deadbyte-mcp 0.15.55 → 0.15.58

package/src/deadbyte-cli.mjs

@@ -1,653 +1,858 @@
 #!/usr/bin/env node
-import { closeSync, openSync } from 'node:fs';
-import { lstat, mkdir, open, readFile, readdir, stat, writeFile } from 'node:fs/promises';
-import { spawn, spawnSync } from 'node:child_process';
-import { createHash, randomBytes } from 'node:crypto';
-import os from 'node:os';
-import path from 'node:path';
-import { setTimeout as sleep } from 'node:timers/promises';
-import { fileURLToPath } from 'node:url';
-import { defaultPublicKeyPath } from './trust.mjs';
-import { verifyAuditChain } from './audit-verify.mjs';
-import { openRemoteResultJournal, parseRemoteResultCursor } from './remote-result-journal.mjs';
-import { DEADBYTE_VERSION } from './version.mjs';
-import { runNativeInspect } from './native-inspector-r67.mjs';
-import { exportOfflineDiagnostics } from './r67-diagnostic-export.mjs';
-import { verifyOfflineDiagnosticsZip } from './r67-diagnostics-verify.mjs';
-import { parseActivePointer } from './release-slot.mjs';
-import { printDoctor } from './doctor-r45.mjs';
-import { classifyRemoteAuditOutcome, createLiveTimelineFilter, createLiveTimelineTracker, createLiveTimelineWriter, formatCompactAuditEvent, formatRemoteLifecycle, formatRemoteToolCall, formatRuntimeDiagnosticLine, selectLiveLogNames } from './remote-live-log.mjs';
-import { prepareRemoteConsole, remoteDisplayText } from './remote-console.mjs';
-import { ensureRuntimeCoherence } from './runtime-coherence.mjs';
-import { windowsPowerShellEnvironment } from './runtime-update.mjs';
-import { resolveStateRoot } from './state-root.mjs';
-import {foregroundIdentityMatches,queryForegroundIdentity,validForegroundIdentity} from './foreground-process-identity.mjs';
-import {readRemoteMarkerSnapshot,deletePinnedRemoteMarker} from './foreground-marker-cas-win32.mjs';
-import {acquireForegroundSessionLock} from './foreground-session-lock.mjs';
-import { AUTHORITY_PLANES, authorityVector, authorityRestorePlan, parseAuthorityObservation, assertAuthorityVector, assertRuntimeReadyObservation, authorityBanner } from './remote-authority.mjs';
-import { decodeRemoteLogBytes, boundedRemoteDiagnostic, readRemoteLogAppend } from './remote-log-decode-r60.mjs';
-
-const REMOTE_COMMANDS=new Set([
-  'menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest',
-  'armprocess','disarmprocess','processstatus','armhost','disarmhost','hoststatus','hosttest',
-  'armdesktop','disarmdesktop','desktopstatus',
-  'armcoding','disarmcoding','codingstatus','codingtest','armautonomous','disarmautonomous','autonomousstatus','autonomoustest'
-]);
-const REMOTE_STATUS_TIMEOUT_MS=30000;
-const REMOTE_START_TIMEOUT_MS=150000;
-const SESSION_CLEANUP=['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost'];
-const SUPERVISOR_COMMANDS=Object.freeze({
-  start:'supervisorstart',stop:'supervisorstop',status:'supervisorstatus',recover:'supervisorrecover'
-});
-const CURRENT_PACKAGE_ROOT=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
-const CURRENT_DEPLOY_SCRIPT=path.join(CURRENT_PACKAGE_ROOT,'scripts','deploy-r48.mjs');
-const REMOTE_UPDATE_TIMEOUT_MS=900000;
-const LIVE_LOG_DISCOVERY_INTERVAL_MS=1000;
+import { closeSync, openSync } from 'node:fs';
+import { lstat, mkdir, open, readFile, readdir, stat, writeFile } from 'node:fs/promises';
+import { spawn, spawnSync } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { fileURLToPath } from 'node:url';
+import { defaultPublicKeyPath } from './trust.mjs';
+import { verifyAuditChain } from './audit-verify.mjs';
+import { openRemoteResultJournal, parseRemoteResultCursor } from './remote-result-journal.mjs';
+import { DEADBYTE_VERSION } from './version.mjs';
+import { runNativeInspect } from './native-inspector-r67.mjs';
+import { exportOfflineDiagnostics } from './r67-diagnostic-export.mjs';
+import { verifyOfflineDiagnosticsZip } from './r67-diagnostics-verify.mjs';
+import { parseActivePointer } from './release-slot.mjs';
+import { printDoctor } from './doctor-r45.mjs';
+import { classifyRemoteAuditOutcome, createLiveTimelineFilter, createLiveTimelineTracker, createLiveTimelineWriter, formatCompactAuditEvent, formatRemoteLifecycle, formatRemoteToolCall, formatRuntimeDiagnosticLine, selectLiveLogNames } from './remote-live-log.mjs';
+import { prepareRemoteConsole, remoteDisplayText } from './remote-console.mjs';
+import { ensureRuntimeCoherence } from './runtime-coherence.mjs';
+import { windowsPowerShellEnvironment } from './runtime-update.mjs';
+import { resolveStateRoot } from './state-root.mjs';
+import {foregroundIdentityMatches,queryForegroundIdentity,validForegroundIdentity,proveRestrictedPidReuse} from './foreground-process-identity.mjs';
+import {readRemoteMarkerSnapshot,deletePinnedRemoteMarker} from './foreground-marker-cas-win32.mjs';
+import {acquireForegroundSessionLock} from './foreground-session-lock.mjs';
+import { AUTHORITY_PLANES, authorityVector, authorityRestorePlan, parseAuthorityObservation, assertAuthorityVector, assertRuntimeReadyObservation, authorityBanner } from './remote-authority.mjs';
+import { decodeRemoteLogBytes, boundedRemoteDiagnostic, readRemoteLogAppend } from './remote-log-decode-r60.mjs';
+import {reconcileStaleMarker,resumeMarkerReconciliation,recoverPublishedMarkerTerminal} from './clean-activation-recovery-r153.mjs';
+
+const REMOTE_COMMANDS=new Set([
+  'menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest',
+  'armprocess','disarmprocess','processstatus','armhost','disarmhost','hoststatus','hosttest',
+  'armdesktop','disarmdesktop','desktopstatus',
+  'armcoding','disarmcoding','codingstatus','codingtest','armautonomous','disarmautonomous','autonomousstatus','autonomoustest'
+]);
+const REMOTE_STATUS_TIMEOUT_MS=30000;
+const REMOTE_START_TIMEOUT_MS=150000;
+const SESSION_CLEANUP=['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost'];
+const SUPERVISOR_COMMANDS=Object.freeze({
+  start:'supervisorstart',stop:'supervisorstop',status:'supervisorstatus',recover:'supervisorrecover'
+});
+const CURRENT_PACKAGE_ROOT=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const CURRENT_DEPLOY_SCRIPT=path.join(CURRENT_PACKAGE_ROOT,'scripts','deploy-r48.mjs');
+const UAC_BOOTSTRAP_SCRIPT=path.join(CURRENT_PACKAGE_ROOT,'scripts','bootstrap-uac-migration-r153.ps1');
+const REMOTE_UPDATE_TIMEOUT_MS=900000;
+const LIVE_LOG_DISCOVERY_INTERVAL_MS=1000;
 const TRUSTED_WINDOWS_ROOT='C:\\Windows';
-
-function stateRoot(){return resolveStateRoot();}
-async function requireRegular(file,label){const info=await lstat(file);if(!info.isFile()||info.isSymbolicLink()) throw new Error(`${label} must be a regular non-symlink file`);return file;}
-function printHelp(){
-  const exact=`deadbyte-mcp@${DEADBYTE_VERSION}`;
-  process.stdout.write([
-    'DEADBYTE MCP CLI','',
-    `  npx -y ${exact} doctor              # verify current package/release truth`,
-    `  npx -y ${exact} mcp                 # stdio MCP server for local clients`,
-    `  npx -y ${exact} remote              # safe observation-only foreground session`,
-    `  npx -y ${exact} remote --operator   # process/coding/autonomous; explicit owner gates still apply`,
-    `  npx -y ${exact} remote --desktop    # session with Desktop authority; Host remains disarmed`,
-    `  npx -y ${exact} remote --host       # session with Host authority; Desktop remains disarmed`,
-    `  npx -y ${exact} remote --full       # explicit five-plane foreground session`,
-    `  npx -y ${exact} remote --resume <cursor> # replay missed results, then reconnect`,
-    `  npx -y ${exact} remote --trace           # show trace/span identity without payload detail`,
-    `  npx -y ${exact} remote --filter <expr>   # presentation filter: tool/category/status/trace`,
-    `  npx -y ${exact} remote status`,
-    `  npx -y ${exact} remote restart`,
-    `  npx -y ${exact} supervisor status`,
-    `  npx -y ${exact} supervisor recover`,
-    `  npx -y ${exact} audit verify`,
-    `  npx -y ${exact} audit status`,
-    `  npx -y ${exact} diagnostics export --output <local.zip> # offline, never uploads`,
-    `  npx -y ${exact} diagnostics verify --input <local.zip>  # local structural/CRC verify`,
-    `  npx -y ${exact} inspect process [limit]       # local native process snapshot`,
-    `  npx -y ${exact} inspect identity PID          # native process creation token`,
-    `  npx -y ${exact} inspect memory self [limit]     # local VirtualQueryEx metadata only`,
-    `  npx -y ${exact} inspect memory PID <creation_filetime> [limit] # PID-reuse guarded`,
-    `  npx -y ${exact} inspect pe <file>            # local native PE32/PE32+ inspection`,''
-  ].join('\n'));
-}
-async function remoteContext(){
-  if(process.platform!=='win32') throw new Error('remote controller is currently Windows-only');
-  const root=stateRoot();
-  const launcher=await requireRegular(path.join(root,'bin','DEADBYTE-MCP.ps1'),'stable DEADBYTE launcher');
+
+function stateRoot(){return resolveStateRoot();}
+async function requireRegular(file,label){const info=await lstat(file);if(!info.isFile()||info.isSymbolicLink()) throw new Error(`${label} must be a regular non-symlink file`);return file;}
+function printHelp(){
+  const exact=`deadbyte-mcp@${DEADBYTE_VERSION}`;
+  process.stdout.write([
+    'DEADBYTE MCP CLI','',
+    `  npx -y ${exact} doctor              # verify current package/release truth`,
+    `  npx -y ${exact} mcp                 # stdio MCP server for local clients`,
+    `  npx -y ${exact} remote              # safe observation-only foreground session`,
+    `  npx -y ${exact} remote --operator   # process/coding/autonomous; explicit owner gates still apply`,
+    `  npx -y ${exact} remote --desktop    # session with Desktop authority; Host remains disarmed`,
+    `  npx -y ${exact} remote --host       # session with Host authority; Desktop remains disarmed`,
+    `  npx -y ${exact} remote --full       # explicit five-plane foreground session`,
+    `  npx -y ${exact} remote --resume <cursor> # replay missed results, then reconnect`,
+    `  npx -y ${exact} remote --trace           # show trace/span identity without payload detail`,
+    `  npx -y ${exact} remote --filter <expr>   # presentation filter: tool/category/status/trace`,
+    `  npx -y ${exact} remote status`,
+    `  npx -y ${exact} remote restart`,
+    `  npx -y ${exact} supervisor status`,
+    `  npx -y ${exact} supervisor recover`,
+    `  npx -y ${exact} audit verify`,
+    `  npx -y ${exact} audit status`,
+    `  npx -y ${exact} diagnostics export --output <local.zip> # offline, never uploads`,
+    `  npx -y ${exact} diagnostics verify --input <local.zip>  # local structural/CRC verify`,
+    `  npx -y ${exact} inspect process [limit]       # local native process snapshot`,
+    `  npx -y ${exact} inspect identity PID          # native process creation token`,
+    `  npx -y ${exact} inspect memory self [limit]     # local VirtualQueryEx metadata only`,
+    `  npx -y ${exact} inspect memory PID <creation_filetime> [limit] # PID-reuse guarded`,
+    `  npx -y ${exact} inspect pe <file>            # local native PE32/PE32+ inspection`,''
+  ].join('\n'));
+}
+async function remoteContext(){
+  if(process.platform!=='win32') throw new Error('remote controller is currently Windows-only');
+  const root=stateRoot();
+  const launcher=await requireRegular(path.join(root,'bin','DEADBYTE-MCP.ps1'),'stable DEADBYTE launcher');
