deadbyte-mcp 0.15.63 → 0.15.64

package/MANIFEST.SHA256

@@ -30,7 +30,7 @@ c814771dddac8bfb184250b868ddb6ab9f5e0e43613c04c3ed8abe09324ec4db  bin/deadbyte-n
 daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4  bin/deadbyte-process-host.exe
 b55d2c4490dfb875d40f29a69df2addc5d579991cb7d094674c04d369dfcfac3  bin/deadbyte-tunnel-host.exe
 f0ce7acb1e41325cef8b6789f95bd78b6a6107423773eace57a12b49faa55095  bin/WORKER-REGISTRY.txt
-c2391bfe4b845818903ce862ee8080010d0354f3bb40097489f637d2c6c9f58c  bridge/package.json
+9ff9a160f9b098bab32318a880b45348d4bdf58062528a4533e24dfab755c540  bridge/package.json
 f99413d82f84c808f52d5b8696c190a9142dd08f517f5ec3e442f0769402d189  bridge/src/bridge-health-r59.mjs
 fa0dcc4cde9c03e978c9f9dd24b62afa83f49bdada1f42ead544a9a17edd332f  bridge/src/bridge.mjs
 471f41c84c5b339cd81a708a4f36d4470e614946817ad2f9fca295dde2c83fb6  bridge/src/canonical-json-r60.mjs
@@ -46,7 +46,7 @@ fedd83eaf14a493db077a0a239eeb68df4e19f075c971a9ff4419bb6e5ab86e3  controller/dea
 331d168750a18d2b8e351796ddbf8f9619374c707c3cea18b8b166934f8af0d3  controller/deadbyte-desktop-policy.json
 5e8ef223b0dbc52173aaf044a075837eef8964ff0e7e16f83a595e0d17695625  controller/deadbyte-host-policy.json.example
 6f0cc469f51444dd18211fa3346c826abeea4d2ec7a8945f0200dc5c622031ef  controller/DEADBYTE-MCP.cmd
-a390f6c8cc658175107135ddf247ef4466d43f056a5139133b3a4e3eb614fc50  controller/deadbyte-process-policy.json
+75fb431f504d9df903946a85d6484b572df3041727b737b194e55b1110629d45  controller/deadbyte-process-policy.json
 d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b  controller/deadbyte-semantic-lsp-config.json
 3023d2985f5b6e5cc7c0d08cb8b342b362c93dce7ebd4224635362194be40cf2  controller/README.TXT
 101e613518c73c6aa31c725fe1b5f9a24c995dc9876b7b28e1f3e97ac9f8d362  DEADBYTE-MCP-R27-FINAL/R27-ADMIN-CLOSURE.json
@@ -696,6 +696,7 @@ a7d00bfd54525bc694b6e32f64c7ebcf5e6b7ae3657be5cc12767bce74654a47  node_modules/t
 7b6976eec43edfa68b79a459dd089c56b7a395916dbf1a01bd11e6d86e12128f  node_modules/typescript/SECURITY.md
 1af3c68039c57e539422da82a4faada506ce6d0ea6f90e0b699d02dbcdb7a90c  node_modules/typescript/ThirdPartyNoticeText.txt
 055f0ac4eed1a1591d033d59462972968bf3483b4cc07e163589569c0fb999f0  node_modules/which/bin/node-which
+89bc599ca0b3a119d711c62855b2e3619b734bf371ef55dcc049454313f9904e  node_modules/which/CHANGELOG.md
 4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b  node_modules/which/LICENSE
 43010039ed5e89f7186960be682b3cb5cda5ab6cdfb06cbfd4f081cf0e7b4260  node_modules/which/package.json
 0c91f714f46006bc9a543e629a3ce3b63700fa8cfbe7c6310a0bcff2738356dd  node_modules/which/README.md
@@ -1418,8 +1419,8 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-f8884d6c9deae08ffc5ddde0ddafd4c17e46a29e3f74917dda240e3e54caf9a0  package.json
-05da8b2303386d83427ec71b07e7c2ff5fc7724d6cfe5063a7bce89246e13651  PROVENANCE.json
+3699f1d462584dcbf099dc6ac6f6da7e7443faa3436116f66d1acce352942bde  package.json
+ffd38750894f30646fa7d4f68ef3d4314342dd6e891d09282fc702a15d4c1720  PROVENANCE.json
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
 0b7ec5ee347ddfa6cca59740fc7a8fe3fc5d51406265bb12189e82fa106319d2  R41-PARENT.json
 bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.json
@@ -1428,9 +1429,9 @@ f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.jso
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
 3dc607603fea511e2f428e9546a875ab7e38b6a0bbd5e803e4510de082f30804  R49-PARENT.json
-c24e89af308ed6dcf97f6cfca14e65e1b2b975038c2d579422e3baa489d0cc11  README.txt
-787e4d9733fef6ee035a068cf739d2a698da403505062a46514063b5d1433471  RELEASE.json
-b632562ee1d3aed41ad1bdbf47fd193e7bbdb3d61aa46ce96537ba49a43b756a  SBOM.cdx.json
+4f0e601ec39d7eb2c5f16b2a12aab33453cb243663caa71524e607b9be59edc7  README.txt
+6e1cc08629c22727c66a6e5cdf05849f024eb1bfb95fce60deb23bc006bbfe4b  RELEASE.json
+6ec3c9451c85c52758ab3c52b8b8724c72803420728c5c6928092d6c57f99ee8  SBOM.cdx.json
 7c86062c4f69db3179a129d65945ccfab1b1c1c5bcc29b91383eac097d50f2aa  scripts/activate-skill-creator-1.1.1.mjs
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
@@ -1517,6 +1518,7 @@ a917df5e741edb97a9ee554ef6942943a67c185f66e00f7aafff76ae56771979  scripts/full-r
 3561ef391aa4097d4f1ef33538c553795352e2fac95317ca08552812ae5af4df  scripts/full-regression-r60.mjs
 93fd7237c1c5885294324458e2cdd7197a2240d576f00fc8640927b0a917a2be  scripts/full-regression-summary-r45.mjs
 ed119ef56eb0309e342cd7f585f211e9f9cef9e94840f756fedc3e72b6ebf3fa  scripts/gate-windows-r160.ps1
+7ee7ab902fca4c604185bc7441370bbe9aac28545c866cb313d5cf6b2c2ace9a  scripts/gate-windows-r166.ps1
 feaecfaf78ebf20a42b17974a81777185b74344bc4717f00fde69b5e66ac3257  scripts/gate-windows-r36.ps1
