deadbyte-mcp 0.15.48 → 0.15.49

package/src/authority-continuity-r65.mjs

@@ -214,10 +214,63 @@ const durablePublicKeys=new Map();
 const RESTORE_BINDING_FIELDS=Object.freeze(['prior_grant_sha256','prior_grant_instance_nonce','predecessor_policy_envelope_sha256','successor_policy_envelope_sha256','candidate_manifest_sha256','continuity_subject_sha256']);
 function normalizeRestoreBinding(value,{required=false}={}){
   if(value===undefined||value===null){if(required)throw new Error('authority epoch transaction restore binding required');return null;}
-  if(!plain(value)||Object.keys(value).length!==RESTORE_BINDING_FIELDS.length||RESTORE_BINDING_FIELDS.some(key=>!SHAPAT.test(String(value[key]))))
+  if(!plain(value)||Object.keys(value).length!==RESTORE_BINDING_FIELDS.length||
+      RESTORE_BINDING_FIELDS.some(key=>typeof value[key]!=='string'||!SHAPAT.test(value[key])))
     throw new Error('authority epoch transaction restore binding invalid');
   for(const key of Object.keys(value))if(!RESTORE_BINDING_FIELDS.includes(key))throw new Error('authority epoch transaction restore binding invalid');
-  return Object.freeze(Object.fromEntries(RESTORE_BINDING_FIELDS.map(key=>[key,String(value[key])])));
+  return Object.freeze(Object.fromEntries(RESTORE_BINDING_FIELDS.map(key=>[key,value[key]])));
+}
+
+function assertEpochActionIdentity(current){
+  const action=current?.action;
+  if(!DURABLE_EPOCH_ACTIONS.has(action)||
+      (action.startsWith('transaction_')?
+        typeof current.update_id!=='string'||!/^[A-Za-z0-9._-]{1,96}$/.test(current.update_id):
+        current.update_id!==null))
+    throw new Error('authority epoch transition invalid');
+  if(action==='transaction_restore')normalizeRestoreBinding(current.restore_binding,{required:true});
+  else if(current.restore_binding!==null)throw new Error('authority epoch transition invalid');
+}
+
+function assertEpochPredecessorIdentity(event){
+  if(event.schema!==DURABLE_EPOCH_SCHEMA||
+      typeof event.grant_sha256!=='string'||!SHAPAT.test(event.grant_sha256)||
+      typeof event.grant_instance_nonce!=='string'||!SHAPAT.test(event.grant_instance_nonce)||
+      (event.seq===1?event.previous_event_sha256!==null:
+        typeof event.previous_event_sha256!=='string'||!SHAPAT.test(event.previous_event_sha256))||
+      ((event.policy_sha256!==undefined||event.policy_envelope_sha256!==undefined)&&
+        (typeof event.policy_sha256!=='string'||!SHAPAT.test(event.policy_sha256)||
+         typeof event.policy_envelope_sha256!=='string'||!SHAPAT.test(event.policy_envelope_sha256))))
+    throw new Error('authority epoch transition invalid');
+  assertEpochActionIdentity(event);
+}
+
+function assertEpochTransition(current,previous){
+  assertEpochActionIdentity(current);
+  const action=current.action;
+  if(!previous){
+    if(action.startsWith('transaction_'))throw new Error('authority epoch transition invalid');
+    return;
+  }
+  if(action==='transaction_revoke'&&
+      (!['grant','transaction_restore'].includes(previous.action)||
+       current.grant_sha256!==previous.grant_sha256||
+       current.grant_instance_nonce!==previous.grant_instance_nonce))
+    throw new Error('authority epoch transition invalid');
+  if(action==='transaction_restore'){
+    const binding=normalizeRestoreBinding(current.restore_binding,{required:true});
+    if(previous.action!=='transaction_revoke'||current.update_id!==previous.update_id||
+        binding.prior_grant_sha256!==previous.grant_sha256||
+        binding.prior_grant_instance_nonce!==previous.grant_instance_nonce||
+        current.grant_instance_nonce===previous.grant_instance_nonce||
+        (previous.policy_envelope_sha256!==undefined&&
+          binding.predecessor_policy_envelope_sha256!==previous.policy_envelope_sha256)||
+        (current.policy_envelope_sha256!==undefined&&
+          binding.successor_policy_envelope_sha256!==current.policy_envelope_sha256))
+      throw new Error('authority epoch transition invalid');
+  }
+  if(action==='grant'&&current.grant_instance_nonce===previous.grant_instance_nonce)
+    throw new Error('authority epoch transition invalid');
 }
 
