deadbyte-mcp 0.15.52 → 0.15.53

package/MANIFEST.SHA256

@@ -38,7 +38,7 @@ fa0dcc4cde9c03e978c9f9dd24b62afa83f49bdada1f42ead544a9a17edd332f  bridge/src/bri
 fa2073209516279eb6324dc5e51b438c583d33922bf4bb9178c0aec8224abd94  bridge/src/public-tool-definitions.mjs
 fb5f27a0d324f5e500feb612f86069fe57f6de537aad6d3df2a3abff8923b1be  bridge/src/r40-governor.mjs
 2a54dd491431a3041ac7a48fc9af13ae5f92c8c5a6ef6869ebacc15f49e57936  bridge/src/reconnect-delay-r60.mjs
-c02261aa429166517d36cdd18f1ab9a09077d9341f9818a7955ad02cff937851  bridge/src/remote-call-claims-r60.mjs
+b963f3256f407b4216343815d310f9dce06ac61633c3b45071be6712ebb357d2  bridge/src/remote-call-claims-r60.mjs
 7e094bb44f74f1bfe0aeb065d6f8d2e61fb494587c2c898d335da2a12e24cb02  bridge/src/remote-dispatch-r60.mjs
 8653d36e373f7c604b4f5e78b446e6a9c3974bfc39a9e346c3fd5abe1f910b3c  CONTEXT.md
 3ffd977e819e0d68bd62dad2dadd7481b25c508ebd8042bec2b706cea8ce16f9  controller/deadbyte-controller.config.psd1.example
@@ -46,7 +46,7 @@ d212dfb2ed0049ea54a62fca07847143a2485a8ba09a7e20fc1cdd58593b5ce0  controller/dea
 331d168750a18d2b8e351796ddbf8f9619374c707c3cea18b8b166934f8af0d3  controller/deadbyte-desktop-policy.json
 5e8ef223b0dbc52173aaf044a075837eef8964ff0e7e16f83a595e0d17695625  controller/deadbyte-host-policy.json.example
 6f0cc469f51444dd18211fa3346c826abeea4d2ec7a8945f0200dc5c622031ef  controller/DEADBYTE-MCP.cmd
-f2a746213e85d7b0809c59c047c4bdcc993563ac87637d864454ed40c9098d08  controller/deadbyte-process-policy.json
+10f447690fb72b8f7d23678dbb3e1d2b95d071af42f4a01796b5e9a02fca912a  controller/deadbyte-process-policy.json
 d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b  controller/deadbyte-semantic-lsp-config.json
 3023d2985f5b6e5cc7c0d08cb8b342b362c93dce7ebd4224635362194be40cf2  controller/README.TXT
 101e613518c73c6aa31c725fe1b5f9a24c995dc9876b7b28e1f3e97ac9f8d362  DEADBYTE-MCP-R27-FINAL/R27-ADMIN-CLOSURE.json
@@ -1394,8 +1394,8 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-9b3041123739c4ccb8e8860d47c0ad5e9957bae60a6d878a780309e23e46114e  package.json
-54fb261169cb263aebebf05f5387e1bc0aefd9013c43c53ef2f4506135ace3a5  PROVENANCE.json
+dbbbcc1804eb36bedb297cf14487a3b97fe40e9a506f6aeb0052ed3d80c415f3  package.json
+2822011499a153ddd4389dfe0805cb58195d12f0b1d84c30041fd9c0ba15ead1  PROVENANCE.json
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
 0b7ec5ee347ddfa6cca59740fc7a8fe3fc5d51406265bb12189e82fa106319d2  R41-PARENT.json
 bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.json
@@ -1404,9 +1404,9 @@ f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.jso
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
 3dc607603fea511e2f428e9546a875ab7e38b6a0bbd5e803e4510de082f30804  R49-PARENT.json
-9b938cd5f3ff30c1e1e554abb3dc873a433f33ec1a9dc8e1470a17547af87be2  README.txt
-1f4bbc7a8abd5849e7162447f2935d4e245e7bf94521141a5bd3112119ac10b9  RELEASE.json
-8041efe7842db00a9a22f303e557040e495f7d0b7dc756cdaca0c7660c71fa18  SBOM.cdx.json
+6b5b4f90c4fdc6667722d55b7d52d6acacfd655fe9bc85e786ea724fab438661  README.txt
+a8fe4687c17920eaaf0bbe03f88d3d0e3742fbc5c0f0f4e87f984c853b40a92e  RELEASE.json