   const powershell=await requireRegular(path.join(TRUSTED_WINDOWS_ROOT,'System32','WindowsPowerShell','v1.0','powershell.exe'),'Windows PowerShell');
-  return {root,launcher,powershell};
-}
-function boundedSingleLine(value,maxChars=2048){
-  return boundedRemoteDiagnostic(value,maxChars);
-}
-async function readActiveRuntimeBinding(root){
-  const file=path.join(root,'active-release.json');
-  try{return parseActivePointer(await readFile(file,'utf8'));}
-  catch(error){if(error?.code==='ENOENT') return null;throw new Error(`active runtime pointer invalid: ${boundedSingleLine(error?.message||error,512)}`);}
-}
-async function readLiveRootPaths(root){
-  const active=await readActiveRuntimeBinding(root);
-  if(!active) return Object.freeze({});
-  const file=path.join(active.generation_root,'coding-policy.json');
-  let raw;
-  try{raw=JSON.parse(await readFile(file,'utf8'));}
-  catch(error){if(error?.code==='ENOENT') return Object.freeze({});throw new Error(`live root policy invalid: ${boundedSingleLine(error?.message||error,512)}`);}
-  if(raw?.schema!=='deadbyte.coding-policy.v1'||!raw.roots||typeof raw.roots!=='object'||Array.isArray(raw.roots)) throw new Error('live root policy schema invalid');
-  const roots={};
-  for(const [id,spec] of Object.entries(raw.roots)){
-    if(!/^[A-Za-z0-9._-]{1,64}$/.test(id)||!spec||typeof spec!=='object'||typeof spec.path!=='string'||!path.isAbsolute(spec.path)) continue;
-    roots[id]=path.resolve(spec.path);
-  }
-  return Object.freeze(roots);
-}
-async function reportVersionCoherence(root,{displayMode='ascii'}={}){
-  const active=await readActiveRuntimeBinding(root);
-  if(!active||active.version===DEADBYTE_VERSION) return active;
-  writeRemote(process.stderr,`${remoteTag('warn',displayMode)} VERSION SKEW: CLI package ${DEADBYTE_VERSION}; active runtime ${active.version} (${active.release_id})\n`,displayMode);
-  return active;
-}
-async function synchronizeForegroundRuntime(ctx,{displayMode='unicode'}={}){
-  const packageManifestSha256=createHash('sha256').update(await readFile(path.join(CURRENT_PACKAGE_ROOT,'MANIFEST.SHA256'))).digest('hex');
-  return ensureRuntimeCoherence({
-    cliVersion:DEADBYTE_VERSION,
-    packageManifestSha256,
-    readActive:()=>readActiveRuntimeBinding(ctx.root),
-    disarmPrivileged:async()=>{
-      for(const command of ['disarmhost','disarmdesktop']){
-        const result=invokeController(ctx,command,{capture:true,allowFailure:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-        if(result.status!==0) throw new Error(`runtime coherence '${command}' failed exit=${result.status}`);
-      }
-    },
-    activateCurrentPackage:async()=>{
-      const result=spawnSync(process.execPath,[CURRENT_DEPLOY_SCRIPT],{
-        cwd:CURRENT_PACKAGE_ROOT,
-        env:{...process.env,DEADBYTE_STATE_ROOT:ctx.root},
-        encoding:'utf8',
-        windowsHide:true,
-        shell:false,
-        timeout:REMOTE_UPDATE_TIMEOUT_MS,
-        maxBuffer:16*1024*1024
-      });
-      if(result.error){
-        if(result.error?.code==='ETIMEDOUT') throw new Error(`runtime coherence activation timed out after ${REMOTE_UPDATE_TIMEOUT_MS}ms`);
-        throw result.error;
-      }
-      if(result.status!==0){
-        const detail=boundedSingleLine(result.stderr||result.stdout||'no deployment output',2048);
-        throw new Error(`runtime coherence activation failed exit=${String(result.status)}: ${detail}`);
-      }
-    },
-    onEvent:event=>{
-      if(event.phase==='upgrade_start') writeRemote(process.stdout,`[UPDATE] Runtime ${event.from_version} -> ${event.to_version}; activating current package...\n`,displayMode);
-      else if(event.phase==='upgrade_complete') writeRemote(process.stdout,`[UPDATE] Runtime synchronized: ${event.release_id||event.to_version}\n`,displayMode);
-    }
-  });
-}
-async function synchronizeOneShotRuntime(ctx,{displayMode='ascii'}={}){
-  const active=await readActiveRuntimeBinding(ctx.root);
-  if(!active||active.version===DEADBYTE_VERSION) return synchronizeForegroundRuntime(ctx,{displayMode});
-  const before=observedAuthority(ctx);
-  const expected=Object.fromEntries(AUTHORITY_PLANES.map(plane=>[plane,before.authority[plane].armed]));
-  const result=await synchronizeForegroundRuntime(ctx,{displayMode});
-  if(result.status!=='upgraded') return result;
-  for(const command of authorityRestorePlan(before)){
-    const restored=invokeController(ctx,command,{capture:true,allowFailure:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-    if(restored.status!==0) throw new Error(`runtime coherence authority restore '${command}' failed exit=${restored.status}`);
-  }
-  assertAuthorityVector(observedAuthority(ctx),expected);
-  return result;
-}
-async function readControllerStartFailure(root,command,{maxChars=2048}={}){
-  const file=path.join(root,'runtime','controller-start-failure.json');
-  let raw;
-  try{raw=await readFile(file,'utf8');}catch(error){if(error?.code==='ENOENT') return null;throw error;}
-  let value;
-  try{value=JSON.parse(String(raw).replace(/^\uFEFF/,''));}catch{return null;}
-  if(value?.schema!=='deadbyte.controller-start-failure.v1'||String(value?.command||'')!==command||typeof value?.message!=='string') return null;
-  const message=boundedSingleLine(value.message,maxChars);
-  return message?{file,message}:null;
-}
-async function readTailBounded(file,maxBytes=4096){
-  try{
-    const info=await stat(file);
-    const length=Math.min(info.size,maxBytes);
-    if(length===0) return '';
-    const buffer=Buffer.alloc(length);
-    const handle=await open(file,'r');
-    let encoding=null;
-    try{
-      const header=Buffer.alloc(2);await handle.read(header,0,2,0);
-      if(header[0]===0xff&&header[1]===0xfe)encoding='utf16le';
-      await handle.read(buffer,0,length,info.size-length);
-    }finally{await handle.close();}
-    return boundedSingleLine(decodeRemoteLogBytes(file,buffer,{encoding}),maxBytes);
-  }catch(error){if(error?.code==='ENOENT') return '';throw error;}
-}
-function invokeController(ctx,command,{capture=false,allowFailure=false,echoCaptured=true,timeoutMs=null,discardOutput=false,redirectOutput=null,json=false,probeMode=null}={}){
-  if(capture&&discardOutput) throw new Error('invokeController cannot capture and discard output together');
-  if(capture&&redirectOutput) throw new Error('invokeController cannot capture and redirect output together');
-  if(discardOutput&&redirectOutput) throw new Error('invokeController cannot discard and redirect output together');
-  let stdoutFd=null,stderrFd=null,result;
-  try{
-    let stdio;
-    if(discardOutput) stdio=['ignore','ignore','ignore'];
-    else if(redirectOutput){
-      stdoutFd=openSync(redirectOutput.stdout_path,'w');
-      stderrFd=openSync(redirectOutput.stderr_path,'w');
-      stdio=['ignore',stdoutFd,stderrFd];
-    }else stdio=capture?['ignore','pipe','pipe']:'inherit';
-    const options={stdio,encoding:capture?'utf8':undefined,windowsHide:false,shell:false,
+  return {root,launcher,powershell};
+}
+function boundedSingleLine(value,maxChars=2048){
+  return boundedRemoteDiagnostic(value,maxChars);
+}
+async function readActiveRuntimeBinding(root){
+  const file=path.join(root,'active-release.json');
+  try{return parseActivePointer(await readFile(file,'utf8'));}
+  catch(error){if(error?.code==='ENOENT') return null;throw new Error(`active runtime pointer invalid: ${boundedSingleLine(error?.message||error,512)}`);}
+}
+async function readLiveRootPaths(root){
+  const active=await readActiveRuntimeBinding(root);
+  if(!active) return Object.freeze({});
+  const file=path.join(active.generation_root,'coding-policy.json');
+  let raw;
+  try{raw=JSON.parse(await readFile(file,'utf8'));}
+  catch(error){if(error?.code==='ENOENT') return Object.freeze({});throw new Error(`live root policy invalid: ${boundedSingleLine(error?.message||error,512)}`);}
+  if(raw?.schema!=='deadbyte.coding-policy.v1'||!raw.roots||typeof raw.roots!=='object'||Array.isArray(raw.roots)) throw new Error('live root policy schema invalid');
+  const roots={};
+  for(const [id,spec] of Object.entries(raw.roots)){
+    if(!/^[A-Za-z0-9._-]{1,64}$/.test(id)||!spec||typeof spec!=='object'||typeof spec.path!=='string'||!path.isAbsolute(spec.path)) continue;
+    roots[id]=path.resolve(spec.path);
+  }
+  return Object.freeze(roots);
+}
+async function reportVersionCoherence(root,{displayMode='ascii'}={}){
+  const active=await readActiveRuntimeBinding(root);
+  if(!active||active.version===DEADBYTE_VERSION) return active;
+  writeRemote(process.stderr,`${remoteTag('warn',displayMode)} VERSION SKEW: CLI package ${DEADBYTE_VERSION}; active runtime ${active.version} (${active.release_id})\n`,displayMode);
+  return active;
+}
+async function synchronizeForegroundRuntime(ctx,{displayMode='unicode',migrationContext=null}={}){
+  const packageManifestSha256=createHash('sha256').update(await readFile(path.join(CURRENT_PACKAGE_ROOT,'MANIFEST.SHA256'))).digest('hex');
+  return ensureRuntimeCoherence({
+    cliVersion:DEADBYTE_VERSION,
+    packageManifestSha256,
+    readActive:()=>readActiveRuntimeBinding(ctx.root),
+    disarmPrivileged:async()=>{
+      for(const command of ['disarmhost','disarmdesktop']){
+        const result=invokeController(ctx,command,{capture:true,allowFailure:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+        if(result.status!==0) throw new Error(`runtime coherence '${command}' failed exit=${result.status}`);
+      }
+    },
+    activateCurrentPackage:async()=>{
+      let result=spawnSync(process.execPath,[CURRENT_DEPLOY_SCRIPT],{
+        cwd:CURRENT_PACKAGE_ROOT,
+        env:{...process.env,DEADBYTE_STATE_ROOT:ctx.root},
+        encoding:'utf8',
+        windowsHide:true,
+        shell:false,
+        timeout:REMOTE_UPDATE_TIMEOUT_MS,
+        maxBuffer:16*1024*1024
+      });
+      if(result.error){
+        if(result.error?.code==='ETIMEDOUT') throw new Error(`runtime coherence activation timed out after ${REMOTE_UPDATE_TIMEOUT_MS}ms`);
+        throw result.error;
+      }
+      if(result.status!==0){
+        const detail=boundedSingleLine(result.stderr||result.stdout||'no deployment output',2048);
+        if(/activation preflight rejected:\s*AUTHORITY_UNVERIFIED\b/.test(detail)){
+          if(!migrationContext?.receipt_path||!/^[0-9a-f]{64}$/.test(String(migrationContext.receipt_sha256??'')))
+            throw new Error('runtime legacy migration marker reconciliation receipt unavailable');
+          const expectedArtifact=path.join(ctx.root,'evidence','npm-publication',DEADBYTE_VERSION,`deadbyte-mcp-${DEADBYTE_VERSION}.tgz`);
+          await requireRegular(expectedArtifact,'exact release tarball');
+          const publicationDir=path.dirname(expectedArtifact),claimPath=path.join(publicationDir,'claim.json');
+          await requireRegular(claimPath,'npm publication claim');
+          const claim=JSON.parse((await readFile(claimPath,'utf8')).replace(/^\uFEFF/,''));
+          const artifactBytes=await readFile(expectedArtifact),artifactSha256=createHash('sha256').update(artifactBytes).digest('hex');
+          if(claim?.schema!=='deadbyte.npm-publication-claim.r65.v1'||claim.version!==DEADBYTE_VERSION||
+            claim.tarball_sha256!==artifactSha256||!/^[0-9a-f]{64}$/.test(String(claim.manifest_sha256??'')))
