deadbyte-mcp 0.15.55 → 0.15.59

package/scripts/request-uac-migration-r153.ps1

@@ -0,0 +1,165 @@
+param(
+    [Parameter(Mandatory=$true)][string]$NodePath,
+    [Parameter(Mandatory=$true)][string]$DeployScript,
+    [Parameter(Mandatory=$true)][string]$StateRoot,
+    [Parameter(Mandatory=$true)][string]$StdoutPath,
+    [Parameter(Mandatory=$true)][string]$StderrPath,
+    [Parameter(Mandatory=$true)][string]$MarkerReceiptPath,
+    [Parameter(Mandatory=$true)][ValidatePattern('^[0-9a-f]{64}$')][string]$MarkerReceiptSha256,
+    [ValidatePattern('^[0-9a-f]{64}$')][string]$PreflightSubjectSha256,
+    [switch]$Elevated
+)
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+function Require-AbsoluteFile([string]$Value,[string]$Label) {
+    if (-not [IO.Path]::IsPathRooted($Value)) { throw "$Label must be absolute" }
+    $item = Get-Item -LiteralPath $Value -Force
+    if ($item.PSIsContainer -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
+        throw "$Label must be a regular non-reparse file"
+    }
+    return $item.FullName
+}
+function Full([string]$Value) { [IO.Path]::GetFullPath($Value).TrimEnd('\') }
+$NodePath = Require-AbsoluteFile $NodePath 'Node executable'
+$DeployScript = Require-AbsoluteFile $DeployScript 'Deploy script'
+$MarkerReceiptPath = Require-AbsoluteFile $MarkerReceiptPath 'Marker reconciliation receipt'
+$helperDir = Split-Path -Parent $PSCommandPath
+$expectedDeploy = Join-Path $helperDir 'deploy-r48.mjs'
+$issuerScript = Require-AbsoluteFile (Join-Path $helperDir 'issue-uac-migration-r153.mjs') 'Protected UAC issuer'
+if ((Full $DeployScript) -ine (Full $expectedDeploy)) { throw 'UAC deploy path is not sibling of helper' }
+$expectedNode = Join-Path $env:ProgramFiles 'nodejs\node.exe'
+if ((Full $NodePath) -ine (Full $expectedNode)) { throw 'UAC Node.js path is not pinned to Program Files' }
+if (-not (Full $helperDir).StartsWith(((Full $env:ProgramFiles) + '\'),[StringComparison]::OrdinalIgnoreCase)) {
+    throw 'UAC helper must be in protected Program Files installation'
+}
+if (-not [IO.Path]::IsPathRooted($StateRoot)) { throw 'State root must be absolute' }
+if (-not [IO.Path]::IsPathRooted($StdoutPath) -or -not [IO.Path]::IsPathRooted($StderrPath)) {
+    throw 'Evidence paths must be absolute'
+}
+# An elevated UAC helper must not become an arbitrary file-writing primitive.
+# Constrain both evidence files to one unique, caller-owned state directory.
+$expectedStateRoot = Join-Path $env:USERPROFILE '.deadbyte-mcp'
+if ((Full $StateRoot) -ine (Full $expectedStateRoot)) {
+    throw 'R153 UAC requires the owning user state root'
+}
+$evidenceDirectory = Join-Path $StateRoot 'evidence\legacy-migration'
+if ((Full (Split-Path -Parent $StdoutPath)) -ine (Full $evidenceDirectory) -or
+    (Full (Split-Path -Parent $StderrPath)) -ine (Full $evidenceDirectory)) {
+    throw 'UAC evidence paths must remain inside state legacy-migration evidence'
+}
+$stdoutName = [IO.Path]::GetFileName($StdoutPath)
+$stderrName = [IO.Path]::GetFileName($StderrPath)
+if ($stdoutName -cnotmatch '^r153-(\d{13}-[0-9a-f]{16})\.stdout\.log$') {
+    throw 'UAC stdout evidence name invalid'
+}
+$id = $Matches[1]
+if ($stderrName -cne ('r153-' + $id + '.stderr.log')) {
+    throw 'UAC stderr evidence identity mismatch'
+}
+$ancestor = [IO.Path]::GetFullPath($evidenceDirectory)
+while ($true) {
+    $item = Get-Item -LiteralPath $ancestor -Force -ErrorAction Stop
+    if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {
+        throw 'UAC evidence directory ancestry contains reparse point'
+    }
+    $parent = [IO.Directory]::GetParent($ancestor)
+    if ($null -eq $parent) { break }
+    $ancestor = $parent.FullName
+}
+if ((Test-Path -LiteralPath $StdoutPath) -or (Test-Path -LiteralPath $StderrPath)) {
+    throw 'UAC evidence files must not pre-exist'
+}
+function Write-NoClobberEvidence([string]$File,[string]$Content) {
+    # CreateNew also rejects an attacker-precreated file or leaf symlink.
