deadbyte-mcp 0.15.69 → 0.15.71

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.69",
-  "train": "R179",
+  "version": "0.15.71",
+  "train": "R191",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",
@@ -10,6 +10,21 @@
     "schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
   },
   "required": [
+    {
+      "id": "r191-trusted-successor-epoch-root",
+      "command": "run R191 protected 0.15.71 ACL and full Windows regression",
+      "expected": "R89 ACL verifies successor exact manifest and native epoch tests pass; no dev-root bypass"
+    },
+    {
+      "id": "r191-signed-initial-precondition-reconciliation",
+      "command": "node --test test/r191-epoch-source-claim.test.mjs test/r153-r65-signed-precondition-recovery.test.mjs",
+      "expected": "R65 claim reconciles only with signed initial R27 rejection, correct predecessor and untampered receipt"
+    },
+    {
+      "id": "r190-explicit-foreground-recovery",
+      "command": "node --test --test-concurrency=1 test/r190-foreground-owner-recovery.test.mjs test/r190-foreground-cli.test.mjs",
+      "expected": "Exact legacy marker hash, PID-reuse proof, pointer and authority vector are bound; native CAS deletion is marker-only and crash-resumable"
+    },
     {
       "id": "r160-receipt-startup-identity",
       "command": "node --test test/r153-marker-reconcile-receipt.test.mjs test/r159-legacy-marker-evidence.test.mjs test/r160-marker-proof.test.mjs test/r160-package-decision-manifest.test.mjs",
@@ -668,5 +683,51 @@
     "package_verify_only": "PASS_2552_MANIFEST_ENTRIES",
     "registry_publish": "NOT_RUN",
     "production_activation": "NOT_RUN"
+  },
+  "r190": {
+    "status": "PREPUBLISH_VERIFIED_BEFORE_FINAL_METADATA_SEAL",
+    "targeted_source": "PASS_14_OF_14",
+    "targeted_protected": "PASS_14_OF_14",
+    "full_protected": "PASS_2090_OF_2141_51_CLASSIFIED_SKIP_0_FAIL",
+    "full_protected_transcript_sha256": "85bbd8088ee25fabd37bd062cf1ec0ad83c43e04abeee81881fc009755a9dd32",
+    "npm_verify_only": "PASS_PRE_FINAL_METADATA_SEAL",
+    "live_marker_reconciliations": 2,
+    "live_foreground_mcp": "PASS_23_CALLS_22_OK_1_EXPECTED_DENIED_0_UNKNOWN_0_MUTATIONS",
+    "active_runtime_after_test": "v0.15.68-ff29dbb2fbb89862_ONLINE",
+    "authority_after_test": "ALL_FIVE_PLANES_DISARMED",
+    "publication": "NOT_RUN",
+    "production_activation": "NOT_RUN"
+  },
+  "r191": {
+    "release_version": "0.15.71",
+    "protected_full": "NOT_VERIFIED",
+    "production_activation": "NOT_RUN",
+    "npm_publish": "NOT_RUN",
+    "test_status": "SOURCE_FOCUSED_PASS_FULL_PENDING",
+    "focused_security": "PASS_47_FAIL_0_SKIP_0",
+    "historical_release_regression": "PASS_25_FAIL_0_SKIP_1",
+    "r191_claim_inspect": "RECONCILABLE_SIGNED_READ_ONLY",
+    "protected_first_attempt": "FAIL_263_PASS_2_FAIL_3_SKIP_IN_BATCH_1_OF_8",
+    "protected_first_log_sha256": "a417aa51f82d93463e69df4d8b90ec8498817fa5ac84e2b7d7fe6b30c7118b30",
+    "corrective_focused_tests": "PASS_10_FAIL_0_SKIP_0",
+    "corrective_security_regression": "PASS_47_FAIL_0_SKIP_0",
+    "protected_retest": "PENDING_FRESH_EXACT_BYTES_TEST_B",
+    "protected_second_attempt": "FAIL_BATCH_2_273_PASS_1_FAIL_7_SKIP_AFTER_BATCH_1_266_PASS_0_FAIL_3_SKIP",
+    "protected_second_log_sha256": "eb32db586a6a1e09d2404eb5088b7783a0f9261d991583be097f13fda8ef8db3",
+    "process_policy_source_rebound": "R191_EXACT_DEV_ROOT",
+    "process_policy_contract": "PASS_5_FAIL_0",
+    "protected_third_attempt": "FAIL_BATCH_3_255_PASS_7_FAIL_5_SKIP_AFTER_1_263_PASS_0_FAIL_3_SKIP_AND_2_266_PASS_0_FAIL_7_SKIP",
+    "protected_third_log_sha256": "b29bf870512b99c26cbee07f17cb5896bfaa09369fea33510a40ca6c8530062c",
+    "protected_unreached_batch4": "249_PASS_1_FAIL_6_SKIP",
+    "protected_unreached_batch5": "284_PASS_1_FAIL_4_SKIP",
+    "protected_unreached_batch6": "234_PASS_0_FAIL_4_SKIP",
+    "protected_unreached_batch7": "274_PASS_2_FAIL_10_SKIP",
+    "protected_unreached_batch8": "264_PASS_0_FAIL_9_SKIP",
+    "corrected_fixture_suite": "15_PASS_0_FAIL",
+    "r67_cross_volume_protected_c": "6_PASS_0_FAIL_WITH_EXPLICIT_D_SCRATCH",
+    "r43_historical_signed_public_key": "2_PASS_0_FAIL_READ_ONLY",
+    "preflight_acl_behavior": "ASSERT_TRUSTED_AND_UNTRUSTED_PATHS_BY_ACTUAL_R89",
+    "release_contract_changes": "R132_R59_README_EXACT_01571",
+    "full_protected_regression": "PENDING_FRESH_PROTECTED_CANDIDATE_D"
   }
 }

