deadbyte-mcp 0.15.52 → 0.15.54

package/scripts/deploy-r48.mjs

@@ -11,12 +11,35 @@ import {classifyActivationPreflight,classifyAuthorityContinuity,orchestrateActiv
 import {createEpochNativeContinuityEngine} from '../src/activation-continuity-engine-r65.mjs';
 import {createActivationClaimManager} from '../src/activation-lock-r65.mjs';
 import {observeAuthorityEvidence} from '../src/activation-authority-proof-r75.mjs';
+import {proveLegacyOfflineScopeRepair} from '../src/legacy-offline-policy-proof-r146.mjs';
 
 const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
 const state=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
 const sha=async f=>createHash('sha256').update(await readFile(f)).digest('hex');
 const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
 
+function parseDeployArgs(argv){
+  const out={preflight:false,approvalPath:null,approvalSha256:null};
+  for(let index=0;index<argv.length;index++){
+    const arg=argv[index];
+    if(arg==='--preflight'){if(out.preflight)throw new Error('duplicate --preflight');out.preflight=true;continue;}
+    if(arg==='--policy-migration-approval'){
+      if(out.approvalPath)throw new Error('duplicate --policy-migration-approval');
+      const value=argv[++index];if(!value)throw new Error('--policy-migration-approval requires a path');
+      out.approvalPath=path.resolve(value);continue;
+    }
+    if(arg==='--policy-migration-approval-sha256'){
+      if(out.approvalSha256)throw new Error('duplicate --policy-migration-approval-sha256');
+      const value=String(argv[++index]??'').toLowerCase();if(!/^[0-9a-f]{64}$/.test(value))throw new Error('--policy-migration-approval-sha256 requires lowercase SHA-256');
+      out.approvalSha256=value;continue;
+    }
+    throw new Error(`unknown deploy argument '${arg}'`);
+  }
+  if(Boolean(out.approvalPath)!==Boolean(out.approvalSha256))throw new Error('policy migration approval path and SHA-256 are required together');
+  return out;
+}
+const deployArgs=parseDeployArgs(process.argv.slice(2));
+
 async function writeExclusive(file,value){
   const handle=await open(file,'wx',0o600);
   try{await handle.writeFile(JSON.stringify(value)+'\n');await handle.sync();}
@@ -72,13 +95,35 @@ function controllerCommand(command){
   if(run.error||run.status!==0)throw new Error(`activation controller ${command} failed exit=${run.status} code=${run.error?.code??'none'}`);
 }
 
-async function activationPreflight(manifest,pkg,pointer){
+function legacyOfflineRecovery(approvalPath,approvalSha256){
+  if(!approvalPath)return null;
+  return async({observation,preflight_subject_sha256,pointer,expectedParent,candidate,expectedCandidate})=>
+    proveLegacyOfflineScopeRepair({stateRoot:state,pointer,expectedParent,candidate,expectedCandidate,
+      preflightSubjectSha256:preflight_subject_sha256,observation,policyPaths:observation.policy_paths,
+      policySha256:observation.policy_sha256,approvalPath,approvalSha256,
+      ownerPublicKeyPath:path.join(state,'trust','r70-owner-public.pem')});
+}
+
+async function activationPreflight(manifest,pkg,pointer,recovery){
   const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
   const observed=await observeController();
   const result=classifyActivationPreflight({pointer,expectedParent:release.parent,
     candidate:{version:pkg.version,manifest_sha256:manifest},
     expectedCandidate:{version:release.version,manifest_sha256:manifest},observation:observed});
   const continuity=classifyAuthorityContinuity(observed);
+  if(result.state==='AUTHORITY_UNVERIFIED'&&recovery&&observed.state==='OFFLINE'){
+    try{
+      const proof=await recovery({phase:'preflight',observation:observed,preflight_subject_sha256:result.subject_sha256,
+        pointer,expectedParent:release.parent,candidate:{version:pkg.version,manifest_sha256:manifest},
+        expectedCandidate:{version:release.version,manifest_sha256:manifest}});
+      if(proof?.state==='VERIFIED_OFFLINE_LEGACY_SCOPE_REPAIR'&&proof.owner_approval_verified===true)
+        return {...result,state:'LEGACY_SCOPE_REPAIR_READY',safe_to_activate:true,authority_continuity:'LEGACY_SCOPE_REPAIRED_DISARMED',
+          legacy_scope_proof_sha256:proof.subject_sha256,owner_approval_subject_sha256:proof.owner_approval_subject_sha256,reauth_planes:[]};
+    }catch(error){
+      return {...result,state:'LEGACY_SCOPE_REPAIR_UNVERIFIED',safe_to_activate:false,
+        reason:String(error?.message??error).slice(0,256),authority_continuity:'UNVERIFIED',reauth_planes:[]};
+    }
+  }
   if(continuity.state==='UNVERIFIED')return {...result,state:'AUTHORITY_CONTINUITY_UNVERIFIED',safe_to_activate:false,
     reason:continuity.reason??'authority continuity observation unverified',authority_continuity:'UNVERIFIED',reauth_planes:continuity.reauth_planes??[]};
   if(continuity.state==='EPOCH_NATIVE')return {...result,authority_continuity:'EPOCH_NATIVE',
@@ -139,13 +184,13 @@ const bridgeScript=path.join(bridgeRoot,'src','bridge.mjs');
 const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
 const expectedVersion=pkg.version;
 const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
-const preflight=await activationPreflight(manifest,pkg,pointer);
-if(process.argv.includes('--preflight')){
+const recovery=legacyOfflineRecovery(deployArgs.approvalPath,deployArgs.approvalSha256);
+const preflight=await activationPreflight(manifest,pkg,pointer,recovery);
+if(deployArgs.preflight){
   console.log(JSON.stringify(preflight));
   process.exit(0);
 }
-if(process.argv.length>2)throw new Error('deploy accepts only --preflight');
-if(!['ONLINE_READY','ONLINE_HOST_ARMED','PARKED_DIRTY','OFFLINE_CLEAN'].includes(preflight.state))
+if(!['ONLINE_READY','ONLINE_HOST_ARMED','PARKED_DIRTY','OFFLINE_CLEAN','LEGACY_SCOPE_REPAIR_READY'].includes(preflight.state))
   throw new Error(`activation preflight rejected: ${preflight.state} subject=${preflight.subject_sha256??'<incomplete>'}`);
 const args=[
   '--stage',root,'--development-root',root,'--expected-version',expectedVersion,'--expected-manifest',manifest,
@@ -178,6 +223,7 @@ if(preflight.authority_continuity==='EPOCH_NATIVE'){
 const outcome=await orchestrateActivation({pointer,expectedParent:release.parent,
   candidate:{version:expectedVersion,manifest_sha256:manifest},expectedCandidate:{version:release.version,manifest_sha256:manifest},
   observe:async()=>observeController(),command:async command=>controllerCommand(command),claim:claimActivation,continuityEngine,
+  legacyOfflineRecovery:recovery,
   recordOutcome:recordActivationOutcome,
   activate:async()=>{
     result=await runSlotUpdateCli(args,{stateRoot:state});