+    $utf8 = [Text.UTF8Encoding]::new($false)
+    $bytes = $utf8.GetBytes($Content)
+    if ($bytes.Length -gt 131072) { throw 'UAC evidence output exceeds 128 KiB bound' }
+    $stream = [IO.FileStream]::new($File,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
+    try { $stream.Write($bytes,0,$bytes.Length); $stream.Flush($true) }
+    finally { $stream.Dispose() }
+}
+if (-not $Elevated) {
+    # Dry run cannot issue approval or consume nonce. It returns the live preflight identity.
+    $preflightOutput = & $NodePath $DeployScript '--preflight'
+    if ($LASTEXITCODE -ne 0) { throw 'Unprivileged activation preflight failed' }
+    $preflight = ($preflightOutput -join "`n") | ConvertFrom-Json
+    if ($preflight.state -ne 'AUTHORITY_UNVERIFIED' -or
+        $preflight.subject_sha256 -notmatch '^[0-9a-f]{64}$') {
+        throw "UAC migration not applicable: $($preflight.state)"
+    }
+    $PreflightSubjectSha256 = $preflight.subject_sha256
+    $powershell = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+    $arguments = @(
+        '-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',('"' + $PSCommandPath + '"'),
+        '-Elevated','-NodePath',('"' + $NodePath + '"'),'-DeployScript',('"' + $DeployScript + '"'),
+        '-StateRoot',('"' + $StateRoot + '"'),'-StdoutPath',('"' + $StdoutPath + '"'),'-StderrPath',('"' + $StderrPath + '"'),
+        '-MarkerReceiptPath',('"' + $MarkerReceiptPath + '"'),'-MarkerReceiptSha256',$MarkerReceiptSha256,
+        '-PreflightSubjectSha256',$PreflightSubjectSha256
+    )
+    # -Verb RunAs is the UseShellExecute parameter set. PowerShell 5.1 rejects
+    # -RedirectStandardOutput/-RedirectStandardError in that same Start-Process.
+    # The elevated child writes bounded, no-clobber evidence instead.
+    $child = Start-Process -FilePath $powershell -ArgumentList $arguments -Verb RunAs -Wait -PassThru -WindowStyle Hidden
+    if (Test-Path -LiteralPath $StdoutPath) { [Console]::Out.Write([IO.File]::ReadAllText($StdoutPath)) }
+    if (Test-Path -LiteralPath $StderrPath) { [Console]::Error.Write([IO.File]::ReadAllText($StderrPath)) }
+    exit $child.ExitCode
+}
+$principal = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
+if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'UAC elevation was not established'
+}
+if ($PreflightSubjectSha256 -notmatch '^[0-9a-f]{64}$') { throw 'UAC preflight subject missing' }
+$env:DEADBYTE_STATE_ROOT = [IO.Path]::GetFullPath($StateRoot)
+$exitCode = 2
+$stdoutText = ''
+$stderrText = ''
+try {
+    # Run native children in the already-elevated process. Merged output is
+    # bounded before durable logging; no shell redirection uses elevated paths.
