deadbyte-mcp 0.15.67 → 0.15.68

package/MANIFEST.SHA256

@@ -30,7 +30,7 @@ c814771dddac8bfb184250b868ddb6ab9f5e0e43613c04c3ed8abe09324ec4db  bin/deadbyte-n
 daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4  bin/deadbyte-process-host.exe
 b55d2c4490dfb875d40f29a69df2addc5d579991cb7d094674c04d369dfcfac3  bin/deadbyte-tunnel-host.exe
 f0ce7acb1e41325cef8b6789f95bd78b6a6107423773eace57a12b49faa55095  bin/WORKER-REGISTRY.txt
-f29db63e7b542f6125b754b7a104a4303f16fa874c2de23dc93ce8c35bbb3d64  bridge/package.json
+dccfb4e262139be78ead880b53488df5c9e3b82927aab0a331789c24cf1276e8  bridge/package.json
 f99413d82f84c808f52d5b8696c190a9142dd08f517f5ec3e442f0769402d189  bridge/src/bridge-health-r59.mjs
 fa0dcc4cde9c03e978c9f9dd24b62afa83f49bdada1f42ead544a9a17edd332f  bridge/src/bridge.mjs
 471f41c84c5b339cd81a708a4f36d4470e614946817ad2f9fca295dde2c83fb6  bridge/src/canonical-json-r60.mjs
@@ -46,7 +46,7 @@ fedd83eaf14a493db077a0a239eeb68df4e19f075c971a9ff4419bb6e5ab86e3  controller/dea
 331d168750a18d2b8e351796ddbf8f9619374c707c3cea18b8b166934f8af0d3  controller/deadbyte-desktop-policy.json
 5e8ef223b0dbc52173aaf044a075837eef8964ff0e7e16f83a595e0d17695625  controller/deadbyte-host-policy.json.example
 6f0cc469f51444dd18211fa3346c826abeea4d2ec7a8945f0200dc5c622031ef  controller/DEADBYTE-MCP.cmd
-627f7644f29ad62124872bb00dadb066fc6462f144e23eec293cf7d177e8a77c  controller/deadbyte-process-policy.json
+f6e9d10459d6215c587abfe041ddf517b62493a44c94092ba6136923541e1758  controller/deadbyte-process-policy.json
 d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b  controller/deadbyte-semantic-lsp-config.json
 3023d2985f5b6e5cc7c0d08cb8b342b362c93dce7ebd4224635362194be40cf2  controller/README.TXT
 101e613518c73c6aa31c725fe1b5f9a24c995dc9876b7b28e1f3e97ac9f8d362  DEADBYTE-MCP-R27-FINAL/R27-ADMIN-CLOSURE.json
@@ -1427,8 +1427,8 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-1ce8404709030ece26e51d5aba310056623549c51482e7a35a0b8b7be836883d  package.json
-d8c0ab28ea3df19737e671a08c8ac9c82912d009f764cae694636514f7282ca6  PROVENANCE.json
+2ba5d2dd41dca1807edf56159355d9c8804db9e6cc3167093d2f7846b71204b8  package.json
+2bb3e2ea787726a4b9cd738044bc353e7eec5cc5051a364e31edd919accb0755  PROVENANCE.json
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
 0b7ec5ee347ddfa6cca59740fc7a8fe3fc5d51406265bb12189e82fa106319d2  R41-PARENT.json
 bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.json
@@ -1437,9 +1437,9 @@ f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.jso
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
 3dc607603fea511e2f428e9546a875ab7e38b6a0bbd5e803e4510de082f30804  R49-PARENT.json
-49eda4f8d3afb4c1f8319097faf481a4bc8f1b6a9e210ccf6d3305bbc4be49f9  README.txt
-24988c7253af8503e2803141ded1a3941690f5393785807cd1d189332efacd46  RELEASE.json
-1f3f9809e30ff506a9fe5239a0ea04d4215003eb48a2ceb1248da25e2c29b587  SBOM.cdx.json
+87da1401a0a692253316e3c1269c368a5e5bc021fd14a265d12fdbeabf85d201  README.txt
+20e66377dc6909a415d0efbb5014e7e1b0ae85bf1e14ed3438a17e5379c83275  RELEASE.json
+935587bf7590c98fe58787c16b14b27addb2d5f4ccc53ea12be8432b4cd22787  SBOM.cdx.json
 7c86062c4f69db3179a129d65945ccfab1b1c1c5bcc29b91383eac097d50f2aa  scripts/activate-skill-creator-1.1.1.mjs
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
@@ -1612,6 +1612,7 @@ c8b3551936ff7e24d851d6cad580d11fbf495150558d963b7215230481412e2e  scripts/r168-p
 34a0ebb4a5d192e03c6680df40287b6af931e5f2f3e4bff60a66adeb8ae2d87d  scripts/r168-source-full-test-runner.mjs
 4bde90b78134c1ea51df7493d183c4dd60d2f70b2c55bc4fd0dcf1f5c510ea11  scripts/r168-subject-readonly.mjs
 bcb3db79b5c4dc9c0165ddf0d94989f342ff0a0f4be10ed4bfd4709d0763647f  scripts/r172-protected-preflight.mjs
+e7d9392f203e2f5f7a7b154f88740202f5051fbdf0a8657b8e3c6b49d196c382  scripts/r173-protected-preflight.mjs
 e19a1d591ccd07af2e87d930ce23b0cc9b814bc2a395408045543847154097d7  scripts/r40-compact-ledger-probe.mjs
 68b9a60aca3f3e3e9ec239710f8368594ef3c8a98fff0816d2e9a7950df48287  scripts/r47-core-failures.mjs
 75f821cc44f8c31f67de0b28b64021d9fb160984a597e704b29c33f9f3a41dde  scripts/r47-syntax-check.mjs
@@ -1723,12 +1724,12 @@ be332ed7cef04abaec8679198e379d7f42fc67e0833be9f42e25103c88cb5b26  scripts/window
 105a5c6dcd54e4fabb416df9eaac093654f3ea39c4233a56e0bc6d53371b2128  scripts/workload-contract-regression-r47.mjs
 c32cb9054a1b9641ae071c00622c0054272bdb0b519ea22c4ff926a1600a2b46  scripts/workload-stream-regression.mjs
 1ee9251c743d817245e858229e1e1db4f7bebb7e5411d370d33c4777528e53e0  scripts/workload-substrate-r47-regression.mjs
-546947775fac8075f48c689ea0f7bed5ea14424efd12587daead4a7df6e796df  src/activation-authority-proof-r75.mjs
+9e277f4be0bbd413bbf5fda31d6b769ceb2308c95c23562d7df29e3eadda4c03  src/activation-authority-proof-r75.mjs
 941a7ac8b700a6621e7f73780072ccd93b0094887bab722648c325c66c91d71b  src/activation-continuity-abort-r172.mjs
 0fca861bfb959b6d84c4767b2f60a4e0ec2403291a6050ee7598f75d2c4c18e0  src/activation-continuity-engine-r65.mjs
 7199b09fee30d3efe76bf882bdb4421f1406222487be1753b4409e5018b17e3c  src/activation-lock-r65.mjs
 6c634aebee33d925f0bc3f1a4f68d97d4115cf6ad39a5f2484e0e44fd4cca32a  src/activation-path-r167.mjs
-04d21b3a6523d9d72bec157c62eab45096a9219f6a449dc9629a5c21928fb0b6  src/activation-preflight-r65.mjs
+1c9012bbe4d9b047d48ab14826f1de4fe489f282a26341be5573b3f1744cb677  src/activation-preflight-r65.mjs
 467268f6f195e9359b819e35c8b418c81e1cb40c9ba04b990fd2656e354c65a5  src/activation-reconciliation-audit-r168.mjs
 a82b05e1c521cc77f3398985d6faa1beb0fe8f65595f50bed474227550d462c5  src/activation-reconciliation-consent-r168.mjs
 585f0abd6fd9747448b8345bd5b51e80b458eaac162770bc74928242a0cc1549  src/activation-reconciliation-fence-r168.mjs
@@ -1958,13 +1959,13 @@ aa765e9a28c69ff58a5b5a0d29b49ea181af4db9076633b102dbca25861e708e  src/tunnel-std
 34719b7d54336b2abbc152ff0c5fb2f0052d4f77753f9b7538adfdd20c804b5b  src/uac-approval-contract-r153.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-84264e3c1117714e834f4203cb93583fef72933daa0d65934e6b19ecc63384d4  src/version.mjs
+269648484d5f691add569179392ae421c0b152f493969c5e59c205e8de2ae4ce  src/version.mjs
 3706206ecaa560b9579f57ed3df104af543331fb09a3ad0d28b217aea2d0256f  src/windows-powershell-environment.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs
 1bd637e7634ca0259791c5108fcf324554f70b1db49e5eac3505287c04bbc3be  STABILIZATION-PROGRESS.md
-7572913dda907b12bb1e7ec8313312549c6a041a00316df07aec18ac3ff74873  TEST-MATRIX.json
+32a9ea5bd28dc9f3be81a482806728fdadd0a59a21be223cd63fb6b8eae722f9  TEST-MATRIX.json
 e4f1fb97545f23772ddff28ad3f9954a4714f9854062fca62e0e12c1cb2ec4ae  test/agent-backend-r44.test.mjs
 2a78c818058b25efdc143a3a97c832da231ccd6ff9d90c7796d681a0251b85c4  test/agent-crash-child.mjs
 d9461ab7c118ee75d37a2d6f5e637d7e43505af6a9ad8c7ddafffc8ace185a5b  test/agent-crash-worker.mjs
@@ -2218,9 +2219,9 @@ ce163ee9f288e30a213636e2267b8630016ef8a170f12286e8cdd44219bdab32  test/r124-live
 17475b51e416ae678f959f8975fab8497eb7c57d13e36cac8656c0e1f7424c0c  test/r126-restore-policy-envelope.test.mjs
 1721d4bd3bb58c10ad9d86b69ad1d993ec5a1e6315c95b28fa50ab67d4ca302a  test/r127-restore-append-policy-boundary.test.mjs
 b3d3dda398c94d18e2e156bde65d1338000233407b435134ba0c16175d96620b  test/r129-sdk-security-baseline.test.mjs
-253d758527d53b6ffd7db88211f8f0f06ee638cbae939a3f9e8a8d262c057066  test/r130-release-security-contract.test.mjs
+55b862a423a5994384f4d7343d2853deab5e745a76e5dcb0f714680e78d2923c  test/r130-release-security-contract.test.mjs
