deadbyte-mcp 0.15.68 → 0.15.69

package/src/remote-live-log.mjs

@@ -11,7 +11,7 @@ const LIFECYCLE=Object.freeze({
   session_new:'[SESSION] New foreground session',
   session_restored:'♻️ [SESSION] Previous result stream replayed',
   ready:'✅ [READY] DEADBYTE MCP online',
-  cleanup:'🔐 [AUTH] Revoking session authority...'
+  cleanup:'[SESSION] Closing observation session...'
 });
 const LIFECYCLE_ASCII=Object.freeze({
   device_start:'[DEVICE] Starting DEADBYTE MCP...',
@@ -20,7 +20,7 @@ const LIFECYCLE_ASCII=Object.freeze({
   session_new:'[SESSION] New foreground session',
   session_restored:'[SESSION] Previous result stream replayed',
   ready:'[READY] DEADBYTE MCP online',
-  cleanup:'[AUTH] Revoking session authority...'
+  cleanup:'[SESSION] Closing observation session...'
 });
 
 function safeAtom(value){
@@ -104,13 +104,33 @@ function rootedPath(args,key='path',rootPaths={}){
     if(base){
       const flavor=/^(?:[A-Za-z]:[\\/]|\\\\)/.test(base)?path.win32:path.posix;
       const absolute=p==='.'?flavor.resolve(base):flavor.resolve(base,p);
+      const relative=flavor.relative(flavor.resolve(base),absolute);
+      // A display-only resolver must not misleadingly mark traversal as in-root.
+      if(relative==='..'||relative.startsWith('..'+flavor.sep)||flavor.isAbsolute(relative))
+        return '[outside root='+root+'] '+p;
       return absolute+' [root='+root+']';
     }
+    // We do not invent drive letters when the trusted runtime policy has
+    // not supplied the actual root mapping.
     return root+':'+p;
   }
   if(root) return 'root='+root;
   return p?'path='+p:'';
 }
+function detailedDisplayPaths(args,rootPaths){
+  const safe=sanitizeAuditArgs(args??{});
+  const paths=[];
+  const entry=(key,label)=>{
+    if(!safePathAtom(safe?.[key]))return;
+    const value=rootedPath(safe,key,rootPaths)+(safe.root_id&&!safePathAtom(rootPaths?.[safe.root_id])?' [unresolved root]':'');
+    if(value)paths.push((label?label+': ':'')+value);
+  };
+  if(safe?.source_path&&safe?.destination_path){
+    entry('source_path','FROM');entry('destination_path','TO');
+  }else if(safe?.path)entry('path','');
+  else if(safe?.script_path)entry('script_path','SCRIPT');
+  return paths;
+}
 function displayToolName(tool,args){
   const op=safeAtom(args?.op);
   if(op&&['machine_fs','coding_inspect','process_session','desktop_control','machine_observe'].includes(tool)) return tool+'.'+op;
@@ -399,10 +419,12 @@ export function createLiveTimelineWriter({stream=process.stdout,displayMode='uni
 
 export function defaultForegroundTimelineOptions({verbose=false}={}){
   if(typeof verbose!=='boolean')throw new Error('default live timeline verbosity invalid');
-  return Object.freeze({commanderStyle:!verbose,foldHeartbeats:false});
+  // R176 default: readable emoji timeline with compact heartbeat groups.
+  // Commander/verbose presentation remains explicitly selectable by callers.
+  return Object.freeze({commanderStyle:false,foldHeartbeats:!verbose,prettyStyle:!verbose});
 }
 
