deadbyte-mcp 0.15.47 → 0.15.49

package/test/r111-supervisor-marker-cas.test.mjs

@@ -0,0 +1,116 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {randomBytes} from 'node:crypto';
+import childProcess from 'node:child_process';
+import {syncBuiltinESMExports} from 'node:module';
+import {promisify} from 'node:util';
+import {existsSync, readFileSync, renameSync, writeFileSync} from 'node:fs';
+import {mkdtemp, readFile, rm, writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+const moduleUrl=new URL('../src/autonomous-local-supervisor.mjs',import.meta.url);
+const freshModule=()=>import(`${moduleUrl.href}?race=${randomBytes(8).toString('hex')}`);
+
+async function withIdenticalReplacement(markerPath,run){
+  const original=childProcess.execFile;
+  let replaced=0;
+  const replace=()=>{
+    if(replaced===0){
+      const before=readFileSync(markerPath);
+      const successor=`${markerPath}.${randomBytes(6).toString('hex')}.successor`;
+      writeFileSync(successor,before,{flag:'wx'});
+      renameSync(successor,markerPath);
+      assert.deepEqual(readFileSync(markerPath),before,'replacement must be byte-identical');
+      replaced++;
+    }
+  };
+  const wrapped=function(...args){replace();return original.apply(this,args);};
+  wrapped[promisify.custom]=function(...args){replace();return original[promisify.custom].apply(original,args);};
+  childProcess.execFile=wrapped;
+  syncBuiltinESMExports();
+  try {
+    const module=await freshModule();
+    await run(module);
+    assert.equal(replaced,1,'replacement must occur after the initial marker observation');
+  } finally {
+    childProcess.execFile=original;
+    syncBuiltinESMExports();
+  }
+}
+
+test('owned supervisor release cannot remove a byte-identical successor marker', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r111-release-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    const baseline=await freshModule();
+    const claim=await baseline.claimSupervisor({markerPath});
+    const original=await readFile(markerPath);
+    await withIdenticalReplacement(markerPath,async({releaseSupervisor})=>{
+      await assert.rejects(releaseSupervisor({markerPath,instanceNonce:claim.instance_nonce}),/changed before release: CHANGED/i);
+    });
+    assert.equal(existsSync(markerPath),true,'successor must survive release');
+    assert.deepEqual(await readFile(markerPath),original);
+  } finally { await rm(root,{recursive:true,force:true}); }
+});
+
+test('stale supervisor takeover cannot overwrite a byte-identical successor marker', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r111-takeover-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    const baseline=await freshModule();
+    const claim=await baseline.claimSupervisor({markerPath});
+    const stale={...claim.marker,creation_time_utc:'2000-01-01T00:00:00.000Z'};
+    await writeFile(markerPath,`${JSON.stringify(stale)}\n`);
+    const original=await readFile(markerPath);
+    await withIdenticalReplacement(markerPath,async({takeoverSupervisor})=>{
+      await assert.rejects(takeoverSupervisor({markerPath}),/changed during takeover: CHANGED/i);
+    });
+    assert.equal(existsSync(markerPath),true,'successor must survive takeover');
+    assert.deepEqual(await readFile(markerPath),original);
+  } finally { await rm(root,{recursive:true,force:true}); }
+});
+
+test('unobservable process identity cannot authorize takeover or remove its marker', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r111-unobservable-'));
+  const markerPath=path.join(root,'owner.json');
+  const originalExec=childProcess.execFile;
+  try {
+    const baseline=await freshModule();
+    await baseline.claimSupervisor({markerPath});
+    const originalMarker=await readFile(markerPath);
+    const denied=function(...args){
+      const callback=args.at(-1);
+      if(typeof callback==='function') callback(new Error('process lookup denied'));
+      return null;
+    };
+    denied[promisify.custom]=()=>Promise.reject(new Error('process lookup denied'));
+    childProcess.execFile=denied;
+    syncBuiltinESMExports();
+    const module=await freshModule();
+    await assert.rejects(module.takeoverSupervisor({markerPath}),/unverified|unobservable|lookup|identity/i);
+    assert.deepEqual(await readFile(markerPath),originalMarker,'uncertain lookup must not delete a live owner marker');
+  } finally {
+    childProcess.execFile=originalExec;
+    syncBuiltinESMExports();
+    await rm(root,{recursive:true,force:true});
+  }
+});
+
+test('same live process with mismatched image evidence cannot be taken over', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r111-image-drift-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    const module=await freshModule();
+    const claim=await module.claimSupervisor({markerPath});
+    const mismatched={...claim.marker,image_sha256:'f'.repeat(64)};
+    await writeFile(markerPath,`${JSON.stringify(mismatched)}\n`);
+    const before=await readFile(markerPath);
+    const observation=await module.observeSupervisor({markerPath});
+    assert.equal(observation.reason,'identity_mismatch');
+    assert.equal(observation.observation.pid,process.pid);
+    assert.equal(observation.observation.creation_time_utc,claim.marker.creation_time_utc);
+    await assert.rejects(module.takeoverSupervisor({markerPath}),/unverified|live|identity/i);
+    assert.deepEqual(await readFile(markerPath),before,'live owner with image drift must retain marker');
+  } finally { await rm(root,{recursive:true,force:true}); }
+});

