deadbyte-mcp 0.15.47 → 0.15.48

package/test/r79-windows-fsync-regression.test.mjs

@@ -0,0 +1,45 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, generateKeyPairSync } from 'node:crypto';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createAuthorityEpochStore } from '../src/authority-continuity-r65.mjs';
+
+const hash = bytes => createHash('sha256').update(bytes).digest('hex');
+
+test('R79 Windows explicit recovery syncs signed orphan through writable pinned handle without altering event bytes', async () => {
+  const home = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r79-fsync-portability-'));
+  try {
+    const runtime = path.join(home, 'runtime');
+    const trust = path.join(home, 'trust');
+    await mkdir(runtime);
+    await mkdir(trust);
+    const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+    await writeFile(path.join(trust, 'ed25519-public.pem'), publicKey.export({ type: 'spki', format: 'pem' }), { flag: 'wx' });
+    await writeFile(path.join(trust, 'ed25519-private.pem'), privateKey.export({ type: 'pkcs8', format: 'pem' }), { flag: 'wx' });
+    const store = createAuthorityEpochStore({ runtimeDir: runtime });
+    const nonce = 'a'.repeat(64);
+    const grantBytes = Buffer.from(JSON.stringify({ instance_nonce: nonce }));
+    const previous = await store.append({ plane: 'coding', action: 'grant', grantBytes, grantInstanceNonce: nonce });
+    const headPath = path.join(runtime, 'authority-epochs', 'coding', 'head.json');
+    const priorHeadBytes = await readFile(headPath);
+    const orphan = await store.append({ plane: 'coding', action: 'transaction_revoke', grantBytes,
+      grantInstanceNonce: nonce, updateId: 'r79-fsync-regression', expectedHeadSha256: previous.event_sha256 });
+    const orphanPath = path.join(runtime, 'authority-epochs', 'coding', 'events', orphan.event_file);
+    const originalEventBytes = await readFile(orphanPath);
+    await writeFile(headPath, priorHeadBytes);
+    await assert.rejects(store.readHead({ plane: 'coding' }), /replay or incomplete write/);
+    const result = await store.reconcileOrphanedRevocation({ plane: 'coding',
+      expectedHeadSha256: previous.event_sha256, expectedOrphanSha256: orphan.event_sha256,
+      operatorConfirmed: true });
+    assert.equal(result.status, 'REVOKED_ONLY_RECONCILED');
+    assert.equal(result.standing_grant_authorized, false);
+    assert.deepEqual(await readFile(orphanPath), originalEventBytes, 'fsync must not change signed event bytes');
+    assert.equal(hash(originalEventBytes), orphan.event_sha256);
+    assert.equal((await store.readHead({ plane: 'coding' })).event_sha256, orphan.event_sha256);
+    assert.equal((await store.verifyGrant({ plane: 'coding', grantBytes, grantInstanceNonce: nonce })).trusted, false);
+  } finally {
+    await rm(home, { recursive: true, force: true });
+  }
+});

