deadbyte-mcp 0.15.70 → 0.15.72

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.70",
-  "train": "R190",
+  "version": "0.15.72",
+  "train": "R192",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",
@@ -10,6 +10,16 @@
     "schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
   },
   "required": [
+    {
+      "id": "r191-trusted-successor-epoch-root",
+      "command": "run R191 protected 0.15.71 ACL and full Windows regression",
+      "expected": "R89 ACL verifies successor exact manifest and native epoch tests pass; no dev-root bypass"
+    },
+    {
+      "id": "r191-signed-initial-precondition-reconciliation",
+      "command": "node --test test/r191-epoch-source-claim.test.mjs test/r153-r65-signed-precondition-recovery.test.mjs",
+      "expected": "R65 claim reconciles only with signed initial R27 rejection, correct predecessor and untampered receipt"
+    },
     {
       "id": "r190-explicit-foreground-recovery",
       "command": "node --test --test-concurrency=1 test/r190-foreground-owner-recovery.test.mjs test/r190-foreground-cli.test.mjs",
@@ -144,6 +154,11 @@
       "id": "r179-live-log-and-foreground",
       "command": "Run Ctrl+C, restart, crash and concurrent sessions with pre-existing standing grants and confirm no implicit revocation",
       "expected": "Owner standing grants unchanged; observation-only marker CAS; signed audit remains verifiable"
+    },
+    {
+      "id": "r192-live-log-hardening",
+      "gate": "R192 regression preserves clean default live logs, sanitization and bounded log rotation",
+      "status": "PASS_FOCUSED_31_0"
     }
   ],
   "observed_pre_release_evidence": {
@@ -687,5 +702,46 @@
     "authority_after_test": "ALL_FIVE_PLANES_DISARMED",
     "publication": "NOT_RUN",
     "production_activation": "NOT_RUN"
+  },
+  "r191": {
+    "release_version": "0.15.71",
+    "protected_full": "NOT_VERIFIED",
+    "production_activation": "NOT_RUN",
+    "npm_publish": "NOT_RUN",
+    "test_status": "SOURCE_FOCUSED_PASS_FULL_PENDING",
+    "focused_security": "PASS_47_FAIL_0_SKIP_0",
+    "historical_release_regression": "PASS_25_FAIL_0_SKIP_1",
+    "r191_claim_inspect": "RECONCILABLE_SIGNED_READ_ONLY",
+    "protected_first_attempt": "FAIL_263_PASS_2_FAIL_3_SKIP_IN_BATCH_1_OF_8",
+    "protected_first_log_sha256": "a417aa51f82d93463e69df4d8b90ec8498817fa5ac84e2b7d7fe6b30c7118b30",
+    "corrective_focused_tests": "PASS_10_FAIL_0_SKIP_0",
+    "corrective_security_regression": "PASS_47_FAIL_0_SKIP_0",
+    "protected_retest": "PENDING_FRESH_EXACT_BYTES_TEST_B",
+    "protected_second_attempt": "FAIL_BATCH_2_273_PASS_1_FAIL_7_SKIP_AFTER_BATCH_1_266_PASS_0_FAIL_3_SKIP",
+    "protected_second_log_sha256": "eb32db586a6a1e09d2404eb5088b7783a0f9261d991583be097f13fda8ef8db3",
+    "process_policy_source_rebound": "R191_EXACT_DEV_ROOT",
+    "process_policy_contract": "PASS_5_FAIL_0",
+    "protected_third_attempt": "FAIL_BATCH_3_255_PASS_7_FAIL_5_SKIP_AFTER_1_263_PASS_0_FAIL_3_SKIP_AND_2_266_PASS_0_FAIL_7_SKIP",
+    "protected_third_log_sha256": "b29bf870512b99c26cbee07f17cb5896bfaa09369fea33510a40ca6c8530062c",
+    "protected_unreached_batch4": "249_PASS_1_FAIL_6_SKIP",
+    "protected_unreached_batch5": "284_PASS_1_FAIL_4_SKIP",
+    "protected_unreached_batch6": "234_PASS_0_FAIL_4_SKIP",
+    "protected_unreached_batch7": "274_PASS_2_FAIL_10_SKIP",
+    "protected_unreached_batch8": "264_PASS_0_FAIL_9_SKIP",
+    "corrected_fixture_suite": "15_PASS_0_FAIL",
+    "r67_cross_volume_protected_c": "6_PASS_0_FAIL_WITH_EXPLICIT_D_SCRATCH",
+    "r43_historical_signed_public_key": "2_PASS_0_FAIL_READ_ONLY",
+    "preflight_acl_behavior": "ASSERT_TRUSTED_AND_UNTRUSTED_PATHS_BY_ACTUAL_R89",
+    "release_contract_changes": "R132_R59_README_EXACT_01571",
+    "full_protected_regression": "PENDING_FRESH_PROTECTED_CANDIDATE_D"
+  },
+  "r192": {
+    "focused": "PASS_31_FAIL_0",
+    "integration": "PENDING_FULL_REGRESSION",
+    "protected_full": "NOT_RUN",
+    "npm_pack": "PENDING",
+    "npm_publish": "NOT_RUN",
+    "public_tool_delta": 0,
+    "authority_policy_delta": 0
   }
 }