+            throw new Error('exact release tarball differs from immutable npm publication claim');
+          const publicationEvents=(await readdir(publicationDir)).filter(name=>/^event-\d+-[0-9a-f]{16}\.json$/.test(name));
+          let registryVerified=false;
+          for(const name of publicationEvents){
+            const event=JSON.parse((await readFile(path.join(publicationDir,name),'utf8')).replace(/^\uFEFF/,''));
+            if(event?.schema==='deadbyte.npm-publication-event.r65.v1'&&event.state==='REGISTRY_IDENTITY_VERIFIED'&&
+              event.tarball_sha256===artifactSha256)registryVerified=true;
+          }
+          if(!registryVerified)throw new Error('exact release tarball lacks registry identity verification evidence');
+          const systemTar=await requireRegular(path.join(TRUSTED_WINDOWS_ROOT,'System32','tar.exe'),'Windows tar');
+          const manifestRead=spawnSync(systemTar,['-xOf',expectedArtifact,'package/MANIFEST.SHA256'],{
+            encoding:'utf8',windowsHide:true,shell:false,timeout:30000,maxBuffer:4*1024*1024});
+          if(manifestRead.error||manifestRead.status!==0)throw new Error('exact release tarball manifest extraction failed');
+          const packagedManifest=manifestRead.stdout,packagedManifestSha256=createHash('sha256').update(packagedManifest,'utf8').digest('hex');
+          if(packagedManifestSha256!==claim.manifest_sha256)throw new Error('exact release tarball manifest identity mismatch');
+          const bootstrapLine=packagedManifest.split(/\r?\n/).find(line=>line.endsWith('  scripts/bootstrap-uac-migration-r153.ps1'));
+          const bootstrapMatch=/^([0-9a-f]{64})  scripts\/bootstrap-uac-migration-r153\.ps1$/.exec(bootstrapLine??'');
+          if(!bootstrapMatch)throw new Error('exact release tarball bootstrap identity missing');
+          const evidenceDir=path.join(ctx.root,'evidence','legacy-migration');
+          await mkdir(evidenceDir,{recursive:true});
+          const id=`r153-${Date.now()}-${randomBytes(8).toString('hex')}`;
+          const stdoutPath=path.join(evidenceDir,`${id}.stdout.log`),stderrPath=path.join(evidenceDir,`${id}.stderr.log`);
+          writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Legacy broad-root migration requires one-time Windows UAC confirmation.\n`,displayMode);
+          result=spawnSync(ctx.powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',UAC_BOOTSTRAP_SCRIPT,
+            '-ExpectedVersion',DEADBYTE_VERSION,'-StateRoot',ctx.root,'-TarballPath',expectedArtifact,
+            '-ExpectedTarballSha256',artifactSha256,'-ExpectedManifestSha256',packagedManifestSha256,
+            '-ExpectedBootstrapSha256',bootstrapMatch[1],
+            '-StdoutPath',stdoutPath,'-StderrPath',stderrPath,
+            '-MarkerReceiptPath',migrationContext.receipt_path,'-MarkerReceiptSha256',migrationContext.receipt_sha256],{
+            cwd:CURRENT_PACKAGE_ROOT,env:windowsPowerShellEnvironment(process.env),encoding:'utf8',windowsHide:true,shell:false,
+            timeout:REMOTE_UPDATE_TIMEOUT_MS,maxBuffer:16*1024*1024
+          });
+          if(result.error){
+            if(result.error?.code==='ETIMEDOUT')throw new Error(`runtime migration UAC timed out after ${REMOTE_UPDATE_TIMEOUT_MS}ms`);
+            throw result.error;
+          }
+          if(result.status===0)return;
+          const uacDetail=boundedSingleLine(result.stderr||result.stdout||'UAC was cancelled or migration failed',2048);
+          throw new Error(`runtime coherence UAC migration failed exit=${String(result.status)}: ${uacDetail}`);
+        }
+        throw new Error(`runtime coherence activation failed exit=${String(result.status)}: ${detail}`);
+      }
+    },
+    onEvent:event=>{
+      if(event.phase==='upgrade_start') writeRemote(process.stdout,`[UPDATE] Runtime ${event.from_version} -> ${event.to_version}; activating current package...\n`,displayMode);
+      else if(event.phase==='upgrade_complete') writeRemote(process.stdout,`[UPDATE] Runtime synchronized: ${event.release_id||event.to_version}\n`,displayMode);
+    }
+  });
+}
+async function synchronizeOneShotRuntime(ctx,{displayMode='ascii'}={}){
+  const active=await readActiveRuntimeBinding(ctx.root);
+  if(!active||active.version===DEADBYTE_VERSION) return synchronizeForegroundRuntime(ctx,{displayMode});
+  const before=observedAuthority(ctx);
+  const expected=Object.fromEntries(AUTHORITY_PLANES.map(plane=>[plane,before.authority[plane].armed]));
+  const result=await synchronizeForegroundRuntime(ctx,{displayMode});
+  if(result.status!=='upgraded') return result;
+  for(const command of authorityRestorePlan(before)){
+    const restored=invokeController(ctx,command,{capture:true,allowFailure:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+    if(restored.status!==0) throw new Error(`runtime coherence authority restore '${command}' failed exit=${restored.status}`);
+  }
+  assertAuthorityVector(observedAuthority(ctx),expected);
+  return result;
+}
+async function readControllerStartFailure(root,command,{maxChars=2048}={}){
+  const file=path.join(root,'runtime','controller-start-failure.json');
+  let raw;
+  try{raw=await readFile(file,'utf8');}catch(error){if(error?.code==='ENOENT') return null;throw error;}
+  let value;
+  try{value=JSON.parse(String(raw).replace(/^\uFEFF/,''));}catch{return null;}
+  if(value?.schema!=='deadbyte.controller-start-failure.v1'||String(value?.command||'')!==command||typeof value?.message!=='string') return null;
+  const message=boundedSingleLine(value.message,maxChars);
+  return message?{file,message}:null;
+}
+async function readTailBounded(file,maxBytes=4096){
+  try{
+    const info=await stat(file);
+    const length=Math.min(info.size,maxBytes);
+    if(length===0) return '';
+    const buffer=Buffer.alloc(length);
+    const handle=await open(file,'r');
+    let encoding=null;
+    try{
+      const header=Buffer.alloc(2);await handle.read(header,0,2,0);
+      if(header[0]===0xff&&header[1]===0xfe)encoding='utf16le';
+      await handle.read(buffer,0,length,info.size-length);
+    }finally{await handle.close();}
+    return boundedSingleLine(decodeRemoteLogBytes(file,buffer,{encoding}),maxBytes);
+  }catch(error){if(error?.code==='ENOENT') return '';throw error;}
+}
+function invokeController(ctx,command,{capture=false,allowFailure=false,echoCaptured=true,timeoutMs=null,discardOutput=false,redirectOutput=null,json=false,probeMode=null}={}){
+  if(capture&&discardOutput) throw new Error('invokeController cannot capture and discard output together');
+  if(capture&&redirectOutput) throw new Error('invokeController cannot capture and redirect output together');
+  if(discardOutput&&redirectOutput) throw new Error('invokeController cannot discard and redirect output together');
+  let stdoutFd=null,stderrFd=null,result;
+  try{
+    let stdio;
+    if(discardOutput) stdio=['ignore','ignore','ignore'];
+    else if(redirectOutput){
+      stdoutFd=openSync(redirectOutput.stdout_path,'w');
+      stderrFd=openSync(redirectOutput.stderr_path,'w');
+      stdio=['ignore',stdoutFd,stderrFd];
+    }else stdio=capture?['ignore','pipe','pipe']:'inherit';
+    const options={stdio,encoding:capture?'utf8':undefined,windowsHide:false,shell:false,
       env:windowsPowerShellEnvironment({...process.env,SystemRoot:TRUSTED_WINDOWS_ROOT,WINDIR:TRUSTED_WINDOWS_ROOT,
         ...(probeMode?{DEADBYTE_REMOTE_PROBE_MODE:probeMode}:{})})};
-    if(Number.isInteger(timeoutMs)&&timeoutMs>0) options.timeout=timeoutMs;
-    result=spawnSync(ctx.powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',ctx.launcher,command,...(json?['-Json']:[])],options);
-  }finally{
-    if(stdoutFd!==null) closeSync(stdoutFd);
-    if(stderrFd!==null) closeSync(stderrFd);
-  }
-  if(result.error){
-    if(result.error?.code==='ETIMEDOUT') throw new Error(`remote controller '${command}' timed out after ${timeoutMs}ms`);
-    throw result.error;
-  }
-  const status=Number.isInteger(result.status)?result.status:1;
-  const stdout=capture?String(result.stdout||''):'';
-  const stderr=capture?String(result.stderr||''):'';
-  if(capture&&echoCaptured){if(stdout) process.stdout.write(stdout);if(stderr) process.stderr.write(stderr);}
-  if(status!==0&&!allowFailure) throw new Error(`remote controller '${command}' failed exit=${status}`);
-  return {status,stdout,stderr};
-}
-function observedAuthority(ctx){
-  const result=invokeController(ctx,'status',{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS,json:true});
-  return parseAuthorityObservation(result.stdout);
-}
-function controllerRuntimeReady(text){
-  const value=String(text||'');
-  return /^DEADBYTE MCP\s*=\s*ONLINE\s*$/m.test(value)&&
-    /^Bridge PID\s*:\s*\d+\s+\[verified\]\s*$/m.test(value)&&
-    /^Cloud PID\s*:\s*\d+\s+\[verified\]\s*$/m.test(value)&&
-    /^Local ready\s*:\s*True\s*$/m.test(value)&&
-    /^Loop supervisor:\s*RUNNING\s+\[verified\]\s*$/m.test(value);
-}
-function controllerRuntimeDegraded(text){
-  return /^DEADBYTE MCP\s*=\s*(?:DEGRADED|FAILED)\s*$/m.test(String(text||''));
-}
-async function listLogFiles(root){
-  const auditDir=path.join(root,'audit');
-  const runtimeDir=path.join(root,'runtime','logs');
-  let auditNames=[],runtimeNames=[];
-  try{auditNames=await readdir(auditDir);}catch(error){if(error?.code!=='ENOENT') throw error;}
-  try{runtimeNames=await readdir(runtimeDir);}catch(error){if(error?.code!=='ENOENT') throw error;}
-  const selected=selectLiveLogNames({auditNames,runtimeNames});
-  return [
-    ...selected.audit.map(name=>path.join(auditDir,name)),
-    ...selected.runtime.map(name=>path.join(runtimeDir,name))
-  ];
-}
-function parseAuditLogLine(file,line){
-  if(!/^segment-\d{8}\.jsonl$/.test(path.basename(file))||!line) return null;
-  try{return JSON.parse(line);}catch{return null;}
-}
-function formatLogLine(file,line,{auditEvent=null,activityTracker=null,sequence=null,sourceSequence=null,verbose=false,displayMode='unicode'}={}){
-  if(!line) return null;
-  if(/^segment-\d{8}\.jsonl$/.test(path.basename(file))){
-    const event=auditEvent??parseAuditLogLine(file,line);
-    if(!event) return null;
-    return activityTracker?activityTracker.observe(event,{sequence,sourceSequence}):formatCompactAuditEvent(event);
-  }
-  return formatRuntimeDiagnosticLine(file,line,{verbose,displayMode});
-}
-function remoteResultJournalPath(root,sessionId){return path.join(root,'runtime','remote-results',`${sessionId}.json`);}
-function auditTimelineRecord(file,line,auditEvent=null){
-  const event=auditEvent??parseAuditLogLine(file,line);
-  if(!event) return null;
-  if(typeof event?.request_id!=='string'||!event.request_id||typeof event.tool!=='string'||!event.tool) return null;
-  const stamp=[event.ts,event.created_at_utc,event.observed_at_utc].find(value=>typeof value==='string'&&Number.isFinite(Date.parse(value)));
-  const observed=stamp?new Date(Date.parse(stamp)).toISOString():new Date().toISOString();
-  const payload_sha256=createHash('sha256').update(Buffer.from(line,'utf8')).digest('hex');
-  if(event.event_type==='tool.request') return {event_type:'tool.call',request_id:event.request_id,tool:event.tool,
-    observed_at_utc:observed,arguments:event.args??{},payload_sha256};
-  if(event.event_type==='tool.result'){
-    const classified=classifyRemoteAuditOutcome(event);
-    const unknown=classified==='unknown';
-    const recoveryReason=unknown&&typeof event.outcome?.recovery?.reason==='string'?event.outcome.recovery.reason:null;
-    return {event_type:'tool.result',request_id:event.request_id,tool:event.tool,
-      status:classified==='pending'?'pending':classified==='ok'?'ok':'error',observed_at_utc:observed,payload_sha256,
-      ...(Number.isFinite(Number(event.outcome?.duration_ms))?{duration_ms:Number(event.outcome.duration_ms)}:{}),
-      ...(unknown?{side_effect_state:'unknown'}:{}),
-      ...(typeof event.outcome?.reason==='string'&&event.outcome.reason?{reason:event.outcome.reason}:(recoveryReason?{reason:recoveryReason}:
-        (classified==='pending'&&typeof event.outcome?.status==='string'?{reason:event.outcome.status}:{})))};
-  }
-  return null;
-}
-async function replayRemoteResults(root,cursor,{displayMode='unicode'}={}){
-  const parsed=parseRemoteResultCursor(cursor);
-  const file=remoteResultJournalPath(root,parsed.session_id);
-  await requireRegular(file,'remote result journal');
-  const journal=await openRemoteResultJournal({filePath:file,sessionId:parsed.session_id,maxEntries:2048});
-  let next=cursor;
-  for(;;){
-    const page=await journal.replayAfter(next,{limit:200});
-    for(const event of page.events){
-      if(event.event_type==='tool.call'){
