deadbyte-mcp 0.15.48 → 0.15.49

package/src/remote-live-log.mjs

@@ -254,13 +254,20 @@ function traceText(meta,displayMode='unicode'){
 }
 function outcomeClass(event){
   const outcome=event?.outcome;
-  if(outcome?.side_effect_state==='unknown') return 'unknown';
-  const status=outcome?.status;
-  if(status==='timeout'||status==='timed_out') return 'unknown';
-  if(outcome?.is_error===true||
-     ['failed','denied','rejected','blocked','observed_failure','cancelled','canceled','unavailable','unsupported'].includes(status)) return 'error';
-  if(['pending','running','input_required','paused','processing','accepted'].includes(status)) return 'pending';
-  return 'ok';
+  // A terminal record is not evidence of success without a classified
+  // outcome. Never upgrade missing or new statuses to OK.
+  if(!outcome||typeof outcome!=='object'||Array.isArray(outcome))return 'unknown';
+  if(outcome.side_effect_state==='unknown')return 'unknown';
+  const status=outcome.status;
+  if(status==='timeout'||status==='timed_out'||status==='interrupted')return 'unknown';
+  if(outcome.is_error===true||
+     ['failed','threw','error','denied','rejected','blocked','observed_failure','cancelled','canceled','unavailable','unsupported'].includes(status))return 'error';
+  if(['pending','running','input_required','paused','processing','accepted'].includes(status))return 'pending';
+  if(['ok','success','succeeded','completed','committed','verified','passed','done'].includes(status))return 'ok';
+  // Legacy audit records with explicit is_error:false but no status remain
+  // supported; an unrecognized status is not evidence of success.
+  if((status===undefined||status===null)&&outcome.is_error===false)return 'ok';
+  return 'unknown';
 }
 export function classifyRemoteAuditOutcome(event){return outcomeClass(event);}
 function parseFilterExpression(expression){
@@ -391,7 +398,7 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
     const category=categoryForTool(displayTool);
     const receipt=Array.isArray(event.outcome?.receipt_sha256s)&&typeof event.outcome.receipt_sha256s[0]==='string'
       ?shortValue(event.outcome.receipt_sha256s[0],8):'';
-    const marker=unknown?'FAILED_AFTER_UNKNOWN_EFFECT':
+    const marker=unknown?(event.outcome?.side_effect_state==='unknown'?'FAILED_AFTER_UNKNOWN_EFFECT':'OUTCOME_UNKNOWN'):
       error?(displayMode==='ascii'?'ERR':'✗'):
       pendingResult?'PENDING':
       ['write','edit','run'].includes(category)?(displayMode==='ascii'?'SUCCEEDED':'✅ SUCCEEDED'):

package/src/remote-log-decode-r60.mjs

@@ -1,4 +1,6 @@
 import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {open} from 'node:fs/promises';
 
