deadbyte-mcp 0.15.55 → 0.15.59

package/src/foreground-process-identity.mjs

@@ -25,3 +25,34 @@ export function queryForegroundIdentity(pid){
  if(!validForegroundIdentity(identity)||identity.pid!==pid)throw new Error('foreground process identity incomplete');
  return identity;
 }
+
+export function classifyRestrictedReusedPid(expected,observed){
+  if(!validForegroundIdentity(expected)||path.win32.basename(expected.executable_path).toLowerCase()!=='node.exe')
+    throw new Error('R153 restricted PID proof requires the exact original Node owner identity');
+  if(!observed||!Number.isSafeInteger(observed.pid)||observed.pid!==expected.pid)
+    throw new Error('R153 restricted PID evidence PID mismatch or unverified');
+  if(String(observed.name).toLowerCase()!=='svchost.exe')
+    throw new Error('R153 restricted PID evidence not a protected Windows service');
+  if(typeof observed.creation_utc!=='string'||!/^\d{4}-\d\d-\d\dT.*Z$/.test(observed.creation_utc))
+    throw new Error('R153 restricted PID birth invalid');
+  const previous=Date.parse(expected.creation_utc),current=Date.parse(observed.creation_utc);
+  if(!Number.isFinite(previous)||!Number.isFinite(current))
+    throw new Error('R153 restricted PID birth invalid');
+  if(current<=previous)throw new Error('R153 restricted PID birth unchanged or ambiguous');
+  return 'REUSED';
+}
+
+export function proveRestrictedPidReuse(expected,cause){
+  if(cause?.message!=='foreground process command identity unavailable')throw cause;
+  if(!validForegroundIdentity(expected))throw new Error('R153 restricted PID owner identity unverified');
+  const powershell='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+  const command=`$p=Get-CimInstance Win32_Process -Filter 'ProcessId=${expected.pid}'; if ($null -eq $p) {throw 'PID not positively observed'}; [pscustomobject]@{pid=$p.ProcessId;name=$p.Name;creation_utc=$p.CreationDate.ToUniversalTime().ToString('o')} | ConvertTo-Json -Compress`;
+  const result=spawnSync(powershell,['-NoLogo','-NoProfile','-Command',command],{
+    encoding:'utf8',windowsHide:true,timeout:15000,maxBuffer:1024*1024,
+    env:windowsPowerShellEnvironment({...process.env,SystemRoot:'C:\\Windows',WINDIR:'C:\\Windows'})
+  });
+  if(result.error||result.status!==0)throw new Error('R153 restricted PID system observation failed');
+  let observed;
+  try{observed=JSON.parse(result.stdout);}catch{throw new Error('R153 restricted PID system observation malformed');}
+  return classifyRestrictedReusedPid(expected,observed)==='REUSED';
+}

package/src/legacy-offline-policy-proof-r146.mjs

@@ -3,6 +3,7 @@ import {lstat,open,readFile} from 'node:fs/promises';
 import path from 'node:path';
 import {verifyGenerationBundle} from './release-generation.mjs';
 import {canonicalJson} from './canonical-json.mjs';
+import {authorizeElevatedLegacyMigration,verifyMarkerReconciliationReceipt} from './clean-activation-recovery-r153.mjs';
 
 const PLANES=['process','coding','autonomous','desktop','host'];
 const GRANT_FIELDS={process:'grant_file',coding:'lease_file',autonomous:'lease_file',desktop:'grant_file',host:'arm_file'};
@@ -114,7 +115,7 @@ async function verifyMigrationApproval({approvalPath,approvalSha256,ownerPublicK
 export async function proveLegacyOfflineScopeRepair({
   stateRoot,pointer,expectedParent,candidate,expectedCandidate,preflightSubjectSha256,
   observation,policyPaths,policySha256,approvalPath,approvalSha256,ownerPublicKeyPath,
-  now=new Date()
+  now=new Date(),uacAuthorization=null
 }){
   if(!stateRoot||!path.isAbsolute(stateRoot))throw new Error('state root invalid');
   if(!pointer||!expectedParent||!observation)throw new Error('legacy scope proof subject missing');
@@ -182,22 +183,42 @@ export async function proveLegacyOfflineScopeRepair({
   if(!Array.isArray(autonomous.root_ids)||autonomous.root_ids.length===0||
     autonomous.root_ids.some(id=>id==='local_c'||id==='local_d'||!Object.hasOwn(coding.roots,id)))
     throw new Error('legacy scope proof autonomous roots unsafe');
-  const approval=await verifyMigrationApproval({approvalPath,approvalSha256,ownerPublicKeyPath,now,expected:{
-    predecessor_release_id:pointer.release_id,predecessor_version:pointer.version,
-    predecessor_manifest_sha256:pointer.manifest_sha256,
-    predecessor_generation_manifest_sha256:pointer.generation_manifest_sha256,
-    candidate_version:candidate.version,candidate_manifest_sha256:candidate.manifest_sha256,
-    predecessor_policy_sha256:policySha256,preflight_subject_sha256:preflightSubjectSha256
-  }});
+  let approval,authorization='owner_ed25519';
+  if(uacAuthorization){
+    const markerReceipt=uacAuthorization.markerReceipt;
+    if(!markerReceipt)throw new Error('legacy migration marker reconciliation receipt missing');
+    verifyMarkerReconciliationReceipt(markerReceipt,{pointer,policySha256,
+      markerSha256:markerReceipt.marker_sha256});
+    const uacSubject={
+      schema:'deadbyte.r153-uac-migration-subject.v1',action:'narrow_legacy_policy_and_activate',
+      state_root:path.win32.resolve(stateRoot),predecessor:pointer,candidate:{...candidate,tarball_sha256:uacAuthorization.tarballSha256},
+      predecessor_policy_sha256:policySha256,marker_sha256:markerReceipt.marker_sha256,
+      allowed_authority_after:Object.fromEntries(PLANES.map(plane=>[plane,false])),
+      preflight_subject_sha256:preflightSubjectSha256,nonce:uacAuthorization.nonce,
+      issued_at_utc:uacAuthorization.issuedAt,expires_at_utc:uacAuthorization.expiresAt
+    };
+    approval=authorizeElevatedLegacyMigration({subject:uacSubject,isElevated:uacAuthorization.isElevated,now});
+    authorization=approval.authorization;
+  }else{
+    approval=await verifyMigrationApproval({approvalPath,approvalSha256,ownerPublicKeyPath,now,expected:{
+      predecessor_release_id:pointer.release_id,predecessor_version:pointer.version,
+      predecessor_manifest_sha256:pointer.manifest_sha256,
+      predecessor_generation_manifest_sha256:pointer.generation_manifest_sha256,
+      candidate_version:candidate.version,candidate_manifest_sha256:candidate.manifest_sha256,
+      predecessor_policy_sha256:policySha256,preflight_subject_sha256:preflightSubjectSha256
+    }});
+  }
   const subject={release_id:pointer.release_id,version:pointer.version,
     generation_manifest_sha256:pointer.generation_manifest_sha256,
     coding_policy_sha256:policySha256.coding,autonomous_policy_sha256:policySha256.autonomous,
     candidate_version:candidate.version,candidate_manifest_sha256:candidate.manifest_sha256,
-    preflight_subject_sha256:preflightSubjectSha256,owner_approval_subject_sha256:approval.subject_sha256,
+    preflight_subject_sha256:preflightSubjectSha256,migration_authorization_subject_sha256:approval.subject_sha256,
+    owner_approval_subject_sha256:authorization==='owner_ed25519'?approval.subject_sha256:null,
     grant_absent_planes:PLANES};
   return Object.freeze({
     state:'VERIFIED_OFFLINE_LEGACY_SCOPE_REPAIR',
-    ...subject,owner_approval_verified:true,owner_key_id:approval.owner_key_id,
+    ...subject,owner_approval_verified:authorization==='owner_ed25519',migration_authorization_verified:true,
+    migration_authorization:authorization,owner_key_id:approval.owner_key_id??null,
     approval_expires_at_utc:approval.expires_at_utc,
     subject_sha256:sha(Buffer.from(canonicalJson(subject),'utf8'))
   });