package/src/activation-preflight-r65.mjs

@@ -85,12 +85,25 @@ export function classifyActivationPreflight({pointer,expectedParent,candidate,ex
   return Object.freeze({state:'ONLINE_READY',safe_to_activate:true,...bound});
 }
 
-export async function orchestrateActivation({pointer,expectedParent,candidate,expectedCandidate,observe,command,activate,claim=null,continuityEngine=null,recordOutcome=null}){
+function validateLegacyOfflineRecoveryProof(proof,{preflightSubjectSha256,candidate}){
+  if(!proof||proof.state!=='VERIFIED_OFFLINE_LEGACY_SCOPE_REPAIR'||
+      proof.preflight_subject_sha256!==preflightSubjectSha256||
+      proof.candidate_manifest_sha256!==candidate.manifest_sha256||
+      proof.owner_approval_verified!==true||!HEX64.test(String(proof.subject_sha256??'')))
+    throw new Error('legacy offline scope recovery proof invalid or unbound');
+  return proof;
+}
+
+export async function orchestrateActivation({pointer,expectedParent,candidate,expectedCandidate,observe,command,activate,claim=null,continuityEngine=null,recordOutcome=null,legacyOfflineRecovery=null}){
   if([observe,command,activate].some(fn=>typeof fn!=='function'))throw new Error('activation orchestrator callbacks invalid');
   const input={pointer,expectedParent,candidate,expectedCandidate};
   const firstObservation=await observe();
   const initial=classifyActivationPreflight({...input,observation:firstObservation});
-  if(!['ONLINE_READY','ONLINE_HOST_ARMED','PARKED_DIRTY','OFFLINE_CLEAN'].includes(initial.state))
+  const legacyScopeRepair=initial.state==='AUTHORITY_UNVERIFIED'&&typeof legacyOfflineRecovery==='function'&&
+    firstObservation?.state==='OFFLINE'&&firstObservation?.local_ready===false&&
+    !firstObservation?.bridge?.alive&&!firstObservation?.core?.alive&&!firstObservation?.cloud?.alive&&
+    firstObservation?.supervisor?.running===false&&PLANES.every(plane=>initial.authority?.[plane]===false);
+  if(!legacyScopeRepair&&!['ONLINE_READY','ONLINE_HOST_ARMED','PARKED_DIRTY','OFFLINE_CLEAN'].includes(initial.state))
     return Object.freeze({state:'ACTIVATION_REJECTED',preflight:initial.state,subject_sha256:initial.subject_sha256??null});
   const continuity=classifyAuthorityContinuity(firstObservation);
   if(continuity.state==='UNVERIFIED')
@@ -112,6 +125,12 @@ export async function orchestrateActivation({pointer,expectedParent,candidate,ex
   let continuityCapture=null;
   const outcome=await (async()=>{
     try{
+      let legacyProof=null;
+      if(legacyScopeRepair){
+        legacyProof=validateLegacyOfflineRecoveryProof(await legacyOfflineRecovery({phase:'claimed',observation:firstObservation,
+          preflight_subject_sha256:initial.subject_sha256,pointer,expectedParent,candidate,expectedCandidate}),
+        {preflightSubjectSha256:initial.subject_sha256,candidate});
+      }
       const requiresReauth=continuity.state==='LEGACY_REAUTH_REQUIRED'||continuity.state==='MIXED_REAUTH_REQUIRED';
       const epochNative=continuity.state==='EPOCH_NATIVE';
       if(epochNative){
@@ -134,8 +153,18 @@ export async function orchestrateActivation({pointer,expectedParent,candidate,ex
         await command('supervisorstop');
         await command('stop');
       }
-      const ready=classifyActivationPreflight({...input,observation:await observe()});
-      if(!ready.safe_to_activate)
+      const readyObservation=await observe();
+      const ready=classifyActivationPreflight({...input,observation:readyObservation});
+      let readySafe=ready.safe_to_activate;
+      if(legacyScopeRepair){
+        if(ready.subject_sha256!==initial.subject_sha256)throw new Error('legacy offline scope recovery observation drift');
+        const second=validateLegacyOfflineRecoveryProof(await legacyOfflineRecovery({phase:'preactivate',observation:readyObservation,
+          preflight_subject_sha256:initial.subject_sha256,pointer,expectedParent,candidate,expectedCandidate,prior_proof:legacyProof}),
+        {preflightSubjectSha256:initial.subject_sha256,candidate});
+        if(second.subject_sha256!==legacyProof.subject_sha256)throw new Error('legacy offline scope recovery proof drift');
+        readySafe=true;
+      }
+      if(!readySafe)
         return Object.freeze({state:transitionAttempted?'ACTIVATION_OUTCOME_UNKNOWN':'ACTIVATION_REJECTED',
           preflight:ready.state,subject_sha256:initial.subject_sha256});
       if(PLANES.some(plane=>ready.authority[plane]!==false))
@@ -180,7 +209,8 @@ export async function orchestrateActivation({pointer,expectedParent,candidate,ex
           reauth_planes:Object.freeze([...(restored.reauth_planes??[])])});
       }
       const final=beforeRestore;
-      const authorityOutcome=continuity.state==='NOT_APPLICABLE'?'NOT_APPLICABLE':'REAUTH_REQUIRED';
+      const authorityOutcome=legacyScopeRepair?'LEGACY_SCOPE_REPAIRED_DISARMED':
+        continuity.state==='NOT_APPLICABLE'?'NOT_APPLICABLE':'REAUTH_REQUIRED';
       return Object.freeze({
         state:'ACTIVATED',runtime_activation:'ACTIVATED',authority_continuity:authorityOutcome,
         subject_sha256:initial.subject_sha256,release_id:activation.release_id,

