deadbyte-mcp 0.15.58 → 0.15.60

package/MANIFEST.SHA256

@@ -30,7 +30,7 @@ c814771dddac8bfb184250b868ddb6ab9f5e0e43613c04c3ed8abe09324ec4db  bin/deadbyte-n
 daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4  bin/deadbyte-process-host.exe
 b55d2c4490dfb875d40f29a69df2addc5d579991cb7d094674c04d369dfcfac3  bin/deadbyte-tunnel-host.exe
 f0ce7acb1e41325cef8b6789f95bd78b6a6107423773eace57a12b49faa55095  bin/WORKER-REGISTRY.txt
-b9c0d2f856a61060cfa7353f7421c8635c567ba1cf3362592d947dbf261c1261  bridge/package.json
+f5ccdaca2662a03dbf2aca4e00e3ba3ee6866f3db93371936115f85d6ad5c754  bridge/package.json
 f99413d82f84c808f52d5b8696c190a9142dd08f517f5ec3e442f0769402d189  bridge/src/bridge-health-r59.mjs
 fa0dcc4cde9c03e978c9f9dd24b62afa83f49bdada1f42ead544a9a17edd332f  bridge/src/bridge.mjs
 471f41c84c5b339cd81a708a4f36d4470e614946817ad2f9fca295dde2c83fb6  bridge/src/canonical-json-r60.mjs
@@ -1393,8 +1393,8 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-c0fae04895112612f30d7b73ca23eb799589dfd0c5a75e6fe0699322ab6825f4  package.json
-120664572ba2a95dd4d0c9e608507c7683bd80130bf2500f59289dee96020edc  PROVENANCE.json
+7ce943961080ef5036c7bacd0561ee6bfd5e4d1e7f31aef68cd8fb631e0c4fac  package.json
+57d2619e30cc63924ad3b433d4760e16323de898fdcccbbb336009ce0c1482c9  PROVENANCE.json
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
 0b7ec5ee347ddfa6cca59740fc7a8fe3fc5d51406265bb12189e82fa106319d2  R41-PARENT.json
 bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.json
@@ -1403,9 +1403,9 @@ f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.jso
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
 3dc607603fea511e2f428e9546a875ab7e38b6a0bbd5e803e4510de082f30804  R49-PARENT.json
-43d0301f4139db8f1d6b60e09bc747fd309ea77ba65f5f60d9876f5d6ba561bf  README.txt
-3de667d48b6056e84bfa046170c80371ae1c9ff81bef969cad21af5292078052  RELEASE.json
-a5bf1a4cc26610ac6b98e34c8a05cecda72614d2d784615d09ef7e86766ed690  SBOM.cdx.json
+218348214070c7c04f7b462b4e71824248c75ee09602a97026c550552eb36341  README.txt
+27668a6a9e578af5d64232bd6e599f89d18fabbe1290c7125d75b11b71651bbd  RELEASE.json
+0df08a9ad4f7c294379f91c50e4dc788cd6208e13cd5484bf4d527dd162e5a27  SBOM.cdx.json
 7c86062c4f69db3179a129d65945ccfab1b1c1c5bcc29b91383eac097d50f2aa  scripts/activate-skill-creator-1.1.1.mjs
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
@@ -1413,7 +1413,7 @@ bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-
 34f9318b6f4afb29948fdc5ab973edca4dfc4fbd63c9a5105478b5e95812dabf  scripts/autonomous-build.ps1
 075acd7616740135973497d676dcd0431f0437bdba87e4eedba4751cb148ff02  scripts/autonomous-tests.ps1
 f43c5e5064fb5863ce51aca156434d8b7c493ee954b8846f41625cd7130936d8  scripts/benchmark-l0-r71.mjs
-a5da0c4bf9063b4e091b44b5b88020c2199594e12da22001350837746ddb19ea  scripts/bootstrap-uac-migration-r153.ps1
+8d2ca9595df68fc2947c5f501e1c55da7853d9f97a1f37732b011cf807f0b45f  scripts/bootstrap-uac-migration-r153.ps1
 5d8ce87ffbe55f4737ba1ee2fa6772a8157bfa92afec9101909c0f9bead27fcb  scripts/bridge-benchmark-r58.mjs
 7c3f2a157f64aef9e605b5fe84d75fbdd88312f09d0ad89effb33de82aa39ab8  scripts/build-advanced-pcb-skill.mjs
 70bccc3572de7e26ac91154b9d87185feab0c2dbfc4cbd40f89660e5769f53b0  scripts/build-combined-skill.mjs
@@ -1447,7 +1447,7 @@ a64b6779eff80d68d90d238dee7f2feda5ada3c5c59bcaeae2ab7812bd28404e  scripts/deferr
 5af5953d67a5c494980feeb36bfc6df7d1cc8a6246f259c31cd3c64885d7e60a  scripts/deferred-slot-operation-r46.mjs
 34116370895aeff9a424475558f4aca3b05460146455d9bb0bafcacd1a270910  scripts/deferred-slot-operation.mjs
 1cee04ab67a1e9a06f42cb5fde7073298ca501a059c961d11659a578aaef5e90  scripts/deploy-r47.mjs
-2cd369f37d0b4e357eb44c50b09981898e0035eb97abe019d6aafcb689125246  scripts/deploy-r48.mjs
+1be4983bf63172064a1ef5ba0cbcc727f68f17fe1b0de1c248cd79aac89a53aa  scripts/deploy-r48.mjs
 2cc7a37231f8836a48c3bf4024887f38c10bfc89296ac483e4b98b3f18281933  scripts/derive-r45-parent.mjs
 67221c5619019a9d19611432d4361c99c365f14e89483e4c8f78451839960176  scripts/derive-r45-release.mjs
 87c6acc0df96a6e8bb6692bc7b12e8b386196a80cba554d9b214ff8bb12147fe  scripts/derive-r45-tests.mjs
@@ -1530,7 +1530,7 @@ a9d10a04324cceafafa7edc1501e8e1f8a1ae4a094d0985c8309472512529d30  scripts/gate-w
 1a771b5b8a62d57f26762d53472ed68a3e733674b1c91e08becf0dc2e4325039  scripts/inspect-active-release-r45.mjs
 de6142bd5693cf4edb8725c9c43fc77e9bdc12f5b398a757006d778d3ee3f8ed  scripts/inspect-r46-active.mjs
 06425d2a4004cb0ad66383c10c30aaa91bb020be2926bc76f9681a8f0827ddfc  scripts/inventory-reference-dist.mjs
-c4061b8ef68c9c842b9314640eeb41afa2313ae106687a36c3e4b99620f5b574  scripts/issue-uac-migration-r153.mjs
+d952ca5bb1d315f37c2d15625756c366b100e8c015f11fedfd22919fadefbea1  scripts/issue-uac-migration-r153.mjs
 7ea8cf6bf094a1612603bc716228a3753e5f06fca8a0684d2da15a04d0710c64  scripts/list-source-zips.mjs
 4326526cbff265bb8ec2d38af1825b0bac227e3506437fff6e13f9cdb20dab33  scripts/npm-artifact-identity-r61.mjs
 2598a67b08caaef2ff75fc52eca1e268c83b79c50048202e318904952379aa4a  scripts/npm-prepublish-contract-r74.mjs
@@ -1561,7 +1561,7 @@ f682cb041e9dec3e4e99c87e9650e35c9f10d51cba458ec7040bbedc8b22f987  scripts/perfor
 6767992de09ed6f95f74a14b743bb5e5660fa63cbd2d5a6cdc2a14be3531c8cc  scripts/promote-local-d-generation.ps1
 c4e081f95bc82e45a06993c34d47f10083640e794e2e3ccc26933fcf597b0c50  scripts/public-baseline-r58.mjs
 615c670581ee3e8a30095c0af63c24edbec01db74c7370069e1a486c53989968  scripts/public-surface-r58.mjs
-74e5162331f1d971a9604241eb64e84ffdf2187636c7ea14341c5e2c4f9fd5bc  scripts/r153-prepublish-identity.mjs
+3af9ef85417e0b55e00df060e345dde2b609b744b065549216c5ffa87130befa  scripts/r153-prepublish-identity.mjs
 e19a1d591ccd07af2e87d930ce23b0cc9b814bc2a395408045543847154097d7  scripts/r40-compact-ledger-probe.mjs
 68b9a60aca3f3e3e9ec239710f8368594ef3c8a98fff0816d2e9a7950df48287  scripts/r47-core-failures.mjs
 75f821cc44f8c31f67de0b28b64021d9fb160984a597e704b29c33f9f3a41dde  scripts/r47-syntax-check.mjs
@@ -1622,7 +1622,7 @@ d42efb6dd8e6abc79c66e768f8c0feb10fa3341bcce0888750461f56612f0fd3  scripts/releas
 1b83f49d9798188533c8cfca0030a98af34560fe181b3e593db790319e1b7bc5  scripts/release-parity.mjs
 21ddee002ddfc1d7c34bf92a4cc02abac38630c4814366216efda66217db6baa  scripts/remove-source-archives-r47.mjs
 817c2f5ce7f2c935a268e16f4a2d8b8611ddf89df8776682082baafb63a84921  scripts/repair-builder-template.mjs
-68cee3df1e65efb81b283fc55a4e1aebc7d68defae2e22c4bf3eb414574985de  scripts/request-uac-migration-r153.ps1
+bb06a46f53222181618569633c177e62274bcb11b440fcfea63826b0bb22edd4  scripts/request-uac-migration-r153.ps1
 fb6e47bf46f86887bcbde703b2618ead594ba430a6faf298be6b34432a87e030  scripts/run-r46-full-regression-background.mjs
 46751fc8c4f25329c235e1946c662f33c23c46428d4075a2f7c9543c801c5cfd  scripts/run-r46-windows-gate-background.mjs
 cabfa63d5edb83f32b3e6e5ce22e76223644d81a3361d52a28de2dbc07e59a54  scripts/run-r46-windows-gate-background.ps1
@@ -1675,7 +1675,7 @@ c32cb9054a1b9641ae071c00622c0054272bdb0b519ea22c4ff926a1600a2b46  scripts/worklo
 1ee9251c743d817245e858229e1e1db4f7bebb7e5411d370d33c4777528e53e0  scripts/workload-substrate-r47-regression.mjs
 546947775fac8075f48c689ea0f7bed5ea14424efd12587daead4a7df6e796df  src/activation-authority-proof-r75.mjs
 0fca861bfb959b6d84c4767b2f60a4e0ec2403291a6050ee7598f75d2c4c18e0  src/activation-continuity-engine-r65.mjs
-ef15933f6d77fdbbddafef4e46352a12ecd4ed8e2d4c6dd515059ad5fa547e65  src/activation-lock-r65.mjs
+64ff84efd679a4f2a7e7aefcca70c3199ad47ff069e18ea9c08a4305ddee2d50  src/activation-lock-r65.mjs
 fc05a48ac13961c2f1dee444946531ff80100a00750fb9f8e456a6d69f6e1310  src/activation-preflight-r65.mjs