+6759a82259a0c21323dce97851c237e16bbd68b49a676637a068ef5da53985f9  SBOM.cdx.json
 7c86062c4f69db3179a129d65945ccfab1b1c1c5bcc29b91383eac097d50f2aa  scripts/activate-skill-creator-1.1.1.mjs
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
@@ -1743,7 +1743,7 @@ dcd4c9784e88e253e91ddad3c24b38cb0b36906ed737f6d7bee7712360f66f7a  src/containmen
 fe1761b98738e1aea1d25ddf3a0ba56ccad95a43d45104a89b8665197c7c9e18  src/containment-result.mjs
 705a89cb12fedb993d55dfed32a5870d33e10db26422c944d1e52223566c096c  src/containment-smoke.mjs
 63a1d4d6a53f9eb7e02197b4e42158b867da8c042c2e61848d8a36cd398b8bd8  src/context-provenance.mjs
-5519f4979ed05f8fe9dbde5d1b8e740065ba556964539fba8bf3256699a0776d  src/deadbyte-cli.mjs
+91b0dacb14cc9ea35b06fc20d1108d3a4729f415871ef927b6a1679b5599d207  src/deadbyte-cli.mjs
 9e9766d64dcc9e2c8d23c2c0a5e9dcb87b7213e8de668f79f593ad48daf15acd  src/deadline-cancellation.mjs
 fe7a8f8611c33552b3da466a9b866ce79a737bfd5b9a78a953269b30cce16274  src/desktop-contract.mjs
 f97352e510c659910c2d4a874d15be028e1291d685c6c1a7be53bdf1a335c2d8  src/desktop-input-r40.mjs
@@ -1886,13 +1886,13 @@ c99c2402fb0df4f68634fa906eb198c551c55dad9f0921a7b8ed6e33d503884e  src/tunnel-std
 aa765e9a28c69ff58a5b5a0d29b49ea181af4db9076633b102dbca25861e708e  src/tunnel-stdio-compat.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-c38135acfcf4db68a28d83bd09b1e33762e89f444703f79134fd80ee119c54cb  src/version.mjs
+45a61c47e1e6b1d8fd0787206ba73c6210e0a7e85f7b2149c2c3f58f6c0da806  src/version.mjs
 acf5f5a57779bc0529f9db3d821f0ef1b53d22063aa237041348c1ca444ea677  src/windows-powershell-environment.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs
 1bd637e7634ca0259791c5108fcf324554f70b1db49e5eac3505287c04bbc3be  STABILIZATION-PROGRESS.md
-7c51693f64b3aceb56f03c8b3ffc86b41b9b5e2c160080ec2b88a452925c5705  TEST-MATRIX.json
+1bc41f5442530b17745205035afd7be1fe98e590e5e8413a47473bb0ce521c91  TEST-MATRIX.json
 e4f1fb97545f23772ddff28ad3f9954a4714f9854062fca62e0e12c1cb2ec4ae  test/agent-backend-r44.test.mjs
 2a78c818058b25efdc143a3a97c832da231ccd6ff9d90c7796d681a0251b85c4  test/agent-crash-child.mjs
 d9461ab7c118ee75d37a2d6f5e637d7e43505af6a9ad8c7ddafffc8ace185a5b  test/agent-crash-worker.mjs
@@ -2146,9 +2146,9 @@ ce163ee9f288e30a213636e2267b8630016ef8a170f12286e8cdd44219bdab32  test/r124-live
 17475b51e416ae678f959f8975fab8497eb7c57d13e36cac8656c0e1f7424c0c  test/r126-restore-policy-envelope.test.mjs
 1721d4bd3bb58c10ad9d86b69ad1d993ec5a1e6315c95b28fa50ab67d4ca302a  test/r127-restore-append-policy-boundary.test.mjs
 b3d3dda398c94d18e2e156bde65d1338000233407b435134ba0c16175d96620b  test/r129-sdk-security-baseline.test.mjs
-effe0e9a6b3db487a3ec748289b35a00e9f3c405195255850f7a06762e783bf7  test/r130-release-security-contract.test.mjs
+2f45d87bf72e4abd5df568694624d69dcbdb605bf456f6f5dd47a49bcb63a546  test/r130-release-security-contract.test.mjs
 bb7963baf412ec0f5aca183f6dd98eda9026fe763017f9af595581b521ae6cb7  test/r131-installed-manifest-boundary.test.mjs
-d79a7128e1a7a1a75196c51e62e39ec26d93c73ada8ab82b91ad9910ea74c7e6  test/r132-release-identity.test.mjs
+626721a443fdec3cd0c4e8abe4f59bc56d2e01fe879e74bed3f5a1626a5b5064  test/r132-release-identity.test.mjs
