deadbyte-mcp 0.15.58 → 0.15.59

package/MANIFEST.SHA256

@@ -30,7 +30,7 @@ c814771dddac8bfb184250b868ddb6ab9f5e0e43613c04c3ed8abe09324ec4db  bin/deadbyte-n
 daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4  bin/deadbyte-process-host.exe
 b55d2c4490dfb875d40f29a69df2addc5d579991cb7d094674c04d369dfcfac3  bin/deadbyte-tunnel-host.exe
 f0ce7acb1e41325cef8b6789f95bd78b6a6107423773eace57a12b49faa55095  bin/WORKER-REGISTRY.txt
-b9c0d2f856a61060cfa7353f7421c8635c567ba1cf3362592d947dbf261c1261  bridge/package.json
+8ea4e87d8cea0dba53c13dd30077936155d437e45cf593f71cd4f3610f9b8516  bridge/package.json
 f99413d82f84c808f52d5b8696c190a9142dd08f517f5ec3e442f0769402d189  bridge/src/bridge-health-r59.mjs
 fa0dcc4cde9c03e978c9f9dd24b62afa83f49bdada1f42ead544a9a17edd332f  bridge/src/bridge.mjs
 471f41c84c5b339cd81a708a4f36d4470e614946817ad2f9fca295dde2c83fb6  bridge/src/canonical-json-r60.mjs
@@ -1393,8 +1393,8 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-c0fae04895112612f30d7b73ca23eb799589dfd0c5a75e6fe0699322ab6825f4  package.json
-120664572ba2a95dd4d0c9e608507c7683bd80130bf2500f59289dee96020edc  PROVENANCE.json
+ece225d6a1c9a60ab260762428a5d06c77e38b431dad95c90e5fb0aa349a9699  package.json
+08ad6734ec8cbcda2c1d98957201553f6252902f454f0b5b577bb4ce8dbff8ec  PROVENANCE.json
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
 0b7ec5ee347ddfa6cca59740fc7a8fe3fc5d51406265bb12189e82fa106319d2  R41-PARENT.json
 bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.json
@@ -1403,9 +1403,9 @@ f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.jso
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
 3dc607603fea511e2f428e9546a875ab7e38b6a0bbd5e803e4510de082f30804  R49-PARENT.json
-43d0301f4139db8f1d6b60e09bc747fd309ea77ba65f5f60d9876f5d6ba561bf  README.txt
-3de667d48b6056e84bfa046170c80371ae1c9ff81bef969cad21af5292078052  RELEASE.json
-a5bf1a4cc26610ac6b98e34c8a05cecda72614d2d784615d09ef7e86766ed690  SBOM.cdx.json
+2f5d490e1c17b2c2cd1cd3d2ab7842e772c145ea570cf640af728ee4f269d7c9  README.txt
+f54e1bd692def7c884ca276dc2a954ca7a7acc752f64b9bbb2c99ed1ca00580b  RELEASE.json
+bb45b4a1b2e2784388be32b334c519c535902312c2a13b3856254e6632652208  SBOM.cdx.json
 7c86062c4f69db3179a129d65945ccfab1b1c1c5bcc29b91383eac097d50f2aa  scripts/activate-skill-creator-1.1.1.mjs
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
@@ -1413,7 +1413,7 @@ bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-
 34f9318b6f4afb29948fdc5ab973edca4dfc4fbd63c9a5105478b5e95812dabf  scripts/autonomous-build.ps1
 075acd7616740135973497d676dcd0431f0437bdba87e4eedba4751cb148ff02  scripts/autonomous-tests.ps1
 f43c5e5064fb5863ce51aca156434d8b7c493ee954b8846f41625cd7130936d8  scripts/benchmark-l0-r71.mjs
-a5da0c4bf9063b4e091b44b5b88020c2199594e12da22001350837746ddb19ea  scripts/bootstrap-uac-migration-r153.ps1
+deb0a47edfa72a17036c1a0a45b88f63405e009452120d673bfe008dc1b6d835  scripts/bootstrap-uac-migration-r153.ps1
 5d8ce87ffbe55f4737ba1ee2fa6772a8157bfa92afec9101909c0f9bead27fcb  scripts/bridge-benchmark-r58.mjs
 7c3f2a157f64aef9e605b5fe84d75fbdd88312f09d0ad89effb33de82aa39ab8  scripts/build-advanced-pcb-skill.mjs
 70bccc3572de7e26ac91154b9d87185feab0c2dbfc4cbd40f89660e5769f53b0  scripts/build-combined-skill.mjs
@@ -1530,7 +1530,7 @@ a9d10a04324cceafafa7edc1501e8e1f8a1ae4a094d0985c8309472512529d30  scripts/gate-w
 1a771b5b8a62d57f26762d53472ed68a3e733674b1c91e08becf0dc2e4325039  scripts/inspect-active-release-r45.mjs
 de6142bd5693cf4edb8725c9c43fc77e9bdc12f5b398a757006d778d3ee3f8ed  scripts/inspect-r46-active.mjs
 06425d2a4004cb0ad66383c10c30aaa91bb020be2926bc76f9681a8f0827ddfc  scripts/inventory-reference-dist.mjs
-c4061b8ef68c9c842b9314640eeb41afa2313ae106687a36c3e4b99620f5b574  scripts/issue-uac-migration-r153.mjs
+4b1ce879a1c3076629d2d13cd0d30764f58b9701c57104020d7a52aa99a1481d  scripts/issue-uac-migration-r153.mjs
