 +431,7 @@ async function acquireEpochLock(dir){
   }
   throw new Error('authority epoch mutation locked');
 }
-async function readDurableHead(runtimeDir,plane){
+async function readDurableHead(runtimeDir,plane,{recoveryOrphanFile=null}={}){
   const dir=durableEpochDir(runtimeDir,plane),headPath=path.join(dir,'head.json');
   let head;
   try{head=JSON.parse(await readFile(headPath,'utf8'));}
@@ -342,7 +463,7 @@ async function readDurableHead(runtimeDir,plane){
     const match=/^(\d{16})-([0-9a-f]{64})\.json$/.exec(name);
     if(!match)throw new Error('authority epoch unexpected event file');
     const seq=Number(match[1]);
-    if(!Number.isSafeInteger(seq)||seq>head.seq||(seq===head.seq&&name!==head.event_file))
+    if(!Number.isSafeInteger(seq)||(seq>head.seq&&name!==recoveryOrphanFile)||(seq===head.seq&&name!==head.event_file))
       throw new Error('authority epoch head replay or incomplete write');
   }
   const eventBytes=eventRead.bytes;
@@ -379,14 +500,134 @@ async function readDurableHead(runtimeDir,plane){
   return Object.freeze({...head});
 }
 
-export function createAuthorityEpochStore({runtimeDir,policyBytes=null}={}){
+// R79: An orphan event is not a committed head. Ordinary reads, verification
+// and appends MUST keep rejecting it. Only explicit revocation-only recovery
+// can use the bounded exception to inspect an older, still-signed head.
+async function inspectOrphanRevocation(runtimeDir,plane,{expectedHeadSha256,expectedOrphanSha256}){
+  if(!SCHEMAS[plane]||!SHAPAT.test(String(expectedHeadSha256))||!SHAPAT.test(String(expectedOrphanSha256)))
+    throw new Error('authority epoch recovery requires exact signed event identities');
+  const dir=durableEpochDir(runtimeDir,plane),events=path.join(dir,'events');
+  // Reject known static reparse/junction boundaries. Handle-pinned directory
+  // protection for concurrent substitutions is a separate Windows requirement.
+  for(const parent of [path.resolve(runtimeDir),path.join(path.resolve(runtimeDir),'authority-epochs'),dir,events]){
+    const st=await lstat(parent);
+    if(!st.isDirectory()||st.isSymbolicLink())throw new Error('authority epoch recovery directory identity invalid');
+  }
+  const headPath=path.join(dir,'head.json');
+  const headStat=await lstat(headPath);
+  if(!headStat.isFile()||headStat.isSymbolicLink())throw new Error('authority epoch recovery head identity invalid');
+  const rawHead=await readFile(headPath);
+  let untrusted;
+  try{untrusted=JSON.parse(decodeUtf8Strict(rawHead));}catch{throw new Error('authority epoch recovery head invalid');}
+  if(!Number.isSafeInteger(untrusted?.seq)||untrusted.seq<1)
+    throw new Error('authority epoch recovery head invalid');
+  const names=await readdir(events);
+  // Do not accept more than one event beyond the old head, even if signed.