-export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,foldHeartbeats=false,heartbeatBurstLimit=10,heartbeatWindowMs=3000,displayMode='unicode',rootPaths={},trace=false,slowCallMs=1000,commanderStyle=false}={}){
+export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,foldHeartbeats=false,heartbeatBurstLimit=10,heartbeatWindowMs=3000,displayMode='unicode',rootPaths={},trace=false,slowCallMs=1000,commanderStyle=false,prettyStyle=false}={}){
   if(typeof clock!=='function') throw new Error('live timeline clock must be a function');
   if(!REMOTE_DISPLAY_MODES.includes(displayMode)) throw new Error('remote display mode invalid');
   if(!Number.isInteger(heartbeatBurstLimit)||heartbeatBurstLimit<2||heartbeatBurstLimit>100) throw new Error('heartbeatBurstLimit invalid');
@@ -410,6 +432,7 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
   if(!rootPaths||typeof rootPaths!=='object'||Array.isArray(rootPaths)) throw new Error('live timeline rootPaths invalid');
   if(typeof trace!=='boolean') throw new Error('live timeline trace invalid');
   if(typeof commanderStyle!=='boolean') throw new Error('live timeline commanderStyle invalid');
+  if(typeof prettyStyle!=='boolean') throw new Error('live timeline prettyStyle invalid');
   if(typeof foldHeartbeats!=='boolean') throw new Error('live timeline foldHeartbeats invalid');
   if(!Number.isInteger(slowCallMs)||slowCallMs<100||slowCallMs>600000) throw new Error('live timeline slowCallMs invalid');
   const pending=new Map();
@@ -428,6 +451,23 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
     return visual+'  '+displayClock(eventMs(event,clock))+'  '+seq+'['+shortSpanId(event.request_id)+']  '+tool;
   }
   function traceSuffix(meta){return trace&&meta?'  '+traceText(meta,displayMode):'';}
+  function prettyLine(event,tool,tag,detail='',glyph=null,displayPaths=[]){
+    const time=displayClock(eventMs(event,clock)).slice(0,8);
+    const title=tool.length>30?tool.slice(0,29)+'…':tool;
+    // Spaces avoid incorrect console-cell widths for double-width emoji.
+    const icon=glyph??iconForTool(tool,displayMode);
+    const leader=displayMode==='ascii'?' | ':'  │ ';
+    const shortId=shortSpanId(event.request_id);
+    const label=title.padEnd(31,' ');
+    const headline=time+'  '+icon+' '+tag.padEnd(8,' ')+' '+label+
+      leader+'['+shortId+']'+(detail?'  '+clipped(detail,220):'');
+    if(!displayPaths.length)return remoteDisplayText(headline,displayMode);
+    const pathIcon=displayMode==='ascii'?'PATH: ':'📁 ';
+    // Paths are not shortened to an ambiguous basename: retain the Windows
+    // drive, directory tree and policy root. Respect the bounded input limit.
+    const descriptions=displayPaths.map(p=>'   '+pathIcon+p);
+    return remoteDisplayText([headline,...descriptions].join('\n'),displayMode);
+  }
   function resultLine(event,span,sequence){
     const outcome=outcomeClass(event);
     const error=outcome==='error';
@@ -458,6 +498,16 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
     const prefixIcon=unknown?(displayMode==='ascii'?'WARN':'⚠️'):null;
     const evidence=receipt?'  '+(displayMode==='ascii'?'RECEIPT':'🧾 receipt')+(displayMode==='ascii'?'=':'=')+receipt:'';
     const reasonSep=displayMode==='ascii'?' - ':' — ';
+    if(prettyStyle){
+      const tag=unknown?'UNKNOWN':pendingResult?'PENDING':error?(rawStatus==='denied'?'DENIED':'FAIL'):'PASS';
+      const glyph=displayMode==='ascii'?(unknown?'!':error?'X':pendingResult?'~':'+'):
+        unknown?'⚠️':error?'❌':pendingResult?'⏳':'✅';
+      const pathList=span?.display_paths??[];
+      const nonPathSummary=pathList.length?summary.replace(pathList[0],'').trim():summary;
+      const detail=[duration,trace&&span?.trace_meta?traceText(span.trace_meta,displayMode):'',nonPathSummary,statusDetail.trim(),receipt?'receipt='+receipt:'',
+        reason?reason:''].filter(Boolean).join('  |  ');
+      return prettyLine(event,displayTool,tag,detail,glyph,pathList);
+    }
     if(commanderStyle){
       const tag=unknown?'OUTCOME_UNKNOWN':pendingResult?'pending':error?'failed':'completed';
       const state=rawStatus?' status='+rawStatus:'';
@@ -475,6 +525,11 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
     const endClock=displayClock(value.last_ms);
     const range=value.first_ms===value.last_ms?endClock:startClock.slice(0,8)+'–'+endClock.slice(0,8);
     if(value.count>1) foldedHeartbeatLines+=value.count-1;
+    if(prettyStyle){
+      return prettyLine({request_id:'polling',created_at_utc:new Date(value.last_ms).toISOString()},
+        value.tool,'FOLDED','×'+value.count+'  avg '+formatDuration(avg),
+        displayMode==='ascii'?'H':'📡');
+    }
     const marker=displayMode==='ascii'?'OK':'✓';
     return remoteDisplayText(iconForTool(value.tool,displayMode)+'  '+range+'  '+seq+value.tool+' ×'+value.count+'  avg '+formatDuration(avg)+'  '+marker,displayMode);
   }
@@ -512,12 +567,13 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
       const args=event.args??{};
       const displayTool=displayToolName(tool,args);
       const summary=summarizeLiveToolArgs(displayTool,args,{rootPaths});
+      const displayPaths=prettyStyle?detailedDisplayPaths(args,rootPaths):[];
       const traceMeta=traceIdentity(event,args);
       if(pending.size>=MAX_PRESENTATION_IDENTITIES){
         pendingOverflow++;
         return pendingOverflow===1?remoteDisplayText('LIVELOG pending span cap reached; full audit remains on disk',displayMode):null;
       }
-      pending.set(requestId,{request_id:requestId,tool,display_tool:displayTool,summary,trace_meta:traceMeta,started_at_ms:clock()});
+      pending.set(requestId,{request_id:requestId,tool,display_tool:displayTool,summary,display_paths:displayPaths,trace_meta:traceMeta,started_at_ms:clock()});
       peakInFlight=Math.max(peakInFlight,pending.size);
       if(commanderStyle){
         const safeArgs=sanitizeAuditArgs(args);
@@ -527,6 +583,9 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
       }
       if(verbose) return formatRemoteToolCall({...event,tool:displayTool},{clock,displayMode})+traceSuffix(traceMeta);
       if(visibleStart(displayTool)){
+        if(prettyStyle) return prettyLine(event,displayTool,'START',
+          [trace?traceText(traceMeta,displayMode):'',displayPaths.length?summary.replace(displayPaths[0],'').trim():summary].filter(Boolean).join('  |  '),
+          null,displayPaths);
         const startMarker=displayMode==='ascii'?'START':'▶ START';
         return remoteDisplayText(eventPrefix(event,sequence,{displayTool})+traceSuffix(traceMeta)+'  '+startMarker+(summary?'  '+summary:''),displayMode);
       }
@@ -606,6 +665,23 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
     const p50=sorted.length?(sorted.length%2?sorted[(sorted.length-1)/2]:(sorted[sorted.length/2-1]+sorted[sorted.length/2])/2):null;
     const p95=sorted.length?sorted[Math.max(0,Math.ceil(sorted.length*0.95)-1)]:null;
     const p99=sorted.length?sorted[Math.max(0,Math.ceil(sorted.length*0.99)-1)]:null;
+    if(prettyStyle){
+      const ascii=displayMode==='ascii';
+      const lines=[
+        (ascii?'[SUMMARY]':'📊 SESSION')+'  '+resultCount+' calls | '+okCount+' ok | '+
+          errorCount+(errorCount===1?' error | ':' errors | ')+unknownCount+' unknown'+(pendingCount?' | '+pendingCount+' pending':''),
+        (ascii?'   work:':'   🛠 work:')+' '+mutationCount+' mutations | peak '+peakInFlight+' in-flight'+
+          (foldedHeartbeatLines?' | folded '+foldedHeartbeatLines+' heartbeats':''),
+        (ascii?'   timing:':'   ⏱ timing:')+' p50 '+(p50===null?'n/a':formatDuration(p50))+
+          ' | p95 '+(p95===null?'n/a':formatDuration(p95))+
+          ' | p99 '+(p99===null?'n/a':formatDuration(p99))+
+          (slowest?' | slowest '+slowest.tool+' '+formatDuration(slowest.duration_ms):''),
+        (ascii?'   top:':'   🔝 top:')+(top?' '+top:' none')
+      ];
+      if(pendingOverflow)lines.push((ascii?'   WARNING:':'   ⚠️ WARNING:')+
+        ' '+pendingOverflow+' untracked presentation spans; inspect signed audit');
+      return remoteDisplayText(lines.join('\n'),displayMode);
+    }
     return remoteDisplayText((displayMode==='ascii'?'[SUMMARY]':'📊 [SUMMARY]')+' '+resultCount+' calls | '+okCount+' ok | '+
       errorCount+' error'+(errorCount===1?'':'s')+' | '+unknownCount+' unknown'+(pendingCount?' | '+pendingCount+' pending':'')+' | '+mutationCount+' mutation'+(mutationCount===1?'':'s')+
       ' | tool time '+(formatDuration(totalDurationMs)||'0ms')+