package/src/commander-remote-bridge-r47.mjs

@@ -1,4 +1,5 @@
 import * as z from 'zod/v4';
+import { payloadHash } from './remote-device-r44.mjs';
 
 const HEX64=/^[0-9a-f]{64}$/;
 const CAP=/^[A-Za-z0-9._-]{1,128}$/;
@@ -9,12 +10,25 @@ function requirePlane(plane,name){
   if(!plane) return {status:'unavailable',tool:name,error:'remote-device-r44 plane is not configured'};
   return null;
 }
+async function probeBoundConnection(plane,{device_id,epoch,connection_id,nonce}){
+  if(!HEX64.test(device_id??''))throw new Error('remote readiness device identity invalid');
+  if(!Number.isInteger(epoch)||epoch<1)throw new Error('remote readiness epoch invalid');
+  if(typeof connection_id!=='string'||connection_id.length<1||connection_id.length>256)throw new Error('remote readiness connection identity invalid');
+  if(!HEX64.test(nonce??''))throw new Error('remote readiness nonce invalid');
+  const result=await plane.probe({deviceId:device_id,epoch});
+  if(!result||result.device_id!==device_id)throw new Error('remote readiness device identity mismatch');
+  if(result.epoch!==epoch)throw new Error('remote readiness epoch mismatch');
+  if(result.connection_id!==connection_id)throw new Error('remote readiness connection identity mismatch');
+  if(result.reachable!==true)throw new Error('remote readiness probe not reachable');
+  return {...result,nonce,ready:true};
+}
 export function registerCommanderRemoteBridge(server,{remoteDevicePlane=null}={}){
   register(server,'remote_device',z.strictObject({
     op:z.enum(['pair','status','report_online','probe','dispatch','revoke','rotate_credential','list']),
     device_id:z.string().regex(HEX64).optional(),epoch:z.number().int().min(1).optional(),
     public_key_spki_base64:z.string().min(1).max(4096).optional(),display_name:z.string().min(1).max(128).optional(),
     connection_id:z.string().min(1).max(256).optional(),capability_id:z.string().regex(CAP).optional(),
+    nonce:z.string().regex(HEX64).optional(),
     payload:z.record(z.string(),z.unknown()).optional(),request_id:z.string().regex(HEX64).optional(),
     encrypted_bundle_base64:z.string().min(1).max(1024*1024).optional(),expected_previous_sha256:z.string().regex(HEX64).nullable().optional()
   }),async a=>{
@@ -23,7 +37,7 @@ export function registerCommanderRemoteBridge(server,{remoteDevicePlane=null}={}
       case 'pair': return remoteDevicePlane.pair({publicKeySpkiBase64:a.public_key_spki_base64,displayName:a.display_name});
       case 'status': return remoteDevicePlane.status({deviceId:a.device_id});
       case 'report_online': return remoteDevicePlane.reportOnline({deviceId:a.device_id,epoch:a.epoch,connectionId:a.connection_id});
-      case 'probe': return remoteDevicePlane.probe({deviceId:a.device_id,epoch:a.epoch});
+      case 'probe': return probeBoundConnection(remoteDevicePlane,a);
       case 'dispatch': return remoteDevicePlane.dispatch({deviceId:a.device_id,epoch:a.epoch,capabilityId:a.capability_id,payload:a.payload??{},requestId:a.request_id});
       case 'revoke': return remoteDevicePlane.revoke({deviceId:a.device_id,epoch:a.epoch});
       case 'rotate_credential': return remoteDevicePlane.rotateCredential({deviceId:a.device_id,epoch:a.epoch,encryptedBundleBase64:a.encrypted_bundle_base64,expectedPreviousSha256:a.expected_previous_sha256??null});
@@ -33,9 +47,13 @@ export function registerCommanderRemoteBridge(server,{remoteDevicePlane=null}={}
   });
   register(server,'remote_mcp',z.strictObject({
     device_id:z.string().regex(HEX64),epoch:z.number().int().min(1),capability_id:z.string().regex(CAP),
-    payload:z.record(z.string(),z.unknown()).default({}),request_id:z.string().regex(HEX64)
+    payload:z.record(z.string(),z.unknown()).default({}),request_id:z.string().regex(HEX64),
+    request_sha256:z.string().regex(HEX64).optional()
   }),async a=>{
     const unavailable=requirePlane(remoteDevicePlane,'remote_mcp');if(unavailable)return unavailable;
+    if(a.request_sha256&&payloadHash({deviceId:a.device_id,epoch:a.epoch,capabilityId:a.capability_id,payload:a.payload})!==a.request_sha256){
+      throw new Error('remote request hash mismatch');
+    }
     return remoteDevicePlane.dispatch({deviceId:a.device_id,epoch:a.epoch,capabilityId:a.capability_id,payload:a.payload,requestId:a.request_id});
   });
 }