 acd236a4d8ba035007bde4166a521b8d4e6044f58c52c0bae9cb42fa75338533  test/r135-autonomous-scope.test.mjs
 3fcf657aae1f8466abc5ab82bb5a619966ea9b8a33d4a95a5a5246df5bf3afa1  test/r136-scoped-command-rights.test.mjs
 e0c466f25b35eb894166df792b71b23924610d32363756c75ff437dfdaa12a4c  test/r136-scoped-observer.test.mjs
@@ -2165,6 +2165,8 @@ c14e6c17defb3eac062ae7429742cb9ac9a3d9aa2bd806754149a37b7dbb0180  test/r139-proc
 b0af7054d5ef9e67af86b5959ff73f6e988992318dc39dd3ee64d4fa7859e8b0  test/r141-commander-tail-utf8.test.mjs
 a21d029a174c7ae069997b284d01ba6708db388dbdf4c6fa24c3a672f0133b8d  test/r141-real-windows-disk.test.mjs
 7c6dddd97f1508d46ffffc2e06b25c077ebbc8f54d44d739619a028436317bec  test/r142-native-machinefs-authority.test.mjs
+79f87493bff0c5bfa06dbd8d51845f292dc3cabc95f9bcd937e3aa90330731ef  test/r144-claim-terminal-history.test.mjs
+ef0665adaab2a2b2d6ca8611a6335ded96b8e65a9661840acd139d3c86710e62  test/r144-controller-broad-roots-cleanup.test.mjs
 3c5c3724bce89aa1fa59fe97cc346c40a5674bb5cd6dc3e2f31b86f2d62e75e4  test/r33-closeout-regression.test.mjs
 5e3700ee610442dfd7b7ae5e380263f231438be0e32790597142c41362a53c9a  test/r33-finalization.test.mjs
 7e419d3c1caf79bfc7407207f50e5645298f9b19d91a7d6f595af185b92cd55e  test/r36-finalization.test.mjs
@@ -2230,7 +2232,7 @@ ca8e23abc89f3eadeceb4b6fdad2cb4db5a7933029ece8e8beae2c6a158876b7  test/r58-owner
 8fc5ed1d3088facf45f9578d9ff8514c3a633f7f342d15eec316e129e7a916c0  test/r58-stale-owner.test.mjs
 84be7ee7d167eb06c9f9fc178930daaa81e53a91de40bad6d7df2060bd3dd165  test/r58-windows-gate.test.mjs
 76db2a4009d76b86e1da57b91a96b0d6bfeb4063bec3301ede736e2fd5832f39  test/r59-release-contract.test.mjs
-a2b6779e6cbc8e23859b42383440b9e08a631e9b0bfa0a92d000ec236769e423  test/r59-tool-surface-compat.test.mjs
+16f1e5b1f3b95341969c604e2355b71764cf35fbcd6cdc18447ce5fd40eb9fc8  test/r59-tool-surface-compat.test.mjs
 3befd5d4dc4d8ca9e1f6cbeb9c430671e676c5696d6ee5931c2cbe3244c558a4  test/r60-authority-coherence.test.mjs
 60577e231c7d164f57a3960c574d3e369ca140d9dbc477b2444fa62dbf224e51  test/r60-authority-enforcement.test.mjs
 a1fa0b1e529da05f3659a33be6d36dab02f93808638cf0f458d057e9c6d1e35b  test/r60-bridge-dispatch.test.mjs
@@ -2328,7 +2330,7 @@ a4f4e675703d6208d2ca51151273f97e547927d6f44d8b95c88309b3ee002008  test/r72-stagi
 c26ac29f6e47e21cc3d20331391295c4f57c20bc1a9094f27079ee60c11ab75b  test/r72-staging-workspace-isolation.test.mjs
 20cc37b85fd61870fc51b01aeba7e7bb4e31fd6529dc38ad42e52b1549c412f8  test/r73-package-boundary.test.mjs
 ff8d6c7998053a20a0d6a855d4a0013f0f19e649b91731d970e647242bb66e86  test/r74-kernel-lock.test.mjs
-6e28226fecd5a13701dbc5f2812ae4e21c9ac65b4eea14a158d040a1db3b213f  test/r74-prepublish-contract.test.mjs
+6903c010b285a7551d1f77fa2a3b56bad74db45b2cacd747da75fea33ef839ab  test/r74-prepublish-contract.test.mjs
 d283a882b9d7bb38b8d6a0db97882fcaf9b6dfa717aca79dd0351012cc00ba23  test/r75-activation-authority-proof.test.mjs
 38b66147b550c1d1e068ebaa9f8de93a070c08a8a99e0ddee7970b0374c4bfc5  test/r75-authority-evidence.test.mjs
 993186133dc7620bcd3057efda9a0ba1435c938656e4b24a32ace4ce57ea9735  test/r76-pinned-marker-cas.test.mjs