package/test/r80-durable-epoch-commit.test.mjs

@@ -0,0 +1,76 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,randomBytes} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,rm,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createAuthorityEpochStore,authorityEpochDurabilityAssessment} from '../src/authority-continuity-r65.mjs';
+
+const nonce=()=>randomBytes(32).toString('hex');
+const data=(n)=>Buffer.from(JSON.stringify({instance_nonce:n,fixture:'R80 isolated'}));
+async function isolated(fn){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r80-epoch-'));
+  try{
+    const runtimeDir=path.join(root,'runtime');
+    const trust=path.join(root,'trust');
+    await mkdir(runtimeDir);await mkdir(trust);
+    const keys=generateKeyPairSync('ed25519');
+    await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+    await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+    return await fn({runtimeDir,root});
+  }finally{await rm(root,{recursive:true,force:true});}
+}
+
+test('R80 durability capability explicitly distinguishes file flush from power-loss proof',()=>{
+  const d=authorityEpochDurabilityAssessment();
+  assert.equal(d.event_file,'FLUSH_REQUIRED');
+  assert.equal(d.head_temp_file,'FLUSH_REQUIRED');
+  assert.equal(d.directory_metadata,process.platform==='win32'?'UNVERIFIED_ON_WINDOWS':'FSYNC_REQUIRED');
+  assert.equal(d.power_loss,'NOT_VERIFIED_BY_TESTS');
+});
+
+test('R80 signed grant event is flushed before head temp; head temp before rename',()=>isolated(async({runtimeDir})=>{
+  const seen=[];
+  const store=createAuthorityEpochStore({runtimeDir,onDurabilityStage:phase=>seen.push(phase)});
+  const n=nonce(),bytes=data(n);
+  const head=await store.append({plane:'process',action:'grant',grantBytes:bytes,grantInstanceNonce:n});
+  assert.deepEqual(seen,['event_created','event_written','event_file_synced','event_directory_barrier',
+    'head_temp_created','head_temp_written','head_temp_file_synced','head_renamed','head_directory_barrier']);
+  assert.equal((await store.verifyGrant({plane:'process',grantBytes:bytes,grantInstanceNonce:n})).trusted,true);
+  const event=path.join(runtimeDir,'authority-epochs','process','events',head.event_file);
+  assert.ok((await readFile(event)).length>64);
+}));
+
+const phases=['event_created','event_written','event_file_synced','event_directory_barrier',
+  'head_temp_created','head_temp_written','head_temp_file_synced','head_renamed','head_directory_barrier'];
+for(const phase of phases){
+  test(`R80 simulated interruption at ${phase} preserves fail-closed or explicit post-rename commit state`,()=>isolated(async({runtimeDir})=>{
+    const n=nonce(),bytes=data(n);
+    const store=createAuthorityEpochStore({runtimeDir,onDurabilityStage:at=>{
+      if(at===phase)throw new Error(`R80_SIMULATED_INTERRUPTION:${at}`);
+    }});
+    await assert.rejects(store.append({plane:'process',action:'grant',grantBytes:bytes,grantInstanceNonce:n}),/R80_SIMULATED_INTERRUPTION/);
+    const verifyStore=createAuthorityEpochStore({runtimeDir});
+    const result=await verifyStore.verifyGrant({plane:'process',grantBytes:bytes,grantInstanceNonce:n});
+    if(phase==='head_renamed'||phase==='head_directory_barrier'){
+      // Rename has already committed the logically visible signed head.
+      // An interrupted caller has an AMBIGUOUS outcome, not guaranteed rollback.
+      assert.equal(result.trusted,true);
+    }else{
+      assert.equal(result.trusted,false);
+    }
+  }));
+}
+
+test('R80 an interrupted user revoke never re-authorizes the old signed grant',()=>isolated(async({runtimeDir})=>{
+  const n=nonce(),bytes=data(n);
+  const normal=createAuthorityEpochStore({runtimeDir});
+  await normal.append({plane:'process',action:'grant',grantBytes:bytes,grantInstanceNonce:n});
+  const faultStore=createAuthorityEpochStore({runtimeDir,onDurabilityStage:at=>{
+    if(at==='event_written')throw new Error('SIMULATED_REVOKE_CRASH');
+  }});
+  await assert.rejects(faultStore.append({plane:'process',action:'user_revoke',grantBytes:bytes,grantInstanceNonce:n}),/SIMULATED_REVOKE_CRASH/);
+  const verified=await normal.verifyGrant({plane:'process',grantBytes:bytes,grantInstanceNonce:n});
+  assert.equal(verified.trusted,false);
+  assert.match(verified.reason,/replay|incomplete/);
+}));