package/src/remote-session-guardian.mjs

@@ -8,6 +8,7 @@ import { windowsPowerShellEnvironment } from './runtime-update.mjs';
 import { resolveStateRoot } from './state-root.mjs';
 import { AUTHORITY_PLANES, parseAuthorityObservation, assertAuthorityVector } from './remote-authority.mjs';
 import { readRemoteMarkerSnapshot, deletePinnedRemoteMarker } from './foreground-marker-cas-win32.mjs';
+import {assertObserveOnlyMarker} from './r175-foreground-boundary.mjs';
 
 const CLEANUP=['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost'];
 const TRUSTED_WINDOWS_ROOT='C:\\Windows';
@@ -68,6 +69,9 @@ async function main(){
   const ownerPid=Number(args['owner-pid']);
   const nonce=String(args['session-nonce']||'');
   const ipcOwner=args['owner-channel']==='ipc';
+  const observerGuard=args['authority-scope']==='observe-only';
+  if(args['authority-scope']!==undefined&&!observerGuard)
+    throw new Error('R175 guardian authority scope invalid');
   if(ipcOwner&&typeof process.send!=='function')throw new Error('guardian owner IPC channel missing');
   if(!Number.isInteger(ownerPid)||ownerPid<1) throw new Error('guardian owner pid invalid');
   if(ipcOwner&&process.ppid!==ownerPid)throw new Error('guardian IPC parent does not match declared owner');
@@ -85,6 +89,25 @@ async function main(){
       continue;
     }
 