 export function safeRemoteLogPrefixLength(bytes,encoding='utf8'){
   if(!Buffer.isBuffer(bytes))throw new Error('remote log prefix bytes invalid');
@@ -30,3 +32,66 @@ export function boundedRemoteDiagnostic(value,maxChars=2048){
   const line=String(value??'').replace(/\x1b\[[0-9;]*[A-Za-z]/g,'').replace(/[\x00-\x1f\x7f]+/g,' ').replace(/\s{2,}/g,' ').trim();
   return line.length<=maxChars?line:`${line.slice(0,maxChars)}...`;
 }
+ 
+// Cursor pinned to the file handle's observed identity. We never use a path
+// stat's size to allocate or seek on a separately opened file.
+export async function readRemoteLogAppend(file,cursor=null,{startAtEnd=false,maxBytes=1048576}={}){
+  if(typeof file!=='string'||!file||!Number.isInteger(maxBytes)||maxBytes<4||maxBytes>1048576)
+    throw new Error('remote live log append arguments invalid');
+  if(cursor!==null&&(!Number.isSafeInteger(cursor.offset)||cursor.offset<0))
+    throw new Error('remote live log cursor invalid');
+  let handle;
+  try{handle=await open(file,'r');}
+  catch(error){
+    if(error?.code==='ENOENT')return {cursor:null,offset:0,text:'',reset:cursor!==null,resetReason:'file disappeared'};
+    throw error;
+  }
+  try{
+    const st=await handle.stat({bigint:true});
+    if(!st.isFile()||st.size<0n||st.size>BigInt(Number.MAX_SAFE_INTEGER))
+      throw new Error('remote live log regular file/size invalid');
+    const size=Number(st.size);
+    const identity=st.ino!==0n?st.dev.toString()+':'+st.ino.toString():null;
+    const mtimeNs=(st.mtimeNs??BigInt(Math.trunc(Number(st.mtimeMs)*1000000))).toString();
+    const gone=cursor!==null&&cursor.identity&&identity&&cursor.identity!==identity;
+    const shrunk=cursor!==null&&size<cursor.offset;
+    // NTFS may report the same timestamp for rapid same-size rewrites.
+    // Compare a bounded suffix fingerprint on the idle cursor as well.
+    // This is best-effort rewrite detection, NOT complete file integrity.
+    async function tailFingerprint(offset){
+      if(offset===0)return null;
+      const length=Math.min(offset,64),bytes=Buffer.allocUnsafe(length);
+      const {bytesRead}=await handle.read(bytes,0,length,offset-length);
+      if(bytesRead!==length)throw new Error('remote live log changed during fingerprint');
+      return createHash('sha256').update(bytes).digest('hex');
+    }
+    const priorTailChanged=cursor!==null&&!gone&&!shrunk&&size===cursor.offset&&
+      typeof cursor.tail_sha256==='string'&&
+      (await tailFingerprint(cursor.offset))!==cursor.tail_sha256;
+    const rewritten=cursor!==null&&!gone&&!shrunk&&size===cursor.offset&&
+      ((typeof cursor.mtimeNs==='string'&&cursor.mtimeNs!==mtimeNs)||priorTailChanged);
+    const reset=Boolean(gone||shrunk||rewritten);
+    let start=reset?0:(cursor?.offset??0);
+    const makeCursor=async offset=>Object.freeze({offset,identity,mtimeNs,tail_sha256:await tailFingerprint(offset)});
+    if(startAtEnd&&cursor===null)
+      return {cursor:await makeCursor(size),offset:size,text:'',reset:false,resetReason:null};
+    let encoding=null;
+    if(/\.log$/i.test(file)){
+      const bom=Buffer.allocUnsafe(2);
+      const header=await handle.read(bom,0,2,0);
+      if(header.bytesRead===2&&bom[0]===0xff&&bom[1]===0xfe){
+        encoding='utf16le';
+        if(start%2!==0)start--;
+      }
+    }
+    if(start>=size)
+      return {cursor:await makeCursor(start),offset:start,text:'',reset,resetReason:gone?'file identity changed':shrunk?'file shrank':rewritten?'same-size rewrite':null};
+    const buffer=Buffer.allocUnsafe(Math.min(maxBytes,size-start));
+    const {bytesRead}=await handle.read(buffer,0,buffer.length,start);
+    const complete=safeRemoteLogPrefixLength(buffer.subarray(0,bytesRead),encoding??'utf8');
+    const next=start+complete;
+    return {cursor:await makeCursor(next),offset:next,
+      text:decodeRemoteLogBytes(file,buffer.subarray(0,complete),{encoding}),
+      reset,resetReason:gone?'file identity changed':shrunk?'file shrank':rewritten?'same-size rewrite':null};
+  }finally{await handle.close();}
+}

package/src/remote-session-guardian.mjs

@@ -10,6 +10,7 @@ import { AUTHORITY_PLANES, parseAuthorityObservation, assertAuthorityVector } fr
 import { readRemoteMarkerSnapshot, deletePinnedRemoteMarker } from './foreground-marker-cas-win32.mjs';
 