package/test/r82-epoch-lock-owned-cas.test.mjs

@@ -0,0 +1,93 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash,generateKeyPairSync,randomBytes} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,readFile,rename,rm,access} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+
+const hash=bytes=>createHash('sha256').update(bytes).digest('hex');
+const nonce=()=>randomBytes(32).toString('hex');
+const lockValue=(pid,token)=>JSON.stringify({schema:'deadbyte.authority-epoch-lock.r65.v1',pid,token,created_at_utc:'2026-10-16T00:00:00.000Z',
+  ...(pid===2147483647?{owner_identity:{schema:'deadbyte.foreground-process.v1',pid,parent_pid:0,
+    creation_utc:'2026-01-01T00:00:00Z',executable_path:process.execPath,command_line_sha256:'0'.repeat(64)}}:{})});
+async function isolated(fn){
+  const root=await mkdtemp(path.join(os.tmpdir(),'r82-lock-cas-'));
+  try{
+    const runtimeDir=path.join(root,'runtime'),trust=path.join(root,'trust');
+    await mkdir(runtimeDir);await mkdir(trust);
+    const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+    await writeFile(path.join(trust,'ed25519-private.pem'),privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+    await writeFile(path.join(trust,'ed25519-public.pem'),publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+    const epochDir=path.join(runtimeDir,'authority-epochs','process');
+    const lockPath=path.join(epochDir,'.lock');
+    return await fn({runtimeDir,epochDir,lockPath,root});
+  }finally{await rm(root,{recursive:true,force:true,maxRetries:6,retryDelay:160});}
+}
+async function appendGrant(store){
+  const n=nonce(),bytes=Buffer.from(JSON.stringify({instance_nonce:n,fixture:'R82 isolated'}));
+  return store.append({plane:'process',action:'grant',grantBytes:bytes,grantInstanceNonce:n});
+}
+const exists=file=>access(file).then(()=>true,()=>false);
+
+// This intentionally tests in the actual R82 runtime; no source-copy shim bypasses the CAS.
+test('R82 Windows: stale lock replacement before native disposition is retained', {skip:process.platform!=='win32'},()=>isolated(async({runtimeDir,epochDir,lockPath})=>{
+  await mkdir(epochDir,{recursive:true});
+  await writeFile(lockPath,lockValue(2147483647,randomBytes(16).toString('hex')));
+  const successor=randomBytes(16).toString('hex');
+  let interleaved=0;
+  const store=createAuthorityEpochStore({runtimeDir,onLockDispositionStage:async(stage,target)=>{
+    if(stage!=='stale_before_cas')return;
+    assert.equal(target,lockPath);interleaved++;
+    const replacement=lockPath+'.replacement';
+    await writeFile(replacement,lockValue(process.pid,successor));
+    await rename(replacement,lockPath);
+  }});
+  await assert.rejects(()=>appendGrant(store),/authority epoch mutation locked.*stale owner changed/);
+  assert.equal(interleaved,1);
+  assert.equal(JSON.parse(await readFile(lockPath,'utf8')).token,successor);
+  assert.equal(await exists(path.join(epochDir,'head.json')),false);
+}));
+
+test('R85 Windows: held lock refuses replacement before owned release', {skip:process.platform!=='win32'},()=>isolated(async({runtimeDir,lockPath})=>{
+  let interleaved=0;
+  const store=createAuthorityEpochStore({runtimeDir,onLockDispositionStage:async(stage,target)=>{
+    if(stage!=='release_before_cas')return;
+    assert.equal(target,lockPath);interleaved++;
+    const replacement=lockPath+'.replacement';
+    await assert.rejects(()=>rename(lockPath,replacement),error=>['EACCES','EPERM','EBUSY'].includes(error?.code));
+  }});
+  assert.equal((await appendGrant(store)).action,'grant');
+  assert.equal(interleaved,1);
+  assert.equal(await exists(lockPath),false);
+  const head=await store.readHead({plane:'process'});
+  assert.equal(head.action,'grant');
+}));
+
+test('R82 Windows: absent recovery race disposes only stale token then writes and releases new lock', {skip:process.platform!=='win32'},()=>isolated(async({runtimeDir,epochDir,lockPath})=>{
+  await mkdir(epochDir,{recursive:true});
+  await writeFile(lockPath,lockValue(2147483647,randomBytes(16).toString('hex')));
+  const store=createAuthorityEpochStore({runtimeDir});
+  assert.equal((await appendGrant(store)).action,'grant');
+  assert.equal(await exists(lockPath),false);
+}));
+
+test('R82 unchanged live PID stays locked on all platforms',()=>isolated(async({runtimeDir,epochDir,lockPath})=>{
+  await mkdir(epochDir,{recursive:true});
+  const successor=randomBytes(16).toString('hex');
+  await writeFile(lockPath,lockValue(process.pid,successor));
+  await assert.rejects(()=>appendGrant(createAuthorityEpochStore({runtimeDir})),/authority epoch mutation locked/);
+  assert.equal(JSON.parse(await readFile(lockPath,'utf8')).token,successor);
+}));
+
+test('R82 normal epoch append releases lock and preserves signed head',()=>isolated(async({runtimeDir,lockPath})=>{
+  const store=createAuthorityEpochStore({runtimeDir});
+  const head=await appendGrant(store);
+  assert.equal(head.action,'grant');
+  assert.equal((await store.readHead({plane:'process'})).event_sha256,head.event_sha256);
+  assert.equal(await exists(lockPath),false);
+}));
+
+test('R82 source does not silently enable a production lock interleave hook',()=>{
+  assert.throws(()=>createAuthorityEpochStore({runtimeDir:os.tmpdir(),onLockDispositionStage:'not-function'}),/lock observer/);
+});