+    // R179: a missing command-line flag is never permission to downgrade an
+    // observation-only marker to legacy broad authority revocation.
+    if(assertObserveOnlyMarker(marker)&&!observerGuard)
+      throw new Error('R179_OBSERVER_GUARDIAN_SCOPE_DOWNGRADE: owner grants retained');
+    if(observerGuard){
+      // Guardian scope is inherited from the parent process command line.
+      // Marker mismatch can never degrade into legacy unconditional revoke.
+      if(!assertObserveOnlyMarker(marker))
+        throw new Error('R175 observer guardian marker invalid; no grants touched');
+      // Observation-only sessions own the foreground marker, never the
+      // process/coding/host/desktop/autonomous grants or runtime.
+      const current=await readRemoteMarkerSnapshot(markerPath);
+      if(!current)return;
+      if(!markerMatches(current.marker,{ownerPid,nonce})||!assertObserveOnlyMarker(current.marker))return;
+      if(deletePinnedRemoteMarker(markerPath,current.sha256)!=='REMOVED')
+        throw new Error('R175 guardian monitor marker CAS failed; marker retained');
+      return;
+    }
+
     const failed=[];
     for(const command of CLEANUP){
       const latest=await readMarker(markerPath);

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.68';
+export const DEADBYTE_VERSION = '0.15.69';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/helpers/r175-active-pointer.mjs

@@ -0,0 +1,28 @@
+import {createHash} from 'node:crypto';
+import {mkdir,readFile,writeFile} from 'node:fs/promises';
+import path from 'node:path';
+
+const sha256=value=>createHash('sha256').update(value).digest('hex');
+
+export async function installExactActivePointer({stateRoot,packageRoot,launcherPath}){
+  const manifestBytes=await readFile(path.join(packageRoot,'MANIFEST.SHA256'));
+  const manifestSha256=sha256(manifestBytes);
+  const pkg=JSON.parse(await readFile(path.join(packageRoot,'package.json'),'utf8'));
+  const generationRoot=path.join(stateRoot,'generations','test-current');
+  const configPath=path.join(generationRoot,'controller-config.psd1');
+  await mkdir(generationRoot,{recursive:true});
+  await writeFile(configPath,"@{ Label = 'test-current' }\r\n",'utf8');
+  const pointer={
+    schema:'deadbyte.active-release.v1',
+    release_id:`v${pkg.version}-${manifestSha256.slice(0,16)}`,
+    version:pkg.version,
+    manifest_sha256:manifestSha256,
+    release_root:path.resolve(packageRoot),
+    generation_root:generationRoot,
+    generation_manifest_sha256:sha256(await readFile(configPath)),
+    launcher_sha256:sha256(await readFile(launcherPath)),
+    config_path:configPath
+  };
+  await writeFile(path.join(stateRoot,'active-release.json'),`${JSON.stringify(pointer)}\n`,'utf8');
+  return pointer;
+}

package/test/helpers/release-lock.mjs

@@ -0,0 +1,12 @@
+import {readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+export async function readReleaseLock(root){
+  const rootPath=root instanceof URL?fileURLToPath(root):root;
+  for(const relative of ['package-lock.json','docs/R184-package-lock.json']){
+    try{return JSON.parse(await readFile(path.join(rootPath,relative),'utf8'));}
+    catch(error){if(error?.code!=='ENOENT')throw error;}
+  }
+  throw new Error('R184_RELEASE_LOCK_EVIDENCE_MISSING');
+}

package/test/r129-sdk-security-baseline.test.mjs

@@ -3,6 +3,7 @@ import assert from 'node:assert/strict';
 import {readFile} from 'node:fs/promises';
 import path from 'node:path';
 import {fileURLToPath} from 'node:url';
+import {readReleaseLock} from './helpers/release-lock.mjs';
 
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 async function json(file){return JSON.parse(await readFile(path.join(root,file),'utf8'));}
@@ -29,7 +30,7 @@ test('R129 shipped client and server SDK exclude all recorded 2.1.0 security adv
 });
 
 test('R129 lockfile resolves security-fixed SDK packages without prerelease versions',async()=>{
-  const lock=await json('package-lock.json');
+  const lock=await readReleaseLock(root);
   const pins=['@modelcontextprotocol/client','@modelcontextprotocol/server'];
   for(const dep of pins){
     const version=lock.packages?.['node_modules/'+dep]?.version;

package/test/r130-release-security-contract.test.mjs

@@ -4,23 +4,24 @@ import {readFile} from 'node:fs/promises';
 import {fileURLToPath} from 'node:url';
 import path from 'node:path';
 import {DEADBYTE_VERSION} from '../src/version.mjs';
+import {readReleaseLock} from './helpers/release-lock.mjs';
 