package/PROVENANCE.json

@@ -1,9 +1,9 @@
 {
   "schema": "deadbyte.provenance.v1",
-  "version": "0.15.52",
-  "source_model": "published 0.15.51 -> R137-R142 isolated Commander/MachineFS successors -> R143 0.15.52 release candidate",
+  "version": "0.15.53",
+  "source_model": "published 0.15.52 -> R144 bounded remote claim recovery and fail-closed authority cleanup",
   "signing": "ed25519",
-  "parent_tarball_sha256": "69586dc07dc7a3025ec44f08e6b0eab60c1f9e75287da77c850b49e320b201ff",
+  "parent_tarball_sha256": "ec675df8885a0d96b1486607956b7091fe47088509b4756194a7e15004d8d97f",
   "parent_activation_status": "PRODUCTION_ACTIVE",
   "parent_rollback_receipt_sha256": null,
   "runtime_predecessor": {
@@ -11,8 +11,8 @@
     "manifest_sha256": "34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc",
     "generation_manifest_sha256": "ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4"
   },
-  "source_predecessor_manifest_file_sha256": "ef27d35d0d3102b356fcb17478abefa82fae2375df27f913ce3b0ff0e5815a7e",
-  "reproducibility": "R143 isolated 0.15.52 candidate from R142 native-authority development, predecessor 0.15.51 published tarball SHA-256 69586dc07dc7a3025ec44f08e6b0eab60c1f9e75287da77c850b49e320b201ff; production 0.15.45 unchanged",
+  "source_predecessor_manifest_file_sha256": "e00223a76ef6d0e0fa7e850de597fa44cd6113cd49725535492da73f1daf4244",
+  "reproducibility": "R144 isolated 0.15.53 candidate from published 0.15.52 tarball SHA-256 ec675df8885a0d96b1486607956b7091fe47088509b4756194a7e15004d8d97f; production 0.15.45 unchanged pending separate activation approval",
   "public_surface_evidence": {
     "status": "PASS",
     "baseline_release": "v0.15.35-1b5715b276facbc0",
@@ -76,12 +76,12 @@
     "stdio_aggregate_p95_delta_pct": 1.984392678457768,
     "limitations_preserved": true
   },
-  "builder": "deadbyte-r143-commander-machinefs-release-candidate",
+  "builder": "deadbyte-r144-remote-recovery-release-candidate",
   "parent_release_id": "v0.15.45-34aa8d1241cfb8bf",
   "parent_manifest_sha256": "34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc",
   "parent_generation_manifest_sha256": "ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4",
-  "source_predecessor_version": "0.15.51",
-  "source_predecessor_tarball_sha256": "69586dc07dc7a3025ec44f08e6b0eab60c1f9e75287da77c850b49e320b201ff",
+  "source_predecessor_version": "0.15.52",
+  "source_predecessor_tarball_sha256": "ec675df8885a0d96b1486607956b7091fe47088509b4756194a7e15004d8d97f",
   "operator_override": {
     "four_hour_soak": "WAIVED_BY_OPERATOR",
     "clean_machine": "WAIVED_BY_OPERATOR",
@@ -274,5 +274,13 @@
     "r143_registry_publication": "NOT_RUN",
     "production_predecessor_version": "0.15.45",
     "production_deployment": "NOT_RUN"
+  },
+  "r144": {
+    "terminal_claim_history_recovery": "PASS_FOCUSED_AND_117K_FILE_PRODUCTION_STATE",
+    "broad_root_cleanup": "PASS_FOCUSED_NO_EPOCH_MUTATION",
+    "protected_full_regression": "PASS_1822_TOTAL_1773_PASS_49_SKIP_0_FAIL",
+    "public_named_tunnel": "PASS_SIGNED_MACHINE_PING",
+    "controller_lifecycle": "PASS_START_RESTART_STOP_ISOLATED_PROTECTED_CANDIDATE",
+    "production_activation": "DEFERRED_SEPARATE_OWNER_APPROVAL"
   }
 }

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.15.52 / R143 ISOLATED RELEASE CANDIDATE
+DEADBYTE MCP V0.15.53 / R144 REMOTE RECOVERY
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -16,12 +16,12 @@ check `--version` before issuing a stateful command. The compatibility CMD
 fails with an explanation when npm is detected rather than forwarding the
 wrong command to the controller.
 
-  npx -y deadbyte-mcp@0.15.52 mcp
-  npx -y deadbyte-mcp@0.15.52 remote
-  npx -y deadbyte-mcp@0.15.52 remote status
-  npx -y deadbyte-mcp@0.15.52 remote restart
-  npx -y deadbyte-mcp@0.15.52 audit status
-  npx -y deadbyte-mcp@0.15.52 audit verify
+  npx -y deadbyte-mcp@0.15.53 mcp
+  npx -y deadbyte-mcp@0.15.53 remote
+  npx -y deadbyte-mcp@0.15.53 remote status
+  npx -y deadbyte-mcp@0.15.53 remote restart
+  npx -y deadbyte-mcp@0.15.53 audit status
+  npx -y deadbyte-mcp@0.15.53 audit verify
 
 MAJOR MCP CLIENT STDIO CONFIGS
 -------------------------------
@@ -32,7 +32,7 @@ CLAUDE DESKTOP
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.52", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.53", "mcp"]
       }
     }
   }
@@ -44,7 +44,7 @@ Save as .cursor/mcp.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.52", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.53", "mcp"]
       }
     }
   }
@@ -57,7 +57,7 @@ Save as .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.52", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.53", "mcp"]
       }
     }
   }
@@ -67,7 +67,7 @@ Add to the Codex MCP configuration:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.15.52", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.53", "mcp"]
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.
@@ -356,7 +356,7 @@ CONTROLLER
 ----------
 Primary operator entry point:
 
-  npx -y deadbyte-mcp@0.15.52 remote
+  npx -y deadbyte-mcp@0.15.53 remote
 
 The legacy CMD entry remains compatibility-only for R33 rollback safety.
 