package/test/r112-supervisor-claim-cas.test.mjs

@@ -0,0 +1,63 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {access, mkdir, mkdtemp, readFile, rm, symlink, unlink, writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {claimSupervisor, observeSupervisor} from '../src/autonomous-local-supervisor.mjs';
+
+async function withJunctionFixture(nested,run){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r112-claim-'));
+  const outside=path.join(root,'outside');
+  const parent=nested?path.join(root,'state','runtime'):path.join(root,'state');
+  const link=path.join(parent,'redirect');
+  await mkdir(parent,{recursive:true});
+  await mkdir(outside);
+  try {
+    await symlink(outside,link,'junction');
+    return await run({markerPath:path.join(link,'owner.json'),outside});
+  } finally {
+    await unlink(link).catch(()=>{});
+    await rm(root,{recursive:true,force:true});
+  }
+}
+
+for(const nested of [false,true]){
+  test(`supervisor claim rejects ${nested?'nested ':' '}parent junction before creating marker`,{skip:process.platform!=='win32'},async()=>{
+    await withJunctionFixture(nested,async({markerPath,outside})=>{
+      await assert.rejects(claimSupervisor({markerPath}),/reparse|pinned|failed closed|ancestor/i);
+      await assert.rejects(access(path.join(outside,'owner.json')),{code:'ENOENT'});
+    });
+  });
+}
+
+test('supervisor claim does not create a missing directory through a parent junction',{skip:process.platform!=='win32'},async()=>{
+  await withJunctionFixture(false,async({markerPath,outside})=>{
+    const redirected=path.join(path.dirname(markerPath),'new-child','owner.json');
+    await assert.rejects(claimSupervisor({markerPath:redirected}),/reparse|pinned|failed closed|ancestor|missing/i);
+    await assert.rejects(access(path.join(outside,'new-child')),{code:'ENOENT'});
+  });
+});
+
+test('supervisor claim requires an existing trusted marker parent',{skip:process.platform!=='win32'},async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r112-missing-parent-'));
+  const parent=path.join(root,'new-runtime');
+  try {
+    await assert.rejects(claimSupervisor({markerPath:path.join(parent,'owner.json')}),/parent|pinned|failed closed|missing/i);
+    await assert.rejects(access(parent),{code:'ENOENT'});
+  } finally { await rm(root,{recursive:true,force:true}); }
+});
+
+test('live image mismatch is unverified, not a stale-owner assertion',{skip:process.platform!=='win32'},async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r112-status-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    const claim=await claimSupervisor({markerPath});
+    const modified={...claim.marker,image_sha256:'f'.repeat(64)};
+    await writeFile(markerPath,`${JSON.stringify(modified)}\n`);
+    const observed=await observeSupervisor({markerPath});
+    assert.equal(observed.reason,'identity_mismatch');
+    assert.equal(observed.observation.pid,process.pid);
+    assert.equal(observed.status,'unverified');
+    assert.deepEqual(JSON.parse(await readFile(markerPath,'utf8')),modified);
+  } finally { await rm(root,{recursive:true,force:true}); }
+});