 75931dbb30e7d5b07bf781481849c7a583c7fe7250ac2e5d43a83e9c4764569b  scripts/gate-windows-r37-0110.ps1
 96c407135841b88ed713ed4984a678acfe5b19285673e0d2c35168d9bedde68c  scripts/gate-windows-r38.ps1
@@ -1564,9 +1566,10 @@ de6142bd5693cf4edb8725c9c43fc77e9bdc12f5b398a757006d778d3ee3f8ed  scripts/inspec
 4870c1dba23d1f05f9302153a309ba5d42d1b08aee34eabd3361792c26b254ae  scripts/npm-publication-r65.mjs
 9d12d15f7c83ddf272834072ed37d618a232bd8a3fd36c339761fe08bb9380d8  scripts/npm-publish-r47.ps1
 4f1a6e0f8d23bd24b066b3a2df0cae1d47822c16c754122fde78dc509d0752f8  scripts/npm-release-r47.mjs
-8113f0ca314ce50e2b166fe60cc7e5113352fcaf4d01eb0cc2a43f77ca1a9667  scripts/npm-release-r48.mjs
+dd0479f6552f8dc48abc365eeb91068e89459a647979e26d1f9ae13fbb84f050  scripts/npm-release-r48.mjs
 4fb7f874cc04cd98ad677425f0aae4191b92f8b71e96db70d1fb395eb8267b93  scripts/npm-release-readiness-r163.mjs
 88ea6b86973c81fb596927a9100865b7464955fd14b60677eb03f9e27f1073fa  scripts/npm-release-readiness-r165.mjs
+7c80f9310547a5ffe779426fdce85ba8f23b1eacadf62aaf1815cdebbbec43ae  scripts/npm-release-readiness-r166.mjs
 c166f98c5ec30d66b1769a9a017d8c4bc56230f221d99539f64b2b597187d912  scripts/npm-release-readiness-r67.mjs
 34b0448dbf7ba61ce821e53f4de0ca85aadeb44c96e689b39cf43c4801216857  scripts/npm-release-readiness-r71.mjs
 8fb0e7a6222d5e2ab67f45453844e53a22958a6c3ba34833c76713a246f2e802  scripts/npm-release-readiness-r72.mjs
@@ -1703,7 +1706,7 @@ c32cb9054a1b9641ae071c00622c0054272bdb0b519ea22c4ff926a1600a2b46  scripts/worklo
 1ee9251c743d817245e858229e1e1db4f7bebb7e5411d370d33c4777528e53e0  scripts/workload-substrate-r47-regression.mjs
 546947775fac8075f48c689ea0f7bed5ea14424efd12587daead4a7df6e796df  src/activation-authority-proof-r75.mjs
 0fca861bfb959b6d84c4767b2f60a4e0ec2403291a6050ee7598f75d2c4c18e0  src/activation-continuity-engine-r65.mjs
-64ff84efd679a4f2a7e7aefcca70c3199ad47ff069e18ea9c08a4305ddee2d50  src/activation-lock-r65.mjs
+1262bfc8408750e963710bdf31089d4fd35bb0904191eb55dccb6a49a50b32ac  src/activation-lock-r65.mjs
 fc05a48ac13961c2f1dee444946531ff80100a00750fb9f8e456a6d69f6e1310  src/activation-preflight-r65.mjs
 9dc1154b3857446d0412002e1f0b0031c23d1768350dc9395749a7f82be337e5  src/agent-backend-r44.mjs
 4e8e442497a15bce43b7d02ade497403d80b86e307473d26c172a0fba3a6d4ea  src/agent-eval-r42.mjs
@@ -1871,7 +1874,7 @@ ee1104d1d77bfded8f93834226db718b6c207730c75650b040eec84aaa298078  src/r67-eviden
 9fa1ece4d9520e24225a119d190cdc59a4a548947f629e15ebdd909adaa42b9f  src/r67-regression-shards.mjs
 bfc27fcd00f40a9e06b35001ba4d4e5fda49079fe9db35d7b82608f84ea4cd9e  src/r70-owner-approval.mjs
 afc638b797d81b16c620ca2226eacc4cb1a36562a402219cdac3376867170610  src/receipt.mjs
-243014bee0f5cf5ec4016c391028f07364b3807250414ae944b52cb27cae743f  src/release-generation.mjs
+a8a0d32f261e570802eae6358b0fde47f5b86bc3565e64020905373bb84d6ab2  src/release-generation.mjs
 7927e0c68a53439618b822985c676ff56cca37f27b7ff11f51b792ab8bfe310c  src/release-slot.mjs
 27c738dc52c66274ad3dc8dc344a73d55da4e28a99607c3191440a5e78d49d3e  src/remote-authority.mjs
 3f41fa32ddeed403b5431a338821b62e0c1946a9d808f06d0edb2d9341ca0121  src/remote-console.mjs
@@ -1925,13 +1928,13 @@ aa765e9a28c69ff58a5b5a0d29b49ea181af4db9076633b102dbca25861e708e  src/tunnel-std
 34719b7d54336b2abbc152ff0c5fb2f0052d4f77753f9b7538adfdd20c804b5b  src/uac-approval-contract-r153.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-c016124baa401cbcb8b57cc4b73745243be597e1f1b77846371c7f033610fd28  src/version.mjs
+6a5a4462a2d7669edc87b750e7375b1cbcd56a09b61b29df9d4e28dc90c52096  src/version.mjs
 3706206ecaa560b9579f57ed3df104af543331fb09a3ad0d28b217aea2d0256f  src/windows-powershell-environment.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs
 1bd637e7634ca0259791c5108fcf324554f70b1db49e5eac3505287c04bbc3be  STABILIZATION-PROGRESS.md
-07a89ec563f133192e269f0efb7fffd7e97b9b0f417a8647015d05eb4fd2d2f9  TEST-MATRIX.json
+7a69929d5d7e1d7ea1c107a7e357378805cb333150098dd612b2e6eb94d44db4  TEST-MATRIX.json
 e4f1fb97545f23772ddff28ad3f9954a4714f9854062fca62e0e12c1cb2ec4ae  test/agent-backend-r44.test.mjs
 2a78c818058b25efdc143a3a97c832da231ccd6ff9d90c7796d681a0251b85c4  test/agent-crash-child.mjs
 d9461ab7c118ee75d37a2d6f5e637d7e43505af6a9ad8c7ddafffc8ace185a5b  test/agent-crash-worker.mjs
@@ -2185,9 +2188,9 @@ ce163ee9f288e30a213636e2267b8630016ef8a170f12286e8cdd44219bdab32  test/r124-live
 17475b51e416ae678f959f8975fab8497eb7c57d13e36cac8656c0e1f7424c0c  test/r126-restore-policy-envelope.test.mjs
 1721d4bd3bb58c10ad9d86b69ad1d993ec5a1e6315c95b28fa50ab67d4ca302a  test/r127-restore-append-policy-boundary.test.mjs
 b3d3dda398c94d18e2e156bde65d1338000233407b435134ba0c16175d96620b  test/r129-sdk-security-baseline.test.mjs