package/bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-chatgpt-bridge",
-  "version": "0.15.70",
+  "version": "0.15.72",
   "private": true,
   "type": "module",
   "engines": {

package/controller/deadbyte-process-policy.json

@@ -1,15 +1,15 @@
 {
   "schema": "deadbyte.process-policy.v1",
   "enabled": true,
-  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.70-r190-foreground-recovery\\controller\\runtime\\process-grant.json",
-  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.70-r190-foreground-recovery\\controller\\runtime\\process-state",
+  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r192-live-log-hardening-dev\\controller\\runtime\\process-grant.json",
+  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r192-live-log-hardening-dev\\controller\\runtime\\process-state",
   "native_host": {
-    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.70-r190-foreground-recovery\\bin\\deadbyte-process-host.exe",
+    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r192-live-log-hardening-dev\\bin\\deadbyte-process-host.exe",
     "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {
-      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.70-r190-foreground-recovery",
+      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r192-live-log-hardening-dev",
       "deny_paths": [
         "node_modules",
         "controller/runtime",

package/docs/R184-package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.70",
+  "version": "0.15.72",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "deadbyte-mcp",
-      "version": "0.15.70",
+      "version": "0.15.72",
       "bundleDependencies": [
         "@modelcontextprotocol/server",
         "@modelcontextprotocol/client",
@@ -76,22 +76,115 @@
       "version": "7.0.6",
       "inBundle": true,
       "license": "MIT",
-      "dependencies": {"path-key":"^3.1.0","shebang-command":"^2.0.0","which":"^2.0.1"},
-      "engines": {"node":">= 8"}
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
     },
     "node_modules/eventsource": {
-      "version":"3.0.7","inBundle":true,"license":"MIT",
-      "dependencies":{"eventsource-parser":"^3.0.1"},"engines":{"node":">=18.0.0"}
+      "version": "3.0.7",
+      "inBundle": true,
+      "license": "MIT",
+      "dependencies": {
+        "eventsource-parser": "^3.0.1"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/eventsource-parser": {
+      "version": "3.1.1",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "inBundle": true,
+      "license": "ISC"
+    },
+    "node_modules/jose": {
+      "version": "6.2.10",
+      "inBundle": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/pkce-challenge": {
+      "version": "5.0.1",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.20.0"
+      }
     },
-    "node_modules/eventsource-parser": {"version":"3.1.1","inBundle":true,"license":"MIT","engines":{"node":">=18.0.0"}},
-    "node_modules/isexe": {"version":"2.0.0","inBundle":true,"license":"ISC"},
-    "node_modules/jose": {"version":"6.2.10","inBundle":true,"license":"MIT","funding":{"url":"https://github.com/sponsors/panva"}},
-    "node_modules/path-key": {"version":"3.1.1","inBundle":true,"license":"MIT","engines":{"node":">=8"}},
-    "node_modules/pkce-challenge": {"version":"5.0.1","inBundle":true,"license":"MIT","engines":{"node":">=16.20.0"}},
-    "node_modules/shebang-command": {"version":"2.0.0","inBundle":true,"license":"MIT","dependencies":{"shebang-regex":"^3.0.0"},"engines":{"node":">=8"}},
-    "node_modules/shebang-regex": {"version":"3.0.0","inBundle":true,"license":"MIT","engines":{"node":">=8"}},
-    "node_modules/typescript": {"version":"5.9.3","inBundle":true,"license":"Apache-2.0","bin":{"tsc":"bin/tsc","tsserver":"bin/tsserver"},"engines":{"node":">=14.17"}},
-    "node_modules/which": {"version":"2.0.2","inBundle":true,"license":"ISC","dependencies":{"isexe":"^2.0.0"},"bin":{"node-which":"bin/node-which"},"engines":{"node":">= 8"}},
-    "node_modules/zod": {"version":"4.4.3","inBundle":true,"license":"MIT","funding":{"url":"https://github.com/sponsors/colinhacks"}}
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "inBundle": true,
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "inBundle": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "inBundle": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "inBundle": true,
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/zod": {
+      "version": "4.4.3",
+      "inBundle": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    }
   }
 }