 7ea8cf6bf094a1612603bc716228a3753e5f06fca8a0684d2da15a04d0710c64  scripts/list-source-zips.mjs
 4326526cbff265bb8ec2d38af1825b0bac227e3506437fff6e13f9cdb20dab33  scripts/npm-artifact-identity-r61.mjs
 2598a67b08caaef2ff75fc52eca1e268c83b79c50048202e318904952379aa4a  scripts/npm-prepublish-contract-r74.mjs
@@ -1561,7 +1561,7 @@ f682cb041e9dec3e4e99c87e9650e35c9f10d51cba458ec7040bbedc8b22f987  scripts/perfor
 6767992de09ed6f95f74a14b743bb5e5660fa63cbd2d5a6cdc2a14be3531c8cc  scripts/promote-local-d-generation.ps1
 c4e081f95bc82e45a06993c34d47f10083640e794e2e3ccc26933fcf597b0c50  scripts/public-baseline-r58.mjs
 615c670581ee3e8a30095c0af63c24edbec01db74c7370069e1a486c53989968  scripts/public-surface-r58.mjs
-74e5162331f1d971a9604241eb64e84ffdf2187636c7ea14341c5e2c4f9fd5bc  scripts/r153-prepublish-identity.mjs
+1f1bf8d98f7ab270cf390e21b2fce199fcb157ceb436755273241d436de0596e  scripts/r153-prepublish-identity.mjs
 e19a1d591ccd07af2e87d930ce23b0cc9b814bc2a395408045543847154097d7  scripts/r40-compact-ledger-probe.mjs
 68b9a60aca3f3e3e9ec239710f8368594ef3c8a98fff0816d2e9a7950df48287  scripts/r47-core-failures.mjs
 75f821cc44f8c31f67de0b28b64021d9fb160984a597e704b29c33f9f3a41dde  scripts/r47-syntax-check.mjs
@@ -1713,7 +1713,7 @@ da5181cec30034ddf089baa5358becb5651da238a2e7cf0888007a4c60b4ea6b  src/capability
 8348e01ec8dcd3171dab02399a2aa48cf09db2d283da25bfdde721a5c3f44b03  src/capability-ledger.mjs
 dd84aab65c73906037390b07f1d9e3e118511b21145e8ba914f98d6f2a153baf  src/capability-resolver.mjs
 b3a669da30bf2d99cd5a912bdacb234b66c90215183a2aeeb3c01c91f1a55c64  src/capability-snapshot.mjs
-ad7a77b7179d98f1640cf5edbf5de5029acb20693f0b463f87984f304f655983  src/clean-activation-recovery-r153.mjs
+2c065a1d1d6b9e720073250e3e51db4d4b5b43b7e7276de370f04795a1fffb47  src/clean-activation-recovery-r153.mjs
 94e5aeff2453cdc0239aee4d547dbbefee183c71933cb84e5e8a418fa99bc1e8  src/codex-app-server-r44.mjs
 c4e07aa6818cd989c43ce8d027dc7d467e05c8e2fe96b5548eea291285d3bbb1  src/coding-mcp-tools.mjs
 059b4bef2ae6a6c2d7a706c463bea6e49d364faeb619372a429ba36c53004ab7  src/coding-output-contracts.mjs
@@ -1890,16 +1890,16 @@ bac271c6f5218752ac5ff4decf5249e3893ddb35c63c092ce17238c27fc4d35b  src/trust-init
 4d934281a72922fabde7d6e988655a6d095eb3a89abf12e9b99fecc3046e3d62  src/trust.mjs
 c99c2402fb0df4f68634fa906eb198c551c55dad9f0921a7b8ed6e33d503884e  src/tunnel-stdio-compat-smoke.mjs
 aa765e9a28c69ff58a5b5a0d29b49ea181af4db9076633b102dbca25861e708e  src/tunnel-stdio-compat.mjs
-255ca6a60fef007d727fd22f653e8f917ed52db6a9ff38aea8fd5271446b15b6  src/uac-approval-contract-r153.mjs
+866f61da7296f9a97e0cd6361c3d0cd19213ac5e3cd55c450047f35695074f86  src/uac-approval-contract-r153.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-34506357807eaa868eb29463762f9d6dacdefde1c95bd3e0143a4748d54c34dd  src/version.mjs
+d3a013dc7456463ba443661428c8d09ba099d2a40501b0478fc3f3fbcf905527  src/version.mjs
 acf5f5a57779bc0529f9db3d821f0ef1b53d22063aa237041348c1ca444ea677  src/windows-powershell-environment.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs
 1bd637e7634ca0259791c5108fcf324554f70b1db49e5eac3505287c04bbc3be  STABILIZATION-PROGRESS.md
-1eb98859f9b9c06197c29ca31bcc088f60bed69adb8f46115b081230f2716a7f  TEST-MATRIX.json
+b5449638038a56ca4e34963ca526439a6308cc6e4f2834ef016a2de2116ec422  TEST-MATRIX.json
 e4f1fb97545f23772ddff28ad3f9954a4714f9854062fca62e0e12c1cb2ec4ae  test/agent-backend-r44.test.mjs
 2a78c818058b25efdc143a3a97c832da231ccd6ff9d90c7796d681a0251b85c4  test/agent-crash-child.mjs
 d9461ab7c118ee75d37a2d6f5e637d7e43505af6a9ad8c7ddafffc8ace185a5b  test/agent-crash-worker.mjs
@@ -2153,9 +2153,9 @@ ce163ee9f288e30a213636e2267b8630016ef8a170f12286e8cdd44219bdab32  test/r124-live
 17475b51e416ae678f959f8975fab8497eb7c57d13e36cac8656c0e1f7424c0c  test/r126-restore-policy-envelope.test.mjs