 const CLEANUP=['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost'];
+const TRUSTED_WINDOWS_ROOT='C:\\Windows';
 // This inherited IPC channel is an OS-owned parent lifetime handle, not a PID
 // poll. A reused PID cannot keep a new foreground guardian alive.
 let ownerDisconnected=false;
@@ -44,7 +45,7 @@ function markerMatches(marker,{ownerPid,nonce}){
 }
 function invokeCleanup(powershell,launcher,command,stateRoot,probeMode=null){
   const result=spawnSync(powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,command],{
-    stdio:'ignore',windowsHide:true,shell:false,env:windowsPowerShellEnvironment({...process.env,DEADBYTE_STATE_ROOT:stateRoot,
+    stdio:'ignore',windowsHide:true,shell:false,env:windowsPowerShellEnvironment({...process.env,SystemRoot:TRUSTED_WINDOWS_ROOT,WINDIR:TRUSTED_WINDOWS_ROOT,DEADBYTE_STATE_ROOT:stateRoot,
       ...(probeMode?{DEADBYTE_REMOTE_PROBE_MODE:probeMode}:{})}),timeout:probeMode?150000:30000
   });
   return !result.error&&result.status===0;
@@ -52,7 +53,7 @@ function invokeCleanup(powershell,launcher,command,stateRoot,probeMode=null){
 function verifyRevoked(powershell,launcher,stateRoot){
   const result=spawnSync(powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,'status','-Json'],{
     stdio:['ignore','pipe','pipe'],encoding:'utf8',windowsHide:true,shell:false,
-    env:windowsPowerShellEnvironment({...process.env,DEADBYTE_STATE_ROOT:stateRoot}),timeout:30000
+    env:windowsPowerShellEnvironment({...process.env,SystemRoot:TRUSTED_WINDOWS_ROOT,WINDIR:TRUSTED_WINDOWS_ROOT,DEADBYTE_STATE_ROOT:stateRoot}),timeout:30000
   });
   if(result.error||result.status!==0) return null;
   try{
@@ -73,9 +74,7 @@ async function main(){
   if(!/^[0-9a-f]{64}$/.test(nonce)) throw new Error('guardian session nonce invalid');
 
   const launcher=await requireRegular(path.join(root,'bin','DEADBYTE-MCP.ps1'),'stable DEADBYTE launcher');
-  const systemRoot=process.env.SystemRoot||process.env.WINDIR;
-  if(!systemRoot) throw new Error('SystemRoot/WINDIR missing');
-  const powershell=await requireRegular(path.join(systemRoot,'System32','WindowsPowerShell','v1.0','powershell.exe'),'Windows PowerShell');
+  const powershell=await requireRegular(path.join(TRUSTED_WINDOWS_ROOT,'System32','WindowsPowerShell','v1.0','powershell.exe'),'Windows PowerShell');
   const markerPath=path.join(root,'runtime','remote-session.json');
 
   for(;;){

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.48';
+export const DEADBYTE_VERSION = '0.15.49';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/autonomous-local-supervisor.test.mjs

@@ -365,7 +365,7 @@ test('continuous standalone supervisor remains alive after READY and hard-stop o
     await new Promise(resolve=>child.once('exit',()=>resolve()));
     const stale=await observeSupervisor({markerPath:f.markerPath});
     assert.equal(stale.live,false);
-    assert.match(stale.reason,/process_unobservable|pid_reused|identity_mismatch/);
+    assert.match(stale.reason,/process_absent|pid_reused|identity_mismatch/);
     const claimed=await takeoverSupervisor({markerPath:f.markerPath});
     assert.equal(claimed.status,'claimed');
     await releaseSupervisor({markerPath:f.markerPath,instanceNonce:claimed.instance_nonce});