package/src/runtime-update.mjs

@@ -22,6 +22,7 @@ import {canonicalLauncherPaths,assertCanonicalLaunchers,renderStateBoundLauncher
 import {assertStageOwnedPath,assertStagingBootstrapInputs,assertStagingControlConfig} from './staging-input-isolation.mjs';
 import { verifyProjectOwnerApproval } from './r70-owner-approval.mjs';
 import {windowsPowerShellEnvironment} from './windows-powershell-environment.mjs';
+import {verifyNarrowedPolicyGeneration} from './clean-activation-recovery-r153.mjs';
 
 export {windowsPowerShellEnvironment};
 
@@ -1847,7 +1848,7 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
   await writeState(statePath,journal,'initial');
   let pointerInfo=null,control=null,predecessor=null,oldRuntime=null,priorStatus=null,authorityPreparation=null,workspace=null,launchers=null,newPointer=null;
   let stableMcpUrl=null,mcpUrlSnapshot=null;
-  let mutationBegan=false;
+  let activationDispatchBegan=false;
   try{
     pointerInfo=await loadPointerIfPresent(state);
     const stageVerified=await verifyPackageRoot(stageRoot,expectedVersion,expectedManifest,'stage');
@@ -1869,7 +1870,6 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
     // Read-only predecessor authority and process identity must be safe before
     // materializing a slot or changing any stable runtime file.
     await capturePredecessor(control.ctx,recoverOfflinePredecessor,{allowHostDisarm:false});
-    mutationBegan=true;
     const slot=await materializeReleaseSlot({source:stageRoot,stateRoot:state,version:expectedVersion,manifestSha256:expectedManifest});
     const hostBootstrap=await prepareHostPolicyBootstrap(hostPolicyBootstrap);if(hostBootstrap) control.hostPolicy=hostBootstrap.policy;
     if(codingBootstrap) control.codingPolicy=codingBootstrap.policy;
@@ -1910,6 +1910,17 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
     }
     workspace=await workspacePlan(control.workspaceRoot,state);launchers=await launcherPlan(state);
     const generation=await createGenerationBundle({stateRoot:state,releaseRoot:slot.release_root,developmentRoot:development,workspaceRoot:workspace.target,releaseId:slot.release_id,currentConfig:control.config,codingPolicy:control.codingPolicy,autonomousPolicy:control.autonomousPolicy,hostPolicy:control.hostPolicy,processPolicy:control.processPolicy,desktopPolicy:control.desktopPolicy});
+    // A newly materialized generation is still pre-pointer-switch.  Prove that
+    // legacy whole-drive roots were narrowed here, while a failure is still a
+    // deterministic candidate-preparation rejection rather than an ambiguous
+    // activation outcome.
+    const generatedCodingBytes=await readFile(generation.coding_policy_path);
+    const generatedAutonomousBytes=await readFile(generation.autonomous_policy_path);
+    verifyNarrowedPolicyGeneration({
+      codingPolicy:JSON.parse(generatedCodingBytes.toString('utf8').replace(/^\uFEFF/,'')),
+      codingPolicyBytes:generatedCodingBytes,
+      autonomousPolicy:JSON.parse(generatedAutonomousBytes.toString('utf8').replace(/^\uFEFF/,''))
+    });
     newPointer={schema:'deadbyte.active-release.v1',release_id:slot.release_id,version:expectedVersion,manifest_sha256:expectedManifest,release_root:slot.release_root,generation_root:generation.generation_root,generation_manifest_sha256:generation.generation_manifest_sha256,launcher_sha256:launchers.launcher_sha256,config_path:generation.config_path};
     parseActivePointer(JSON.stringify(newPointer));
     await writeState(statePath,journal,'candidate_prepared',{prior_pointer:publicPointer(pointerInfo.pointer),stage:stageVerified,development:developmentVerified,
@@ -1925,17 +1936,21 @@ export async function performSlotUpdate({stage,developmentRoot,expectedVersion,e
     await writeState(statePath,journal,'old_runtime_verified',{predecessor_mode:predecessor.mode,old_runtime:generationTuple(oldRuntime),
       prior_authority:{process_armed:priorStatus.process_armed,coding_armed:priorStatus.coding_armed,autonomous_armed:priorStatus.autonomous_armed,desktop_armed:priorStatus.desktop_armed,host_armed:priorStatus.host_armed}});
     const handoff=await writeHandoff({stateRoot:state,state:journal,journal,statePath,evidenceDir,key,pointerInfo,newPointer,predecessor,priorStatus,workspace,launchers,stableMcpUrl,mcpUrlSnapshot,controlCtx:control.ctx});
+    // From this point a detached child may observe the handoff even if the
+    // parent loses its acknowledgement. Earlier failures are deterministic
+    // preparation rejections and must not be reported as unknown activation.
+    activationDispatchBegan=true;
     const supervisor=await spawnDetachedSupervisor({script:handoff.body.supervisor_script,handoffPath:handoff.path,cwd:control.ctx.core_root});
     return {ok:true,handed_off:true,completed:false,update_id:updateId,state_path:statePath,handoff_path:handoff.path,handoff_receipt_sha256:handoff.receipt.receipt_sha256,supervisor_pid:supervisor.pid,pointer:newPointer};
   }catch(error){
     const failure={schema:FAILURE_SCHEMA,update_id:updateId,release_version:expectedVersion,candidate_manifest_sha256:expectedManifest,failed_at_utc:new Date().toISOString(),
-      result:mutationBegan?'MUTATION_OUTCOME_REQUIRES_RECONCILIATION':'PRECONDITION_REJECTED',
+      result:activationDispatchBegan?'MUTATION_OUTCOME_REQUIRES_RECONCILIATION':'PRECONDITION_REJECTED',
       phase:journal.phase??'unknown',error:{name:error?.name??'Error',code:error?.code??null,message:String(error?.message??error)},
       predecessor_mode:predecessor?.mode??null,prior_pointer:publicPointer(pointerInfo?.pointer??null),attempted_pointer:publicPointer(newPointer),old_runtime:generationTuple(oldRuntime),
       rollback:{attempted:false,new_runtime_stopped:false,pointer_restored:false,launchers_restored:false,workspace_restored:false,mcp_url_restored:false,old_runtime_restarted:false,authority_restored:false,errors:[]}};
     await writeState(statePath,journal,'failed',{failure}).catch(()=>{});
     let failureReceipt=null;
-    try{ failureReceipt=await writeEnvelope(failurePath,failure,key);await writeState(statePath,journal,mutationBegan?'failed_receipted':'precondition_rejected',{failure_receipt_path:failurePath,failure_receipt_sha256:failureReceipt.receipt_sha256});}
+    try{ failureReceipt=await writeEnvelope(failurePath,failure,key);await writeState(statePath,journal,activationDispatchBegan?'failed_receipted':'precondition_rejected',{failure_receipt_path:failurePath,failure_receipt_sha256:failureReceipt.receipt_sha256});}
     catch(receiptError){ await writeState(statePath,journal,'failed_unreceipted',{failure_receipt_error:String(receiptError?.message??receiptError)}).catch(()=>{}); }
     const wrapped=new Error('R27 slot update handoff failed: '+(error?.message??error));wrapped.cause=error;wrapped.statePath=statePath;wrapped.failureReceiptPath=failureReceipt?failurePath:null;throw wrapped;
   }