package/test/r83-epoch-lock-fileid-cas.test.mjs

@@ -0,0 +1,92 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,randomBytes} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,readFile,rename,rm,access} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {readPinnedEpochLockSnapshot,deletePinnedRemoteMarker} from '../src/foreground-marker-cas-win32.mjs';
+
+const nonce=()=>randomBytes(32).toString('hex');
+const lockValue=(pid,token)=>JSON.stringify({schema:'deadbyte.authority-epoch-lock.r65.v1',pid,token,created_at_utc:'2026-10-16T00:00:00.000Z',
+  ...(pid===2147483647?{owner_identity:{schema:'deadbyte.foreground-process.v1',pid,parent_pid:0,
+    creation_utc:'2026-01-01T00:00:00Z',executable_path:process.execPath,command_line_sha256:'0'.repeat(64)}}:{})});
+const exists=file=>access(file).then(()=>true,()=>false);
+async function fixture(fn){
+ const base=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r83-cas-'));
+ try{
+   const runtimeDir=path.join(base,'runtime'),trust=path.join(base,'trust');
+   await mkdir(runtimeDir);await mkdir(trust);
+   const keys=generateKeyPairSync('ed25519');
+   await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+   await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+   const epochDir=path.join(runtimeDir,'authority-epochs','process'),lockPath=path.join(epochDir,'.lock');
+   return await fn({runtimeDir,epochDir,lockPath});
+ }finally{await rm(base,{recursive:true,force:true,maxRetries:8,retryDelay:150});}
+}
+async function grant(store){
+ const n=nonce();return store.append({plane:'process',action:'grant',grantBytes:Buffer.from(JSON.stringify({instance_nonce:n,r83:true})),grantInstanceNonce:n});
+}
+async function replaceSameBytes(lockPath){
+ const original=await readFile(lockPath);
+ const replacement=lockPath+'.r83-'+randomBytes(6).toString('hex');
+ await writeFile(replacement,original,{flag:'wx'});
+ await rename(replacement,lockPath);
+ assert.deepEqual(await readFile(lockPath),original,'replacement must have byte-identical content');
+}
+
+test('R83 Windows: native snapshot binds bytes and FileIdInfo on one handle',{skip:process.platform!=='win32'},()=>fixture(async({epochDir,lockPath})=>{
+ await mkdir(epochDir,{recursive:true});
+ const bytes=Buffer.from(lockValue(process.pid,nonce()));
+ await writeFile(lockPath,bytes,{flag:'wx'});
+ const snap=readPinnedEpochLockSnapshot(lockPath);
+ assert.deepEqual(snap.bytes,bytes);
+ assert.match(snap.fileId,/^[a-f0-9]{16}:[a-f0-9]{32}$/);
+ assert.equal(deletePinnedRemoteMarker(lockPath,snap.sha256,{expectedFileId:snap.fileId}),'REMOVED');
+ assert.equal(await exists(lockPath),false);
+}));
+
+test('R83 Windows: same-byte successor survives stale lock recovery',{skip:process.platform!=='win32'},()=>fixture(async({runtimeDir,epochDir,lockPath})=>{
+ await mkdir(epochDir,{recursive:true});
+ await writeFile(lockPath,lockValue(2147483647,nonce()),{flag:'wx'});
+ let swapped=0;
+ const store=createAuthorityEpochStore({runtimeDir,onLockDispositionStage:async(stage,target)=>{
+  if(stage==='stale_before_cas'){assert.equal(target,lockPath);swapped++;await replaceSameBytes(lockPath);}
+ }});
+ await assert.rejects(()=>grant(store),/authority epoch mutation locked.*stale owner changed: CHANGED/);
+ assert.equal(swapped,1);
+ assert.equal(await exists(lockPath),true,'successor lock must survive');
+ assert.equal(await exists(path.join(epochDir,'head.json')),false);
+}));
+
+test('R85 Windows: held owner lock reaches release after signed commit',{skip:process.platform!=='win32'},()=>fixture(async({runtimeDir,lockPath})=>{
+ let swapped=0;
+ const store=createAuthorityEpochStore({runtimeDir,onLockDispositionStage:async(stage,target)=>{
+  if(stage==='release_before_cas'){
+   assert.equal(target,lockPath);swapped++;
+  }
+ }});
+ assert.equal((await grant(store)).action,'grant');
+ assert.equal(swapped,1);
+ assert.equal(await exists(lockPath),false,'owned lock must be released');
+ assert.equal((await store.readHead({plane:'process'})).action,'grant');
+}));
+
+test('R83 Windows: old File ID cannot delete a same-byte successor directly',{skip:process.platform!=='win32'},()=>fixture(async({epochDir,lockPath})=>{
+ await mkdir(epochDir,{recursive:true});
+ await writeFile(lockPath,lockValue(process.pid,nonce()),{flag:'wx'});
+ const before=readPinnedEpochLockSnapshot(lockPath);
+ await replaceSameBytes(lockPath);
+ const after=readPinnedEpochLockSnapshot(lockPath);
+ assert.deepEqual(before.bytes,after.bytes);
+ assert.equal(before.sha256,after.sha256);
+ assert.notEqual(before.fileId,after.fileId,'native File ID must change on a new file');
+ assert.equal(deletePinnedRemoteMarker(lockPath,before.sha256,{expectedFileId:before.fileId}),'CHANGED');
+ assert.equal(await exists(lockPath),true);
+ assert.equal(deletePinnedRemoteMarker(lockPath,after.sha256,{expectedFileId:after.fileId}),'REMOVED');
+}));
+
+// Only verifies no test interleave hook is accepted from a production runtime.
+test('R83 production prohibits string lock interleave observer',()=>{
+ assert.throws(()=>createAuthorityEpochStore({runtimeDir:os.tmpdir(),onLockDispositionStage:'bad'}),/lock observer/);
+});