-a2e11035e6fd0b1039f3a49f3a59dee692470615a717c6c885b1f31e8a7b9191  test/r130-release-security-contract.test.mjs
+f8ca77f9e642171fcfb5d53bbb1889567686458bca2b906db50ab9e967001bc0  test/r130-release-security-contract.test.mjs
 bb7963baf412ec0f5aca183f6dd98eda9026fe763017f9af595581b521ae6cb7  test/r131-installed-manifest-boundary.test.mjs
-09edcdda615c483c821a48396d6a72996023220f4d26df0cf78f7bfea480dc3a  test/r132-release-identity.test.mjs
+6832662cb8a22e7888ea87521642d2563fd31a4d08a0b709d09d90fa3dbf8391  test/r132-release-identity.test.mjs
 acd236a4d8ba035007bde4166a521b8d4e6044f58c52c0bae9cb42fa75338533  test/r135-autonomous-scope.test.mjs
 3fcf657aae1f8466abc5ab82bb5a619966ea9b8a33d4a95a5a5246df5bf3afa1  test/r136-scoped-command-rights.test.mjs
 e0c466f25b35eb894166df792b71b23924610d32363756c75ff437dfdaa12a4c  test/r136-scoped-observer.test.mjs
@@ -2211,7 +2214,7 @@ b92f914455cac010b1468cd37a31651e7d423571d0edfeb29829d2281073e1e3  test/r146-lega
 32f40b649033172384267bbe8f6009dededcba81afff1e3ca51331407197fe3b  test/r146-livelog-backpressure.test.mjs
 77b3bfcd6fa04e21c7a04206181f7b4cbd5321f799a145859d8e84d0b984d174  test/r147-remote-request-hash.test.mjs
 ad184a83ee098eac21d523adbebfd379dcf8b87d4878c2d8dcca95cb22fdc9ee  test/r153-clean-activation-recovery.test.mjs
-ef2f51a6fe9e40253b8fa9365ffeb7b5985a66b2cab7cd65a7f05f1e452d2c67  test/r153-prepublish-identity.test.mjs
+fefb3fe1f8eb7412258bf6d1757736a1d4693af834a76bda397ab9b678e2ec1c  test/r153-prepublish-identity.test.mjs
 377b03dbb1d82ed0ddeee261a060b8173d5591dfc20a60d9ea991390a03039b4  test/r153-r60-host-repin-e2e-contract.test.mjs
 e2bc7995f2ca85ce5d4a15e647c209d273d8f3871d25bd353046af66ee71bb34  test/r153-r65-signed-precondition-recovery.test.mjs
 ce37fc59761ceddf43fd3844b34d57f64f1c8d191ca1d6cba13b643a5e2c02ce  test/r153-restricted-reused-pid.test.mjs
@@ -2232,13 +2235,15 @@ efc195b10b5cb706c23f3a35ba8bf07e7ee23daffcb072704e5c14ffd6db26d5  test/r158-epoc
 ff0fc541ef9b9b1565be647d2861c29afc8827504122c1df88a94d67fd2c20bd  test/r159-legacy-marker-evidence.test.mjs.before-assertion-fix-20261025-120246.bak
 d5d0eddc5c33ae9ea2f31d57381bf595bd85adf8048d2886f67554141f086bde  test/r160-marker-proof.test.mjs
 7816089ae7668f7a5776a50259638cf31dc480116f3445b70afb0b8c64dbb4d3  test/r160-package-decision-manifest.test.mjs
-ea99cf4afbe7c50a974cd86ffa27e2df4730ba00603974d170bef00b86712a75  test/r160-release-contract.test.mjs
+99b13e127518be5bca1161d14e613053bb39de60ff028ea1cad1033c60fdeca1  test/r160-release-contract.test.mjs
 8ddebf4e81e5ccb66533694e7b04775ea9ce063ead75a17c54ce28580a55a0b4  test/r160-stable-launcher.test.mjs
-6113cdae02e286f4e443a046293e13e7792e07a59b00a309f098f81a6b4a37ed  test/r163-isolated-slot-rollback-restore.test.mjs
+630b20b231f2ddfcacfb40d5ce31443488cb0aec8a3270a9e685fce367ee43bf  test/r163-isolated-slot-rollback-restore.test.mjs
 842222cce8d50ba214a4dc97d5965d711e83a29f6660e784ccaf000f50a4213d  test/r163-publish-fence.test.mjs
 3473a513db884f2ab40a9e3e875ca6ef2c9e5202fc0bf4df56e388b0d55e5e84  test/r164-remote-history-skew.test.mjs
-dd74a3f6cc4950079a95be0141f141c96b99025d25863adb088c722c58356229  test/r165-live-cli-skew.test.mjs
+ff0aaa95f8c03e647b3c750fe91fd19ef06e92c3bd44b73a29db755ecd954ccb  test/r165-live-cli-skew.test.mjs
 e9c493435956201439479b05d301e81673457abe5c456d8a50153f3d9922daf9  test/r165-publish-fence.test.mjs
+425e6756afe323d358287a4d00ab6460e8398a8ee39c4a64e4be7ae191c4676f  test/r166-hotfix-contract.test.mjs
+13c4c7792152466b6967627b44eb4aaf815e9c20b4bd67a50323420c937d532c  test/r166-release-readiness.test.mjs
 3c5c3724bce89aa1fa59fe97cc346c40a5674bb5cd6dc3e2f31b86f2d62e75e4  test/r33-closeout-regression.test.mjs
 5e3700ee610442dfd7b7ae5e380263f231438be0e32790597142c41362a53c9a  test/r33-finalization.test.mjs
 7e419d3c1caf79bfc7407207f50e5645298f9b19d91a7d6f595af185b92cd55e  test/r36-finalization.test.mjs
@@ -2304,7 +2309,7 @@ ca8e23abc89f3eadeceb4b6fdad2cb4db5a7933029ece8e8beae2c6a158876b7  test/r58-owner
 8fc5ed1d3088facf45f9578d9ff8514c3a633f7f342d15eec316e129e7a916c0  test/r58-stale-owner.test.mjs
 84be7ee7d167eb06c9f9fc178930daaa81e53a91de40bad6d7df2060bd3dd165  test/r58-windows-gate.test.mjs
 76db2a4009d76b86e1da57b91a96b0d6bfeb4063bec3301ede736e2fd5832f39  test/r59-release-contract.test.mjs
-1d7c8b74ebb6a8e4581354613b0dff31c8013f7ec1fbd83b077032912f37e284  test/r59-tool-surface-compat.test.mjs
+14bfb9e12e51e7291f35c88c8a80e970f635d61f16dec2b5879299d3fa3605ee  test/r59-tool-surface-compat.test.mjs
 3befd5d4dc4d8ca9e1f6cbeb9c430671e676c5696d6ee5931c2cbe3244c558a4  test/r60-authority-coherence.test.mjs
 60577e231c7d164f57a3960c574d3e369ca140d9dbc477b2444fa62dbf224e51  test/r60-authority-enforcement.test.mjs
 a1fa0b1e529da05f3659a33be6d36dab02f93808638cf0f458d057e9c6d1e35b  test/r60-bridge-dispatch.test.mjs