package/bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-chatgpt-bridge",
-  "version": "0.15.69",
+  "version": "0.15.71",
   "private": true,
   "type": "module",
   "engines": {

package/controller/deadbyte-process-policy.json

@@ -1,15 +1,15 @@
 {
   "schema": "deadbyte.process-policy.v1",
   "enabled": true,
-  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.69-r186-owner-consent\\controller\\runtime\\process-grant.json",
-  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.69-r186-owner-consent\\controller\\runtime\\process-state",
+  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.71-r191-activation-precondition-repair\\controller\\runtime\\process-grant.json",
+  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.71-r191-activation-precondition-repair\\controller\\runtime\\process-state",
   "native_host": {
-    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.69-r186-owner-consent\\bin\\deadbyte-process-host.exe",
+    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.71-r191-activation-precondition-repair\\bin\\deadbyte-process-host.exe",
     "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {
-      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.69-r186-owner-consent",
+      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.71-r191-activation-precondition-repair",
       "deny_paths": [
         "node_modules",
         "controller/runtime",

package/docs/R184-package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.69",
+  "version": "0.15.71",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "deadbyte-mcp",
-      "version": "0.15.69",
+      "version": "0.15.71",
       "bundleDependencies": [
         "@modelcontextprotocol/server",
         "@modelcontextprotocol/client",
@@ -76,22 +76,115 @@
       "version": "7.0.6",
       "inBundle": true,
       "license": "MIT",
-      "dependencies": {"path-key":"^3.1.0","shebang-command":"^2.0.0","which":"^2.0.1"},
-      "engines": {"node":">= 8"}
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
     },
     "node_modules/eventsource": {
-      "version":"3.0.7","inBundle":true,"license":"MIT",
-      "dependencies":{"eventsource-parser":"^3.0.1"},"engines":{"node":">=18.0.0"}
+      "version": "3.0.7",
+      "inBundle": true,
+      "license": "MIT",
+      "dependencies": {
+        "eventsource-parser": "^3.0.1"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/eventsource-parser": {
+      "version": "3.1.1",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "inBundle": true,
+      "license": "ISC"
+    },
+    "node_modules/jose": {
+      "version": "6.2.10",
+      "inBundle": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/pkce-challenge": {
+      "version": "5.0.1",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.20.0"
+      }
     },
-    "node_modules/eventsource-parser": {"version":"3.1.1","inBundle":true,"license":"MIT","engines":{"node":">=18.0.0"}},
-    "node_modules/isexe": {"version":"2.0.0","inBundle":true,"license":"ISC"},
-    "node_modules/jose": {"version":"6.2.10","inBundle":true,"license":"MIT","funding":{"url":"https://github.com/sponsors/panva"}},
-    "node_modules/path-key": {"version":"3.1.1","inBundle":true,"license":"MIT","engines":{"node":">=8"}},
-    "node_modules/pkce-challenge": {"version":"5.0.1","inBundle":true,"license":"MIT","engines":{"node":">=16.20.0"}},
-    "node_modules/shebang-command": {"version":"2.0.0","inBundle":true,"license":"MIT","dependencies":{"shebang-regex":"^3.0.0"},"engines":{"node":">=8"}},
-    "node_modules/shebang-regex": {"version":"3.0.0","inBundle":true,"license":"MIT","engines":{"node":">=8"}},
-    "node_modules/typescript": {"version":"5.9.3","inBundle":true,"license":"Apache-2.0","bin":{"tsc":"bin/tsc","tsserver":"bin/tsserver"},"engines":{"node":">=14.17"}},
-    "node_modules/which": {"version":"2.0.2","inBundle":true,"license":"ISC","dependencies":{"isexe":"^2.0.0"},"bin":{"node-which":"bin/node-which"},"engines":{"node":">= 8"}},
-    "node_modules/zod": {"version":"4.4.3","inBundle":true,"license":"MIT","funding":{"url":"https://github.com/sponsors/colinhacks"}}
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "inBundle": true,
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "inBundle": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "inBundle": true,
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/zod": {
+      "version": "4.4.3",
+      "inBundle": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.69",
+  "version": "0.15.71",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/deploy-r48.mjs