package/test/r84-epoch-lock-created-fileid.test.mjs

@@ -0,0 +1,112 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,randomBytes} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,readFile,rename,rm,access} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+
+test('R85 Windows: held lock cannot be replaced before event publication',
+  {skip:process.platform!=='win32'},async()=>{
+    const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r84-create-id-'));
+    try{
+      const runtimeDir=path.join(root,'runtime'),trust=path.join(root,'trust');
+      await mkdir(runtimeDir);await mkdir(trust);
+      const keys=generateKeyPairSync('ed25519');
+      await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+      await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+      const lockPath=path.join(runtimeDir,'authority-epochs','process','.lock');
+      let replacements=0;
+      const store=createAuthorityEpochStore({runtimeDir,onDurabilityStage:async stage=>{
+        if(stage!=='event_created')return;
+        const replacement=lockPath+'.replacement';
+        await assert.rejects(()=>rename(lockPath,replacement),error=>['EACCES','EPERM','EBUSY'].includes(error?.code));
+        replacements++;
+      }});
+      const nonce=randomBytes(32).toString('hex');
+      assert.equal((await store.append({plane:'process',action:'grant',
+        grantBytes:Buffer.from(JSON.stringify({instance_nonce:nonce})),grantInstanceNonce:nonce})).action,'grant');
+      assert.equal(replacements,1);
+      assert.equal(await access(lockPath).then(()=>true,()=>false),false,'owned lock must be released');
+      assert.equal(await access(path.join(runtimeDir,'authority-epochs','process','head.json')).then(()=>true,()=>false),
+        true,'exclusive held lock permits an uncontested authority head');
+    }finally{await rm(root,{recursive:true,force:true,maxRetries:8,retryDelay:150});}
+  });
+
+test('R85 Windows: held lock cannot be replaced during head publication',
+  {skip:process.platform!=='win32'},async()=>{
+    const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r84-postcheck-'));
+    try{
+      const runtimeDir=path.join(root,'runtime'),trust=path.join(root,'trust');
+      await mkdir(runtimeDir);await mkdir(trust);
+      const keys=generateKeyPairSync('ed25519');
+      await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+      await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+      const epochDir=path.join(runtimeDir,'authority-epochs','process');
+      const lockPath=path.join(epochDir,'.lock');
+      let replacements=0;
+      const store=createAuthorityEpochStore({runtimeDir,onDurabilityStage:async stage=>{
+        if(stage!=='head_temp_created')return;
+        const replacement=lockPath+'.replacement';
+        await assert.rejects(()=>rename(lockPath,replacement),error=>['EACCES','EPERM','EBUSY'].includes(error?.code));
+        replacements++;
+      }});
+      const nonce=randomBytes(32).toString('hex');
+      assert.equal((await store.append({plane:'process',action:'grant',
+        grantBytes:Buffer.from(JSON.stringify({instance_nonce:nonce})),grantInstanceNonce:nonce})).action,'grant');
+      assert.equal(replacements,1);
+      assert.equal(await access(path.join(epochDir,'head.json')).then(()=>true,()=>false),true,
+        'authority head commits only while the original lock remains held');
+    }finally{await rm(root,{recursive:true,force:true,maxRetries:8,retryDelay:150});}
+  });
+
+test('R84 Windows: legacy stale lock without process birth identity is not auto-reclaimed',
+  {skip:process.platform!=='win32'},async()=>{
+    const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r84-owner-id-'));
+    try{
+      const runtimeDir=path.join(root,'runtime'),trust=path.join(root,'trust');
+      await mkdir(runtimeDir);await mkdir(trust);
+      const keys=generateKeyPairSync('ed25519');
+      await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+      await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+      const epochDir=path.join(runtimeDir,'authority-epochs','process');
+      await mkdir(epochDir,{recursive:true});
+      const lockPath=path.join(epochDir,'.lock');
+      const legacy=JSON.stringify({schema:'deadbyte.authority-epoch-lock.r65.v1',pid:2147483647,
+        token:randomBytes(16).toString('hex'),created_at_utc:'2026-10-16T00:00:00.000Z'});
+      await writeFile(lockPath,legacy,{flag:'wx'});
+      const nonce=randomBytes(32).toString('hex');
+      const store=createAuthorityEpochStore({runtimeDir});
+      await assert.rejects(()=>store.append({plane:'process',action:'grant',
+        grantBytes:Buffer.from(JSON.stringify({instance_nonce:nonce})),grantInstanceNonce:nonce}),
+        /authority epoch mutation locked.*owner identity unverified/);
+      assert.equal(await readFile(lockPath,'utf8'),legacy);
+      assert.equal(await access(path.join(epochDir,'head.json')).then(()=>true,()=>false),false);
+    }finally{await rm(root,{recursive:true,force:true,maxRetries:8,retryDelay:150});}
+  });
+
+test('R84 Windows: reused live PID with different birth identity cannot surrender its lock',
+  {skip:process.platform!=='win32'},async()=>{
+    const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r84-reused-pid-'));
+    try{
+      const runtimeDir=path.join(root,'runtime'),trust=path.join(root,'trust');
+      await mkdir(runtimeDir);await mkdir(trust);
+      const keys=generateKeyPairSync('ed25519');
+      await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+      await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+      const epochDir=path.join(runtimeDir,'authority-epochs','process');
+      await mkdir(epochDir,{recursive:true});
+      const lockPath=path.join(epochDir,'.lock');
+      const lock=JSON.stringify({schema:'deadbyte.authority-epoch-lock.r65.v1',pid:process.pid,
+        token:randomBytes(16).toString('hex'),created_at_utc:'2026-01-01T00:00:00Z',
+        owner_identity:{schema:'deadbyte.foreground-process.v1',pid:process.pid,parent_pid:0,
+          creation_utc:'2026-01-01T00:00:00Z',executable_path:process.execPath,command_line_sha256:'0'.repeat(64)}});
+      await writeFile(lockPath,lock,{flag:'wx'});
+      const nonce=randomBytes(32).toString('hex');
+      await assert.rejects(()=>createAuthorityEpochStore({runtimeDir}).append({plane:'process',action:'grant',
+        grantBytes:Buffer.from(JSON.stringify({instance_nonce:nonce})),grantInstanceNonce:nonce}),
+        /authority epoch mutation locked \(owner process birth changed\)/);
+      assert.equal(await readFile(lockPath,'utf8'),lock);
+      assert.equal(await access(path.join(epochDir,'head.json')).then(()=>true,()=>false),false);
+    }finally{await rm(root,{recursive:true,force:true,maxRetries:8,retryDelay:150});}
+  });