+  const orphanNames=names.filter(name=>{
+    const m=/^(\d{16})-([0-9a-f]{64})\.json$/.exec(name);
+    return m&&Number(m[1])>untrusted.seq;
+  });
+  if(orphanNames.length!==1)throw new Error('authority epoch recovery requires exactly one orphan event');
+  const orphanFile=orphanNames[0];
+  if(orphanFile!==durableEventName(untrusted.seq+1,expectedOrphanSha256))
+    throw new Error('authority epoch recovery orphan identity mismatch');
+  const previous=await readDurableHead(runtimeDir,plane,{recoveryOrphanFile:orphanFile});
+  if(!previous||previous.event_sha256!==expectedHeadSha256||previous.seq!==untrusted.seq)
+    throw new Error('authority epoch recovery previous head mismatch');
+  if(!['grant','transaction_restore','transaction_revoke'].includes(previous.action))
+    throw new Error('authority epoch recovery previous action invalid');
+  const orphanPath=path.join(events,orphanFile);
+  const orphanStat=await lstat(orphanPath);
+  if(!orphanStat.isFile()||orphanStat.isSymbolicLink())throw new Error('authority epoch recovery orphan file identity invalid');
+  const orphanBytes=await readFile(orphanPath);
+  if(hashBytes(orphanBytes)!==expectedOrphanSha256)
+    throw new Error('authority epoch recovery orphan bytes mismatch');
+  let event;
+  try{event=JSON.parse(decodeUtf8Strict(orphanBytes));}catch{throw new Error('authority epoch recovery orphan invalid');}
+  const {publicKey,keyId}=await durableEpochKeys(runtimeDir);
+  if(!verifyDurableEvent(event,publicKey,keyId))
+    throw new Error('authority epoch recovery orphan signature invalid');
+  if(event.schema!==DURABLE_EPOCH_SCHEMA||event.plane!==plane||event.seq!==previous.seq+1||
+      !['transaction_revoke','user_revoke'].includes(event.action)||
+      (event.action==='transaction_revoke'&&!/^[A-Za-z0-9._-]{1,96}$/.test(String(event.update_id??'')))||
+      (event.action==='user_revoke'&&event.update_id!==null)||
+      event.previous_event_sha256!==previous.event_sha256||
+      event.grant_sha256!==previous.grant_sha256||event.grant_instance_nonce!==previous.grant_instance_nonce||
+      event.policy_sha256!==previous.policy_sha256||event.policy_envelope_sha256!==previous.policy_envelope_sha256||
+      event.restore_binding!==null||
+      (event.action==='transaction_revoke'&&!['grant','transaction_restore'].includes(previous.action)))
+    throw new Error('authority epoch recovery orphan revocation binding invalid');
+  // Head cannot be promoted unless it is still exactly the same committed
+  // predecessor. No authority-creating action is ever eligible.
+  const replay=await readFile(path.join(dir,'head.json'));
+  if(!replay.equals(rawHead))throw new Error('authority epoch recovery head changed');
+  const newHead={schema:DURABLE_HEAD_SCHEMA,plane,seq:event.seq,action:event.action,
+    update_id:event.update_id,grant_sha256:event.grant_sha256,
+    grant_instance_nonce:event.grant_instance_nonce,restore_binding:null,
+    ...(event.policy_sha256===undefined?{}:{policy_sha256:event.policy_sha256,policy_envelope_sha256:event.policy_envelope_sha256}),
+    previous_event_sha256:event.previous_event_sha256,event_sha256:expectedOrphanSha256,event_file:orphanFile};
+  return Object.freeze({previous,newHead,headBytes:rawHead,orphanBytes});
+}
+
+export function createAuthorityEpochStore({runtimeDir,policyBytes=null,onDurabilityStage=null,onLockDispositionStage=null}={}){
   const root=path.resolve(String(runtimeDir??''));
   if(!runtimeDir)throw new Error('authority epoch runtime directory invalid');
   if(policyBytes!==null&&!Buffer.isBuffer(policyBytes))throw new Error('authority epoch policy bytes invalid');
+  if(onDurabilityStage!==null&&(typeof onDurabilityStage!=='function'||process.env.NODE_TEST_CONTEXT!=='child-v8'))
+    throw new Error('authority epoch stage observer is restricted to node test workers');
+  if(onLockDispositionStage!==null&&(typeof onLockDispositionStage!=='function'||process.env.NODE_TEST_CONTEXT!=='child-v8'))
+    throw new Error('authority epoch lock observer is restricted to node test workers');
+  // Node-test-worker-only fault observer. It can abort, never bypass, flush/order checks.
+  const stage=async name=>{if(onDurabilityStage)await onDurabilityStage(name);};
   return Object.freeze({
     async readHead({plane}){
       return readDurableHead(root,plane);
     },
+    async reconcileOrphanedRevocation({plane,expectedHeadSha256,expectedOrphanSha256,operatorConfirmed=false}){
+      // NOT called from grant verification, append, startup or automatic
+      // recovery. The operator must supply two observed event identities.
+      if(operatorConfirmed!==true)throw new Error('authority epoch recovery requires explicit operator confirmation');
+      const dir=durableEpochDir(root,plane);
+      // Reject wrong or stale operator evidence before even reclaiming a dead
+      // owner's lock. This is a read-only preflight, not an ownership proof;
+      // the same exact evidence is independently rechecked under the lock.
+      await inspectOrphanRevocation(root,plane,{expectedHeadSha256,expectedOrphanSha256});
+      // Explicit, identity-bound revocation reconciliation may reclaim a
+      // verified dead owner's lock through the same native stale-owner CAS as
+      // append. A live or unverified owner still fails closed. The orphan
+      // itself is inspected only after exclusive ownership is established.