+    $priorErrorAction = $ErrorActionPreference
+    $ErrorActionPreference = 'Continue'
+    try {
+        $issuerOutput = @(& $NodePath $issuerScript '--state-root' $env:DEADBYTE_STATE_ROOT `
+            '--marker-receipt' $MarkerReceiptPath '--marker-receipt-sha256' $MarkerReceiptSha256 `
+            '--preflight-subject-sha256' $PreflightSubjectSha256 2>&1)
+        $issuerExit = $LASTEXITCODE
+    } finally { $ErrorActionPreference = $priorErrorAction }
+    $issuerText = (@($issuerOutput) | ForEach-Object { [string]$_ }) -join "`n"
+    if ($issuerExit -ne 0) { throw "R153 UAC issuer failed exit=$issuerExit : $issuerText" }
+    $issued = $issuerText | ConvertFrom-Json
+    if ($issued.schema -ne 'deadbyte.r153-uac-issuer-result.v1' -or
+        $issued.nonce -notmatch '^[0-9a-f]{64}$' -or
+        $issued.receipt_sha256 -notmatch '^[0-9a-f]{64}$') {
+        throw 'R153 UAC issuer result invalid'
+    }
+    $priorErrorAction = $ErrorActionPreference
+    $ErrorActionPreference = 'Continue'
+    try {
+        $deployOutput = @(& $NodePath $DeployScript '--uac-legacy-migration' `
+            '--marker-reconciliation-receipt' $MarkerReceiptPath `
+            '--marker-reconciliation-receipt-sha256' $MarkerReceiptSha256 `
+            '--migration-nonce' $issued.nonce `
+            '--migration-issued-at' $issued.issued_at_utc `
+            '--migration-expires-at' $issued.expires_at_utc `
+            '--uac-approval-receipt' $issued.receipt_path `
+            '--uac-approval-receipt-sha256' $issued.receipt_sha256 2>&1)
+        $deployExit = $LASTEXITCODE
+    } finally { $ErrorActionPreference = $priorErrorAction }
+    $deployText = (@($deployOutput) | ForEach-Object { [string]$_ }) -join "`n"
+    if ($deployExit -ne 0) {
+        $stderrText = "R153 activation rejected exit=$deployExit : $deployText"
+        $exitCode = 2
+    } else {
+        $stdoutText = $deployText
+        $exitCode = 0
+    }
+} catch {
+    $stderrText = 'R153 UAC failed: ' + [string]$_.Exception.Message
+    $exitCode = 2
+} finally {
+    # A successful issuer cannot be mistaken for a successful activation:
+    # success is reported only after the deploy process exited with code zero.
+    Write-NoClobberEvidence $StdoutPath $stdoutText
+    Write-NoClobberEvidence $StderrPath $stderrText
+}
+exit $exitCode

package/scripts/verify-protected-stage-r153.mjs

@@ -0,0 +1,20 @@
+// First candidate JavaScript executed by the elevated R153 bootstrap.
+// Package bytes have already been independently checked by PowerShell; this
+// adds the repository's R89 OS ACL verdict before any activation code runs.
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {inspectTrustedInstallation,privilegedEpochInstallFiles} from '../src/privileged-install-trust-r89.mjs';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const files=[...privilegedEpochInstallFiles(root,process.execPath),
+  fileURLToPath(import.meta.url),
+  path.join(root,'scripts','deploy-r48.mjs'),
+  path.join(root,'scripts','request-uac-migration-r153.ps1'),
+  path.join(root,'scripts','issue-uac-migration-r153.mjs'),
+  path.join(root,'package.json'),path.join(root,'MANIFEST.SHA256'),path.join(root,'RELEASE.json'),
+  path.join(root,'src','uac-approval-contract-r153.mjs'),
+  path.join(root,'src','clean-activation-recovery-r153.mjs'),
+  path.join(root,'src','legacy-offline-policy-proof-r146.mjs')];
+const verdict=await inspectTrustedInstallation(files);
+if(verdict.trusted!==true)throw new Error('R153 protected stage trust rejected');
+process.stdout.write(JSON.stringify({schema:'deadbyte.r153-protected-stage-verdict.v1',trusted:true,reason:verdict.reason})+'\n');

package/src/activation-preflight-r65.mjs

@@ -94,7 +94,8 @@ function validateLegacyOfflineRecoveryProof(proof,{preflightSubjectSha256,candid
   if(!proof||proof.state!=='VERIFIED_OFFLINE_LEGACY_SCOPE_REPAIR'||
       proof.preflight_subject_sha256!==preflightSubjectSha256||
       proof.candidate_manifest_sha256!==candidate.manifest_sha256||
-      proof.owner_approval_verified!==true||!HEX64.test(String(proof.subject_sha256??'')))