package/docs/R192-LIVE-LOG-HARDENING.txt

@@ -0,0 +1,39 @@
+R192 live log hardening
+target 0.15.72
+
+the default npx remote console stays compact
+signed tool audit is the authority for execution results
+console output never grants or restores machine authority
+
+changes
+- extra screening and byte bounds for verbose runtime diagnostics
+- keep tool name status and duration while reducing noisy reason text
+- remove old log cursors and partial-line fragments after discovery drops files
+- preserve independent START and terminal result lines for mutations
+- keep heartbeat folding timeline filters and trace formatting
+- no change to the public MCP tool catalog or authority policy
+
+integration
+src/deadbyte-cli.mjs reads and tracks foreground streams
+src/remote-live-log.mjs formats audit-safe progress and prunes old readers
+src/remote-log-decode-r60.mjs handles bounded append and file identity
+src/tool-audit.mjs remains the signed and sanitized audit source
+
+reference study
+D:\Projects\deadbyte-mcp\references
+read-only comparison of remote MCP/Commander implementations
+no donor code imported or copied into R192
+
+verification
+R192 focused 31 pass 0 fail
+R192 extended release identity 60 pass 0 fail
+full workspace regression not yet verified
+protected Windows package test not yet verified
+npm publication not yet verified
+production activation not run
+
+release constraints
+0.15.71 remains the active rollback predecessor
+no writes to installed production files or owner authority
+do not publish before exact package verification
+do not use npm success messages as proof of registry bytes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.70",
+  "version": "0.15.72",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/deploy-r48.mjs

@@ -14,7 +14,7 @@ import {observeAuthorityEvidence} from '../src/activation-authority-proof-r75.mj
 import {proveLegacyOfflineScopeRepair} from '../src/legacy-offline-policy-proof-r146.mjs';
 import {claimWithOneTimeMigration,verifyNarrowedPolicyGeneration} from '../src/clean-activation-recovery-r153.mjs';
 import {verifyUacApproval,uacPointerSha256,protectedUacReceiptPath,requireTrustedUacInstallation} from '../src/uac-approval-contract-r153.mjs';
-import {inspectTrustedInstallation} from '../src/privileged-install-trust-r89.mjs';
+import {inspectTrustedInstallation,privilegedEpochInstallFiles} from '../src/privileged-install-trust-r89.mjs';
 import {normalizeHostCommandPins,hostCommandPinArgs} from '../src/host-command-pins-r154.mjs';
 import {parseActivationPathFlags,assertTrustedActivationEntrypoint,appendActivationPathArgs} from '../src/activation-path-r167.mjs';
 
@@ -310,7 +310,7 @@ if(deployArgs.uacLegacyMigration){
     expiresAt:deployArgs.migrationExpiresAt
   });
 }
-let activationPaths=null,activationPathError=null;
+let activationPaths=null,activationPathError=null,stageEpochRebind=false;
 if(preflight.authority_continuity==='EPOCH_NATIVE'){
   try{
     // Validate exact path identity before the ACL probe so an unrelated protected
@@ -329,12 +329,25 @@ if(preflight.authority_continuity==='EPOCH_NATIVE'){
   activationPathError=new Error('--authority-epoch-root is valid only for EPOCH_NATIVE activation');
 }else{
   activationPaths={authorityEpochRoot:null,developmentRoot:deployArgs.developmentRoot??root};
+  if(preflight.authority_continuity==='NOT_APPLICABLE'){
+    try{
+      const installed=await loadPowerShellDataFile(pointer.config_path);
+      if(installed.AuthorityEpochRoot){
+        stageEpochRebind=true;
+        // The successor stage itself must be OS ACL-protected. An inherited
+        // predecessor epoch root cannot attest different successor bytes.
+        await inspectTrustedInstallation(privilegedEpochInstallFiles(root,process.execPath));
+      }
+    }catch(error){activationPathError=error;}
+  }
 }
 