 async function durableEpochKeys(runtimeDir,{privateRequired=false}={}){
@@ -431,12 +484,40 @@ async function acquireEpochLock(dir,{allowStaleRecovery=true,onLockDispositionSt
   }
   throw new Error('authority epoch mutation locked');
 }
+const MAX_DURABLE_EPOCH_RECORD_BYTES=1048576;
+
+async function readBoundedEpochHandle(handle,label){
+    const stat=await handle.stat();
+    if(!stat.isFile()||!Number.isSafeInteger(stat.size)||stat.size>MAX_DURABLE_EPOCH_RECORD_BYTES)
+      throw new Error(`authority epoch ${label} oversized`);
+    // Read at most the observed size plus one byte. A concurrent extension
+    // cannot turn this into an unbounded read, and is rejected rather than
+    // silently truncating the record that will be hashed or parsed.
+    const bytes=Buffer.alloc(stat.size+1);
+    let used=0;
+    while(used<bytes.length){
+      const {bytesRead}=await handle.read(bytes,used,bytes.length-used,used);
+      if(bytesRead===0)break;
+      used+=bytesRead;
+    }
+    if(used!==stat.size)throw new Error(`authority epoch ${label} changed during read`);
+    return bytes.subarray(0,used);
+}
+
+async function readBoundedEpochRecord(file,label){
+  const handle=await open(file,'r');
+  try{
+    return await readBoundedEpochHandle(handle,label);
+  }finally{await handle.close();}
+}
+
 async function readDurableHead(runtimeDir,plane,{recoveryOrphanFile=null}={}){
   const dir=durableEpochDir(runtimeDir,plane),headPath=path.join(dir,'head.json');
   let head;
-  try{head=JSON.parse(await readFile(headPath,'utf8'));}
+  try{head=JSON.parse(decodeUtf8Strict(await readBoundedEpochRecord(headPath,'head')));}
   catch(error){
     if(error?.code==='ENOENT')return null;
+    if(String(error?.message??'').includes('authority epoch head oversized'))throw error;
     throw new Error('authority epoch head invalid');
   }
   if(!plain(head)||head.schema!==DURABLE_HEAD_SCHEMA||head.plane!==plane||
@@ -455,7 +536,8 @@ async function readDurableHead(runtimeDir,plane,{recoveryOrphanFile=null}={}){
   // the head. The head remains freshly read on every authority decision.
   const [eventNames,eventRead,keys]=await Promise.all([
     readdir(path.join(dir,'events')),
-    readFile(path.join(dir,'events',head.event_file)).then(bytes=>({bytes}),()=>({bytes:null})),
+    readBoundedEpochRecord(path.join(dir,'events',head.event_file),'event')
+      .then(bytes=>({bytes}),error=>({error})),
     durableEpochKeys(runtimeDir)
   ]);
   if(eventNames.length>10000)throw new Error('authority epoch event budget exceeded');
@@ -466,8 +548,11 @@ async function readDurableHead(runtimeDir,plane,{recoveryOrphanFile=null}={}){
     if(!Number.isSafeInteger(seq)||(seq>head.seq&&name!==recoveryOrphanFile)||(seq===head.seq&&name!==head.event_file))
       throw new Error('authority epoch head replay or incomplete write');
   }
+  if(eventRead.error){
+    if(eventRead.error.code==='ENOENT')throw new Error('authority epoch event missing');
+    throw eventRead.error;
+  }
   const eventBytes=eventRead.bytes;
-  if(!eventBytes)throw new Error('authority epoch event missing');
   if(hashBytes(eventBytes)!==head.event_sha256)throw new Error('authority epoch event hash mismatch');
   let event;
   try{event=JSON.parse(decodeUtf8Strict(eventBytes));}catch{throw new Error('authority epoch event invalid');}
@@ -484,22 +569,92 @@ async function readDurableHead(runtimeDir,plane,{recoveryOrphanFile=null}={}){
       (!SHAPAT.test(String(head.policy_sha256))||!SHAPAT.test(String(head.policy_envelope_sha256))||
        head.policy_sha256!==event.policy_sha256||head.policy_envelope_sha256!==event.policy_envelope_sha256))
     throw new Error('authority epoch policy binding invalid');
-  if(head.seq===1&&head.previous_event_sha256!==null)throw new Error('authority epoch genesis chain invalid');
+  if(head.seq===1){
+    if(head.previous_event_sha256!==null)throw new Error('authority epoch genesis chain invalid');
+    assertEpochTransition(head,null);
+  }
   if(head.seq>1){
     if(!SHAPAT.test(String(head.previous_event_sha256)))throw new Error('authority epoch predecessor missing');
     const priorName=durableEventName(head.seq-1,head.previous_event_sha256);
     let priorBytes;
-    try{priorBytes=await readFile(path.join(dir,'events',priorName));}
-    catch{throw new Error('authority epoch predecessor event missing');}
+    try{priorBytes=await readBoundedEpochRecord(path.join(dir,'events',priorName),'predecessor event');}
+    catch(error){
+      if(error?.code==='ENOENT')throw new Error('authority epoch predecessor event missing');
+      throw error;
+    }
     if(hashBytes(priorBytes)!==head.previous_event_sha256)throw new Error('authority epoch predecessor hash mismatch');
     let prior;
     try{prior=JSON.parse(decodeUtf8Strict(priorBytes));}catch{throw new Error('authority epoch predecessor invalid');}
     if(!verifyDurableEvent(prior,publicKey,keyId)||prior.seq!==head.seq-1||prior.plane!==plane)
       throw new Error('authority epoch predecessor signature invalid');
+    assertEpochPredecessorIdentity(prior);
+    if(prior.seq===1)assertEpochTransition(prior,null);
+    assertEpochTransition(head,prior);
   }
   return Object.freeze({...head});
 }
 