 9dc1154b3857446d0412002e1f0b0031c23d1768350dc9395749a7f82be337e5  src/agent-backend-r44.mjs
 4e8e442497a15bce43b7d02ade497403d80b86e307473d26c172a0fba3a6d4ea  src/agent-eval-r42.mjs
@@ -1713,7 +1713,7 @@ da5181cec30034ddf089baa5358becb5651da238a2e7cf0888007a4c60b4ea6b  src/capability
 8348e01ec8dcd3171dab02399a2aa48cf09db2d283da25bfdde721a5c3f44b03  src/capability-ledger.mjs
 dd84aab65c73906037390b07f1d9e3e118511b21145e8ba914f98d6f2a153baf  src/capability-resolver.mjs
 b3a669da30bf2d99cd5a912bdacb234b66c90215183a2aeeb3c01c91f1a55c64  src/capability-snapshot.mjs
-ad7a77b7179d98f1640cf5edbf5de5029acb20693f0b463f87984f304f655983  src/clean-activation-recovery-r153.mjs
+3e2818046625828107e2fcb6723eaf9f227648f781293b1abac475cf03ee7565  src/clean-activation-recovery-r153.mjs
 94e5aeff2453cdc0239aee4d547dbbefee183c71933cb84e5e8a418fa99bc1e8  src/codex-app-server-r44.mjs
 c4e07aa6818cd989c43ce8d027dc7d467e05c8e2fe96b5548eea291285d3bbb1  src/coding-mcp-tools.mjs
 059b4bef2ae6a6c2d7a706c463bea6e49d364faeb619372a429ba36c53004ab7  src/coding-output-contracts.mjs
@@ -1748,7 +1748,7 @@ dcd4c9784e88e253e91ddad3c24b38cb0b36906ed737f6d7bee7712360f66f7a  src/containmen
 fe1761b98738e1aea1d25ddf3a0ba56ccad95a43d45104a89b8665197c7c9e18  src/containment-result.mjs
 705a89cb12fedb993d55dfed32a5870d33e10db26422c944d1e52223566c096c  src/containment-smoke.mjs
 63a1d4d6a53f9eb7e02197b4e42158b867da8c042c2e61848d8a36cd398b8bd8  src/context-provenance.mjs
-0d6c6534d41cd4ef8568d2dc52a5ed39aab53c9a4e09bfe266ac129aa034bb46  src/deadbyte-cli.mjs
+d766b4643e1e6e7f03f51c9033b99248612ede1a995cd826923febd556563954  src/deadbyte-cli.mjs
 9e9766d64dcc9e2c8d23c2c0a5e9dcb87b7213e8de668f79f593ad48daf15acd  src/deadline-cancellation.mjs
 fe7a8f8611c33552b3da466a9b866ce79a737bfd5b9a78a953269b30cce16274  src/desktop-contract.mjs
 f97352e510c659910c2d4a874d15be028e1291d685c6c1a7be53bdf1a335c2d8  src/desktop-input-r40.mjs
@@ -1890,16 +1890,16 @@ bac271c6f5218752ac5ff4decf5249e3893ddb35c63c092ce17238c27fc4d35b  src/trust-init
 4d934281a72922fabde7d6e988655a6d095eb3a89abf12e9b99fecc3046e3d62  src/trust.mjs
 c99c2402fb0df4f68634fa906eb198c551c55dad9f0921a7b8ed6e33d503884e  src/tunnel-stdio-compat-smoke.mjs
 aa765e9a28c69ff58a5b5a0d29b49ea181af4db9076633b102dbca25861e708e  src/tunnel-stdio-compat.mjs
-255ca6a60fef007d727fd22f653e8f917ed52db6a9ff38aea8fd5271446b15b6  src/uac-approval-contract-r153.mjs
+e241728ead29da4336c66011464c1204874741c92667a1bc2cd92d0b29cc04e2  src/uac-approval-contract-r153.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-34506357807eaa868eb29463762f9d6dacdefde1c95bd3e0143a4748d54c34dd  src/version.mjs
+b2a6b4f53b8c7b729995a2cd87c616492c9dac01d7b6de2e2c8f0b0c487ff63a  src/version.mjs
 acf5f5a57779bc0529f9db3d821f0ef1b53d22063aa237041348c1ca444ea677  src/windows-powershell-environment.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs
 1bd637e7634ca0259791c5108fcf324554f70b1db49e5eac3505287c04bbc3be  STABILIZATION-PROGRESS.md
-1eb98859f9b9c06197c29ca31bcc088f60bed69adb8f46115b081230f2716a7f  TEST-MATRIX.json
+908286ccfafec104fe2b1cf50253c579fedc3acf0275d4ebd5ed2f706b001a20  TEST-MATRIX.json
 e4f1fb97545f23772ddff28ad3f9954a4714f9854062fca62e0e12c1cb2ec4ae  test/agent-backend-r44.test.mjs
 2a78c818058b25efdc143a3a97c832da231ccd6ff9d90c7796d681a0251b85c4  test/agent-crash-child.mjs
 d9461ab7c118ee75d37a2d6f5e637d7e43505af6a9ad8c7ddafffc8ace185a5b  test/agent-crash-worker.mjs
@@ -2153,9 +2153,9 @@ ce163ee9f288e30a213636e2267b8630016ef8a170f12286e8cdd44219bdab32  test/r124-live
 17475b51e416ae678f959f8975fab8497eb7c57d13e36cac8656c0e1f7424c0c  test/r126-restore-policy-envelope.test.mjs
 1721d4bd3bb58c10ad9d86b69ad1d993ec5a1e6315c95b28fa50ab67d4ca302a  test/r127-restore-append-policy-boundary.test.mjs
 b3d3dda398c94d18e2e156bde65d1338000233407b435134ba0c16175d96620b  test/r129-sdk-security-baseline.test.mjs
-c219428ae92bf75d0a5101ada579bfaedfca16da91ff86f5621802056a10e684  test/r130-release-security-contract.test.mjs
+593ea4cc04fa6f09188774cedc39978a8279f1201c3222184eb1433ebcc258b0  test/r130-release-security-contract.test.mjs
 bb7963baf412ec0f5aca183f6dd98eda9026fe763017f9af595581b521ae6cb7  test/r131-installed-manifest-boundary.test.mjs
-6e0bdb24f8f704822ca5767bf344386560adcc09c9fc4ce778b04b5edf0f7835  test/r132-release-identity.test.mjs
+f3571a18beeeecb4073e3169acd7ffb5a7dda169406170ad40ba4867572621c4  test/r132-release-identity.test.mjs
 acd236a4d8ba035007bde4166a521b8d4e6044f58c52c0bae9cb42fa75338533  test/r135-autonomous-scope.test.mjs
 3fcf657aae1f8466abc5ab82bb5a619966ea9b8a33d4a95a5a5246df5bf3afa1  test/r136-scoped-command-rights.test.mjs
 e0c466f25b35eb894166df792b71b23924610d32363756c75ff437dfdaa12a4c  test/r136-scoped-observer.test.mjs
@@ -2178,12 +2178,15 @@ ef0665adaab2a2b2d6ca8611a6335ded96b8e65a9661840acd139d3c86710e62  test/r144-cont
 b92f914455cac010b1468cd37a31651e7d423571d0edfeb29829d2281073e1e3  test/r146-legacy-offline-policy-proof.test.mjs
 32f40b649033172384267bbe8f6009dededcba81afff1e3ca51331407197fe3b  test/r146-livelog-backpressure.test.mjs
 77b3bfcd6fa04e21c7a04206181f7b4cbd5321f799a145859d8e84d0b984d174  test/r147-remote-request-hash.test.mjs
-1a51c946190de4a9ed2adee709f26063e3e769081211a61d3547c0805056cffc  test/r153-clean-activation-recovery.test.mjs
+48157c509b03fe5661a67a5c68d931c455a71494fb1d52ef0070effb764873f3  test/r153-clean-activation-recovery.test.mjs
 b1c9d788a607e579d18a1be36e0837dcc34b343bb53d55f9fb51c202af13bacd  test/r153-prepublish-identity.test.mjs
+377b03dbb1d82ed0ddeee261a060b8173d5591dfc20a60d9ea991390a03039b4  test/r153-r60-host-repin-e2e-contract.test.mjs
+658a839860ca6bfc7a26cf8f793c58f6cdeb2a8d425744ee7872f2eca3ff4ef6  test/r153-r65-signed-precondition-recovery.test.mjs
 ce37fc59761ceddf43fd3844b34d57f64f1c8d191ca1d6cba13b643a5e2c02ce  test/r153-restricted-reused-pid.test.mjs
-7d5c668aa9eecd944247b389851ab7a107e70cb3b40a8766bf4a093daf5ab517  test/r153-uac-approval-contract.test.mjs
+3c8d2110e869d4a6f125c9a4978c049f54424893f2317312448813ba0f19860f  test/r153-staging-leaf-acl.test.mjs
+b3e9fb4452b3a96ddc5af1a7873eb487bd273e042aa7eb91bbd03f8f7d8f46a9  test/r153-uac-approval-contract.test.mjs
 3d6a76df732eaa52b7409aa26c933f9e4d8316b64ded5cfad4202fea51b74fcd  test/r153-uac-installed-manifest-contract.test.mjs
-7ca4dd229e86d5882c0143d6bbc711367fc5230e490b77c400b679acb8bdccf6  test/r153-uac-launch-parameter-contract.test.mjs
+7d4ac1735e2c8760a4fe424aec6ceef8def6680c882c2cde32a59bedccb5edff  test/r153-uac-launch-parameter-contract.test.mjs
 3c5c3724bce89aa1fa59fe97cc346c40a5674bb5cd6dc3e2f31b86f2d62e75e4  test/r33-closeout-regression.test.mjs
 5e3700ee610442dfd7b7ae5e380263f231438be0e32790597142c41362a53c9a  test/r33-finalization.test.mjs
 7e419d3c1caf79bfc7407207f50e5645298f9b19d91a7d6f595af185b92cd55e  test/r36-finalization.test.mjs
@@ -2249,7 +2252,7 @@ ca8e23abc89f3eadeceb4b6fdad2cb4db5a7933029ece8e8beae2c6a158876b7  test/r58-owner
 8fc5ed1d3088facf45f9578d9ff8514c3a633f7f342d15eec316e129e7a916c0  test/r58-stale-owner.test.mjs
 84be7ee7d167eb06c9f9fc178930daaa81e53a91de40bad6d7df2060bd3dd165  test/r58-windows-gate.test.mjs
 76db2a4009d76b86e1da57b91a96b0d6bfeb4063bec3301ede736e2fd5832f39  test/r59-release-contract.test.mjs
-c88615a9f41a545515a5fce79fc590e5cffedab378ab5e408d339c50a8ba99fc  test/r59-tool-surface-compat.test.mjs
+65c50d4be2fa29851a2f908da569bdd3c4f8e1b970bddfdc7fda15a153edde13  test/r59-tool-surface-compat.test.mjs
 3befd5d4dc4d8ca9e1f6cbeb9c430671e676c5696d6ee5931c2cbe3244c558a4  test/r60-authority-coherence.test.mjs
 60577e231c7d164f57a3960c574d3e369ca140d9dbc477b2444fa62dbf224e51  test/r60-authority-enforcement.test.mjs
 a1fa0b1e529da05f3659a33be6d36dab02f93808638cf0f458d057e9c6d1e35b  test/r60-bridge-dispatch.test.mjs