+      (proof.owner_approval_verified!==true&&proof.migration_authorization_verified!==true)||
+      !HEX64.test(String(proof.subject_sha256??'')))
     throw new Error('legacy offline scope recovery proof invalid or unbound');
   return proof;
 }

package/src/clean-activation-recovery-r153.mjs

@@ -0,0 +1,297 @@
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {canonicalJson} from './canonical-json.mjs';
+
+const PLANES=Object.freeze(['process','coding','autonomous','desktop','host']);
+const HEX64=/^[0-9a-f]{64}$/;
+const sha=value=>createHash('sha256').update(Buffer.from(canonicalJson(value),'utf8')).digest('hex');
+const allDisarmed=Object.freeze(Object.fromEntries(PLANES.map(plane=>[plane,false])));
+
+function reject(reason,subject=null){
+  return Object.freeze({state:'MIGRATION_REJECTED',safe_to_migrate:false,reason,
+    subject_sha256:subject?sha(subject):null});
+}
+
+function migrationSubject(input){
+  return {
+    schema:'deadbyte.r153-legacy-migration-preflight.v1',
+    action:'narrow_legacy_policy_and_activate',
+    state_root:path.win32.resolve(input.stateRoot),
+    predecessor:input.pointer,
+    candidate:input.candidate,
+    predecessor_policy_sha256:input.policySha256,
+    marker_sha256:input.marker?.sha256??null,
+    allowed_authority_after:allDisarmed
+  };
+}
+
+export function classifyLegacyMigration(input){
+  if(!input||typeof input!=='object'||typeof input.stateRoot!=='string'||!path.win32.isAbsolute(input.stateRoot))
+    return reject('state root invalid');
+  const subject=migrationSubject(input);
+  if(!input.pointer||input.pointer.version!=='0.15.45'||
+    !HEX64.test(String(input.pointer.manifest_sha256??''))||!HEX64.test(String(input.pointer.generation_manifest_sha256??'')))
+    return reject('predecessor identity invalid',subject);
+  if(!input.candidate||input.candidate.version!=='0.15.59'||
+    !HEX64.test(String(input.candidate.manifest_sha256??''))||!HEX64.test(String(input.candidate.tarball_sha256??'')))
+    return reject('candidate identity invalid',subject);
+  if(PLANES.some(plane=>!HEX64.test(String(input.policySha256?.[plane]??''))))
+    return reject('policy identity incomplete',subject);
+  const observed=input.observation;
+  if(observed?.state!=='OFFLINE'||observed.local_ready!==false||
+    observed.bridge?.alive!==false||observed.core?.alive!==false||observed.cloud?.alive!==false||
+    observed.supervisor?.running!==false)
+    return reject('runtime is not cleanly offline',subject);
+  for(const plane of PLANES){
+    const entry=observed.authority?.[plane];
+    if(entry?.configured!==true||entry.armed!==false)
+      return reject(`${plane} authority is not physically inactive`,subject);
+    if(input.grantPresence?.[plane]!==false)
+      return reject(`${plane} grant absence unverified`,subject);
+  }
+  if(input.marker&&(!HEX64.test(String(input.marker.sha256??''))||
+    input.marker.owner_live!==false||input.marker.guardian_live!==false))
+    return reject('foreground ownership is live or unverified',subject);
+  const roots=Array.isArray(input.codingRootPaths)?input.codingRootPaths:[];
+  const drives=new Set(roots.map(value=>path.win32.normalize(String(value)).toLowerCase())
+    .filter(value=>/^[a-z]:\\$/.test(value)));
+  if(!drives.has('c:\\')||!drives.has('d:\\'))
+    return reject('legacy broad-root signature not present',subject);
+  return Object.freeze({state:'MIGRATION_CONSENT_REQUIRED',safe_to_migrate:true,
+    subject_sha256:sha(subject),subject:Object.freeze(subject)});
+}
+
+function parseInstant(value,label){
+  if(typeof value!=='string'||new Date(value).toISOString()!==value)throw new Error(`${label} invalid`);
+  return Date.parse(value);
+}
+
+export function createLegacyMigrationSubject({classification,nonce,issuedAt,expiresAt,...input}){
+  if(classification?.state!=='MIGRATION_CONSENT_REQUIRED'||classification.safe_to_migrate!==true)
+    throw new Error('migration classification is not consentable');
+  if(!HEX64.test(String(nonce??'')))throw new Error('migration nonce invalid');
+  const issued=parseInstant(issuedAt,'migration issued time');
+  const expires=parseInstant(expiresAt,'migration expiry');
+  if(expires<=issued||expires-issued>600_000)throw new Error('migration lifetime invalid');