+// Deliberately separate from the per-request authority decision. This is an
+// independent, bounded audit of the complete signed chain, including events
+// older than the immediate predecessor checked by readDurableHead().
+async function auditDurableHistory(runtimeDir,plane){
+  const dir=durableEpochDir(runtimeDir,plane),events=path.join(dir,'events');
+  const head=await readDurableHead(runtimeDir,plane);
+  if(!head){
+    let names;
+    try{names=await readdir(events);}catch(error){if(error?.code==='ENOENT')return Object.freeze({status:'EMPTY',plane,verified_events:0});throw error;}
+    if(names.length)throw new Error('authority epoch history events exist without head');
+    return Object.freeze({status:'EMPTY',plane,verified_events:0});
+  }
+  if(head.seq>10000)throw new Error('authority epoch history event budget exceeded');
+  const headPath=path.join(dir,'head.json'),headBytes=await readBoundedEpochRecord(headPath,'head');
+  let pinnedHead;
+  try{pinnedHead=JSON.parse(decodeUtf8Strict(headBytes));}catch{throw new Error('authority epoch history head changed');}
+  if(canonicalJson(pinnedHead)!==canonicalJson(head))throw new Error('authority epoch history head changed');
+  const names=await readdir(events);
+  if(names.length!==head.seq)throw new Error('authority epoch history event count mismatch');
+  const namesSet=new Set(names);
+  const {publicKey,keyId}=await durableEpochKeys(runtimeDir);
+  let expectedSha=head.event_sha256,totalBytes=0,newer=null;
+  for(let seq=head.seq;seq>=1;seq--){
+    const name=durableEventName(seq,expectedSha);
+    if(!namesSet.has(name))throw new Error('authority epoch history event missing');
+    const file=path.join(events,name),st=await lstat(file);
+    if(!st.isFile()||st.isSymbolicLink()||st.size>1048576)
+      throw new Error('authority epoch history event identity invalid');
+    totalBytes+=st.size;
+    if(totalBytes>67108864)throw new Error('authority epoch history byte budget exceeded');
+    const bytes=await readBoundedEpochRecord(file,'event');
+    if(hashBytes(bytes)!==expectedSha)throw new Error('authority epoch history hash mismatch');
+    let event;
+    try{event=JSON.parse(decodeUtf8Strict(bytes));}catch{throw new Error('authority epoch history event invalid');}
+    if(!verifyDurableEvent(event,publicKey,keyId)||event.schema!==DURABLE_EPOCH_SCHEMA||
+        event.plane!==plane||event.seq!==seq||!DURABLE_EPOCH_ACTIONS.has(event.action)||
+        !SHAPAT.test(String(event.grant_sha256))||!SHAPAT.test(String(event.grant_instance_nonce)))
+      throw new Error('authority epoch history event signature or identity invalid');
+    normalizeRestoreBinding(event.restore_binding,{required:event.action==='transaction_restore'});
+    if((event.action.startsWith('transaction_')?!/^[A-Za-z0-9._-]{1,96}$/.test(String(event.update_id??'')):event.update_id!==null))
+      throw new Error('authority epoch history update identity invalid');
+    if(event.policy_sha256!==undefined||event.policy_envelope_sha256!==undefined){
+      if(!SHAPAT.test(String(event.policy_sha256))||!SHAPAT.test(String(event.policy_envelope_sha256)))
+        throw new Error('authority epoch history policy binding invalid');
+    }
+    if(seq===1){
+      if(event.previous_event_sha256!==null)throw new Error('authority epoch history genesis chain invalid');
+    }else if(!SHAPAT.test(String(event.previous_event_sha256)))
+      throw new Error('authority epoch history predecessor missing');
+    if(newer)assertEpochTransition(newer,event);
+    else if(seq===1)assertEpochTransition(event,null);
+    newer=event;
+    expectedSha=event.previous_event_sha256;
+  }
+  if(newer&&head.seq>1)assertEpochTransition(newer,null);
+  if(!(await readBoundedEpochRecord(headPath,'head')).equals(headBytes))throw new Error('authority epoch history head changed during audit');
+  if((await durableEpochKeys(runtimeDir)).keyId!==keyId)throw new Error('authority epoch history trust changed during audit');
+  return Object.freeze({status:'PASS',plane,seq:head.seq,event_sha256:head.event_sha256,
+    verified_events:head.seq,verified_bytes:totalBytes});
+}
+
 // R79: An orphan event is not a committed head. Ordinary reads, verification
 // and appends MUST keep rejecting it. Only explicit revocation-only recovery
 // can use the bounded exception to inspect an older, still-signed head.
@@ -516,7 +671,7 @@ async function inspectOrphanRevocation(runtimeDir,plane,{expectedHeadSha256,expe
   const headPath=path.join(dir,'head.json');
   const headStat=await lstat(headPath);
   if(!headStat.isFile()||headStat.isSymbolicLink())throw new Error('authority epoch recovery head identity invalid');
-  const rawHead=await readFile(headPath);
+  const rawHead=await readBoundedEpochRecord(headPath,'head');
   let untrusted;
   try{untrusted=JSON.parse(decodeUtf8Strict(rawHead));}catch{throw new Error('authority epoch recovery head invalid');}
   if(!Number.isSafeInteger(untrusted?.seq)||untrusted.seq<1)