package/test/r113-supervisor-cleanup-terminality.test.mjs

@@ -0,0 +1,100 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {randomBytes} from 'node:crypto';
+import childProcess from 'node:child_process';
+import {syncBuiltinESMExports} from 'node:module';
+import {promisify} from 'node:util';
+import {readFileSync, renameSync, writeFileSync} from 'node:fs';
+import {mkdtemp, readFile, rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+const moduleUrl=new URL('../src/autonomous-local-supervisor.mjs',import.meta.url);
+
+async function withReleaseReplacement(markerPath,run){
+  const original=childProcess.execFile;
+  let armed=false;
+  let replaced=0;
+  const replace=()=>{
+    if(!armed||replaced) return;
+    const before=readFileSync(markerPath);
+    const successor=`${markerPath}.${randomBytes(6).toString('hex')}.successor`;
+    writeFileSync(successor,before,{flag:'wx'});
+    renameSync(successor,markerPath);
+    assert.deepEqual(readFileSync(markerPath),before);
+    replaced++;
+  };
+  const wrapped=function(...args){replace();return original.apply(this,args);};
+  wrapped[promisify.custom]=function(...args){replace();return original[promisify.custom].apply(original,args);};
+  childProcess.execFile=wrapped;
+  syncBuiltinESMExports();
+  try {
+    const module=await import(`${moduleUrl.href}?cleanup=${randomBytes(8).toString('hex')}`);
+    await run({module,arm:()=>{armed=true;},replacementCount:()=>replaced});
+    assert.equal(replaced,1,'test must replace the marker at cleanup time');
+  } finally {
+    childProcess.execFile=original;
+    syncBuiltinESMExports();
+  }
+}
+
+test('startup failure retains both primary and cleanup failure and preserves successor marker', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r113-start-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    await withReleaseReplacement(markerPath,async({module,arm})=>{
+      const policy={get planner(){arm();throw new Error('PRIMARY_START_FAILURE');}};
+      const runtime={policy};
+      await assert.rejects(module.startLocalSupervisorHost({runtime,policy,markerPath}),error=>{
+        assert.ok(error instanceof AggregateError,'cleanup failure must not be discarded');
+        assert.match(String(error.errors[0]),/PRIMARY_START_FAILURE/);
+        assert.match(String(error.errors[1]),/changed before release: CHANGED/i);
+        return true;
+      });
+      assert.ok((await readFile(markerPath)).length>0,'uncertain successor marker must survive');
+    });
+  } finally { await rm(root,{recursive:true,force:true}); }
+});
+
+test('failed stop never reports stopped on retry or deletes a changed marker', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r113-stop-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    await withReleaseReplacement(markerPath,async({module,arm,replacementCount})=>{
+      const policy={evidence_dir:root,planner:{backend:'client_sampling'}};
+      const runtime={policy};
+      const host=await module.startLocalSupervisorHost({runtime,policy,markerPath,continuous:false});
+      arm();
+      await assert.rejects(host.stop(),/changed before release: CHANGED/i);
+      assert.equal(replacementCount(),1);
+      const survivor=await readFile(markerPath);
+      await assert.rejects(host.stop(),/changed before release: CHANGED|cleanup|uncertain/i);
+      assert.deepEqual(await readFile(markerPath),survivor,'retry must not remove the byte-identical successor');
+    });
+  } finally { await rm(root,{recursive:true,force:true}); }
+});
+
+test('ordinary startup rejection releases owned marker and retains the primary error', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r113-start-clean-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    const module=await import(`${moduleUrl.href}?clean=${randomBytes(8).toString('hex')}`);
+    const policy={evidence_dir:root,planner:{backend:'client_sampling'}};
+    await assert.rejects(module.startLocalSupervisorHost({runtime:{policy},policy,markerPath,idleDelayMs:0}),
+      /idleDelayMs out of range/);
+    assert.equal((await module.observeSupervisor({markerPath})).reason,'no_owner');
+  } finally { await rm(root,{recursive:true,force:true}); }
+});
+
+test('concurrent stop calls share one verified cleanup outcome', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r113-stop-concurrent-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    const module=await import(`${moduleUrl.href}?concurrent=${randomBytes(8).toString('hex')}`);
+    const policy={evidence_dir:root,planner:{backend:'client_sampling'}};
+    const host=await module.startLocalSupervisorHost({runtime:{policy},policy,markerPath,continuous:false});
+    const results=await Promise.all([host.stop(),host.stop()]);
+    assert.deepEqual(results,[{status:'stopped'},{status:'stopped'}]);
+    assert.equal((await module.observeSupervisor({markerPath})).reason,'no_owner');
+  } finally { await rm(root,{recursive:true,force:true}); }
+});