@@ -14,7 +14,7 @@ import {observeAuthorityEvidence} from '../src/activation-authority-proof-r75.mj
 import {proveLegacyOfflineScopeRepair} from '../src/legacy-offline-policy-proof-r146.mjs';
 import {claimWithOneTimeMigration,verifyNarrowedPolicyGeneration} from '../src/clean-activation-recovery-r153.mjs';
 import {verifyUacApproval,uacPointerSha256,protectedUacReceiptPath,requireTrustedUacInstallation} from '../src/uac-approval-contract-r153.mjs';
-import {inspectTrustedInstallation} from '../src/privileged-install-trust-r89.mjs';
+import {inspectTrustedInstallation,privilegedEpochInstallFiles} from '../src/privileged-install-trust-r89.mjs';
 import {normalizeHostCommandPins,hostCommandPinArgs} from '../src/host-command-pins-r154.mjs';
 import {parseActivationPathFlags,assertTrustedActivationEntrypoint,appendActivationPathArgs} from '../src/activation-path-r167.mjs';
 
@@ -310,7 +310,7 @@ if(deployArgs.uacLegacyMigration){
     expiresAt:deployArgs.migrationExpiresAt
   });
 }
-let activationPaths=null,activationPathError=null;
+let activationPaths=null,activationPathError=null,stageEpochRebind=false;
 if(preflight.authority_continuity==='EPOCH_NATIVE'){
   try{
     // Validate exact path identity before the ACL probe so an unrelated protected
@@ -329,12 +329,25 @@ if(preflight.authority_continuity==='EPOCH_NATIVE'){
   activationPathError=new Error('--authority-epoch-root is valid only for EPOCH_NATIVE activation');
 }else{
   activationPaths={authorityEpochRoot:null,developmentRoot:deployArgs.developmentRoot??root};
+  if(preflight.authority_continuity==='NOT_APPLICABLE'){
+    try{
+      const installed=await loadPowerShellDataFile(pointer.config_path);
+      if(installed.AuthorityEpochRoot){
+        stageEpochRebind=true;
+        // The successor stage itself must be OS ACL-protected. An inherited
+        // predecessor epoch root cannot attest different successor bytes.
+        await inspectTrustedInstallation(privilegedEpochInstallFiles(root,process.execPath));
+      }
+    }catch(error){activationPathError=error;}
+  }
 }
 
 if(deployArgs.preflight){
+  const protectedEntrypoint=preflight.authority_continuity==='EPOCH_NATIVE'||stageEpochRebind;
   console.log(JSON.stringify({...preflight,
-    activation_entrypoint_state:activationPathError?'REJECTED':preflight.authority_continuity==='EPOCH_NATIVE'?'TRUSTED_READY':'NOT_APPLICABLE',
-    protected_activation_entrypoint:preflight.authority_continuity==='EPOCH_NATIVE'?!activationPathError:null,
+    safe_to_activate:preflight.safe_to_activate&&!activationPathError,
+    activation_entrypoint_state:activationPathError?'REJECTED':protectedEntrypoint?'TRUSTED_READY':'NOT_APPLICABLE',
+    protected_activation_entrypoint:protectedEntrypoint?!activationPathError:null,
     activation_entrypoint_reason:activationPathError?String(activationPathError?.message??activationPathError).slice(0,256):null}));
   process.exit(0);
 }