package/PROVENANCE.json

@@ -1,9 +1,9 @@
 {
   "schema": "deadbyte.provenance.v1",
-  "version": "0.15.58",
-  "source_model": "published 0.15.55 tarball -> isolated R153 clean activation recovery successor",
+  "version": "0.15.60",
+  "source_model": "published 0.15.59 tarball -> isolated R153 clean activation recovery successor",
   "signing": "ed25519",
-  "parent_tarball_sha256": "dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760",
+  "parent_tarball_sha256": "0c20152b8ee553f06f05dfe017f4bd823d30cd50710722e9e0874f0bd6c66c75",
   "parent_activation_status": "PRODUCTION_ACTIVE",
   "parent_rollback_receipt_sha256": null,
   "runtime_predecessor": {
@@ -11,8 +11,8 @@
     "manifest_sha256": "34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc",
     "generation_manifest_sha256": "ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4"
   },
-  "source_predecessor_manifest_file_sha256": "96e243c87ac01a6769643179201ac3ca3dc900d1d72f71fbf272a853846a4891",
-  "reproducibility": "R153 isolated successor of published 0.15.55 tarball SHA-256 dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760; production runtime 0.15.45 remains immutable until exact candidate gates pass; legacy migration is one-time Windows UAC, marker-bound, and may only narrow policy while retaining all authority disarmed",
+  "source_predecessor_manifest_file_sha256": "f727be4a63220f4215f18282a1fd89963924a64adcd07747ca3c12d8fb166d86",
+  "reproducibility": "R153 isolated successor of published 0.15.59 tarball SHA-256 0c20152b8ee553f06f05dfe017f4bd823d30cd50710722e9e0874f0bd6c66c75; production runtime 0.15.45 remains immutable until exact candidate gates pass; legacy migration is one-time Windows UAC, marker-bound, and may only narrow policy while retaining all authority disarmed",
   "public_surface_evidence": {
     "status": "PASS",
     "baseline_release": "v0.15.35-1b5715b276facbc0",
@@ -80,8 +80,8 @@
   "parent_release_id": "v0.15.45-34aa8d1241cfb8bf",
   "parent_manifest_sha256": "34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc",
   "parent_generation_manifest_sha256": "ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4",
-  "source_predecessor_version": "0.15.55",
-  "source_predecessor_tarball_sha256": "dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760",
+  "source_predecessor_version": "0.15.59",
+  "source_predecessor_tarball_sha256": "0c20152b8ee553f06f05dfe017f4bd823d30cd50710722e9e0874f0bd6c66c75",
   "operator_override": {
     "four_hour_soak": "WAIVED_BY_OPERATOR",
     "clean_machine": "WAIVED_BY_OPERATOR",
@@ -125,7 +125,7 @@
     "package_registry_activation_rollback_restore": "PENDING",
     "stable_final_claim": false
   },
-  "parent_registry_tarball_sha1": "6a51d2253b3bf594fda5b7b52a3aafa9ef9d04fb",
+  "parent_registry_tarball_sha1": "04cc1a1e80bcb7062ac39eee6b7bab70edd5d8c3",
   "r62": {
     "transaction_inventory_default_max_entries": 1024,
     "parent_state_records_observed": 341,

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.15.58 / R153 CLEAN ACTIVATION RECOVERY
+DEADBYTE MCP V0.15.60 / R153 CLEAN ACTIVATION RECOVERY
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -16,12 +16,12 @@ check `--version` before issuing a stateful command. The compatibility CMD
 fails with an explanation when npm is detected rather than forwarding the
 wrong command to the controller.
 
-  npx -y deadbyte-mcp@0.15.58 mcp
-  npx -y deadbyte-mcp@0.15.58 remote
-  npx -y deadbyte-mcp@0.15.58 remote status
-  npx -y deadbyte-mcp@0.15.58 remote restart
-  npx -y deadbyte-mcp@0.15.58 audit status
-  npx -y deadbyte-mcp@0.15.58 audit verify
+  npx -y deadbyte-mcp@0.15.60 mcp
+  npx -y deadbyte-mcp@0.15.60 remote
+  npx -y deadbyte-mcp@0.15.60 remote status
+  npx -y deadbyte-mcp@0.15.60 remote restart
+  npx -y deadbyte-mcp@0.15.60 audit status
+  npx -y deadbyte-mcp@0.15.60 audit verify
 
 MAJOR MCP CLIENT STDIO CONFIGS
 -------------------------------
@@ -32,7 +32,7 @@ CLAUDE DESKTOP
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.60", "mcp"]
       }
     }
   }
@@ -44,7 +44,7 @@ Save as .cursor/mcp.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.60", "mcp"]
       }
     }
   }
@@ -57,7 +57,7 @@ Save as .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.60", "mcp"]
       }
     }
   }
@@ -67,7 +67,7 @@ Add to the Codex MCP configuration:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.60", "mcp"]
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.
@@ -356,7 +356,7 @@ CONTROLLER
 ----------
 Primary operator entry point:
 
-  npx -y deadbyte-mcp@0.15.58 remote
+  npx -y deadbyte-mcp@0.15.60 remote
 
 The legacy CMD entry remains compatibility-only for R33 rollback safety.
 