-        const line=formatRemoteToolCall({event_type:'tool.request',tool:event.tool,request_id:event.request_id,
-          observed_at_utc:event.observed_at_utc,args:event.arguments},{displayMode});
-        process.stdout.write(remoteDisplayText(`${line} | REPLAY #${event.seq}\n`,displayMode));
-        continue;
-      }
-      const unknown=event.side_effect_state==='unknown';
-      const marker=unknown?'OUTCOME_UNKNOWN':event.status==='pending'?'PENDING':event.status==='error'?(displayMode==='ascii'?'ERR':'✗'):(displayMode==='ascii'?'OK':'✓');
-      const duration=Number.isFinite(Number(event.duration_ms))?` ${event.duration_ms<1000?Math.round(event.duration_ms)+'ms':(event.duration_ms/1000).toFixed(2)+'s'}`:'';
-      const reason=(event.status==='error'||event.status==='pending'||unknown)&&typeof event.reason==='string'&&event.reason?` — ${event.reason}`:'';
-      process.stdout.write(remoteDisplayText(`[REPLAY] #${event.seq} ${event.tool}${duration} ${marker}${reason}\n`,displayMode));
-    }
-    next=page.next_cursor;
-    if(!page.has_more) return next;
-  }
-}
-async function readAppend(file,cursor){
-  return readRemoteLogAppend(file,cursor);
-}
-async function snapshotRemoteLogOffsets(root){
-  const offsets=new Map();
-  const files=await listLogFiles(root);
-  for(const file of files){
-    const snapshot=await readRemoteLogAppend(file,null,{startAtEnd:true});
-    if(snapshot.cursor)offsets.set(file,snapshot.cursor);
-  }
-  return offsets;
-}
-function timelineFilterEvent(timeline){
-  if(!timeline) return null;
-  if(timeline.event_type==='tool.call') return {
-    event_type:'tool.request',request_id:timeline.request_id,tool:timeline.tool,args:timeline.arguments??{}
-  };
-  return {
-    event_type:'tool.result',request_id:timeline.request_id,tool:timeline.tool,
-    outcome:{
-      status:timeline.side_effect_state==='unknown'?'interrupted':timeline.status,
-      is_error:timeline.status==='error',
-      ...(Number.isFinite(Number(timeline.duration_ms))?{duration_ms:Number(timeline.duration_ms)}:{}),
-      ...(timeline.side_effect_state?{side_effect_state:timeline.side_effect_state}:{}),
-      ...(timeline.reason?{reason:timeline.reason}:{})
-    }
-  };
-}
-async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTracker=null,timelineFilter=null,timelineWriter=null,verbose=false,displayMode='unicode'}={}){
-  process.stdout.write(verbose
-    ? '[LOG] Verbose live timeline. Full sanitized request detail enabled; Ctrl+C disconnects and revokes authority.\n'
-    : '[LOG] Human live timeline. Transport IN/OUT hidden; full replay/audit detail remains on disk. START/DONE retained; heartbeat bursts folded; Ctrl+C disconnects and revokes authority.\n');
-  const activeOffsets=offsets??await snapshotRemoteLogOffsets(root);
-  const partialLines=new Map();
-  let liveFiles=[...activeOffsets.keys()];
-  let nextDiscoveryAt=0;
-  while(!signal.aborted){
-    const now=Date.now();
-    if(now>=nextDiscoveryAt){
-      liveFiles=await listLogFiles(root);
-      nextDiscoveryAt=now+LIVE_LOG_DISCOVERY_INTERVAL_MS;
-    }
-    for(const file of liveFiles){
-      const prior=activeOffsets.has(file)?activeOffsets.get(file):null;
-      const next=await readAppend(file,prior);
-      activeOffsets.set(file,next.cursor);
-      if(next.reset){
-        partialLines.delete(file);
-        process.stderr.write('[LIVELOG] STREAM_RESET '+path.basename(file)+' — '+next.resetReason+'; check audit continuity before trusting coverage\n');
-      }
-      if(!next.text)continue;
-      const lines=((partialLines.get(file)??'')+next.text).split(/\r?\n/);
-      partialLines.set(file,lines.pop()??'');
-      if(Buffer.byteLength(partialLines.get(file),'utf8')>1024*1024) throw new Error(`remote log line exceeds bounded decode limit: ${path.basename(file)}`);
-      for(const line of lines){
-        if(Buffer.byteLength(line,'utf8')>1024*1024) throw new Error(`remote log line exceeds bounded decode limit: ${path.basename(file)}`);
-        const auditEvent=parseAuditLogLine(file,line);
-        if(/^segment-\d{8}\.jsonl$/.test(path.basename(file))&&!auditEvent)
-          throw new Error('LIVELOG_AUDIT_RECORD_INVALID '+path.basename(file)+'; refusing to silently skip audit bytes');
-        const timeline=auditTimelineRecord(file,line,auditEvent);
-        let recorded=null;
-        if(timeline&&journal) recorded=timeline.event_type==='tool.call'
-          ? await journal.recordCall(timeline)
-          : await journal.recordTerminal(timeline);
-        if(recorded?.duplicate) continue;
-        const accepted=timelineFilter&&timeline?timelineFilter.accept(timelineFilterEvent(timeline)):true;
-        const formatted=formatLogLine(file,line,{auditEvent,activityTracker,sequence:recorded?.event?.seq??null,
-          sourceSequence:Number.isSafeInteger(auditEvent?.seq)?auditEvent.seq:null,verbose,displayMode});
-        if(!formatted||!accepted) continue;
-        const output=Array.isArray(formatted)?formatted:[formatted];
-        for(const item of output) if(item){
-          if(timelineWriter) timelineWriter.write(item,{event_type:timeline?.event_type??null,request_id:timeline?.request_id??null});
-          else process.stdout.write(`${item}\n`);
-        }
-      }
-    }
-    try{await sleep(250,null,{signal});}catch(error){if(error?.name!=='AbortError') throw error;}
-  }
-}
-function remoteTag(kind,displayMode){
-  const unicode={warn:'⚠️ [WARN]',recovery:'♻️ [RECOVERY]',auth:'🔐 [AUTH]'};
-  const ascii={warn:'[WARN]',recovery:'[RECOVERY]',auth:'[AUTH]'};
-  return (displayMode==='ascii'?ascii:unicode)[kind];
-}
-function writeRemote(stream,text,displayMode){stream.write(remoteDisplayText(text,displayMode));}
-async function cleanupRemoteSession(ctx,{displayMode='unicode'}={}){
-  const failed=[];
-  for(const command of SESSION_CLEANUP){
-    try{
-      const result=invokeController(ctx,command,{allowFailure:true,capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+    if(Number.isInteger(timeoutMs)&&timeoutMs>0) options.timeout=timeoutMs;
+    result=spawnSync(ctx.powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',ctx.launcher,command,...(json?['-Json']:[])],options);
+  }finally{
+    if(stdoutFd!==null) closeSync(stdoutFd);
+    if(stderrFd!==null) closeSync(stderrFd);
+  }
+  if(result.error){
+    if(result.error?.code==='ETIMEDOUT') throw new Error(`remote controller '${command}' timed out after ${timeoutMs}ms`);
+    throw result.error;
+  }
+  const status=Number.isInteger(result.status)?result.status:1;
+  const stdout=capture?String(result.stdout||''):'';
+  const stderr=capture?String(result.stderr||''):'';
+  if(capture&&echoCaptured){if(stdout) process.stdout.write(stdout);if(stderr) process.stderr.write(stderr);}
+  if(status!==0&&!allowFailure) throw new Error(`remote controller '${command}' failed exit=${status}`);
+  return {status,stdout,stderr};
+}
+function observedAuthority(ctx){
+  const result=invokeController(ctx,'status',{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS,json:true});
+  return parseAuthorityObservation(result.stdout);
+}
+function controllerRuntimeReady(text){
+  const value=String(text||'');
+  return /^DEADBYTE MCP\s*=\s*ONLINE\s*$/m.test(value)&&
+    /^Bridge PID\s*:\s*\d+\s+\[verified\]\s*$/m.test(value)&&
+    /^Cloud PID\s*:\s*\d+\s+\[verified\]\s*$/m.test(value)&&
+    /^Local ready\s*:\s*True\s*$/m.test(value)&&
+    /^Loop supervisor:\s*RUNNING\s+\[verified\]\s*$/m.test(value);
+}
+function controllerRuntimeDegraded(text){
+  return /^DEADBYTE MCP\s*=\s*(?:DEGRADED|FAILED)\s*$/m.test(String(text||''));
+}
+async function listLogFiles(root){
+  const auditDir=path.join(root,'audit');
+  const runtimeDir=path.join(root,'runtime','logs');
+  let auditNames=[],runtimeNames=[];
+  try{auditNames=await readdir(auditDir);}catch(error){if(error?.code!=='ENOENT') throw error;}
+  try{runtimeNames=await readdir(runtimeDir);}catch(error){if(error?.code!=='ENOENT') throw error;}
+  const selected=selectLiveLogNames({auditNames,runtimeNames});
+  return [
+    ...selected.audit.map(name=>path.join(auditDir,name)),
+    ...selected.runtime.map(name=>path.join(runtimeDir,name))
+  ];
+}
+function parseAuditLogLine(file,line){
+  if(!/^segment-\d{8}\.jsonl$/.test(path.basename(file))||!line) return null;
+  try{return JSON.parse(line);}catch{return null;}
+}
+function formatLogLine(file,line,{auditEvent=null,activityTracker=null,sequence=null,sourceSequence=null,verbose=false,displayMode='unicode'}={}){
+  if(!line) return null;
+  if(/^segment-\d{8}\.jsonl$/.test(path.basename(file))){
+    const event=auditEvent??parseAuditLogLine(file,line);
+    if(!event) return null;
+    return activityTracker?activityTracker.observe(event,{sequence,sourceSequence}):formatCompactAuditEvent(event);
+  }
+  return formatRuntimeDiagnosticLine(file,line,{verbose,displayMode});
+}
+function remoteResultJournalPath(root,sessionId){return path.join(root,'runtime','remote-results',`${sessionId}.json`);}
+function auditTimelineRecord(file,line,auditEvent=null){
+  const event=auditEvent??parseAuditLogLine(file,line);
+  if(!event) return null;
+  if(typeof event?.request_id!=='string'||!event.request_id||typeof event.tool!=='string'||!event.tool) return null;
+  const stamp=[event.ts,event.created_at_utc,event.observed_at_utc].find(value=>typeof value==='string'&&Number.isFinite(Date.parse(value)));
+  const observed=stamp?new Date(Date.parse(stamp)).toISOString():new Date().toISOString();
+  const payload_sha256=createHash('sha256').update(Buffer.from(line,'utf8')).digest('hex');
+  if(event.event_type==='tool.request') return {event_type:'tool.call',request_id:event.request_id,tool:event.tool,
+    observed_at_utc:observed,arguments:event.args??{},payload_sha256};
+  if(event.event_type==='tool.result'){
+    const classified=classifyRemoteAuditOutcome(event);
+    const unknown=classified==='unknown';
+    const recoveryReason=unknown&&typeof event.outcome?.recovery?.reason==='string'?event.outcome.recovery.reason:null;
+    return {event_type:'tool.result',request_id:event.request_id,tool:event.tool,
+      status:classified==='pending'?'pending':classified==='ok'?'ok':'error',observed_at_utc:observed,payload_sha256,
+      ...(Number.isFinite(Number(event.outcome?.duration_ms))?{duration_ms:Number(event.outcome.duration_ms)}:{}),
+      ...(unknown?{side_effect_state:'unknown'}:{}),
+      ...(typeof event.outcome?.reason==='string'&&event.outcome.reason?{reason:event.outcome.reason}:(recoveryReason?{reason:recoveryReason}:
+        (classified==='pending'&&typeof event.outcome?.status==='string'?{reason:event.outcome.status}:{})))};
+  }
+  return null;
+}
+async function replayRemoteResults(root,cursor,{displayMode='unicode'}={}){
+  const parsed=parseRemoteResultCursor(cursor);
+  const file=remoteResultJournalPath(root,parsed.session_id);
+  await requireRegular(file,'remote result journal');
+  const journal=await openRemoteResultJournal({filePath:file,sessionId:parsed.session_id,maxEntries:2048});
+  let next=cursor;
+  for(;;){
+    const page=await journal.replayAfter(next,{limit:200});
+    for(const event of page.events){
+      if(event.event_type==='tool.call'){
+        const line=formatRemoteToolCall({event_type:'tool.request',tool:event.tool,request_id:event.request_id,
+          observed_at_utc:event.observed_at_utc,args:event.arguments},{displayMode});
+        process.stdout.write(remoteDisplayText(`${line} | REPLAY #${event.seq}\n`,displayMode));
+        continue;
+      }
+      const unknown=event.side_effect_state==='unknown';
+      const marker=unknown?'OUTCOME_UNKNOWN':event.status==='pending'?'PENDING':event.status==='error'?(displayMode==='ascii'?'ERR':'✗'):(displayMode==='ascii'?'OK':'✓');
+      const duration=Number.isFinite(Number(event.duration_ms))?` ${event.duration_ms<1000?Math.round(event.duration_ms)+'ms':(event.duration_ms/1000).toFixed(2)+'s'}`:'';
+      const reason=(event.status==='error'||event.status==='pending'||unknown)&&typeof event.reason==='string'&&event.reason?` — ${event.reason}`:'';
+      process.stdout.write(remoteDisplayText(`[REPLAY] #${event.seq} ${event.tool}${duration} ${marker}${reason}\n`,displayMode));
+    }
+    next=page.next_cursor;
+    if(!page.has_more) return next;
+  }
+}
+async function readAppend(file,cursor){
+  return readRemoteLogAppend(file,cursor);
+}
+async function snapshotRemoteLogOffsets(root){
+  const offsets=new Map();
+  const files=await listLogFiles(root);
+  for(const file of files){
+    const snapshot=await readRemoteLogAppend(file,null,{startAtEnd:true});
+    if(snapshot.cursor)offsets.set(file,snapshot.cursor);
+  }
+  return offsets;
+}
+function timelineFilterEvent(timeline){
+  if(!timeline) return null;