package/PROVENANCE.json

@@ -1,6 +1,6 @@
 {
   "schema": "deadbyte.provenance.v1",
-  "version": "0.15.63",
+  "version": "0.15.64",
   "source_model": "R159 unsealed development predecessor -> isolated R160 trusted recovery successor; active runtime 0.15.61 remains immutable",
   "signing": "ed25519",
   "parent_tarball_sha256": "b85f735f4c8be56f97ea5c78f0cc48583e8d5708a704c903596f5720e36ace83",
@@ -11,7 +11,7 @@
     "manifest_sha256": "055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf",
     "generation_manifest_sha256": "f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4"
   },
-  "source_predecessor_manifest_file_sha256": "4adf7d94682fbb71c4a91eb3147ecc48076bbc5d79cb67fcb875cde6a1bb4805",
+  "source_predecessor_manifest_file_sha256": "b1d7ab48f8ea16178a2700610a5da1b9b60313a1c8b9a1922e57355cc512ab37",
   "reproducibility": "R154 isolated successor of published 0.15.60 tarball SHA-256 b85f735f4c8be56f97ea5c78f0cc48583e8d5708a704c903596f5720e36ace83; production runtime 0.15.45 remains immutable until exact candidate gates pass; multi-command executable repins are one-time Windows UAC, receipt-bound, and retain all authority disarmed",
   "public_surface_evidence": {
     "status": "PASS",
@@ -80,8 +80,8 @@
   "parent_release_id": "v0.15.61-055d1ff0aa99e60b",
   "parent_manifest_sha256": "055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf",
   "parent_generation_manifest_sha256": "f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4",
-  "source_predecessor_version": "0.15.62",
-  "source_predecessor_tarball_sha256": "812e97609b7c51353ed25f2202129737e43bb4fbe0778c3adec43ec065352641",
+  "source_predecessor_version": "0.15.63",
+  "source_predecessor_tarball_sha256": "3bcd89c00fca98428aab6791b545bcfd0c62323349ee9de819aae4041d170406",
   "operator_override": {
     "four_hour_soak": "WAIVED_BY_OPERATOR",
     "clean_machine": "WAIVED_BY_OPERATOR",

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.15.63 / R165 TRUSTED RECOVERY AND BOUNDED ENGINEERING LOOP
+DEADBYTE MCP V0.15.64 / R166 TRUSTED RECOVERY AND BOUNDED ENGINEERING LOOP
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -16,12 +16,12 @@ check `--version` before issuing a stateful command. The compatibility CMD
 fails with an explanation when npm is detected rather than forwarding the
 wrong command to the controller.
 
-  npx -y deadbyte-mcp@0.15.63 mcp
-  npx -y deadbyte-mcp@0.15.63 remote
-  npx -y deadbyte-mcp@0.15.63 remote status
-  npx -y deadbyte-mcp@0.15.63 remote restart
-  npx -y deadbyte-mcp@0.15.63 audit status
-  npx -y deadbyte-mcp@0.15.63 audit verify
+  npx -y deadbyte-mcp@0.15.64 mcp
+  npx -y deadbyte-mcp@0.15.64 remote
+  npx -y deadbyte-mcp@0.15.64 remote status
+  npx -y deadbyte-mcp@0.15.64 remote restart
+  npx -y deadbyte-mcp@0.15.64 audit status
+  npx -y deadbyte-mcp@0.15.64 audit verify
 
 MAJOR MCP CLIENT STDIO CONFIGS
 -------------------------------
@@ -32,7 +32,7 @@ CLAUDE DESKTOP
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.63", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.64", "mcp"]
       }
     }
   }
@@ -44,7 +44,7 @@ Save as .cursor/mcp.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.63", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.64", "mcp"]
       }
     }
   }
@@ -57,7 +57,7 @@ Save as .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.63", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.64", "mcp"]
       }
     }
   }
@@ -67,7 +67,7 @@ Add to the Codex MCP configuration:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.15.63", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.64", "mcp"]
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.
@@ -356,7 +356,7 @@ CONTROLLER
 ----------
 Primary operator entry point:
 
-  npx -y deadbyte-mcp@0.15.63 remote
+  npx -y deadbyte-mcp@0.15.64 remote
 
 The legacy CMD entry remains compatibility-only for R33 rollback safety.
 
@@ -417,7 +417,7 @@ MCP CLIENT CONFIGURATION
 ------------------------
 The local stdio entry point is quiet and suitable for MCP hosts:
 
-  npx -y deadbyte-mcp@0.15.63 mcp
+  npx -y deadbyte-mcp@0.15.64 mcp
 
 CLAUDE DESKTOP
 Use the standard local-server entry in claude_desktop_config.json:
@@ -426,7 +426,7 @@ Use the standard local-server entry in claude_desktop_config.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.63", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.64", "mcp"]
       }
     }
   }
@@ -439,7 +439,7 @@ Create .cursor/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.63", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.64", "mcp"]
       }
     }
   }
@@ -452,7 +452,7 @@ Create .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.63", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.64", "mcp"]
       }
     }
   }
@@ -462,9 +462,9 @@ Add this to ~/.codex/config.toml:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.15.63", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.64", "mcp"]
 
-The remote device path remains `npx -y deadbyte-mcp@0.15.63 remote`. Remote public MCP uses the
+The remote device path remains `npx -y deadbyte-mcp@0.15.64 remote`. Remote public MCP uses the
 verified HTTPS named-tunnel URL selected by the active generation; do not commit a private device
 URL or tunnel token into a repository.
 

package/RELEASE.json

@@ -1,8 +1,8 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.63",
-  "train": "R165",
+  "version": "0.15.64",
+  "train": "R166",
   "label": "R165 remote startup hotfix",
   "protocol_revision": "2026-07-28",
   "parent": {
@@ -19,12 +19,12 @@
     "generation_manifest_sha256": "f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4"
   },
   "source_predecessor": {
-    "version": "0.15.62",
-    "train": "R163",
-    "source_path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.62-r163-release-closure",
+    "version": "0.15.63",
+    "train": "R165",
+    "source_path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.63-r165-remote-recovery",
     "release_status": "PUBLISHED_REGISTRY_VERIFIED",
     "manifest_status": "VERIFIED_FINAL_BYTES",
-    "tarball_sha256": "812e97609b7c51353ed25f2202129737e43bb4fbe0778c3adec43ec065352641"
+    "tarball_sha256": "3bcd89c00fca98428aab6791b545bcfd0c62323349ee9de819aae4041d170406"
   },
   "consolidation": {
     "frontend_status_vocabulary": true,
@@ -475,5 +475,13 @@
     "production_activation": "NOT_RUN",
     "npm_publish": "NOT_RUN",
     "stable_final_claim": false
+  },
+  "r166": {
+    "scope": "WINDOWS_GATE_AND_SIGNED_PRECONDITION_RECOVERY_HOTFIX",
+    "production_activation": "NOT_RUN",
+    "npm_publish": "NOT_RUN",
+    "source_predecessor_version": "0.15.63",
+    "runtime_predecessor_version": "0.15.61",
+    "release_test_evidence": "EXTERNAL_ONLY"
   }
 }

package/SBOM.cdx.json

@@ -1,13 +1,13 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:cdx:deadbyte-mcp:r165:0.15.63",
+  "serialNumber": "urn:cdx:deadbyte-mcp:r165:0.15.64",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "deadbyte-mcp",
-      "version": "0.15.63"
+      "version": "0.15.64"
     }
   },
   "components": [