+  const base=migrationSubject(input);
+  if(sha(base)!==classification.subject_sha256)throw new Error('migration preflight subject changed');
+  return Object.freeze({...base,schema:'deadbyte.r153-uac-migration-subject.v1',
+    preflight_subject_sha256:classification.subject_sha256,nonce,issued_at_utc:issuedAt,
+    expires_at_utc:expiresAt});
+}
+
+export function authorizeElevatedLegacyMigration({subject,isElevated,now=new Date()}){
+  if(isElevated!==true)throw new Error('legacy migration requires verified Windows elevation');
+  if(subject?.schema!=='deadbyte.r153-uac-migration-subject.v1'||
+    subject.action!=='narrow_legacy_policy_and_activate'||!HEX64.test(String(subject.nonce??''))||
+    !HEX64.test(String(subject.preflight_subject_sha256??'')))throw new Error('legacy migration subject invalid');
+  if(PLANES.some(plane=>subject.allowed_authority_after?.[plane]!==false))
+    throw new Error('legacy migration may not grant authority');
+  const issued=parseInstant(subject.issued_at_utc,'migration issued time');
+  const expires=parseInstant(subject.expires_at_utc,'migration expiry');
+  const observed=now instanceof Date?now.getTime():NaN;
+  if(!Number.isFinite(observed)||expires<=issued||expires-issued>600_000||observed<issued||observed>=expires)
+    throw new Error('legacy migration authorization expired or invalid');
+  return Object.freeze({state:'MIGRATION_APPROVED',authorization:'windows_uac_elevated',
+    subject_sha256:sha(subject),preflight_subject_sha256:subject.preflight_subject_sha256,
+    nonce:subject.nonce,expires_at_utc:subject.expires_at_utc,allowed_authority_after:allDisarmed});
+}
+
+export async function reconcileStaleMarker(options){
+  const {deleteIfHash,publishIntent,publishTerminal,revalidate,...input}=options??{};
+  if(typeof deleteIfHash!=='function')throw new Error('marker CAS deletion unavailable');
+  if(typeof publishIntent!=='function'||typeof publishTerminal!=='function')
+    throw new Error('marker reconciliation durable publication unavailable');
+  if(typeof revalidate!=='function')throw new Error('marker reconciliation revalidation unavailable');
+  const observed=input.observation;
+  if(!input.pointer||!HEX64.test(String(input.pointer.manifest_sha256??''))||
+    !HEX64.test(String(input.pointer.generation_manifest_sha256??'')))
+    throw new Error('stale marker predecessor identity invalid');
+  if(PLANES.some(plane=>!HEX64.test(String(input.policySha256?.[plane]??''))))
+    throw new Error('stale marker policy identity incomplete');
+  if(observed?.state!=='OFFLINE'||observed.local_ready!==false||
+    observed.bridge?.alive!==false||observed.core?.alive!==false||observed.cloud?.alive!==false||
+    observed.supervisor?.running!==false)
+    throw new Error('stale marker runtime is not cleanly offline');
+  for(const plane of PLANES){
+    if(observed.authority?.[plane]?.configured!==true||observed.authority?.[plane]?.armed!==false)
+      throw new Error(`stale marker ${plane} authority is not physically inactive`);
+    if(input.grantPresence?.[plane]!==false)throw new Error(`stale marker ${plane} grant absence unverified`);
+  }
+  if(!input.marker||!HEX64.test(String(input.marker.sha256??'')))throw new Error('stale marker snapshot missing');
+  if(input.marker.owner_live!==false||input.marker.guardian_live!==false)
+    throw new Error('stale marker ownership is live or unverified');
+  const proofSha256=sha({pointer:input.pointer,policy_sha256:input.policySha256,
+    marker_sha256:input.marker.sha256,authority:Object.fromEntries(PLANES.map(plane=>[plane,false]))});
+  const intent=Object.freeze({schema:'deadbyte.r153-marker-reconciliation-intent.v1',
+    state:'RECONCILIATION_CLAIMED',predecessor:input.pointer,
+    predecessor_policy_sha256:input.policySha256,marker_sha256:input.marker.sha256,
+    proof_sha256:proofSha256,authority:allDisarmed,
+    subject_sha256:sha({predecessor:input.pointer,predecessor_policy_sha256:input.policySha256,
+      marker_sha256:input.marker.sha256,proof_sha256:proofSha256,authority:allDisarmed})});
+  const intentEvidence=await publishIntent(intent);
+  if(!intentEvidence||!HEX64.test(String(intentEvidence.sha256??'')))