@@ -539,7 +694,7 @@ async function inspectOrphanRevocation(runtimeDir,plane,{expectedHeadSha256,expe
   const orphanPath=path.join(events,orphanFile);
   const orphanStat=await lstat(orphanPath);
   if(!orphanStat.isFile()||orphanStat.isSymbolicLink())throw new Error('authority epoch recovery orphan file identity invalid');
-  const orphanBytes=await readFile(orphanPath);
+  const orphanBytes=await readBoundedEpochRecord(orphanPath,'event');
   if(hashBytes(orphanBytes)!==expectedOrphanSha256)
     throw new Error('authority epoch recovery orphan bytes mismatch');
   let event;
@@ -559,7 +714,7 @@ async function inspectOrphanRevocation(runtimeDir,plane,{expectedHeadSha256,expe
     throw new Error('authority epoch recovery orphan revocation binding invalid');
   // Head cannot be promoted unless it is still exactly the same committed
   // predecessor. No authority-creating action is ever eligible.
-  const replay=await readFile(path.join(dir,'head.json'));
+  const replay=await readBoundedEpochRecord(headPath,'head');
   if(!replay.equals(rawHead))throw new Error('authority epoch recovery head changed');
   const newHead={schema:DURABLE_HEAD_SCHEMA,plane,seq:event.seq,action:event.action,
     update_id:event.update_id,grant_sha256:event.grant_sha256,
@@ -583,6 +738,9 @@ export function createAuthorityEpochStore({runtimeDir,policyBytes=null,onDurabil
     async readHead({plane}){
       return readDurableHead(root,plane);
     },
+    async auditHistory({plane}){
+      return auditDurableHistory(root,plane);
+    },
     async reconcileOrphanedRevocation({plane,expectedHeadSha256,expectedOrphanSha256,operatorConfirmed=false}){
       // NOT called from grant verification, append, startup or automatic
       // recovery. The operator must supply two observed event identities.
@@ -610,12 +768,12 @@ export function createAuthorityEpochStore({runtimeDir,policyBytes=null,onDurabil
           const st=await fh.stat();
           if(!st.isFile()||st.size!==orphanBytes.length)
             throw new Error('authority epoch recovery pinned orphan identity invalid');
-          const pinnedBytes=await fh.readFile();
+          const pinnedBytes=await readBoundedEpochHandle(fh,'event');
           if(!pinnedBytes.equals(orphanBytes)||hashBytes(pinnedBytes)!==expectedOrphanSha256)
             throw new Error('authority epoch recovery orphan changed before sync');
           await fh.sync();
         }finally{await fh.close();}
-        if(!(await readFile(path.join(dir,'head.json'))).equals(headBytes))
+        if(!(await readBoundedEpochRecord(path.join(dir,'head.json'),'head')).equals(headBytes))
           throw new Error('authority epoch recovery head changed before commit');
         await release.verifyOwned();
         await atomicJsonWrite(path.join(dir,'head.json'),newHead,{stage});
@@ -650,6 +808,11 @@ export function createAuthorityEpochStore({runtimeDir,policyBytes=null,onDurabil
         if(parsedGrant?.policy_sha256!==policySha256)throw new Error('authority epoch grant policy digest mismatch');
         policyBinding={policy_sha256:policySha256,policy_envelope_sha256:deriveSecurityEnvelope(plane,parsedPolicy).sha256};
       }
+      // A mismatched successor envelope is known before acquiring a native
+      // lock or writing any signed event. Refuse it without side effects.
+      if(action==='transaction_restore'&&policyBinding?.policy_envelope_sha256!==undefined&&
+          normalizedRestoreBinding.successor_policy_envelope_sha256!==policyBinding.policy_envelope_sha256)
+        throw new Error('authority epoch transaction restore successor policy envelope mismatch');
       const dir=durableEpochDir(root,plane),events=path.join(dir,'events');
       const release=await acquireEpochLock(dir,{onLockDispositionStage});
       try{
@@ -674,6 +837,12 @@ export function createAuthorityEpochStore({runtimeDir,policyBytes=null,onDurabil
             throw new Error('authority epoch transaction restore predecessor grant binding mismatch');
           if(previous.grant_instance_nonce===grantInstanceNonce)
             throw new Error('authority epoch transaction restore requires fresh nonce; revoked nonce cannot be resurrected');
+          if(previous.policy_envelope_sha256!==undefined&&
+              normalizedRestoreBinding.predecessor_policy_envelope_sha256!==previous.policy_envelope_sha256)
+            throw new Error('authority epoch transaction restore predecessor policy envelope mismatch');
+          if(policyBinding?.policy_envelope_sha256!==undefined&&
+              normalizedRestoreBinding.successor_policy_envelope_sha256!==policyBinding.policy_envelope_sha256)
+            throw new Error('authority epoch transaction restore successor policy envelope mismatch');
         }
         if(action==='grant'&&previous?.grant_instance_nonce===grantInstanceNonce)
           throw new Error('authority epoch grant requires fresh nonce; prior nonce cannot be resurrected');