package/scripts/r191-acceptance-readonly.mjs

@@ -0,0 +1,7 @@
+import '../test/r191-epoch-source-claim.test.mjs';
+import '../test/r191-epoch-root-selection.test.mjs';
+import '../test/r191-inherited-epoch-preflight.test.mjs';
+import '../test/r65-activation-lock-recovery.test.mjs';
+import '../test/r65-activation-orchestration.test.mjs';
+import '../test/r158-epoch-bootstrap.test.mjs';
+import '../test/r167-activation-path.test.mjs';

package/scripts/r191-existing-regression.mjs

@@ -0,0 +1,5 @@
+import '../test/r65-activation-lock-recovery.test.mjs';
+import '../test/r65-activation-orchestration.test.mjs';
+import '../test/r158-epoch-bootstrap.test.mjs';
+import '../test/r167-activation-path.test.mjs';
+import '../test/r172-activation-recovery.test.mjs';

package/scripts/r191-existing-stage-audit.mjs

@@ -0,0 +1,21 @@
+import {readFile,lstat} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {inspectTrustedInstallation,privilegedEpochInstallFiles} from '../src/privileged-install-trust-r89.mjs';
+const stage='C:\\Program Files\\DEADBYTE-01570-REGISTRY-df15db35c7dd';
+const expected='df15db35c7ddddd769650f5c86557159d10d99e9eef4dd232cae67faeb8ad6e3';
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const info=await lstat(stage);if(!info.isDirectory()||info.isSymbolicLink())throw new Error('STAGE_DIRECTORY_INVALID');
+const manifest=sha(await readFile(path.join(stage,'MANIFEST.SHA256')));
+if(manifest!==expected)throw new Error('STAGE_HASH_DRIFT '+manifest);
+console.log('R191_EXISTING_EXACT_STAGE_MANIFEST='+manifest);
+try{
+  const trust=await inspectTrustedInstallation([...privilegedEpochInstallFiles(stage,process.execPath),
+    path.join(stage,'MANIFEST.SHA256'),path.join(stage,'scripts','deploy-r48.mjs'),
+    path.join(stage,'src','runtime-update.mjs'),path.join(stage,'src','trusted-epoch-bootstrap-r158.mjs')]);
+  if(!trust.trusted)throw new Error('R89_ACL_UNTRUSTED');
+  console.log('R191_EXACT_STAGE_R89_ACL=PASS');
+}catch(e){
+  console.error('R191_EXACT_STAGE_R89_ACL=BLOCKED '+e.message);
+  process.exitCode=3;
+}

package/scripts/r191-extended-security-gate.mjs

@@ -0,0 +1,14 @@
+import '../test/r65-activation-lock-recovery.test.mjs';
+import '../test/r65-activation-preflight.test.mjs';
+import '../test/r65-activation-orchestration.test.mjs';
+import '../test/r65-deploy-preflight.test.mjs';
+import '../test/r65-transaction-precondition.test.mjs';
+import '../test/r153-r65-signed-precondition-recovery.test.mjs';
+import '../test/r153-staging-leaf-acl.test.mjs';
+import '../test/r153-uac-installed-manifest-contract.test.mjs';
+import '../test/r167-activation-path.test.mjs';
+import '../test/r168-protected-entrypoint.test.mjs';
+import '../test/r190-foreground-owner-recovery.test.mjs';
+import '../test/r191-epoch-root-selection.test.mjs';
+import '../test/r191-epoch-source-claim.test.mjs';
+import '../test/r191-inherited-epoch-preflight.test.mjs';

package/scripts/r191-focused-tests.mjs

@@ -0,0 +1,3 @@
+import '../test/r191-epoch-source-claim.test.mjs';
+import '../test/r191-epoch-root-selection.test.mjs';
+import '../test/r191-inherited-epoch-preflight.test.mjs';