@@ -417,7 +417,7 @@ MCP CLIENT CONFIGURATION
 ------------------------
 The local stdio entry point is quiet and suitable for MCP hosts:
 
-  npx -y deadbyte-mcp@0.15.58 mcp
+  npx -y deadbyte-mcp@0.15.60 mcp
 
 CLAUDE DESKTOP
 Use the standard local-server entry in claude_desktop_config.json:
@@ -426,7 +426,7 @@ Use the standard local-server entry in claude_desktop_config.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.60", "mcp"]
       }
     }
   }
@@ -439,7 +439,7 @@ Create .cursor/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.60", "mcp"]
       }
     }
   }
@@ -452,7 +452,7 @@ Create .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.60", "mcp"]
       }
     }
   }
@@ -462,9 +462,9 @@ Add this to ~/.codex/config.toml:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.15.58", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.60", "mcp"]
 
-The remote device path remains `npx -y deadbyte-mcp@0.15.58 remote`. Remote public MCP uses the
+The remote device path remains `npx -y deadbyte-mcp@0.15.60 remote`. Remote public MCP uses the
 verified HTTPS named-tunnel URL selected by the active generation; do not commit a private device
 URL or tunnel token into a repository.
 

package/RELEASE.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.58",
+  "version": "0.15.60",
   "train": "R153",
   "label": "R153 CLEAN ACTIVATION RECOVERY",
   "protocol_revision": "2026-07-28",
@@ -19,10 +19,10 @@
     "generation_manifest_sha256": "ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4"
   },
   "source_predecessor": {
-    "version": "0.15.55",
-    "source_path": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\evidence\\npm-publication\\0.15.55\\deadbyte-mcp-0.15.55.tgz",
+    "version": "0.15.59",
+    "source_path": "C:\\Users\\DEADBYTE\\.deadbyte-mcp\\evidence\\npm-publication\\0.15.59\\deadbyte-mcp-0.15.59.tgz",
     "release_status": "REGISTRY_PUBLISHED",
-    "tarball_sha256": "dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760"
+    "tarball_sha256": "0c20152b8ee553f06f05dfe017f4bd823d30cd50710722e9e0874f0bd6c66c75"
   },
   "consolidation": {
     "frontend_status_vocabulary": true,
@@ -417,9 +417,9 @@
     "stable_final_claim": false
   },
   "r153": {
-    "release_candidate_version": "0.15.58",
-    "source_predecessor_version": "0.15.55",
-    "source_predecessor_tarball_sha256": "dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760",
+    "release_candidate_version": "0.15.60",
+    "source_predecessor_version": "0.15.59",
+    "source_predecessor_tarball_sha256": "0c20152b8ee553f06f05dfe017f4bd823d30cd50710722e9e0874f0bd6c66c75",
     "production_predecessor_version": "0.15.45",
     "startup_order": "LOCK_MARKER_RECONCILE_ACTIVATE_CLAIM_START",
     "stale_marker_reconciliation": "PASS_FOCUSED_CONTENT_CAS",

package/SBOM.cdx.json

@@ -1,13 +1,13 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:cdx:deadbyte-mcp:r153:0.15.58",
+  "serialNumber": "urn:cdx:deadbyte-mcp:r153:0.15.60",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "deadbyte-mcp",
-      "version": "0.15.58"
+      "version": "0.15.60"
     }
   },
   "components": [

package/TEST-MATRIX.json

@@ -1,6 +1,6 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.58",
+  "version": "0.15.60",
   "train": "R153",
   "primary_platform": "win32-x64",
   "reference": {

package/bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-chatgpt-bridge",
-  "version": "0.15.58",
+  "version": "0.15.60",
   "private": true,
   "type": "module",
   "engines": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.58",
+  "version": "0.15.60",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/bootstrap-uac-migration-r153.ps1

@@ -1,5 +1,5 @@
 param(
-    [Parameter(Mandatory=$true)][ValidateSet('0.15.58')][string]$ExpectedVersion,
+    [Parameter(Mandatory=$true)][ValidateSet('0.15.60')][string]$ExpectedVersion,
     [Parameter(Mandatory=$true)][string]$StateRoot,
     [Parameter(Mandatory=$true)][string]$TarballPath,
     [Parameter(Mandatory=$true)][ValidatePattern('^[0-9a-f]{64}$')][string]$ExpectedTarballSha256,
@@ -9,6 +9,7 @@ param(
     [Parameter(Mandatory=$true)][string]$StderrPath,
     [Parameter(Mandatory=$true)][string]$MarkerReceiptPath,
     [Parameter(Mandatory=$true)][ValidatePattern('^[0-9a-f]{64}$')][string]$MarkerReceiptSha256,
+    [ValidatePattern('^powershell_script=[0-9a-f]{64}$')][string]$HostCommandPin,
     [switch]$Bootstrap
 )
 $ErrorActionPreference = 'Stop'
@@ -65,6 +66,7 @@ if (-not $Bootstrap) {
         '-ExpectedManifestSha256',$ExpectedManifestSha256,'-ExpectedBootstrapSha256',$ExpectedBootstrapSha256,
         '-StdoutPath',(Quote $StdoutPath),'-StderrPath',(Quote $StderrPath),
         '-MarkerReceiptPath',(Quote $MarkerReceiptPath),'-MarkerReceiptSha256',$MarkerReceiptSha256)
+    if ($HostCommandPin) { $arguments += @('-HostCommandPin',$HostCommandPin) }
     $child = Start-Process -FilePath $powershell -ArgumentList $arguments -Verb RunAs -Wait -PassThru -WindowStyle Hidden
     if (Test-Path -LiteralPath $StdoutPath) { [Console]::Out.Write([IO.File]::ReadAllText($StdoutPath)) }
     if (Test-Path -LiteralPath $StderrPath) { [Console]::Error.Write([IO.File]::ReadAllText($StderrPath)) }
@@ -99,7 +101,7 @@ if ($LASTEXITCODE -ne 0) { throw 'R153 protected staging initial ACL normalizati
 & $icacls $prefix '/setowner' '*S-1-5-32-544' '/T' '/C' | Out-Null
 if ($LASTEXITCODE -ne 0) { throw 'R153 protected staging initial owner normalization failed' }
 
-$metadataUri = 'https://registry.npmjs.org/deadbyte-mcp/0.15.58'
+$metadataUri = 'https://registry.npmjs.org/deadbyte-mcp/0.15.60'
 $tagsUri = 'https://registry.npmjs.org/-/package/deadbyte-mcp/dist-tags'
 [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
 $metadata = Invoke-RestMethod -UseBasicParsing -Uri $metadataUri -Method Get -TimeoutSec 30
@@ -184,6 +186,12 @@ if ($actual.Count -ne $expected.Count) { throw 'R153 staged package file-count m
 if ($LASTEXITCODE -ne 0) { throw 'R153 protected staging final ACL normalization failed' }
 & $icacls $prefix '/setowner' '*S-1-5-32-544' '/T' '/C' | Out-Null
 if ($LASTEXITCODE -ne 0) { throw 'R153 protected staging final owner normalization failed' }
+# /inheritance:r with /T strips inherited Allow ACEs from leaf files.
+# The directory OI/CI grant above does not become a direct leaf ACE on Windows.
+# Restore direct access for Administrators and SYSTEM on every existing member;
+# never grant Users/Everyone, and independently re-hash all package files below.
+& $icacls $prefix '/grant' '*S-1-5-32-544:(F)' '*S-1-5-18:(F)' '/T' '/C' | Out-Null
+if ($LASTEXITCODE -ne 0) { throw 'R153 protected staging leaf ACL restoration failed' }
 
 # Re-read every manifest-bound byte after ACL normalization. The first
 # candidate JavaScript below cannot run against bytes changed in the ACL gap.
@@ -217,9 +225,11 @@ $preflight = ($preflightOutput -join "`n") | ConvertFrom-Json
 if ($preflight.state -ne 'AUTHORITY_UNVERIFIED' -or $preflight.subject_sha256 -notmatch '^[0-9a-f]{64}$') {
     throw "R153 protected migration not applicable: $($preflight.state)"
 }
-& $helper -Elevated -NodePath $node -DeployScript $deploy -StateRoot $StateRoot `
-    -StdoutPath $StdoutPath -StderrPath $StderrPath -MarkerReceiptPath $MarkerReceiptPath `
-    -MarkerReceiptSha256 $MarkerReceiptSha256 -PreflightSubjectSha256 $preflight.subject_sha256
+$helperArgs = @('-Elevated','-NodePath',$node,'-DeployScript',$deploy,'-StateRoot',$StateRoot,
+    '-StdoutPath',$StdoutPath,'-StderrPath',$StderrPath,'-MarkerReceiptPath',$MarkerReceiptPath,
+    '-MarkerReceiptSha256',$MarkerReceiptSha256,'-PreflightSubjectSha256',$preflight.subject_sha256)
+if ($HostCommandPin) { $helperArgs += @('-HostCommandPin',$HostCommandPin) }
+& $helper @helperArgs
 $helperExit = $LASTEXITCODE
 try { Remove-Item -LiteralPath $prefix -Recurse -Force -ErrorAction Stop }
 catch { [Console]::Error.WriteLine('R153_STAGE_CLEANUP_WARNING: protected stage retained for operator reconciliation') }