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.63",
-  "train": "R165",
+  "version": "0.15.64",
+  "train": "R166",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",

package/bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-chatgpt-bridge",
-  "version": "0.15.63",
+  "version": "0.15.64",
   "private": true,
   "type": "module",
   "engines": {

package/controller/deadbyte-process-policy.json

@@ -1,15 +1,15 @@
 {
   "schema": "deadbyte.process-policy.v1",
   "enabled": true,
-  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.62-r160-marker-proof\\controller\\runtime\\process-grant.json",
-  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.62-r160-marker-proof\\controller\\runtime\\process-state",
+  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.64-r166-final\\controller\\runtime\\process-grant.json",
+  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.64-r166-final\\controller\\runtime\\process-state",
   "native_host": {
-    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.62-r160-marker-proof\\bin\\deadbyte-process-host.exe",
+    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.64-r166-final\\bin\\deadbyte-process-host.exe",
     "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {
-      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.62-r160-marker-proof",
+      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.64-r166-final",
       "deny_paths": [
         "node_modules",
         "controller/runtime",

package/node_modules/which/CHANGELOG.md

@@ -0,0 +1,166 @@
+# Changes
+
+
+## 2.0.2
+
+* Rename bin to `node-which`
+
+## 2.0.1
+
+* generate changelog and publish on version bump
+* enforce 100% test coverage
+* Promise interface
+
+## 2.0.0
+
+* Parallel tests, modern JavaScript, and drop support for node < 8
+
+## 1.3.1
+
+* update deps
+* update travis
+
+## v1.3.0
+
+* Add nothrow option to which.sync
+* update tap
+
+## v1.2.14
+
+* appveyor: drop node 5 and 0.x
+* travis-ci: add node 6, drop 0.x
+
+## v1.2.13
+
+* test: Pass missing option to pass on windows
+* update tap
+* update isexe to 2.0.0
+* neveragain.tech pledge request
+
+## v1.2.12
+
+* Removed unused require
+
+## v1.2.11
+
+* Prevent changelog script from being included in package
+
+## v1.2.10
+
+* Use env.PATH only, not env.Path
+
+## v1.2.9
+
+* fix for paths starting with ../
+* Remove unused `is-absolute` module
+
+## v1.2.8
+
+* bullet items in changelog that contain (but don't start with) #
+
+## v1.2.7
+
+* strip 'update changelog' changelog entries out of changelog
+
+## v1.2.6
+
+* make the changelog bulleted
+
+## v1.2.5
+
+* make a changelog, and keep it up to date
+* don't include tests in package
+* Properly handle relative-path executables
+* appveyor
+* Attach error code to Not Found error
+* Make tests pass on Windows
+
+## v1.2.4
+
+* Fix typo
+
+## v1.2.3
+
+* update isexe, fix regression in pathExt handling
+
+## v1.2.2
+
+* update deps, use isexe module, test windows
+
+## v1.2.1
+
+* Sometimes windows PATH entries are quoted
+* Fixed a bug in the check for group and user mode bits. This bug was introduced during refactoring for supporting strict mode.
+* doc cli
+
+## v1.2.0
+
+* Add support for opt.all and -as cli flags
+* test the bin
+* update travis
+* Allow checking for multiple programs in bin/which
+* tap 2
+
+## v1.1.2
+
+* travis
+* Refactored and fixed undefined error on Windows
+* Support strict mode
+
+## v1.1.1
+
+* test +g exes against secondary groups, if available
+* Use windows exe semantics on cygwin & msys
+* cwd should be first in path on win32, not last
+* Handle lower-case 'env.Path' on Windows
+* Update docs
+* use single-quotes
+
+## v1.1.0
+
+* Add tests, depend on is-absolute
+
+## v1.0.9
+
+* which.js: root is allowed to execute files owned by anyone
+
+## v1.0.8
+
+* don't use graceful-fs
+
+## v1.0.7
+
+* add license to package.json
+
+## v1.0.6
+
+* isc license
+
+## 1.0.5
+
+* Awful typo
+
+## 1.0.4
+
+* Test for path absoluteness properly
+* win: Allow '' as a pathext if cmd has a . in it
+
+## 1.0.3
+
+* Remove references to execPath
+* Make `which.sync()` work on Windows by honoring the PATHEXT variable.
+* Make `isExe()` always return true on Windows.
+* MIT
+
+## 1.0.2
+
+* Only files can be exes
+
+## 1.0.1
+
+* Respect the PATHEXT env for win32 support
+* should 0755 the bin
+* binary
+* guts
+* package
+* 1st

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.63",
+  "version": "0.15.64",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
@@ -42,7 +42,7 @@
     "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
     "contained:smoke": "node src/contained-smoke.mjs",
     "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r160.ps1 -Stage all",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r166.ps1 -Stage all",
     "authority:smoke": "node src/authority-smoke.mjs",
     "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
     "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",