package/test/r114-supervisor-absence-proof.test.mjs

@@ -0,0 +1,45 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {randomBytes} from 'node:crypto';
+import childProcess from 'node:child_process';
+import {syncBuiltinESMExports} from 'node:module';
+import {promisify} from 'node:util';
+import {mkdtemp, readFile, rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+const moduleUrl=new URL('../src/autonomous-local-supervisor.mjs',import.meta.url);
+
+test('CIM false absence cannot authorize takeover of a live marker owner', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r114-cim-absence-'));
+  const markerPath=path.join(root,'owner.json');
+  const originalExec=childProcess.execFile;
+  try {
+    const baseline=await import(`${moduleUrl.href}?baseline=${randomBytes(8).toString('hex')}`);
+    await baseline.claimSupervisor({markerPath});
+    const before=await readFile(markerPath);
+    let deniedLookups=0, falseAbsences=0;
+    const mock=function(...args){return originalExec.apply(this,args);};
+    mock[promisify.custom]=function(...args){
+      const shellArgs=Array.isArray(args[1])?args[1]:[];
+      const script=String(shellArgs[shellArgs.indexOf('-Command')+1]??'');
+      if(script.includes('Get-Process -Id')) {deniedLookups++;return Promise.reject(new Error('process identity access denied'));}
+      if(script.includes('Get-CimInstance Win32_Process')) {falseAbsences++;return Promise.resolve({stdout:'ABSENT\n',stderr:''});}
+      return originalExec[promisify.custom].apply(originalExec,args);
+    };
+    childProcess.execFile=mock;
+    syncBuiltinESMExports();
+    const module=await import(`${moduleUrl.href}?attack=${randomBytes(8).toString('hex')}`);
+    const observed=await module.observeSupervisor({markerPath});
+    assert.equal(observed.status,'unverified','a native live handle must outweigh a false CIM null');
+    assert.equal(observed.reason,'process_unobservable');
+    await assert.rejects(module.takeoverSupervisor({markerPath}),/unverified|unobservable|ownership/i);
+    assert.deepEqual(await readFile(markerPath),before,'live owner marker must remain byte-identical');
+    assert.ok(deniedLookups>=2);
+    assert.ok(falseAbsences>=2);
+  } finally {
+    childProcess.execFile=originalExec;
+    syncBuiltinESMExports();
+    await rm(root,{recursive:true,force:true});
+  }
+});