 1721d4bd3bb58c10ad9d86b69ad1d993ec5a1e6315c95b28fa50ab67d4ca302a  test/r127-restore-append-policy-boundary.test.mjs
 b3d3dda398c94d18e2e156bde65d1338000233407b435134ba0c16175d96620b  test/r129-sdk-security-baseline.test.mjs
-c219428ae92bf75d0a5101ada579bfaedfca16da91ff86f5621802056a10e684  test/r130-release-security-contract.test.mjs
+772b9c88cd1d2bbcdbbe3e4f671526315edbeb889f67981d9ec158ce9162124d  test/r130-release-security-contract.test.mjs
 bb7963baf412ec0f5aca183f6dd98eda9026fe763017f9af595581b521ae6cb7  test/r131-installed-manifest-boundary.test.mjs
-6e0bdb24f8f704822ca5767bf344386560adcc09c9fc4ce778b04b5edf0f7835  test/r132-release-identity.test.mjs
+fed899734017d1ff871c43b4ece957422bbfb94b4aeabbebc6548cf6f17e1345  test/r132-release-identity.test.mjs
 acd236a4d8ba035007bde4166a521b8d4e6044f58c52c0bae9cb42fa75338533  test/r135-autonomous-scope.test.mjs
 3fcf657aae1f8466abc5ab82bb5a619966ea9b8a33d4a95a5a5246df5bf3afa1  test/r136-scoped-command-rights.test.mjs
 e0c466f25b35eb894166df792b71b23924610d32363756c75ff437dfdaa12a4c  test/r136-scoped-observer.test.mjs
@@ -2178,12 +2178,13 @@ ef0665adaab2a2b2d6ca8611a6335ded96b8e65a9661840acd139d3c86710e62  test/r144-cont
 b92f914455cac010b1468cd37a31651e7d423571d0edfeb29829d2281073e1e3  test/r146-legacy-offline-policy-proof.test.mjs
 32f40b649033172384267bbe8f6009dededcba81afff1e3ca51331407197fe3b  test/r146-livelog-backpressure.test.mjs
 77b3bfcd6fa04e21c7a04206181f7b4cbd5321f799a145859d8e84d0b984d174  test/r147-remote-request-hash.test.mjs
-1a51c946190de4a9ed2adee709f26063e3e769081211a61d3547c0805056cffc  test/r153-clean-activation-recovery.test.mjs
+ef36f10e2da43b720b8681550f95f5f1af4f1059d233122ed04861ecb3194d1a  test/r153-clean-activation-recovery.test.mjs
 b1c9d788a607e579d18a1be36e0837dcc34b343bb53d55f9fb51c202af13bacd  test/r153-prepublish-identity.test.mjs
 ce37fc59761ceddf43fd3844b34d57f64f1c8d191ca1d6cba13b643a5e2c02ce  test/r153-restricted-reused-pid.test.mjs
-7d5c668aa9eecd944247b389851ab7a107e70cb3b40a8766bf4a093daf5ab517  test/r153-uac-approval-contract.test.mjs
+3c8d2110e869d4a6f125c9a4978c049f54424893f2317312448813ba0f19860f  test/r153-staging-leaf-acl.test.mjs
+4a77ad57c5f06f9740fe42dcceda49047c39466d040dc1965cc311996e4c54d3  test/r153-uac-approval-contract.test.mjs
 3d6a76df732eaa52b7409aa26c933f9e4d8316b64ded5cfad4202fea51b74fcd  test/r153-uac-installed-manifest-contract.test.mjs
-7ca4dd229e86d5882c0143d6bbc711367fc5230e490b77c400b679acb8bdccf6  test/r153-uac-launch-parameter-contract.test.mjs
+f75d97eaa6c7b83550eab4f1278958942b53ae25706156fe4f3cc67c242bf77b  test/r153-uac-launch-parameter-contract.test.mjs
 3c5c3724bce89aa1fa59fe97cc346c40a5674bb5cd6dc3e2f31b86f2d62e75e4  test/r33-closeout-regression.test.mjs
 5e3700ee610442dfd7b7ae5e380263f231438be0e32790597142c41362a53c9a  test/r33-finalization.test.mjs
 7e419d3c1caf79bfc7407207f50e5645298f9b19d91a7d6f595af185b92cd55e  test/r36-finalization.test.mjs
@@ -2249,7 +2250,7 @@ ca8e23abc89f3eadeceb4b6fdad2cb4db5a7933029ece8e8beae2c6a158876b7  test/r58-owner
 8fc5ed1d3088facf45f9578d9ff8514c3a633f7f342d15eec316e129e7a916c0  test/r58-stale-owner.test.mjs
 84be7ee7d167eb06c9f9fc178930daaa81e53a91de40bad6d7df2060bd3dd165  test/r58-windows-gate.test.mjs
 76db2a4009d76b86e1da57b91a96b0d6bfeb4063bec3301ede736e2fd5832f39  test/r59-release-contract.test.mjs
-c88615a9f41a545515a5fce79fc590e5cffedab378ab5e408d339c50a8ba99fc  test/r59-tool-surface-compat.test.mjs
+4547f13cc32fa1316fdce26086783e0c91dd48d8170fbe956cb5352a0fd2f3ad  test/r59-tool-surface-compat.test.mjs
 3befd5d4dc4d8ca9e1f6cbeb9c430671e676c5696d6ee5931c2cbe3244c558a4  test/r60-authority-coherence.test.mjs
 60577e231c7d164f57a3960c574d3e369ca140d9dbc477b2444fa62dbf224e51  test/r60-authority-enforcement.test.mjs
 a1fa0b1e529da05f3659a33be6d36dab02f93808638cf0f458d057e9c6d1e35b  test/r60-bridge-dispatch.test.mjs