 bb7963baf412ec0f5aca183f6dd98eda9026fe763017f9af595581b521ae6cb7  test/r131-installed-manifest-boundary.test.mjs
-f622573e1a11cce5dcca105f46c9388afcc5b5d19fb013d5d3e1c13e300f984e  test/r132-release-identity.test.mjs
+cb013d23eb051c4d9e68f28091f9a97728e9de04d8df9ac6d315cfdfbfabeed2  test/r132-release-identity.test.mjs
 acd236a4d8ba035007bde4166a521b8d4e6044f58c52c0bae9cb42fa75338533  test/r135-autonomous-scope.test.mjs
 3fcf657aae1f8466abc5ab82bb5a619966ea9b8a33d4a95a5a5246df5bf3afa1  test/r136-scoped-command-rights.test.mjs
 e0c466f25b35eb894166df792b71b23924610d32363756c75ff437dfdaa12a4c  test/r136-scoped-observer.test.mjs
@@ -2244,7 +2245,7 @@ b92f914455cac010b1468cd37a31651e7d423571d0edfeb29829d2281073e1e3  test/r146-lega
 32f40b649033172384267bbe8f6009dededcba81afff1e3ca51331407197fe3b  test/r146-livelog-backpressure.test.mjs
 77b3bfcd6fa04e21c7a04206181f7b4cbd5321f799a145859d8e84d0b984d174  test/r147-remote-request-hash.test.mjs
 ad184a83ee098eac21d523adbebfd379dcf8b87d4878c2d8dcca95cb22fdc9ee  test/r153-clean-activation-recovery.test.mjs
-26e2bbc83410d13266c93fa7be4be09f8e226376d3e2035cad76b6641dff5011  test/r153-prepublish-identity.test.mjs
+bbfb36b6c9ff112f0e00f9c1ab81e7706ce81d7c626a2ba14dc2b10a4fca19ec  test/r153-prepublish-identity.test.mjs
 377b03dbb1d82ed0ddeee261a060b8173d5591dfc20a60d9ea991390a03039b4  test/r153-r60-host-repin-e2e-contract.test.mjs
 e2bc7995f2ca85ce5d4a15e647c209d273d8f3871d25bd353046af66ee71bb34  test/r153-r65-signed-precondition-recovery.test.mjs
 ce37fc59761ceddf43fd3844b34d57f64f1c8d191ca1d6cba13b643a5e2c02ce  test/r153-restricted-reused-pid.test.mjs
@@ -2267,15 +2268,15 @@ d5d0eddc5c33ae9ea2f31d57381bf595bd85adf8048d2886f67554141f086bde  test/r160-mark
 7816089ae7668f7a5776a50259638cf31dc480116f3445b70afb0b8c64dbb4d3  test/r160-package-decision-manifest.test.mjs
 cf624087da10899195500f265ea48a304afa0ebdef74f064cfccb105ec2248d3  test/r160-release-contract.test.mjs
 8ddebf4e81e5ccb66533694e7b04775ea9ce063ead75a17c54ce28580a55a0b4  test/r160-stable-launcher.test.mjs
-81bd68a7f6918f4f4fc941f53ba4f41b37fb53a4f452cc3330364146722102ac  test/r163-isolated-slot-rollback-restore.test.mjs
+52aa861ec17d6914bd1bf682dc2b4409dd3586206a3bceb231203f911c1583cc  test/r163-isolated-slot-rollback-restore.test.mjs
 842222cce8d50ba214a4dc97d5965d711e83a29f6660e784ccaf000f50a4213d  test/r163-publish-fence.test.mjs
 3473a513db884f2ab40a9e3e875ca6ef2c9e5202fc0bf4df56e388b0d55e5e84  test/r164-remote-history-skew.test.mjs
-d6d3c405617de6e40fbfa369ddc82d5c35980e70bca8dd4632e03a0b6fdfb92b  test/r165-live-cli-skew.test.mjs
+b167b60eaedb6fdfe5288a837c6e5689b3ef89357621a8d297f6fcbe0727fea8  test/r165-live-cli-skew.test.mjs
 e9c493435956201439479b05d301e81673457abe5c456d8a50153f3d9922daf9  test/r165-publish-fence.test.mjs
 425e6756afe323d358287a4d00ab6460e8398a8ee39c4a64e4be7ae191c4676f  test/r166-hotfix-contract.test.mjs
 13c4c7792152466b6967627b44eb4aaf815e9c20b4bd67a50323420c937d532c  test/r166-release-readiness.test.mjs
 52e6f015329fecf570ac6211ca9904b929119b66dbf72c6776be5cefcc63b282  test/r167-activation-path.test.mjs
-4397b0a239a5091d9e53a1b16e539e06744cdd9f6cb3e1272c74eff349a3a9a9  test/r167-release-contract.test.mjs
+5747aa22acca96bf45634431fa320c02eab822a64e3e9a80befaa0df7662d49d  test/r167-release-contract.test.mjs
 471102e7b4e1655423efa80688c786306df62d6b76e23d41c8ebe596b8f63749  test/r167-release-readiness.test.mjs
 eb5a5e73fd0284297959f4e6ca1631ebf0f23749c56ec1b4cc75cad5f8f1ca6b  test/r168-combined-targeted-runner.mjs
 44818657894db72a0ead65e96e734f30c11f10f5914e2c4e2961ee3a3e5b2c70  test/r168-crash-journal.test.mjs
@@ -2287,7 +2288,7 @@ eb5a5e73fd0284297959f4e6ca1631ebf0f23749c56ec1b4cc75cad5f8f1ca6b  test/r168-comb
 7b0c15a35ec97aa34bedb3759a2c8f276e9b776de2c56a3bebe3be8d6009c102  test/r168-native-r85-protected-scratch.test.mjs
 50ea9e611570940170b6960a5114ce491d50d6a250121f28f3cbb6b26db34771  test/r168-npm-resume-identity.test.mjs
 191b6db0f79e23b48fd64be5d788dc651ef1af5ab165cff3cbe99f18139872aa  test/r168-owner-reconciliation-contract.test.mjs
-1fbc8c1a35b20e6b72669a3cc1f4893687b6a89e41a9e5aba66b268c7169690b  test/r168-protected-entrypoint.test.mjs
+41a4dcaa8d00ef5148f9700f71a5dda3558dacc8d6c90ca17bcdcb9310dbc3e8  test/r168-protected-entrypoint.test.mjs
 c40ee4e3c6f22ace3da133fee953a88545c773def2fe1ef84d5b552b6c9f649a  test/r168-reconciliation-audit.test.mjs
 31218d4b085db1b34f410a7487c0fee9ac40286ec512ee56e500650bf551bfcc  test/r168-release-contract.test.mjs
 0039529761aef4389074f17cd29223a6435b66785616417c030cfd0dd7370951  test/r168-remote-one-shot-coherence.test.mjs
@@ -2295,7 +2296,8 @@ ccd8b5b287808f5165f5e7fd7ade8278ae84c33463e4f9753059806da503fd3c  test/r169-dele
 2866649338191383446edb60d11d558736a4e6d58cb0cdebd94cd8e162fae6bc  test/r169-delegate-cli-integration.test.mjs
 5d2725223b48c2d44dab2eade455f9008a36f91522dcdcc3c0594d762c282b2b  test/r169-targeted-runner.mjs
 bf015b6b85a40f9f81a7627d71217b2994c2161943368bde46be94852ec7eb77  test/r172-activation-recovery.test.mjs
-f65d80e38fd5a96e5a9cc69c66bc29ce9ec4f3cbbf6923bf576b18e139b62c9d  test/r172-release-contract.test.mjs
+d7e3b51f3cd90f1876912832d9b13023b566d5b78d8a3c4a9ce9a776660917c9  test/r172-release-contract.test.mjs
+6c7d5d7b6e1554db8fe8c5c27977f62a93095d3351727eb8e35b33dc21940610  test/r173-release-contract.test.mjs
 3c5c3724bce89aa1fa59fe97cc346c40a5674bb5cd6dc3e2f31b86f2d62e75e4  test/r33-closeout-regression.test.mjs
 5e3700ee610442dfd7b7ae5e380263f231438be0e32790597142c41362a53c9a  test/r33-finalization.test.mjs
 7e419d3c1caf79bfc7407207f50e5645298f9b19d91a7d6f595af185b92cd55e  test/r36-finalization.test.mjs
@@ -2361,7 +2363,7 @@ ca8e23abc89f3eadeceb4b6fdad2cb4db5a7933029ece8e8beae2c6a158876b7  test/r58-owner
 8fc5ed1d3088facf45f9578d9ff8514c3a633f7f342d15eec316e129e7a916c0  test/r58-stale-owner.test.mjs
 84be7ee7d167eb06c9f9fc178930daaa81e53a91de40bad6d7df2060bd3dd165  test/r58-windows-gate.test.mjs
 76db2a4009d76b86e1da57b91a96b0d6bfeb4063bec3301ede736e2fd5832f39  test/r59-release-contract.test.mjs
-d497e0bfbb8838559c7c4c997a71a1b0c991d5c16dc950a6d81f22b7ead7bbc4  test/r59-tool-surface-compat.test.mjs
+b5a4c09711ed25bfab64045f132eec18f8c6a7e37f949fd30861e223826241f1  test/r59-tool-surface-compat.test.mjs
 3befd5d4dc4d8ca9e1f6cbeb9c430671e676c5696d6ee5931c2cbe3244c558a4  test/r60-authority-coherence.test.mjs
 60577e231c7d164f57a3960c574d3e369ca140d9dbc477b2444fa62dbf224e51  test/r60-authority-enforcement.test.mjs
 a1fa0b1e529da05f3659a33be6d36dab02f93808638cf0f458d057e9c6d1e35b  test/r60-bridge-dispatch.test.mjs
@@ -2461,7 +2463,7 @@ c26ac29f6e47e21cc3d20331391295c4f57c20bc1a9094f27079ee60c11ab75b  test/r72-stagi
 ff8d6c7998053a20a0d6a855d4a0013f0f19e649b91731d970e647242bb66e86  test/r74-kernel-lock.test.mjs
 7cb5edf625e965c0e6a6938bd822522777880bd41ad51e73e1daaec6556e2bc2  test/r74-prepublish-contract.test.mjs
 d283a882b9d7bb38b8d6a0db97882fcaf9b6dfa717aca79dd0351012cc00ba23  test/r75-activation-authority-proof.test.mjs
-38b66147b550c1d1e068ebaa9f8de93a070c08a8a99e0ddee7970b0374c4bfc5  test/r75-authority-evidence.test.mjs
+19bfae3e86101af9b5a1ea730498bf0de5fb39f894488b687c516db3a76e00af  test/r75-authority-evidence.test.mjs
 993186133dc7620bcd3057efda9a0ba1435c938656e4b24a32ace4ce57ea9735  test/r76-pinned-marker-cas.test.mjs
 2c21c965864ca4f7deb8f0d5bee4f5a54d20e1c2dbf373f19faa1fc869c33bd1  test/r77-epoch-grant-cas.test.mjs
 547c01ea307b182dbcee341773a29eb5e3045245a046e220b85ace373a0fd678  test/r78-parent-junction-cas.test.mjs