 if(deployArgs.preflight){
+  const protectedEntrypoint=preflight.authority_continuity==='EPOCH_NATIVE'||stageEpochRebind;
   console.log(JSON.stringify({...preflight,
-    activation_entrypoint_state:activationPathError?'REJECTED':preflight.authority_continuity==='EPOCH_NATIVE'?'TRUSTED_READY':'NOT_APPLICABLE',
-    protected_activation_entrypoint:preflight.authority_continuity==='EPOCH_NATIVE'?!activationPathError:null,
+    safe_to_activate:preflight.safe_to_activate&&!activationPathError,
+    activation_entrypoint_state:activationPathError?'REJECTED':protectedEntrypoint?'TRUSTED_READY':'NOT_APPLICABLE',
+    protected_activation_entrypoint:protectedEntrypoint?!activationPathError:null,
     activation_entrypoint_reason:activationPathError?String(activationPathError?.message??activationPathError).slice(0,256):null}));
   process.exit(0);
 }

package/scripts/r191-acceptance-readonly.mjs

@@ -0,0 +1,7 @@
+import '../test/r191-epoch-source-claim.test.mjs';
+import '../test/r191-epoch-root-selection.test.mjs';
+import '../test/r191-inherited-epoch-preflight.test.mjs';
+import '../test/r65-activation-lock-recovery.test.mjs';
+import '../test/r65-activation-orchestration.test.mjs';
+import '../test/r158-epoch-bootstrap.test.mjs';
+import '../test/r167-activation-path.test.mjs';

package/scripts/r191-existing-regression.mjs

@@ -0,0 +1,5 @@
+import '../test/r65-activation-lock-recovery.test.mjs';
+import '../test/r65-activation-orchestration.test.mjs';
+import '../test/r158-epoch-bootstrap.test.mjs';
+import '../test/r167-activation-path.test.mjs';
+import '../test/r172-activation-recovery.test.mjs';

package/scripts/r191-existing-stage-audit.mjs

@@ -0,0 +1,21 @@
+import {readFile,lstat} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {inspectTrustedInstallation,privilegedEpochInstallFiles} from '../src/privileged-install-trust-r89.mjs';
+const stage='C:\\Program Files\\DEADBYTE-01570-REGISTRY-df15db35c7dd';
+const expected='df15db35c7ddddd769650f5c86557159d10d99e9eef4dd232cae67faeb8ad6e3';
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const info=await lstat(stage);if(!info.isDirectory()||info.isSymbolicLink())throw new Error('STAGE_DIRECTORY_INVALID');
+const manifest=sha(await readFile(path.join(stage,'MANIFEST.SHA256')));
+if(manifest!==expected)throw new Error('STAGE_HASH_DRIFT '+manifest);
+console.log('R191_EXISTING_EXACT_STAGE_MANIFEST='+manifest);
+try{
+  const trust=await inspectTrustedInstallation([...privilegedEpochInstallFiles(stage,process.execPath),
+    path.join(stage,'MANIFEST.SHA256'),path.join(stage,'scripts','deploy-r48.mjs'),
+    path.join(stage,'src','runtime-update.mjs'),path.join(stage,'src','trusted-epoch-bootstrap-r158.mjs')]);
+  if(!trust.trusted)throw new Error('R89_ACL_UNTRUSTED');
+  console.log('R191_EXACT_STAGE_R89_ACL=PASS');
+}catch(e){
+  console.error('R191_EXACT_STAGE_R89_ACL=BLOCKED '+e.message);
+  process.exitCode=3;
+}