package/PROVENANCE.json

@@ -1,9 +1,9 @@
 {
   "schema": "deadbyte.provenance.v1",
-  "version": "0.15.58",
-  "source_model": "published 0.15.55 tarball -> isolated R153 clean activation recovery successor",
+  "version": "0.15.59",
+  "source_model": "published 0.15.58 tarball -> isolated R153 clean activation recovery successor",
   "signing": "ed25519",
-  "parent_tarball_sha256": "dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760",
+  "parent_tarball_sha256": "4bc53cfa6b3890b5749066cb507e8773b36d6c255192a8973dadb8546a39822e",
   "parent_activation_status": "PRODUCTION_ACTIVE",
   "parent_rollback_receipt_sha256": null,
   "runtime_predecessor": {
@@ -11,8 +11,8 @@
     "manifest_sha256": "34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc",
     "generation_manifest_sha256": "ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4"
   },
-  "source_predecessor_manifest_file_sha256": "96e243c87ac01a6769643179201ac3ca3dc900d1d72f71fbf272a853846a4891",
-  "reproducibility": "R153 isolated successor of published 0.15.55 tarball SHA-256 dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760; production runtime 0.15.45 remains immutable until exact candidate gates pass; legacy migration is one-time Windows UAC, marker-bound, and may only narrow policy while retaining all authority disarmed",
+  "source_predecessor_manifest_file_sha256": "ec621a8a16f264f8824aa4644c914aca8f6ce57cb3578f5bce8acf2ac77fcc18",
+  "reproducibility": "R153 isolated successor of published 0.15.58 tarball SHA-256 4bc53cfa6b3890b5749066cb507e8773b36d6c255192a8973dadb8546a39822e; production runtime 0.15.45 remains immutable until exact candidate gates pass; legacy migration is one-time Windows UAC, marker-bound, and may only narrow policy while retaining all authority disarmed",
   "public_surface_evidence": {
     "status": "PASS",
     "baseline_release": "v0.15.35-1b5715b276facbc0",
@@ -80,8 +80,8 @@
   "parent_release_id": "v0.15.45-34aa8d1241cfb8bf",
   "parent_manifest_sha256": "34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc",
   "parent_generation_manifest_sha256": "ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4",
-  "source_predecessor_version": "0.15.55",
-  "source_predecessor_tarball_sha256": "dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760",
+  "source_predecessor_version": "0.15.58",
+  "source_predecessor_tarball_sha256": "4bc53cfa6b3890b5749066cb507e8773b36d6c255192a8973dadb8546a39822e",
   "operator_override": {
     "four_hour_soak": "WAIVED_BY_OPERATOR",
     "clean_machine": "WAIVED_BY_OPERATOR",
@@ -125,7 +125,7 @@
     "package_registry_activation_rollback_restore": "PENDING",
     "stable_final_claim": false
   },
-  "parent_registry_tarball_sha1": "6a51d2253b3bf594fda5b7b52a3aafa9ef9d04fb",
+  "parent_registry_tarball_sha1": "04cc1a1e80bcb7062ac39eee6b7bab70edd5d8c3",
   "r62": {
     "transaction_inventory_default_max_entries": 1024,
     "parent_state_records_observed": 341,

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.15.58 / R153 CLEAN ACTIVATION RECOVERY
+DEADBYTE MCP V0.15.59 / R153 CLEAN ACTIVATION RECOVERY
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -16,12 +16,12 @@ check `--version` before issuing a stateful command. The compatibility CMD
 fails with an explanation when npm is detected rather than forwarding the
 wrong command to the controller.
 
-  npx -y deadbyte-mcp@0.15.58 mcp
-  npx -y deadbyte-mcp@0.15.58 remote
-  npx -y deadbyte-mcp@0.15.58 remote status
-  npx -y deadbyte-mcp@0.15.58 remote restart
-  npx -y deadbyte-mcp@0.15.58 audit status
-  npx -y deadbyte-mcp@0.15.58 audit verify
+  npx -y deadbyte-mcp@0.15.59 mcp
+  npx -y deadbyte-mcp@0.15.59 remote
+  npx -y deadbyte-mcp@0.15.59 remote status
+  npx -y deadbyte-mcp@0.15.59 remote restart
+  npx -y deadbyte-mcp@0.15.59 audit status
+  npx -y deadbyte-mcp@0.15.59 audit verify
 
 MAJOR MCP CLIENT STDIO CONFIGS
 -------------------------------
@@ -32,7 +32,7 @@ CLAUDE DESKTOP
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.59", "mcp"]
       }
     }
   }
@@ -44,7 +44,7 @@ Save as .cursor/mcp.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.59", "mcp"]
       }
     }
   }
@@ -57,7 +57,7 @@ Save as .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.59", "mcp"]
       }
     }
   }
@@ -67,7 +67,7 @@ Add to the Codex MCP configuration:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.59", "mcp"]
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.
@@ -356,7 +356,7 @@ CONTROLLER
 ----------
 Primary operator entry point:
 
-  npx -y deadbyte-mcp@0.15.58 remote
+  npx -y deadbyte-mcp@0.15.59 remote
 
 The legacy CMD entry remains compatibility-only for R33 rollback safety.
 