package/PROVENANCE.json

@@ -1,9 +1,9 @@
 {
   "schema": "deadbyte.provenance.v1",
-  "version": "0.15.67",
-  "source_model": "published R168 0.15.66 -> isolated R172 0.15.67; active production 0.15.61 unchanged",
+  "version": "0.15.68",
+  "source_model": "published R172 0.15.67 -> isolated R173 0.15.68; active production 0.15.61 unchanged",
   "signing": "ed25519",
-  "parent_tarball_sha256": "31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d",
+  "parent_tarball_sha256": "0fe761f035f38730a4717448da4217f55464c38cd1616126b5850ff44411cd6d",
   "parent_activation_status": "PUBLISHED_NOT_ACTIVE",
   "parent_rollback_receipt_sha256": null,
   "runtime_predecessor": {
@@ -11,9 +11,9 @@
     "manifest_sha256": "055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf",
     "generation_manifest_sha256": "f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4"
   },
-  "source_predecessor_manifest_file_sha256": "962e227dace247d59aa860211388fbde461c5f9c8a7e8a878e34a14a27d355f8",
-  "source_predecessor_tarball_sha256": "31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d",
-  "reproducibility": "R172 source successor to published R168 0.15.66 exact manifest 962e227dace247d59aa860211388fbde461c5f9c8a7e8a878e34a14a27d355f8; live predecessor 0.15.61 held unchanged",
+  "source_predecessor_manifest_file_sha256": "4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8",
+  "source_predecessor_tarball_sha256": "0fe761f035f38730a4717448da4217f55464c38cd1616126b5850ff44411cd6d",
+  "reproducibility": "R173 source successor to published R172 0.15.67 exact manifest 4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8; live predecessor 0.15.61 held unchanged",
   "public_surface_evidence": {
     "status": "PASS",
     "baseline_release": "v0.15.35-1b5715b276facbc0",
@@ -77,12 +77,12 @@
     "stdio_aggregate_p95_delta_pct": 1.984392678457768,
     "limitations_preserved": true
   },
-  "builder": "deadbyte-r172-terminal-activation-recovery-isolated",
+  "builder": "deadbyte-r173-epoch-proof-hotfix-isolated",
   "parent_release_id": "v0.15.61-055d1ff0aa99e60b",
   "parent_manifest_sha256": "055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf",
   "parent_generation_manifest_sha256": "f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4",
-  "source_predecessor_version": "0.15.66",
-  "source_predecessor_tarball_sha256": "31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d",
+  "source_predecessor_version": "0.15.67",
+  "source_predecessor_tarball_sha256": "0fe761f035f38730a4717448da4217f55464c38cd1616126b5850ff44411cd6d",
   "operator_override": {
     "four_hour_soak": "WAIVED_BY_OPERATOR",
     "clean_machine": "WAIVED_BY_OPERATOR",
@@ -359,5 +359,15 @@
     "full_protected_regression": "PENDING_FINAL_BYTES",
     "publication": "NOT_RUN",
     "production_activation": "NOT_RUN"
+  },
+  "r173": {
+    "status": "FOCUSED_GREEN_PREPUBLICATION",
+    "source_predecessor_version": "0.15.67",
+    "source_predecessor_manifest_sha256": "4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8",
+    "source_predecessor_tarball_sha256": "0fe761f035f38730a4717448da4217f55464c38cd1616126b5850ff44411cd6d",
+    "runtime_predecessor_release_id": "v0.15.61-055d1ff0aa99e60b",
+    "epoch_revoked_authority_proof": "SIGNED_HEAD_AND_CAPTURED_GRANT_BOUND",
+    "publication": "NOT_RUN",
+    "production_activation": "NOT_RUN"
   }
 }