+  if(timeline.event_type==='tool.call') return {
+    event_type:'tool.request',request_id:timeline.request_id,tool:timeline.tool,args:timeline.arguments??{}
+  };
+  return {
+    event_type:'tool.result',request_id:timeline.request_id,tool:timeline.tool,
+    outcome:{
+      status:timeline.side_effect_state==='unknown'?'interrupted':timeline.status,
+      is_error:timeline.status==='error',
+      ...(Number.isFinite(Number(timeline.duration_ms))?{duration_ms:Number(timeline.duration_ms)}:{}),
+      ...(timeline.side_effect_state?{side_effect_state:timeline.side_effect_state}:{}),
+      ...(timeline.reason?{reason:timeline.reason}:{})
+    }
+  };
+}
+async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTracker=null,timelineFilter=null,timelineWriter=null,verbose=false,displayMode='unicode'}={}){
+  process.stdout.write(verbose
+    ? '[LOG] Verbose live timeline. Full sanitized request detail enabled; Ctrl+C disconnects and revokes authority.\n'
+    : '[LOG] Human live timeline. Transport IN/OUT hidden; full replay/audit detail remains on disk. START/DONE retained; heartbeat bursts folded; Ctrl+C disconnects and revokes authority.\n');
+  const activeOffsets=offsets??await snapshotRemoteLogOffsets(root);
+  const partialLines=new Map();
+  let liveFiles=[...activeOffsets.keys()];
+  let nextDiscoveryAt=0;
+  while(!signal.aborted){
+    const now=Date.now();
+    if(now>=nextDiscoveryAt){
+      liveFiles=await listLogFiles(root);
+      nextDiscoveryAt=now+LIVE_LOG_DISCOVERY_INTERVAL_MS;
+    }
+    for(const file of liveFiles){
+      const prior=activeOffsets.has(file)?activeOffsets.get(file):null;
+      const next=await readAppend(file,prior);
+      activeOffsets.set(file,next.cursor);
+      if(next.reset){
+        partialLines.delete(file);
+        process.stderr.write('[LIVELOG] STREAM_RESET '+path.basename(file)+' — '+next.resetReason+'; check audit continuity before trusting coverage\n');
+      }
+      if(!next.text)continue;
+      const lines=((partialLines.get(file)??'')+next.text).split(/\r?\n/);
+      partialLines.set(file,lines.pop()??'');
+      if(Buffer.byteLength(partialLines.get(file),'utf8')>1024*1024) throw new Error(`remote log line exceeds bounded decode limit: ${path.basename(file)}`);
+      for(const line of lines){
+        if(Buffer.byteLength(line,'utf8')>1024*1024) throw new Error(`remote log line exceeds bounded decode limit: ${path.basename(file)}`);
+        const auditEvent=parseAuditLogLine(file,line);
+        if(/^segment-\d{8}\.jsonl$/.test(path.basename(file))&&!auditEvent)
+          throw new Error('LIVELOG_AUDIT_RECORD_INVALID '+path.basename(file)+'; refusing to silently skip audit bytes');
+        const timeline=auditTimelineRecord(file,line,auditEvent);
+        let recorded=null;
+        if(timeline&&journal) recorded=timeline.event_type==='tool.call'
+          ? await journal.recordCall(timeline)
+          : await journal.recordTerminal(timeline);
+        if(recorded?.duplicate) continue;
+        const accepted=timelineFilter&&timeline?timelineFilter.accept(timelineFilterEvent(timeline)):true;
+        const formatted=formatLogLine(file,line,{auditEvent,activityTracker,sequence:recorded?.event?.seq??null,
+          sourceSequence:Number.isSafeInteger(auditEvent?.seq)?auditEvent.seq:null,verbose,displayMode});
+        if(!formatted||!accepted) continue;
+        const output=Array.isArray(formatted)?formatted:[formatted];
+        for(const item of output) if(item){
+          if(timelineWriter) timelineWriter.write(item,{event_type:timeline?.event_type??null,request_id:timeline?.request_id??null});
+          else process.stdout.write(`${item}\n`);
+        }
+      }
+    }
+    try{await sleep(250,null,{signal});}catch(error){if(error?.name!=='AbortError') throw error;}
+  }
+}
+function remoteTag(kind,displayMode){
+  const unicode={warn:'⚠️ [WARN]',recovery:'♻️ [RECOVERY]',auth:'🔐 [AUTH]'};
+  const ascii={warn:'[WARN]',recovery:'[RECOVERY]',auth:'[AUTH]'};
+  return (displayMode==='ascii'?ascii:unicode)[kind];
+}
+function writeRemote(stream,text,displayMode){stream.write(remoteDisplayText(text,displayMode));}
+async function cleanupRemoteSession(ctx,{displayMode='unicode'}={}){
+  const failed=[];
+  for(const command of SESSION_CLEANUP){
+    try{
+      const result=invokeController(ctx,command,{allowFailure:true,capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
       if(result.status!==0){
         failed.push(command);
         const detail=boundedSingleLine(result.stderr||result.stdout||'controller returned no diagnostic',512);
         writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command} exit=${result.status}: ${detail}\n`,displayMode);
-      }
-    }
-    catch(error){failed.push(command);writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command}: ${String(error?.message||error)}\n`,displayMode);}
-  }
-  if(failed.length) throw new Error(`remote session cleanup failed; ownership marker retained: ${failed.join(',')}`);
-  let snapshot;
-  try{snapshot=assertAuthorityVector(observedAuthority(ctx),Object.fromEntries(AUTHORITY_PLANES.map(plane=>[plane,false])));}
-  catch(error){throw new Error(`remote session cleanup verification failed; ownership marker retained: ${String(error?.message||error)}`);}
-  if(snapshot.state==='ONLINE'){
-    try{invokeController(ctx,'machinetest',{capture:true,echoCaptured:false,timeoutMs:REMOTE_START_TIMEOUT_MS,probeMode:'revoked'});}
-    catch(error){throw new Error(`remote session enforcement cleanup verification failed; ownership marker retained: ${String(error?.message||error)}`);}
-  }
-  const parked=invokeController(ctx,'park',{allowFailure:true,capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-  if(parked.status!==0) throw new Error(`remote session park failed exit=${parked.status}; ownership marker retained`);
-}
-const GUARDIAN_SCRIPT=fileURLToPath(new URL('./remote-session-guardian.mjs',import.meta.url));
-function remoteSessionMarker(root){return path.join(root,'runtime','remote-session.json');}
-function pidAlive(pid){
-  if(!Number.isInteger(pid)||pid<1)return false;
-  try{process.kill(pid,0);return true;}
-  catch(error){return error?.code!=='ESRCH';}
-}
-function remoteOwnerPid(marker){return marker?.schema==='deadbyte.remote-session.v2'?marker.owner_pid:marker?.pid;}
-async function readRemoteSessionMarker(root){
-  const file=remoteSessionMarker(root);
-  let text;try{text=await readFile(file,'utf8');}catch(error){if(error?.code==='ENOENT') return null;throw error;}
-  let value;try{value=JSON.parse(text);}catch{throw new Error('remote session marker is invalid JSON');}
-  if(value?.schema==='deadbyte.remote-session.v1'){
-    if(!Number.isInteger(value?.pid)||value.pid<1) throw new Error('remote session marker schema invalid');
-    return value;
-  }
-  if(value?.schema==='deadbyte.remote-session.v2'){
-    for(const key of ['owner_identity','guardian_identity'])if(value[key]!==undefined&&!validForegroundIdentity(value[key]))throw new Error('remote session ownership identity invalid');
-    if(!Number.isInteger(value?.owner_pid)||value.owner_pid<1||
-       !/^[0-9a-f]{64}$/.test(String(value?.session_nonce||''))||
-       !Number.isInteger(value?.guardian_pid)||value.guardian_pid<0||
-       (value.result_session_id!==undefined&&!/^[0-9a-f]{24}$/.test(String(value.result_session_id)))) throw new Error('remote session marker schema invalid');
-    return value;
-  }
-  throw new Error('remote session marker schema invalid');
-}
-async function recoverRemoteSession(ctx,{displayMode='unicode'}={}){
-  let prior=await readRemoteSessionMarker(ctx.root);
-  if(!prior) return;
-  const ownerPid=remoteOwnerPid(prior);
-  if(pidAlive(ownerPid)){
-    if(!prior.owner_identity)throw new Error(`remote session ownership unverified for legacy pid=${ownerPid}; marker retained`);
+      }
+    }
+    catch(error){failed.push(command);writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command}: ${String(error?.message||error)}\n`,displayMode);}
+  }
+  if(failed.length) throw new Error(`remote session cleanup failed; ownership marker retained: ${failed.join(',')}`);
+  let snapshot;
+  try{snapshot=assertAuthorityVector(observedAuthority(ctx),Object.fromEntries(AUTHORITY_PLANES.map(plane=>[plane,false])));}
+  catch(error){throw new Error(`remote session cleanup verification failed; ownership marker retained: ${String(error?.message||error)}`);}
+  if(snapshot.state==='ONLINE'){
+    try{invokeController(ctx,'machinetest',{capture:true,echoCaptured:false,timeoutMs:REMOTE_START_TIMEOUT_MS,probeMode:'revoked'});}
+    catch(error){throw new Error(`remote session enforcement cleanup verification failed; ownership marker retained: ${String(error?.message||error)}`);}
+  }
+  const parked=invokeController(ctx,'park',{allowFailure:true,capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+  if(parked.status!==0) throw new Error(`remote session park failed exit=${parked.status}; ownership marker retained`);
+}
+const GUARDIAN_SCRIPT=fileURLToPath(new URL('./remote-session-guardian.mjs',import.meta.url));
+function remoteSessionMarker(root){return path.join(root,'runtime','remote-session.json');}
+function pidAlive(pid){
+  if(!Number.isInteger(pid)||pid<1)return false;
+  try{process.kill(pid,0);return true;}
+  catch(error){return error?.code!=='ESRCH';}
+}
+function remoteOwnerPid(marker){return marker?.schema==='deadbyte.remote-session.v2'?marker.owner_pid:marker?.pid;}
+async function readRemoteSessionMarker(root){
+  const file=remoteSessionMarker(root);
+  let text;try{text=await readFile(file,'utf8');}catch(error){if(error?.code==='ENOENT') return null;throw error;}
+  let value;try{value=JSON.parse(text);}catch{throw new Error('remote session marker is invalid JSON');}
+  if(value?.schema==='deadbyte.remote-session.v1'){
+    if(!Number.isInteger(value?.pid)||value.pid<1) throw new Error('remote session marker schema invalid');
+    return value;
+  }
+  if(value?.schema==='deadbyte.remote-session.v2'){
+    for(const key of ['owner_identity','guardian_identity'])if(value[key]!==undefined&&!validForegroundIdentity(value[key]))throw new Error('remote session ownership identity invalid');
+    if(!Number.isInteger(value?.owner_pid)||value.owner_pid<1||
+       !/^[0-9a-f]{64}$/.test(String(value?.session_nonce||''))||
+       !Number.isInteger(value?.guardian_pid)||value.guardian_pid<0||
+       (value.result_session_id!==undefined&&!/^[0-9a-f]{24}$/.test(String(value.result_session_id)))) throw new Error('remote session marker schema invalid');
+    return value;
+  }
+  throw new Error('remote session marker schema invalid');
+}
+async function publishExclusiveJson(file,value){
+  const bytes=Buffer.from(`${JSON.stringify(value)}\n`,'utf8');
+  await mkdir(path.dirname(file),{recursive:true});
+  try{
+    const handle=await open(file,'wx',0o600);
+    try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+  }catch(error){
+    if(error?.code!=='EEXIST')throw error;
+    const existing=await readFile(file);
+    if(!existing.equals(bytes))throw new Error(`exclusive evidence identity collision: ${path.basename(file)}`);
+  }
+  return {path:file,sha256:createHash('sha256').update(bytes).digest('hex')};
+}
+async function recoverRemoteSession(ctx,{displayMode='unicode'}={}){
+  let prior=await readRemoteSessionMarker(ctx.root);
+  const evidenceDir=path.join(ctx.root,'evidence','legacy-migration');
+  const locatorPath=path.join(evidenceDir,'r153-pending-migration.json');
+  if(!prior){
+    try{
+      const locator=JSON.parse(await readFile(locatorPath,'utf8'));
+      if(locator?.schema!=='deadbyte.r153-pending-migration.v1'||
+        typeof locator.receipt_path!=='string'||!path.isAbsolute(locator.receipt_path)||
+        path.resolve(path.dirname(locator.receipt_path)).toLowerCase()!==path.resolve(evidenceDir).toLowerCase()||
+        !/^[0-9a-f]{64}$/.test(String(locator.receipt_sha256??'')))throw new Error('pending migration locator invalid');
+      const bytes=await readFile(locator.receipt_path);
+      if(createHash('sha256').update(bytes).digest('hex')!==locator.receipt_sha256)
+        throw new Error('pending migration receipt hash mismatch');
+      return {state:'MARKER_RECONCILED',receipt_path:locator.receipt_path,
+        receipt_sha256:locator.receipt_sha256};
+    }catch(error){if(error?.code!=='ENOENT')throw error;}
+    // Crash recovery for the narrow window after marker CAS deletion and
+    // before terminal receipt publication. Never infer completion from the
+    // missing marker alone: require exactly one durable intent and re-observe
+    // the full predecessor/policy/grant/runtime subject.