package/test/harness2-eval-context-isolation.test.mjs

@@ -0,0 +1,90 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { runIsolatedEvaluation } from '../src/agent-eval-r42.mjs';
+
+const caseBase = {
+  schema: 'deadbyte.agent-eval-case.v1',
+  case_id: 'harness2-context-boundary',
+  task: 'Return a bounded plan.',
+  acceptance: ['Bounded plan']
+};
+
+test('judge-only oracle token nested in allowed context is rejected before generator invocation', async () => {
+  const token = 'JUDGE_ONLY_38d0f04a8a7b4ae8';
+  let generatorCalls = 0;
+  await assert.rejects(runIsolatedEvaluation({
+    caseSpec: {
+      ...caseBase,
+      allowed_context: {files: [{path: 'context.md', contents: `visible notes: ${token}`}]},
+      hidden_oracle: {graded: {token}}
+    },
+    generator: async () => { generatorCalls++; return {artifact: {plan: ['safe']}}; },
+    judge: async () => ({verdict: 'pass', findings: [], evidence_refs: ['a'.repeat(64)]})
+  }), /judge-only.*context|oracle.*leak/i);
+  assert.equal(generatorCalls, 0);
+});
+
+test('judge-only secret in task or acceptance fails closed without echoing secret', async () => {
+  const token = 'SECRET_4f725e0e1cbe4a15';
+  for (const visible of [
+    {task: `Return ${token}`, acceptance: ['Bounded plan']},
+    {task: 'Return a bounded plan.', acceptance: [`Must not reveal ${token}`]}
+  ]) {
+    let generatorCalls = 0;
+    await assert.rejects(runIsolatedEvaluation({
+      caseSpec: {...caseBase, ...visible, allowed_context: {}, hidden_oracle: {secret: token}},
+      generator: async () => { generatorCalls++; return {artifact: {plan: ['safe']}}; },
+      judge: async () => ({verdict: 'pass', findings: [], evidence_refs: ['a'.repeat(64)]})
+    }), error => {
+      assert.match(error.message, /judge-only.*context/i);
+      assert.equal(error.message.includes(token), false);
+      return true;
+    });
+    assert.equal(generatorCalls, 0);
+  }
+});
+
+test('short explicit judge-only secret is not exempt from context isolation', async () => {
+  let generatorCalls = 0;
+  await assert.rejects(runIsolatedEvaluation({
+    caseSpec: {
+      ...caseBase,
+      allowed_context: {note: 'Visible value K9 is forbidden here'},
+      hidden_oracle: {secret: 'K9'}
+    },
+    generator: async () => { generatorCalls++; return {artifact: {plan: ['safe']}}; },
+    judge: async () => ({verdict: 'pass', findings: [], evidence_refs: ['a'.repeat(64)]})
+  }), /judge-only.*context/i);
+  assert.equal(generatorCalls, 0);
+});
+
+test('nested judge verdict objects cannot enter generator-visible context', async () => {
+  for (const forbidden of ['hidden_oracle', 'judge_result', 'grader_verdict', 'deterministic_eval_result']) {
+    let generatorCalls = 0;
+    await assert.rejects(runIsolatedEvaluation({
+      caseSpec: {
+        ...caseBase,
+        allowed_context: {fixture: {metadata: {[forbidden]: {verdict: 'pass'}}}},
+        hidden_oracle: {expected: 'bounded'}
+      },
+      generator: async () => { generatorCalls++; return {artifact: {plan: ['safe']}}; },
+      judge: async () => ({verdict: 'pass', findings: [], evidence_refs: ['a'.repeat(64)]})
+    }), /judge-only.*context|grader.*context/i);
+    assert.equal(generatorCalls, 0, `${forbidden} must reject before generator dispatch`);
+  }
+});
+
+test('ordinary shared acceptance terms do not trigger oracle isolation tripwire', async () => {
+  let generatorCalls = 0;
+  const result = await runIsolatedEvaluation({
+    caseSpec: {
+      ...caseBase,
+      allowed_context: {visible: 'bounded plan'},
+      hidden_oracle: {expected: 'bounded plan'}
+    },
+    generator: async () => { generatorCalls++; return {artifact: {plan: ['safe']}}; },
+    judge: async () => ({verdict: 'pass', findings: [], evidence_refs: ['a'.repeat(64)]})
+  });
+  assert.equal(result.verdict, 'pass');
+  assert.equal(generatorCalls, 1);
+});