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.15.67 / R172 TERMINAL ACTIVATION RECOVERY
+DEADBYTE MCP V0.15.68 / R173 EPOCH-REVOKED AUTHORITY PROOF HOTFIX
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -16,17 +16,17 @@ check `--version` before issuing a stateful command. The compatibility CMD
 fails with an explanation when npm is detected rather than forwarding the
 wrong command to the controller.
 
-  npx -y deadbyte-mcp@0.15.67 mcp
-  npx -y deadbyte-mcp@0.15.67 remote
-  npx -y deadbyte-mcp@0.15.67 remote status
-  npx -y deadbyte-mcp@0.15.67 remote restart
-  npx -y deadbyte-mcp@0.15.67 audit status
-  npx -y deadbyte-mcp@0.15.67 audit verify
+  npx -y deadbyte-mcp@0.15.68 mcp
+  npx -y deadbyte-mcp@0.15.68 remote
+  npx -y deadbyte-mcp@0.15.68 remote status
+  npx -y deadbyte-mcp@0.15.68 remote restart
+  npx -y deadbyte-mcp@0.15.68 audit status
+  npx -y deadbyte-mcp@0.15.68 audit verify
 
 
-R172 TERMINAL ACTIVATION RECOVERY
+R173 EPOCH-REVOKED AUTHORITY PROOF HOTFIX
 ------------------------
-This 0.15.67 CLI keeps npm publication and local production activation separate.
+This 0.15.68 CLI keeps npm publication and local production activation separate.
 When a newer npm CLI finds an older installed runtime, one-shot remote status
 observes the existing stable launcher and prints VERSION SKEW without deploying.
 On a version mismatch, remote arm/disarm/restart and bare foreground remote
@@ -45,7 +45,7 @@ CLAUDE DESKTOP
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.67", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.68", "mcp"]
       }
     }
   }
@@ -57,7 +57,7 @@ Save as .cursor/mcp.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.67", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.68", "mcp"]
       }
     }
   }
@@ -70,7 +70,7 @@ Save as .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.67", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.68", "mcp"]
       }
     }
   }
@@ -80,7 +80,7 @@ Add to the Codex MCP configuration:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.15.67", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.68", "mcp"]
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.
@@ -369,7 +369,7 @@ CONTROLLER
 ----------
 Primary operator entry point:
 
-  npx -y deadbyte-mcp@0.15.67 remote
+  npx -y deadbyte-mcp@0.15.68 remote
 
 The legacy CMD entry remains compatibility-only for R33 rollback safety.
 
@@ -430,7 +430,7 @@ MCP CLIENT CONFIGURATION
 ------------------------
 The local stdio entry point is quiet and suitable for MCP hosts:
 
-  npx -y deadbyte-mcp@0.15.67 mcp
+  npx -y deadbyte-mcp@0.15.68 mcp
 
 CLAUDE DESKTOP
 Use the standard local-server entry in claude_desktop_config.json:
@@ -439,7 +439,7 @@ Use the standard local-server entry in claude_desktop_config.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.67", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.68", "mcp"]
       }
     }
   }
@@ -452,7 +452,7 @@ Create .cursor/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.67", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.68", "mcp"]
       }
     }
   }
@@ -465,7 +465,7 @@ Create .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.67", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.68", "mcp"]
       }
     }
   }
@@ -475,9 +475,9 @@ Add this to ~/.codex/config.toml:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.15.67", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.68", "mcp"]
 
-The remote device path remains `npx -y deadbyte-mcp@0.15.67 remote`. Remote public MCP uses the
+The remote device path remains `npx -y deadbyte-mcp@0.15.68 remote`. Remote public MCP uses the
 verified HTTPS named-tunnel URL selected by the active generation; do not commit a private device
 URL or tunnel token into a repository.
 

package/RELEASE.json

@@ -1,9 +1,9 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.67",
-  "train": "R172",
-  "label": "R172 terminal activation recovery release",
+  "version": "0.15.68",
+  "train": "R173",
+  "label": "R173 epoch-revoked authority proof hotfix",
   "protocol_revision": "2026-07-28",
   "parent": {
     "version": "0.15.61",
@@ -19,13 +19,13 @@
     "generation_manifest_sha256": "f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4"
   },
   "source_predecessor": {
-    "version": "0.15.66",
-    "train": "R168",
-    "source_path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.66-r168-activation-reconcile",
+    "version": "0.15.67",
+    "train": "R172",
+    "source_path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.67-r172-final-remote-recovery",
     "release_status": "PUBLISHED_REGISTRY_VERIFIED",
     "manifest_status": "VERIFIED_FINAL_BYTES",
-    "manifest_sha256": "962e227dace247d59aa860211388fbde461c5f9c8a7e8a878e34a14a27d355f8",
-    "tarball_sha256": "31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d"
+    "manifest_sha256": "4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8",
+    "tarball_sha256": "0fe761f035f38730a4717448da4217f55464c38cd1616126b5850ff44411cd6d"
   },
   "consolidation": {
     "frontend_status_vocabulary": true,
@@ -534,5 +534,19 @@
     "npm_publish": "NOT_RUN",
     "production_activation": "NOT_RUN",
     "stable_final_claim": false
+  },
+  "r173": {
+    "scope": "EPOCH_REVOKED_AUTHORITY_PROOF_AND_FINAL_REMOTE_RECOVERY",
+    "source_predecessor_version": "0.15.67",
+    "source_predecessor_train": "R172",
+    "source_predecessor_manifest_sha256": "4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8",
+    "source_predecessor_tarball_sha256": "0fe761f035f38730a4717448da4217f55464c38cd1616126b5850ff44411cd6d",
+    "runtime_predecessor_release_id": "v0.15.61-055d1ff0aa99e60b",
+    "epoch_revoked_authority_proof": "GREEN_FOCUSED",
+    "public_tool_delta": 0,
+    "authority_scope_delta": 0,
+    "npm_publish": "NOT_RUN",
+    "production_activation": "NOT_RUN",
+    "stable_final_claim": false
   }
 }

package/SBOM.cdx.json

@@ -1,13 +1,13 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:cdx:deadbyte-mcp:r172:0.15.67",
+  "serialNumber": "urn:cdx:deadbyte-mcp:r173:0.15.68",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "deadbyte-mcp",
-      "version": "0.15.67"
+      "version": "0.15.68"
     }
   },
   "components": [