@@ -417,7 +417,7 @@ MCP CLIENT CONFIGURATION
 ------------------------
 The local stdio entry point is quiet and suitable for MCP hosts:
 
-  npx -y deadbyte-mcp@0.15.58 mcp
+  npx -y deadbyte-mcp@0.15.59 mcp
 
 CLAUDE DESKTOP
 Use the standard local-server entry in claude_desktop_config.json:
@@ -426,7 +426,7 @@ Use the standard local-server entry in claude_desktop_config.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.59", "mcp"]
       }
     }
   }
@@ -439,7 +439,7 @@ Create .cursor/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.59", "mcp"]
       }
     }
   }
@@ -452,7 +452,7 @@ Create .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.59", "mcp"]
       }
     }
   }
@@ -462,9 +462,9 @@ Add this to ~/.codex/config.toml:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.59", "mcp"]
 
-The remote device path remains `npx -y deadbyte-mcp@0.15.58 remote`. Remote public MCP uses the
+The remote device path remains `npx -y deadbyte-mcp@0.15.59 remote`. Remote public MCP uses the
 verified HTTPS named-tunnel URL selected by the active generation; do not commit a private device
 URL or tunnel token into a repository.
 

package/RELEASE.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.58",
+  "version": "0.15.59",
   "train": "R153",
   "label": "R153 CLEAN ACTIVATION RECOVERY",
   "protocol_revision": "2026-07-28",
@@ -19,10 +19,10 @@
     "generation_manifest_sha256": "ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4"
   },
   "source_predecessor": {
-    "version": "0.15.55",
-    "source_path": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\evidence\\npm-publication\\0.15.55\\deadbyte-mcp-0.15.55.tgz",
+    "version": "0.15.58",
+    "source_path": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\evidence\\npm-publication\\0.15.58\\deadbyte-mcp-0.15.58.tgz",
     "release_status": "REGISTRY_PUBLISHED",
-    "tarball_sha256": "dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760"
+    "tarball_sha256": "4bc53cfa6b3890b5749066cb507e8773b36d6c255192a8973dadb8546a39822e"
   },
   "consolidation": {
     "frontend_status_vocabulary": true,
@@ -417,9 +417,9 @@
     "stable_final_claim": false
   },
   "r153": {
-    "release_candidate_version": "0.15.58",
-    "source_predecessor_version": "0.15.55",
-    "source_predecessor_tarball_sha256": "dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760",
+    "release_candidate_version": "0.15.59",
+    "source_predecessor_version": "0.15.58",
+    "source_predecessor_tarball_sha256": "4bc53cfa6b3890b5749066cb507e8773b36d6c255192a8973dadb8546a39822e",
     "production_predecessor_version": "0.15.45",
     "startup_order": "LOCK_MARKER_RECONCILE_ACTIVATE_CLAIM_START",
     "stale_marker_reconciliation": "PASS_FOCUSED_CONTENT_CAS",

package/SBOM.cdx.json

@@ -1,13 +1,13 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:cdx:deadbyte-mcp:r153:0.15.58",
+  "serialNumber": "urn:cdx:deadbyte-mcp:r153:0.15.59",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "deadbyte-mcp",
-      "version": "0.15.58"
+      "version": "0.15.59"
     }
   },
   "components": [

package/TEST-MATRIX.json

@@ -1,6 +1,6 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.58",
+  "version": "0.15.59",
   "train": "R153",
   "primary_platform": "win32-x64",
   "reference": {

package/bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-chatgpt-bridge",
-  "version": "0.15.58",
+  "version": "0.15.59",
   "private": true,
   "type": "module",
   "engines": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.58",
+  "version": "0.15.59",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/bootstrap-uac-migration-r153.ps1

@@ -1,5 +1,5 @@
 param(
-    [Parameter(Mandatory=$true)][ValidateSet('0.15.58')][string]$ExpectedVersion,
+    [Parameter(Mandatory=$true)][ValidateSet('0.15.59')][string]$ExpectedVersion,
     [Parameter(Mandatory=$true)][string]$StateRoot,
     [Parameter(Mandatory=$true)][string]$TarballPath,
     [Parameter(Mandatory=$true)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedTarballSha256,
@@ -99,7 +99,7 @@ if ($LASTEXITCODE -ne 0) { throw 'R153 protected staging initial ACL normalizati
 & $icacls $prefix '/setowner' '*S-1-5-32-544' '/T' '/C' | Out-Null
 if ($LASTEXITCODE -ne 0) { throw 'R153 protected staging initial owner normalization failed' }
 
-$metadataUri = 'https://registry.npmjs.org/deadbyte-mcp/0.15.58'
+$metadataUri = 'https://registry.npmjs.org/deadbyte-mcp/0.15.59'
 $tagsUri = 'https://registry.npmjs.org/-/package/deadbyte-mcp/dist-tags'
 [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
 $metadata = Invoke-RestMethod -UseBasicParsing -Uri $metadataUri -Method Get -TimeoutSec 30
@@ -184,6 +184,12 @@ if ($actual.Count -ne $expected.Count) { throw 'R153 staged package file-count m
 if ($LASTEXITCODE -ne 0) { throw 'R153 protected staging final ACL normalization failed' }
 & $icacls $prefix '/setowner' '*S-1-5-32-544' '/T' '/C' | Out-Null
 if ($LASTEXITCODE -ne 0) { throw 'R153 protected staging final owner normalization failed' }
+# /inheritance:r with /T strips inherited Allow ACEs from leaf files.
+# The directory OI/CI grant above does not become a direct leaf ACE on Windows.
+# Restore direct access for Administrators and SYSTEM on every existing member;
+# never grant Users/Everyone, and independently re-hash all package files below.
+& $icacls $prefix '/grant' '*S-1-5-32-544:(F)' '*S-1-5-18:(F)' '/T' '/C' | Out-Null
+if ($LASTEXITCODE -ne 0) { throw 'R153 protected staging leaf ACL restoration failed' }
 