package/src/autonomous-local-supervisor.mjs

@@ -1,11 +1,15 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { access, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { access, readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { startAutonomousSupervisor } from './autonomous-supervisor.mjs';
+import { windowsPowerShellEnvironment } from './windows-powershell-environment.mjs';
+import { readPinnedEpochLockSnapshot, createPinnedEpochLock, deletePinnedRemoteMarker } from './foreground-marker-cas-win32.mjs';
+import { runNativeInspect } from './native-inspector-r67.mjs';
 
 const execFileAsync=promisify(execFile);
+const TRUSTED_WINDOWS_ROOT='C:\\Windows';
 export const AUTONOMOUS_SUPERVISOR_OWNER_SCHEMA='deadbyte.autonomous-supervisor-owner.v1';
 const HEX64=/^[0-9a-f]{64}$/;
 const RECOVERY_OPERATIONS=Object.freeze(['status','resume','park','disarmautonomous','disarmcoding','disarmprocess','disarmhost']);
@@ -33,12 +37,12 @@ function validateMarker(marker){
 }
 async function powershellPath(){
   if(process.platform!=='win32') return null;
-  const systemRoot=process.env.SystemRoot || process.env.WINDIR;
-  if(systemRoot){
-    const candidate=path.join(systemRoot,'System32','WindowsPowerShell','v1.0','powershell.exe');
-    try { await access(candidate); return candidate; } catch {}
-  }
-  return 'powershell.exe';
+  const candidate=path.join(TRUSTED_WINDOWS_ROOT,'System32','WindowsPowerShell','v1.0','powershell.exe');
+  try { await access(candidate); return candidate; } catch { return null; }
+}
+
+function trustedPowerShellEnvironment(){
+  return windowsPowerShellEnvironment({...process.env,SystemRoot:TRUSTED_WINDOWS_ROOT,WINDIR:TRUSTED_WINDOWS_ROOT});
 }
 
 export async function observeCurrentProcessIdentity(pid=process.pid){
@@ -49,7 +53,7 @@ export async function observeCurrentProcessIdentity(pid=process.pid){
   let stdout;
   try {
     ({stdout}=await execFileAsync(shell,['-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-Command',script],{
-      windowsHide:true,timeout:10_000,maxBuffer:1024*1024,encoding:'utf8'
+      windowsHide:true,timeout:10_000,maxBuffer:1024*1024,encoding:'utf8',env:trustedPowerShellEnvironment()
     }));
   } catch { return null; }
   let parsed;
@@ -64,14 +68,36 @@ export async function observeCurrentProcessIdentity(pid=process.pid){
   });
 }
 
+async function confirmProcessAbsent(pid){
+  const shell=await powershellPath();
+  if(!shell) return false;
+  const script=`$ErrorActionPreference='Stop'; $p=Get-CimInstance Win32_Process -Filter 'ProcessId=${pid}' -ErrorAction Stop; if($null -eq $p){[Console]::Out.WriteLine('ABSENT')}else{[Console]::Out.WriteLine('PRESENT')}`;
+  try {
+    const {stdout}=await execFileAsync(shell,['-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-Command',script],{
+      windowsHide:true,timeout:10_000,maxBuffer:1024*1024,encoding:'utf8',env:trustedPowerShellEnvironment()
+    });
+    if(String(stdout).trim()!=='ABSENT') return false;
+    const native=await runNativeInspect(['identity',String(pid)]);
+    return native.status==='failed'&&native.error_code==='INVALID_PARAMETER'&&
+      native.win32_error===87&&native.error==='OpenProcess identity win32=87';
+  } catch { return false; }
+}
+
 async function readMarker(markerPath){
-  let raw;
-  try { raw=await readFile(markerPath); }
-  catch(error){ if(error?.code==='ENOENT') return {exists:false}; throw error; }
+  let raw, fileId=null;
+  if(process.platform==='win32'){
+    const snapshot=readPinnedEpochLockSnapshot(markerPath);
+    if(!snapshot) return {exists:false};
+    raw=snapshot.bytes;
+    fileId=snapshot.fileId;
+  } else {
+    try { raw=await readFile(markerPath); }
+    catch(error){ if(error?.code==='ENOENT') return {exists:false}; throw error; }
+  }
   let marker;
   try { marker=JSON.parse(raw.toString('utf8')); }
-  catch { return {exists:true,raw,raw_sha256:sha256Bytes(raw),valid:false,marker:null}; }
-  return {exists:true,raw,raw_sha256:sha256Bytes(raw),valid:validateMarker(marker),marker};
+  catch { return {exists:true,raw,raw_sha256:sha256Bytes(raw),file_id:fileId,valid:false,marker:null}; }
+  return {exists:true,raw,raw_sha256:sha256Bytes(raw),file_id:fileId,valid:validateMarker(marker),marker};
 }
 function markerFor(identity){
   return {
@@ -91,28 +117,28 @@ export async function observeSupervisor(options={}){
   const markerPath=assertOptions(options);
   const stored=await readMarker(markerPath);
   if(!stored.exists) return {status:'absent',live:false,reason:'no_owner',marker:null,marker_sha256:null};
-  if(!stored.valid) return {status:'unverified',live:false,reason:'marker_invalid',marker:stored.marker,marker_sha256:stored.raw_sha256};
+  const binding={marker_sha256:stored.raw_sha256,marker_file_id:stored.file_id};
+  if(!stored.valid) return {status:'unverified',live:false,reason:'marker_invalid',marker:stored.marker,...binding};
   const observed=await observeCurrentProcessIdentity(stored.marker.pid);
-  if(!observed) return {status:'stale',live:false,reason:'process_unobservable',marker:stored.marker,marker_sha256:stored.raw_sha256};
+  if(!observed){
+    if(await confirmProcessAbsent(stored.marker.pid))
+      return {status:'stale',live:false,reason:'process_absent',marker:stored.marker,...binding};
+    return {status:'unverified',live:false,reason:'process_unobservable',marker:stored.marker,...binding};
+  }
   if(observed.creation_time_utc!==new Date(stored.marker.creation_time_utc).toISOString()) {
-    return {status:'stale',live:false,reason:'pid_reused',marker:stored.marker,observation:observed,marker_sha256:stored.raw_sha256};
+    return {status:'stale',live:false,reason:'pid_reused',marker:stored.marker,observation:observed,...binding};
   }
   if(!samePath(observed.image_path,stored.marker.image_path)||observed.image_sha256!==stored.marker.image_sha256) {
-    return {status:'stale',live:false,reason:'identity_mismatch',marker:stored.marker,observation:observed,marker_sha256:stored.raw_sha256};
+    return {status:'unverified',live:false,reason:'identity_mismatch',marker:stored.marker,observation:observed,...binding};
   }
-  return {status:'owned',live:true,reason:'live_verified_owner',marker:stored.marker,observation:observed,marker_sha256:stored.raw_sha256};
+  return {status:'owned',live:true,reason:'live_verified_owner',marker:stored.marker,observation:observed,...binding};
 }
 