package/scripts/r191-full-runner.mjs

@@ -0,0 +1,18 @@
+import {readdir,mkdir,writeFile} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const list=(await readdir(path.join(root,'test'))).filter(x=>x.endsWith('.test.mjs')&&!new Set(['full-max-catalog-r44.test.mjs','full-max-catalog-r45.test.mjs','full-max-catalog-r46.test.mjs']).has(x));
+const output='D:\\Projects\\deadbyte-mcp\\testing\\r191\\R191-SOURCE-FULL-REGRESSION.txt';
+await mkdir(path.dirname(output),{recursive:true});
+console.log('FULL_SOURCE_REGRESSION_FILES='+list.length);
+const started=Date.now();
+const p=spawnSync(process.execPath,['--test','--test-concurrency=4',...list.map(x=>'test/'+x)],{cwd:root,shell:false,encoding:'utf8',windowsHide:true,maxBuffer:20*1024*1024,timeout:300000});
+const stdout=p.stdout||'',stderr=p.stderr||'';
+await writeFile(output,stdout+'\n===== STDERR =====\n'+stderr,'utf8');
+const summary=stdout.split(/\r?\n/).filter(x=>/^(?:ℹ (?:tests|pass|fail|skipped|duration_ms)|✖ |﹣ |✔ R191)/.test(x));
+console.log('RESULT_EXIT='+p.status+' SIGNAL='+p.signal+' ELAPSED_MS='+(Date.now()-started)+' ERROR='+(p.error?.message||'none'));
+console.log('SUMMARY='+JSON.stringify(summary.slice(-100)));
+console.log('TRANSCRIPT='+output);
+if(p.status!==0)process.exitCode=1;

package/scripts/r191-historical-release-regression.mjs

@@ -0,0 +1,9 @@
+import '../test/r130-release-security-contract.test.mjs';
+import '../test/r153-prepublish-identity.test.mjs';
+import '../test/r165-live-cli-skew.test.mjs';
+import '../test/r167-release-contract.test.mjs';
+import '../test/r172-release-contract.test.mjs';
+import '../test/r173-release-contract.test.mjs';
+import '../test/r179-release-contract.test.mjs';
+import '../test/r190-release-contract.test.mjs';
+import '../test/release-version.test.mjs';

package/scripts/r191-live-claim-inspect.mjs

@@ -0,0 +1,15 @@
+import os from 'node:os';
+import path from 'node:path';
+import {readFile} from 'node:fs/promises';
+import {createActivationClaimManager} from '../src/activation-lock-r65.mjs';
+const state=path.join(os.homedir(),'.deadbyte-mcp');
+const pointer=JSON.parse(await readFile(path.join(state,'active-release.json'),'utf8'));
+const manager=createActivationClaimManager({stateRoot:state});
+const result=await manager.inspect();
+console.log(JSON.stringify({state:'READ_ONLY_INSPECTION',active_release_id:pointer.release_id,
+  manifest_sha256:pointer.manifest_sha256,
+  claim_status:result.status,claim_operation_id:result.operation_id??null,
+  subject_sha256:result.subject_sha256??null,matched:result.matched??null,
+  foreign:result.foreign??null,unknown:result.unknown??null}));
+if(pointer.release_id!=='v0.15.68-ff29dbb2fbb89862')process.exitCode=5;
+if(result.status!=='RECONCILABLE')process.exitCode=6;

package/scripts/r191-npm-registry-readonly.mjs

@@ -0,0 +1,14 @@
+import https from 'node:https';
+const read=url=>new Promise((resolve,reject)=>{
+ const req=https.get(url,{timeout:10000,headers:{'User-Agent':'deadbyte-r191-readonly-version-check'}},res=>{
+ let s='';res.on('data',b=>{if(s.length<40000)s+=b;});res.on('end',()=>resolve({status:res.statusCode,body:s}));});
+ req.on('timeout',()=>req.destroy(new Error('timeout')));req.on('error',reject);
+});
+for(const suffix of ['0.15.71','dist-tags']){
+ try{
+ const r=await read('https://registry.npmjs.org/deadbyte-mcp/'+suffix);
+ let v={status:r.status};
+ if(r.status===200){const p=JSON.parse(r.body);v=suffix==='dist-tags'?p:{name:p.name,version:p.version,tarball:p.dist?.tarball,integrity_present:Boolean(p.dist?.integrity)};}
+ console.log(JSON.stringify({target:suffix,...v}));
+ }catch(e){console.log(JSON.stringify({target:suffix,status:'NETWORK_UNVERIFIED',error:e.message}));}
+}