 # Re-read every manifest-bound byte after ACL normalization. The first
 # candidate JavaScript below cannot run against bytes changed in the ACL gap.

package/scripts/issue-uac-migration-r153.mjs

@@ -45,7 +45,7 @@ async function main(){
   if(trust.trusted!==true)fail('candidate not R89 protected');
   const pkg=JSON.parse((await read(path.join(root,'package.json'))).toString('utf8'));
   const rel=JSON.parse((await read(path.join(root,'RELEASE.json'))).toString('utf8'));
-  if(pkg.version!=='0.15.58'||rel.version!==pkg.version)fail('candidate release identity mismatch');
+  if(pkg.version!=='0.15.59'||rel.version!==pkg.version)fail('candidate release identity mismatch');
   const pointer=parseActivePointer((await read(path.join(state,'active-release.json'))).toString('utf8'));
   if(pointer.version!=='0.15.45'||rel.parent?.release_id!==pointer.release_id||
     rel.parent?.manifest_sha256!==pointer.manifest_sha256||

package/scripts/r153-prepublish-identity.mjs

@@ -6,9 +6,9 @@ import {fileURLToPath} from 'node:url';
 const defaultRoot=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
 const hex64=/^[0-9a-f]{64}$/;
 const EXPECTED=Object.freeze({
-  candidateVersion:'0.15.58', train:'R153',
-  sourceVersion:'0.15.55',
-  sourceSha256:'dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760',
+  candidateVersion:'0.15.59', train:'R153',
+  sourceVersion:'0.15.58',
+  sourceSha256:'4bc53cfa6b3890b5749066cb507e8773b36d6c255192a8973dadb8546a39822e',
   runtimeVersion:'0.15.45',
   runtimeReleaseId:'v0.15.45-34aa8d1241cfb8bf',
   runtimeManifest:'34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc',

package/src/clean-activation-recovery-r153.mjs

@@ -32,7 +32,7 @@ export function classifyLegacyMigration(input){
   if(!input.pointer||input.pointer.version!=='0.15.45'||
     !HEX64.test(String(input.pointer.manifest_sha256??''))||!HEX64.test(String(input.pointer.generation_manifest_sha256??'')))
     return reject('predecessor identity invalid',subject);
-  if(!input.candidate||input.candidate.version!=='0.15.58'||
+  if(!input.candidate||input.candidate.version!=='0.15.59'||
     !HEX64.test(String(input.candidate.manifest_sha256??''))||!HEX64.test(String(input.candidate.tarball_sha256??'')))
     return reject('candidate identity invalid',subject);
   if(PLANES.some(plane=>!HEX64.test(String(input.policySha256?.[plane]??''))))

package/src/uac-approval-contract-r153.mjs

@@ -58,7 +58,7 @@ export function uacReceiptSubject(input){
   const candidate=windowsAbsolute(input.candidateRoot,'candidate root');
   if(!candidate.startsWith('c:\\program files\\')||candidate==='c:\\program files\\')
     throw new Error('UAC migration requires a protected candidate installation');
-  if(input.candidateVersion!=='0.15.58')throw new Error('UAC migration candidate identity unsupported');
+  if(input.candidateVersion!=='0.15.59')throw new Error('UAC migration candidate identity unsupported');
   const hashes=['candidateManifestSha256','tarballSha256','markerReceiptSha256','predecessorPointerSha256',
     'preflightSubjectSha256','nodeSha256','deployScriptSha256','nonce'];
   for(const key of hashes)if(!HEX64.test(String(input[key]??'')))throw new Error('UAC approval hash/nonce invalid: '+key);

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.58';
+export const DEADBYTE_VERSION = '0.15.59';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/r130-release-security-contract.test.mjs

@@ -13,15 +13,15 @@ test('R130 security patch has a new immutable package identity and truthful sour
     read('SBOM.cdx.json'),read('package-lock.json'),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.58');
+    assert.equal(actual,'0.15.59');
   assert.equal(release.train,'R153');
   assert.equal(matrix.train,'R153');
-  assert.equal(release.source_predecessor.version,'0.15.55');
-  assert.match(release.source_predecessor.source_path,/0\.15\.55/);
+  assert.equal(release.source_predecessor.version,'0.15.58');
+  assert.match(release.source_predecessor.source_path,/0\.15\.58/);
   assert.equal(release.runtime_predecessor.version,'0.15.45');
-  assert.equal(provenance.source_predecessor_tarball_sha256,'dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760');
-  assert.equal(provenance.source_predecessor_version,'0.15.55');
-  assert.equal(provenance.source_predecessor_manifest_file_sha256,'96e243c87ac01a6769643179201ac3ca3dc900d1d72f71fbf272a853846a4891');
+  assert.equal(provenance.source_predecessor_tarball_sha256,'4bc53cfa6b3890b5749066cb507e8773b36d6c255192a8973dadb8546a39822e');
+  assert.equal(provenance.source_predecessor_version,'0.15.58');
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,'ec621a8a16f264f8824aa4644c914aca8f6ce57cb3578f5bce8acf2ac77fcc18');
   assert.equal(pkg.dependencies['@modelcontextprotocol/client'],'2.3.1');
   assert.equal(pkg.dependencies['@modelcontextprotocol/server'],'2.3.1');
   for(const dep of ['@modelcontextprotocol/client','@modelcontextprotocol/server'])