@@ -417,7 +417,7 @@ MCP CLIENT CONFIGURATION
 ------------------------
 The local stdio entry point is quiet and suitable for MCP hosts:
 
-  npx -y deadbyte-mcp@0.15.52 mcp
+  npx -y deadbyte-mcp@0.15.53 mcp
 
 CLAUDE DESKTOP
 Use the standard local-server entry in claude_desktop_config.json:
@@ -426,7 +426,7 @@ Use the standard local-server entry in claude_desktop_config.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.52", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.53", "mcp"]
       }
     }
   }
@@ -439,7 +439,7 @@ Create .cursor/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.52", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.53", "mcp"]
       }
     }
   }
@@ -452,7 +452,7 @@ Create .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.52", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.53", "mcp"]
       }
     }
   }
@@ -462,9 +462,9 @@ Add this to ~/.codex/config.toml:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.15.52", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.53", "mcp"]
 
-The remote device path remains `npx -y deadbyte-mcp@0.15.52 remote`. Remote public MCP uses the
+The remote device path remains `npx -y deadbyte-mcp@0.15.53 remote`. Remote public MCP uses the
 verified HTTPS named-tunnel URL selected by the active generation; do not commit a private device
 URL or tunnel token into a repository.
 

package/RELEASE.json

@@ -1,9 +1,9 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.52",
-  "train": "R143",
-  "label": "R143 COMMANDER AND MACHINEFS HARDENING / ISOLATED RELEASE CANDIDATE",
+  "version": "0.15.53",
+  "train": "R144",
+  "label": "R144 REMOTE RECOVERY / VERIFIED PUBLIC NPM CANDIDATE",
   "protocol_revision": "2026-07-28",
   "parent": {
     "version": "0.15.45",
@@ -19,10 +19,10 @@
     "generation_manifest_sha256": "ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4"
   },
   "source_predecessor": {
-    "version": "0.15.51",
-    "source_path": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\evidence\\npm-publication\\0.15.51\\deadbyte-mcp-0.15.51.tgz",
+    "version": "0.15.52",
+    "source_path": "D:\\Projects\\deadbyte-mcp\\testing\\r144-remote-recovery\\source-predecessor-0.15.52\\deadbyte-mcp-0.15.52.tgz",
     "release_status": "REGISTRY_PUBLISHED",
-    "tarball_sha256": "69586dc07dc7a3025ec44f08e6b0eab60c1f9e75287da77c850b49e320b201ff"
+    "tarball_sha256": "ec675df8885a0d96b1486607956b7091fe47088509b4756194a7e15004d8d97f"
   },
   "consolidation": {
     "frontend_status_vocabulary": true,
@@ -388,5 +388,19 @@
     "npm_publish": "NOT_RUN",
     "production_activation": "NOT_RUN",
     "stable_final_claim": false
+  },
+  "r144": {
+    "release_candidate_version": "0.15.53",
+    "source_predecessor_version": "0.15.52",
+    "source_predecessor_tarball_sha256": "ec675df8885a0d96b1486607956b7091fe47088509b4756194a7e15004d8d97f",
+    "production_predecessor_version": "0.15.45",
+    "terminal_claim_history_recovery": "PASS",
+    "broad_root_disarmed_cleanup": "PASS",
+    "protected_full_regression": "PASS_1822_TOTAL_1773_PASS_49_SKIP_0_FAIL",
+    "public_named_tunnel_machine_ping": "PASS",
+    "controller_start_restart_stop": "PASS_ISOLATED_PROTECTED_CANDIDATE",
+    "npm_publish": "PENDING",
+    "production_activation": "DEFERRED_SEPARATE_OWNER_APPROVAL",
+    "stable_final_claim": false
   }
 }

package/SBOM.cdx.json

@@ -1,13 +1,13 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:cdx:deadbyte-mcp:r143:0.15.52",
+  "serialNumber": "urn:cdx:deadbyte-mcp:r144:0.15.53",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "deadbyte-mcp",
-      "version": "0.15.52"
+      "version": "0.15.53"
     }
   },
   "components": [

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.52",
-  "train": "R143",
+  "version": "0.15.53",
+  "train": "R144",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",
@@ -10,6 +10,21 @@
     "schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
   },
   "required": [
+    {
+      "id": "r144-protected-native-full",
+      "command": "node --test --test-concurrency=4 test/*.test.mjs on exact protected candidate",
+      "expected": "1822 total, 1773 pass, 49 classified skip, zero failures"
+    },
+    {
+      "id": "r144-public-remote-lifecycle",
+      "command": "protected candidate controller start, signed public machine ping, restart, signed public machine ping, stop",
+      "expected": "Public named tunnel calls pass and all owned processes are stopped"
+    },
+    {
+      "id": "r144-package-and-registry",
+      "command": "node scripts/npm-release-r48.mjs --publish-only",
+      "expected": "Exact tarball identity, registry readback and external npx smoke pass; production activation deferred"
+    },
     {
       "id": "r143-protected-native-full",
       "command": "node --test --test-concurrency=4 test/*.test.mjs on exact R143 protected installed tree",