package/test/r85-epoch-lock-release-lifetime.test.mjs

@@ -0,0 +1,25 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp, mkdir, rename, rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {acquireHeldEpochLock} from '../src/epoch-lock-r85.mjs';
+
+test('R85 released native lock permits immediate reacquire and directory rename',
+  {skip: process.platform !== 'win32'}, async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r85-handle-lifetime-'));
+    try {
+      const epoch = path.join(root, 'authority-epochs', 'process');
+      await mkdir(epoch, {recursive: true});
+      const lease = await acquireHeldEpochLock(path.join(epoch, '.lock'), Buffer.from('{}'));
+      assert.ok(lease);
+      await lease.release();
+      const second = await acquireHeldEpochLock(path.join(epoch, '.lock'), Buffer.from('{}'));
+      assert.ok(second);
+      await second.release();
+      await rename(epoch, epoch + '-moved');
+      await assert.rejects(() => lease.release(), /already released/);
+    } finally {
+      await rm(root, {recursive: true, force: true, maxRetries: 8, retryDelay: 150});
+    }
+  });

package/test/r85-epoch-repeat-append.test.mjs

@@ -0,0 +1,30 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,readFile,readdir,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+
+test('R85 repeated append reacquires a released kernel lock', async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r79-fsync-portability-'));
+  try{
+    const runtimeDir=path.join(root,'runtime'),trust=path.join(root,'trust');
+    await mkdir(runtimeDir);await mkdir(trust);
+    const keys=generateKeyPairSync('ed25519');
+    await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+    await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+    const store=createAuthorityEpochStore({runtimeDir});
+    const nonce='a'.repeat(64),grantBytes=Buffer.from(JSON.stringify({instance_nonce:nonce}));
+    const first=await store.append({plane:'coding',action:'grant',grantBytes,grantInstanceNonce:nonce});
+    const epoch=path.join(runtimeDir,'authority-epochs','coding');
+    assert.ok((await readFile(path.join(epoch,'head.json'))).length>0);
+    try{
+      await store.append({plane:'coding',action:'transaction_revoke',grantBytes,grantInstanceNonce:nonce,
+        updateId:'r85-repeat',expectedHeadSha256:first.event_sha256});
+    }catch(error){
+      error.message+=` [epoch-files=${JSON.stringify(await readdir(epoch))}]`;
+      throw error;
+    }
+  }finally{await rm(root,{recursive:true,force:true,maxRetries:8,retryDelay:150});}
+});