+    throw new Error('marker reconciliation intent publication unverified');
+  await revalidate('before_delete',input);
+  const result=await deleteIfHash(input.marker.sha256);
+  if(result==='CHANGED')throw new Error('stale marker changed before CAS deletion');
+  // An observed marker must be removed by this CAS operation. Treat MISSING as
+  // an ownership race, not as evidence that the expected bytes were deleted.
+  if(result!=='REMOVED')throw new Error('stale marker CAS did not remove observed marker');
+  await revalidate('after_delete',input);
+  const terminal=createMarkerReconciliationReceipt({pointer:input.pointer,policySha256:input.policySha256,
+    markerSha256:input.marker.sha256,proofSha256,observedAtUtc:new Date().toISOString(),
+    intentSha256:intentEvidence.sha256});
+  const terminalEvidence=await publishTerminal(terminal);
+  if(!terminalEvidence||!HEX64.test(String(terminalEvidence.sha256??'')))
+    throw new Error('marker reconciliation terminal publication unverified');
+  return Object.freeze({...terminal,receipt_sha256:terminalEvidence.sha256});
+}
+
+// A crash after the content-CAS delete but before terminal publication leaves
+// an immutable intent. Resume only from that exact intent after independently
+// proving the marker is absent and the same predecessor remains OFFLINE with
+// every grant absent. This closes the crash boundary without replaying deletion.
+export async function resumeMarkerReconciliation(options){
+  const {intent,intentSha256,markerPresent,publishTerminal,...input}=options??{};
+  if(typeof publishTerminal!=='function')throw new Error('marker reconciliation terminal publication unavailable');
+  if(!HEX64.test(String(intentSha256??'')))throw new Error('marker reconciliation intent identity invalid');
+  if(markerPresent!==false)throw new Error('stale marker is present; CAS reconciliation required');
+  if(intent?.schema!=='deadbyte.r153-marker-reconciliation-intent.v1'||
+      intent.state!=='RECONCILIATION_CLAIMED'||!HEX64.test(String(intent.marker_sha256??''))||
+      !HEX64.test(String(intent.proof_sha256??''))||!HEX64.test(String(intent.subject_sha256??'')))
+    throw new Error('marker reconciliation intent invalid');
+  const observed=input.observation;
+  if(observed?.state!=='OFFLINE'||observed.local_ready!==false||
+      observed.bridge?.alive!==false||observed.core?.alive!==false||observed.cloud?.alive!==false||
+      observed.supervisor?.running!==false)throw new Error('marker reconciliation runtime is not cleanly offline');
+  for(const plane of PLANES){
+    if(observed.authority?.[plane]?.configured!==true||observed.authority?.[plane]?.armed!==false)
+      throw new Error(`marker reconciliation ${plane} authority is not physically inactive`);
+    if(input.grantPresence?.[plane]!==false)throw new Error(`marker reconciliation ${plane} grant absence unverified`);
+  }
+  const expectedProof=sha({pointer:input.pointer,policy_sha256:input.policySha256,
+    marker_sha256:intent.marker_sha256,authority:Object.fromEntries(PLANES.map(plane=>[plane,false]))});
+  const expectedSubject=sha({predecessor:input.pointer,predecessor_policy_sha256:input.policySha256,
+    marker_sha256:intent.marker_sha256,proof_sha256:expectedProof,authority:allDisarmed});
+  if(canonicalJson(intent.predecessor)!==canonicalJson(input.pointer)||
+      canonicalJson(intent.predecessor_policy_sha256)!==canonicalJson(input.policySha256)||
+      canonicalJson(intent.authority)!==canonicalJson(allDisarmed)||
+      intent.proof_sha256!==expectedProof||intent.subject_sha256!==expectedSubject)
+    throw new Error('marker reconciliation intent proof or predecessor drift');
+  const terminal=createMarkerReconciliationReceipt({pointer:input.pointer,policySha256:input.policySha256,
+    markerSha256:intent.marker_sha256,proofSha256:expectedProof,observedAtUtc:new Date().toISOString(),intentSha256});
+  const terminalEvidence=await publishTerminal(terminal);
+  if(!terminalEvidence||!HEX64.test(String(terminalEvidence.sha256??'')))
