deadbyte-mcp 0.15.74 → 0.15.75

package/test/desktop-runtime-r40.test.mjs

@@ -100,6 +100,48 @@ test('desktop runtime performs observe-target-fresh-guard-effect-post chain',asy
   }),{ok:true,receipt_sha256:result.receipt_sha256,kind:'desktop_action_completed',receipt_id:result.receipt_id});
 });
 
+test('R196 Desktop explicit postimage is signed separately from injection completion',async()=>{
+  const fx=await fixture();
+  const result=await fx.runtime.action({
+    intentId:H('r196-postimage'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,
+    point:{x:20,y:20},expectedPostcondition:{kind:'frame_image_sha256',expected_sha256:H('after')}
+  });
+  assert.equal(result.injected,true);
+  assert.equal(result.side_effect_state,'confirmed_injected');
+  assert.equal(result.task_success,null,'generic task success must remain unknown');
+  assert.equal(result.postcondition.status,'satisfied');
+  assert.equal(result.postcondition.reason,'exact_post_image_observed');
+  assert.match(result.postcondition_sha256,/^[0-9a-f]{64}$/);
+  const receipt=JSON.parse(await readFile(path.join(fx.evidence,result.receipt_id+'.json'),'utf8'));
+  assert.equal(receipt.payload.postcondition.status,'satisfied');
+  assert.equal(receipt.payload.postcondition_sha256,result.postcondition_sha256);
+  assert.equal(verifyDesktopReceiptObject(receipt,{
+    policySha256:fx.policy.policy_sha256,publicKey:fx.publicKey,keyId:'test-key'
+  }).ok,true,'postcondition evidence must be in signed receipt');
+});
+
+test('R196 Desktop injected input without expected postimage is not application success',async()=>{
+  const before={frame:F('2026-09-19T02:00:00.700Z'),backend:'fake',byte_length:4};
+  const after={frame:F('2026-09-19T02:00:01.000Z'),backend:'fake',byte_length:4};
+  const fx=await fixture({captureFrames:[before,after]});
+  const result=await fx.runtime.action({
+    intentId:H('r196-disabled-like'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,point:{x:20,y:20},
+    expectedPostcondition:{kind:'frame_image_sha256',expected_sha256:H('desired-but-unobserved')}
+  });
+  assert.equal(result.injected,true);
+  assert.equal(result.postcondition.status,'unsatisfied');
+  assert.equal(result.task_success,null);
+});
+
+test('R196 Desktop malformed postcondition fails before input dispatch',async()=>{
+  const fx=await fixture();
+  await assert.rejects(fx.runtime.action({
+    intentId:H('r196-forgery'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,point:{x:20,y:20},
+    expectedPostcondition:{kind:'frame_image_sha256',expected_sha256:H('after'),_internal:true}
+  }),/unsupported desktop postcondition/);
+  assert.equal(fx.calls.length,0);
+});
+
 test('desktop runtime refuses effect when expected frame is stale',async()=>{
   const fx=await fixture({times:['2026-09-19T02:00:03.500Z']});
   await assert.rejects(fx.runtime.action({
@@ -322,3 +364,72 @@ test('T5 UIA grounding re-observes and binds candidate to fresh frame without mu
   assert.equal(JSON.stringify(result).includes('Save'),false);
   assert.equal(fx.calls.length,0);
 });
+
+test('R199 stale UIA RuntimeId must refuse action before input delivery',async()=>{
+  const at='2026-09-19T02:00:00.700Z';
+  const f1={frame:F(at),backend:'fake',byte_length:4};
+  const f2={frame:F('2026-09-19T02:00:00.750Z'),backend:'fake',byte_length:4};
+  const f3={frame:F('2026-09-19T02:00:01.100Z',H('post')),backend:'fake',byte_length:4};
+  let lookups=0;
+  const grounderProvider=async({query})=>{
+    lookups++;
+    assert.equal(query.value,'Save');
+    return {status:'ok',query_sha256:H('R199-Save'),query_kind:'name_exact',ordinal:0,
+      visited:2,truncated:false,provider_receipt_sha256:H('uia-provider'),
+      matches:[{rect:{left:100,top:120,width:80,height:30},control_type:50000,
+        enabled:true,offscreen:false,runtime_id:lookups===1?[17,222,0]:[17,223,0]}]};
+  };
+  const fx=await fixture({captureFrames:[f1,f2,f3],grounderProvider});
+  const q={kind:'name_exact',value:'Save',max_results:8,ordinal:0};
+  const target=await fx.runtime.ground({frameId:fx.expected.frame_id,query:q});
+  await assert.rejects(fx.runtime.action({intentId:H('R199-stale'),kind:'click_primary',
+    expectedFrameId:target.frame.frame_id,targetId:target.target.target_id}),/UIA.*(identity|stale|changed)/i);
+  assert.equal(lookups,2,'re-ground must happen exactly once before effect');
+  assert.equal(fx.calls.length,0,'stale UIA target must never dispatch input');
+});
+test('R199 matching RuntimeId permits guarded input but never claims application success',async()=>{
+  const f1={frame:F('2026-09-19T02:00:00.700Z'),backend:'fake',byte_length:4};
+  const f2={frame:F('2026-09-19T02:00:00.750Z'),backend:'fake',byte_length:4};
+  const f3={frame:F('2026-09-19T02:00:01.100Z',H('post')),backend:'fake',byte_length:4};
+  let lookups=0;
+  const grounderProvider=async()=>({status:'ok',query_sha256:H('R199-Save'),query_kind:'name_exact',ordinal:0,
+    visited:2,truncated:false,provider_receipt_sha256:H('uia-provider'),
+    matches:[{rect:{left:100,top:120,width:80,height:30},control_type:50000,
+      enabled:true,offscreen:false,runtime_id:[17,222,0]}]});
+  const fx=await fixture({captureFrames:[f1,f2,f3],grounderProvider});
+  const target=await fx.runtime.ground({frameId:fx.expected.frame_id,query:{kind:'name_exact',value:'Save',ordinal:0}});
+  const result=await fx.runtime.action({intentId:H('R199-valid'),kind:'click_primary',
+    expectedFrameId:target.frame.frame_id,targetId:target.target.target_id});
+  assert.equal(fx.calls.length,1);
+  assert.equal(result.injected,true);
+  assert.equal(result.task_success,null);
+  assert.equal(result.side_effect_state,'confirmed_injected');
+});
+
+test('R199 UIA target without RuntimeId cannot be used to inject coordinates',async()=>{
+ const f1={frame:F('2026-09-19T02:00:00.700Z'),backend:'fake',byte_length:4};
+ const f2={frame:F('2026-09-19T02:00:00.750Z'),backend:'fake',byte_length:4};
+ const grounderProvider=async()=>({status:'ok',query_sha256:H('legacy'),query_kind:'name_exact',ordinal:0,
+   visited:2,truncated:false,provider_receipt_sha256:H('provider'),
+   matches:[{rect:{left:100,top:120,width:80,height:30},control_type:50000,enabled:true,offscreen:false}]});
+ const fx=await fixture({captureFrames:[f1,f2],grounderProvider});
+ const result=await fx.runtime.ground({frameId:fx.expected.frame_id,query:{kind:'name_exact',value:'Save',ordinal:0}});
+ await assert.rejects(fx.runtime.action({intentId:H('legacy-noid'),kind:'click_primary',
+   expectedFrameId:result.frame.frame_id,targetId:result.target.target_id}),/UIA.*RuntimeId/i);
+ assert.equal(fx.calls.length,0);
+});
+test('R199 recreated UIA element at identical coordinates gets a different target id',async()=>{
+ const f1={frame:F('2026-09-19T02:00:00.700Z'),backend:'fake',byte_length:4};
+ let count=0;
+ const grounderProvider=async()=>({status:'ok',query_sha256:H('stable-query'),query_kind:'name_exact',
+   ordinal:0,visited:2,truncated:false,provider_receipt_sha256:H('provider'),
+   matches:[{rect:{left:100,top:120,width:80,height:30},control_type:50000,
+     enabled:true,offscreen:false,runtime_id:[7,++count,9]}]});
+ const fx=await fixture({captureFrames:[f1,f1],grounderProvider});
+ const query={kind:'name_exact',value:'Save',ordinal:0};
+ const first=await fx.runtime.ground({frameId:fx.expected.frame_id,query});
+ const next=await fx.runtime.ground({frameId:fx.expected.frame_id,query});
+ assert.notEqual(first.target.target_id,next.target.target_id);
+ assert.notEqual(first.grounding.element_token_sha256,next.grounding.element_token_sha256);
+ assert.equal(fx.calls.length,0);
+});