package/test/r115-posix-continuity-entrypoint.test.mjs

@@ -0,0 +1,17 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp, rm, access} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createEpochNativeContinuityEngine} from '../src/activation-continuity-engine-r65.mjs';
+
+test('POSIX continuity engine refuses activation authority before any filesystem mutation',
+  {skip:process.platform==='win32'},async()=>{
+    const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r115-posix-continuity-'));
+    try{
+      assert.throws(()=>createEpochNativeContinuityEngine({
+        stateRoot:root,predecessorPolicyPaths:{},successorPolicyPaths:async()=>({}),updateId:'r115-posix'
+      }),/POSIX.*unsupported|Windows-only/i);
+      await assert.rejects(access(path.join(root,'runtime')),{code:'ENOENT'});
+    }finally{await rm(root,{recursive:true,force:true});}
+  });

package/test/r116-authority-crash-matrix.test.mjs

@@ -0,0 +1,83 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync, randomBytes, createHash} from 'node:crypto';
+import {mkdtemp, mkdir, writeFile, rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+
+const phases = ['event_created', 'event_written', 'event_file_synced',
+  'event_directory_barrier', 'head_temp_created', 'head_temp_written',
+  'head_temp_file_synced', 'head_renamed', 'head_directory_barrier'];
+const sha256 = value => createHash('sha256').update(value).digest('hex');
+const grant = nonce => Buffer.from(JSON.stringify({instance_nonce:nonce, fixture:'R116 isolated'}));
+
+async function fixture(run) {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r116-epoch-'));
+  try {
+    const runtimeDir = path.join(root, 'runtime');
+    const trust = path.join(root, 'trust');
+    await mkdir(runtimeDir); await mkdir(trust);
+    const keys = generateKeyPairSync('ed25519');
+    await writeFile(path.join(trust, 'ed25519-private.pem'), keys.privateKey.export({type:'pkcs8', format:'pem'}), {flag:'wx'});
+    await writeFile(path.join(trust, 'ed25519-public.pem'), keys.publicKey.export({type:'spki', format:'pem'}), {flag:'wx'});
+    await run(runtimeDir);
+  } finally {
+    await rm(root, {recursive:true, force:true});
+  }
+}
+
+for (const phase of phases) {
+  test(`R116 interrupted user revoke at ${phase} never verifies the old grant`, () => fixture(async runtimeDir => {
+    const oldNonce = randomBytes(32).toString('hex');
+    const oldGrant = grant(oldNonce);
+    const store = createAuthorityEpochStore({runtimeDir});
+    await store.append({plane:'process', action:'grant', grantBytes:oldGrant, grantInstanceNonce:oldNonce});
+    assert.equal((await store.verifyGrant({plane:'process', grantBytes:oldGrant, grantInstanceNonce:oldNonce})).trusted, true);
+    const interrupted = createAuthorityEpochStore({runtimeDir, onDurabilityStage:at => {