+    throw new Error('marker reconciliation terminal publication unverified');
+  return Object.freeze({...terminal,receipt_sha256:terminalEvidence.sha256});
+}
+
+function markerReceiptSubject({pointer,policySha256,markerSha256,proofSha256,observedAtUtc,intentSha256}){
+  if(!pointer||!HEX64.test(String(pointer.manifest_sha256??''))||
+    !HEX64.test(String(pointer.generation_manifest_sha256??'')))throw new Error('marker receipt predecessor identity invalid');
+  if(PLANES.some(plane=>!HEX64.test(String(policySha256?.[plane]??''))))throw new Error('marker receipt policy identity incomplete');
+  if(!HEX64.test(String(markerSha256??'')))throw new Error('marker receipt marker identity invalid');
+  if(!HEX64.test(String(proofSha256??'')))throw new Error('marker receipt proof identity invalid');
+  if(!HEX64.test(String(intentSha256??'')))throw new Error('marker receipt intent identity invalid');
+  parseInstant(observedAtUtc,'marker receipt observed time');
+  return Object.freeze({schema:'deadbyte.r153-marker-reconciliation.v1',state:'MARKER_RECONCILED',
+    predecessor:pointer,predecessor_policy_sha256:policySha256,marker_sha256:markerSha256,
+    proof_sha256:proofSha256,intent_sha256:intentSha256,observed_at_utc:observedAtUtc,
+    authority:Object.freeze({...allDisarmed})});
+}
+
+export function createMarkerReconciliationReceipt(input){
+  const subject=markerReceiptSubject(input);
+  return Object.freeze({...subject,subject_sha256:sha(subject)});
+}
+
+export function verifyMarkerReconciliationReceipt(receipt,{pointer,policySha256,markerSha256}){
+  if(receipt?.schema!=='deadbyte.r153-marker-reconciliation.v1'||receipt.state!=='MARKER_RECONCILED')
+    throw new Error('marker reconciliation receipt schema invalid');
+  if(receipt.marker_sha256!==markerSha256)throw new Error('marker reconciliation receipt marker mismatch');
+  const expectedProof=sha({pointer,policy_sha256:policySha256,marker_sha256:markerSha256,
+    authority:Object.fromEntries(PLANES.map(plane=>[plane,false]))});
+  if(receipt.proof_sha256!==expectedProof)
+    throw new Error('marker reconciliation receipt proof binding mismatch');
+  const expected=markerReceiptSubject({pointer,policySha256,markerSha256,
+    proofSha256:receipt.proof_sha256,intentSha256:receipt.intent_sha256,
+    observedAtUtc:receipt.observed_at_utc});
+  if(canonicalJson(receipt.predecessor)!==canonicalJson(pointer)||
+    canonicalJson(receipt.predecessor_policy_sha256)!==canonicalJson(policySha256))
+    throw new Error('marker reconciliation receipt predecessor drift');
+  const digest=sha(expected);
+  if(receipt.subject_sha256!==digest)throw new Error('marker reconciliation receipt subject mismatch');
+  return digest;
+}
+
+export function recoverPublishedMarkerTerminal(options){
+  const {intent,intentSha256,terminal,terminalSha256,markerPresent,...input}=options??{};
+  if(markerPresent!==false)throw new Error('stale marker is present; published terminal cannot be adopted');
+  if(!HEX64.test(String(intentSha256??''))||!HEX64.test(String(terminalSha256??'')))