package/scripts/r191-old-version-audit.mjs

@@ -0,0 +1,12 @@
+import {readdir,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const paths=await readdir(path.join(root,'test'));
+let hits=0;
+for(const f of paths.filter(x=>x.endsWith('.test.mjs'))){
+const s=await readFile(path.join(root,'test',f),'utf8');
+const n=s.split('0.15.70').length-1;
+if(n){hits++;const a=s.split(String.fromCharCode(10)).filter(l=>l.includes('0.15.70'));console.log(f+': '+n+' occurrences; '+a.slice(0,3).map(x=>x.trim().slice(0,150)).join(' | '));}
+}
+console.log('MATCHED_FILES='+hits);

package/scripts/r191-privilege-readonly.mjs

@@ -0,0 +1,6 @@
+import {access,constants,stat} from 'node:fs/promises';
+import os from 'node:os';
+const programFiles='C:\\Program Files';
+try{await access(programFiles,constants.W_OK);console.log('PROGRAM_FILES_WRITE_PROBE=ACCESS_ALLOWED')}catch(e){console.log('PROGRAM_FILES_WRITE_PROBE='+e.code);}
+console.log('HOME='+os.homedir());
+console.log('PROCESS_PLATFORM='+process.platform);

package/scripts/r191-process-policy-focused.mjs

@@ -0,0 +1 @@
+import '../test/process-policy-refresh.test.mjs';

package/scripts/r191-protected-failure-gate.mjs

@@ -0,0 +1,3 @@
+import '../test/r166-hotfix-contract.test.mjs';
+import '../test/r190-foreground-cli.test.mjs';
+import '../test/r191-epoch-source-claim.test.mjs';

package/scripts/r191-release-contract-runner.mjs

@@ -0,0 +1 @@
+import '../test/r191-release-contract.test.mjs';

package/scripts/r191-unreached-focused.mjs

@@ -0,0 +1,29 @@
+import {spawnSync} from 'node:child_process';
+import {mkdtemp,mkdir,readFile} from 'node:fs/promises';
+import {createPublicKey} from 'node:crypto';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import os from 'node:os';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const parentPublicKey=path.join(os.homedir(),'.deadbyte-mcp','trust','ed25519-public.pem');
+const pubKey=createPublicKey(await readFile(parentPublicKey));
+if(pubKey.asymmetricKeyType!=='ed25519')throw new Error('R43_PARENT_PUBLIC_KEY_NOT_ED25519');
+const isolated=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r191-unreached-'));
+const scratch='D:\\Projects\\deadbyte-mcp\\testing\\r191\\cross-volume-focused';
+if(path.parse(scratch).root.toLowerCase()===path.parse(os.tmpdir()).root.toLowerCase())throw new Error('R67_CROSS_VOLUME_NOT_DISTINCT');
+await mkdir(scratch,{recursive:true});
+const tests=[
+ 'test/r132-release-identity.test.mjs',
+ 'test/r59-tool-surface-compat.test.mjs',
+ 'test/production-docs.test.mjs',
+ 'test/r191-inherited-epoch-preflight.test.mjs',
+ 'test/r67-npm-cross-volume.test.mjs',
+ 'test/r43-parent.test.mjs'
+];
+const r=spawnSync(process.execPath,['--test','--test-concurrency=1',...tests],{
+ cwd:root,env:{...process.env,DEADBYTE_STATE_ROOT:isolated,DEADBYTE_PARENT_VERIFY_KEY:parentPublicKey,DEADBYTE_TEST_CROSS_VOLUME_ROOT:scratch},
+ windowsHide:true,shell:false,encoding:'utf8',timeout:160000,maxBuffer:2000000});
+console.log('FOCUSED_EXIT='+r.status+' ERROR='+(r.error?.message??'none'));
+console.log((r.stdout??'').slice(-19000));
+if(r.stderr)console.error(r.stderr.slice(-1400));
+if(r.error||r.status!==0)process.exitCode=1;