package/src/uac-approval-contract-r153.mjs

@@ -0,0 +1,104 @@
+// R153 consent is narrowly scoped to a one-time, authority-reducing migration.
+// This JSON record is evidence of UAC confirmation, NOT a signature or owner grant.
+// Verify it only when running elevated from an independently R89-verified install.
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const PLANES=['process','coding','autonomous','desktop','host'];
+const ALL_DISARMED=Object.freeze(Object.fromEntries(PLANES.map(p=>[p,false])));
+const TIME=/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/;
+const FIELDS=['schema','action','state_root','candidate_root','candidate_version','candidate_manifest_sha256',
+  'tarball_sha256','marker_receipt_sha256','predecessor_pointer_sha256','predecessor_policy_sha256',
+  'preflight_subject_sha256','node_sha256','deploy_script_sha256','nonce','issued_at_utc',
+  'expires_at_utc','allowed_authority_after','subject_sha256'];
+function canonical(value){
+  if(value===null)return 'null';
+  if(typeof value==='string'||typeof value==='boolean')return JSON.stringify(value);
+  if(typeof value==='number'&&Number.isFinite(value))return JSON.stringify(value);
+  if(Array.isArray(value))return '['+value.map(canonical).join(',')+']';
+  if(typeof value==='object'&&Object.getPrototypeOf(value)===Object.prototype)
+    return '{'+Object.keys(value).sort().map(k=>JSON.stringify(k)+':'+canonical(value[k])).join(',')+'}';
+  throw new Error('UAC approval subject has noncanonical field');
+}
+const digest=v=>createHash('sha256').update(canonical(v),'utf8').digest('hex');
+export function uacPointerSha256(pointer){return digest(pointer);}
+
+// Protected one-time approval evidence must not mutate the exact npm package
+// tree. Store it as an adjacent protected sidecar and require a fresh R89 ACL
+// verdict before the elevated deploy reads it.
+export function protectedUacReceiptPath(candidateRoot,nonce){
+  const candidate=windowsAbsolute(candidateRoot,'candidate root');
+  if(!candidate.startsWith('c:\\program files\\')||candidate==='c:\\program files\\')
+    throw new Error('UAC approval requires a protected candidate root');
+  if(!HEX64.test(String(nonce??'')))throw new Error('UAC approval nonce invalid');
+  const basename=path.win32.basename(candidate);
+  if(!basename||basename==='.'||basename==='..')throw new Error('UAC candidate path invalid');
+  return path.win32.join(path.win32.dirname(candidate),`${basename}.r153-uac-approval-${nonce}.json`);
+}
+
+function time(value,label){
+  const ms=Date.parse(value);
+  if(typeof value!=='string'||!TIME.test(value)||!Number.isFinite(ms)||new Date(ms).toISOString()!==value)
+    throw new Error('UAC '+label+' invalid');
+  return ms;
+}
+export function validateApprovalWindow(issuedAt,expiresAt,now=new Date().toISOString()){
+  const issued=time(issuedAt,'issue time'),expires=time(expiresAt,'expiry time'),current=time(now,'current time');
+  if(expires<=issued||expires-issued>600_000)throw new Error('UAC consent lifetime invalid');
+  if(current<issued||current>=expires)throw new Error('UAC consent expired or not yet valid');
+}
+function windowsAbsolute(value,label){
+  if(typeof value!=='string'||!path.win32.isAbsolute(value)||!(/^[A-Za-z]:\\/.test(value))||value.includes('\0'))
+    throw new Error(`UAC ${label} path invalid`);
+  return path.win32.normalize(value).toLowerCase();
+}
+export function uacReceiptSubject(input){
+  const root=windowsAbsolute(input.stateRoot,'state root');
+  const candidate=windowsAbsolute(input.candidateRoot,'candidate root');
+  if(!candidate.startsWith('c:\\program files\\')||candidate==='c:\\program files\\')
+    throw new Error('UAC migration requires a protected candidate installation');
+  if(input.candidateVersion!=='0.15.59')throw new Error('UAC migration candidate identity unsupported');
+  const hashes=['candidateManifestSha256','tarballSha256','markerReceiptSha256','predecessorPointerSha256',
+    'preflightSubjectSha256','nodeSha256','deployScriptSha256','nonce'];
+  for(const key of hashes)if(!HEX64.test(String(input[key]??'')))throw new Error('UAC approval hash/nonce invalid: '+key);
+  const policies=input.predecessorPolicySha256;
+  if(!policies||typeof policies!=='object'||Array.isArray(policies)||
+      Object.keys(policies).length!==PLANES.length||PLANES.some(p=>!HEX64.test(String(policies[p]??''))))
+    throw new Error('UAC predecessor policy identity incomplete');
+  const issued=time(input.issuedAt,'issue time'),expires=time(input.expiresAt,'expiry time');
+  if(expires<=issued||expires-issued>600_000)throw new Error('UAC consent lifetime invalid');
+  return Object.freeze({schema:'deadbyte.r153-uac-approval.v1',action:'narrow_legacy_policy_and_activate',
+    state_root:root,candidate_root:candidate,candidate_version:input.candidateVersion,
+    candidate_manifest_sha256:input.candidateManifestSha256,tarball_sha256:input.tarballSha256,
+    marker_receipt_sha256:input.markerReceiptSha256,
+    predecessor_pointer_sha256:input.predecessorPointerSha256,
+    predecessor_policy_sha256:Object.freeze(Object.fromEntries(PLANES.map(p=>[p,policies[p]]))),
+    preflight_subject_sha256:input.preflightSubjectSha256,node_sha256:input.nodeSha256,
+    deploy_script_sha256:input.deployScriptSha256,nonce:input.nonce,
+    issued_at_utc:input.issuedAt,expires_at_utc:input.expiresAt,
+    allowed_authority_after:Object.freeze({...ALL_DISARMED})});
+}
+export function createUacApproval(input){
+  const subject=uacReceiptSubject(input);
+  return Object.freeze({...subject,subject_sha256:digest(subject)});
+}
+export function verifyUacApproval(receipt,input,{now=new Date().toISOString()}={}){
+  if(!receipt||typeof receipt!=='object'||Array.isArray(receipt)||
+      Object.keys(receipt).length!==FIELDS.length||FIELDS.some(f=>!Object.hasOwn(receipt,f)))
+    throw new Error('UAC approval receipt field shape invalid');
+  const expected=createUacApproval(input);
+  if(canonical(receipt)!==canonical(expected))throw new Error('UAC approval receipt binding mismatch');
+  validateApprovalWindow(expected.issued_at_utc,expected.expires_at_utc,now);
+  return receipt;
+}
+
+// UAC is forbidden unless R89 has positively attested the installed bytes and ACLs.
+// inspectTrustedInstallation may report a failure as data rather than throw.
+export function requireTrustedUacInstallation(result){
+  if(result?.trusted!==true){
+    const reason=typeof result?.reason==='string'?result.reason.slice(0,128):'unverified';
+    throw new Error('R89 protected installation trust required: '+reason);
+  }
+  return result;
+}

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.55';
+export const DEADBYTE_VERSION = '0.15.59';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/commander-protocol-r47.test.mjs

@@ -17,11 +17,16 @@ const execFileAsync=promisify(execFile);
 
 async function materializeTestHostPolicy(root){
   const policyPath=path.join(root,'deadbyte-host-policy.json');
+  // The policy initializer creates controller/runtime under CoreRoot. Keep that
+  // mutable fixture out of the immutable or protected installation tree.
+  const fixtureCore=path.join(root,'core');
+  await mkdir(path.join(fixtureCore,'src'),{recursive:true});
+  await writeFile(path.join(fixtureCore,'src','mcp-server.mjs'),'// test-only CoreRoot identity; never executed\n');
   const script=path.join(repoRoot,'scripts','init-host-policy.ps1');
   // Windows PowerShell must derive its own module path, not inherit incompatible
   // PowerShell 7 modules from the verifier's parent process.
   const env={...process.env};delete env.PSModulePath;
-  await execFileAsync('powershell.exe',['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',script,'-CoreRoot',repoRoot,'-BridgeRoot',repoRoot,'-PolicyPath',policyPath],{windowsHide:true,env});
+  await execFileAsync('powershell.exe',['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',script,'-CoreRoot',fixtureCore,'-BridgeRoot',repoRoot,'-PolicyPath',policyPath],{windowsHide:true,env});
   return policyPath;
 }
 