 export async function claimSupervisor(options={}){
   const markerPath=assertOptions(options);
   const marker=await currentMarker();
-  await mkdir(path.dirname(markerPath),{recursive:true});
-  try {
-    await writeFile(markerPath,`${JSON.stringify(marker)}\n`,{flag:'wx',mode:0o600});
-  } catch(error){
-    if(error?.code==='EEXIST') throw new Error('supervisor owner marker already exists; takeover required');
-    throw error;
-  }
+  const created=createPinnedEpochLock(markerPath,Buffer.from(`${JSON.stringify(marker)}\n`));
+  if(!created) throw new Error('supervisor owner marker already exists; takeover required');
   return {status:'claimed',instance_nonce:marker.instance_nonce,marker};
 }
 
@@ -121,17 +147,13 @@ export async function takeoverSupervisor(options={}){
   const prior=await observeSupervisor({markerPath});
   if(prior.live&&prior.reason==='live_verified_owner') throw new Error('supervisor takeover refused: live verified owner');
   if(prior.reason==='no_owner') return claimSupervisor({markerPath});
-  const marker=await currentMarker();
-  const before=await readMarker(markerPath);
-  if(!before.exists||before.raw_sha256!==prior.marker_sha256) throw new Error('supervisor ownership changed during takeover');
-  const temp=path.join(path.dirname(markerPath),`.${path.basename(markerPath)}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
-  try {
-    await writeFile(temp,`${JSON.stringify(marker)}\n`,{flag:'wx',mode:0o600});
-    const check=await readMarker(markerPath);
-    if(!check.exists||check.raw_sha256!==prior.marker_sha256) throw new Error('supervisor ownership changed during takeover');
-    await rename(temp,markerPath);
-  } finally { await rm(temp,{force:true}).catch(()=>{}); }
-  return {status:'claimed',instance_nonce:marker.instance_nonce,marker,taken_over_reason:prior.reason};
+  if(!['process_absent','pid_reused'].includes(prior.reason))
+    throw new Error(`supervisor takeover refused: ownership unverified (${prior.reason})`);
+  if(!prior.marker_file_id) throw new Error('supervisor ownership file identity unavailable for takeover');
+  const removed=deletePinnedRemoteMarker(markerPath,prior.marker_sha256,{expectedFileId:prior.marker_file_id});
+  if(removed!=='REMOVED') throw new Error(`supervisor ownership changed during takeover: ${removed}`);
+  const claimed=await claimSupervisor({markerPath});
+  return {...claimed,taken_over_reason:prior.reason};
 }
 
 export async function releaseSupervisor(options={}){
@@ -147,9 +169,9 @@ export async function releaseSupervisor(options={}){
     !samePath(current.image_path,observed.observation.image_path)||current.image_sha256!==observed.observation.image_sha256) {
     throw new Error('supervisor ownership current process identity mismatch');
   }
-  const check=await readMarker(markerPath);
-  if(!check.exists||check.raw_sha256!==observed.marker_sha256) throw new Error('supervisor ownership changed before release');
-  await rm(markerPath,{force:false});
+  if(!observed.marker_file_id) throw new Error('supervisor ownership file identity unavailable for release');
+  const removed=deletePinnedRemoteMarker(markerPath,observed.marker_sha256,{expectedFileId:observed.marker_file_id});
+  if(removed!=='REMOVED') throw new Error(`supervisor ownership changed before release: ${removed}`);
   return {status:'released'};
 }
 