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.67",
-  "train": "R172",
+  "version": "0.15.68",
+  "train": "R173",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",

package/bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-chatgpt-bridge",
-  "version": "0.15.67",
+  "version": "0.15.68",
   "private": true,
   "type": "module",
   "engines": {

package/controller/deadbyte-process-policy.json

@@ -1,15 +1,15 @@
 {
   "schema": "deadbyte.process-policy.v1",
   "enabled": true,
-  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.67-r172-final-remote-recovery\\controller\\runtime\\process-grant.json",
-  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.67-r172-final-remote-recovery\\controller\\runtime\\process-state",
+  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.68-r173-epoch-proof\\controller\\runtime\\process-grant.json",
+  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.68-r173-epoch-proof\\controller\\runtime\\process-state",
   "native_host": {
-    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.67-r172-final-remote-recovery\\bin\\deadbyte-process-host.exe",
+    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.68-r173-epoch-proof\\bin\\deadbyte-process-host.exe",
     "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {
-      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.67-r172-final-remote-recovery",
+      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.68-r173-epoch-proof",
       "deny_paths": [
         "node_modules",
         "controller/runtime",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.67",
+  "version": "0.15.68",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
@@ -98,7 +98,8 @@
     "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r168.ps1 -Stage all",
     "r168:focused:test": "node test/r168-combined-targeted-runner.mjs",
     "r168:release:verify": "node scripts/npm-release-r48.mjs --verify-only",
-    "r172:focused:test": "node --test --test-concurrency=1 test/r172-activation-recovery.test.mjs test/r172-release-contract.test.mjs test/r169-delegate-active.test.mjs test/r169-delegate-cli-integration.test.mjs test/r65-activation-lock-recovery.test.mjs test/r65-activation-orchestration.test.mjs"
+    "r172:focused:test": "node --test --test-concurrency=1 test/r172-activation-recovery.test.mjs test/r172-release-contract.test.mjs test/r169-delegate-active.test.mjs test/r169-delegate-cli-integration.test.mjs test/r65-activation-lock-recovery.test.mjs test/r65-activation-orchestration.test.mjs",
+    "r173:focused:test": "node --test --test-concurrency=1 test/r75-authority-evidence.test.mjs test/r172-activation-recovery.test.mjs test/r173-release-contract.test.mjs test/r65-activation-preflight.test.mjs test/r65-activation-orchestration.test.mjs"
   },
   "bundleDependencies": [
     "@modelcontextprotocol/server",

package/scripts/r173-protected-preflight.mjs

@@ -0,0 +1,42 @@
+// R173 privileged preflight; read-only. Never invokes native CAS or changes grants.
+import {createHash} from 'node:crypto';
+import {readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {parseManifest,verifyManifestTreeExact} from '../src/release-slot.mjs';
+import {inspectTrustedInstallation,privilegedEpochInstallFiles} from '../src/privileged-install-trust-r89.mjs';
+
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const version='0.15.68',expectedTrain='R173';
+const mandatory=['scripts/r173-protected-preflight.mjs','src/activation-continuity-abort-r172.mjs',
+  'src/activation-lock-r65.mjs','src/activation-preflight-r65.mjs',
+  'src/activation-reconciliation-journal-r168.mjs','src/activation-reconciliation-terminal-r168.mjs',
+  'src/activation-reconciliation-fence-r168.mjs','src/activation-reconciliation-audit-r168.mjs'];
+function denied(reason){throw new Error('R173_'+reason);}
+function actualProtectedRoot(){
+  const trusted='C:\\Program Files',rel=path.win32.relative(trusted,root);
+  if(!rel||rel==='..'||rel.startsWith('..'+path.win32.sep)||path.win32.isAbsolute(rel))denied('ROOT_UNPROTECTED');
+  return root;
+}
+async function main(){
+  if(process.platform!=='win32'||process.arch!=='x64')denied('WINDOWS_X64_REQUIRED');
+  if(process.argv.length!==2)denied('UNKNOWN_OPTION');
+  const verifiedRoot=actualProtectedRoot();
+  const pkg=JSON.parse(await readFile(path.join(verifiedRoot,'package.json'),'utf8'));
+  const release=JSON.parse(await readFile(path.join(verifiedRoot,'RELEASE.json'),'utf8'));
+  if(pkg.name!=='deadbyte-mcp'||pkg.version!==version||release.name!=='deadbyte-mcp'||
+     release.version!==version||release.train!==expectedTrain)denied('VERSION_DRIFT');
+  const manifest=await readFile(path.join(verifiedRoot,'MANIFEST.SHA256'));
+  const entries=parseManifest(manifest.toString('utf8'));
+  for(const name of mandatory)if(!entries.has(name))denied('SOURCE_NOT_IN_MANIFEST');
+  await verifyManifestTreeExact(verifiedRoot,entries,{allowedExtraPaths:['.npmignore','package-lock.json']});
+  const important=[...privilegedEpochInstallFiles(verifiedRoot,process.execPath),
+    ...mandatory.map(rel=>path.win32.join(verifiedRoot,...rel.split('/'))),
+    path.win32.join(verifiedRoot,'MANIFEST.SHA256'),path.win32.join(verifiedRoot,'RELEASE.json'),
+    path.win32.join(verifiedRoot,'package.json')];
+  await inspectTrustedInstallation(important);
+  const hash=createHash('sha256').update(manifest).digest('hex');
+  process.stdout.write(JSON.stringify({status:'R173_PROTECTED_PREFLIGHT_READONLY_PASS',version,train:expectedTrain,
+    manifest_sha256:hash,files:entries.size,terminalization_authorized:false,activation_authorized:false})+'\n');
+}
+try{await main();}catch(error){process.stderr.write('R173_PROTECTED_PREFLIGHT=BLOCKED '+String(error?.message??error)+'\n');process.exitCode=1;}

package/src/activation-authority-proof-r75.mjs

@@ -1,6 +1,7 @@
 import {createHash} from 'node:crypto';
 import {lstat,open,realpath} from 'node:fs/promises';
 import path from 'node:path';
+import {createAuthorityEpochStore} from './authority-continuity-r65.mjs';
 
 const FIELDS=Object.freeze({process:'grant_file',coding:'lease_file',autonomous:'lease_file',desktop:'grant_file',host:'arm_file'});
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
@@ -22,7 +23,9 @@ async function readRegularPinned(file,label){
   }finally{await handle.close();}
 }
 