package/test/r130-release-security-contract.test.mjs

@@ -13,14 +13,15 @@ test('R130 security patch has a new immutable package identity and truthful sour
     read('SBOM.cdx.json'),read('package-lock.json'),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.55');
-  assert.equal(release.train,'R152');
-  assert.equal(matrix.train,'R146');
-  assert.equal(release.source_predecessor.version,'0.15.54');
-  assert.match(release.source_predecessor.source_path,/0\.15\.54/);
+    assert.equal(actual,'0.15.59');
+  assert.equal(release.train,'R153');
+  assert.equal(matrix.train,'R153');
+  assert.equal(release.source_predecessor.version,'0.15.58');
+  assert.match(release.source_predecessor.source_path,/0\.15\.58/);
   assert.equal(release.runtime_predecessor.version,'0.15.45');
-  assert.equal(provenance.source_predecessor_version,'0.15.54');
-  assert.equal(provenance.source_predecessor_manifest_file_sha256,'e87712aee4fdad8f450cce2351b87675aa1c112811f2aa8e363cbe808cd49b9f');
+  assert.equal(provenance.source_predecessor_tarball_sha256,'4bc53cfa6b3890b5749066cb507e8773b36d6c255192a8973dadb8546a39822e');
+  assert.equal(provenance.source_predecessor_version,'0.15.58');
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,'ec621a8a16f264f8824aa4644c914aca8f6ce57cb3578f5bce8acf2ac77fcc18');
   assert.equal(pkg.dependencies['@modelcontextprotocol/client'],'2.3.1');
   assert.equal(pkg.dependencies['@modelcontextprotocol/server'],'2.3.1');
   for(const dep of ['@modelcontextprotocol/client','@modelcontextprotocol/server'])

package/test/r132-release-identity.test.mjs

@@ -15,13 +15,14 @@ test('R144 package identities, R132 historic evidence and published predecessor
   for(const value of [pkg.version,lock.version,lock.packages[''].version,release.version,prov.version,bom.metadata.component.version,matrix.version,DEADBYTE_VERSION]){
     assert.equal(value,pkg.version);
   }
-  assert.equal(release.train,'R152');
-  assert.equal(matrix.train,'R146');
-  assert.equal(release.source_predecessor.version,'0.15.54');
-  assert.match(release.source_predecessor.source_path,/0\.15\.54/);
-  assert.equal(prov.source_predecessor_version,'0.15.54');
-  assert.equal(prov.source_predecessor_manifest_file_sha256,'e87712aee4fdad8f450cce2351b87675aa1c112811f2aa8e363cbe808cd49b9f');
-  assert.equal(prov.parent_tarball_sha256,'bedb4be86f4c22d4c98d661a08738d5ef51027a87240a1770c8cc0b0a4885081');
+  assert.equal(release.train,'R153');
+  assert.equal(matrix.train,'R153');
+  assert.equal(release.source_predecessor.version,'0.15.58');
+  assert.match(release.source_predecessor.source_path,/0\.15\.58/);
+  assert.equal(prov.source_predecessor_version,'0.15.58');
+  assert.equal(prov.source_predecessor_manifest_file_sha256,'ec621a8a16f264f8824aa4644c914aca8f6ce57cb3578f5bce8acf2ac77fcc18');
+  assert.equal(prov.parent_tarball_sha256,'4bc53cfa6b3890b5749066cb507e8773b36d6c255192a8973dadb8546a39822e');
+  assert.equal(prov.parent_registry_tarball_sha1,'04cc1a1e80bcb7062ac39eee6b7bab70edd5d8c3');
   assert.equal(release.runtime_predecessor.version,'0.15.45');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);
   assert.equal(prov.runtime_predecessor.manifest_sha256,release.runtime_predecessor.manifest_sha256);

package/test/r146-legacy-offline-policy-proof.test.mjs

@@ -6,6 +6,7 @@ import os from 'node:os';
 import path from 'node:path';
 import {proveLegacyOfflineScopeRepair} from '../src/legacy-offline-policy-proof-r146.mjs';
 import {canonicalJson} from '../src/canonical-json.mjs';
+import {createMarkerReconciliationReceipt} from '../src/clean-activation-recovery-r153.mjs';
 