@@ -180,7 +202,7 @@ export async function runPinnedControllerOperation(options={}){
   if(!shell) throw new Error('supervisor controller requires Windows PowerShell');
   try {
     const {stdout,stderr}=await execFileAsync(shell,['-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-File',controllerPath,operation],{
-      windowsHide:true,timeout:120_000,maxBuffer:4*1024*1024,encoding:'utf8'
+      windowsHide:true,timeout:120_000,maxBuffer:4*1024*1024,encoding:'utf8',env:trustedPowerShellEnvironment()
     });
     return {exit_code:0,stdout:String(stdout??''),stderr:String(stderr??'')};
   } catch(error) {
@@ -228,20 +250,28 @@ export async function startLocalSupervisorHost({runtime,policy=runtime?.policy,m
   try {
     supervisor=startAutonomousSupervisor({runtime,policy,idleDelayMs,maxCycles,logger,continuous});
   } catch(error) {
-    await releaseSupervisor({markerPath,instanceNonce:claim.instance_nonce}).catch(()=>{});
+    try { await releaseSupervisor({markerPath,instanceNonce:claim.instance_nonce}); }
+    catch(cleanupError) {
+      throw new AggregateError([error,cleanupError],
+        'supervisor startup and ownership cleanup both failed',{cause:error});
+    }
     throw error;
   }
   let stopped=false;
+  let stopPromise=null;
   return Object.freeze({
     marker_path:path.resolve(markerPath),instance_nonce:claim.instance_nonce,supervisor,
-    get running(){ return !stopped&&supervisor.running; },
-    async scanNow(){ if(stopped) throw new Error('local supervisor host stopped'); return supervisor.scanNow(); },
+    get running(){ return !stopPromise&&supervisor.running; },
+    async scanNow(){ if(stopPromise) throw new Error('local supervisor host stopping or stopped'); return supervisor.scanNow(); },
     async stop(){
       if(stopped) return {status:'stopped'};
-      stopped=true;
-      await supervisor.stop();
-      await releaseSupervisor({markerPath,instanceNonce:claim.instance_nonce});
-      return {status:'stopped'};
+      if(!stopPromise) stopPromise=(async()=>{
+        await supervisor.stop();
+        await releaseSupervisor({markerPath,instanceNonce:claim.instance_nonce});
+        stopped=true;
+        return {status:'stopped'};
+      })();
+      return stopPromise;
     }
   });
 }

package/src/deadbyte-cli.mjs

@@ -25,7 +25,7 @@ import {foregroundIdentityMatches,queryForegroundIdentity,validForegroundIdentit
 import {readRemoteMarkerSnapshot,deletePinnedRemoteMarker} from './foreground-marker-cas-win32.mjs';
 import {acquireForegroundSessionLock} from './foreground-session-lock.mjs';
 import { AUTHORITY_PLANES, authorityVector, authorityRestorePlan, parseAuthorityObservation, assertAuthorityVector, assertRuntimeReadyObservation, authorityBanner } from './remote-authority.mjs';
-import { decodeRemoteLogBytes, boundedRemoteDiagnostic, safeRemoteLogPrefixLength } from './remote-log-decode-r60.mjs';
+import { decodeRemoteLogBytes, boundedRemoteDiagnostic, readRemoteLogAppend } from './remote-log-decode-r60.mjs';
 
 const REMOTE_COMMANDS=new Set([
   'menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest',
@@ -43,6 +43,7 @@ const CURRENT_PACKAGE_ROOT=path.resolve(fileURLToPath(new URL('..',import.meta.u
 const CURRENT_DEPLOY_SCRIPT=path.join(CURRENT_PACKAGE_ROOT,'scripts','deploy-r48.mjs');
 const REMOTE_UPDATE_TIMEOUT_MS=900000;
 const LIVE_LOG_DISCOVERY_INTERVAL_MS=1000;
+const TRUSTED_WINDOWS_ROOT='C:\\Windows';
 