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async file=>JSON.parse(await readFile(path.join(root,file),'utf8'));
-test('current successor retains the R130 security baseline with truthful R173 identity',async()=>{
+test('current successor retains the R130 security baseline with truthful R179 identity',async()=>{
   const [pkg,release,provenance,bom,lock,matrix]=await Promise.all([
     read('package.json'),read('RELEASE.json'),read('PROVENANCE.json'),
-    read('SBOM.cdx.json'),read('package-lock.json'),read('TEST-MATRIX.json')]);
+    read('SBOM.cdx.json'),readReleaseLock(root),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.68');
-  assert.equal(release.train,'R173');
-  assert.equal(matrix.train,'R173');
-  assert.equal(release.source_predecessor.version,'0.15.67');
-  assert.equal(release.source_predecessor.train,'R172');
-  assert.match(release.source_predecessor.source_path,/0\.15\.67-r172-final-remote-recovery/i);
-  assert.equal(release.source_predecessor.manifest_status,'VERIFIED_FINAL_BYTES');
-  assert.equal(release.runtime_predecessor.version,'0.15.61');
+    assert.equal(actual,'0.15.69');
+  assert.equal(release.train,'R179');
+  assert.equal(matrix.train,'R179');
+  assert.equal(release.source_predecessor.version,'0.15.68');
+  assert.equal(release.source_predecessor.train,'R173');
+  assert.match(release.source_predecessor.source_path,/deadbyte-mcp-0\.15\.68\.tgz/i);
+  assert.equal(release.source_predecessor.manifest_status,'ACTIVE_PRODUCTION_MANIFEST_VERIFIED');
+  assert.equal(release.runtime_predecessor.version,'0.15.68');
   assert.equal(provenance.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(pkg.dependencies['@modelcontextprotocol/client'],'2.3.1');
   assert.equal(pkg.dependencies['@modelcontextprotocol/server'],'2.3.1');

package/test/r132-release-identity.test.mjs

@@ -4,28 +4,29 @@ import {readFile} from 'node:fs/promises';
 import path from 'node:path';
 import {fileURLToPath} from 'node:url';
 import {DEADBYTE_VERSION} from '../src/version.mjs';
+import {readReleaseLock} from './helpers/release-lock.mjs';
 
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 
-test('R173 package identity preserves R132 evidence and published R172 source predecessor',async()=>{
+test('R179 package identity preserves R132 evidence and published R173 source predecessor',async()=>{
   const [pkg,lock,release,prov,bom,matrix]=await Promise.all([
-    read('package.json'),read('package-lock.json'),read('RELEASE.json'),
+    read('package.json'),readReleaseLock(root),read('RELEASE.json'),
     read('PROVENANCE.json'),read('SBOM.cdx.json'),read('TEST-MATRIX.json')]);
   for(const value of [pkg.version,lock.version,lock.packages[''].version,release.version,prov.version,bom.metadata.component.version,matrix.version,DEADBYTE_VERSION]){
     assert.equal(value,pkg.version);
   }
-  assert.equal(release.train,'R173');
-  assert.equal(matrix.train,'R173');
-  assert.equal(release.source_predecessor.version,'0.15.67');
-  assert.equal(release.source_predecessor.train,'R172');
-  assert.match(release.source_predecessor.source_path,/0\.15\.67-r172-final-remote-recovery/i);
+  assert.equal(release.train,'R179');
+  assert.equal(matrix.train,'R179');
+  assert.equal(release.source_predecessor.version,'0.15.68');
+  assert.equal(release.source_predecessor.train,'R173');
+  assert.match(release.source_predecessor.source_path,/deadbyte-mcp-0\.15\.68\.tgz/i);
   assert.equal(prov.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(release.r165.published_source_manifest_sha256,'4adf7d94682fbb71c4a91eb3147ecc48076bbc5d79cb67fcb875cde6a1bb4805');
   assert.equal(release.r165.published_source_tarball_sha256,'812e97609b7c51353ed25f2202129737e43bb4fbe0778c3adec43ec065352641');
-  assert.equal(release.source_predecessor.tarball_sha256,'0fe761f035f38730a4717448da4217f55464c38cd1616126b5850ff44411cd6d');
-  assert.equal(release.r173.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
-  assert.equal(release.runtime_predecessor.version,'0.15.61');
+  assert.equal(release.source_predecessor.tarball_sha256,'1a7f1fe05a06178b8d772a140be6e0470790b743cef690c3f8f8165cc61075bf');
+  assert.equal(release.r179.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
+  assert.equal(release.runtime_predecessor.version,'0.15.68');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);
   assert.equal(prov.runtime_predecessor.manifest_sha256,release.runtime_predecessor.manifest_sha256);
   assert.equal(prov.runtime_predecessor.generation_manifest_sha256,release.runtime_predecessor.generation_manifest_sha256);
@@ -36,7 +37,7 @@ test('R173 package identity preserves R132 evidence and published R172 source pr
 });
 
 test('R132 shipped SBOM matches the actual audited bundled MCP SDK',async()=>{
-  const [pkg,bom,lock]=await Promise.all([read('package.json'),read('SBOM.cdx.json'),read('package-lock.json')]);
+  const [pkg,bom,lock]=await Promise.all([read('package.json'),read('SBOM.cdx.json'),readReleaseLock(root)]);
   for(const name of ['@modelcontextprotocol/client','@modelcontextprotocol/server','@modelcontextprotocol/core']){
     const entry=bom.components.find(v=>v.name===name);
     assert.ok(entry,'missing SBOM component: '+name);