 const sha=x=>createHash('sha256').update(x).digest('hex');
 const PLANES=['process','coding','autonomous','desktop','host'];
@@ -82,11 +83,18 @@ async function fixture({thirdDrive=false,badBinding=false}={}){
   const approval={...signed,subject,signature_base64:sign(null,Buffer.concat([APPROVAL_DOMAIN,Buffer.from(canonicalJson(signed),'utf8')]),privateKey).toString('base64')};
   const approvalPath=path.join(base,'approval.json'),approvalBytes=Buffer.from(JSON.stringify(approval));
   await writeFile(approvalPath,approvalBytes);
+  const markerSha256='d'.repeat(64);
+  const markerProofSha256=sha(Buffer.from(canonicalJson({pointer,policy_sha256:policySha256,
+    marker_sha256:markerSha256,
+    authority:Object.fromEntries(PLANES.map(plane=>[plane,false]))}),'utf8'));
+  const markerReceipt=createMarkerReconciliationReceipt({pointer,policySha256,
+    markerSha256,proofSha256:markerProofSha256,intentSha256:'f'.repeat(64),
+    observedAtUtc:'2026-10-23T00:00:00.000Z'});
   return {
     root:base,stateRoot,pointer,expectedParent:parent,observation,policyPaths,policySha256,
     runtime,policies,candidate,expectedCandidate:candidate,preflightSubjectSha256,
     approvalPath,approvalSha256:sha(approvalBytes),ownerPublicKeyPath,
-    now:new Date('2026-10-23T00:05:00.000Z'),async close(){await rm(base,{recursive:true,force:true});}
+    markerReceipt,now:new Date('2026-10-23T00:05:00.000Z'),async close(){await rm(base,{recursive:true,force:true});}
   };
 }
 const invoke=x=>proveLegacyOfflineScopeRepair(x);
@@ -103,6 +111,28 @@ test('R146 verifies exact inactive legacy scope only with manifest, direct grant
     assert.match(got.subject_sha256,/^[0-9a-f]{64}$/);
   }finally{await x.close();}
 });
+test('R153 elevated one-time migration proof narrows authority without an owner signing key',async()=>{
+  const x=await fixture();
+  try{
+    const got=await invoke({...x,approvalPath:null,approvalSha256:null,ownerPublicKeyPath:null,
+      uacAuthorization:{isElevated:true,nonce:'b'.repeat(64),issuedAt:'2026-10-23T00:00:00.000Z',
+        expiresAt:'2026-10-23T00:10:00.000Z',tarballSha256:'c'.repeat(64),markerReceipt:x.markerReceipt}});
+    assert.equal(got.state,'VERIFIED_OFFLINE_LEGACY_SCOPE_REPAIR');
+    assert.equal(got.migration_authorization_verified,true);
+    assert.equal(got.migration_authorization,'windows_uac_elevated');
+    assert.equal(got.owner_approval_verified,false);
+    assert.equal(got.owner_key_id,null);
+    assert.equal(got.owner_approval_subject_sha256,null);
+  }finally{await x.close();}
+});
+test('R153 non-elevated migration proof is rejected without falling back to owner approval',async()=>{
+  const x=await fixture();
+  try{
+    await assert.rejects(invoke({...x,approvalPath:null,approvalSha256:null,ownerPublicKeyPath:null,
+      uacAuthorization:{isElevated:false,nonce:'b'.repeat(64),issuedAt:'2026-10-23T00:00:00.000Z',
+        expiresAt:'2026-10-23T00:10:00.000Z',tarballSha256:'c'.repeat(64),markerReceipt:x.markerReceipt}}),/elevation/i);
+  }finally{await x.close();}
+});
 test('R146 proof rejects candidate or approval subject drift',async()=>{
   const x=await fixture();
   try{