package/src/activation-lock-r65.mjs

@@ -115,7 +115,7 @@ async function isSafeSignedPreconditionReject(outcome,lock,stateRoot){
      body.result!=='PRECONDITION_REJECTED'||body.phase!=='initial'||
      body.attempted_pointer!==null||body.rollback?.attempted!==false||
      !Array.isArray(body.rollback?.errors)||body.rollback.errors.length!==0||
-     !(/^(?:host command 'powershell_script' executable pin drift detected;|windows release gate package script invalid$)/.test(String(body.error?.message??'')))||
+     !(/^(?:host command 'powershell_script' executable pin drift detected;.*$|windows release gate package script invalid$|authority epoch exact release source hash mismatch: manifest\.sha256$)/.test(String(body.error?.message??'')))||
      !Number.isFinite(failedTime)||failedTime<lockTime||failedTime>observedTime||
      !samePointerIdentity(body.prior_pointer,current))return false;
   return true;
@@ -162,6 +162,14 @@ export function createActivationClaimManager({stateRoot}={}){
   }
 
   return Object.freeze({
+    async inspect(){
+      const claim=await readLock(lockPath);
+      if(!claim)return Object.freeze({status:'NO_CLAIM'});
+      const evidence=await findTerminalOutcome(updatesDir,claim,state);
+      const safe=evidence.matched&&!evidence.foreign&&!evidence.unknown;
+      return Object.freeze({status:safe?'RECONCILABLE':'UNRESOLVED',operation_id:claim.operation_id,
+        subject_sha256:claim.subject_sha256,matched:evidence.matched,foreign:evidence.foreign,unknown:evidence.unknown});
+    },
     async claim(subjectSha256){
       if(!HEX64.test(String(subjectSha256??'')))throw new Error('activation claim subject invalid');
       await mkdir(updatesDir,{recursive:true});

package/src/deadbyte-cli.mjs

@@ -33,6 +33,8 @@ import {reconcileStaleMarker,resumeMarkerReconciliation,recoverPublishedMarkerTe
 import {selectLegacyMarkerEvidence,verifyLocatedLegacyMarkerReceipt} from './legacy-marker-evidence-r159.mjs';
 import {normalizeHostCommandPins,encodeHostCommandPins} from './host-command-pins-r154.mjs';
 import {verifyPackageDecisionManifest} from './package-identity-r160.mjs';
+import {inspectTrustedInstallation} from './privileged-install-trust-r89.mjs';
+import {recoverLegacyForegroundOwnership} from './foreground-owner-recovery-r190.mjs';
 
 const REMOTE_COMMANDS=new Set([
   'menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest',
@@ -70,6 +72,7 @@ function printHelp(){
     `  npx -y ${exact} remote --trace           # show trace/span identity without payload detail`,
  