+      const release=await acquireEpochLock(dir,{allowStaleRecovery:true,onLockDispositionStage});
+      try{
+        const {newHead,headBytes,orphanBytes}=await inspectOrphanRevocation(root,plane,{expectedHeadSha256,expectedOrphanSha256});
+        // Windows FlushFileBuffers requires a writable file handle. The old
+        // read-only ('r') handle returned EPERM on Windows even for a valid,
+        // signed revocation. 'r+' grants the handle sync rights; we do not
+        // write event bytes. Revalidate exact bytes through this same handle
+        // before syncing, refusing a replaced or modified orphan event.
+        // Directory/power-loss durability is NOT proven here.
+        const fh=await open(path.join(dir,'events',newHead.event_file),'r+');
+        try{
+          const st=await fh.stat();
+          if(!st.isFile()||st.size!==orphanBytes.length)
+            throw new Error('authority epoch recovery pinned orphan identity invalid');
+          const pinnedBytes=await fh.readFile();
+          if(!pinnedBytes.equals(orphanBytes)||hashBytes(pinnedBytes)!==expectedOrphanSha256)
+            throw new Error('authority epoch recovery orphan changed before sync');
+          await fh.sync();
+        }finally{await fh.close();}
+        if(!(await readFile(path.join(dir,'head.json'))).equals(headBytes))
+          throw new Error('authority epoch recovery head changed before commit');
+        await release.verifyOwned();
+        await atomicJsonWrite(path.join(dir,'head.json'),newHead,{stage});
+        const committed=await readDurableHead(root,plane);
+        if(committed.event_sha256!==expectedOrphanSha256||
+            !['transaction_revoke','user_revoke'].includes(committed.action))
+          throw new Error('authority epoch recovered head re-verification failed');
+        return Object.freeze({status:'REVOKED_ONLY_RECONCILED',plane,seq:committed.seq,
+          action:committed.action,event_sha256:committed.event_sha256,
+          standing_grant_authorized:false});
+      }finally{await release();}
+    },
     async append({plane,action,grantBytes,grantInstanceNonce,updateId=null,expectedHeadSha256=undefined,restoreBinding=null}){
       const transactional=action?.startsWith('transaction_')===true;
       if(!SCHEMAS[plane]||!DURABLE_EPOCH_ACTIONS.has(action)||!Buffer.isBuffer(grantBytes)||
@@ -410,7 +651,7 @@ export function createAuthorityEpochStore({runtimeDir,policyBytes=null}={}){
         policyBinding={policy_sha256:policySha256,policy_envelope_sha256:deriveSecurityEnvelope(plane,parsedPolicy).sha256};
       }
       const dir=durableEpochDir(root,plane),events=path.join(dir,'events');
-      const release=await acquireEpochLock(dir);
+      const release=await acquireEpochLock(dir,{onLockDispositionStage});
       try{
         await mkdir(events,{recursive:true});
         const previous=await readDurableHead(root,plane);
@@ -445,12 +686,15 @@ export function createAuthorityEpochStore({runtimeDir,policyBytes=null}={}){
         const event={...body,attestation:{algorithm:'ed25519',domain:'DEADBYTE-AUTHORITY-DURABLE-EPOCH-R65-V1',key_id:keyId,signature_base64:signature.toString('base64')}};
         const eventBytes=Buffer.from(canonicalJson(event),'utf8'),eventSha256=hashBytes(eventBytes);
         const eventFile=durableEventName(seq,eventSha256);
-        await writeFile(path.join(events,eventFile),eventBytes,{flag:'wx'});
+        await writeDurableEvent(path.join(events,eventFile),eventBytes,{stage});
         const head={schema:DURABLE_HEAD_SCHEMA,plane,seq,action,update_id:updateId,
           grant_sha256:grantSha256,grant_instance_nonce:grantInstanceNonce,restore_binding:normalizedRestoreBinding,
           ...(policyBinding??{}),
           previous_event_sha256:event.previous_event_sha256,event_sha256:eventSha256,event_file:eventFile};
-        await atomicJsonWrite(path.join(dir,'head.json'),head);
+        // A replaced lock observed before publication must not authorize a
+        // head commit. This narrows the window but is not a held-handle lock.