package/scripts/gate-windows-r166.ps1

@@ -0,0 +1,57 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param([ValidateSet('preflight','focused','full','manifest','doctor','all')][string]$Stage='preflight')
+Set-StrictMode -Version Latest
+$ErrorActionPreference='Stop'
+$repo=Split-Path -Parent $PSScriptRoot
+$state=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$parentId='v0.15.61-055d1ff0aa99e60b'
+$parentSha='055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf'
+$parentGen='f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4'
+$nativeNode='C:\Program Files\nodejs\node.exe'
+$node=if(Test-Path -LiteralPath $nativeNode -PathType Leaf){$nativeNode}else{(Get-Command node -ErrorAction Stop).Source}
+function Sha([string]$file){
+    $sha=[Security.Cryptography.SHA256]::Create()
+    try{$stream=[IO.File]::OpenRead($file);try{return ([BitConverter]::ToString($sha.ComputeHash($stream))).Replace('-','').ToLowerInvariant()}finally{$stream.Dispose()}}finally{$sha.Dispose()}
+}
+function Run-Node([string]$label,[string[]]$nodeArgs){
+    if($null -eq $nodeArgs -or $nodeArgs.Count -lt 1){throw "R166_${label}_NO_NODE_ARGUMENTS"}
+    Write-Output "R166_STAGE_START=$label"
+    Write-Output "R166_STAGE_ARGS=$($nodeArgs.Count)"
+    $global:LASTEXITCODE=0
+    & $node @nodeArgs
+    $exit=$global:LASTEXITCODE
+    if($exit -ne 0){throw "R166_${label}_FAILED exit=$exit"}
+    Write-Output "R166_STAGE_PASS=$label"
+}
+Push-Location $repo
+try{
+    $pkg=Get-Content -LiteralPath 'package.json' -Raw | ConvertFrom-Json
+    $release=Get-Content -LiteralPath 'RELEASE.json' -Raw | ConvertFrom-Json
+    if($pkg.version -ne '0.15.64' -or $release.version -ne '0.15.64' -or $release.train -ne 'R166'){throw 'R166_CANDIDATE_VERSION_DRIFT'}
+    if($release.runtime_predecessor.release_id -ne $parentId -or $release.runtime_predecessor.manifest_sha256 -ne $parentSha -or $release.runtime_predecessor.generation_manifest_sha256 -ne $parentGen){throw 'R166_RUNTIME_PREDECESSOR_IDENTITY_DRIFT'}
+    $active=Get-Content -LiteralPath (Join-Path $state 'active-release.json') -Raw | ConvertFrom-Json
+    if($active.version -ne '0.15.61' -or $active.release_id -ne $parentId -or $active.manifest_sha256 -ne $parentSha -or $active.generation_manifest_sha256 -ne $parentGen){throw 'R166_ACTIVE_RUNTIME_DRIFT'}
+    if((Sha (Join-Path $active.release_root 'MANIFEST.SHA256')) -ne $parentSha){throw 'R166_ACTIVE_MANIFEST_MISMATCH'}
+    Write-Output 'R166_PREDECESSOR_PREFLIGHT=PASS'
+    if($Stage -eq 'preflight'){return}
+    if($Stage -in @('focused','all')){
+        Run-Node -label 'focused' -nodeArgs @('--test','--test-reporter=tap','--test-concurrency=1','test/r89-privileged-install-boundary.test.mjs','test/r92-acl-ace-applicability.test.mjs','test/r153-clean-activation-recovery.test.mjs','test/r155-commander-live-log.test.mjs','test/r155-default-live-log.test.mjs','test/r156-supervisor-pacing.test.mjs','test/r157-supervisor-singleflight.test.mjs','test/r158-epoch-bootstrap.test.mjs','test/r159-legacy-marker-evidence.test.mjs','test/r160-marker-proof.test.mjs','test/r160-package-decision-manifest.test.mjs','test/r160-stable-launcher.test.mjs','test/r160-release-contract.test.mjs','test/r59-tool-surface-compat.test.mjs')
+        if($Stage -eq 'focused'){return}
+    }
+    if($Stage -in @('full','all')){
+        Run-Node -label 'full' -nodeArgs @('--test','--test-reporter=tap','--test-concurrency=4','test/*.test.mjs')
+        if($Stage -eq 'full'){return}
+    }
+    if($Stage -in @('manifest','all')){
+        Run-Node -label 'manifest' -nodeArgs @('scripts/release-manifest.mjs','verify')
+        if($Stage -eq 'manifest'){return}
+    }
+    if($Stage -in @('doctor','all')){
+        $previous=$env:DEADBYTE_STATE_ROOT
+        $isolated=Join-Path $env:TEMP ('deadbyte-r160-doctor-'+[guid]::NewGuid().ToString('N'))
+        try{[IO.Directory]::CreateDirectory($isolated)|Out-Null;$env:DEADBYTE_STATE_ROOT=$isolated;Run-Node -label 'isolated_doctor' -nodeArgs @('src/deadbyte-cli.mjs','doctor')}
+        finally{$env:DEADBYTE_STATE_ROOT=$previous;Remove-Item -LiteralPath $isolated -Recurse -Force -ErrorAction SilentlyContinue}
+    }
+    Write-Output 'R166_WINDOWS_CANDIDATE_GATE=PASS_PREPUBLICATION'
+}finally{Pop-Location}

package/scripts/npm-release-r48.mjs

@@ -9,6 +9,7 @@ import {assertR72NpmPublishReady} from './npm-release-readiness-r72.mjs';
 import {assertR74NpmPublishReady} from './npm-release-readiness-r74.mjs';
 import {assertR163NpmPublishReady} from './npm-release-readiness-r163.mjs';
 import {assertR165NpmPublishReady} from './npm-release-readiness-r165.mjs';
+import {assertR166NpmPublishReady} from './npm-release-readiness-r166.mjs';
 import { existsSync } from 'node:fs';
 import { resolveStateRoot } from '../src/state-root.mjs';
 import path from 'node:path';
@@ -105,6 +106,10 @@ async function main() {
     if (!publishOnly) throw new Error('PUBLISH_BLOCKED R165 0.15.63 requires --publish-only; production activation is a separate authority boundary');
     await assertR165NpmPublishReady(release,{root});
   }
+  if (!isVerifyOnly && version==='0.15.64') {
+    if (!publishOnly) throw new Error('PUBLISH_BLOCKED R166 requires --publish-only; activation is separate');
+    await assertR166NpmPublishReady(release,{root});
+  }
   if (release.parent?.release_id !== provenance.parent_release_id ||
       release.parent?.manifest_sha256 !== provenance.parent_manifest_sha256 ||
       release.parent?.generation_manifest_sha256 !== provenance.parent_generation_manifest_sha256) {

package/scripts/npm-release-readiness-r166.mjs

@@ -0,0 +1,37 @@
+import {readFile,lstat} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const required=(v,m)=>{if(!v)throw new Error('PUBLISH_BLOCKED R166 '+m)};
+const hex=s=>typeof s==='string'&&/^[a-f0-9]{64}$/.test(s);
+async function checkedFile(f,expected){
+  required(hex(expected),'missing log hash');
+  const s=await lstat(f);
+  required(s.isFile()&&!s.isSymbolicLink()&&s.size>0&&s.size<32*1024*1024,'invalid log');
+  const b=await readFile(f);required(sha(b)===expected,'log digest differs');return b.toString('utf8');
+}
+export async function assertR166NpmPublishReady(release,{root}={}){
+  required(release?.version==='0.15.64'&&release?.train==='R166'&&release?.r166?.scope==='WINDOWS_GATE_AND_SIGNED_PRECONDITION_RECOVERY_HOTFIX','candidate metadata invalid');
+  required(release?.parent?.release_id==='v0.15.61-055d1ff0aa99e60b'&&release?.source_predecessor?.version==='0.15.63','lineage mismatch');
+  const evidence=process.env.DEADBYTE_R166_CLOSURE_ROOT;
+  required(root&&path.isAbsolute(root)&&evidence&&path.isAbsolute(evidence),'closure root absent');
+  const allowed=path.resolve(root,'..','..','testing','r166-final-gate');
+  required(path.resolve(evidence).toLowerCase()===allowed.toLowerCase(),'closure root not in scoped testing folder');
+  const data=JSON.parse(await readFile(path.join(evidence,'closure.json'),'utf8'));
+  required(data?.schema==='deadbyte.r166-release-closure.v1'&&data.status==='PASS'&&data.version==='0.15.64','closure status mismatch');
+  required(data?.production_release_id===release.parent.release_id&&hex(data.manifest_sha256),'predecessor or manifest invalid');
+  required(data.manifest_sha256===sha(await readFile(path.join(root,'MANIFEST.SHA256'))),'final manifest drift');
+  const gate=await checkedFile(path.join(evidence,'windows-gate.protected.stdout.log'),data.gate_stdout_sha256);
+  const verify=await checkedFile(path.join(evidence,'npm-verify.stdout.log'),data.verify_stdout_sha256);
+  required(gate.includes('R166_WINDOWS_CANDIDATE_GATE=PASS_PREPUBLICATION')&&gate.includes('MANIFEST_VERIFY_OK')&&gate.includes('R166_STAGE_PASS=full'),'Windows full gate transcript incomplete');
+  const matches=[...gate.matchAll(/^# tests (\d+)\s*\r?\n# suites (\d+)\s*\r?\n# pass (\d+)\s*\r?\n# fail (\d+)\s*\r?\n# cancelled (\d+)\s*\r?\n# skipped (\d+)/gm)];
+  required(matches.length>0,'full TAP summary absent');
+  const full=matches.at(-1);
+  const tests=Number(full[1]),passes=Number(full[3]),fails=Number(full[4]),skips=Number(full[6]);
+  required(tests>=1960&&passes>=1908&&fails===0&&skips<=55&&passes+skips===tests,'full regression count mismatch');
+  required(verify.includes('VERIFY-ONLY PIPELINE PASS')&&verify.includes('Artifact isolation gate PASS')&&verify.includes('VERIFIED_TARBALL '),'exact npm tarball gate missing');
+  const tar=verify.split(/\r?\n/).find(x=>x.startsWith('VERIFIED_TARBALL '));
+  let identity;try{identity=JSON.parse(tar.slice('VERIFIED_TARBALL '.length));}catch{required(false,'tarball evidence malformed');}
+  required(identity.filename==='deadbyte-mcp-0.15.64.tgz'&&hex(identity.sha256)&&identity.bytes>0,'tarball subject invalid');
+  return Object.freeze({status:'R166_RELEASE_READY_EVIDENCE_BOUND',manifest_sha256:data.manifest_sha256,tests,passes,skips});
+}