     `  npx -y ${exact} remote --filter <expr>   # presentation filter: tool/category/status/trace`,
+    `  npx -y ${exact} remote reconcileforeground --confirm-marker-sha256 <sha256> # protected marker-only recovery`,
     `  npx -y ${exact} remote status`,
     `  npx -y ${exact} remote restart`,
     `  npx -y ${exact} supervisor status`,
@@ -934,8 +937,56 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     }
   }
 }
+async function readR190Evidence(file){
+  try{
+    const info=await lstat(file);
+    if(!info.isFile()||info.isSymbolicLink()||info.size<1||info.size>64*1024)
+      throw new Error(`R190 recovery evidence is unsafe: ${path.basename(file)}`);
+    return JSON.parse((await readFile(file,'utf8')).replace(/^\uFEFF/,''));
+  }catch(error){if(error?.code==='ENOENT')return null;throw error;}
+}
+async function runRemoteForegroundRecovery(expectedMarkerSha256){
+  // Reject writable/untrusted CLI bytes before reading controller state.
+  const thisFile=fileURLToPath(import.meta.url);
+  const protectedFiles=[process.execPath,thisFile,path.join(CURRENT_PACKAGE_ROOT,'MANIFEST.SHA256'),
+    path.join(CURRENT_PACKAGE_ROOT,'src','foreground-owner-recovery-r190.mjs'),
+    path.join(CURRENT_PACKAGE_ROOT,'src','foreground-marker-cas-win32.mjs'),
+    path.join(CURRENT_PACKAGE_ROOT,'src','foreground-process-identity.mjs'),
+    path.join(CURRENT_PACKAGE_ROOT,'src','foreground-session-lock.mjs'),
+    path.join(CURRENT_PACKAGE_ROOT,'src','privileged-install-trust-r89.mjs'),
+    path.join(CURRENT_PACKAGE_ROOT,'src','canonical-json.mjs'),
+    path.join(CURRENT_PACKAGE_ROOT,'bin','deadbyte-epoch-lock-r85.node')];
+  let installation;
+  try{installation=await inspectTrustedInstallation(protectedFiles);}
+  catch(error){throw new Error(`R190_PROTECTED_RECOVERY_REQUIRED: ${boundedSingleLine(error?.message||error,512)}`);}
+  if(!installation.trusted)throw new Error('R190_PROTECTED_RECOVERY_REQUIRED: package ACL is not R89-trusted');
+  await verifyPackageDecisionManifest({root:CURRENT_PACKAGE_ROOT,expectedVersion:DEADBYTE_VERSION});
+  const ctx=await remoteContext();
+  const evidenceDir=path.join(ctx.root,'evidence','foreground-recovery-r190');
+  const intentPath=path.join(evidenceDir,`${expectedMarkerSha256}.intent.json`);
+  const terminalPath=path.join(evidenceDir,`${expectedMarkerSha256}.terminal.json`);
+  const startupLock=await acquireForegroundSessionLock({root:ctx.root,powershell:ctx.powershell});
+  try{
+    startupLock.assertHeld();
+    const result=await recoverLegacyForegroundOwnership({
+      expectedMarkerSha256,
+      readMarkerSnapshot:()=>readRemoteMarkerSnapshot(remoteSessionMarker(ctx.root)),
+      deleteMarkerIfHash:expected=>deletePinnedRemoteMarker(remoteSessionMarker(ctx.root),expected),
+      readActivePointer:()=>readActiveRuntimeBinding(ctx.root),
+      readAuthority:()=>observedAuthority(ctx),
+      queryIdentity:identity=>queryForegroundIdentity(identity.pid),
+      loadIntent:()=>readR190Evidence(intentPath),loadTerminal:()=>readR190Evidence(terminalPath),
+      publishIntent:value=>publishExclusiveJson(intentPath,value),
+      publishTerminal:value=>publishExclusiveJson(terminalPath,value)
+    });
+    startupLock.assertHeld();
+    process.stdout.write(`${JSON.stringify({...result,intent_path:intentPath,terminal_path:terminalPath,
+      authority_mutated:false,runtime_mutated:false})}\n`);
+  }finally{await startupLock.release();}
+}
 async function runRemote(args){
   let verbose=false,trace=false,filterExpression='',resumeCursor=null,mode='default';
+  let recoveryMarkerSha256=null;
   const hostCommandPinValues=[];
   const positional=[];
   for(let index=0;index<args.length;index++){
@@ -960,12 +1011,23 @@ async function runRemote(args){
       if(index+1>=args.length) throw new Error('remote --resume requires a cursor');
       resumeCursor=args[++index];continue;
     }
+    if(arg==='--confirm-marker-sha256'){
+      if(recoveryMarkerSha256!==null) throw new Error('remote --confirm-marker-sha256 may be specified once');
+      recoveryMarkerSha256=String(args[++index]??'');continue;
+    }
     positional.push(arg);
   }
   let hostCommandPins;
   try{hostCommandPins=normalizeHostCommandPins(hostCommandPinValues);}
   catch(error){throw new Error(`remote --host-command-pin ${error.message}`);}
   const presentation=verbose||trace||Boolean(filterExpression)||resumeCursor!==null||mode!=='default'||hostCommandPins.length>0;
+  if(positional.length===1&&positional[0]==='reconcileforeground'){
+    if(presentation)throw new Error('remote reconcileforeground does not accept presentation or authority flags');
+    if(!/^[0-9a-f]{64}$/.test(String(recoveryMarkerSha256??'')))
+      throw new Error('remote reconcileforeground requires --confirm-marker-sha256 with the exact current marker hash');
+    await runRemoteForegroundRecovery(recoveryMarkerSha256);return;
+  }
+  if(recoveryMarkerSha256!==null)throw new Error('remote --confirm-marker-sha256 is valid only with reconcileforeground');
   if(positional.length===0){await runRemoteSession({resumeCursor,verbose,trace,filterExpression,mode,hostCommandPins});return;}
   if(presentation) throw new Error('remote presentation flags are valid only for foreground session');
   if(positional.length>1) throw new Error('remote accepts one controller command');