package/src/commander-remote-relay-r47.mjs

@@ -1,4 +1,5 @@
 import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { DEADBYTE_VERSION } from './version.mjs';
 
 function insist(ok,message){if(!ok)throw new Error(message);}
 function structured(result,label){
@@ -8,11 +9,21 @@ function structured(result,label){
   return value;
 }
 
+export function validateRemoteProbeResponseR47(result,{deviceId,epoch,connectionId,nonce}){
+  insist(result&&typeof result==='object','remote readiness response missing');
+  insist(result.device_id===deviceId,'remote readiness device identity mismatch');
+  insist(result.epoch===epoch,'remote readiness epoch mismatch');
+  insist(result.connection_id===connectionId,'remote readiness connection identity mismatch');
+  insist(result.nonce===nonce,'remote readiness nonce mismatch');
+  insist(result.ready===true,'remote readiness response not ready');
+  return result;
+}
+
 export async function createCommanderRemoteRelayR47({endpoint,protocolVersion='2026-07-28',timeoutMs=15000}={}){
   const url=new URL(String(endpoint??''));
   insist(url.protocol==='https:','remote relay endpoint must use HTTPS');
   insist(Number.isInteger(timeoutMs)&&timeoutMs>=100&&timeoutMs<=120000,'remote relay timeout invalid');
-  const client=new Client({name:'deadbyte-r47-remote-relay',version:'0.15.15'},{versionNegotiation:{mode:{pin:protocolVersion}}});
+  const client=new Client({name:'deadbyte-r47-remote-relay',version:DEADBYTE_VERSION},{versionNegotiation:{mode:{pin:protocolVersion}}});
   const transport=new StreamableHTTPClientTransport(url);
   let connected=false;
   let connecting=null;
@@ -25,7 +36,7 @@ export async function createCommanderRemoteRelayR47({endpoint,protocolVersion='2
   async function probe({device_id,epoch,connection_id,nonce}){
     const value=await call('remote_device',{op:'probe',device_id,epoch,connection_id,nonce},'remote readiness probe');
     const result=value.result??value;
-    return {device_id,epoch,nonce,ready:result.ready===true||result.reachable===true};
+    return validateRemoteProbeResponseR47(result,{deviceId:device_id,epoch,connectionId:connection_id,nonce});
   }
   async function request({device_id,epoch,capability_id,payload,request_id,request_sha256}){
     insist(typeof request_sha256==='string'&&/^[0-9a-f]{64}$/.test(request_sha256),'remote request hash invalid');

package/src/deadbyte-cli.mjs

@@ -400,7 +400,11 @@ async function cleanupRemoteSession(ctx,{displayMode='unicode'}={}){
   for(const command of SESSION_CLEANUP){
     try{
       const result=invokeController(ctx,command,{allowFailure:true,capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-      if(result.status!==0){failed.push(command);writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command} exit=${result.status}\n`,displayMode);}
+      if(result.status!==0){
+        failed.push(command);
+        const detail=boundedSingleLine(result.stderr||result.stdout||'controller returned no diagnostic',512);
+        writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command} exit=${result.status}: ${detail}\n`,displayMode);
+      }
     }
     catch(error){failed.push(command);writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command}: ${String(error?.message||error)}\n`,displayMode);}
   }
@@ -631,7 +635,11 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     const wasAborted=aborter.signal.aborted;
     aborter.abort();
     if(logTask) await logTask.catch(()=>{});
-    timelineWriter.flush();
+    timelineWriter.flush();
+    const liveLogDelivery=timelineWriter.retention();
+    if(liveLogDelivery.suppressed_since_drain>0){
+      process.stderr.write(`[WARN] LIVELOG ${liveLogDelivery.suppressed_since_drain} display lines still suppressed at disconnect due to stdout backpressure; inspect signed audit and runtime logs.\n`);
+    }
     for(const line of activityTracker.reconcileInterrupted('session_end')) process.stdout.write(`${line}\n`);
     const filterRetention=timelineFilter?.retention();
     if(filterRetention?.evicted>0) process.stdout.write(`[WARN] LIVELOG filter evicted ${filterRetention.evicted} presentation identities; full audit remains on disk.\n`);