package/src/activation-lock-r65.mjs

@@ -114,7 +114,7 @@ async function isSafeSignedPreconditionReject(outcome,lock,stateRoot){
      body.result!=='PRECONDITION_REJECTED'||body.phase!=='initial'||
      body.attempted_pointer!==null||body.rollback?.attempted!==false||
      !Array.isArray(body.rollback?.errors)||body.rollback.errors.length!==0||
-     !/^host command 'powershell_script' executable pin drift detected;/.test(String(body.error?.message??''))||
+     !(/^(?:host command 'powershell_script' executable pin drift detected;|windows release gate package script invalid$)/.test(String(body.error?.message??'')))||
      !Number.isFinite(failedTime)||failedTime<lockTime||failedTime>observedTime||
      !samePointerIdentity(body.prior_pointer,current))return false;
   return true;

package/src/release-generation.mjs

@@ -87,7 +87,7 @@ async function currentWindowsGateScript(rootPath){
   try{ pkg=JSON.parse(await readFile(packagePath,'utf8')); }
   catch{ throw new Error('windows release gate package.json malformed'); }
   const command=String(pkg?.scripts?.['gate:windows']??'').trim();
-  const match=/^powershell(?:\.exe)?\s+-NoProfile\s+-ExecutionPolicy\s+Bypass\s+-File\s+(scripts\/[A-Za-z0-9._\/-]+\.ps1)$/i.exec(command);
+  const match=/^powershell(?:\.exe)?\s+-NoProfile\s+-ExecutionPolicy\s+Bypass\s+-File\s+(scripts\/[A-Za-z0-9._\/-]+\.ps1)(?:\s+-Stage\s+all)?$/i.exec(command);
   if(!match) throw new Error('windows release gate package script invalid');
   return safeRel(match[1]);
 }

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.63';
+export const DEADBYTE_VERSION = '0.15.64';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/r130-release-security-contract.test.mjs

@@ -13,12 +13,12 @@ test('R130 security patch has a new immutable package identity and truthful sour
     read('SBOM.cdx.json'),read('package-lock.json'),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.63');
-  assert.equal(release.train,'R165');
-  assert.equal(matrix.train,'R165');
-  assert.equal(release.source_predecessor.version,'0.15.62');
-  assert.equal(release.source_predecessor.train,'R163');
-  assert.match(release.source_predecessor.source_path,/0\.15\.62-r163-release-closure/i);
+    assert.equal(actual,'0.15.64');
+  assert.equal(release.train,'R166');
+  assert.equal(matrix.train,'R166');
+  assert.equal(release.source_predecessor.version,'0.15.63');
+  assert.equal(release.source_predecessor.train,'R165');
+  assert.match(release.source_predecessor.source_path,/0\.15\.63-r165-remote-recovery/i);
   assert.equal(release.source_predecessor.manifest_status,'VERIFIED_FINAL_BYTES');
   assert.equal(release.runtime_predecessor.version,'0.15.61');
   assert.equal(provenance.r160.source_predecessor_manifest_status,'STALE_REJECTED');

package/test/r132-release-identity.test.mjs

@@ -8,22 +8,22 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 
-test('R165 package identity preserves R132 evidence and published source predecessor',async()=>{
+test('R166 package identity preserves R132 evidence and published source predecessor',async()=>{
   const [pkg,lock,release,prov,bom,matrix]=await Promise.all([
     read('package.json'),read('package-lock.json'),read('RELEASE.json'),
     read('PROVENANCE.json'),read('SBOM.cdx.json'),read('TEST-MATRIX.json')]);
   for(const value of [pkg.version,lock.version,lock.packages[''].version,release.version,prov.version,bom.metadata.component.version,matrix.version,DEADBYTE_VERSION]){
     assert.equal(value,pkg.version);
   }
-  assert.equal(release.train,'R165');
-  assert.equal(matrix.train,'R165');
-  assert.equal(release.source_predecessor.version,'0.15.62');
-  assert.equal(release.source_predecessor.train,'R163');
-  assert.match(release.source_predecessor.source_path,/0\.15\.62-r163-release-closure/i);
+  assert.equal(release.train,'R166');
+  assert.equal(matrix.train,'R166');
+  assert.equal(release.source_predecessor.version,'0.15.63');
+  assert.equal(release.source_predecessor.train,'R165');
+  assert.match(release.source_predecessor.source_path,/0\.15\.63-r165-remote-recovery/i);
   assert.equal(prov.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(release.r165.published_source_manifest_sha256,'4adf7d94682fbb71c4a91eb3147ecc48076bbc5d79cb67fcb875cde6a1bb4805');
   assert.equal(release.r165.published_source_tarball_sha256,'812e97609b7c51353ed25f2202129737e43bb4fbe0778c3adec43ec065352641');
-  assert.equal(release.source_predecessor.tarball_sha256,release.r165.published_source_tarball_sha256);
+  assert.equal(release.source_predecessor.tarball_sha256,'3bcd89c00fca98428aab6791b545bcfd0c62323349ee9de819aae4041d170406');
   assert.equal(prov.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
   assert.equal(release.runtime_predecessor.version,'0.15.61');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);

package/test/r153-prepublish-identity.test.mjs

@@ -26,7 +26,7 @@ test('R153 historical verifier refuses current R160 package identity',async()=>{
  const state={pkg:JSON.parse(await readFile(path.join(root,'package.json'),'utf8')),
   release:JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8')),
   bridge:JSON.parse(await readFile(path.join(root,'bridge/package.json'),'utf8'))};
- assert.equal(state.pkg.version,'0.15.63');
+ assert.equal(state.pkg.version,'0.15.64');
  assert.throws(()=>verifyR153Lineage(state),/package version/);
  await assert.rejects(verifyR153IdentityTree(root),/package version/);
 });