package/test/r153-clean-activation-recovery.test.mjs

@@ -0,0 +1,213 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import {fileURLToPath} from 'node:url';
+import {createHash} from 'node:crypto';
+import {canonicalJson} from '../src/canonical-json.mjs';
+import {
+  classifyLegacyMigration,
+  createLegacyMigrationSubject,
+  authorizeElevatedLegacyMigration,
+  createMarkerReconciliationReceipt,
+  verifyMarkerReconciliationReceipt,
+  reconcileStaleMarker,
+  resumeMarkerReconciliation,
+  recoverPublishedMarkerTerminal,
+  verifyNarrowedPolicyGeneration,
+  runRemoteStartupSequence,claimWithOneTimeMigration
+} from '../src/clean-activation-recovery-r153.mjs';
+
+const HEX='a'.repeat(64);
+const planes=['process','coding','autonomous','desktop','host'];
+const base=()=>({
+  stateRoot:'C:\\Users\\owner\\.deadbyte-mcp',
+  pointer:{release_id:'v0.15.45-parent',version:'0.15.45',manifest_sha256:'1'.repeat(64),generation_manifest_sha256:'2'.repeat(64)},
+  candidate:{version:'0.15.59',manifest_sha256:'3'.repeat(64),tarball_sha256:'4'.repeat(64)},
+  observation:{state:'OFFLINE',local_ready:false,bridge:{alive:false},core:{alive:false},cloud:{alive:false},supervisor:{running:false},
+    authority:Object.fromEntries(planes.map(plane=>[plane,{configured:true,armed:false,reason:plane==='autonomous'?'unverified':'disarmed'}]))},
+  policySha256:Object.fromEntries(planes.map((plane,index)=>[plane,String(index+5).repeat(64)])),
+  grantPresence:Object.fromEntries(planes.map(plane=>[plane,false])),
+  codingRootPaths:['C:\\','D:\\','D:\\Projects\\deadbyte-mcp'],
+  marker:{sha256:HEX,owner_live:false,guardian_live:false}
+});
+
+test('R153 RED: exact offline legacy broad-root state requires one-time narrowing consent',()=>{
+  const result=classifyLegacyMigration(base());
+  assert.equal(result.state,'MIGRATION_CONSENT_REQUIRED');
+  assert.equal(result.safe_to_migrate,true);
+  assert.match(result.subject_sha256,/^[0-9a-f]{64}$/);
+});
+
+test('R153 RED: migration never proceeds with a grant, live runtime, live owner, or non-narrowing candidate',()=>{
+  const grant=base();grant.grantPresence.coding=true;
+  assert.equal(classifyLegacyMigration(grant).safe_to_migrate,false);
+  const online=base();online.observation.state='ONLINE';
+  assert.equal(classifyLegacyMigration(online).safe_to_migrate,false);
+  const live=base();live.marker.owner_live=true;
+  assert.equal(classifyLegacyMigration(live).safe_to_migrate,false);
+  const noLegacy=base();noLegacy.codingRootPaths=['D:\\Projects\\deadbyte-mcp'];
+  assert.equal(classifyLegacyMigration(noLegacy).safe_to_migrate,false);
+});
+
+test('R153 RED: UAC subject binds candidate, predecessor, policy, marker, state root, nonce, and expiry',()=>{
+  const classified=classifyLegacyMigration(base());
+  const subject=createLegacyMigrationSubject({...base(),classification:classified,nonce:'b'.repeat(64),
+    issuedAt:'2026-10-23T16:00:00.000Z',expiresAt:'2026-10-23T16:10:00.000Z'});
+  assert.equal(subject.action,'narrow_legacy_policy_and_activate');
+  assert.equal(subject.marker_sha256,HEX);
+  assert.equal(subject.candidate.version,'0.15.59');
+  assert.equal(subject.nonce,'b'.repeat(64));
+  assert.deepEqual(subject.allowed_authority_after,Object.fromEntries(planes.map(plane=>[plane,false])));
+});
+
+test('R153 RED: UAC authorization is accepted only from an elevated process and cannot carry authority',()=>{
+  const input=base(),classification=classifyLegacyMigration(input);
+  const subject=createLegacyMigrationSubject({...input,classification,nonce:'b'.repeat(64),
+    issuedAt:'2026-10-23T16:00:00.000Z',expiresAt:'2026-10-23T16:10:00.000Z'});
+  assert.equal(authorizeElevatedLegacyMigration({subject,isElevated:true,now:new Date('2026-10-23T16:05:00.000Z')}).state,'MIGRATION_APPROVED');
+  assert.throws(()=>authorizeElevatedLegacyMigration({subject,isElevated:false,now:new Date('2026-10-23T16:05:00.000Z')}),/elevation/i);
+  assert.throws(()=>authorizeElevatedLegacyMigration({subject:{...subject,allowed_authority_after:{...subject.allowed_authority_after,coding:true}},isElevated:true,now:new Date('2026-10-23T16:05:00.000Z')}),/authority/i);
+});
+
+test('R153 RED: remote synchronization happens before a foreground marker is claimed',async()=>{
+  const calls=[];
+  await runRemoteStartupSequence({
+    recover:async()=>calls.push('recover'),
+    synchronize:async()=>calls.push('synchronize'),
+    claim:async()=>{calls.push('claim');return {id:'marker'};},
+    start:async()=>calls.push('start')
+  });