package/test/r108-remote-powershell-path.test.mjs

@@ -0,0 +1,59 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,writeFile,rm} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath,pathToFileURL} from 'node:url';
+
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const systemPowerShell='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+const winTest=process.platform==='win32'?test:test.skip;
+function poisonedRuntimeImport(source,args){
+  return `process.env.SystemRoot='C:\\\\untrusted-root';process.env.WINDIR='C:\\\\untrusted-root';`+
+    `process.argv=[process.execPath,${JSON.stringify(source)},...${JSON.stringify(args)}];`+
+    `await import(${JSON.stringify(pathToFileURL(source).href)});`;
+}
+
+winTest('remote supervisor dispatch ignores poisoned caller Windows roots',async()=>{
+  const scratch=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r108-cli-'));
+  try{
+    await mkdir(path.join(scratch,'bin'));
+    await writeFile(path.join(scratch,'bin','DEADBYTE-MCP.ps1'),
+      "Write-Output ('R108_CONTROLLER_EXECUTED root=' + $env:SystemRoot + ' windir=' + $env:WINDIR)\nexit 0\n",{flag:'wx'});
+    const source=path.join(root,'src','deadbyte-cli.mjs');
+    const result=spawnSync(process.execPath,['--input-type=module','-e',
+      poisonedRuntimeImport(source,['supervisor','status'])],{
+      cwd:root,encoding:'utf8',timeout:15000,windowsHide:true,
+      env:{...process.env,DEADBYTE_STATE_ROOT:scratch}
+    });
+    assert.equal(result.error,undefined,String(result.error));
+    assert.equal(result.status,0,result.stderr);
+    assert.match(result.stdout,/R108_CONTROLLER_EXECUTED root=C:\\Windows windir=C:\\Windows/);
+  }finally{await rm(scratch,{recursive:true,force:true});}
+});
+
+winTest('guardian startup ignores poisoned caller Windows roots before marker lookup',async()=>{
+  const scratch=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r108-guardian-'));
+  try{
+    await mkdir(path.join(scratch,'bin'));
+    await writeFile(path.join(scratch,'bin','DEADBYTE-MCP.ps1'),"exit 0\n",{flag:'wx'});
+    const source=path.join(root,'src','remote-session-guardian.mjs');
+    const result=spawnSync(process.execPath,['--input-type=module','-e',
+      poisonedRuntimeImport(source,['--state-root',scratch,'--owner-pid',String(process.pid),'--session-nonce','a'.repeat(64)])],{
+        cwd:root,encoding:'utf8',timeout:15000,windowsHide:true,
+        env:process.env
+      });
+    assert.equal(result.error,undefined,String(result.error));
+    assert.equal(result.status,0,`guardian startup failed under poisoned roots; stderr=${result.stderr}`);
+  }finally{await rm(scratch,{recursive:true,force:true});}
+});
+
+winTest('trusted Windows PowerShell binary exists for remote lifecycle tests',()=>{
+  const result=spawnSync(systemPowerShell,['-NoLogo','-NoProfile','-Command','exit 0'],{
+    encoding:'utf8',timeout:15000,windowsHide:true,
+    env:{...process.env,SystemRoot:'C:\\Windows',WINDIR:'C:\\Windows'}
+  });
+  assert.equal(result.error,undefined,String(result.error));
+  assert.equal(result.status,0);
+});

package/test/r110-supervisor-powershell-path.test.mjs

@@ -0,0 +1,28 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {copyFile, mkdir, mkdtemp, rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {observeCurrentProcessIdentity} from '../src/autonomous-local-supervisor.mjs';
+
+test('supervisor identity observation ignores an inherited untrusted Windows root', {skip:process.platform!=='win32'}, async () => {
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r110-poisoned-root-'));
+  const shellDir=path.join(root,'System32','WindowsPowerShell','v1.0');
+  const priorRoot=process.env.SystemRoot;
+  const priorWindir=process.env.WINDIR;
+  try {
+    await mkdir(shellDir,{recursive:true});
+    await copyFile('C:\\Windows\\System32\\where.exe',path.join(shellDir,'powershell.exe'));
+    process.env.SystemRoot=root;
+    process.env.WINDIR=root;
+    const identity=await observeCurrentProcessIdentity();
+    assert.ok(identity,'a caller-provided Windows root must not redirect the trusted identity probe');
+    assert.equal(identity.pid,process.pid);
+  } finally {
+    if(priorRoot===undefined) delete process.env.SystemRoot;
+    else process.env.SystemRoot=priorRoot;
+    if(priorWindir===undefined) delete process.env.WINDIR;
+    else process.env.WINDIR=priorWindir;
+    await rm(root,{recursive:true,force:true});
+  }
+});