package/test/r153-prepublish-identity.test.mjs

@@ -26,7 +26,7 @@ test('R153 historical verifier refuses current successor package identity',async
  const state={pkg:JSON.parse(await readFile(path.join(root,'package.json'),'utf8')),
   release:JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8')),
   bridge:JSON.parse(await readFile(path.join(root,'bridge/package.json'),'utf8'))};
- assert.equal(state.pkg.version,'0.15.68');
+ assert.equal(state.pkg.version,'0.15.69');
  assert.throws(()=>verifyR153Lineage(state),/package version/);
  await assert.rejects(verifyR153IdentityTree(root),/package version/);
 });

package/test/r155-default-live-log.test.mjs

@@ -14,25 +14,25 @@ function defaultTracker(){
  return live.createLiveTimelineTracker({clock:now,...live.defaultForegroundTimelineOptions({verbose:false})});
 }
 
-test('R155 ordinary remote has per-call START and DONE without opt-in flag',()=>{
+test('R176 default folds harmless status polling',()=>{
  const tracker=defaultTracker();
  const start=tracker.observe({event_type:'tool.request',request_id:'abc012345678',tool:'machine_status',args:{}},{sequence:1});
- assert.match(start,/Received tool call/);
- assert.match(start,/machine_status/);
+ assert.equal(start,null);
  const done=tracker.observe({event_type:'tool.result',request_id:'abc012345678',tool:'machine_status',outcome:{status:'ok',duration_ms:3}},{sequence:2});
- assert.match(done,/completed/);
- assert.match(done,/3ms/);
+ assert.equal(done,null);
+ assert.match(tracker.reconcileInterrupted().join('\n'),/machine_status.*×1/);
 });
 
-test('R155 ordinary remote does not fold successive status calls into a burst',()=>{
+test('R176 status bursts collapse without losing event totals',()=>{
  const tracker=defaultTracker();
  for(let n=0;n<3;n++){
   const id='repeat-'+n;
-  assert.match(tracker.observe({event_type:'tool.request',request_id:id,tool:'machine_ping',args:{}},{sequence:n*2+1}),/Received tool call/);
-  assert.match(tracker.observe({event_type:'tool.result',request_id:id,tool:'machine_ping',outcome:{status:'ok',duration_ms:1}},{sequence:n*2+2}),/completed/);
+  assert.equal(tracker.observe({event_type:'tool.request',request_id:id,tool:'machine_ping',args:{}},{sequence:n*2+1}),null);
+  assert.equal(tracker.observe({event_type:'tool.result',request_id:id,tool:'machine_ping',outcome:{status:'ok',duration_ms:1}},{sequence:n*2+2}),null);
  }
+ assert.match(tracker.reconcileInterrupted().join('\n'),/machine_ping.*×3/);
  assert.match(tracker.summary(),/3 calls \| 3 ok/);
- assert.doesNotMatch(tracker.summary(),/folded [1-9]/);
+ assert.match(tracker.summary(),/folded 2 heartbeat/);
 });
 
 test('R155 ordinary remote keeps credentials and payload opaque by default',()=>{
@@ -42,7 +42,7 @@ test('R155 ordinary remote keeps credentials and payload opaque by default',()=>
    command_id:'node_script',path:'C:\\Safe\\test.js',
    metadata:{token:'Bearer should-not-appear'}
  }},{sequence:1});
- assert.match(line,/Received tool call/);
+ assert.match(line,/START/);
  assert.match(line,/node_script/);
  assert.doesNotMatch(line,/sk-secret-test|PRIVATE SOURCE CONTENT|should-not-appear/);
 });
@@ -51,10 +51,10 @@ test('R155 ordinary remote prints DENIED and UNKNOWN as failures rather than com
  const tracker=defaultTracker();
  tracker.observe({event_type:'tool.request',request_id:'one',tool:'host_file_read',args:{path:'a.txt'}},{sequence:1});
  const fail=tracker.observe({event_type:'tool.result',request_id:'one',tool:'host_file_read',outcome:{status:'denied',is_error:true,reason:'arm file missing'}},{sequence:2});
- assert.match(fail,/failed/);assert.match(fail,/arm file missing/);
+ assert.match(fail,/DENIED/);assert.match(fail,/arm file missing/);
  tracker.observe({event_type:'tool.request',request_id:'two',tool:'coding_file_write',args:{path:'x.txt'}},{sequence:3});
  const unknown=tracker.observe({event_type:'tool.result',request_id:'two',tool:'coding_file_write',outcome:{status:'interrupted',side_effect_state:'unknown'}},{sequence:4});
- assert.match(unknown,/OUTCOME_UNKNOWN/);
+ assert.match(unknown,/UNKNOWN/);
 });
 
 test('R155 ordinary remote has no new CLI live-log mode and wired default live behavior',()=>{
@@ -66,16 +66,17 @@ test('R155 ordinary remote has no new CLI live-log mode and wired default live b
  assert.match(source,/defaultForegroundTimelineOptions\(\{verbose\}\)/);
 });
 