+        await release.verifyOwned();
+        await atomicJsonWrite(path.join(dir,'head.json'),head,{stage});
         return Object.freeze({...head});
       }finally{await release();}
     },

package/src/deadbyte-cli.mjs

@@ -1,6 +1,6 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 import { closeSync, openSync } from 'node:fs';
-import { lstat, mkdir, open, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
+import { lstat, mkdir, open, readFile, readdir, stat, writeFile } from 'node:fs/promises';
 import { spawn, spawnSync } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
 import os from 'node:os';
@@ -22,6 +22,7 @@ import { ensureRuntimeCoherence } from './runtime-coherence.mjs';
 import { windowsPowerShellEnvironment } from './runtime-update.mjs';
 import { resolveStateRoot } from './state-root.mjs';
 import {foregroundIdentityMatches,queryForegroundIdentity,validForegroundIdentity} from './foreground-process-identity.mjs';
+import {readRemoteMarkerSnapshot,deletePinnedRemoteMarker} from './foreground-marker-cas-win32.mjs';
 import {acquireForegroundSessionLock} from './foreground-session-lock.mjs';
 import { AUTHORITY_PLANES, authorityVector, authorityRestorePlan, parseAuthorityObservation, assertAuthorityVector, assertRuntimeReadyObservation, authorityBanner } from './remote-authority.mjs';
 import { decodeRemoteLogBytes, boundedRemoteDiagnostic, safeRemoteLogPrefixLength } from './remote-log-decode-r60.mjs';
@@ -456,8 +457,9 @@ async function recoverRemoteSession(ctx,{displayMode='unicode'}={}){
   const ownerPid=remoteOwnerPid(prior);
   if(pidAlive(ownerPid)){
     if(!prior.owner_identity)throw new Error(`remote session ownership unverified for legacy pid=${ownerPid}; marker retained`);
-    if(prior.owner_identity.pid!==ownerPid)throw new Error('remote session owner identity PID binding mismatch');
-    if(foregroundIdentityMatches(prior.owner_identity,queryForegroundIdentity(ownerPid)))throw new Error(`remote session already active pid=${ownerPid}`);
+    if(prior.owner_identity.pid!==ownerPid)throw new Error('remote session owner identity PID binding mismatch; marker retained');
+    if(!foregroundIdentityMatches(prior.owner_identity,queryForegroundIdentity(ownerPid)))throw new Error('remote session owner identity mismatch; marker retained');
+    throw new Error(`remote session already active pid=${ownerPid}`);
   }
   let guardianAlive=prior.schema==='deadbyte.remote-session.v2'&&pidAlive(prior.guardian_pid);
   if(guardianAlive){
@@ -475,9 +477,7 @@ async function recoverRemoteSession(ctx,{displayMode='unicode'}={}){
     }
     throw new Error(`remote session guardian cleanup still active pid=${prior.guardian_pid}`);
   }
-  writeRemote(process.stdout,`${remoteTag('recovery',displayMode)} Stale remote session pid=${ownerPid}; revoking authority before restart.\n`,displayMode);
-  await cleanupRemoteSession(ctx,{displayMode});
-  await rm(remoteSessionMarker(ctx.root),{force:true});
+  throw new Error(`remote session ownership unverified for stale pid=${ownerPid}; marker retained`);
 }
 async function claimRemoteSession(ctx){
   const dir=path.join(ctx.root,'runtime');await mkdir(dir,{recursive:true});
@@ -505,14 +505,28 @@ async function claimRemoteSession(ctx){
     return marker;
   }catch(error){
     try{guardian?.kill();}catch{}
-    await rm(markerPath,{force:true});
+    try{
+      const snapshot=await readRemoteMarkerSnapshot(markerPath);
+      if(!snapshot||snapshot.marker?.owner_pid!==marker.owner_pid||snapshot.marker?.session_nonce!==marker.session_nonce)
+        throw new Error('claim marker ownership changed or missing');
+      if(deletePinnedRemoteMarker(markerPath,snapshot.sha256)!=='REMOVED')
+        throw new Error('claim marker changed before native deletion');
+    }catch(cleanupError){
+      throw new AggregateError([error,cleanupError],
+        'remote session claim failed; marker cleanup unverified and marker retained');
+    }
     throw error;
   }
 }
 async function releaseRemoteSession(ctx,marker,{displayMode='unicode'}={}){
-  let current=null;try{current=await readRemoteSessionMarker(ctx.root);}catch(error){writeRemote(process.stderr,`${remoteTag('warn',displayMode)} remote session marker cleanup: ${String(error?.message||error)}\n`,displayMode);return;}
+  let snapshot;