package/test/r111-supervisor-marker-cas.test.mjs

@@ -0,0 +1,116 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {randomBytes} from 'node:crypto';
+import childProcess from 'node:child_process';
+import {syncBuiltinESMExports} from 'node:module';
+import {promisify} from 'node:util';
+import {existsSync, readFileSync, renameSync, writeFileSync} from 'node:fs';
+import {mkdtemp, readFile, rm, writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+const moduleUrl=new URL('../src/autonomous-local-supervisor.mjs',import.meta.url);
+const freshModule=()=>import(`${moduleUrl.href}?race=${randomBytes(8).toString('hex')}`);
+
+async function withIdenticalReplacement(markerPath,run){
+  const original=childProcess.execFile;
+  let replaced=0;
+  const replace=()=>{
+    if(replaced===0){
+      const before=readFileSync(markerPath);
+      const successor=`${markerPath}.${randomBytes(6).toString('hex')}.successor`;
+      writeFileSync(successor,before,{flag:'wx'});
+      renameSync(successor,markerPath);
+      assert.deepEqual(readFileSync(markerPath),before,'replacement must be byte-identical');
+      replaced++;
+    }
+  };
+  const wrapped=function(...args){replace();return original.apply(this,args);};
+  wrapped[promisify.custom]=function(...args){replace();return original[promisify.custom].apply(original,args);};
+  childProcess.execFile=wrapped;
+  syncBuiltinESMExports();
+  try {
+    const module=await freshModule();
+    await run(module);
+    assert.equal(replaced,1,'replacement must occur after the initial marker observation');
+  } finally {
+    childProcess.execFile=original;
+    syncBuiltinESMExports();
+  }
+}
+
+test('owned supervisor release cannot remove a byte-identical successor marker', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r111-release-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    const baseline=await freshModule();
+    const claim=await baseline.claimSupervisor({markerPath});
+    const original=await readFile(markerPath);
+    await withIdenticalReplacement(markerPath,async({releaseSupervisor})=>{
+      await assert.rejects(releaseSupervisor({markerPath,instanceNonce:claim.instance_nonce}),/changed before release: CHANGED/i);
+    });
+    assert.equal(existsSync(markerPath),true,'successor must survive release');
+    assert.deepEqual(await readFile(markerPath),original);
+  } finally { await rm(root,{recursive:true,force:true}); }
+});
+
+test('stale supervisor takeover cannot overwrite a byte-identical successor marker', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r111-takeover-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    const baseline=await freshModule();
+    const claim=await baseline.claimSupervisor({markerPath});
+    const stale={...claim.marker,creation_time_utc:'2000-01-01T00:00:00.000Z'};
+    await writeFile(markerPath,`${JSON.stringify(stale)}\n`);
+    const original=await readFile(markerPath);
+    await withIdenticalReplacement(markerPath,async({takeoverSupervisor})=>{
+      await assert.rejects(takeoverSupervisor({markerPath}),/changed during takeover: CHANGED/i);
+    });
+    assert.equal(existsSync(markerPath),true,'successor must survive takeover');
+    assert.deepEqual(await readFile(markerPath),original);
+  } finally { await rm(root,{recursive:true,force:true}); }
+});
+
+test('unobservable process identity cannot authorize takeover or remove its marker', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r111-unobservable-'));
+  const markerPath=path.join(root,'owner.json');
+  const originalExec=childProcess.execFile;
+  try {
+    const baseline=await freshModule();
+    await baseline.claimSupervisor({markerPath});
+    const originalMarker=await readFile(markerPath);
+    const denied=function(...args){
+      const callback=args.at(-1);
+      if(typeof callback==='function') callback(new Error('process lookup denied'));
+      return null;
+    };
+    denied[promisify.custom]=()=>Promise.reject(new Error('process lookup denied'));
+    childProcess.execFile=denied;
+    syncBuiltinESMExports();
+    const module=await freshModule();
+    await assert.rejects(module.takeoverSupervisor({markerPath}),/unverified|unobservable|lookup|identity/i);
+    assert.deepEqual(await readFile(markerPath),originalMarker,'uncertain lookup must not delete a live owner marker');
+  } finally {
+    childProcess.execFile=originalExec;
+    syncBuiltinESMExports();
+    await rm(root,{recursive:true,force:true});
+  }
+});
+
+test('same live process with mismatched image evidence cannot be taken over', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r111-image-drift-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    const module=await freshModule();
+    const claim=await module.claimSupervisor({markerPath});
+    const mismatched={...claim.marker,image_sha256:'f'.repeat(64)};
+    await writeFile(markerPath,`${JSON.stringify(mismatched)}\n`);
+    const before=await readFile(markerPath);
+    const observation=await module.observeSupervisor({markerPath});
+    assert.equal(observation.reason,'identity_mismatch');
+    assert.equal(observation.observation.pid,process.pid);
+    assert.equal(observation.observation.creation_time_utc,claim.marker.creation_time_utc);
+    await assert.rejects(module.takeoverSupervisor({markerPath}),/unverified|live|identity/i);
+    assert.deepEqual(await readFile(markerPath),before,'live owner with image drift must retain marker');
+  } finally { await rm(root,{recursive:true,force:true}); }
+});