package/scripts/deploy-r48.mjs

@@ -24,11 +24,17 @@ const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
 function parseDeployArgs(argv){
   const out={preflight:false,approvalPath:null,approvalSha256:null,uacLegacyMigration:false,
     markerReceiptPath:null,markerReceiptSha256:null,migrationNonce:null,migrationIssuedAt:null,
-    migrationExpiresAt:null,uacApprovalPath:null,uacApprovalSha256:null};
+    migrationExpiresAt:null,uacApprovalPath:null,uacApprovalSha256:null,hostCommandPin:null};
   for(let index=0;index<argv.length;index++){
     const arg=argv[index];
     if(arg==='--preflight'){if(out.preflight)throw new Error('duplicate --preflight');out.preflight=true;continue;}
     if(arg==='--uac-legacy-migration'){if(out.uacLegacyMigration)throw new Error('duplicate --uac-legacy-migration');out.uacLegacyMigration=true;continue;}
+    if(arg==='--host-command-pin'){
+      if(out.hostCommandPin!==null)throw new Error('duplicate --host-command-pin');
+      const value=String(argv[++index]??'');
+      if(!/^powershell_script=[0-9a-f]{64}$/.test(value))throw new Error('--host-command-pin requires powershell_script=lowercase_sha256');
+      out.hostCommandPin=value;continue;
+    }
     if(arg==='--marker-reconciliation-receipt'){
       if(out.markerReceiptPath)throw new Error('duplicate --marker-reconciliation-receipt');
       const value=argv[++index];if(!value)throw new Error('--marker-reconciliation-receipt requires a path');
@@ -70,6 +76,7 @@ function parseDeployArgs(argv){
   const uacFields=[out.migrationNonce,out.migrationIssuedAt,out.migrationExpiresAt,out.uacApprovalPath,out.uacApprovalSha256];
   if(out.uacLegacyMigration&&uacFields.some(value=>!value))throw new Error('UAC migration requires nonce, lifetime, and approval receipt');
   if(!out.uacLegacyMigration&&uacFields.some(value=>value))throw new Error('UAC migration arguments require --uac-legacy-migration');
+  if(out.hostCommandPin!==null&&(!out.uacLegacyMigration||out.preflight))throw new Error('explicit host repin requires the elevated UAC migration');
   return out;
 }
 const deployArgs=parseDeployArgs(process.argv.slice(2));
@@ -313,6 +320,7 @@ const args=[
   '--bridge-root',bridgeRoot,'--bridge-script-sha256',await sha(bridgeScript),
   '--enable-machine-fs','--enable-observation','--enable-desktop','--enable-autonomous-supervisor','--recover-offline-predecessor'
 ];
+if(deployArgs.hostCommandPin!==null)args.push('--host-command-pin',deployArgs.hostCommandPin);
 let result=null,verification=null,activationOutcomePath=null;
 let continuityEngine=null,continuityUpdateId=null;
 

package/scripts/issue-uac-migration-r153.mjs

@@ -45,7 +45,7 @@ async function main(){
   if(trust.trusted!==true)fail('candidate not R89 protected');
   const pkg=JSON.parse((await read(path.join(root,'package.json'))).toString('utf8'));
   const rel=JSON.parse((await read(path.join(root,'RELEASE.json'))).toString('utf8'));
-  if(pkg.version!=='0.15.58'||rel.version!==pkg.version)fail('candidate release identity mismatch');
+  if(pkg.version!=='0.15.60'||rel.version!==pkg.version)fail('candidate release identity mismatch');
   const pointer=parseActivePointer((await read(path.join(state,'active-release.json'))).toString('utf8'));
   if(pointer.version!=='0.15.45'||rel.parent?.release_id!==pointer.release_id||
     rel.parent?.manifest_sha256!==pointer.manifest_sha256||

package/scripts/r153-prepublish-identity.mjs

@@ -6,9 +6,9 @@ import {fileURLToPath} from 'node:url';
 const defaultRoot=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
 const hex64=/^[0-9a-f]{64}$/;
 const EXPECTED=Object.freeze({
-  candidateVersion:'0.15.58', train:'R153',
-  sourceVersion:'0.15.55',
-  sourceSha256:'dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760',
+  candidateVersion:'0.15.60', train:'R153',
+  sourceVersion:'0.15.59',
+  sourceSha256:'0c20152b8ee553f06f05dfe017f4bd823d30cd50710722e9e0874f0bd6c66c75',
   runtimeVersion:'0.15.45',
   runtimeReleaseId:'v0.15.45-34aa8d1241cfb8bf',
   runtimeManifest:'34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc',

package/scripts/request-uac-migration-r153.ps1

@@ -7,6 +7,7 @@ param(
     [Parameter(Mandatory=$true)][string]$MarkerReceiptPath,
     [Parameter(Mandatory=$true)][ValidatePattern('^[0-9a-f]{64}$')][string]$MarkerReceiptSha256,
     [ValidatePattern('^[0-9a-f]{64}$')][string]$PreflightSubjectSha256,
+    [ValidatePattern('^powershell_script=[0-9a-f]{64}$')][string]$HostCommandPin,
     [switch]$Elevated
 )
 $ErrorActionPreference = 'Stop'
@@ -99,6 +100,7 @@ if (-not $Elevated) {
     # -Verb RunAs is the UseShellExecute parameter set. PowerShell 5.1 rejects
     # -RedirectStandardOutput/-RedirectStandardError in that same Start-Process.
     # The elevated child writes bounded, no-clobber evidence instead.
+    if ($HostCommandPin) { $arguments += @('-HostCommandPin',$HostCommandPin) }
     $child = Start-Process -FilePath $powershell -ArgumentList $arguments -Verb RunAs -Wait -PassThru -WindowStyle Hidden
     if (Test-Path -LiteralPath $StdoutPath) { [Console]::Out.Write([IO.File]::ReadAllText($StdoutPath)) }
     if (Test-Path -LiteralPath $StderrPath) { [Console]::Error.Write([IO.File]::ReadAllText($StderrPath)) }
@@ -135,14 +137,16 @@ try {
     $priorErrorAction = $ErrorActionPreference
     $ErrorActionPreference = 'Continue'
     try {
-        $deployOutput = @(& $NodePath $DeployScript '--uac-legacy-migration' `
-            '--marker-reconciliation-receipt' $MarkerReceiptPath `
-            '--marker-reconciliation-receipt-sha256' $MarkerReceiptSha256 `
-            '--migration-nonce' $issued.nonce `
-            '--migration-issued-at' $issued.issued_at_utc `
-            '--migration-expires-at' $issued.expires_at_utc `
-            '--uac-approval-receipt' $issued.receipt_path `
-            '--uac-approval-receipt-sha256' $issued.receipt_sha256 2>&1)
+        $deployArgs = @('--uac-legacy-migration',
+            '--marker-reconciliation-receipt',$MarkerReceiptPath,
+            '--marker-reconciliation-receipt-sha256',$MarkerReceiptSha256,
+            '--migration-nonce',$issued.nonce,
+            '--migration-issued-at',$issued.issued_at_utc,
+            '--migration-expires-at',$issued.expires_at_utc,
+            '--uac-approval-receipt',$issued.receipt_path,
+            '--uac-approval-receipt-sha256',$issued.receipt_sha256)
+        if ($HostCommandPin) { $deployArgs += @('--host-command-pin',$HostCommandPin) }
+        $deployOutput = @(& $NodePath $DeployScript @deployArgs 2>&1)
         $deployExit = $LASTEXITCODE
     } finally { $ErrorActionPreference = $priorErrorAction }
     $deployText = (@($deployOutput) | ForEach-Object { [string]$_ }) -join "`n"

package/src/activation-lock-r65.mjs

@@ -85,6 +85,41 @@ async function isSafeTerminalActivation(outcome,lock,stateRoot){
   return true;
 }
 
+async function isSafeSignedPreconditionReject(outcome,lock,stateRoot){
+  if(!outcomeMatchesLock(outcome,lock)||outcome?.outcome?.state!=='ACTIVATION_OUTCOME_UNKNOWN'||
+    outcome.update_id!==null||outcome.state_path!==null||outcome.continuity_update_id!==null||
+    typeof outcome.candidate_version!=='string'||!HEX64.test(String(outcome.candidate_manifest_sha256??''))||
+    typeof outcome.predecessor_release_id!=='string')return false;
+  const lockTime=Date.parse(lock.created_at_utc),observedTime=Date.parse(outcome.observed_at_utc);
+  if(!Number.isFinite(observedTime)||observedTime<lockTime||observedTime-lockTime>120000)return false;
+  const updatesDir=path.join(path.resolve(stateRoot),'evidence','updates');
+  let current,publicKey,files;
+  try{
+    current=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+    publicKey=createPublicKey(await readFile(path.join(stateRoot,'trust','ed25519-public.pem')));
+    files=await readdir(updatesDir,{withFileTypes:true});
+  }catch{return false;}
+  if(publicKey.asymmetricKeyType!=='ed25519'||current?.release_id!==outcome.predecessor_release_id)return false;
+  const prefix='r27-'+outcome.candidate_manifest_sha256.slice(0,16)+'-';
+  const candidates=files.filter(f=>f.name.startsWith(prefix)&&/^r27-[a-f0-9]{16}-[a-z0-9-]+$/.test(f.name));
+  if(candidates.length!==1||!candidates[0].isDirectory()||candidates[0].isSymbolicLink())return false;
+  let signed;
+  try{signed=JSON.parse(await readFile(path.join(updatesDir,candidates[0].name,'failure-receipt.json'),'utf8'));}
+  catch{return false;}
+  if(!verifySlotUpdateEnvelope(signed,publicKey))return false;
+  const body=signed.body,failedTime=Date.parse(body?.failed_at_utc??'');
+  if(body?.schema!=='deadbyte.r27-slot-update-failure.v1'||
+     body.update_id!==candidates[0].name||body.release_version!==outcome.candidate_version||
+     body.candidate_manifest_sha256!==outcome.candidate_manifest_sha256||
+     body.result!=='PRECONDITION_REJECTED'||body.phase!=='initial'||
+     body.attempted_pointer!==null||body.rollback?.attempted!==false||
+     !Array.isArray(body.rollback?.errors)||body.rollback.errors.length!==0||
+     !/^host command 'powershell_script' executable pin drift detected;/.test(String(body.error?.message??''))||
+     !Number.isFinite(failedTime)||failedTime<lockTime||failedTime>observedTime||
+     !samePointerIdentity(body.prior_pointer,current))return false;
+  return true;
+}
+
 async function findTerminalOutcome(updatesDir,lock,stateRoot){
   const names=(await readdir(updatesDir)).filter(name=>/^r65-activation-outcome-.*\.json$/.test(name)).sort();
   if(names.length>MAX_OUTCOME_SCAN)throw new Error('activation outcome inventory exceeds safe scan budget');
@@ -95,7 +130,8 @@ async function findTerminalOutcome(updatesDir,lock,stateRoot){
     catch{continue;}
     if(value?.claim_operation_id!==lock.operation_id)continue;
     if(value?.preflight_subject_sha256!==lock.subject_sha256){foreign=true;continue;}
-    if(isSafePreMutationReject(value,lock)||await isSafeTerminalActivation(value,lock,stateRoot))matched=true;
+    if(isSafePreMutationReject(value,lock)||await isSafeTerminalActivation(value,lock,stateRoot)||
+       await isSafeSignedPreconditionReject(value,lock,stateRoot))matched=true;
     else unknown=true;
   }
   return {matched,foreign,unknown};