package/test/r132-release-identity.test.mjs

@@ -17,12 +17,12 @@ test('R144 package identities, R132 historic evidence and published predecessor
   }
   assert.equal(release.train,'R153');
   assert.equal(matrix.train,'R153');
-  assert.equal(release.source_predecessor.version,'0.15.55');
-  assert.match(release.source_predecessor.source_path,/0\.15\.55/);
-  assert.equal(prov.source_predecessor_version,'0.15.55');
-  assert.equal(prov.source_predecessor_manifest_file_sha256,'96e243c87ac01a6769643179201ac3ca3dc900d1d72f71fbf272a853846a4891');
-  assert.equal(prov.parent_tarball_sha256,'dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760');
-  assert.equal(prov.parent_registry_tarball_sha1,'6a51d2253b3bf594fda5b7b52a3aafa9ef9d04fb');
+  assert.equal(release.source_predecessor.version,'0.15.58');
+  assert.match(release.source_predecessor.source_path,/0\.15\.58/);
+  assert.equal(prov.source_predecessor_version,'0.15.58');
+  assert.equal(prov.source_predecessor_manifest_file_sha256,'ec621a8a16f264f8824aa4644c914aca8f6ce57cb3578f5bce8acf2ac77fcc18');
+  assert.equal(prov.parent_tarball_sha256,'4bc53cfa6b3890b5749066cb507e8773b36d6c255192a8973dadb8546a39822e');
+  assert.equal(prov.parent_registry_tarball_sha1,'04cc1a1e80bcb7062ac39eee6b7bab70edd5d8c3');
   assert.equal(release.runtime_predecessor.version,'0.15.45');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);
   assert.equal(prov.runtime_predecessor.manifest_sha256,release.runtime_predecessor.manifest_sha256);

package/test/r153-clean-activation-recovery.test.mjs

@@ -22,7 +22,7 @@ const planes=['process','coding','autonomous','desktop','host'];
 const base=()=>({
   stateRoot:'C:\\Users\\owner\\.deadbyte-mcp',
   pointer:{release_id:'v0.15.45-parent',version:'0.15.45',manifest_sha256:'1'.repeat(64),generation_manifest_sha256:'2'.repeat(64)},
-  candidate:{version:'0.15.58',manifest_sha256:'3'.repeat(64),tarball_sha256:'4'.repeat(64)},
+  candidate:{version:'0.15.59',manifest_sha256:'3'.repeat(64),tarball_sha256:'4'.repeat(64)},
   observation:{state:'OFFLINE',local_ready:false,bridge:{alive:false},core:{alive:false},cloud:{alive:false},supervisor:{running:false},
     authority:Object.fromEntries(planes.map(plane=>[plane,{configured:true,armed:false,reason:plane==='autonomous'?'unverified':'disarmed'}]))},
   policySha256:Object.fromEntries(planes.map((plane,index)=>[plane,String(index+5).repeat(64)])),
@@ -55,7 +55,7 @@ test('R153 RED: UAC subject binds candidate, predecessor, policy, marker, state
     issuedAt:'2026-10-23T16:00:00.000Z',expiresAt:'2026-10-23T16:10:00.000Z'});
   assert.equal(subject.action,'narrow_legacy_policy_and_activate');
   assert.equal(subject.marker_sha256,HEX);
-  assert.equal(subject.candidate.version,'0.15.58');
+  assert.equal(subject.candidate.version,'0.15.59');
   assert.equal(subject.nonce,'b'.repeat(64));
   assert.deepEqual(subject.allowed_authority_after,Object.fromEntries(planes.map(plane=>[plane,false])));
 });