-test('R155 unchanged capability polling still has a matching visible DONE for every CALL',()=>{
+test('R176 same snapshot suppresses repeated capability messages',()=>{
  const tracker=defaultTracker();
  const snapshot='a'.repeat(64);
  for(let n=0;n<2;n++){
   const id='cap-'+n;
-  assert.match(tracker.observe({event_type:'tool.request',request_id:id,tool:'capability_manifest',args:{}},{sequence:n*2+1}),/Received tool call/);
+  assert.equal(tracker.observe({event_type:'tool.request',request_id:id,tool:'capability_manifest',args:{}},{sequence:n*2+1}),null);
   const done=tracker.observe({event_type:'tool.result',request_id:id,tool:'capability_manifest',outcome:{status:'ok',snapshot_id:snapshot,state_epoch:1,duration_ms:2}},{sequence:n*2+2});
-  assert.match(done,/completed/);
+  if(n===0) assert.match(done,/PASS/);
+  else assert.equal(done,null);
  }
- assert.match(tracker.summary(),/2 calls \\| 2 ok/);
+ assert.match(tracker.summary(),/2 calls \| 2 ok/);
 });
 
 test('R155 runtime-only stream reset does not claim audit corruption, audit reset remains severe',()=>{

package/test/r160-package-decision-manifest.test.mjs

@@ -59,7 +59,7 @@ test('R160 startup decision manifest rejects a newly required recovery module om
 test('R160 remote startup verifies decision bytes before evidence recovery and foreground claim',async()=>{
   const source=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
   const verifyAt=source.indexOf('await verifyPackageDecisionManifest({root:CURRENT_PACKAGE_ROOT,expectedVersion:DEADBYTE_VERSION})');
-  const recoverAt=source.indexOf('const migrationContext=await recoverRemoteSession(ctx,{displayMode})');
+  const recoverAt=source.indexOf('await recoverRemoteSession(ctx,{displayMode})');
   const claimAt=source.indexOf('marker=await claimRemoteSession(ctx)');
   assert.ok(verifyAt>0&&verifyAt<recoverAt&&recoverAt<claimAt,
     'package decision manifest must be verified before recovery and claim');

package/test/r160-release-contract.test.mjs

@@ -8,12 +8,11 @@ const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 
 test('R160 historical contract remains distinct from the current package identity',async()=>{
   const [release,provenance]=await Promise.all([read('RELEASE.json'),read('PROVENANCE.json')]);
-  assert.equal(release.runtime_predecessor.version,'0.15.61');
-  assert.equal(release.runtime_predecessor.release_id,'v0.15.61-055d1ff0aa99e60b');
-  assert.equal(release.runtime_predecessor.manifest_sha256,'055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf');
-  assert.equal(release.runtime_predecessor.generation_manifest_sha256,'f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4');
-  assert.equal(release.r160.source_predecessor_train,'R159');
+  assert.equal(release.runtime_predecessor.version,'0.15.68');
+  assert.equal(release.runtime_predecessor.release_id,'v0.15.68-ff29dbb2fbb89862');
+  assert.equal(release.runtime_predecessor.manifest_sha256,'ff29dbb2fbb898625592afb47835a4a62ef289429f1e0a89a83242398cd98885');
   assert.equal(release.r160.runtime_predecessor_version,'0.15.61');
+  assert.equal(release.r160.source_predecessor_train,'R159');
   assert.equal(release.r160.public_tool_delta,0);
   assert.equal(release.r160.authority_scope_delta,0);
   assert.equal(release.r160.production_activation,'NOT_RUN');

package/test/r163-isolated-slot-rollback-restore.test.mjs

@@ -8,9 +8,9 @@ import {fileURLToPath} from 'node:url';
 import {atomicWriteActivePointer,materializeReleaseSlot,parseActivePointer,parseManifest,renderStableLauncherPs1,verifyManifestTreeExact} from '../src/release-slot.mjs';
 