package/src/clean-activation-recovery-r153.mjs

@@ -32,7 +32,7 @@ export function classifyLegacyMigration(input){
   if(!input.pointer||input.pointer.version!=='0.15.45'||
     !HEX64.test(String(input.pointer.manifest_sha256??''))||!HEX64.test(String(input.pointer.generation_manifest_sha256??'')))
     return reject('predecessor identity invalid',subject);
-  if(!input.candidate||input.candidate.version!=='0.15.58'||
+  if(!input.candidate||input.candidate.version!=='0.15.60'||
     !HEX64.test(String(input.candidate.manifest_sha256??''))||!HEX64.test(String(input.candidate.tarball_sha256??'')))
     return reject('candidate identity invalid',subject);
   if(PLANES.some(plane=>!HEX64.test(String(input.policySha256?.[plane]??''))))

package/src/deadbyte-cli.mjs

@@ -114,7 +114,7 @@ async function reportVersionCoherence(root,{displayMode='ascii'}={}){
   writeRemote(process.stderr,`${remoteTag('warn',displayMode)} VERSION SKEW: CLI package ${DEADBYTE_VERSION}; active runtime ${active.version} (${active.release_id})\n`,displayMode);
   return active;
 }
-async function synchronizeForegroundRuntime(ctx,{displayMode='unicode',migrationContext=null}={}){
+async function synchronizeForegroundRuntime(ctx,{displayMode='unicode',migrationContext=null,hostCommandPin=null}={}){
   const packageManifestSha256=createHash('sha256').update(await readFile(path.join(CURRENT_PACKAGE_ROOT,'MANIFEST.SHA256'))).digest('hex');
   return ensureRuntimeCoherence({
     cliVersion:DEADBYTE_VERSION,
@@ -181,7 +181,8 @@ async function synchronizeForegroundRuntime(ctx,{displayMode='unicode',migration
             '-ExpectedTarballSha256',artifactSha256,'-ExpectedManifestSha256',packagedManifestSha256,
             '-ExpectedBootstrapSha256',bootstrapMatch[1],
             '-StdoutPath',stdoutPath,'-StderrPath',stderrPath,
-            '-MarkerReceiptPath',migrationContext.receipt_path,'-MarkerReceiptSha256',migrationContext.receipt_sha256],{
+            '-MarkerReceiptPath',migrationContext.receipt_path,'-MarkerReceiptSha256',migrationContext.receipt_sha256,
+            ...(hostCommandPin?['-HostCommandPin',hostCommandPin]:[])],{
             cwd:CURRENT_PACKAGE_ROOT,env:windowsPowerShellEnvironment(process.env),encoding:'utf8',windowsHide:true,shell:false,
             timeout:REMOTE_UPDATE_TIMEOUT_MS,maxBuffer:16*1024*1024
           });
@@ -743,7 +744,7 @@ async function releaseRemoteSession(ctx,marker,{displayMode='unicode'}={}){
   if(deletePinnedRemoteMarker(remoteSessionMarker(ctx.root),snapshot.sha256)!=='REMOVED')
     throw new Error('remote session ownership marker replaced before native deletion; marker retained');
 }
-async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,filterExpression='',mode='default'}={}){
+async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,filterExpression='',mode='default',hostCommandPin=null}={}){
   const display=prepareRemoteConsole();
   const displayMode=display.mode;
   const ctx=await remoteContext();
@@ -755,7 +756,7 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     startupLock.assertHeld();
     const migrationContext=await recoverRemoteSession(ctx,{displayMode});
     startupLock.assertHeld();
-    await synchronizeForegroundRuntime(ctx,{displayMode,migrationContext});
+    await synchronizeForegroundRuntime(ctx,{displayMode,migrationContext,hostCommandPin});
     startupLock.assertHeld();
     marker=await claimRemoteSession(ctx);
     startupLock.assertHeld();
@@ -868,12 +869,18 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
   }
 }
 async function runRemote(args){
-  let verbose=false,trace=false,filterExpression='',resumeCursor=null,mode='default';
+  let verbose=false,trace=false,filterExpression='',resumeCursor=null,mode='default',hostCommandPin=null;
   const positional=[];
   for(let index=0;index<args.length;index++){
     const arg=args[index];
     if(arg==='--verbose'||arg==='-v'){verbose=true;continue;}
     if(arg==='--trace'){trace=true;continue;}
+    if(arg==='--host-command-pin'){
+      if(hostCommandPin!==null)throw new Error('remote --host-command-pin may be specified once');
+      const value=String(args[++index]??'');
+      if(!/^powershell_script=[0-9a-f]{64}$/.test(value))throw new Error('remote --host-command-pin requires powershell_script=lowercase_sha256');
+      hostCommandPin=value;continue;
+    }
     if(['--operator','--desktop','--host','--full'].includes(arg)){
       if(mode!=='default') throw new Error('remote authority modes are mutually exclusive');
       mode=arg.slice(2);continue;
@@ -890,8 +897,8 @@ async function runRemote(args){
     }
     positional.push(arg);
   }
-  const presentation=verbose||trace||Boolean(filterExpression)||resumeCursor!==null||mode!=='default';
-  if(positional.length===0){await runRemoteSession({resumeCursor,verbose,trace,filterExpression,mode});return;}
+  const presentation=verbose||trace||Boolean(filterExpression)||resumeCursor!==null||mode!=='default'||hostCommandPin!==null;
+  if(positional.length===0){await runRemoteSession({resumeCursor,verbose,trace,filterExpression,mode,hostCommandPin});return;}
   if(presentation) throw new Error('remote presentation flags are valid only for foreground session');
   if(positional.length>1) throw new Error('remote accepts one controller command');
   const command=positional[0];if(!REMOTE_COMMANDS.has(command)) throw new Error(`unsupported remote command '${command}'`);

package/src/uac-approval-contract-r153.mjs

@@ -58,7 +58,7 @@ export function uacReceiptSubject(input){
   const candidate=windowsAbsolute(input.candidateRoot,'candidate root');
   if(!candidate.startsWith('c:\\program files\\')||candidate==='c:\\program files\\')
     throw new Error('UAC migration requires a protected candidate installation');
-  if(input.candidateVersion!=='0.15.58')throw new Error('UAC migration candidate identity unsupported');
+  if(input.candidateVersion!=='0.15.60')throw new Error('UAC migration candidate identity unsupported');
   const hashes=['candidateManifestSha256','tarballSha256','markerReceiptSha256','predecessorPointerSha256',
     'preflightSubjectSha256','nodeSha256','deployScriptSha256','nonce'];
   for(const key of hashes)if(!HEX64.test(String(input[key]??'')))throw new Error('UAC approval hash/nonce invalid: '+key);

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.58';
+export const DEADBYTE_VERSION = '0.15.60';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/r130-release-security-contract.test.mjs