package/test/r86-epoch-cleanup-and-loader.test.mjs

@@ -0,0 +1,126 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash,generateKeyPairSync,randomBytes} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,readFile,access,rm,copyFile} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {pathToFileURL} from 'node:url';
+import {fileURLToPath} from 'node:url';
+import {spawn} from 'node:child_process';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+
+const repo=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const exists=async file=>access(file).then(()=>true,()=>false);
+const hash=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+// This uses NODE_TEST_CONTEXT-only fault injection; it is NOT exposed by the production CLI.
+test('R86 Windows: observer rejection cannot strand the owned native lock after head publication',
+  {skip:process.platform!=='win32'},async()=>{
+    const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r86-hook-cleanup-'));
+    try{
+      const runtimeDir=path.join(root,'runtime'),trust=path.join(root,'trust');
+      await mkdir(runtimeDir);await mkdir(trust);
+      const keys=generateKeyPairSync('ed25519');
+      await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+      await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+      let injected=0;
+      const store=createAuthorityEpochStore({runtimeDir,onLockDispositionStage:async stage=>{
+        if(stage==='release_before_cas'&&injected++===0)throw new Error('R86_INJECTED_RELEASE_OBSERVER_FAILURE');
+      }});
+      const grantInstanceNonce=randomBytes(32).toString('hex');
+      const grantBytes=Buffer.from(JSON.stringify({instance_nonce:grantInstanceNonce}));
+      await assert.rejects(store.append({plane:'process',action:'grant',grantBytes,grantInstanceNonce}),
+        /R86_INJECTED_RELEASE_OBSERVER_FAILURE/);
+      const epoch=path.join(runtimeDir,'authority-epochs','process');
+      assert.equal(await exists(path.join(epoch,'.lock')),false,'injected observer error must not strand lock');
+      const head=await store.readHead({plane:'process'});
+      assert.equal(head?.action,'grant','post-rename commit may have succeeded before observer failure');
+      const next=await store.append({plane:'process',action:'user_revoke',grantBytes,grantInstanceNonce});
+      assert.equal(next.action,'user_revoke','subsequent independent mutation must reacquire owned lock');
+      assert.equal(await exists(path.join(epoch,'.lock')),false);
+      console.log('R86_OBSERVER_FAILURE_CLEANUP_GREEN_OBSERVED');
+    }finally{await rm(root,{recursive:true,force:true,maxRetries:8,retryDelay:150});}
+  });
+
+test('R86 static audit: native error cleanup cannot ignore failed disposition',async()=>{
+  const source=await readFile(path.join(repo,'native','deadbyte-epoch-lock-r85.cpp'),'utf8');
+  assert.match(source,/DWORD DisposeHeldLeaf\(Lease& lease\)/);
+  assert.match(source,/ThrowWin32WithCleanup/);
+  assert.doesNotMatch(source,/void DisposeHeldLeaf\(/);
+  assert.match(source,/cleanup != ERROR_SUCCESS/);
+  assert.match(source,/DWORD ClosePinnedAncestors\(Lease& lease\)/);
+  assert.match(source,/DWORD ancestorCloseError = ClosePinnedAncestors\(\*lease\)/);
+  assert.match(source,/if \(cleanup == ERROR_SUCCESS && \(error == ERROR_FILE_EXISTS/);
+  console.log('R86_STATIC_NATIVE_CLEANUP_ERROR_PROPAGATION_REVIEW_PASS');
+});
+
+test('R86 Windows: OS death releases native handle and restart reconciles exact committed head',
+  {skip:process.platform!=='win32',timeout:15000},async()=>{
+    const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r86-crash-restart-'));
+    try{
+      const runtimeDir=path.join(root,'runtime'),trust=path.join(root,'trust');
+      await mkdir(runtimeDir);await mkdir(trust);
+      const keys=generateKeyPairSync('ed25519');
+      await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+      await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+      const grantInstanceNonce=randomBytes(32).toString('hex');
+      const grantBytes=Buffer.from(JSON.stringify({instance_nonce:grantInstanceNonce}));
+      const moduleUrl=pathToFileURL(path.join(repo,'src','authority-continuity-r65.mjs')).href;
+      const script=`import {createAuthorityEpochStore} from ${JSON.stringify(moduleUrl)};
+        const store=createAuthorityEpochStore({runtimeDir:${JSON.stringify(runtimeDir)},