+      if (at === phase) throw new Error(`R116_INTERRUPTED:${at}`);
+    }});
+    await assert.rejects(interrupted.append({plane:'process', action:'user_revoke', grantBytes:oldGrant,
+      grantInstanceNonce:oldNonce}), /R116_INTERRUPTED/);
+    const fresh = createAuthorityEpochStore({runtimeDir});
+    assert.equal((await fresh.verifyGrant({plane:'process', grantBytes:oldGrant,
+      grantInstanceNonce:oldNonce})).trusted, false);
+    if (phase === 'head_renamed' || phase === 'head_directory_barrier') {
+      assert.equal((await fresh.readHead({plane:'process'})).action, 'user_revoke');
+    } else {
+      await assert.rejects(fresh.readHead({plane:'process'}), /replay or incomplete write/);
+    }
+  }));
+
+  test(`R116 interrupted transaction restore at ${phase} is observed, never inferred`, () => fixture(async runtimeDir => {
+    const oldNonce = randomBytes(32).toString('hex');
+    const newNonce = randomBytes(32).toString('hex');
+    const oldGrant = grant(oldNonce);
+    const newGrant = grant(newNonce);
+    const store = createAuthorityEpochStore({runtimeDir});
+    const original = await store.append({plane:'process', action:'grant', grantBytes:oldGrant,
+      grantInstanceNonce:oldNonce});
+    const revoked = await store.append({plane:'process', action:'transaction_revoke', grantBytes:oldGrant,
+      grantInstanceNonce:oldNonce, updateId:'r116-isolated', expectedHeadSha256:original.event_sha256});
+    assert.equal((await store.verifyGrant({plane:'process', grantBytes:oldGrant,
+      grantInstanceNonce:oldNonce})).trusted, false);
+    const interrupted = createAuthorityEpochStore({runtimeDir, onDurabilityStage:at => {
+      if (at === phase) throw new Error(`R116_INTERRUPTED:${at}`);
+    }});
+    const restoreBinding = {
+      prior_grant_sha256:sha256(oldGrant), prior_grant_instance_nonce:oldNonce,
+      predecessor_policy_envelope_sha256:'1'.repeat(64),
+      successor_policy_envelope_sha256:'2'.repeat(64),
+      candidate_manifest_sha256:'3'.repeat(64), continuity_subject_sha256:'4'.repeat(64)
+    };
+    await assert.rejects(interrupted.append({plane:'process', action:'transaction_restore', grantBytes:newGrant,
+      grantInstanceNonce:newNonce, updateId:'r116-isolated', expectedHeadSha256:revoked.event_sha256,
+      restoreBinding}), /R116_INTERRUPTED/);
+    const fresh = createAuthorityEpochStore({runtimeDir});
+    const observed = await fresh.verifyGrant({plane:'process', grantBytes:newGrant, grantInstanceNonce:newNonce});
+    const committed = phase === 'head_renamed' || phase === 'head_directory_barrier';
+    assert.equal(observed.trusted, committed);
+    if (committed) assert.equal((await fresh.readHead({plane:'process'})).action, 'transaction_restore');
+    else await assert.rejects(fresh.readHead({plane:'process'}), /replay or incomplete write/);
+  }));
+}