package/src/legacy-offline-policy-proof-r146.mjs

@@ -0,0 +1,204 @@
+import {createHash,createPublicKey,verify as verifySignature} from 'node:crypto';
+import {lstat,open,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {verifyGenerationBundle} from './release-generation.mjs';
+import {canonicalJson} from './canonical-json.mjs';
+
+const PLANES=['process','coding','autonomous','desktop','host'];
+const GRANT_FIELDS={process:'grant_file',coding:'lease_file',autonomous:'lease_file',desktop:'grant_file',host:'arm_file'};
+const HEX=/^[0-9a-f]{64}$/;
+const APPROVAL_DOMAIN=Buffer.from('DEADBYTE-R146-POLICY-MIGRATION-APPROVAL\0','utf8');
+const APPROVAL_SCHEMA='deadbyte.r146-policy-migration-approval.v1';
+const SUBJECT_SCHEMA='deadbyte.r146-policy-migration-subject.v1';
+const APPROVAL_FIELDS=['schema','subject_sha256','owner_key_id','subject','signature_base64'];
+const SUBJECT_FIELDS=['schema','action','predecessor_release_id','predecessor_version','predecessor_manifest_sha256',
+  'predecessor_generation_manifest_sha256','candidate_version','candidate_manifest_sha256','predecessor_policy_sha256',
+  'preflight_subject_sha256','issued_at_utc','expires_at_utc'];
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+function sameFile(a,b){
+  return a.isFile()&&b.isFile()&&!a.isSymbolicLink()&&!b.isSymbolicLink()&&
+    a.dev===b.dev&&a.ino===b.ino&&a.size===b.size&&a.mtimeMs===b.mtimeMs&&a.ctimeMs===b.ctimeMs;
+}
+async function readPinned(file,expected,label){
+  if(!path.isAbsolute(file)||!HEX.test(expected??''))throw new Error(label+' identity incomplete');
+  const before=await lstat(file);
+  if(!before.isFile()||before.isSymbolicLink())throw new Error(label+' file invalid');
+  const handle=await open(file,'r');
+  try{
+    const opened=await handle.stat();
+    if(!sameFile(before,opened))throw new Error(label+' identity moved');
+    const bytes=await handle.readFile();
+    const after=await handle.stat(),onPath=await lstat(file);
+    if(!sameFile(opened,after)||!sameFile(after,onPath))throw new Error(label+' changed');
+    if(sha(bytes)!==expected)throw new Error(label+' hash mismatch');
+    return JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));
+  }finally{await handle.close();}
+}
+async function readPinnedBytes(file,expected,label){
+  if(!path.isAbsolute(file)||!HEX.test(expected??''))throw new Error(label+' identity incomplete');
+  const before=await lstat(file);
+  if(!before.isFile()||before.isSymbolicLink())throw new Error(label+' file invalid');
+  const handle=await open(file,'r');
+  try{
+    const opened=await handle.stat();
+    if(!sameFile(before,opened))throw new Error(label+' identity moved');
+    const bytes=await handle.readFile();
+    const after=await handle.stat(),onPath=await lstat(file);
+    if(!sameFile(opened,after)||!sameFile(after,onPath))throw new Error(label+' changed');
+    if(sha(bytes)!==expected)throw new Error(label+' hash mismatch');
+    return bytes;
+  }finally{await handle.close();}
+}
+async function readRegularBytes(file,label){
+  if(!path.isAbsolute(file))throw new Error(label+' path invalid');
+  const before=await lstat(file);
+  if(!before.isFile()||before.isSymbolicLink())throw new Error(label+' file invalid');
+  const handle=await open(file,'r');
+  try{
+    const opened=await handle.stat();
+    if(!sameFile(before,opened))throw new Error(label+' identity moved');
+    const bytes=await handle.readFile();
+    const after=await handle.stat(),onPath=await lstat(file);
+    if(!sameFile(opened,after)||!sameFile(after,onPath))throw new Error(label+' changed');
+    return bytes;
+  }finally{await handle.close();}
+}
+async function mustBeAbsent(file,label){
+  try{await lstat(file);throw new Error(label+' present');}
+  catch(error){if(error?.code!=='ENOENT')throw error;}
+}
+function exactDrive(root,drive){
+  return typeof root?.path==='string'&&path.win32.normalize(root.path).toLowerCase()===drive.toLowerCase();
+}
+function exactObject(value,fields,label){
+  if(!value||typeof value!=='object'||Array.isArray(value))throw new Error(label+' invalid');
+  const keys=Object.keys(value);
+  if(keys.some(key=>!fields.includes(key))||fields.some(key=>!Object.hasOwn(value,key)))throw new Error(label+' shape invalid');
+  return value;
+}
+function instant(value,label){
+  if(typeof value!=='string'||!/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3}Z$/.test(value))throw new Error(label+' invalid');
+  const parsed=Date.parse(value);
+  if(!Number.isFinite(parsed)||new Date(parsed).toISOString()!==value)throw new Error(label+' invalid');
+  return parsed;
+}
+async function verifyMigrationApproval({approvalPath,approvalSha256,ownerPublicKeyPath,expected,now}){
+  const approval=JSON.parse((await readPinnedBytes(approvalPath,approvalSha256,'policy migration approval')).toString('utf8').replace(/^\uFEFF/,''));
+  exactObject(approval,APPROVAL_FIELDS,'policy migration approval');
+  const subject=exactObject(approval.subject,SUBJECT_FIELDS,'policy migration approval subject');
+  if(approval.schema!==APPROVAL_SCHEMA||subject.schema!==SUBJECT_SCHEMA||subject.action!=='legacy_offline_scope_repair')throw new Error('policy migration approval scope invalid');
+  for(const [key,value] of Object.entries(expected)){
+    if(key==='predecessor_policy_sha256'){
+      if(canonicalJson(subject[key])!==canonicalJson(value))throw new Error('policy migration approval policy binding mismatch');
+    }else if(subject[key]!==value)throw new Error('policy migration approval subject mismatch: '+key.replaceAll('_',' '));
+  }
+  const issued=instant(subject.issued_at_utc,'policy migration approval issued time');
+  const expires=instant(subject.expires_at_utc,'policy migration approval expiry');
+  const observed=now instanceof Date?now.getTime():NaN;
+  if(!Number.isFinite(observed)||expires<=issued||expires-issued>3_600_000||observed<issued||observed>=expires)throw new Error('policy migration approval expired or invalid');
+  const subjectSha256=sha(Buffer.from(canonicalJson(subject),'utf8'));
+  if(approval.subject_sha256!==subjectSha256)throw new Error('policy migration approval subject hash mismatch');
+  const keyBytes=await readRegularBytes(ownerPublicKeyPath,'policy migration owner key');
+  let publicKey;
+  try{publicKey=createPublicKey(keyBytes);}catch{throw new Error('policy migration owner key invalid');}
+  if(publicKey.asymmetricKeyType!=='ed25519')throw new Error('policy migration owner key must be Ed25519');
+  const ownerKeyId=sha(publicKey.export({type:'spki',format:'der'}));
+  if(approval.owner_key_id!==ownerKeyId)throw new Error('policy migration owner key identity mismatch');
+  if(typeof approval.signature_base64!=='string')throw new Error('policy migration approval signature invalid');