+    let entries=[];
+    try{entries=await readdir(evidenceDir,{withFileTypes:true});}
+    catch(error){if(error?.code==='ENOENT')return null;throw error;}
+    const candidates=[];
+    for(const entry of entries){
+      const match=/^marker-([0-9a-f]{64})\.intent\.json$/.exec(entry.name);
+      if(!match||!entry.isFile())continue;
+      const terminal=path.join(evidenceDir,`marker-${match[1]}.terminal.json`);
+      let terminalExists=true;
+      try{await lstat(terminal);}
+      catch(error){if(error?.code==='ENOENT')terminalExists=false;else throw error;}
+      candidates.push({markerSha256:match[1],intent:path.join(evidenceDir,entry.name),terminal,terminalExists});
+    }
+    if(candidates.length===0)return null;
+    if(candidates.length!==1)throw new Error('multiple unlocated marker reconciliation claims; manual reconciliation required');
+    const pending=candidates[0],intentInfo=await lstat(pending.intent);
+    if(!intentInfo.isFile()||intentInfo.isSymbolicLink())throw new Error('marker reconciliation intent is not a regular file');
+    const intentBytes=await readFile(pending.intent),intent=JSON.parse(intentBytes.toString('utf8').replace(/^\uFEFF/,''));
+    if(intent.marker_sha256!==pending.markerSha256)throw new Error('marker reconciliation intent filename identity mismatch');
+    const active=await readActiveRuntimeBinding(ctx.root);
+    if(!active)throw new Error('marker reconciliation predecessor pointer missing');
+    const observed=observedAuthority(ctx);
+    const grantField={process:'grant_file',coding:'lease_file',autonomous:'lease_file',desktop:'grant_file',host:'arm_file'};
+    const policySha256={},grantPresence={};
+    for(const plane of AUTHORITY_PLANES){
+      const policyFile=path.join(active.generation_root,`${plane}-policy.json`),info=await lstat(policyFile);
+      if(!info.isFile()||info.isSymbolicLink()||path.resolve(path.dirname(policyFile)).toLowerCase()!==path.resolve(active.generation_root).toLowerCase())
+        throw new Error(`marker reconciliation ${plane} policy identity invalid`);
+      const bytes=await readFile(policyFile),policy=JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));
+      policySha256[plane]=createHash('sha256').update(bytes).digest('hex');
+      const grant=policy?.[grantField[plane]];
+      if(typeof grant!=='string'||!path.isAbsolute(grant)||
+        path.resolve(path.dirname(grant)).toLowerCase()!==path.resolve(ctx.root,'runtime').toLowerCase())
+        throw new Error(`marker reconciliation ${plane} grant path invalid`);
+      try{await lstat(grant);grantPresence[plane]=true;}
+      catch(error){if(error?.code==='ENOENT')grantPresence[plane]=false;else throw error;}
+    }
+    if(await readRemoteMarkerSnapshot(remoteSessionMarker(ctx.root))!==null)
+      throw new Error('marker reconciliation marker reappeared');
+    const intentSha256=createHash('sha256').update(intentBytes).digest('hex');
+    let reconciled;
+    if(pending.terminalExists){
+      const terminalInfo=await lstat(pending.terminal);
+      if(!terminalInfo.isFile()||terminalInfo.isSymbolicLink())throw new Error('marker reconciliation terminal is not a regular file');
+      const terminalBytes=await readFile(pending.terminal),terminal=JSON.parse(terminalBytes.toString('utf8').replace(/^\uFEFF/,''));
+      reconciled=recoverPublishedMarkerTerminal({stateRoot:ctx.root,pointer:active,observation:observed,
+        policySha256,grantPresence,intent,intentSha256,terminal,
+        terminalSha256:createHash('sha256').update(terminalBytes).digest('hex'),markerPresent:false});
+    }else{
+      reconciled=await resumeMarkerReconciliation({stateRoot:ctx.root,pointer:active,observation:observed,
+        policySha256,grantPresence,intent,intentSha256,markerPresent:false,
+        publishTerminal:async terminal=>publishExclusiveJson(pending.terminal,terminal)});
+    }
+    const locator={schema:'deadbyte.r153-pending-migration.v1',receipt_path:pending.terminal,
+      receipt_sha256:reconciled.receipt_sha256,marker_sha256:reconciled.marker_sha256};
+    await publishExclusiveJson(locatorPath,locator);
+    writeRemote(process.stdout,`${remoteTag('recovery',displayMode)} Interrupted marker reconciliation completed (${reconciled.marker_sha256.slice(0,12)}).\n`,displayMode);
+    return {...reconciled,receipt_path:pending.terminal};
+  }
+  const ownerPid=remoteOwnerPid(prior);
+  let restrictedReusedOwner=false;
+  if(pidAlive(ownerPid)){
+    if(!prior.owner_identity)throw new Error(`remote session ownership unverified for legacy pid=${ownerPid}; marker retained`);
     if(prior.owner_identity.pid!==ownerPid)throw new Error('remote session owner identity PID binding mismatch; marker retained');
-    if(!foregroundIdentityMatches(prior.owner_identity,queryForegroundIdentity(ownerPid)))throw new Error('remote session owner identity mismatch; marker retained');
-    throw new Error(`remote session already active pid=${ownerPid}`);
-  }
-  let guardianAlive=prior.schema==='deadbyte.remote-session.v2'&&pidAlive(prior.guardian_pid);
-  if(guardianAlive){
-    if(!prior.guardian_identity)throw new Error('remote guardian ownership unverified; marker retained');
-    if(prior.guardian_identity.pid!==prior.guardian_pid)throw new Error('remote guardian identity PID binding mismatch');
-    guardianAlive=foregroundIdentityMatches(prior.guardian_identity,queryForegroundIdentity(prior.guardian_pid));
-  }
-  if(guardianAlive){
-    const deadline=Date.now()+3000;
-    while(Date.now()<deadline){
-      await sleep(100);
-      prior=await readRemoteSessionMarker(ctx.root);
-      if(!prior) return;
-      if(remoteOwnerPid(prior)!==ownerPid) throw new Error('remote session ownership changed during guardian recovery');
-    }
-    throw new Error(`remote session guardian cleanup still active pid=${prior.guardian_pid}`);
-  }
-  throw new Error(`remote session ownership unverified for stale pid=${ownerPid}; marker retained`);
-}
-async function claimRemoteSession(ctx){
-  const dir=path.join(ctx.root,'runtime');await mkdir(dir,{recursive:true});
-  const nonce=randomBytes(32).toString('hex');
-  const resultSessionId=randomBytes(12).toString('hex');
-  const marker={schema:'deadbyte.remote-session.v2',owner_pid:process.pid,guardian_pid:0,session_nonce:nonce,
-    result_session_id:resultSessionId,started_at_utc:new Date().toISOString()};
-  marker.owner_identity=queryForegroundIdentity(process.pid);
-  if(!marker.owner_identity)throw new Error('remote foreground identity unavailable');
-  const markerPath=remoteSessionMarker(ctx.root);
-  try{await writeFile(markerPath,`${JSON.stringify(marker)}\n`,{encoding:'utf8',flag:'wx'});}
-  catch(error){if(error?.code==='EEXIST') throw new Error('remote session already claimed');throw error;}
-  let guardian=null;
-  try{
-    guardian=spawn(process.execPath,[GUARDIAN_SCRIPT,'--state-root',ctx.root,'--owner-pid',String(process.pid),'--session-nonce',nonce,'--owner-channel','ipc'],{
-      detached:true,stdio:['ignore','ignore','ignore','ipc'],windowsHide:true,shell:false,env:process.env
-    });
-    if(!Number.isInteger(guardian.pid)||guardian.pid<1) throw new Error('remote session guardian did not start');
-    marker.guardian_pid=guardian.pid;
-    marker.guardian_identity=queryForegroundIdentity(guardian.pid);
-    if(!marker.guardian_identity||marker.guardian_identity.parent_pid!==process.pid)throw new Error('remote guardian parent identity mismatch');
-    await writeFile(markerPath,`${JSON.stringify(marker)}\n`,'utf8');
-    guardian.unref();
-    guardian.channel?.unref();
-    return marker;
-  }catch(error){
-    try{guardian?.kill();}catch{}
-    try{
-      const snapshot=await readRemoteMarkerSnapshot(markerPath);
-      if(!snapshot||snapshot.marker?.owner_pid!==marker.owner_pid||snapshot.marker?.session_nonce!==marker.session_nonce)
-        throw new Error('claim marker ownership changed or missing');
-      if(deletePinnedRemoteMarker(markerPath,snapshot.sha256)!=='REMOVED')
-        throw new Error('claim marker changed before native deletion');
-    }catch(cleanupError){
-      throw new AggregateError([error,cleanupError],
-        'remote session claim failed; marker cleanup unverified and marker retained');
-    }
-    throw error;
-  }
-}
-async function releaseRemoteSession(ctx,marker,{displayMode='unicode'}={}){
+    let actualOwner;
+    try{actualOwner=queryForegroundIdentity(ownerPid);}
+    catch(error){restrictedReusedOwner=proveRestrictedPidReuse(prior.owner_identity,error);}
+    if(!restrictedReusedOwner){
+      if(!foregroundIdentityMatches(prior.owner_identity,actualOwner))throw new Error('remote session owner identity mismatch; marker retained');
+      throw new Error(`remote session already active pid=${ownerPid}`);
+    }
+  }
+  if(prior.schema!=='deadbyte.remote-session.v2'||!prior.owner_identity)
+    throw new Error(`remote session ownership identity unverified for stale pid=${ownerPid}; marker retained`);
+  let guardianAlive=pidAlive(prior.guardian_pid);
+  if(guardianAlive){
+    if(!prior.guardian_identity)throw new Error('remote guardian ownership unverified; marker retained');
+    if(prior.guardian_identity.pid!==prior.guardian_pid)throw new Error('remote guardian identity PID binding mismatch');
+    const actualGuardian=queryForegroundIdentity(prior.guardian_pid);
+    if(!actualGuardian||!foregroundIdentityMatches(prior.guardian_identity,actualGuardian))
+      throw new Error('remote guardian identity mismatch or PID reuse; marker retained');
+  }
+  if(guardianAlive){
+    const deadline=Date.now()+3000;
+    while(Date.now()<deadline){
+      await sleep(100);
+      prior=await readRemoteSessionMarker(ctx.root);
+      if(!prior) return;
+      if(remoteOwnerPid(prior)!==ownerPid) throw new Error('remote session ownership changed during guardian recovery');
+    }
+    throw new Error(`remote session guardian cleanup still active pid=${prior.guardian_pid}`);
+  }
+  const markerPath=remoteSessionMarker(ctx.root);
+  const snapshot=await readRemoteMarkerSnapshot(markerPath);
+  if(!snapshot) return null;
+  const active=await readActiveRuntimeBinding(ctx.root);
+  if(!active)throw new Error(`remote session ownership unverified for stale pid=${ownerPid}; active pointer missing; marker retained`);
+  const observed=observedAuthority(ctx);
+  const grantField={process:'grant_file',coding:'lease_file',autonomous:'lease_file',desktop:'grant_file',host:'arm_file'};
+  const policySha256={},grantPresence={};
+  for(const plane of AUTHORITY_PLANES){
+    const policyFile=path.join(active.generation_root,`${plane}-policy.json`);
+    const info=await lstat(policyFile);
+    if(!info.isFile()||info.isSymbolicLink()||path.resolve(path.dirname(policyFile)).toLowerCase()!==path.resolve(active.generation_root).toLowerCase())
+      throw new Error(`remote stale marker ${plane} policy identity invalid; marker retained`);
+    const bytes=await readFile(policyFile),policy=JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));
+    policySha256[plane]=createHash('sha256').update(bytes).digest('hex');
+    const grant=policy?.[grantField[plane]];
+    if(typeof grant!=='string'||!path.isAbsolute(grant)||
+      path.resolve(path.dirname(grant)).toLowerCase()!==path.resolve(ctx.root,'runtime').toLowerCase())
+      throw new Error(`remote stale marker ${plane} grant path invalid; marker retained`);
+    try{await lstat(grant);grantPresence[plane]=true;}
+    catch(error){if(error?.code==='ENOENT')grantPresence[plane]=false;else throw error;}
+  }
+  const identityLive=identity=>{
+    if(!identity||!validForegroundIdentity(identity))throw new Error('remote stale marker identity unverified; marker retained');
+    // A later-created protected svchost is not the signed original Node owner.
+    // This negative proof is limited to the exact owner and never exempts the guardian.
+    if(restrictedReusedOwner&&identity.pid===ownerPid)return false;
+    const actual=queryForegroundIdentity(identity.pid);
+    if(actual===null)return false;
+    if(!foregroundIdentityMatches(identity,actual))throw new Error('remote stale marker PID reuse detected; marker retained');
+    return true;
+  };
+  const revalidate=async phase=>{
+    const current=await readActiveRuntimeBinding(ctx.root);
+    for(const key of ['release_id','manifest_sha256','generation_manifest_sha256','generation_root'])
+      if(current?.[key]!==active[key])throw new Error(`remote stale marker pointer drift during ${phase}`);
+    const fresh=observedAuthority(ctx);
+    if(fresh.state!=='OFFLINE'||fresh.local_ready!==false||fresh.bridge?.alive!==false||fresh.core?.alive!==false||
+      fresh.cloud?.alive!==false||fresh.supervisor?.running!==false)throw new Error(`remote stale marker runtime drift during ${phase}`);
+    for(const plane of AUTHORITY_PLANES){
+      if(fresh.authority?.[plane]?.configured!==true||fresh.authority?.[plane]?.armed!==false)
+        throw new Error(`remote stale marker ${plane} authority drift during ${phase}`);
+      const policyFile=path.join(active.generation_root,`${plane}-policy.json`),bytes=await readFile(policyFile);
+      if(createHash('sha256').update(bytes).digest('hex')!==policySha256[plane])
+        throw new Error(`remote stale marker ${plane} policy drift during ${phase}`);
+      const policy=JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,'')),grant=policy?.[grantField[plane]];
+      try{await lstat(grant);throw new Error(`remote stale marker ${plane} grant appeared during ${phase}`);}
+      catch(error){if(error?.code!=='ENOENT')throw error;}
+    }
+    const currentMarker=await readRemoteMarkerSnapshot(markerPath);
+    if(phase==='before_delete'&&currentMarker?.sha256!==snapshot.sha256)
+      throw new Error('remote stale marker changed before deletion');
+    if(phase==='after_delete'&&currentMarker!==null)
+      throw new Error('remote stale marker remained or reappeared after deletion');
+  };
+  const intentPath=path.join(evidenceDir,`marker-${snapshot.sha256}.intent.json`);
+  const terminalPath=path.join(evidenceDir,`marker-${snapshot.sha256}.terminal.json`);
+  const reconciled=await reconcileStaleMarker({stateRoot:ctx.root,pointer:active,observation:observed,
+    policySha256,grantPresence,marker:{sha256:snapshot.sha256,
+      owner_live:identityLive(prior.owner_identity),
+      guardian_live:prior.guardian_pid===0?false:identityLive(prior.guardian_identity)},
+    publishIntent:async intent=>publishExclusiveJson(intentPath,intent),