+  assert.deepEqual(calls,['recover','synchronize','claim','start']);
+});
+
+test('R153 RED: stale marker deletion is content-CAS and requires complete offline/grant proof',async()=>{
+  const input=base();let deleted=false;
+  const evidence={publishIntent:async()=>({sha256:'b'.repeat(64)}),
+    publishTerminal:async()=>({sha256:'c'.repeat(64)}),revalidate:async()=>{}};
+  const result=await reconcileStaleMarker({...input,...evidence,deleteIfHash:async sha=>{assert.equal(sha,HEX);deleted=true;return 'REMOVED';}});
+  assert.equal(result.state,'MARKER_RECONCILED');
+  assert.equal(deleted,true);
+  await assert.rejects(reconcileStaleMarker({...input,...evidence,deleteIfHash:async()=> 'CHANGED'}),/changed/i);
+  await assert.rejects(reconcileStaleMarker({...input,...evidence,deleteIfHash:async()=> 'MISSING'}),/did not remove observed marker/i);
+});
+
+test('R153 RED: UAC migration consumes a subject-bound terminal marker reconciliation receipt',()=>{
+  const input=base();
+  const proofSha256=createHash('sha256').update(canonicalJson({
+    pointer:input.pointer,policy_sha256:input.policySha256,marker_sha256:HEX,
+    authority:Object.fromEntries(planes.map(plane=>[plane,false]))
+  })).digest('hex');
+  const receipt=createMarkerReconciliationReceipt({
+    pointer:input.pointer,policySha256:input.policySha256,markerSha256:HEX,
+    proofSha256,intentSha256:'e'.repeat(64),observedAtUtc:'2026-10-23T16:00:00.000Z'
+  });
+  assert.equal(receipt.schema,'deadbyte.r153-marker-reconciliation.v1');
+  assert.equal(receipt.state,'MARKER_RECONCILED');
+  assert.equal(receipt.marker_sha256,HEX);
+  assert.match(receipt.subject_sha256,/^[0-9a-f]{64}$/);
+  assert.equal(verifyMarkerReconciliationReceipt(receipt,{pointer:input.pointer,
+    policySha256:input.policySha256,markerSha256:HEX}),receipt.subject_sha256);
+  assert.throws(()=>verifyMarkerReconciliationReceipt({...receipt,proof_sha256:'c'.repeat(64)},
+    {pointer:input.pointer,policySha256:input.policySha256,markerSha256:HEX}),/proof binding/i);
+  assert.throws(()=>verifyMarkerReconciliationReceipt({...receipt,marker_sha256:'d'.repeat(64)},
+    {pointer:input.pointer,policySha256:input.policySha256,markerSha256:HEX}),/marker/i);
+});
+
+test('R153: dry preflight does not consume a one-time approval; activation claim does',async()=>{
+  const events=[];
+  const held=await claimWithOneTimeMigration({subjectSha256:HEX,
+    claim:async value=>{assert.equal(value,HEX);events.push('claim');return {operation_id:'c'.repeat(32),release:async()=>events.push('release')};},
+    consume:async()=>events.push('consume')});
+  assert.deepEqual(events,['claim','consume']);
+  await held.release();
+  assert.deepEqual(events,['claim','consume','release']);
+});
+
+test('R153: failed or replayed nonce aborts the operation and releases the exact claim',async()=>{
+  const events=[];
+  await assert.rejects(claimWithOneTimeMigration({subjectSha256:HEX,
+    claim:async()=>({operation_id:'c'.repeat(32),release:async()=>events.push('release')}),
+    consume:async()=>{events.push('consume');throw Object.assign(new Error('replay'),{code:'EEXIST'});}
+  }),/replay/);
+  assert.deepEqual(events,['consume','release']);
+});
+
+test('R153 RED: an intent survives owner crash after marker deletion and completes exactly once',async()=>{
+  const input=base();
+  const proofSha256=createHash('sha256').update(canonicalJson({
+    pointer:input.pointer,policy_sha256:input.policySha256,marker_sha256:HEX,
+    authority:Object.fromEntries(planes.map(plane=>[plane,false]))
+  })).digest('hex');
+  const intent={schema:'deadbyte.r153-marker-reconciliation-intent.v1',
+    state:'RECONCILIATION_CLAIMED',predecessor:input.pointer,
+    predecessor_policy_sha256:input.policySha256,marker_sha256:HEX,
+    proof_sha256:proofSha256,authority:Object.fromEntries(planes.map(plane=>[plane,false]))};
+  intent.subject_sha256=createHash('sha256').update(canonicalJson({predecessor:intent.predecessor,
+    predecessor_policy_sha256:intent.predecessor_policy_sha256,marker_sha256:intent.marker_sha256,
+    proof_sha256:intent.proof_sha256,authority:intent.authority})).digest('hex');
+  let publications=0;
+  const result=await resumeMarkerReconciliation({...input,intent,intentSha256:'f'.repeat(64),markerPresent:false,
+    publishTerminal:async receipt=>{publications+=1;assert.equal(receipt.intent_sha256,'f'.repeat(64));return {sha256:'c'.repeat(64)};}});
+  assert.equal(result.state,'MARKER_RECONCILED');
+  assert.equal(result.marker_sha256,HEX);