-export async function observeAuthorityEvidence({stateRoot,policyPaths,policySha256,authority}){
+export async function observeAuthorityEvidence({stateRoot,policyPaths,policySha256,authority,
+  epochStoreFactory=createAuthorityEpochStore}){
+  if(typeof epochStoreFactory!=='function')throw new Error('authority epoch store factory invalid');
   const runtimeRoot=await realpath(path.join(stateRoot,'runtime'));
   const result={};
   for(const [plane,field] of Object.entries(FIELDS)){
@@ -49,11 +52,31 @@ export async function observeAuthorityEvidence({stateRoot,policyPaths,policySha2
     const grantAbsent=grantInfo===undefined;
     if(grantInfo&&(!grantInfo.isFile()||grantInfo.isSymbolicLink()))throw new Error(`${plane} grant file type invalid`);
     const validEntry=entry&&entry.configured===true&&typeof entry.armed==='boolean';
-    const validDisarmed=validEntry&&!entry.armed&&grantAbsent&&
-      (entry.reason==='disarmed'||(plane==='autonomous'&&entry.reason==='coding-disarmed'));
+    const grantBytes=grantInfo?await readRegularPinned(checkedPath,`${plane} grant`):null;
+    const grantSha=grantBytes?sha(grantBytes):null;
+    let transactionRevoked=false;
+    if(validEntry&&!entry.armed&&entry.reason==='epoch-revoked'&&grantBytes){
+      let grant;
+      try{grant=JSON.parse(grantBytes.toString('utf8').replace(/^\uFEFF/,''));}catch{}
+      const nonce=grant?.instance_nonce;
+      if(typeof nonce==='string'&&/^[0-9a-f]{64}$/.test(nonce)){
+        const store=epochStoreFactory({runtimeDir:parent,policyBytes});
+        const [audit,head,verification]=await Promise.all([
+          store.auditHistory({plane}),store.readHead({plane}),
+          store.verifyGrant({plane,grantBytes,grantInstanceNonce:nonce,policyBytes})
+        ]);
+        transactionRevoked=audit?.status==='PASS'&&Number.isSafeInteger(audit.verified_events)&&audit.verified_events>0&&
+          head?.action==='transaction_revoke'&&Number.isSafeInteger(head.seq)&&head.seq>0&&
+          /^[0-9a-f]{64}$/.test(String(head.event_sha256??''))&&
+          head.policy_sha256===expectedHash&&head.grant_sha256===grantSha&&head.grant_instance_nonce===nonce&&
+          /^r65-[0-9a-f]{32}$/.test(String(head.update_id??''))&&verification?.trusted===false&&
+          verification?.reason==='epoch-revoked'&&verification?.event_sha256===head.event_sha256;
+      }
+    }
+    const validDisarmed=validEntry&&!entry.armed&&(
+      (grantAbsent&&(entry.reason==='disarmed'||(plane==='autonomous'&&entry.reason==='coding-disarmed')))||transactionRevoked);
     const validArmed=validEntry&&entry.armed&&!grantAbsent&&entry.reason==='standing-grant'&&
       Number.isSafeInteger(entry.epoch_seq)&&entry.epoch_seq>0&&/^[0-9a-f]{64}$/.test(entry.epoch_sha256??'');
-    const grantSha=grantInfo?sha(await readRegularPinned(checkedPath,`${plane} grant`)):null;
     let grantFinal;
     try{grantFinal=await lstat(checkedPath);}
     catch(error){if(error?.code!=='ENOENT')throw error;}
@@ -61,6 +84,7 @@ export async function observeAuthorityEvidence({stateRoot,policyPaths,policySha2
       throw new Error(`${plane} grant identity changed during observation`);
     result[plane]=Object.freeze({state:validDisarmed?'VERIFIED_DISARMED':validArmed?'VERIFIED_ARMED':'UNVERIFIED',
       policy_sha256:expectedHash,grant_absent:grantAbsent,
+      ...(transactionRevoked?{transaction_revoked:true}:{}),
       ...(grantSha?{grant_sha256:grantSha}:{})});
   }
   return Object.freeze(result);

package/src/activation-preflight-r65.mjs

@@ -63,7 +63,8 @@ export function classifyActivationPreflight({pointer,expectedParent,candidate,ex
       return Object.freeze({state:'AUTHORITY_UNVERIFIED',safe_to_activate:false,reason:`${plane} authority proof missing`,...bound});
     if(proof&&(proof.policy_sha256!==observation?.policy_sha256?.[plane]||
         proof.state!==(authority[plane]?'VERIFIED_ARMED':'VERIFIED_DISARMED')||
-        (!authority[plane]&&proof.grant_absent!==true)))
+        (!authority[plane]&&proof.grant_absent!==true&&
+          !(entry?.reason==='epoch-revoked'&&proof.transaction_revoked===true))))
       return Object.freeze({state:'AUTHORITY_UNVERIFIED',safe_to_activate:false,reason:`${plane} authority proof unverified`,...bound});
   }
   if(PLANES.some(plane=>!HEX64.test(String(observation?.policy_sha256?.[plane]))))

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.67';
+export const DEADBYTE_VERSION = '0.15.68';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/r130-release-security-contract.test.mjs

@@ -7,18 +7,18 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async file=>JSON.parse(await readFile(path.join(root,file),'utf8'));
-test('current successor retains the R130 security baseline with truthful R172 identity',async()=>{
+test('current successor retains the R130 security baseline with truthful R173 identity',async()=>{
   const [pkg,release,provenance,bom,lock,matrix]=await Promise.all([
     read('package.json'),read('RELEASE.json'),read('PROVENANCE.json'),
     read('SBOM.cdx.json'),read('package-lock.json'),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.67');
-  assert.equal(release.train,'R172');
-  assert.equal(matrix.train,'R172');
-  assert.equal(release.source_predecessor.version,'0.15.66');
-  assert.equal(release.source_predecessor.train,'R168');
-  assert.match(release.source_predecessor.source_path,/0\.15\.66-r168-activation-reconcile/i);
+    assert.equal(actual,'0.15.68');
+  assert.equal(release.train,'R173');
+  assert.equal(matrix.train,'R173');
+  assert.equal(release.source_predecessor.version,'0.15.67');
+  assert.equal(release.source_predecessor.train,'R172');
+  assert.match(release.source_predecessor.source_path,/0\.15\.67-r172-final-remote-recovery/i);
   assert.equal(release.source_predecessor.manifest_status,'VERIFIED_FINAL_BYTES');
   assert.equal(release.runtime_predecessor.version,'0.15.61');
   assert.equal(provenance.r160.source_predecessor_manifest_status,'STALE_REJECTED');

package/test/r132-release-identity.test.mjs

@@ -8,23 +8,23 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 
-test('R172 package identity preserves R132 evidence and published R168 source predecessor',async()=>{
+test('R173 package identity preserves R132 evidence and published R172 source predecessor',async()=>{
   const [pkg,lock,release,prov,bom,matrix]=await Promise.all([
     read('package.json'),read('package-lock.json'),read('RELEASE.json'),
     read('PROVENANCE.json'),read('SBOM.cdx.json'),read('TEST-MATRIX.json')]);
   for(const value of [pkg.version,lock.version,lock.packages[''].version,release.version,prov.version,bom.metadata.component.version,matrix.version,DEADBYTE_VERSION]){
     assert.equal(value,pkg.version);
   }
-  assert.equal(release.train,'R172');
-  assert.equal(matrix.train,'R172');
-  assert.equal(release.source_predecessor.version,'0.15.66');
-  assert.equal(release.source_predecessor.train,'R168');
-  assert.match(release.source_predecessor.source_path,/0\.15\.66-r168-activation-reconcile/i);
+  assert.equal(release.train,'R173');
+  assert.equal(matrix.train,'R173');
+  assert.equal(release.source_predecessor.version,'0.15.67');
+  assert.equal(release.source_predecessor.train,'R172');
+  assert.match(release.source_predecessor.source_path,/0\.15\.67-r172-final-remote-recovery/i);
   assert.equal(prov.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(release.r165.published_source_manifest_sha256,'4adf7d94682fbb71c4a91eb3147ecc48076bbc5d79cb67fcb875cde6a1bb4805');
   assert.equal(release.r165.published_source_tarball_sha256,'812e97609b7c51353ed25f2202129737e43bb4fbe0778c3adec43ec065352641');
-  assert.equal(release.source_predecessor.tarball_sha256,'31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d');
-  assert.equal(release.r172.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
+  assert.equal(release.source_predecessor.tarball_sha256,'0fe761f035f38730a4717448da4217f55464c38cd1616126b5850ff44411cd6d');
+  assert.equal(release.r173.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
   assert.equal(release.runtime_predecessor.version,'0.15.61');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);
   assert.equal(prov.runtime_predecessor.manifest_sha256,release.runtime_predecessor.manifest_sha256);

package/test/r153-prepublish-identity.test.mjs

@@ -26,7 +26,7 @@ test('R153 historical verifier refuses current successor package identity',async
  const state={pkg:JSON.parse(await readFile(path.join(root,'package.json'),'utf8')),
   release:JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8')),
   bridge:JSON.parse(await readFile(path.join(root,'bridge/package.json'),'utf8'))};
- assert.equal(state.pkg.version,'0.15.67');
+ assert.equal(state.pkg.version,'0.15.68');
  assert.throws(()=>verifyR153Lineage(state),/package version/);
  await assert.rejects(verifyR153IdentityTree(root),/package version/);
 });