package/test/r153-staging-leaf-acl.test.mjs

@@ -0,0 +1,47 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import {fileURLToPath} from 'node:url';
+import {spawnSync} from 'node:child_process';
+
+const bootstrap=readFileSync(fileURLToPath(new URL('../scripts/bootstrap-uac-migration-r153.ps1',import.meta.url)),'utf8');
+
+test('R153 ACL hotfix grants direct leaf read only to Administrators and SYSTEM before rehash',()=>{
+  const start=bootstrap.indexOf("R153 protected staging final ACL normalization failed");
+  const repair=bootstrap.indexOf("'*S-1-5-32-544:(F)' '*S-1-5-18:(F)' '/T' '/C'");
+  const rehash=bootstrap.indexOf('R153 staged package post-ACL verification failed');
+  assert.ok(start>=0&&repair>start&&rehash>repair,'ACL repair must follow recursive inheritance stripping and precede independent rehash');
+  assert.match(bootstrap,/R153 protected staging leaf ACL restoration failed/);
+  assert.doesNotMatch(bootstrap.slice(start,rehash),/S-1-5-32-545:\(F\)|Everyone:\(F\)/);
+});
+
+test('R153 Windows ACL reproduction rejects stripped leaf ACE and restores direct read', {skip:process.platform!=='win32'},()=>{
+  const ps=String.raw`$ErrorActionPreference = 'Stop'
+$root = Join-Path $env:TEMP ('r153-native-acl-test-' + [guid]::NewGuid().ToString('N'))
+$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+$leaf = Join-Path $root 'child\file.txt'
+try {
+  New-Item -ItemType Directory -Path (Split-Path -Parent $leaf) -Force | Out-Null
+  [IO.File]::WriteAllText($leaf,'read-only regression fixture')
+  & icacls.exe $root '/inheritance:r' '/grant:r' ('*'+$sid+':(OI)(CI)(F)') '/T' '/C' | Out-Null
+  if($LASTEXITCODE -ne 0){throw 'REPRO_SETUP_FAILED'}
+  $blocked = Get-FileHash -LiteralPath $leaf -Algorithm SHA256 -ErrorAction SilentlyContinue
+  if($null -ne $blocked){throw 'REPRO_DID_NOT_STRIP_LEAF_ACE'}
+  & icacls.exe $root '/grant' ('*'+$sid+':(F)') '/T' '/C' | Out-Null
+  if($LASTEXITCODE -ne 0){throw 'LEAF_REPAIR_FAILED'}
+  $restored = Get-FileHash -LiteralPath $leaf -Algorithm SHA256
+  if($null -eq $restored -or $restored.Hash.Length -ne 64){throw 'LEAF_NOT_READABLE_AFTER_REPAIR'}
+  $acl = Get-Acl -LiteralPath $leaf
+  $allow=@($acl.Access | Where-Object {$_.AccessControlType -eq 'Allow'})
+  if($allow.Count -ne 1){throw 'LEAF_HAS_UNEXPECTED_ALLOW_ACE_COUNT'}
+  if($allow[0].IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value -ne $sid){throw 'LEAF_HAS_UNEXPECTED_TRUSTEE'}
+  Write-Output 'R153_WIN32_LEAF_ACL_REPAIR_PASS'
+} finally {
+  if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Force -Recurse}
+}`;
+  const encoded=Buffer.from(ps,'utf16le').toString('base64');
+  const result=spawnSync('powershell.exe',['-NoLogo','-NoProfile','-NonInteractive','-EncodedCommand',encoded],
+    {encoding:'utf8',timeout:30000,maxBuffer:256*1024});
+  assert.equal(result.status,0,result.stderr||result.stdout||String(result.error));
+  assert.match(result.stdout,/R153_WIN32_LEAF_ACL_REPAIR_PASS/);
+});

package/test/r153-uac-approval-contract.test.mjs

@@ -4,7 +4,7 @@ import {createUacApproval,verifyUacApproval,validateApprovalWindow,requireTruste
 import {readFileSync} from 'node:fs';
 import {fileURLToPath} from 'node:url';
 const h=(n)=>n.repeat(64);
-const base=()=>({stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp',candidateRoot:'C:\\Program Files\\DEADBYTE-R153-TEST',candidateVersion:'0.15.58',candidateManifestSha256:h('a'),tarballSha256:h('b'),markerReceiptSha256:h('c'),predecessorPointerSha256:h('d'),predecessorPolicySha256:{process:h('1'),coding:h('2'),autonomous:h('3'),desktop:h('4'),host:h('5')},preflightSubjectSha256:h('e'),nodeSha256:h('f'),deployScriptSha256:h('0'),nonce:h('6'),issuedAt:'2026-10-24T00:00:00.000Z',expiresAt:'2026-10-24T00:05:00.000Z'});
+const base=()=>({stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp',candidateRoot:'C:\\Program Files\\DEADBYTE-R153-TEST',candidateVersion:'0.15.59',candidateManifestSha256:h('a'),tarballSha256:h('b'),markerReceiptSha256:h('c'),predecessorPointerSha256:h('d'),predecessorPolicySha256:{process:h('1'),coding:h('2'),autonomous:h('3'),desktop:h('4'),host:h('5')},preflightSubjectSha256:h('e'),nodeSha256:h('f'),deployScriptSha256:h('0'),nonce:h('6'),issuedAt:'2026-10-24T00:00:00.000Z',expiresAt:'2026-10-24T00:05:00.000Z'});
 test('R153 UAC receipt carries exact no-grants narrow migration subject',()=>{
   const x=base(),receipt=createUacApproval(x);
   assert.equal(receipt.schema,'deadbyte.r153-uac-approval.v1');
@@ -31,7 +31,7 @@ test('R153 UAC receipt fails closed on expiration, malformed, replay-like tamper
   assert.throws(()=>createUacApproval({...x,issuedAt:'not-a-date'}));
   assert.throws(()=>createUacApproval({...x,nonce:'x'}));
 });
-test('R153 UAC scope only accepts protected root and exact v0.15.58',()=>{
+test('R153 UAC scope only accepts protected root and exact v0.15.59',()=>{
   assert.throws(()=>createUacApproval({...base(),candidateRoot:'C:\\Users\\DEADBYTE\\npm-cache'}),/protected/i);
   assert.throws(()=>createUacApproval({...base(),candidateVersion:'0.15.55'}),/candidate/i);
   assert.throws(()=>validateApprovalWindow('2026-10-24T00:00:00.000Z','2026-10-24T00:00:00.000Z','2026-10-24T00:00:00.000Z'));

package/test/r153-uac-launch-parameter-contract.test.mjs

@@ -45,7 +45,7 @@ test('R153 RED: mutable npx entrypoint stages exact registry package before priv
   assert.doesNotMatch(script,/npm-cli\.js|npm install/i);
   assert.match(script,/Get-FileHash -LiteralPath \$file -Algorithm SHA256/);
   assert.match(script,/NODE_OPTIONS/);
-  assert.match(script,/https:\/\/registry\.npmjs\.org\/deadbyte-mcp\/0\.15\.58/);
+  assert.match(script,/https:\/\/registry\.npmjs\.org\/deadbyte-mcp\/0\.15\.59/);
   assert.match(script,/live npm registry tarball SHA-256 mismatch/);
   assert.match(script,/live npm registry tarball integrity mismatch/);
   assert.match(script,/DEADBYTE-R153-Stage-/);

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');