package/scripts/r191-extended-security-gate.mjs

@@ -0,0 +1,14 @@
+import '../test/r65-activation-lock-recovery.test.mjs';
+import '../test/r65-activation-preflight.test.mjs';
+import '../test/r65-activation-orchestration.test.mjs';
+import '../test/r65-deploy-preflight.test.mjs';
+import '../test/r65-transaction-precondition.test.mjs';
+import '../test/r153-r65-signed-precondition-recovery.test.mjs';
+import '../test/r153-staging-leaf-acl.test.mjs';
+import '../test/r153-uac-installed-manifest-contract.test.mjs';
+import '../test/r167-activation-path.test.mjs';
+import '../test/r168-protected-entrypoint.test.mjs';
+import '../test/r190-foreground-owner-recovery.test.mjs';
+import '../test/r191-epoch-root-selection.test.mjs';
+import '../test/r191-epoch-source-claim.test.mjs';
+import '../test/r191-inherited-epoch-preflight.test.mjs';

package/scripts/r191-focused-tests.mjs

@@ -0,0 +1,3 @@
+import '../test/r191-epoch-source-claim.test.mjs';
+import '../test/r191-epoch-root-selection.test.mjs';
+import '../test/r191-inherited-epoch-preflight.test.mjs';

package/scripts/r191-full-runner.mjs

@@ -0,0 +1,18 @@
+import {readdir,mkdir,writeFile} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const list=(await readdir(path.join(root,'test'))).filter(x=>x.endsWith('.test.mjs')&&!new Set(['full-max-catalog-r44.test.mjs','full-max-catalog-r45.test.mjs','full-max-catalog-r46.test.mjs']).has(x));
+const output='D:\\Projects\\deadbyte-mcp\\testing\\r191\\R191-SOURCE-FULL-REGRESSION.txt';
+await mkdir(path.dirname(output),{recursive:true});
+console.log('FULL_SOURCE_REGRESSION_FILES='+list.length);
+const started=Date.now();
+const p=spawnSync(process.execPath,['--test','--test-concurrency=4',...list.map(x=>'test/'+x)],{cwd:root,shell:false,encoding:'utf8',windowsHide:true,maxBuffer:20*1024*1024,timeout:300000});
+const stdout=p.stdout||'',stderr=p.stderr||'';
+await writeFile(output,stdout+'\n===== STDERR =====\n'+stderr,'utf8');
+const summary=stdout.split(/\r?\n/).filter(x=>/^(?:ℹ (?:tests|pass|fail|skipped|duration_ms)|✖ |﹣ |✔ R191)/.test(x));
+console.log('RESULT_EXIT='+p.status+' SIGNAL='+p.signal+' ELAPSED_MS='+(Date.now()-started)+' ERROR='+(p.error?.message||'none'));
+console.log('SUMMARY='+JSON.stringify(summary.slice(-100)));
+console.log('TRANSCRIPT='+output);
+if(p.status!==0)process.exitCode=1;

package/scripts/r191-historical-release-regression.mjs

@@ -0,0 +1,9 @@
+import '../test/r130-release-security-contract.test.mjs';
+import '../test/r153-prepublish-identity.test.mjs';
+import '../test/r165-live-cli-skew.test.mjs';
+import '../test/r167-release-contract.test.mjs';
+import '../test/r172-release-contract.test.mjs';
+import '../test/r173-release-contract.test.mjs';
+import '../test/r179-release-contract.test.mjs';
+import '../test/r190-release-contract.test.mjs';
+import '../test/release-version.test.mjs';

package/scripts/r191-live-claim-inspect.mjs

@@ -0,0 +1,15 @@
+import os from 'node:os';
+import path from 'node:path';
+import {readFile} from 'node:fs/promises';
+import {createActivationClaimManager} from '../src/activation-lock-r65.mjs';
+const state=path.join(os.homedir(),'.deadbyte-mcp');
+const pointer=JSON.parse(await readFile(path.join(state,'active-release.json'),'utf8'));
+const manager=createActivationClaimManager({stateRoot:state});
+const result=await manager.inspect();
+console.log(JSON.stringify({state:'READ_ONLY_INSPECTION',active_release_id:pointer.release_id,
+  manifest_sha256:pointer.manifest_sha256,
+  claim_status:result.status,claim_operation_id:result.operation_id??null,
+  subject_sha256:result.subject_sha256??null,matched:result.matched??null,
+  foreign:result.foreign??null,unknown:result.unknown??null}));
+if(pointer.release_id!=='v0.15.68-ff29dbb2fbb89862')process.exitCode=5;
+if(result.status!=='RECONCILABLE')process.exitCode=6;