+  try{snapshot=await readRemoteMarkerSnapshot(remoteSessionMarker(ctx.root));}
+  catch(error){writeRemote(process.stderr,`${remoteTag('warn',displayMode)} remote session marker cleanup: ${String(error?.message||error)}\n`,displayMode);throw new Error(`remote session ownership marker retained: ${String(error?.message||error)}`);}
+  const current=snapshot?.marker;
   const same=current?.schema==='deadbyte.remote-session.v2'&&current.owner_pid===marker.owner_pid&&current.session_nonce===marker.session_nonce;
-  if(same) await rm(remoteSessionMarker(ctx.root),{force:true});
+  if(!same)throw new Error('remote session ownership marker changed or missing; marker retained');
+  if(deletePinnedRemoteMarker(remoteSessionMarker(ctx.root),snapshot.sha256)!=='REMOVED')
+    throw new Error('remote session ownership marker replaced before native deletion; marker retained');
 }
 async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,filterExpression='',mode='default'}={}){
   const display=prepareRemoteConsole();
@@ -531,10 +545,21 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
   }finally{await startupLock.release();}
   try{
     await synchronizeForegroundRuntime(ctx,{displayMode});
-  }catch(error){
-    await cleanupRemoteSession(ctx,{displayMode});
-    await releaseRemoteSession(ctx,marker,{displayMode});
-    throw error;
+  }catch(primaryError){
+    let cleanupError=null;
+    try{await cleanupRemoteSession(ctx,{displayMode});}
+    catch(error){cleanupError=error;}
+    if(!cleanupError){
+      try{await releaseRemoteSession(ctx,marker,{displayMode});}
+      catch(error){cleanupError=error;}
+    }
+    if(cleanupError){
+      const primaryDetail=String(primaryError?.message||primaryError);
+      const cleanupDetail=String(cleanupError?.message||cleanupError);
+      throw new AggregateError([primaryError,cleanupError],
+        `remote activation failed: ${primaryDetail}; cleanup failed, ownership marker retained: ${cleanupDetail}`);
+    }
+    throw primaryError;
   }
   const resultJournal=await openRemoteResultJournal({
     filePath:remoteResultJournalPath(ctx.root,marker.result_session_id),sessionId:marker.result_session_id,maxEntries:2048
@@ -550,6 +575,7 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
   if(watchStdin){process.stdin.once('end',abort);process.stdin.once('close',abort);process.stdin.resume();}
   let ready=false;
   let logTask=null;
+  let sessionError=null;
   try{
     process.stdout.write('DEADBYTE MCP\n');
     process.stdout.write(`${formatRemoteLifecycle('device_start',{displayMode})}\n`);
@@ -609,8 +635,9 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     process.stdout.write('[OK] ONLINE\n');
     process.stdout.write(`${formatRemoteLifecycle('ready',{displayMode})}\n`);
     if(url) writeRemote(process.stdout,`URL: ${url}\n`,displayMode);
-    await logTask;
-  }finally{
+    await logTask;
+  }catch(error){sessionError=error;throw error;}
+  finally{
     const wasAborted=aborter.signal.aborted;
     aborter.abort();
     if(logTask) await logTask.catch(()=>{});
@@ -623,8 +650,18 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     if(watchStdin){process.stdin.removeListener('end',abort);process.stdin.removeListener('close',abort);process.stdin.pause();}
     process.stdout.write(`${formatRemoteLifecycle('cleanup',{displayMode})}\n`);
     if(ready||!wasAborted) process.stdout.write('[INFO] Disconnecting; revoking authority...\n');
-    await cleanupRemoteSession(ctx,{displayMode});
-    await releaseRemoteSession(ctx,marker,{displayMode});
+    try{await cleanupRemoteSession(ctx,{displayMode});}
+    catch(cleanupError){
+      if(sessionError) throw new AggregateError([sessionError,cleanupError],
+        `remote activation failed: ${String(sessionError?.message||sessionError)}; cleanup failed, ownership marker retained: ${String(cleanupError?.message||cleanupError)}`);
+      throw cleanupError;
+    }
+    try{await releaseRemoteSession(ctx,marker,{displayMode});}
+    catch(markerError){
+      if(sessionError)throw new AggregateError([sessionError,markerError],
+        `remote activation failed: ${String(sessionError?.message||sessionError)}; marker cleanup failed: ${String(markerError?.message||markerError)}`);
+      throw markerError;
+    }
   }
 }
 async function runRemote(args){