@@ -13,15 +13,15 @@ test('R130 security patch has a new immutable package identity and truthful sour
     read('SBOM.cdx.json'),read('package-lock.json'),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.58');
+    assert.equal(actual,'0.15.60');
   assert.equal(release.train,'R153');
   assert.equal(matrix.train,'R153');
-  assert.equal(release.source_predecessor.version,'0.15.55');
-  assert.match(release.source_predecessor.source_path,/0\.15\.55/);
+  assert.equal(release.source_predecessor.version,'0.15.59');
+  assert.match(release.source_predecessor.source_path,/0\.15\.59/);
   assert.equal(release.runtime_predecessor.version,'0.15.45');
-  assert.equal(provenance.source_predecessor_tarball_sha256,'dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760');
-  assert.equal(provenance.source_predecessor_version,'0.15.55');
-  assert.equal(provenance.source_predecessor_manifest_file_sha256,'96e243c87ac01a6769643179201ac3ca3dc900d1d72f71fbf272a853846a4891');
+  assert.equal(provenance.source_predecessor_tarball_sha256,'0c20152b8ee553f06f05dfe017f4bd823d30cd50710722e9e0874f0bd6c66c75');
+  assert.equal(provenance.source_predecessor_version,'0.15.59');
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,'f727be4a63220f4215f18282a1fd89963924a64adcd07747ca3c12d8fb166d86');
   assert.equal(pkg.dependencies['@modelcontextprotocol/client'],'2.3.1');
   assert.equal(pkg.dependencies['@modelcontextprotocol/server'],'2.3.1');
   for(const dep of ['@modelcontextprotocol/client','@modelcontextprotocol/server'])

package/test/r132-release-identity.test.mjs

@@ -17,12 +17,12 @@ test('R144 package identities, R132 historic evidence and published predecessor
   }
   assert.equal(release.train,'R153');
   assert.equal(matrix.train,'R153');
-  assert.equal(release.source_predecessor.version,'0.15.55');
-  assert.match(release.source_predecessor.source_path,/0\.15\.55/);
-  assert.equal(prov.source_predecessor_version,'0.15.55');
-  assert.equal(prov.source_predecessor_manifest_file_sha256,'96e243c87ac01a6769643179201ac3ca3dc900d1d72f71fbf272a853846a4891');
-  assert.equal(prov.parent_tarball_sha256,'dae555680b904da0a4d62d418f51b7579278268888bd9e2389d60453d4e10760');
-  assert.equal(prov.parent_registry_tarball_sha1,'6a51d2253b3bf594fda5b7b52a3aafa9ef9d04fb');
+  assert.equal(release.source_predecessor.version,'0.15.59');
+  assert.match(release.source_predecessor.source_path,/0\.15\.59/);
+  assert.equal(prov.source_predecessor_version,'0.15.59');
+  assert.equal(prov.source_predecessor_manifest_file_sha256,'f727be4a63220f4215f18282a1fd89963924a64adcd07747ca3c12d8fb166d86');
+  assert.equal(prov.parent_tarball_sha256,'0c20152b8ee553f06f05dfe017f4bd823d30cd50710722e9e0874f0bd6c66c75');
+  assert.equal(prov.parent_registry_tarball_sha1,'04cc1a1e80bcb7062ac39eee6b7bab70edd5d8c3');
   assert.equal(release.runtime_predecessor.version,'0.15.45');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);
   assert.equal(prov.runtime_predecessor.manifest_sha256,release.runtime_predecessor.manifest_sha256);

package/test/r153-clean-activation-recovery.test.mjs

@@ -22,7 +22,7 @@ const planes=['process','coding','autonomous','desktop','host'];
 const base=()=>({
   stateRoot:'C:\\Users\\owner\\.deadbyte-mcp',
   pointer:{release_id:'v0.15.45-parent',version:'0.15.45',manifest_sha256:'1'.repeat(64),generation_manifest_sha256:'2'.repeat(64)},
-  candidate:{version:'0.15.58',manifest_sha256:'3'.repeat(64),tarball_sha256:'4'.repeat(64)},
+  candidate:{version:'0.15.60',manifest_sha256:'3'.repeat(64),tarball_sha256:'4'.repeat(64)},
   observation:{state:'OFFLINE',local_ready:false,bridge:{alive:false},core:{alive:false},cloud:{alive:false},supervisor:{running:false},
     authority:Object.fromEntries(planes.map(plane=>[plane,{configured:true,armed:false,reason:plane==='autonomous'?'unverified':'disarmed'}]))},
   policySha256:Object.fromEntries(planes.map((plane,index)=>[plane,String(index+5).repeat(64)])),
@@ -55,7 +55,7 @@ test('R153 RED: UAC subject binds candidate, predecessor, policy, marker, state
     issuedAt:'2026-10-23T16:00:00.000Z',expiresAt:'2026-10-23T16:10:00.000Z'});
   assert.equal(subject.action,'narrow_legacy_policy_and_activate');
   assert.equal(subject.marker_sha256,HEX);
-  assert.equal(subject.candidate.version,'0.15.58');
+  assert.equal(subject.candidate.version,'0.15.60');
   assert.equal(subject.nonce,'b'.repeat(64));
   assert.deepEqual(subject.allowed_authority_after,Object.fromEntries(planes.map(plane=>[plane,false])));
 });

package/test/r153-r60-host-repin-e2e-contract.test.mjs

@@ -0,0 +1,30 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+const root=new URL('../',import.meta.url);
+const source=async path=>readFile(new URL(path,root),'utf8');
+
+test('R60 explicit host-command pin is owner supplied and forwarded end to end',async()=>{
+  const [cli,bootstrap,helper,deploy]=await Promise.all([
+    source('src/deadbyte-cli.mjs'),source('scripts/bootstrap-uac-migration-r153.ps1'),
+    source('scripts/request-uac-migration-r153.ps1'),source('scripts/deploy-r48.mjs')]);
+  assert.match(cli,/arg===['"]--host-command-pin['"]/, 'remote CLI must parse a bounded owner-supplied pin');
+  assert.match(cli,/hostCommandPin/, 'remote must preserve the parsed pin');
+  assert.match(bootstrap,/HostCommandPin/, 'protected UAC bootstrap must receive the owner pin');
+  assert.match(helper,/HostCommandPin/, 'protected helper must carry the pin without shell injection');
+  assert.match(deploy,/hostCommandPin/, 'deploy must pass pin to R27 before activation');
+  assert.match(deploy,/explicit host repin requires the elevated UAC migration/);
+});
+
+test('R60 malformed, unrelated, and duplicate pins fail before remote context or activation',()=>{
+  const cli=fileURLToPath(new URL('../src/deadbyte-cli.mjs',import.meta.url));
+  const cases=[['powershell_script=notahash'],['other_command='+'a'.repeat(64)],
+    ['powershell_script='+'a'.repeat(64),'--host-command-pin','powershell_script='+'b'.repeat(64)]];
+  for(const args of cases){
+    const p=spawnSync(process.execPath,[cli,'remote','--host-command-pin',...args],{encoding:'utf8',timeout:8000});
+    assert.equal(p.status,1,JSON.stringify(args));
+    assert.match(p.stderr,/remote --host-command-pin/);
+  }
+});

package/test/r153-r65-signed-precondition-recovery.test.mjs

@@ -0,0 +1,58 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash,generateKeyPairSync,sign as signBytes} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {canonicalJson} from '../src/canonical-json.mjs';
+import {createActivationClaimManager} from '../src/activation-lock-r65.mjs';
+
+const sha=buffer=>createHash('sha256').update(buffer).digest('hex');
+const domain=Buffer.from('DEADBYTE-R27-SLOT-UPDATE-V1\0','utf8');
+const now=()=>new Date().toISOString();
+function seal(body,key,pub){
+  const payload=Buffer.from(canonicalJson(body));
+  const signature=signBytes(null,Buffer.concat([domain,payload]),key).toString('base64');
+  const e={body,body_sha256:sha(payload),attestation:{algorithm:'ed25519',domain:'DEADBYTE-R27-SLOT-UPDATE-V1',
+    key_id:sha(pub.export({type:'spki',format:'der'})),signature_base64:signature}};
+  return {...e,receipt_sha256:sha(Buffer.from(canonicalJson(e)))};
+}
+
+test('signed R27 initial precondition reject safely reconciles R65 unknown claim',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r153-precondition-'));
+  try{
+    const updates=path.join(root,'evidence','updates');
+    await mkdir(updates,{recursive:true});await mkdir(path.join(root,'trust'),{recursive:true});
+    const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+    await writeFile(path.join(root,'trust','ed25519-public.pem'),publicKey.export({type:'spki',format:'pem'}));
+    const manager=createActivationClaimManager({stateRoot:root}),claim=await manager.claim('a'.repeat(64));
+    const pointer={schema:'deadbyte.active-release.v1',release_id:'predecessor-r153',version:'0.15.45',
+      manifest_sha256:'b'.repeat(64),generation_manifest_sha256:'c'.repeat(64)};
+    await writeFile(path.join(root,'active-release.json'),JSON.stringify(pointer));
+    const dir=path.join(updates,'r27-'+'d'.repeat(16)+'-synthetic');
+    await mkdir(dir);
+    const failure=seal({schema:'deadbyte.r27-slot-update-failure.v1',update_id:path.basename(dir),
+      release_version:'0.15.60',candidate_manifest_sha256:'d'.repeat(64),failed_at_utc:now(),
+      result:'PRECONDITION_REJECTED',phase:'initial',error:{name:'Error',message:"host command 'powershell_script' executable pin drift detected; explicit approval required"},
+      prior_pointer:pointer,attempted_pointer:null,rollback:{attempted:false,errors:[]}},privateKey,publicKey);
+    await writeFile(path.join(dir,'failure-receipt.json'),JSON.stringify(failure));
+    await writeFile(path.join(updates,'r65-activation-outcome-test.json'),JSON.stringify({
+      schema:'deadbyte.r65-activation-outcome.v1',claim_operation_id:claim.operation_id,
+      preflight_subject_sha256:claim.subject_sha256,candidate_version:'0.15.60',
+      candidate_manifest_sha256:'d'.repeat(64),predecessor_release_id:pointer.release_id,
+      outcome:{state:'ACTIVATION_OUTCOME_UNKNOWN'},update_id:null,continuity_update_id:null,state_path:null,observed_at_utc:now()
+    }));
+    // A tampered signed envelope must not authorize reclaim.
+    const failurePath=path.join(dir,'failure-receipt.json');
+    await writeFile(failurePath,JSON.stringify({...failure,body:{...failure.body,phase:'committing'}}));
+    await assert.rejects(()=>manager.claim('e'.repeat(64)),/unresolved|in progress/);
+    await writeFile(failurePath,JSON.stringify(failure));
+    // Even a valid signature cannot authorize reclaim if the live pointer changed.
+    await writeFile(path.join(root,'active-release.json'),JSON.stringify({...pointer,release_id:'foreign-runtime'}));
+    await assert.rejects(()=>manager.claim('e'.repeat(64)),/unresolved|in progress/);
+    await writeFile(path.join(root,'active-release.json'),JSON.stringify(pointer));
+    const next=await manager.claim('e'.repeat(64));
+    assert.notEqual(next.operation_id,claim.operation_id);
+    await next.release();
+  }finally{await rm(root,{recursive:true,force:true})}
+});