package/test/r112-supervisor-claim-cas.test.mjs

@@ -0,0 +1,63 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {access, mkdir, mkdtemp, readFile, rm, symlink, unlink, writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {claimSupervisor, observeSupervisor} from '../src/autonomous-local-supervisor.mjs';
+
+async function withJunctionFixture(nested,run){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r112-claim-'));
+  const outside=path.join(root,'outside');
+  const parent=nested?path.join(root,'state','runtime'):path.join(root,'state');
+  const link=path.join(parent,'redirect');
+  await mkdir(parent,{recursive:true});
+  await mkdir(outside);
+  try {
+    await symlink(outside,link,'junction');
+    return await run({markerPath:path.join(link,'owner.json'),outside});
+  } finally {
+    await unlink(link).catch(()=>{});
+    await rm(root,{recursive:true,force:true});
+  }
+}
+
+for(const nested of [false,true]){
+  test(`supervisor claim rejects ${nested?'nested ':' '}parent junction before creating marker`,{skip:process.platform!=='win32'},async()=>{
+    await withJunctionFixture(nested,async({markerPath,outside})=>{
+      await assert.rejects(claimSupervisor({markerPath}),/reparse|pinned|failed closed|ancestor/i);
+      await assert.rejects(access(path.join(outside,'owner.json')),{code:'ENOENT'});
+    });
+  });
+}
+
+test('supervisor claim does not create a missing directory through a parent junction',{skip:process.platform!=='win32'},async()=>{
+  await withJunctionFixture(false,async({markerPath,outside})=>{
+    const redirected=path.join(path.dirname(markerPath),'new-child','owner.json');
+    await assert.rejects(claimSupervisor({markerPath:redirected}),/reparse|pinned|failed closed|ancestor|missing/i);
+    await assert.rejects(access(path.join(outside,'new-child')),{code:'ENOENT'});
+  });
+});
+
+test('supervisor claim requires an existing trusted marker parent',{skip:process.platform!=='win32'},async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r112-missing-parent-'));
+  const parent=path.join(root,'new-runtime');
+  try {
+    await assert.rejects(claimSupervisor({markerPath:path.join(parent,'owner.json')}),/parent|pinned|failed closed|missing/i);
+    await assert.rejects(access(parent),{code:'ENOENT'});
+  } finally { await rm(root,{recursive:true,force:true}); }
+});
+
+test('live image mismatch is unverified, not a stale-owner assertion',{skip:process.platform!=='win32'},async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r112-status-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    const claim=await claimSupervisor({markerPath});
+    const modified={...claim.marker,image_sha256:'f'.repeat(64)};
+    await writeFile(markerPath,`${JSON.stringify(modified)}\n`);
+    const observed=await observeSupervisor({markerPath});
+    assert.equal(observed.reason,'identity_mismatch');
+    assert.equal(observed.observation.pid,process.pid);
+    assert.equal(observed.status,'unverified');
+    assert.deepEqual(JSON.parse(await readFile(markerPath,'utf8')),modified);
+  } finally { await rm(root,{recursive:true,force:true}); }
+});