 function stateRoot(){return resolveStateRoot();}
 async function requireRegular(file,label){const info=await lstat(file);if(!info.isFile()||info.isSymbolicLink()) throw new Error(`${label} must be a regular non-symlink file`);return file;}
@@ -79,8 +80,7 @@ async function remoteContext(){
   if(process.platform!=='win32') throw new Error('remote controller is currently Windows-only');
   const root=stateRoot();
   const launcher=await requireRegular(path.join(root,'bin','DEADBYTE-MCP.ps1'),'stable DEADBYTE launcher');
-  const systemRoot=process.env.SystemRoot||process.env.WINDIR;if(!systemRoot) throw new Error('SystemRoot/WINDIR missing');
-  const powershell=await requireRegular(path.join(systemRoot,'System32','WindowsPowerShell','v1.0','powershell.exe'),'Windows PowerShell');
+  const powershell=await requireRegular(path.join(TRUSTED_WINDOWS_ROOT,'System32','WindowsPowerShell','v1.0','powershell.exe'),'Windows PowerShell');
   return {root,launcher,powershell};
 }
 function boundedSingleLine(value,maxChars=2048){
@@ -203,7 +203,8 @@ function invokeController(ctx,command,{capture=false,allowFailure=false,echoCapt
       stdio=['ignore',stdoutFd,stderrFd];
     }else stdio=capture?['ignore','pipe','pipe']:'inherit';
     const options={stdio,encoding:capture?'utf8':undefined,windowsHide:false,shell:false,
-      env:windowsPowerShellEnvironment(probeMode?{...process.env,DEADBYTE_REMOTE_PROBE_MODE:probeMode}:process.env)};
+      env:windowsPowerShellEnvironment({...process.env,SystemRoot:TRUSTED_WINDOWS_ROOT,WINDIR:TRUSTED_WINDOWS_ROOT,
+        ...(probeMode?{DEADBYTE_REMOTE_PROBE_MODE:probeMode}:{})})};
     if(Number.isInteger(timeoutMs)&&timeoutMs>0) options.timeout=timeoutMs;
     result=spawnSync(ctx.powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',ctx.launcher,command,...(json?['-Json']:[])],options);
   }finally{
@@ -309,32 +310,15 @@ async function replayRemoteResults(root,cursor,{displayMode='unicode'}={}){
     if(!page.has_more) return next;
   }
 }
-async function readAppend(file,offset){
-  let info;try{info=await stat(file);}catch(error){if(error?.code==='ENOENT') return {offset:0,text:''};throw error;}
-  let start=offset;
-  const reset=info.size<start;
-  if(reset) start=0;
-  if(info.size===start) return {offset:start,text:''};
-  const handle=await open(file,'r');
-  let encoding=null,buffer,bytesRead=0;
-  try{
-    const header=Buffer.alloc(2);await handle.read(header,0,2,0);
-    if(header[0]===0xff&&header[1]===0xfe&&/\.log$/i.test(file)){
-      encoding='utf16le';if(start%2!==0)start=Math.max(0,start-1);
-    }
-    const length=Math.min(1024*1024,info.size-start);
-    if(length===0)return {offset:start,text:''};
-    buffer=Buffer.alloc(length);
-    ({bytesRead}=await handle.read(buffer,0,length,start));
-  }finally{await handle.close();}
-  const complete=safeRemoteLogPrefixLength(buffer.subarray(0,bytesRead),encoding??'utf8');
-  return {offset:start+complete,text:decodeRemoteLogBytes(file,buffer.subarray(0,complete),{encoding}),reset};
+async function readAppend(file,cursor){
+  return readRemoteLogAppend(file,cursor);
 }
 async function snapshotRemoteLogOffsets(root){
   const offsets=new Map();
   const files=await listLogFiles(root);
   for(const file of files){
-    try{offsets.set(file,(await stat(file)).size);}catch{}
+    const snapshot=await readRemoteLogAppend(file,null,{startAtEnd:true});
+    if(snapshot.cursor)offsets.set(file,snapshot.cursor);
   }
   return offsets;
 }
@@ -346,6 +330,7 @@ function timelineFilterEvent(timeline){
   return {
     event_type:'tool.result',request_id:timeline.request_id,tool:timeline.tool,
     outcome:{
+      status:timeline.side_effect_state==='unknown'?'interrupted':timeline.status,
       is_error:timeline.status==='error',
       ...(Number.isFinite(Number(timeline.duration_ms))?{duration_ms:Number(timeline.duration_ms)}:{}),
       ...(timeline.side_effect_state?{side_effect_state:timeline.side_effect_state}:{}),
@@ -368,10 +353,13 @@ async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTra
       nextDiscoveryAt=now+LIVE_LOG_DISCOVERY_INTERVAL_MS;
     }
     for(const file of liveFiles){
-      const prior=activeOffsets.has(file)?activeOffsets.get(file):0;
+      const prior=activeOffsets.has(file)?activeOffsets.get(file):null;
       const next=await readAppend(file,prior);
-      activeOffsets.set(file,next.offset);
-      if(next.reset)partialLines.delete(file);
+      activeOffsets.set(file,next.cursor);
+      if(next.reset){
+        partialLines.delete(file);
+        process.stderr.write('[LIVELOG] STREAM_RESET '+path.basename(file)+' — '+next.resetReason+'; check audit continuity before trusting coverage\n');
+      }
       if(!next.text)continue;
       const lines=((partialLines.get(file)??'')+next.text).split(/\r?\n/);
       partialLines.set(file,lines.pop()??'');
@@ -379,6 +367,8 @@ async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTra
       for(const line of lines){
         if(Buffer.byteLength(line,'utf8')>1024*1024) throw new Error(`remote log line exceeds bounded decode limit: ${path.basename(file)}`);
         const auditEvent=parseAuditLogLine(file,line);
+        if(/^segment-\d{8}\.jsonl$/.test(path.basename(file))&&!auditEvent)
+          throw new Error('LIVELOG_AUDIT_RECORD_INVALID '+path.basename(file)+'; refusing to silently skip audit bytes');
         const timeline=auditTimelineRecord(file,line,auditEvent);
         let recorded=null;
         if(timeline&&journal) recorded=timeline.event_type==='tool.call'