+    publishTerminal:async terminal=>publishExclusiveJson(terminalPath,terminal),revalidate,
+    deleteIfHash:async expected=>deletePinnedRemoteMarker(markerPath,expected)});
+  const locator={schema:'deadbyte.r153-pending-migration.v1',receipt_path:terminalPath,
+    receipt_sha256:reconciled.receipt_sha256,marker_sha256:reconciled.marker_sha256};
+  await publishExclusiveJson(locatorPath,locator);
+  writeRemote(process.stdout,`${remoteTag('recovery',displayMode)} Stale session evidence reconciled (${reconciled.marker_sha256.slice(0,12)}).\n`,displayMode);
+  return {...reconciled,receipt_path:terminalPath};
+}
+async function claimRemoteSession(ctx){
+  const dir=path.join(ctx.root,'runtime');await mkdir(dir,{recursive:true});
+  const nonce=randomBytes(32).toString('hex');
+  const resultSessionId=randomBytes(12).toString('hex');
+  const marker={schema:'deadbyte.remote-session.v2',owner_pid:process.pid,guardian_pid:0,session_nonce:nonce,
+    result_session_id:resultSessionId,started_at_utc:new Date().toISOString()};
+  marker.owner_identity=queryForegroundIdentity(process.pid);
+  if(!marker.owner_identity)throw new Error('remote foreground identity unavailable');
+  const markerPath=remoteSessionMarker(ctx.root);
+  try{await writeFile(markerPath,`${JSON.stringify(marker)}\n`,{encoding:'utf8',flag:'wx'});}
+  catch(error){if(error?.code==='EEXIST') throw new Error('remote session already claimed');throw error;}
+  let guardian=null;
+  try{
+    guardian=spawn(process.execPath,[GUARDIAN_SCRIPT,'--state-root',ctx.root,'--owner-pid',String(process.pid),'--session-nonce',nonce,'--owner-channel','ipc'],{
+      detached:true,stdio:['ignore','ignore','ignore','ipc'],windowsHide:true,shell:false,env:process.env
+    });
+    if(!Number.isInteger(guardian.pid)||guardian.pid<1) throw new Error('remote session guardian did not start');
+    marker.guardian_pid=guardian.pid;
+    marker.guardian_identity=queryForegroundIdentity(guardian.pid);
+    if(!marker.guardian_identity||marker.guardian_identity.parent_pid!==process.pid)throw new Error('remote guardian parent identity mismatch');
+    await writeFile(markerPath,`${JSON.stringify(marker)}\n`,'utf8');
+    guardian.unref();
+    guardian.channel?.unref();
+    return marker;
+  }catch(error){
+    try{guardian?.kill();}catch{}
+    try{
+      const snapshot=await readRemoteMarkerSnapshot(markerPath);
+      if(!snapshot||snapshot.marker?.owner_pid!==marker.owner_pid||snapshot.marker?.session_nonce!==marker.session_nonce)
+        throw new Error('claim marker ownership changed or missing');
+      if(deletePinnedRemoteMarker(markerPath,snapshot.sha256)!=='REMOVED')
+        throw new Error('claim marker changed before native deletion');
+    }catch(cleanupError){
+      throw new AggregateError([error,cleanupError],
+        'remote session claim failed; marker cleanup unverified and marker retained');
+    }
+    throw error;
+  }
+}
+async function releaseRemoteSession(ctx,marker,{displayMode='unicode'}={}){
   let snapshot;
   try{snapshot=await readRemoteMarkerSnapshot(remoteSessionMarker(ctx.root));}
   catch(error){writeRemote(process.stderr,`${remoteTag('warn',displayMode)} remote session marker cleanup: ${String(error?.message||error)}\n`,displayMode);throw new Error(`remote session ownership marker retained: ${String(error?.message||error)}`);}
   const current=snapshot?.marker;
-  const same=current?.schema==='deadbyte.remote-session.v2'&&current.owner_pid===marker.owner_pid&&current.session_nonce===marker.session_nonce;
+  const same=current?.schema==='deadbyte.remote-session.v2'&&current.owner_pid===marker.owner_pid&&current.session_nonce===marker.session_nonce;
   if(!same)throw new Error('remote session ownership marker changed or missing; marker retained');
   if(deletePinnedRemoteMarker(remoteSessionMarker(ctx.root),snapshot.sha256)!=='REMOVED')
     throw new Error('remote session ownership marker replaced before native deletion; marker retained');
-}
-async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,filterExpression='',mode='default'}={}){
-  const display=prepareRemoteConsole();
-  const displayMode=display.mode;
-  const ctx=await remoteContext();
-  if(displayMode==='ascii') writeRemote(process.stdout,`[DISPLAY] ASCII fallback: ${display.reason}\n`,displayMode);
-  if(resumeCursor!==null) await replayRemoteResults(ctx.root,resumeCursor,{displayMode});
-  const startupLock=await acquireForegroundSessionLock({root:ctx.root,powershell:ctx.powershell});
-  let marker;
-  try{
-    startupLock.assertHeld();
-    await recoverRemoteSession(ctx,{displayMode});
-    startupLock.assertHeld();
-    marker=await claimRemoteSession(ctx);
-    startupLock.assertHeld();
-  }finally{await startupLock.release();}
-  try{
-    await synchronizeForegroundRuntime(ctx,{displayMode});
-  }catch(primaryError){
-    let cleanupError=null;
-    try{await cleanupRemoteSession(ctx,{displayMode});}
-    catch(error){cleanupError=error;}
-    if(!cleanupError){
-      try{await releaseRemoteSession(ctx,marker,{displayMode});}
-      catch(error){cleanupError=error;}
-    }
-    if(cleanupError){
-      const primaryDetail=String(primaryError?.message||primaryError);
-      const cleanupDetail=String(cleanupError?.message||cleanupError);
-      throw new AggregateError([primaryError,cleanupError],
-        `remote activation failed: ${primaryDetail}; cleanup failed, ownership marker retained: ${cleanupDetail}`);
-    }
-    throw primaryError;
-  }
-  const resultJournal=await openRemoteResultJournal({
-    filePath:remoteResultJournalPath(ctx.root,marker.result_session_id),sessionId:marker.result_session_id,maxEntries:2048
-  });
-  const rootPaths=await readLiveRootPaths(ctx.root);
-  const activityTracker=createLiveTimelineTracker({verbose,displayMode,rootPaths,trace,foldHeartbeats:!verbose});
-  const timelineFilter=filterExpression?createLiveTimelineFilter(filterExpression):null;
-  const timelineWriter=createLiveTimelineWriter({stream:process.stdout,displayMode,rewrite:false});
-  const aborter=new AbortController();
-  const abort=()=>aborter.abort();
-  const watchStdin=!process.stdin.isTTY;
-  process.once('SIGINT',abort);process.once('SIGTERM',abort);
-  if(watchStdin){process.stdin.once('end',abort);process.stdin.once('close',abort);process.stdin.resume();}
-  let ready=false;
-  let logTask=null;
+}
+async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,filterExpression='',mode='default'}={}){
+  const display=prepareRemoteConsole();
+  const displayMode=display.mode;
+  const ctx=await remoteContext();
+  if(displayMode==='ascii') writeRemote(process.stdout,`[DISPLAY] ASCII fallback: ${display.reason}\n`,displayMode);
+  if(resumeCursor!==null) await replayRemoteResults(ctx.root,resumeCursor,{displayMode});
+  const startupLock=await acquireForegroundSessionLock({root:ctx.root,powershell:ctx.powershell});
+  let marker;
+  try{
+    startupLock.assertHeld();
+    const migrationContext=await recoverRemoteSession(ctx,{displayMode});
+    startupLock.assertHeld();
+    await synchronizeForegroundRuntime(ctx,{displayMode,migrationContext});
+    startupLock.assertHeld();
+    marker=await claimRemoteSession(ctx);
+    startupLock.assertHeld();
+  }finally{await startupLock.release();}
+  const resultJournal=await openRemoteResultJournal({
+    filePath:remoteResultJournalPath(ctx.root,marker.result_session_id),sessionId:marker.result_session_id,maxEntries:2048
+  });
+  const rootPaths=await readLiveRootPaths(ctx.root);
+  const activityTracker=createLiveTimelineTracker({verbose,displayMode,rootPaths,trace,foldHeartbeats:!verbose});
+  const timelineFilter=filterExpression?createLiveTimelineFilter(filterExpression):null;
+  const timelineWriter=createLiveTimelineWriter({stream:process.stdout,displayMode,rewrite:false});
+  const aborter=new AbortController();
+  const abort=()=>aborter.abort();
+  const watchStdin=!process.stdin.isTTY;
+  process.once('SIGINT',abort);process.once('SIGTERM',abort);
+  if(watchStdin){process.stdin.once('end',abort);process.stdin.once('close',abort);process.stdin.resume();}
+  let ready=false;
+  let logTask=null;
   let sessionError=null;
-  try{
-    process.stdout.write('DEADBYTE MCP\n');
-    process.stdout.write(`${formatRemoteLifecycle('device_start',{displayMode})}\n`);
-    process.stdout.write(`${formatRemoteLifecycle(resumeCursor!==null?'session_restored':'session_new',{displayMode})}\n`);
-    const logOffsets=await snapshotRemoteLogOffsets(ctx.root);
-    logTask=tailRemoteLogs(ctx.root,aborter.signal,{journal:resultJournal,offsets:logOffsets,activityTracker,timelineFilter,timelineWriter,verbose,displayMode});
-    process.stdout.write('[BOOT] Starting local + remote runtime...\n');
-    const preflight=invokeController(ctx,'status',{capture:true,allowFailure:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-    let startText=preflight.stdout||'';
-    if(preflight.status===0&&controllerRuntimeReady(preflight.stdout)){
-      process.stdout.write('[BOOT] Runtime already ONLINE; reusing verified bridge/cloud/supervisor.\n');
-    }else{
-      const recovery=preflight.status===0&&controllerRuntimeDegraded(preflight.stdout);
-      process.stdout.write(recovery?'[RECOVERY] Runtime failed readiness; restarting verified owned components...\n':'[BOOT] Starting bridge/runtime...\n');
-      const startCommand=recovery?'restart':'start';
-      const controllerLogDir=path.join(ctx.root,'runtime','logs');
-      await mkdir(controllerLogDir,{recursive:true});
-      const launchOutput={
-        stdout_path:path.join(controllerLogDir,`controller-${startCommand}.stdout.log`),
-        stderr_path:path.join(controllerLogDir,`controller-${startCommand}.stderr.log`)
-      };
-      const launch=invokeController(ctx,startCommand,{allowFailure:true,redirectOutput:launchOutput,timeoutMs:REMOTE_START_TIMEOUT_MS});
-      if(launch.status!==0){
-        const evidence=await readControllerStartFailure(ctx.root,startCommand);
-        const fallback=evidence?'':await readTailBounded(launchOutput.stderr_path,2048);
-        const detail=evidence?`; controller-start-failure: ${evidence.message}`:(fallback?`; controller-stderr: ${fallback}`:'');
-        throw new Error(`remote controller '${startCommand}' failed exit=${launch.status}${detail}`);
-      }
-      const started=invokeController(ctx,'status',{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-      if(started.status!==0||!controllerRuntimeReady(started.stdout)) throw new Error(`remote controller ${recovery?'restart':'start'} returned without a verified ONLINE runtime`);
-      startText=started.stdout||'';
-    }
-    process.stdout.write(`${formatRemoteLifecycle('bridge_connected',{displayMode})}\n`);
-    process.stdout.write(`${formatRemoteLifecycle('cloud_connected',{displayMode})}\n`);
-    const desired=authorityVector(mode);
-    const priorAuthority=observedAuthority(ctx);
-    for(const plane of ['host','desktop','autonomous','coding','process'].filter(name=>!desired[name]&&priorAuthority.authority[name].armed)){
-      const command=`disarm${plane}`;
-      writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Revoking unwanted ${plane} authority...\n`,displayMode);
-      invokeController(ctx,command,{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-    }
-    for(const plane of AUTHORITY_PLANES.filter(name=>desired[name])){
-      const command=`arm${plane}`;
-      writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Arming ${command.slice(3)}...\n`,displayMode);
-      invokeController(ctx,command,{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-    }
-    const url=startText.match(/^URL\s*:\s*(\S+)/m)?.[1]||'';
-    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Verifying exact ${mode} authority vector...\n`,displayMode);
-    const current=await readActiveRuntimeBinding(ctx.root);
-    const authority=assertAuthorityVector(assertRuntimeReadyObservation(observedAuthority(ctx),{
-      coreRoot:current?.release_root??null
-    }),desired);
-    process.stdout.write('[BOOT] Verifying public signed MCP execution path...\n');
-    invokeController(ctx,'machinetest',{capture:true,echoCaptured:false,timeoutMs:REMOTE_START_TIMEOUT_MS,probeMode:mode==='default'?'revoked':mode});
-    ready=true;
-    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} ${authorityBanner(authority)}\n`,displayMode);
-    process.stdout.write('[OK] ONLINE\n');
-    process.stdout.write(`${formatRemoteLifecycle('ready',{displayMode})}\n`);
-    if(url) writeRemote(process.stdout,`URL: ${url}\n`,displayMode);
+  try{
+    process.stdout.write('DEADBYTE MCP\n');
+    process.stdout.write(`${formatRemoteLifecycle('device_start',{displayMode})}\n`);
+    process.stdout.write(`${formatRemoteLifecycle(resumeCursor!==null?'session_restored':'session_new',{displayMode})}\n`);
+    const logOffsets=await snapshotRemoteLogOffsets(ctx.root);
+    logTask=tailRemoteLogs(ctx.root,aborter.signal,{journal:resultJournal,offsets:logOffsets,activityTracker,timelineFilter,timelineWriter,verbose,displayMode});
+    process.stdout.write('[BOOT] Starting local + remote runtime...\n');
+    const preflight=invokeController(ctx,'status',{capture:true,allowFailure:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+    let startText=preflight.stdout||'';
+    if(preflight.status===0&&controllerRuntimeReady(preflight.stdout)){
+      process.stdout.write('[BOOT] Runtime already ONLINE; reusing verified bridge/cloud/supervisor.\n');
+    }else{
+      const recovery=preflight.status===0&&controllerRuntimeDegraded(preflight.stdout);
+      process.stdout.write(recovery?'[RECOVERY] Runtime failed readiness; restarting verified owned components...\n':'[BOOT] Starting bridge/runtime...\n');
+      const startCommand=recovery?'restart':'start';
+      const controllerLogDir=path.join(ctx.root,'runtime','logs');
+      await mkdir(controllerLogDir,{recursive:true});
+      const launchOutput={
+        stdout_path:path.join(controllerLogDir,`controller-${startCommand}.stdout.log`),
+        stderr_path:path.join(controllerLogDir,`controller-${startCommand}.stderr.log`)
+      };
+      const launch=invokeController(ctx,startCommand,{allowFailure:true,redirectOutput:launchOutput,timeoutMs:REMOTE_START_TIMEOUT_MS});
+      if(launch.status!==0){
+        const evidence=await readControllerStartFailure(ctx.root,startCommand);
+        const fallback=evidence?'':await readTailBounded(launchOutput.stderr_path,2048);
+        const detail=evidence?`; controller-start-failure: ${evidence.message}`:(fallback?`; controller-stderr: ${fallback}`:'');