package/test/r113-supervisor-cleanup-terminality.test.mjs

@@ -0,0 +1,100 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {randomBytes} from 'node:crypto';
+import childProcess from 'node:child_process';
+import {syncBuiltinESMExports} from 'node:module';
+import {promisify} from 'node:util';
+import {readFileSync, renameSync, writeFileSync} from 'node:fs';
+import {mkdtemp, readFile, rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+const moduleUrl=new URL('../src/autonomous-local-supervisor.mjs',import.meta.url);
+
+async function withReleaseReplacement(markerPath,run){
+  const original=childProcess.execFile;
+  let armed=false;
+  let replaced=0;
+  const replace=()=>{
+    if(!armed||replaced) return;
+    const before=readFileSync(markerPath);
+    const successor=`${markerPath}.${randomBytes(6).toString('hex')}.successor`;
+    writeFileSync(successor,before,{flag:'wx'});
+    renameSync(successor,markerPath);
+    assert.deepEqual(readFileSync(markerPath),before);
+    replaced++;
+  };
+  const wrapped=function(...args){replace();return original.apply(this,args);};
+  wrapped[promisify.custom]=function(...args){replace();return original[promisify.custom].apply(original,args);};
+  childProcess.execFile=wrapped;
+  syncBuiltinESMExports();
+  try {
+    const module=await import(`${moduleUrl.href}?cleanup=${randomBytes(8).toString('hex')}`);
+    await run({module,arm:()=>{armed=true;},replacementCount:()=>replaced});
+    assert.equal(replaced,1,'test must replace the marker at cleanup time');
+  } finally {
+    childProcess.execFile=original;
+    syncBuiltinESMExports();
+  }
+}
+
+test('startup failure retains both primary and cleanup failure and preserves successor marker', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r113-start-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    await withReleaseReplacement(markerPath,async({module,arm})=>{
+      const policy={get planner(){arm();throw new Error('PRIMARY_START_FAILURE');}};
+      const runtime={policy};
+      await assert.rejects(module.startLocalSupervisorHost({runtime,policy,markerPath}),error=>{
+        assert.ok(error instanceof AggregateError,'cleanup failure must not be discarded');
+        assert.match(String(error.errors[0]),/PRIMARY_START_FAILURE/);
+        assert.match(String(error.errors[1]),/changed before release: CHANGED/i);
+        return true;
+      });
+      assert.ok((await readFile(markerPath)).length>0,'uncertain successor marker must survive');
+    });
+  } finally { await rm(root,{recursive:true,force:true}); }
+});
+
+test('failed stop never reports stopped on retry or deletes a changed marker', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r113-stop-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    await withReleaseReplacement(markerPath,async({module,arm,replacementCount})=>{
+      const policy={evidence_dir:root,planner:{backend:'client_sampling'}};
+      const runtime={policy};
+      const host=await module.startLocalSupervisorHost({runtime,policy,markerPath,continuous:false});
+      arm();
+      await assert.rejects(host.stop(),/changed before release: CHANGED/i);
+      assert.equal(replacementCount(),1);
+      const survivor=await readFile(markerPath);
+      await assert.rejects(host.stop(),/changed before release: CHANGED|cleanup|uncertain/i);
+      assert.deepEqual(await readFile(markerPath),survivor,'retry must not remove the byte-identical successor');
+    });
+  } finally { await rm(root,{recursive:true,force:true}); }
+});
+
+test('ordinary startup rejection releases owned marker and retains the primary error', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r113-start-clean-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    const module=await import(`${moduleUrl.href}?clean=${randomBytes(8).toString('hex')}`);
+    const policy={evidence_dir:root,planner:{backend:'client_sampling'}};
+    await assert.rejects(module.startLocalSupervisorHost({runtime:{policy},policy,markerPath,idleDelayMs:0}),
+      /idleDelayMs out of range/);
+    assert.equal((await module.observeSupervisor({markerPath})).reason,'no_owner');
+  } finally { await rm(root,{recursive:true,force:true}); }
+});
+
+test('concurrent stop calls share one verified cleanup outcome', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r113-stop-concurrent-'));
+  const markerPath=path.join(root,'owner.json');
+  try {
+    const module=await import(`${moduleUrl.href}?concurrent=${randomBytes(8).toString('hex')}`);
+    const policy={evidence_dir:root,planner:{backend:'client_sampling'}};
+    const host=await module.startLocalSupervisorHost({runtime:{policy},policy,markerPath,continuous:false});
+    const results=await Promise.all([host.stop(),host.stop()]);
+    assert.deepEqual(results,[{status:'stopped'},{status:'stopped'}]);
+    assert.equal((await module.observeSupervisor({markerPath})).reason,'no_owner');
+  } finally { await rm(root,{recursive:true,force:true}); }
+});