package/bridge/src/remote-call-claims-r60.mjs

@@ -133,9 +133,14 @@ export function openRemoteCallClaims({root,clock=Date.now}={}){
         names=await readdir(folder);
       }catch(error){if(error?.code==='ENOENT')continue;throw error;}
       if(names.length>4096)throw new Error('remote recovery shard exceeds bounded inventory');
+      // Terminal claims have no recovery work. Checking same-shard terminal names
+      // avoids re-reading large immutable history before bridge readiness.
+      // Duplicate requests still validate claim + terminal bytes in state().
+      const terminalIds=new Set(names.filter(item=>/^[0-9a-f]{64}\.terminal\.json$/.test(item)).map(item=>item.slice(0,64)));
       for(const name of names.filter(item=>/^[0-9a-f]{64}\.claim\.json$/.test(item)).sort()){
         const id=name.slice(0,64);
         if(after&&id<=after)continue;
+        if(terminalIds.has(id))continue;
         if(records.length>=limit){more=true;break;}
         const claimRecord=await readExact(files(id).claim);
         if(!claimRecord||claimRecord.schema!=='deadbyte.remote-call-claim.v1')throw new Error('remote recovery claim corrupt');

package/controller/deadbyte-process-policy.json

@@ -1,15 +1,15 @@
 {
   "schema": "deadbyte.process-policy.v1",
   "enabled": true,
-  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-epoch-transition-audit-dev\\controller\\runtime\\process-grant.json",
-  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-epoch-transition-audit-dev\\controller\\runtime\\process-state",
+  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r144-remote-recovery-dev\\controller\\runtime\\process-grant.json",
+  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r144-remote-recovery-dev\\controller\\runtime\\process-state",
   "native_host": {
-    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-epoch-transition-audit-dev\\bin\\deadbyte-process-host.exe",
+    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r144-remote-recovery-dev\\bin\\deadbyte-process-host.exe",
     "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {
-      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-epoch-transition-audit-dev",
+      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r144-remote-recovery-dev",
       "deny_paths": [
         "node_modules",
         "controller/runtime",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.52",
+  "version": "0.15.53",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/src/deadbyte-cli.mjs

@@ -400,7 +400,11 @@ async function cleanupRemoteSession(ctx,{displayMode='unicode'}={}){
   for(const command of SESSION_CLEANUP){
     try{
       const result=invokeController(ctx,command,{allowFailure:true,capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-      if(result.status!==0){failed.push(command);writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command} exit=${result.status}\n`,displayMode);}
+      if(result.status!==0){
+        failed.push(command);
+        const detail=boundedSingleLine(result.stderr||result.stdout||'controller returned no diagnostic',512);
+        writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command} exit=${result.status}: ${detail}\n`,displayMode);
+      }
     }
     catch(error){failed.push(command);writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command}: ${String(error?.message||error)}\n`,displayMode);}
   }

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.52';
+export const DEADBYTE_VERSION = '0.15.53';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/r130-release-security-contract.test.mjs

@@ -13,16 +13,16 @@ test('R130 security patch has a new immutable package identity and truthful sour
     read('SBOM.cdx.json'),read('package-lock.json'),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.52');
-  assert.equal(release.train,'R143');
-  assert.equal(matrix.train,'R143');
-  assert.equal(release.source_predecessor.version,'0.15.51');
-  assert.match(release.source_predecessor.source_path,/0\.15\.51/);
+    assert.equal(actual,'0.15.53');
+  assert.equal(release.train,'R144');
+  assert.equal(matrix.train,'R144');
+  assert.equal(release.source_predecessor.version,'0.15.52');
+  assert.match(release.source_predecessor.source_path,/0\.15\.52/);
   assert.equal(release.runtime_predecessor.version,'0.15.45');
-  assert.equal(provenance.source_predecessor_version,'0.15.51');
-  assert.equal(provenance.source_predecessor_manifest_file_sha256,'ef27d35d0d3102b356fcb17478abefa82fae2375df27f913ce3b0ff0e5815a7e');
+  assert.equal(provenance.source_predecessor_version,'0.15.52');
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,'e00223a76ef6d0e0fa7e850de597fa44cd6113cd49725535492da73f1daf4244');
   assert.equal(pkg.dependencies['@modelcontextprotocol/client'],'2.3.1');
   assert.equal(pkg.dependencies['@modelcontextprotocol/server'],'2.3.1');
   for(const dep of ['@modelcontextprotocol/client','@modelcontextprotocol/server'])
     assert.equal(pkg.bundleDependencies.includes(dep),true);
-});
+});