package/test/r153-staging-leaf-acl.test.mjs

@@ -0,0 +1,47 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import {fileURLToPath} from 'node:url';
+import {spawnSync} from 'node:child_process';
+
+const bootstrap=readFileSync(fileURLToPath(new URL('../scripts/bootstrap-uac-migration-r153.ps1',import.meta.url)),'utf8');
+
+test('R153 ACL hotfix grants direct leaf read only to Administrators and SYSTEM before rehash',()=>{
+  const start=bootstrap.indexOf("R153 protected staging final ACL normalization failed");
+  const repair=bootstrap.indexOf("'*S-1-5-32-544:(F)' '*S-1-5-18:(F)' '/T' '/C'");
+  const rehash=bootstrap.indexOf('R153 staged package post-ACL verification failed');
+  assert.ok(start>=0&&repair>start&&rehash>repair,'ACL repair must follow recursive inheritance stripping and precede independent rehash');
+  assert.match(bootstrap,/R153 protected staging leaf ACL restoration failed/);
+  assert.doesNotMatch(bootstrap.slice(start,rehash),/S-1-5-32-545:\(F\)|Everyone:\(F\)/);
+});
+
+test('R153 Windows ACL reproduction rejects stripped leaf ACE and restores direct read', {skip:process.platform!=='win32'},()=>{
+  const ps=String.raw`$ErrorActionPreference = 'Stop'
+$root = Join-Path $env:TEMP ('r153-native-acl-test-' + [guid]::NewGuid().ToString('N'))
+$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+$leaf = Join-Path $root 'child\file.txt'
+try {
+  New-Item -ItemType Directory -Path (Split-Path -Parent $leaf) -Force | Out-Null
+  [IO.File]::WriteAllText($leaf,'read-only regression fixture')
+  & icacls.exe $root '/inheritance:r' '/grant:r' ('*'+$sid+':(OI)(CI)(F)') '/T' '/C' | Out-Null
+  if($LASTEXITCODE -ne 0){throw 'REPRO_SETUP_FAILED'}
+  $blocked = Get-FileHash -LiteralPath $leaf -Algorithm SHA256 -ErrorAction SilentlyContinue
+  if($null -ne $blocked){throw 'REPRO_DID_NOT_STRIP_LEAF_ACE'}
+  & icacls.exe $root '/grant' ('*'+$sid+':(F)') '/T' '/C' | Out-Null
+  if($LASTEXITCODE -ne 0){throw 'LEAF_REPAIR_FAILED'}
+  $restored = Get-FileHash -LiteralPath $leaf -Algorithm SHA256
+  if($null -eq $restored -or $restored.Hash.Length -ne 64){throw 'LEAF_NOT_READABLE_AFTER_REPAIR'}
+  $acl = Get-Acl -LiteralPath $leaf
+  $allow=@($acl.Access | Where-Object {$_.AccessControlType -eq 'Allow'})
+  if($allow.Count -ne 1){throw 'LEAF_HAS_UNEXPECTED_ALLOW_ACE_COUNT'}
+  if($allow[0].IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value -ne $sid){throw 'LEAF_HAS_UNEXPECTED_TRUSTEE'}
+  Write-Output 'R153_WIN32_LEAF_ACL_REPAIR_PASS'
+} finally {
+  if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Force -Recurse}
+}`;
+  const encoded=Buffer.from(ps,'utf16le').toString('base64');
+  const result=spawnSync('powershell.exe',['-NoLogo','-NoProfile','-NonInteractive','-EncodedCommand',encoded],
+    {encoding:'utf8',timeout:30000,maxBuffer:256*1024});
+  assert.equal(result.status,0,result.stderr||result.stdout||String(result.error));
+  assert.match(result.stdout,/R153_WIN32_LEAF_ACL_REPAIR_PASS/);
+});

package/test/r153-uac-approval-contract.test.mjs

@@ -4,7 +4,7 @@ import {createUacApproval,verifyUacApproval,validateApprovalWindow,requireTruste
 import {readFileSync} from 'node:fs';
 import {fileURLToPath} from 'node:url';
 const h=(n)=>n.repeat(64);
-const base=()=>({stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp',candidateRoot:'C:\\Program Files\\DEADBYTE-R153-TEST',candidateVersion:'0.15.58',candidateManifestSha256:h('a'),tarballSha256:h('b'),markerReceiptSha256:h('c'),predecessorPointerSha256:h('d'),predecessorPolicySha256:{process:h('1'),coding:h('2'),autonomous:h('3'),desktop:h('4'),host:h('5')},preflightSubjectSha256:h('e'),nodeSha256:h('f'),deployScriptSha256:h('0'),nonce:h('6'),issuedAt:'2026-10-24T00:00:00.000Z',expiresAt:'2026-10-24T00:05:00.000Z'});
+const base=()=>({stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp',candidateRoot:'C:\\Program Files\\DEADBYTE-R153-TEST',candidateVersion:'0.15.60',candidateManifestSha256:h('a'),tarballSha256:h('b'),markerReceiptSha256:h('c'),predecessorPointerSha256:h('d'),predecessorPolicySha256:{process:h('1'),coding:h('2'),autonomous:h('3'),desktop:h('4'),host:h('5')},preflightSubjectSha256:h('e'),nodeSha256:h('f'),deployScriptSha256:h('0'),nonce:h('6'),issuedAt:'2026-10-24T00:00:00.000Z',expiresAt:'2026-10-24T00:05:00.000Z'});
 test('R153 UAC receipt carries exact no-grants narrow migration subject',()=>{
   const x=base(),receipt=createUacApproval(x);
   assert.equal(receipt.schema,'deadbyte.r153-uac-approval.v1');
@@ -31,7 +31,7 @@ test('R153 UAC receipt fails closed on expiration, malformed, replay-like tamper
   assert.throws(()=>createUacApproval({...x,issuedAt:'not-a-date'}));
   assert.throws(()=>createUacApproval({...x,nonce:'x'}));
 });
-test('R153 UAC scope only accepts protected root and exact v0.15.58',()=>{
+test('R153 UAC scope only accepts protected root and exact v0.15.60',()=>{
   assert.throws(()=>createUacApproval({...base(),candidateRoot:'C:\\Users\\DEADBYTE\\npm-cache'}),/protected/i);
   assert.throws(()=>createUacApproval({...base(),candidateVersion:'0.15.55'}),/candidate/i);
   assert.throws(()=>validateApprovalWindow('2026-10-24T00:00:00.000Z','2026-10-24T00:00:00.000Z','2026-10-24T00:00:00.000Z'));

package/test/r153-uac-launch-parameter-contract.test.mjs

@@ -45,7 +45,7 @@ test('R153 RED: mutable npx entrypoint stages exact registry package before priv
   assert.doesNotMatch(script,/npm-cli\.js|npm install/i);
   assert.match(script,/Get-FileHash -LiteralPath \$file -Algorithm SHA256/);
   assert.match(script,/NODE_OPTIONS/);
-  assert.match(script,/https:\/\/registry\.npmjs\.org\/deadbyte-mcp\/0\.15\.58/);
+  assert.match(script,/https:\/\/registry\.npmjs\.org\/deadbyte-mcp\/0\.15\.60/);
   assert.match(script,/live npm registry tarball SHA-256 mismatch/);
   assert.match(script,/live npm registry tarball integrity mismatch/);
   assert.match(script,/DEADBYTE-R153-Stage-/);
@@ -54,6 +54,7 @@ test('R153 RED: mutable npx entrypoint stages exact registry package before priv
   assert.match(script,/'\/inheritance:r'/);
   assert.match(script,/verify-protected-stage-r153\.mjs/);
   assert.match(script,/request-uac-migration-r153\.ps1/);
-  assert.match(script,/& \$helper -Elevated/);
+  assert.match(script,/\$helperArgs\s*=\s*@\('-Elevated'/);
+  assert.match(script,/& \$helper @helperArgs/);
   assert.match(script,/Remove-Item -LiteralPath \$prefix -Recurse -Force/);
 });

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');