package/test/r163-isolated-slot-rollback-restore.test.mjs

@@ -8,7 +8,7 @@ import {fileURLToPath} from 'node:url';
 import {atomicWriteActivePointer,materializeReleaseSlot,parseActivePointer,parseManifest,renderStableLauncherPs1,verifyManifestTreeExact} from '../src/release-slot.mjs';
 
 const candidate=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
-const version='0.15.67';
+const version='0.15.68';
 const parent=path.join(os.homedir(),'.deadbyte-mcp','releases','v0.15.61-055d1ff0aa99e60b');
 const parentDigest='055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf';
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
@@ -21,7 +21,7 @@ async function generation(state,label){
   await writeFile(path.join(root,'GENERATION.SHA256'),manifest,{flag:'wx'});
   return {root,manifest_sha256:sha(manifest),config_path:path.join(root,'controller-config.psd1')};
 }
-test('R172 isolated immutable slot activates, rolls back, and restores 0.15.67 without authority or production mutation',async()=>{
+test('R173 isolated immutable slot activates, rolls back, and restores 0.15.68 without authority or production mutation',async()=>{
   const stateBase=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r163-isolated-'));
   const state=path.join(stateBase,'state');
   try{

package/test/r165-live-cli-skew.test.mjs

@@ -17,7 +17,7 @@ const hashMarker=c=>c.repeat(64);
 async function fixture(t,kind){
   assert.equal(typeof envRoot,'string'); assert.ok(path.isAbsolute(envRoot));
   assert.match(sha(await readFile(path.join(envRoot,'MANIFEST.SHA256'))),/^[0-9a-f]{64}$/);
-  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.67');
+  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.68');
   const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r164-skew-e2e-'));
   t.after(async()=>{await rm(dir,{recursive:true,force:true,maxRetries:10,retryDelay:150});});
   const state=path.join(dir,'state'),bin=path.join(state,'bin');
@@ -68,7 +68,7 @@ async function run(fx){
 gate('R168 executable CLI blocks npm-cache activation on version skew before touching R159 history',async t=>{
  const fx=await fixture(t,'completed');
  const r=await run(fx);
- assert.match(r.output,/R168 version skew.*0\.15\.61.*0\.15\.67/i,r.output);
+ assert.match(r.output,/R168 version skew.*0\.15\.61.*0\.15\.68/i,r.output);
  assert.doesNotMatch(r.output,/R159 ambiguous multiple completed/i);
  assert.equal(r.trace,'');
  assert.doesNotMatch(r.trace,/disarmdesktop/);

package/test/r167-release-contract.test.mjs

@@ -8,11 +8,11 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 const readOptional=async rel=>{try{return await read(rel);}catch(error){if(error?.code==='ENOENT')return null;throw error;}};
-const VERSION='0.15.67';
+const VERSION='0.15.68';
 const R166_MANIFEST='ad3c091fbbe2bac6d234548724008b67305fd483ad6542f92d5aeb1aa84f5849';
 const R166_TARBALL='3d22412c3cebabd66bfa92ca4dbaaf3ef49acba7f92436a16485d7e4cb18c653';
 
-test('R172 package identity binds published R168 source separately from active R153 runtime',async()=>{
+test('R173 package identity binds published R172 source separately from active R153 runtime',async()=>{
   const [pkg,lock,bridge,release,provenance,matrix,bom]=await Promise.all([
     read('package.json'),readOptional('package-lock.json'),read('bridge/package.json'),read('RELEASE.json'),
     read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
@@ -20,19 +20,19 @@ test('R172 package identity binds published R168 source separately from active R
     provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION];
   if(lock)versions.push(lock.version,lock.packages[''].version);
   for(const version of versions)assert.equal(version,VERSION);
-  assert.equal(release.train,'R172');
-  assert.equal(matrix.train,'R172');
-  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r172:0.15.67');
+  assert.equal(release.train,'R173');
+  assert.equal(matrix.train,'R173');
+  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r173:0.15.68');
   assert.deepEqual(release.runtime_predecessor,{
     version:'0.15.61',release_id:'v0.15.61-055d1ff0aa99e60b',
     manifest_sha256:'055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf',
     generation_manifest_sha256:'f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4'
   });
-  assert.equal(release.source_predecessor.version,'0.15.66');
-  assert.equal(release.source_predecessor.train,'R168');
-  assert.equal(release.source_predecessor.tarball_sha256,'31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d');
+  assert.equal(release.source_predecessor.version,'0.15.67');
+  assert.equal(release.source_predecessor.train,'R172');
+  assert.equal(release.source_predecessor.tarball_sha256,'0fe761f035f38730a4717448da4217f55464c38cd1616126b5850ff44411cd6d');
   assert.equal(release.r167.source_predecessor_manifest_sha256,R166_MANIFEST);
-  assert.equal(provenance.source_predecessor_manifest_file_sha256,'962e227dace247d59aa860211388fbde461c5f9c8a7e8a878e34a14a27d355f8');
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,'4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8');
   assert.equal(release.r172.source_predecessor_manifest_sha256,'962e227dace247d59aa860211388fbde461c5f9c8a7e8a878e34a14a27d355f8');
   assert.equal(release.r172.source_predecessor_tarball_sha256,'31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d');
   assert.equal(release.r167.public_tool_delta,0);

package/test/r168-protected-entrypoint.test.mjs

@@ -6,7 +6,7 @@ import {fileURLToPath} from 'node:url';
 import path from 'node:path';
 
 const root=fileURLToPath(new URL('..',import.meta.url));
-const script=path.join(root,'scripts','r172-protected-preflight.mjs');
+const script=path.join(root,'scripts','r173-protected-preflight.mjs');
 const protectedRoot='C:\\Program Files';
 const relative=path.win32.relative(protectedRoot,root);
 const isProtected=process.platform==='win32'&&relative!==''&&relative!=='..'&&!relative.startsWith('..'+path.win32.sep)&&!path.win32.isAbsolute(relative);
@@ -14,17 +14,17 @@ function launch(file,...args){return spawnSync(process.execPath,[file,...args],{
   encoding:'utf8',windowsHide:true,shell:false,timeout:15000,maxBuffer:65536
 });}
 
-test('R172 installed preflight respects R89 protected-vs-writable execution context',()=>{
+test('R173 installed preflight respects R89 protected-vs-writable execution context',()=>{
   const result=launch(script);
   if(isProtected){
     assert.equal(result.status,0,result.stderr);
-    assert.match(result.stdout,/R172_PROTECTED_PREFLIGHT_READONLY_PASS/);
+    assert.match(result.stdout,/R173_PROTECTED_PREFLIGHT_READONLY_PASS/);
     assert.match(result.stdout,/"terminalization_authorized":false/);
     assert.match(result.stdout,/"activation_authorized":false/);
   }else{
     assert.notEqual(result.status,0);
-    assert.match(result.stderr,/R172_PROTECTED_PREFLIGHT=BLOCKED/);
-    assert.match(result.stderr,/R172_.*_(UNPROTECTED|VERSION_DRIFT)/);
+    assert.match(result.stderr,/R173_PROTECTED_PREFLIGHT=BLOCKED/);
+    assert.match(result.stderr,/R173_.*_(UNPROTECTED|VERSION_DRIFT)/);
   }
 });
 