+    throw new Error('published marker terminal evidence identity invalid');
+  if(intent?.schema!=='deadbyte.r153-marker-reconciliation-intent.v1'||
+      intent.state!=='RECONCILIATION_CLAIMED'||intent.marker_sha256!==terminal?.marker_sha256||
+      terminal?.intent_sha256!==intentSha256)throw new Error('published marker terminal intent binding mismatch');
+  const observed=input.observation;
+  if(observed?.state!=='OFFLINE'||observed.local_ready!==false||
+      observed.bridge?.alive!==false||observed.core?.alive!==false||observed.cloud?.alive!==false||
+      observed.supervisor?.running!==false)throw new Error('published marker terminal runtime is not cleanly offline');
+  for(const plane of PLANES){
+    if(observed.authority?.[plane]?.configured!==true||observed.authority?.[plane]?.armed!==false)
+      throw new Error(`published marker terminal ${plane} authority is not physically inactive`);
+    if(input.grantPresence?.[plane]!==false)
+      throw new Error(`published marker terminal ${plane} grant absence unverified`);
+  }
+  verifyMarkerReconciliationReceipt(terminal,{pointer:input.pointer,policySha256:input.policySha256,
+    markerSha256:intent.marker_sha256});
+  return Object.freeze({...terminal,receipt_sha256:terminalSha256});
+}
+
+export function verifyNarrowedPolicyGeneration({codingPolicy,codingPolicyBytes,autonomousPolicy}){
+  if(!codingPolicy||codingPolicy.schema!=='deadbyte.coding-policy.v1'||!Buffer.isBuffer(codingPolicyBytes)||
+      !autonomousPolicy||autonomousPolicy.schema!=='deadbyte.autonomous-policy.v1')
+    throw new Error('narrowed policy generation inputs invalid');
+  for(const [id,root] of Object.entries(codingPolicy.roots??{})){
+    if(typeof root?.path!=='string'||!path.win32.isAbsolute(root.path))
+      throw new Error(`narrowed policy root invalid: ${id}`);
+    const normalized=path.win32.normalize(root.path),drive=path.win32.parse(normalized).root;
+    if(/^[a-z]:\\$/i.test(drive)&&normalized.toLowerCase()===drive.toLowerCase())
+      throw new Error(`narrowed policy contains whole-drive root: ${id}`);
+  }
+  const codingSha256=createHash('sha256').update(codingPolicyBytes).digest('hex');
+  if(autonomousPolicy.coding_policy_sha256!==codingSha256)
+    throw new Error('Autonomous coding policy digest mismatch after narrowing');
+  return Object.freeze({coding_policy_sha256:codingSha256,root_count:Object.keys(codingPolicy.roots??{}).length});
+}
+
+// The activation claim is acquired before one-time nonce consumption. If
+// consumption fails, release only the claim we just acquired and abort.
+export async function claimWithOneTimeMigration({claim,subjectSha256,consume=null}){
+  if(typeof claim!=='function'||!HEX64.test(String(subjectSha256??'')))
+    throw new Error('activation claim callback or subject invalid');
+  if(consume!==null&&typeof consume!=='function')
+    throw new Error('migration nonce consumer invalid');
+  const held=await claim(subjectSha256);
+  if(!held||typeof held.operation_id!=='string'||typeof held.release!=='function')
+    throw new Error('activation claim result invalid');
+  try{if(consume)await consume();}
+  catch(error){
+    try{await held.release();}
+    catch(releaseError){throw new AggregateError([error,releaseError],
+      'migration nonce consumption failed and activation claim cleanup failed');}
+    throw error;
+  }
+  return held;
+}
+
+export async function runRemoteStartupSequence({recover,synchronize,claim,start}){
+  if([recover,synchronize,claim,start].some(fn=>typeof fn!=='function'))throw new Error('remote startup callback missing');
+  await recover();
+  const coherence=await synchronize();
+  const marker=await claim();
+  try{return Object.freeze({coherence,marker,result:await start(marker)});}
+  catch(error){throw error;}
+}
+
+export const R153_AUTHORITY_AFTER_MIGRATION=allDisarmed;