+        throw new Error(`remote controller '${startCommand}' failed exit=${launch.status}${detail}`);
+      }
+      const started=invokeController(ctx,'status',{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+      if(started.status!==0||!controllerRuntimeReady(started.stdout)) throw new Error(`remote controller ${recovery?'restart':'start'} returned without a verified ONLINE runtime`);
+      startText=started.stdout||'';
+    }
+    process.stdout.write(`${formatRemoteLifecycle('bridge_connected',{displayMode})}\n`);
+    process.stdout.write(`${formatRemoteLifecycle('cloud_connected',{displayMode})}\n`);
+    const desired=authorityVector(mode);
+    const priorAuthority=observedAuthority(ctx);
+    for(const plane of ['host','desktop','autonomous','coding','process'].filter(name=>!desired[name]&&priorAuthority.authority[name].armed)){
+      const command=`disarm${plane}`;
+      writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Revoking unwanted ${plane} authority...\n`,displayMode);
+      invokeController(ctx,command,{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+    }
+    for(const plane of AUTHORITY_PLANES.filter(name=>desired[name])){
+      const command=`arm${plane}`;
+      writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Arming ${command.slice(3)}...\n`,displayMode);
+      invokeController(ctx,command,{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+    }
+    const url=startText.match(/^URL\s*:\s*(\S+)/m)?.[1]||'';
+    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Verifying exact ${mode} authority vector...\n`,displayMode);
+    const current=await readActiveRuntimeBinding(ctx.root);
+    const authority=assertAuthorityVector(assertRuntimeReadyObservation(observedAuthority(ctx),{
+      coreRoot:current?.release_root??null
+    }),desired);
+    process.stdout.write('[BOOT] Verifying public signed MCP execution path...\n');
+    invokeController(ctx,'machinetest',{capture:true,echoCaptured:false,timeoutMs:REMOTE_START_TIMEOUT_MS,probeMode:mode==='default'?'revoked':mode});
+    ready=true;
+    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} ${authorityBanner(authority)}\n`,displayMode);
+    process.stdout.write('[OK] ONLINE\n');
+    process.stdout.write(`${formatRemoteLifecycle('ready',{displayMode})}\n`);
+    if(url) writeRemote(process.stdout,`URL: ${url}\n`,displayMode);
     await logTask;
   }catch(error){sessionError=error;throw error;}
   finally{
-    const wasAborted=aborter.signal.aborted;
-    aborter.abort();
-    if(logTask) await logTask.catch(()=>{});
+    const wasAborted=aborter.signal.aborted;
+    aborter.abort();
+    if(logTask) await logTask.catch(()=>{});
     timelineWriter.flush();
     const liveLogDelivery=timelineWriter.retention();
     if(liveLogDelivery.suppressed_since_drain>0){
       process.stderr.write(`[WARN] LIVELOG ${liveLogDelivery.suppressed_since_drain} display lines still suppressed at disconnect due to stdout backpressure; inspect signed audit and runtime logs.\n`);
-    }
-    for(const line of activityTracker.reconcileInterrupted('session_end')) process.stdout.write(`${line}\n`);
-    const filterRetention=timelineFilter?.retention();
-    if(filterRetention?.evicted>0) process.stdout.write(`[WARN] LIVELOG filter evicted ${filterRetention.evicted} presentation identities; full audit remains on disk.\n`);
-    process.stdout.write(`${activityTracker.summary()}\n`);
-    process.removeListener('SIGINT',abort);process.removeListener('SIGTERM',abort);
-    if(watchStdin){process.stdin.removeListener('end',abort);process.stdin.removeListener('close',abort);process.stdin.pause();}
-    process.stdout.write(`${formatRemoteLifecycle('cleanup',{displayMode})}\n`);
-    if(ready||!wasAborted) process.stdout.write('[INFO] Disconnecting; revoking authority...\n');
+    }
+    for(const line of activityTracker.reconcileInterrupted('session_end')) process.stdout.write(`${line}\n`);
+    const filterRetention=timelineFilter?.retention();
+    if(filterRetention?.evicted>0) process.stdout.write(`[WARN] LIVELOG filter evicted ${filterRetention.evicted} presentation identities; full audit remains on disk.\n`);
+    process.stdout.write(`${activityTracker.summary()}\n`);
+    process.removeListener('SIGINT',abort);process.removeListener('SIGTERM',abort);
+    if(watchStdin){process.stdin.removeListener('end',abort);process.stdin.removeListener('close',abort);process.stdin.pause();}
+    process.stdout.write(`${formatRemoteLifecycle('cleanup',{displayMode})}\n`);
+    if(ready||!wasAborted) process.stdout.write('[INFO] Disconnecting; revoking authority...\n');
     try{await cleanupRemoteSession(ctx,{displayMode});}
     catch(cleanupError){
       if(sessionError) throw new AggregateError([sessionError,cleanupError],
@@ -660,98 +865,98 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
         `remote activation failed: ${String(sessionError?.message||sessionError)}; marker cleanup failed: ${String(markerError?.message||markerError)}`);
       throw markerError;
     }
-  }
-}
-async function runRemote(args){
-  let verbose=false,trace=false,filterExpression='',resumeCursor=null,mode='default';
-  const positional=[];
-  for(let index=0;index<args.length;index++){
-    const arg=args[index];
-    if(arg==='--verbose'||arg==='-v'){verbose=true;continue;}
-    if(arg==='--trace'){trace=true;continue;}
-    if(['--operator','--desktop','--host','--full'].includes(arg)){
-      if(mode!=='default') throw new Error('remote authority modes are mutually exclusive');
-      mode=arg.slice(2);continue;
-    }
-    if(arg==='--filter'){
-      if(filterExpression) throw new Error('remote --filter may be specified once');
-      if(index+1>=args.length) throw new Error('remote --filter requires an expression');
-      filterExpression=args[++index];continue;
-    }
-    if(arg==='--resume'){
-      if(resumeCursor!==null) throw new Error('remote --resume may be specified once');
-      if(index+1>=args.length) throw new Error('remote --resume requires a cursor');
-      resumeCursor=args[++index];continue;
-    }
-    positional.push(arg);
-  }
-  const presentation=verbose||trace||Boolean(filterExpression)||resumeCursor!==null||mode!=='default';
-  if(positional.length===0){await runRemoteSession({resumeCursor,verbose,trace,filterExpression,mode});return;}
-  if(presentation) throw new Error('remote presentation flags are valid only for foreground session');
-  if(positional.length>1) throw new Error('remote accepts one controller command');
-  const command=positional[0];if(!REMOTE_COMMANDS.has(command)) throw new Error(`unsupported remote command '${command}'`);
-  const ctx=await remoteContext();
-  await synchronizeOneShotRuntime(ctx,{displayMode:'ascii'});
-  const result=invokeController(ctx,command,{allowFailure:true});
-  process.exitCode=result.status;
-}
-async function runSupervisor(args){
-  const action=args[0]||'status';
-  if(args.length>1||!Object.hasOwn(SUPERVISOR_COMMANDS,action)) throw new Error(`unsupported supervisor command '${action}'`);
-  const ctx=await remoteContext();
-  const result=invokeController(ctx,SUPERVISOR_COMMANDS[action],{allowFailure:true});
-  process.exitCode=result.status;
-}
-async function runAudit(args){
-  const command=args[0]||'status';if(args.length>1) throw new Error('audit accepts one command');
-  if(!['verify','status'].includes(command)) throw new Error(`unsupported audit command '${command}'`);
-  const result=await verifyAuditChain({stateRoot:stateRoot(),verifyKeyPath:process.env.DEADBYTE_VERIFY_KEY||defaultPublicKeyPath(),requireComplete:command==='verify'});
-  const output=command==='status'?{...result,mode:'status'}:result;
-  process.stdout.write(`${JSON.stringify(output,null,2)}\n`);
-  if(command==='verify'&&!result.ok) process.exitCode=1;
-}
-async function main(argv){
-  const [command,...rest]=argv;
-  if(command==='--version'||command==='-v'||command==='version'){
-    if(rest.length) throw new Error('version accepts no arguments');
-    process.stdout.write(`${DEADBYTE_VERSION}\n`);return;
-  }
-  if(!command||command==='help'||command==='--help'||command==='-h'){printHelp();return;}
-  if(command==='doctor'){
-    if(rest.length) throw new Error('doctor accepts no arguments');
-    await printDoctor();return;
-  }
-  if(command==='mcp'){
-    if(rest.length) throw new Error('mcp accepts no arguments');
-    await import('./mcp-server.mjs');
-    return;
-  }
-  if(command==='remote'){await runRemote(rest);return;}
-  if(command==='supervisor'){await runSupervisor(rest);return;}
-  if(command==='audit'){await runAudit(rest);return;}
-  if(command==='diagnostics'){
-    if(rest.length!==3)throw new Error('diagnostics export --output or verify --input; no network upload supported');
-    if(rest[0]==='export'&&rest[1]==='--output'){
-      const report=await exportOfflineDiagnostics({stateRoot:stateRoot(),outputPath:rest[2]});
-      process.stdout.write(`${JSON.stringify(report)}\n`);
-      return;
-    }
-    if(rest[0]==='verify'&&rest[1]==='--input'){
-      const file=path.resolve(rest[2]);
-      await requireRegular(file,'diagnostic ZIP');
-      const report=verifyOfflineDiagnosticsZip(await readFile(file));
-      process.stdout.write(`${JSON.stringify(report)}\n`);
-      return;
-    }
-    throw new Error('unsupported diagnostics mode; network upload is forbidden');
-  }
-  if(command==='inspect'){
-    const result=await runNativeInspect(rest);
-    process.stdout.write(`${JSON.stringify(result)}\n`);
-    if(result.status!=='ok')process.exitCode=2;
-    return;
-  }
-  throw new Error(`unknown command '${command}'`);
-}
-
-main(process.argv.slice(2)).catch(error=>{process.stderr.write(`DEADBYTE CLI: ${String(error?.message||error)}\n`);process.exitCode=1;});
+  }
+}
+async function runRemote(args){
+  let verbose=false,trace=false,filterExpression='',resumeCursor=null,mode='default';
+  const positional=[];
+  for(let index=0;index<args.length;index++){
+    const arg=args[index];
+    if(arg==='--verbose'||arg==='-v'){verbose=true;continue;}
+    if(arg==='--trace'){trace=true;continue;}
+    if(['--operator','--desktop','--host','--full'].includes(arg)){
+      if(mode!=='default') throw new Error('remote authority modes are mutually exclusive');
+      mode=arg.slice(2);continue;
+    }
+    if(arg==='--filter'){
+      if(filterExpression) throw new Error('remote --filter may be specified once');
+      if(index+1>=args.length) throw new Error('remote --filter requires an expression');
+      filterExpression=args[++index];continue;
+    }
+    if(arg==='--resume'){
+      if(resumeCursor!==null) throw new Error('remote --resume may be specified once');
+      if(index+1>=args.length) throw new Error('remote --resume requires a cursor');
+      resumeCursor=args[++index];continue;
+    }
+    positional.push(arg);
+  }
+  const presentation=verbose||trace||Boolean(filterExpression)||resumeCursor!==null||mode!=='default';
+  if(positional.length===0){await runRemoteSession({resumeCursor,verbose,trace,filterExpression,mode});return;}
+  if(presentation) throw new Error('remote presentation flags are valid only for foreground session');
+  if(positional.length>1) throw new Error('remote accepts one controller command');
+  const command=positional[0];if(!REMOTE_COMMANDS.has(command)) throw new Error(`unsupported remote command '${command}'`);
+  const ctx=await remoteContext();
+  await synchronizeOneShotRuntime(ctx,{displayMode:'ascii'});
+  const result=invokeController(ctx,command,{allowFailure:true});
+  process.exitCode=result.status;
+}
+async function runSupervisor(args){
+  const action=args[0]||'status';
+  if(args.length>1||!Object.hasOwn(SUPERVISOR_COMMANDS,action)) throw new Error(`unsupported supervisor command '${action}'`);
+  const ctx=await remoteContext();
+  const result=invokeController(ctx,SUPERVISOR_COMMANDS[action],{allowFailure:true});
+  process.exitCode=result.status;
+}
+async function runAudit(args){
+  const command=args[0]||'status';if(args.length>1) throw new Error('audit accepts one command');
+  if(!['verify','status'].includes(command)) throw new Error(`unsupported audit command '${command}'`);
+  const result=await verifyAuditChain({stateRoot:stateRoot(),verifyKeyPath:process.env.DEADBYTE_VERIFY_KEY||defaultPublicKeyPath(),requireComplete:command==='verify'});
+  const output=command==='status'?{...result,mode:'status'}:result;
+  process.stdout.write(`${JSON.stringify(output,null,2)}\n`);
+  if(command==='verify'&&!result.ok) process.exitCode=1;
+}
+async function main(argv){
+  const [command,...rest]=argv;
+  if(command==='--version'||command==='-v'||command==='version'){
+    if(rest.length) throw new Error('version accepts no arguments');
+    process.stdout.write(`${DEADBYTE_VERSION}\n`);return;
+  }
+  if(!command||command==='help'||command==='--help'||command==='-h'){printHelp();return;}
+  if(command==='doctor'){
+    if(rest.length) throw new Error('doctor accepts no arguments');
+    await printDoctor();return;
+  }
+  if(command==='mcp'){
+    if(rest.length) throw new Error('mcp accepts no arguments');
+    await import('./mcp-server.mjs');
+    return;
+  }
+  if(command==='remote'){await runRemote(rest);return;}
+  if(command==='supervisor'){await runSupervisor(rest);return;}
+  if(command==='audit'){await runAudit(rest);return;}
+  if(command==='diagnostics'){
+    if(rest.length!==3)throw new Error('diagnostics export --output or verify --input; no network upload supported');
+    if(rest[0]==='export'&&rest[1]==='--output'){
+      const report=await exportOfflineDiagnostics({stateRoot:stateRoot(),outputPath:rest[2]});
+      process.stdout.write(`${JSON.stringify(report)}\n`);
+      return;
+    }
+    if(rest[0]==='verify'&&rest[1]==='--input'){
+      const file=path.resolve(rest[2]);
+      await requireRegular(file,'diagnostic ZIP');
+      const report=verifyOfflineDiagnosticsZip(await readFile(file));
+      process.stdout.write(`${JSON.stringify(report)}\n`);
+      return;
+    }
+    throw new Error('unsupported diagnostics mode; network upload is forbidden');
+  }
+  if(command==='inspect'){
+    const result=await runNativeInspect(rest);
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    if(result.status!=='ok')process.exitCode=2;
+    return;
+  }
+  throw new Error(`unknown command '${command}'`);
+}
+
+main(process.argv.slice(2)).catch(error=>{process.stderr.write(`DEADBYTE CLI: ${String(error?.message||error)}\n`);process.exitCode=1;});