package/scripts/r191-npm-registry-readonly.mjs

@@ -0,0 +1,14 @@
+import https from 'node:https';
+const read=url=>new Promise((resolve,reject)=>{
+ const req=https.get(url,{timeout:10000,headers:{'User-Agent':'deadbyte-r191-readonly-version-check'}},res=>{
+ let s='';res.on('data',b=>{if(s.length<40000)s+=b;});res.on('end',()=>resolve({status:res.statusCode,body:s}));});
+ req.on('timeout',()=>req.destroy(new Error('timeout')));req.on('error',reject);
+});
+for(const suffix of ['0.15.71','dist-tags']){
+ try{
+ const r=await read('https://registry.npmjs.org/deadbyte-mcp/'+suffix);
+ let v={status:r.status};
+ if(r.status===200){const p=JSON.parse(r.body);v=suffix==='dist-tags'?p:{name:p.name,version:p.version,tarball:p.dist?.tarball,integrity_present:Boolean(p.dist?.integrity)};}
+ console.log(JSON.stringify({target:suffix,...v}));
+ }catch(e){console.log(JSON.stringify({target:suffix,status:'NETWORK_UNVERIFIED',error:e.message}));}
+}

package/scripts/r191-old-version-audit.mjs

@@ -0,0 +1,12 @@
+import {readdir,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const paths=await readdir(path.join(root,'test'));
+let hits=0;
+for(const f of paths.filter(x=>x.endsWith('.test.mjs'))){
+const s=await readFile(path.join(root,'test',f),'utf8');
+const n=s.split('0.15.70').length-1;
+if(n){hits++;const a=s.split(String.fromCharCode(10)).filter(l=>l.includes('0.15.70'));console.log(f+': '+n+' occurrences; '+a.slice(0,3).map(x=>x.trim().slice(0,150)).join(' | '));}
+}
+console.log('MATCHED_FILES='+hits);

package/scripts/r191-privilege-readonly.mjs

@@ -0,0 +1,6 @@
+import {access,constants,stat} from 'node:fs/promises';
+import os from 'node:os';
+const programFiles='C:\\Program Files';
+try{await access(programFiles,constants.W_OK);console.log('PROGRAM_FILES_WRITE_PROBE=ACCESS_ALLOWED')}catch(e){console.log('PROGRAM_FILES_WRITE_PROBE='+e.code);}
+console.log('HOME='+os.homedir());
+console.log('PROCESS_PLATFORM='+process.platform);

package/scripts/r191-process-policy-focused.mjs

@@ -0,0 +1 @@
+import '../test/process-policy-refresh.test.mjs';

package/scripts/r191-protected-failure-gate.mjs

@@ -0,0 +1,3 @@
+import '../test/r166-hotfix-contract.test.mjs';
+import '../test/r190-foreground-cli.test.mjs';
+import '../test/r191-epoch-source-claim.test.mjs';

package/scripts/r191-release-contract-runner.mjs

@@ -0,0 +1 @@
+import '../test/r191-release-contract.test.mjs';