 const candidate=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
-const version='0.15.68';
-const parent=path.join(os.homedir(),'.deadbyte-mcp','releases','v0.15.61-055d1ff0aa99e60b');
-const parentDigest='055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf';
+const version='0.15.69';
+const parent=path.join(os.homedir(),'.deadbyte-mcp','releases','v0.15.68-ff29dbb2fbb89862');
+const parentDigest='ff29dbb2fbb898625592afb47835a4a62ef289429f1e0a89a83242398cd98885';
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
 async function generation(state,label){
   const root=path.join(state,'generations',label);
@@ -21,7 +21,7 @@ async function generation(state,label){
   await writeFile(path.join(root,'GENERATION.SHA256'),manifest,{flag:'wx'});
   return {root,manifest_sha256:sha(manifest),config_path:path.join(root,'controller-config.psd1')};
 }
-test('R173 isolated immutable slot activates, rolls back, and restores 0.15.68 without authority or production mutation',async()=>{
+test('R179 isolated immutable slot activates, rolls back, and restores 0.15.69 without authority or production mutation',async()=>{
   const stateBase=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r163-isolated-'));
   const state=path.join(stateBase,'state');
   try{
@@ -31,7 +31,7 @@ test('R173 isolated immutable slot activates, rolls back, and restores 0.15.68 w
     const nextManifest=await readFile(path.join(candidate,'MANIFEST.SHA256'));
     assert.equal(sha(parentManifest),parentDigest);
     const nextDigest=sha(nextManifest);
-    const parentSlot=await materializeReleaseSlot({source:parent,stateRoot:state,version:'0.15.61',manifestSha256:parentDigest});
+    const parentSlot=await materializeReleaseSlot({source:parent,stateRoot:state,version:'0.15.68',manifestSha256:parentDigest});
     const nextSlot=await materializeReleaseSlot({source:candidate,stateRoot:state,version,manifestSha256:nextDigest});
     const pGen=await generation(state,'r165-parent');
     const nGen=await generation(state,'r165-next');
@@ -43,7 +43,7 @@ test('R173 isolated immutable slot activates, rolls back, and restores 0.15.68 w
     const activated=await atomicWriteActivePointer(pointerPath,ptr(nextSlot,version,nGen));
     assert.equal(activated.release_id,nextSlot.release_id);
     await verifyManifestTreeExact(nextSlot.release_root,parseManifest(nextManifest.toString('utf8')));
-    const rolled=await atomicWriteActivePointer(pointerPath,ptr(parentSlot,'0.15.61',pGen));
+    const rolled=await atomicWriteActivePointer(pointerPath,ptr(parentSlot,'0.15.68',pGen));
     assert.equal(rolled.release_id,parentSlot.release_id);
     assert.equal(rolled.manifest_sha256,parentDigest);
     await verifyManifestTreeExact(parentSlot.release_root,parseManifest(parentManifest.toString('utf8')));

package/test/r165-live-cli-skew.test.mjs

@@ -17,7 +17,7 @@ const hashMarker=c=>c.repeat(64);
 async function fixture(t,kind){
   assert.equal(typeof envRoot,'string'); assert.ok(path.isAbsolute(envRoot));
   assert.match(sha(await readFile(path.join(envRoot,'MANIFEST.SHA256'))),/^[0-9a-f]{64}$/);
-  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.68');
+  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.69');
   const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r164-skew-e2e-'));
   t.after(async()=>{await rm(dir,{recursive:true,force:true,maxRetries:10,retryDelay:150});});
   const state=path.join(dir,'state'),bin=path.join(state,'bin');
@@ -65,26 +65,26 @@ async function run(fx){
  assert.doesNotMatch(trace,/\b(?:start|restart|armprocess|armcoding|armautonomous|deploy)\b/i,'unexpected runtime operation');
  return {output:(result.stderr||'')+'\n'+(result.stdout||''),trace};
 }
-gate('R168 executable CLI blocks npm-cache activation on version skew before touching R159 history',async t=>{
+gate('R175 executable CLI blocks foreground observation on version skew before touching history',async t=>{
  const fx=await fixture(t,'completed');
  const r=await run(fx);
- assert.match(r.output,/R168 version skew.*0\.15\.61.*0\.15\.68/i,r.output);
+ assert.match(r.output,/R175_EXACT_ACTIVE_RELEASE_REQUIRED/i,r.output);
  assert.doesNotMatch(r.output,/R159 ambiguous multiple completed/i);
  assert.equal(r.trace,'');
  assert.doesNotMatch(r.trace,/disarmdesktop/);
 });
 gate('R165 executable CLI rejects pending current reconciliation before upgrade',async t=>{
  const fx=await fixture(t,'pending'),r=await run(fx);
- assert.match(r.output,/R168 version skew/i,r.output);
+ assert.match(r.output,/R175_EXACT_ACTIVE_RELEASE_REQUIRED/i,r.output);
  assert.doesNotMatch(r.trace,/disarmhost/);
 });
 gate('R165 executable CLI rejects tampered terminal before upgrade',async t=>{
  const fx=await fixture(t,'tampered'),r=await run(fx);
- assert.match(r.output,/R168 version skew/i,r.output);
+ assert.match(r.output,/R175_EXACT_ACTIVE_RELEASE_REQUIRED/i,r.output);
  assert.doesNotMatch(r.trace,/disarmhost/);
 });
 gate('R165 executable CLI keeps ambiguous history fail-closed when predecessor is not ONLINE',async t=>{
  const fx=await fixture(t,'offline'),r=await run(fx);
- assert.match(r.output,/R168 version skew/i,r.output);
+ assert.match(r.output,/R175_EXACT_ACTIVE_RELEASE_REQUIRED/i,r.output);
  assert.doesNotMatch(r.trace,/disarmhost/);
 });