package/test/r132-release-identity.test.mjs

@@ -8,20 +8,20 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 
-test('R143 package identities, R132 historic evidence and published predecessor are consistent',async()=>{
+test('R144 package identities, R132 historic evidence and published predecessor are consistent',async()=>{
   const [pkg,lock,release,prov,bom,matrix]=await Promise.all([
     read('package.json'),read('package-lock.json'),read('RELEASE.json'),
     read('PROVENANCE.json'),read('SBOM.cdx.json'),read('TEST-MATRIX.json')]);
   for(const value of [pkg.version,lock.version,lock.packages[''].version,release.version,prov.version,bom.metadata.component.version,matrix.version,DEADBYTE_VERSION]){
-    assert.equal(value,'0.15.52');
+    assert.equal(value,'0.15.53');
   }
-  assert.equal(release.train,'R143');
-  assert.equal(matrix.train,'R143');
-  assert.equal(release.source_predecessor.version,'0.15.51');
-  assert.match(release.source_predecessor.source_path,/0\.15\.51/);
-  assert.equal(prov.source_predecessor_version,'0.15.51');
-  assert.equal(prov.source_predecessor_manifest_file_sha256,'ef27d35d0d3102b356fcb17478abefa82fae2375df27f913ce3b0ff0e5815a7e');
-  assert.equal(prov.parent_tarball_sha256,'69586dc07dc7a3025ec44f08e6b0eab60c1f9e75287da77c850b49e320b201ff');
+  assert.equal(release.train,'R144');
+  assert.equal(matrix.train,'R144');
+  assert.equal(release.source_predecessor.version,'0.15.52');
+  assert.match(release.source_predecessor.source_path,/0\.15\.52/);
+  assert.equal(prov.source_predecessor_version,'0.15.52');
+  assert.equal(prov.source_predecessor_manifest_file_sha256,'e00223a76ef6d0e0fa7e850de597fa44cd6113cd49725535492da73f1daf4244');
+  assert.equal(prov.parent_tarball_sha256,'ec675df8885a0d96b1486607956b7091fe47088509b4756194a7e15004d8d97f');
   assert.equal(release.runtime_predecessor.version,'0.15.45');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);
   assert.equal(prov.runtime_predecessor.manifest_sha256,release.runtime_predecessor.manifest_sha256);

package/test/r144-claim-terminal-history.test.mjs

@@ -0,0 +1,55 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,rm,readFile,writeFile} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {performance} from 'node:perf_hooks';
+import {openRemoteCallClaims} from '../bridge/src/remote-call-claims-r60.mjs';
+
+const now=Date.parse('2029-01-01T00:00:00Z');
+const base={device_id:'device-1',session_id:'session-1',request_id:'init',
+  tool:'coding_file_write',arguments:{root_id:'fixture',path:'a.txt',content:'A'},
+  expires_at_utc:'2030-01-01T00:00:00.000Z',release_id:'v-test',
+  generation_manifest_sha256:'a'.repeat(64),machine_id:'b'.repeat(64),
+  online_epoch:'c'.repeat(64),classification:'mutating'};
+
+test('R144 terminal-heavy recovery ignores closed history and keeps live interruption fail-closed',async()=>{
+  const dir=await mkdtemp(path.join(os.tmpdir(),'r144-terminal-'));
+  try{
+    const store=openRemoteCallClaims({root:dir,clock:()=>now});
+    for(let i=0;i<200;i++){
+      const rec=await store.claim({...base,request_id:'terminal-'+i});
+      await store.dispatch(rec.claim_id);
+      await store.terminal(rec.claim_id,{status:'ok',value:i});
+    }
+    const pending=await store.claim({...base,request_id:'pending'});
+    const inflight=await store.claim({...base,request_id:'inflight'});
+    await store.dispatch(inflight.claim_id);
+    const start=performance.now(), recovered=await store.recover({limit:100});
+    const elapsed_ms=Math.round(performance.now()-start);
+    assert.deepEqual(new Set(recovered.records.map(x=>x.claim_id)),new Set([pending.claim_id,inflight.claim_id]));
+    assert.equal(recovered.next_cursor,null);
+    assert.equal((await store.state(inflight.claim_id)).state,'INTERRUPTED');
+    assert.equal((await store.state(inflight.claim_id)).side_effect_state,'unknown');
+    const replay=await store.claim({...base,request_id:'terminal-77'});
+    assert.equal(replay.owner,false);
+    assert.equal(replay.state,'TERMINAL');
+    console.log('R144_TERMINAL_HISTORY_BENCH',{terminal_count:200,elapsed_ms});
+  }finally{await rm(dir,{recursive:true,force:true});}
+});
+
+test('R144 terminal marker cannot enable replay when its bytes are forged',async()=>{
+  const dir=await mkdtemp(path.join(os.tmpdir(),'r144-forged-'));
+  try{
+    const store=openRemoteCallClaims({root:dir,clock:()=>now});
+    const claim=await store.claim(base);
+    await store.dispatch(claim.claim_id);
+    await store.terminal(claim.claim_id,{status:'ok'});
+    const f=path.join(dir,claim.claim_id.slice(0,2),claim.claim_id+'.terminal.json');
+    const bytes=await readFile(f,'utf8');
+    await writeFile(f,bytes.replace('"status":"ok"','"status":"forged"'));
+    assert.equal((await store.recover({limit:100})).records.length,0);
+    await assert.rejects(store.claim(base),/terminal hash corrupt|remote claim state unreadable/);
+    await assert.rejects(store.dispatch(claim.claim_id),/already dispatched/);
+  }finally{await rm(dir,{recursive:true,force:true});}
+});