+  const signature=Buffer.from(approval.signature_base64,'base64');
+  const signed={schema:APPROVAL_SCHEMA,subject_sha256:subjectSha256,owner_key_id:ownerKeyId};
+  if(signature.length!==64||!verifySignature(null,Buffer.concat([APPROVAL_DOMAIN,Buffer.from(canonicalJson(signed),'utf8')]),publicKey,signature))throw new Error('policy migration approval signature invalid');
+  return {subject_sha256:subjectSha256,owner_key_id:ownerKeyId,expires_at_utc:subject.expires_at_utc};
+}
+export async function proveLegacyOfflineScopeRepair({
+  stateRoot,pointer,expectedParent,candidate,expectedCandidate,preflightSubjectSha256,
+  observation,policyPaths,policySha256,approvalPath,approvalSha256,ownerPublicKeyPath,
+  now=new Date()
+}){
+  if(!stateRoot||!path.isAbsolute(stateRoot))throw new Error('state root invalid');
+  if(!pointer||!expectedParent||!observation)throw new Error('legacy scope proof subject missing');
+  if(expectedParent.version!=='0.15.45'||pointer.version!==expectedParent.version||
+    pointer.release_id!==expectedParent.release_id||
+    pointer.manifest_sha256!==expectedParent.manifest_sha256||
+    pointer.generation_manifest_sha256!==expectedParent.generation_manifest_sha256)
+    throw new Error('legacy scope proof predecessor mismatch');
+  if(!candidate||!expectedCandidate||candidate.version!==expectedCandidate.version||
+    candidate.manifest_sha256!==expectedCandidate.manifest_sha256||!HEX.test(candidate.manifest_sha256??''))
+    throw new Error('legacy scope proof candidate mismatch');
+  if(!HEX.test(preflightSubjectSha256??''))throw new Error('legacy scope proof preflight subject invalid');
+  if(observation.state!=='OFFLINE'||observation.local_ready!==false||
+    ['bridge','core','cloud'].some(key=>observation[key]?.alive!==false)||
+    observation.supervisor?.running!==false)
+    throw new Error('legacy scope proof runtime is not cleanly offline');
+  if(observation.active_release_id!==pointer.release_id||
+    observation.active_manifest_sha256!==pointer.manifest_sha256||
+    observation.active_generation_manifest_sha256!==pointer.generation_manifest_sha256)
+    throw new Error('legacy scope proof observation generation drift');
+  if(!observation.authority||!observation.authority_proof||!observation.policy_sha256)
+    throw new Error('legacy scope proof missing authority evidence');
+  for(const plane of PLANES){
+    const entry=observation.authority[plane],proof=observation.authority_proof[plane];
+    const reason=plane==='autonomous'?'unverified':'disarmed';
+    const state=plane==='autonomous'?'UNVERIFIED':'VERIFIED_DISARMED';
+    if(entry?.configured!==true||entry.armed!==false||entry.reason!==reason||
+      proof?.state!==state||proof.grant_absent!==true||
+      proof.policy_sha256!==observation.policy_sha256[plane]||
+      policySha256?.[plane]!==proof.policy_sha256)
+      throw new Error('legacy scope proof authority not physically inactive: '+plane);
+  }
+  const storedPointer=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+  if(storedPointer.release_id!==pointer.release_id||
+    storedPointer.generation_manifest_sha256!==pointer.generation_manifest_sha256||
+    storedPointer.manifest_sha256!==pointer.manifest_sha256)
+    throw new Error('legacy scope proof pointer changed');
+  await verifyGenerationBundle(pointer.generation_root,pointer.generation_manifest_sha256);
+  await mustBeAbsent(path.join(stateRoot,'runtime','remote-session.json'),'foreground ownership marker');
+  for(const plane of PLANES)await mustBeAbsent(path.join(stateRoot,'runtime','authority-epochs',plane,'.lock'),plane+' authority epoch lock');
+  const policies={};
+  for(const plane of PLANES){
+    const file=policyPaths?.[plane],digest=policySha256?.[plane];
+    if(path.resolve(path.dirname(file??''))!==path.resolve(pointer.generation_root))throw new Error('legacy scope proof policy outside predecessor generation: '+plane);
+    policies[plane]=await readPinned(file,digest,plane+' policy');
+    const grant=policies[plane][GRANT_FIELDS[plane]];
+    if(typeof grant!=='string'||!path.isAbsolute(grant)||
+      path.win32.resolve(path.win32.dirname(grant)).toLowerCase()!==
+      path.win32.resolve(path.join(stateRoot,'runtime')).toLowerCase())
+      throw new Error('legacy scope proof grant path invalid: '+plane);
+    await mustBeAbsent(grant,plane+' grant');
+  }
+  const coding=policies.coding,autonomous=policies.autonomous;
+  if(coding.schema!=='deadbyte.coding-policy.v1'||autonomous.schema!=='deadbyte.autonomous-policy.v1'||
+    coding.enabled!==true||autonomous.enabled!==true||
+    autonomous.coding_policy_sha256!==policySha256.coding)
+    throw new Error('legacy scope proof Coding/Autonomous binding invalid');
+  if(!exactDrive(coding.roots?.local_c,'C:\\')||!exactDrive(coding.roots?.local_d,'D:\\'))
+    throw new Error('legacy scope proof expected drive roots missing');
+  for(const [id,root] of Object.entries(coding.roots)){
+    const normalized=path.win32.normalize(String(root?.path??''));
+    if(/^[a-z]:\\$/i.test(normalized)&&!['local_c','local_d'].includes(id))
+      throw new Error('legacy scope proof unexpected drive root: '+id);
+  }
+  if(!Array.isArray(autonomous.root_ids)||autonomous.root_ids.length===0||
+    autonomous.root_ids.some(id=>id==='local_c'||id==='local_d'||!Object.hasOwn(coding.roots,id)))
+    throw new Error('legacy scope proof autonomous roots unsafe');
+  const approval=await verifyMigrationApproval({approvalPath,approvalSha256,ownerPublicKeyPath,now,expected:{
+    predecessor_release_id:pointer.release_id,predecessor_version:pointer.version,
+    predecessor_manifest_sha256:pointer.manifest_sha256,
+    predecessor_generation_manifest_sha256:pointer.generation_manifest_sha256,
+    candidate_version:candidate.version,candidate_manifest_sha256:candidate.manifest_sha256,
+    predecessor_policy_sha256:policySha256,preflight_subject_sha256:preflightSubjectSha256
+  }});
+  const subject={release_id:pointer.release_id,version:pointer.version,
+    generation_manifest_sha256:pointer.generation_manifest_sha256,
+    coding_policy_sha256:policySha256.coding,autonomous_policy_sha256:policySha256.autonomous,
+    candidate_version:candidate.version,candidate_manifest_sha256:candidate.manifest_sha256,
+    preflight_subject_sha256:preflightSubjectSha256,owner_approval_subject_sha256:approval.subject_sha256,
+    grant_absent_planes:PLANES};
+  return Object.freeze({
+    state:'VERIFIED_OFFLINE_LEGACY_SCOPE_REPAIR',
+    ...subject,owner_approval_verified:true,owner_key_id:approval.owner_key_id,
+    approval_expires_at_utc:approval.expires_at_utc,
+    subject_sha256:sha(Buffer.from(canonicalJson(subject),'utf8'))
+  });
+}