+  assert.equal(publications,1);
+  await assert.rejects(resumeMarkerReconciliation({...input,intent,intentSha256:'f'.repeat(64),markerPresent:true,
+    publishTerminal:async()=>({sha256:'c'.repeat(64)})}),/marker.*present/i);
+  await assert.rejects(resumeMarkerReconciliation({...input,intent:{...intent,proof_sha256:'0'.repeat(64)},
+    intentSha256:'f'.repeat(64),markerPresent:false,publishTerminal:async()=>({sha256:'c'.repeat(64)})}),/proof|intent/i);
+});
+
+test('R153 RED: a published terminal survives crash before locator publication',()=>{
+  const input=base();
+  const proofSha256=createHash('sha256').update(canonicalJson({pointer:input.pointer,
+    policy_sha256:input.policySha256,marker_sha256:HEX,
+    authority:Object.fromEntries(planes.map(plane=>[plane,false]))})).digest('hex');
+  const intent={schema:'deadbyte.r153-marker-reconciliation-intent.v1',state:'RECONCILIATION_CLAIMED',
+    predecessor:input.pointer,predecessor_policy_sha256:input.policySha256,marker_sha256:HEX,
+    proof_sha256:proofSha256,authority:Object.fromEntries(planes.map(plane=>[plane,false]))};
+  intent.subject_sha256=createHash('sha256').update(canonicalJson({predecessor:intent.predecessor,
+    predecessor_policy_sha256:intent.predecessor_policy_sha256,marker_sha256:HEX,
+    proof_sha256:proofSha256,authority:intent.authority})).digest('hex');
+  const intentSha256='f'.repeat(64);
+  const terminal=createMarkerReconciliationReceipt({pointer:input.pointer,policySha256:input.policySha256,
+    markerSha256:HEX,proofSha256,intentSha256,observedAtUtc:'2026-10-24T01:00:00.000Z'});
+  const result=recoverPublishedMarkerTerminal({...input,intent,intentSha256,terminal,
+    terminalSha256:'c'.repeat(64),markerPresent:false});
+  assert.equal(result.receipt_sha256,'c'.repeat(64));
+  assert.equal(result.state,'MARKER_RECONCILED');
+  assert.throws(()=>recoverPublishedMarkerTerminal({...input,intent,intentSha256,terminal,
+    terminalSha256:'c'.repeat(64),markerPresent:true}),/marker.*present/i);
+  assert.throws(()=>recoverPublishedMarkerTerminal({...input,intent,intentSha256:'0'.repeat(64),terminal,
+    terminalSha256:'c'.repeat(64),markerPresent:false}),/intent/i);
+});
+
+test('R153 RED: UAC activation accepts only a scoped Coding generation bound to Autonomous',()=>{
+  const coding={schema:'deadbyte.coding-policy.v1',roots:{core:{path:'D:\\Projects\\deadbyte-mcp',read:true,write:true}}};
+  const codingBytes=Buffer.from(JSON.stringify(coding)+'\n');
+  const autonomous={schema:'deadbyte.autonomous-policy.v1',coding_policy_sha256:createHash('sha256').update(codingBytes).digest('hex')};
+  assert.equal(verifyNarrowedPolicyGeneration({codingPolicy:coding,codingPolicyBytes:codingBytes,autonomousPolicy:autonomous}).coding_policy_sha256,
+    autonomous.coding_policy_sha256);
+  assert.throws(()=>verifyNarrowedPolicyGeneration({codingPolicy:{...coding,roots:{...coding.roots,local_c:{path:'C:\\'}}},
+    codingPolicyBytes:codingBytes,autonomousPolicy:autonomous}),/whole-drive/i);
+  assert.throws(()=>verifyNarrowedPolicyGeneration({codingPolicy:coding,codingPolicyBytes:codingBytes,
+    autonomousPolicy:{...autonomous,coding_policy_sha256:'0'.repeat(64)}}),/digest/i);
+});
+
+test('R153: generated policy narrowing is proven before an active pointer can be constructed',()=>{
+  const source=readFileSync(fileURLToPath(new URL('../src/runtime-update.mjs',import.meta.url)),'utf8');
+  const generation=source.indexOf('const generation=await createGenerationBundle');
+  const narrowing=source.indexOf('verifyNarrowedPolicyGeneration({',generation);
+  const pointer=source.indexOf('newPointer={schema:',generation);
+  assert.ok(generation>=0&&narrowing>generation&&pointer>narrowing,
+    'narrowing must reject the prepared generation before pointer construction or handoff');
+});
+
+test('R153: only detached activation dispatch can create an unknown mutation outcome',()=>{
+  const source=readFileSync(fileURLToPath(new URL('../src/runtime-update.mjs',import.meta.url)),'utf8');
+  const handoff=source.indexOf('const handoff=await writeHandoff');
+  const boundary=source.indexOf('activationDispatchBegan=true',handoff);
+  const spawn=source.indexOf('await spawnDetachedSupervisor',boundary);
+  const failure=source.indexOf("result:activationDispatchBegan?'MUTATION_OUTCOME_REQUIRES_RECONCILIATION'",spawn);
+  assert.ok(handoff>=0&&boundary>handoff&&spawn>boundary&&failure>spawn);
+  assert.doesNotMatch(source,/result:mutationBegan\?'MUTATION_OUTCOME_REQUIRES_RECONCILIATION'/);
+});