package/test/r117-concurrent-orphan-recovery.test.mjs

@@ -0,0 +1,54 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync, randomBytes} from 'node:crypto';
+import {mkdtemp, mkdir, readFile, writeFile, rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {pathToFileURL} from 'node:url';
+
+// A writable development checkout cannot load the privileged Windows addon.
+// The optional test-only override must point to a protected, byte-identical
+// source installation; callers verify that hash before using this mode.
+const epochModule = process.env.DEADBYTE_TEST_PROTECTED_EPOCH_MODULE
+  ? pathToFileURL(process.env.DEADBYTE_TEST_PROTECTED_EPOCH_MODULE).href
+  : new URL('../src/authority-continuity-r65.mjs', import.meta.url).href;
+const {createAuthorityEpochStore} = await import(epochModule);
+
+test('R117 two independent recoverers commit one orphaned revoke at most once', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r117-recovery-'));
+  try {
+    const runtimeDir = path.join(root, 'runtime');
+    const trust = path.join(root, 'trust');
+    await mkdir(runtimeDir); await mkdir(trust);
+    const keys = generateKeyPairSync('ed25519');
+    await writeFile(path.join(trust, 'ed25519-private.pem'), keys.privateKey.export({type:'pkcs8', format:'pem'}), {flag:'wx'});
+    await writeFile(path.join(trust, 'ed25519-public.pem'), keys.publicKey.export({type:'spki', format:'pem'}), {flag:'wx'});
+    const nonce = randomBytes(32).toString('hex');
+    const bytes = Buffer.from(JSON.stringify({instance_nonce:nonce, fixture:'R117 isolated'}));
+    const writer = createAuthorityEpochStore({runtimeDir});
+    const granted = await writer.append({plane:'process', action:'grant', grantBytes:bytes, grantInstanceNonce:nonce});
+    const headPath = path.join(runtimeDir, 'authority-epochs', 'process', 'head.json');
+    const predecessorBytes = await readFile(headPath);
+    const orphan = await writer.append({plane:'process', action:'user_revoke', grantBytes:bytes, grantInstanceNonce:nonce});
+    // Simulate interruption before the new head becomes visible. The signed
+    // revoke event remains, while the exact prior signed head is restored.
+    await writeFile(headPath, predecessorBytes);
+    const observed = createAuthorityEpochStore({runtimeDir});
+    assert.equal((await observed.verifyGrant({plane:'process', grantBytes:bytes, grantInstanceNonce:nonce})).trusted, false);
+    const recover = () => createAuthorityEpochStore({runtimeDir}).reconcileOrphanedRevocation({
+      plane:'process', expectedHeadSha256:granted.event_sha256,
+      expectedOrphanSha256:orphan.event_sha256, operatorConfirmed:true
+    });
+    const outcomes = await Promise.allSettled([recover(), recover()]);
+    assert.equal(outcomes.filter(item => item.status === 'fulfilled').length, 1,
+      'two independent attempts cannot both claim the same recovery');
+    assert.equal(outcomes.filter(item => item.status === 'rejected').length, 1);
+    assert.equal(outcomes.find(item => item.status === 'fulfilled').value.status, 'REVOKED_ONLY_RECONCILED');
+    const finalStore = createAuthorityEpochStore({runtimeDir});
+    assert.equal((await finalStore.readHead({plane:'process'})).event_sha256, orphan.event_sha256);
+    assert.equal((await finalStore.verifyGrant({plane:'process', grantBytes:bytes,
+      grantInstanceNonce:nonce})).trusted, false);
+  } finally {
+    await rm(root, {recursive:true, force:true});
+  }
+});