@@ -32,20 +32,20 @@ test('R172 writable development copy remains blocked when protected fixture exis
   const source=path.resolve(process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT||root);
   if(path.win32.relative(protectedRoot,source).toLowerCase()===path.win32.relative(protectedRoot,root).toLowerCase()&&isProtected)
     return test.skip('no separate development source configured');
-  const result=launch(path.join(source,'scripts','r172-protected-preflight.mjs'));
+  const result=launch(path.join(source,'scripts','r173-protected-preflight.mjs'));
   assert.notEqual(result.status,0);
-  assert.match(result.stderr,/R172_PROTECTED_PREFLIGHT=BLOCKED/);
-  assert.match(result.stderr,/R172_.*_UNPROTECTED/);
+  assert.match(result.stderr,/R173_PROTECTED_PREFLIGHT=BLOCKED/);
+  assert.match(result.stderr,/R173_.*_UNPROTECTED/);
 });
 
 test('R172 entrypoint does not accept flags to skip manifest, R89 or root checks',()=>{
   const result=launch(script,'--skip-trust');
   assert.notEqual(result.status,0);
-  assert.match(result.stderr,/R172_PROTECTED_PREFLIGHT=BLOCKED/);
+  assert.match(result.stderr,/R173_PROTECTED_PREFLIGHT=BLOCKED/);
   assert.match(result.stderr,/UNKNOWN_OPTION/);
 });
 
-test('R172 protected preflight source is read-only and calls exact manifest and OS ACL verification',async()=>{
+test('R173 protected preflight source is read-only and calls exact manifest and OS ACL verification',async()=>{
   const src=await readFile(script,'utf8');
   assert.match(src,/verifyManifestTreeExact\(/);
   assert.match(src,/inspectTrustedInstallation\(/);

package/test/r172-release-contract.test.mjs

@@ -9,20 +9,20 @@ const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 const readOptional=async rel=>{try{return await read(rel);}catch(error){if(error?.code==='ENOENT')return null;throw error;}};
 
-test('R172 binds the published source predecessor separately from the active runtime predecessor',async()=>{
+test('R173 binds the published source predecessor separately from the active runtime predecessor',async()=>{
   const [pkg,lock,bridge,release,provenance,matrix,bom]=await Promise.all([
     read('package.json'),readOptional('package-lock.json'),read('bridge/package.json'),read('RELEASE.json'),
     read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
   const versions=[pkg.version,bridge.version,release.version,provenance.version,matrix.version,
     bom.metadata.component.version,DEADBYTE_VERSION];
   if(lock)versions.push(lock.version,lock.packages[''].version);
-  for(const value of versions)assert.equal(value,'0.15.67');
-  assert.equal(release.train,'R172'); assert.equal(matrix.train,'R172');
-  assert.equal(release.source_predecessor.version,'0.15.66');
-  assert.equal(release.source_predecessor.manifest_sha256,'962e227dace247d59aa860211388fbde461c5f9c8a7e8a878e34a14a27d355f8');
-  assert.equal(release.source_predecessor.tarball_sha256,'31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d');
+  for(const value of versions)assert.equal(value,'0.15.68');
+  assert.equal(release.train,'R173'); assert.equal(matrix.train,'R173');
+  assert.equal(release.source_predecessor.version,'0.15.67');
+  assert.equal(release.source_predecessor.manifest_sha256,'4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8');
+  assert.equal(release.source_predecessor.tarball_sha256,'0fe761f035f38730a4717448da4217f55464c38cd1616126b5850ff44411cd6d');
   assert.equal(release.runtime_predecessor.release_id,'v0.15.61-055d1ff0aa99e60b');
-  assert.equal(release.r172.public_tool_delta,0); assert.equal(release.r172.authority_scope_delta,0);
+  assert.equal(release.r173.public_tool_delta,0); assert.equal(release.r173.authority_scope_delta,0);
 });
 
 test('R172 recovery remains fail closed until final protected and publication gates pass',async()=>{

package/test/r173-release-contract.test.mjs

@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const json=async file=>JSON.parse(await readFile(path.join(root,file),'utf8'));
+
+test('R173 package identity binds the exact published R172 source and live runtime predecessor',async()=>{
+  const [pkg,lock,bridge,release,provenance,matrix,sbom]=await Promise.all([
+    json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
+    json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json')
+  ]);
+  assert.equal(pkg.version,'0.15.68');
+  assert.equal(lock.version,'0.15.68');
+  assert.equal(lock.packages[''].version,'0.15.68');
+  assert.equal(bridge.version,'0.15.68');
+  assert.equal(release.version,'0.15.68');
+  assert.equal(release.train,'R173');
+  assert.equal(matrix.version,'0.15.68');
+  assert.equal(matrix.train,'R173');
+  assert.equal(sbom.metadata.component.version,'0.15.68');
+  assert.equal(release.source_predecessor.version,'0.15.67');
+  assert.equal(release.source_predecessor.train,'R172');
+  assert.equal(release.source_predecessor.manifest_sha256,'4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8');
+  assert.equal(release.source_predecessor.tarball_sha256,'0fe761f035f38730a4717448da4217f55464c38cd1616126b5850ff44411cd6d');
+  assert.equal(release.runtime_predecessor.version,'0.15.61');
+  assert.equal(provenance.version,'0.15.68');
+  assert.equal(provenance.parent_tarball_sha256,release.source_predecessor.tarball_sha256);
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,release.source_predecessor.manifest_sha256);
+});

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65','0.15.66','0.15.67'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65','0.15.66','0.15.67','0.15.68'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');

package/test/r75-authority-evidence.test.mjs

@@ -49,6 +49,38 @@ test('a present grant with controller armed=false is unverified, not clean',asyn
   }finally{await f.cleanup();}
 });
 
+test('a signed transaction revoke proves epoch-revoked disarmed while captured grant bytes remain',async()=>{
+  const stateRoot=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r173-epoch-proof-'));
+  try{
+    const runtime=path.join(stateRoot,'runtime'),policies=path.join(stateRoot,'policies');
+    await mkdir(runtime);await mkdir(policies);
+    const policyPaths={},policySha256={},authority={};
+    let codingGrant=null,codingPolicyBytes=null;
+    for(const plane of planes){
+      const grant=path.join(runtime,`${plane}-grant.json`),policyPath=path.join(policies,`${plane}.json`);
+      const bytes=Buffer.from(JSON.stringify({schema:`deadbyte.${plane}-policy.v${plane==='host'?2:1}`,enabled:true,
+        [grantField[plane]]:grant,...(plane==='coding'?{roots:{project:{path:path.join(stateRoot,'project')}}}:{})}));
+      await writeFile(policyPath,bytes);policyPaths[plane]=policyPath;policySha256[plane]=sha(bytes);
+      authority[plane]={configured:true,armed:false,reason:plane==='coding'?'epoch-revoked':'disarmed'};
+      if(plane==='coding'){codingGrant=grant;codingPolicyBytes=bytes;}
+    }
+    const nonce='7'.repeat(64),grantBytes=Buffer.from(JSON.stringify({schema:'deadbyte.coding-grant.v2',
+      policy_sha256:sha(codingPolicyBytes),instance_nonce:nonce,root_ids:['project'],granted_at_utc:new Date().toISOString()}));
+    await writeFile(codingGrant,grantBytes);
+    const grantSha=sha(grantBytes),eventSha='8'.repeat(64);
+    const proof=await observeAuthorityEvidence({stateRoot,policyPaths,policySha256,authority,
+      epochStoreFactory:()=>({
+        auditHistory:async()=>({status:'PASS',verified_events:2}),
+        readHead:async()=>({action:'transaction_revoke',seq:2,event_sha256:eventSha,policy_sha256:sha(codingPolicyBytes),
+          grant_sha256:grantSha,grant_instance_nonce:nonce,update_id:'r65-'+'8'.repeat(32)}),
+        verifyGrant:async()=>({trusted:false,reason:'epoch-revoked',event_sha256:eventSha})
+      })});
+    assert.equal(proof.coding.state,'VERIFIED_DISARMED');
+    assert.equal(proof.coding.grant_absent,false);
+    assert.equal(proof.coding.transaction_revoked,true);
+  }finally{await rm(stateRoot,{recursive:true,force:true});}
+});
+
 test('malformed policy cannot provide disarmed proof',async()=>{
   const f=await fixture();
   try{