+          onDurabilityStage:stage=>{if(stage==='head_renamed')process.kill(process.pid,'SIGKILL');}});
+        await store.append({plane:'process',action:'grant',
+          grantBytes:Buffer.from(${JSON.stringify(grantBytes.toString('base64'))},'base64'),
+          grantInstanceNonce:${JSON.stringify(grantInstanceNonce)}});`;
+      const child=spawn(process.execPath,['--input-type=module','-e',script],
+        {env:{...process.env,NODE_TEST_CONTEXT:'child-v8'},windowsHide:true,stdio:'ignore'});
+      const outcome=await new Promise((resolve,reject)=>{
+        const timer=setTimeout(()=>{child.kill();reject(new Error('R86 crash child timeout'));},10000);
+        child.once('error',error=>{clearTimeout(timer);reject(error);});
+        child.once('exit',(code,signal)=>{clearTimeout(timer);resolve({code,signal});});
+      });
+      assert.notEqual(outcome.code,0,'child must die at post-rename crash boundary');
+      const store=createAuthorityEpochStore({runtimeDir});
+      const committed=await store.readHead({plane:'process'});
+      assert.equal(committed?.action,'grant','restart must verify exact signed post-rename head');
+      const revoked=await store.append({plane:'process',action:'user_revoke',grantBytes,grantInstanceNonce});
+      assert.equal(revoked.action,'user_revoke','OS-released handle must permit bounded stale recovery');
+      assert.equal((await store.verifyGrant({plane:'process',grantBytes,grantInstanceNonce})).trusted,false);
+      assert.equal(await exists(path.join(runtimeDir,'authority-epochs','process','.lock')),false);
+      console.log('R86_PROCESS_CRASH_RESTART_REVOKE_GREEN_OBSERVED');
+    }finally{await rm(root,{recursive:true,force:true,maxRetries:8,retryDelay:150});}
+  });
+
+// Retain the historical post-hash swap injection, but verify that the R89
+// protected-installation precondition now rejects this writable test copy
+// before the injected write can run. The old R86 test omitted its newer R89
+// import and was failing at module resolution rather than the trust boundary.
+test('R103 writable-tree addon is denied before post-hash injection',
+  {skip:process.platform!=='win32'||process.arch!=='x64'},async()=>{
+    const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r86-loader-red-'));
+    try{
+      for(const rel of ['src','docs','native','bin'])await mkdir(path.join(root,rel),{recursive:true});
+      for(const rel of ['docs/R85-EPOCH-LOCK-BINARY.json','native/deadbyte-epoch-lock-r85.cpp',
+        'bin/deadbyte-epoch-lock-r85.node','src/privileged-install-trust-r89.mjs',
+        'src/authority-continuity-r65.mjs','src/canonical-json.mjs','src/text-policy.mjs',
+        'src/foreground-marker-cas-win32.mjs','src/foreground-process-identity.mjs',
+        'src/windows-powershell-environment.mjs'])
+        await copyFile(path.join(repo,rel),path.join(root,rel));
+      const original=await readFile(path.join(repo,'src','epoch-lock-r85.mjs'),'utf8');
+      const anchor='addon??=require(binary);';
+      assert.equal(original.split(anchor).length,2,'unexpected loader structure');
+      const injection=`await (await import('node:fs/promises')).writeFile(binary,Buffer.from('R86_TEST_ONLY_INVALID_PE_NOT_EXECUTABLE'));\n  ${anchor}`;
+      await writeFile(path.join(root,'src','epoch-lock-r85.mjs'),original.replace(anchor,injection));
+      const meta=JSON.parse(await readFile(path.join(root,'docs','R85-EPOCH-LOCK-BINARY.json'),'utf8'));
+      assert.equal(hash(await readFile(path.join(root,meta.addon))),meta.addon_sha256);
+      assert.equal(hash(await readFile(path.join(root,meta.source))),meta.source_sha256);
+      const module=await import(pathToFileURL(path.join(root,'src','epoch-lock-r85.mjs')).href);
+      const lockFile=path.join(root,'.lock');
+      await assert.rejects(module.acquireHeldEpochLock(lockFile,Buffer.from('{}')),
+        error=>{assert.equal(error.code,'EPOCH_NATIVE_SLOT_UNTRUSTED');return true;});
+      assert.equal(hash(await readFile(path.join(root,meta.addon))),meta.addon_sha256,
+        'untrusted writable copy must be refused before post-hash injection');
+      assert.equal(await exists(lockFile),false);
+      console.log('R103_WRITABLE_LOADER_DENIED_BEFORE_POST_HASH_INJECTION');
+    }finally{await rm(root,{recursive:true,force:true,maxRetries:8,retryDelay:150});}
+  });