package/scripts/r191-unreached-focused.mjs

@@ -0,0 +1,29 @@
+import {spawnSync} from 'node:child_process';
+import {mkdtemp,mkdir,readFile} from 'node:fs/promises';
+import {createPublicKey} from 'node:crypto';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import os from 'node:os';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const parentPublicKey=path.join(os.homedir(),'.deadbyte-mcp','trust','ed25519-public.pem');
+const pubKey=createPublicKey(await readFile(parentPublicKey));
+if(pubKey.asymmetricKeyType!=='ed25519')throw new Error('R43_PARENT_PUBLIC_KEY_NOT_ED25519');
+const isolated=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r191-unreached-'));
+const scratch='D:\\Projects\\deadbyte-mcp\\testing\\r191\\cross-volume-focused';
+if(path.parse(scratch).root.toLowerCase()===path.parse(os.tmpdir()).root.toLowerCase())throw new Error('R67_CROSS_VOLUME_NOT_DISTINCT');
+await mkdir(scratch,{recursive:true});
+const tests=[
+ 'test/r132-release-identity.test.mjs',
+ 'test/r59-tool-surface-compat.test.mjs',
+ 'test/production-docs.test.mjs',
+ 'test/r191-inherited-epoch-preflight.test.mjs',
+ 'test/r67-npm-cross-volume.test.mjs',
+ 'test/r43-parent.test.mjs'
+];
+const r=spawnSync(process.execPath,['--test','--test-concurrency=1',...tests],{
+ cwd:root,env:{...process.env,DEADBYTE_STATE_ROOT:isolated,DEADBYTE_PARENT_VERIFY_KEY:parentPublicKey,DEADBYTE_TEST_CROSS_VOLUME_ROOT:scratch},
+ windowsHide:true,shell:false,encoding:'utf8',timeout:160000,maxBuffer:2000000});
+console.log('FOCUSED_EXIT='+r.status+' ERROR='+(r.error?.message??'none'));
+console.log((r.stdout??'').slice(-19000));
+if(r.stderr)console.error(r.stderr.slice(-1400));
+if(r.error||r.status!==0)process.exitCode=1;

package/scripts/r192-focused.mjs

@@ -0,0 +1,10 @@
+import {spawnSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const files=['test/r192-live-log-hardening.test.mjs',
+'test/remote-live-log-r37.test.mjs','test/r51-live-log-polling.test.mjs',
+'test/remote-log-decode-r60.test.mjs'];
+const r=spawnSync(process.execPath,['--test','--test-concurrency=1',...files],{cwd:root,encoding:'utf8',windowsHide:true,shell:false,timeout:130000,maxBuffer:700000});
+console.log(JSON.stringify({state:r.status===0?'PASS':'FAIL',exit:r.status,error:r.error?.message??null,stdout:r.stdout?.slice(-16000),stderr:r.stderr?.slice(-4000)}));
+if(r.error||r.status!==0)process.exitCode=1;

package/scripts/r192-release-tests.mjs

@@ -0,0 +1,8 @@
+import {spawnSync} from 'node:child_process';import path from 'node:path';import {fileURLToPath} from 'node:url';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const tests=['r192-release-identity','r192-live-log-hardening','r130-release-security-contract','r132-release-identity','r153-prepublish-identity','r167-release-contract','r172-release-contract','r173-release-contract','r179-release-contract','r190-release-contract','r191-release-contract','process-policy-refresh','remote-live-log-r37','r51-live-log-polling'];
+const r=spawnSync(process.execPath,['--test','--test-concurrency=1',...tests.map(t=>'test/'+t+'.test.mjs')],{
+ cwd:root,encoding:'utf8',windowsHide:true,shell:false,timeout:220000,maxBuffer:1400000});
+console.log(JSON.stringify({status:r.status===0?'PASS':'FAIL',exit:r.status,error:r.error?.message??null,
+ stdout:r.stdout?.slice(-18000),stderr:r.stderr?.slice(-2200)}));
+if(r.error||r.status!==0)process.exitCode=1;

package/src/activation-lock-r65.mjs

@@ -115,7 +115,7 @@ async function isSafeSignedPreconditionReject(outcome,lock,stateRoot){
      body.result!=='PRECONDITION_REJECTED'||body.phase!=='initial'||
      body.attempted_pointer!==null||body.rollback?.attempted!==false||
      !Array.isArray(body.rollback?.errors)||body.rollback.errors.length!==0||
-     !(/^(?:host command 'powershell_script' executable pin drift detected;|windows release gate package script invalid$)/.test(String(body.error?.message??'')))||
+     !(/^(?:host command 'powershell_script' executable pin drift detected;.*$|windows release gate package script invalid$|authority epoch exact release source hash mismatch: manifest\.sha256$)/.test(String(body.error?.message??'')))||
      !Number.isFinite(failedTime)||failedTime<lockTime||failedTime>observedTime||
      !samePointerIdentity(body.prior_pointer,current))return false;
   return true;
@@ -162,6 +162,14 @@ export function createActivationClaimManager({stateRoot}={}){
   }
 