package/src/release-generation.mjs

@@ -51,11 +51,30 @@ export async function verifyGenerationBundle(root,expectedManifestSha256){
   return {files,generation_manifest_sha256:manifestSha256};
 }
 
-function rebindCodingPolicy(raw,{developmentRoot,stateRoot,parityScratchRoot}){
+export function rebindCodingPolicy(raw,{developmentRoot,stateRoot,parityScratchRoot}){
   const policy=clone(raw);
   policy.lease_file=path.join(stateRoot,'runtime','coding-grant.json');
   policy.evidence_dir=path.join(stateRoot,'evidence','coding');
   if(!policy.roots?.core) throw new Error('coding policy requires core root for R27');
+  // A prior generation may contain legacy whole-drive roots. Never let those
+  // capabilities propagate into a new signed release generation.
+  const removed=new Set();
+  for(const [id,root] of Object.entries(policy.roots)){
+    if(typeof root?.path!=='string') throw new Error('coding root path invalid: '+id);
+    const full=path.win32.normalize(root.path),drive=path.win32.parse(full).root;
+    if(!/^[a-z]:\\$/i.test(drive)||full.toLowerCase()!==drive.toLowerCase()) continue;
+    if(!((id==='local_c'&&drive.toLowerCase()==='c:\\')||
+         (id==='local_d'&&drive.toLowerCase()==='d:\\')))
+      throw new Error('unrecognized whole-drive Coding root: '+id);
+    removed.add(id);
+    delete policy.roots[id];
+  }
+  for(const [id,command] of Object.entries(policy.commands??{})){
+    if(!Array.isArray(command.root_ids)) continue;
+    const next=command.root_ids.filter(rootId=>!removed.has(rootId));
+    if(next.length===0) throw new Error('Coding command would lose every scoped root: '+id);
+    command.root_ids=next;
+  }
   policy.roots.core.path=developmentRoot;
   policy.roots.parity_scratch={path:parityScratchRoot,read:true,write:true,exec:false,deny_paths:[]};
   return policy;