package/test/r118-cross-process-orphan-recovery.test.mjs

@@ -0,0 +1,99 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync, randomBytes} from 'node:crypto';
+import {spawn} from 'node:child_process';
+import {mkdtemp, mkdir, readFile, writeFile, rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {pathToFileURL} from 'node:url';
+
+const moduleUrl = process.env.DEADBYTE_TEST_PROTECTED_EPOCH_MODULE
+  ? pathToFileURL(process.env.DEADBYTE_TEST_PROTECTED_EPOCH_MODULE).href
+  : new URL('../src/authority-continuity-r65.mjs', import.meta.url).href;
+const {createAuthorityEpochStore} = await import(moduleUrl);
+
+function recoverer(runtimeDir, expectedHeadSha256, expectedOrphanSha256) {
+  // Each invocation is a separate OS process using the real native lock.
+  // IPC is only a starting barrier and result channel; it cannot bypass the
+  // authority store's signature, file identity, or ownership checks.
+  const code = `
+    import {createAuthorityEpochStore} from ${JSON.stringify(moduleUrl)};
+    process.once('message', async () => {
+      let result;
+      try {
+        const value = await createAuthorityEpochStore({runtimeDir:${JSON.stringify(runtimeDir)}})
+          .reconcileOrphanedRevocation({plane:'process',
+            expectedHeadSha256:${JSON.stringify(expectedHeadSha256)},
+            expectedOrphanSha256:${JSON.stringify(expectedOrphanSha256)},operatorConfirmed:true});
+        result = {kind:'RESULT',status:'FULFILLED',value:value.status};
+      } catch (error) {
+        result = {kind:'RESULT',status:'REJECTED',reason:String(error?.message??error)};
+      }
+      process.send(result, () => process.disconnect());
+    });
+    process.send({kind:'READY'});
+  `;
+  const child = spawn(process.execPath, ['--input-type=module', '-e', code], {
+    env:process.env, stdio:['ignore', 'ignore', 'pipe', 'ipc'], windowsHide:true
+  });
+  let stderr = '';
+  child.stderr.on('data', chunk => { stderr = (stderr + chunk.toString()).slice(-2048); });
+  let readyResolve, readyReject, resultResolve, resultReject;
+  const ready = new Promise((resolve, reject) => {readyResolve=resolve; readyReject=reject;});
+  const result = new Promise((resolve, reject) => {resultResolve=resolve; resultReject=reject;});
+  let readySeen = false, resultSeen = false;
+  child.on('message', message => {
+    if (message?.kind === 'READY') {readySeen=true; readyResolve();}
+    if (message?.kind === 'RESULT') {resultSeen=true; resultResolve(message);}
+  });
+  child.once('error', error => {readyReject(error); resultReject(error);});
+  child.once('exit', (code, signal) => {
+    const error = new Error(`R118 child exited before result code=${code} signal=${signal} stderr=${stderr}`);
+    if (!readySeen) readyReject(error);
+    if (!resultSeen) resultReject(error);
+  });
+  return {child, ready, result};
+}
+
+test('R118 two OS processes cannot both commit one signed orphaned user revoke',
+  {timeout:30000}, async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r118-cross-process-'));
+    const children = [];
+    try {
+      const runtimeDir = path.join(root, 'runtime');
+      const trust = path.join(root, 'trust');
+      await mkdir(runtimeDir); await mkdir(trust);
+      const keys = generateKeyPairSync('ed25519');
+      await writeFile(path.join(trust, 'ed25519-private.pem'),
+        keys.privateKey.export({type:'pkcs8', format:'pem'}), {flag:'wx'});
+      await writeFile(path.join(trust, 'ed25519-public.pem'),
+        keys.publicKey.export({type:'spki', format:'pem'}), {flag:'wx'});
+      const nonce = randomBytes(32).toString('hex');
+      const grantBytes = Buffer.from(JSON.stringify({instance_nonce:nonce, fixture:'R118 isolated'}));
+      const store = createAuthorityEpochStore({runtimeDir});
+      const granted = await store.append({plane:'process', action:'grant',
+        grantBytes, grantInstanceNonce:nonce});
+      const headPath = path.join(runtimeDir, 'authority-epochs', 'process', 'head.json');
+      const predecessorBytes = await readFile(headPath);
+      const orphan = await store.append({plane:'process', action:'user_revoke',
+        grantBytes, grantInstanceNonce:nonce});
+      await writeFile(headPath, predecessorBytes);
+      assert.equal((await store.verifyGrant({plane:'process', grantBytes,
+        grantInstanceNonce:nonce})).trusted, false);
+      children.push(recoverer(runtimeDir, granted.event_sha256, orphan.event_sha256));
+      children.push(recoverer(runtimeDir, granted.event_sha256, orphan.event_sha256));
+      await Promise.all(children.map(item => item.ready));
+      children.forEach(item => item.child.send({kind:'GO'}));
+      const results = await Promise.all(children.map(item => item.result));
+      assert.equal(results.filter(item => item.status === 'FULFILLED').length, 1, JSON.stringify(results));
+      assert.equal(results.filter(item => item.status === 'REJECTED').length, 1, JSON.stringify(results));
+      assert.equal(results.find(item => item.status === 'FULFILLED').value, 'REVOKED_ONLY_RECONCILED');
+      const fresh = createAuthorityEpochStore({runtimeDir});
+      assert.equal((await fresh.readHead({plane:'process'})).event_sha256, orphan.event_sha256);
+      assert.equal((await fresh.verifyGrant({plane:'process', grantBytes,
+        grantInstanceNonce:nonce})).trusted, false);
+    } finally {
+      for (const item of children) if (item.child.exitCode === null) item.child.kill();
+      await rm(root, {recursive:true, force:true, maxRetries:8, retryDelay:100});
+    }
+  });