   return Object.freeze({
+    async inspect(){
+      const claim=await readLock(lockPath);
+      if(!claim)return Object.freeze({status:'NO_CLAIM'});
+      const evidence=await findTerminalOutcome(updatesDir,claim,state);
+      const safe=evidence.matched&&!evidence.foreign&&!evidence.unknown;
+      return Object.freeze({status:safe?'RECONCILABLE':'UNRESOLVED',operation_id:claim.operation_id,
+        subject_sha256:claim.subject_sha256,matched:evidence.matched,foreign:evidence.foreign,unknown:evidence.unknown});
+    },
     async claim(subjectSha256){
       if(!HEX64.test(String(subjectSha256??'')))throw new Error('activation claim subject invalid');
       await mkdir(updatesDir,{recursive:true});

package/src/deadbyte-cli.mjs

@@ -16,7 +16,7 @@ import { exportOfflineDiagnostics } from './r67-diagnostic-export.mjs';
 import { verifyOfflineDiagnosticsZip } from './r67-diagnostics-verify.mjs';
 import { parseActivePointer } from './release-slot.mjs';
 import { printDoctor } from './doctor-r45.mjs';
-import { classifyRemoteAuditOutcome, createLiveTimelineFilter, createLiveTimelineTracker, createLiveTimelineWriter, defaultForegroundTimelineOptions, formatRemoteLogResetNotice, formatCompactAuditEvent, formatRemoteLifecycle, formatRemoteToolCall, formatRuntimeDiagnosticLine, selectLiveLogNames } from './remote-live-log.mjs';
+import { classifyRemoteAuditOutcome, createLiveTimelineFilter, createLiveTimelineTracker, createLiveTimelineWriter, defaultForegroundTimelineOptions, formatRemoteLogResetNotice, formatCompactAuditEvent, formatRemoteLifecycle, formatRemoteToolCall, formatRuntimeDiagnosticLine, selectLiveLogNames, pruneLiveLogReaders } from './remote-live-log.mjs';
 import { prepareRemoteConsole, remoteDisplayText } from './remote-console.mjs';
 import { ensureRuntimeCoherence } from './runtime-coherence.mjs';
 import {selectR168OneShotRemotePath} from './remote-one-shot-coherence-r168.mjs';
@@ -414,6 +414,7 @@ async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTra
     const now=Date.now();
     if(now>=nextDiscoveryAt){
       liveFiles=await listLogFiles(root);
+      pruneLiveLogReaders(activeOffsets,partialLines,liveFiles);
       nextDiscoveryAt=now+LIVE_LOG_DISCOVERY_INTERVAL_MS;
     }
     for(const file of liveFiles){
@@ -946,7 +947,7 @@ async function readR190Evidence(file){
   }catch(error){if(error?.code==='ENOENT')return null;throw error;}
 }
 async function runRemoteForegroundRecovery(expectedMarkerSha256){
-  const ctx=await remoteContext();
+  // Reject writable/untrusted CLI bytes before reading controller state.
   const thisFile=fileURLToPath(import.meta.url);
   const protectedFiles=[process.execPath,thisFile,path.join(CURRENT_PACKAGE_ROOT,'MANIFEST.SHA256'),
     path.join(CURRENT_PACKAGE_ROOT,'src','foreground-owner-recovery-r190.mjs'),
@@ -961,6 +962,7 @@ async function runRemoteForegroundRecovery(expectedMarkerSha256){
   catch(error){throw new Error(`R190_PROTECTED_RECOVERY_REQUIRED: ${boundedSingleLine(error?.message||error,512)}`);}
   if(!installation.trusted)throw new Error('R190_PROTECTED_RECOVERY_REQUIRED: package ACL is not R89-trusted');
   await verifyPackageDecisionManifest({root:CURRENT_PACKAGE_ROOT,expectedVersion:DEADBYTE_VERSION});
+  const ctx=await remoteContext();
   const evidenceDir=path.join(ctx.root,'evidence','foreground-recovery-r190');
   const intentPath=path.join(evidenceDir,`${expectedMarkerSha256}.intent.json`);
   const terminalPath=path.join(evidenceDir,`${expectedMarkerSha256}.terminal.json`);