package/src/remote-device-r44.mjs

@@ -73,7 +73,7 @@ async function withTimeout(operation,timeoutMs,label){
     ]);
   }finally{if(timer)clearTimeout(timer);}
 }
-function payloadHash({deviceId,epoch,capabilityId,payload}){
+export function payloadHash({deviceId,epoch,capabilityId,payload}){
   return sha(Buffer.from(canonicalJson({device_id:deviceId,epoch,capability_id:capabilityId,payload}),'utf8'));
 }
 

package/src/remote-live-log.mjs

@@ -325,9 +325,40 @@ export function createLiveTimelineWriter({stream=process.stdout,displayMode='uni
   if(!stream||typeof stream.write!=='function') throw new Error('timeline writer stream invalid');
   if(!REMOTE_DISPLAY_MODES.includes(displayMode)) throw new Error('timeline writer display mode invalid');
   if(typeof rewrite!=='boolean') throw new Error('timeline writer rewrite invalid');
-  let active=null;
+  let active=null,congested=false,needsNewline=false,suppressedSinceDrain=0,totalSuppressed=0;
+  // Display output is lossy under a stalled consumer; the on-disk signed audit
+  // and runtime logs remain authoritative. Do not enqueue unbounded text in
+  // Node's Writable internal buffer after write() returns false.
+  function emit(chunk){
+    const ok=stream.write(chunk);
+    if(ok===false){
+      if(typeof stream.once!=='function') throw new Error('timeline writer requires drain-capable stream under backpressure');
+      congested=true;
+      stream.once('drain',onDrain);
+    }
+  }
+  function onDrain(){
+    congested=false;
+    if(active||needsNewline){
+      active=null;needsNewline=false;
+      emit('\n');
+      if(congested) return;
+    }
+    if(suppressedSinceDrain){
+      const skipped=suppressedSinceDrain;
+      suppressedSinceDrain=0;
+      emit('[WARN] LIVELOG '+skipped+' presentation lines suppressed by stdout backpressure; inspect signed audit and runtime logs.\n');
+    }
+  }
+  function noteSuppressed(){
+    suppressedSinceDrain++;
+    totalSuppressed++;
+  }
   function flush(){
-    if(active){stream.write('\n');active=null;}
+    if(!active) return;
+    active=null;
+    if(congested){needsNewline=true;return;}
+    emit('\n');
   }
   // Inspect terminal width for every emission: resize must not erase a wrapped prior line.
   // Unknown Unicode cell width falls back to append-only output, never truncation.
@@ -337,20 +368,24 @@ export function createLiveTimelineWriter({stream=process.stdout,displayMode='uni
   }
   function write(line,{event_type=null,request_id=null}={}){
     if(typeof line!=='string'||!line) return;
+    if(congested){noteSuppressed();return;}
     const tty=stream.isTTY===true&&rewrite;
     if(!tty||!fitsOneRow(line)){
       if(active) flush();
-      stream.write(line+'\n');
+      if(congested){noteSuppressed();return;}
+      emit(line+'\n');
       return;
     }
     if(active&&event_type==='tool.result'&&request_id&&request_id===active.request_id){
-      stream.write('\r\x1b[2K'+line+'\n');active=null;return;
+      active=null;emit('\r\x1b[2K'+line+'\n');return;
     }
     if(active) flush();
-    if(event_type==='tool.call'&&request_id){stream.write(line);active={request_id};return;}
-    stream.write(line+'\n');
+    if(congested){noteSuppressed();return;}
+    if(event_type==='tool.call'&&request_id){emit(line);active={request_id};return;}
+    emit(line+'\n');
   }
-  return Object.freeze({write,flush,pending(){return active?{...active}:null;}});
+  return Object.freeze({write,flush,pending(){return active?{...active}:null;},
+    retention(){return Object.freeze({congested,suppressed_since_drain:suppressedSinceDrain,total_suppressed:totalSuppressed});}});
 }
 
 export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,foldHeartbeats=false,heartbeatBurstLimit=10,heartbeatWindowMs=3000,displayMode='unicode',rootPaths={},trace=false,slowCallMs=1000}={}){
@@ -549,6 +584,7 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
       (p50!==null?' | p50 '+formatDuration(p50)+' | p95 '+formatDuration(p95)+' | p99 '+formatDuration(p99)+' | sample '+durationSamples.length+'/'+durationObservedCount:'')+
       (slowest?' | slowest '+slowest.tool+' '+formatDuration(slowest.duration_ms):'')+
       ' | peak in-flight '+peakInFlight+
+      (pendingOverflow?' | '+pendingOverflow+' presentation spans untracked (overflow); inspect signed audit':'')+
       (foldedHeartbeatLines?' | folded '+foldedHeartbeatLines+' heartbeat lines':'')+
       (top?' | top: '+top:''),displayMode);
   }

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.52';
+export const DEADBYTE_VERSION = '0.15.54';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';