package/test/r144-controller-broad-roots-cleanup.test.mjs

@@ -0,0 +1,54 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile,writeFile,mkdtemp,mkdir,rm,access} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+
+const q=x=>"'"+String(x).replaceAll("'","''")+"'";
+const section=(src,start,end)=>{
+  const a=src.indexOf('function '+start+'('),b=src.indexOf('function '+end+'(',a);
+  assert.ok(a>=0&&b>a,start+' boundaries missing');
+  return src.slice(a,b);
+};
+
+test('R144 broad Coding roots with no leases permit isolated cleanup without changing grants',async()=>{
+  const home='C:/Users/DEADBYTE/.deadbyte-mcp';
+  const cfgRoot=path.join(home,'generations','v0.15.45-34aa8d1241cfb8bf-ga9de1c56d5e65fa4');
+  const tmp=await mkdtemp(path.join(os.tmpdir(),'r144-broad-policy-cleanup-'));
+  try{
+    const runtime=path.join(tmp,'runtime');await mkdir(runtime);
+    const coding=JSON.parse(await readFile(path.join(cfgRoot,'coding-policy.json'),'utf8'));
+    const autonomous=JSON.parse(await readFile(path.join(cfgRoot,'autonomous-policy.json'),'utf8'));
+    assert.equal(coding.roots.local_c.path,'C:\\');
+    assert.equal(coding.roots.local_d.path,'D:\\');
+    coding.lease_file=path.join(runtime,'coding-grant.json');
+    const codingFile=path.join(tmp,'coding.json');
+    await writeFile(codingFile,JSON.stringify(coding));
+    autonomous.lease_file=path.join(runtime,'autonomous-grant.json');
+    autonomous.coding_policy_sha256=createHash('sha256').update(await readFile(codingFile)).digest('hex');
+    const autonomousFile=path.join(tmp,'autonomous.json');
+    await writeFile(autonomousFile,JSON.stringify(autonomous));
+    const src=await readFile(new URL('../controller/deadbyte-controller.ps1',import.meta.url),'utf8');
+    const code=[
+      "$ErrorActionPreference='Stop';",'$RuntimeDir='+q(runtime)+';',
+      'function Fail([string]$m){throw $m}',
+      'function Invoke-AuthorityEpochCommand{throw "UNEXPECTED_EPOCH_MUTATION"}',
+      section(src,'Assert-PolicyRootsAvailable','Get-AuthorityEpochStatus'),
+      section(src,'Read-ControllerPolicySnapshot','Get-CodingPolicyMetadata'),
+      section(src,'Get-CodingPolicyMetadata','Get-CodingLeaseStatus'),
+      section(src,'Disarm-Coding','Show-CodingStatus'),
+      section(src,'Get-AutonomousRevocationLeaseFile','Show-AutonomousStatus'),
+      '$cfg=@{CodingPolicyFile='+q(codingFile)+';AutonomousPolicyFile='+q(autonomousFile)+'};',
+      'Disarm-Coding $cfg; Disarm-Autonomous $cfg; Write-Output "R144_NO_GRANT_REVOKE_OK"'
+    ].join('\n');
+    const run=spawnSync('powershell.exe',['-NoLogo','-NoProfile','-NonInteractive','-Command',code],{
+      encoding:'utf8',timeout:30000,maxBuffer:1024*1024
+    });
+    assert.equal(run.status,0,run.stderr+'\n'+run.stdout);
+    assert.match(run.stdout,/R144_NO_GRANT_REVOKE_OK/);
+    for(const f of ['coding-grant.json','autonomous-grant.json'])
+      await assert.rejects(access(path.join(runtime,f)),{code:'ENOENT'});
+  }finally{await rm(tmp,{recursive:true,force:true});}
+});

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');

package/test/r74-prepublish-contract.test.mjs

@@ -21,8 +21,8 @@ test('R74 prepublish contract: positive path succeeds and verifies identities',
   assert.equal(result.checks.no_self_referential_tarball_hash, true);
   assert.equal(result.identities.package_name, 'deadbyte-mcp');
   // R74 component contract retains its train-specific source and predecessor assertions;
-  // the containing R143 package must report its actual immutable package version.
-  assert.equal(result.identities.package_version, '0.15.52');
+  // the containing R144 package must report its actual immutable package version.
+  assert.equal(result.identities.package_version, '0.15.53');
   assert.equal(result.identities.target_train, 'R74');
   assert.equal(result.identities.published_source_predecessor, '0.15.46');
   assert.notEqual(result.identities.published_source_predecessor, result.identities.runtime_predecessor);