package/test/r160-release-contract.test.mjs

@@ -13,15 +13,15 @@ test('R160 package identity separates source and live runtime predecessors',asyn
     read('package.json'),read('package-lock.json'),read('bridge/package.json'),read('RELEASE.json'),
     read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
   for(const version of [pkg.version,lock.version,lock.packages[''].version,bridge.version,release.version,
-    provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION]) assert.equal(version,'0.15.63');
-  assert.equal(release.train,'R165');
-  assert.equal(matrix.train,'R165');
+    provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION]) assert.equal(version,'0.15.64');
+  assert.equal(release.train,'R166');
+  assert.equal(matrix.train,'R166');
   assert.equal(release.runtime_predecessor.version,'0.15.61');
   assert.equal(release.runtime_predecessor.release_id,'v0.15.61-055d1ff0aa99e60b');
   assert.equal(release.runtime_predecessor.manifest_sha256,'055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf');
   assert.equal(release.runtime_predecessor.generation_manifest_sha256,'f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4');
-  assert.equal(release.source_predecessor.train,'R163');
-  assert.match(release.source_predecessor.source_path,/deadbyte-mcp-0\.15\.62-r163-release-closure/i);
+  assert.equal(release.source_predecessor.train,'R165');
+  assert.match(release.source_predecessor.source_path,/deadbyte-mcp-0\.15\.63-r165-remote-recovery/i);
   assert.equal(release.r160.public_tool_delta,0);
   assert.equal(release.r160.authority_scope_delta,0);
   assert.equal(release.r160.production_activation,'NOT_RUN');

package/test/r163-isolated-slot-rollback-restore.test.mjs

@@ -8,7 +8,7 @@ import {fileURLToPath} from 'node:url';
 import {atomicWriteActivePointer,materializeReleaseSlot,parseActivePointer,parseManifest,renderStableLauncherPs1,verifyManifestTreeExact} from '../src/release-slot.mjs';
 
 const candidate=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
-const version='0.15.63';
+const version='0.15.64';
 const parent=path.join(os.homedir(),'.deadbyte-mcp','releases','v0.15.61-055d1ff0aa99e60b');
 const parentDigest='055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf';
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
@@ -21,7 +21,7 @@ async function generation(state,label){
   await writeFile(path.join(root,'GENERATION.SHA256'),manifest,{flag:'wx'});
   return {root,manifest_sha256:sha(manifest),config_path:path.join(root,'controller-config.psd1')};
 }
-test('R165 isolated immutable slot activates, rolls back, and restores 0.15.63 without authority or production mutation',async()=>{
+test('R166 isolated immutable slot activates, rolls back, and restores 0.15.64 without authority or production mutation',async()=>{
   const stateBase=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r163-isolated-'));
   const state=path.join(stateBase,'state');
   try{

package/test/r165-live-cli-skew.test.mjs

@@ -17,7 +17,7 @@ const hashMarker=c=>c.repeat(64);
 async function fixture(t,kind){
   assert.equal(typeof envRoot,'string'); assert.ok(path.isAbsolute(envRoot));
   assert.match(sha(await readFile(path.join(envRoot,'MANIFEST.SHA256'))),/^[0-9a-f]{64}$/);
-  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.63');
+  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.64');
   const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r164-skew-e2e-'));
   t.after(async()=>{await rm(dir,{recursive:true,force:true,maxRetries:10,retryDelay:150});});
   const state=path.join(dir,'state'),bin=path.join(state,'bin');
@@ -65,7 +65,7 @@ async function run(fx){
  assert.doesNotMatch(trace,/\b(?:start|restart|armprocess|armcoding|armautonomous|deploy)\b/i,'unexpected runtime operation');
  return {output:(result.stderr||'')+'\n'+(result.stdout||''),trace};
 }
-gate('R165 executable CLI passes completed R159 history, reaches 0.15.61 -> 0.15.63 synchronization safely',async t=>{
+gate('R165 executable CLI passes completed R159 history, reaches 0.15.61 -> 0.15.64 synchronization safely',async t=>{
  const fx=await fixture(t,'completed');
  const r=await run(fx);
  assert.match(r.output,/runtime coherence 'disarmhost' failed exit=93/i,r.output);

package/test/r166-hotfix-contract.test.mjs

@@ -0,0 +1,27 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+const release = await readFile(new URL('../src/release-generation.mjs',import.meta.url),'utf8');
+const gate = await readFile(new URL('../scripts/gate-windows-r166.ps1',import.meta.url),'utf8');
+const pkg = JSON.parse(await readFile(new URL('../package.json',import.meta.url),'utf8'));
+const lock = await readFile(new URL('../src/activation-lock-r65.mjs',import.meta.url),'utf8');
+test('exact Windows gate grammar supports only optional Stage all',()=>{
+  const line = release.split('\n').find(x=>x.includes('const match=/^powershell'));
+  assert.ok(line);
+  const regexSource=line.slice(line.indexOf('const match=')+12,line.lastIndexOf('.exec(command)'));
+  const regex=Function(`return ${regexSource}`)();
+  assert.ok(regex.test(pkg.scripts['gate:windows']));
+  assert.equal(regex.test(pkg.scripts['gate:windows']+'; echo injected'),false);
+  assert.equal(regex.test(pkg.scripts['gate:windows'].replace('all','focused')),false);
+});
+test('corrected gate matches candidate identity',()=>{
+  assert.match(gate,/R166_CANDIDATE_VERSION_DRIFT/);
+  assert.match(gate,/\$pkg.version -ne '0.15.64'/);
+  assert.match(gate,/\$release.train -ne 'R166'/);
+});
+test('recovery is restricted to exact recognized signed preconditions',()=>{
+  assert.match(lock,/windows release gate package script invalid\$/);
+  assert.match(lock,/verifySlotUpdateEnvelope\(signed,publicKey\)/);
+  assert.match(lock,/body.phase!=='initial'/);
+  assert.match(lock,/body.attempted_pointer!==null/);
+});

package/test/r166-release-readiness.test.mjs

@@ -0,0 +1,10 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {assertR166NpmPublishReady} from '../scripts/npm-release-readiness-r166.mjs';
+test('R166 publication refuses absent external closure',async()=>{
+  const release=JSON.parse(await readFile(new URL('../RELEASE.json',import.meta.url)));
+  const old=process.env.DEADBYTE_R166_CLOSURE_ROOT;
+  try{delete process.env.DEADBYTE_R166_CLOSURE_ROOT;await assert.rejects(assertR166NpmPublishReady(release,{root:new URL('..',import.meta.url).pathname}),/PUBLISH_BLOCKED R166/);}
+  finally{if(old===undefined)delete process.env.DEADBYTE_R166_CLOSURE_ROOT;else process.env.DEADBYTE_R166_CLOSURE_ROOT=old;}
+});

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');