package/test/desktop-uia-r40.test.mjs

@@ -40,3 +40,18 @@ test('T5 UIA response rejects foreground substitution and oversized query',()=>{
   assert.throws(()=>parseDesktopUiaResponse(raw,{expectedWindow:win,expectedBounds:bounds,query:{kind:'root',value:'',max_results:1,ordinal:0}}),/hwnd mismatch/);
   assert.throws(()=>serializeDesktopUiaRequest({expectedWindow:win,query:{kind:'name_exact',value:'x'.repeat(513)}}),/bytes invalid/);
 });
+
+test('R199 UIA parser keeps bounded native RuntimeId and refuses malformed identities',()=>{
+  const query={kind:'name_exact',value:'Save',max_results:2,ordinal:0};
+  const make=id=>Buffer.from(JSON.stringify({
+    schema:'deadbyte.desktop-uia-ground.v1',foreground_hwnd:win.hwnd,foreground_pid:win.pid,
+    query_kind:query.kind,visited:2,truncated:false,matches:[
+      {left:10,top:20,width:100,height:30,control_type:50000,enabled:true,offscreen:false,runtime_id:id}
+    ]}));
+  const parse=id=>parseDesktopUiaResponse(make(id),{expectedWindow:win,expectedBounds:bounds,query});
+  assert.deepEqual(parse([17,-2147483648,2147483647]).matches[0].runtime_id,[17,-2147483648,2147483647]);
+  assert.throws(()=>parse([]),/RuntimeId missing/);
+  assert.throws(()=>parse(Array(65).fill(1)),/RuntimeId shape/);
+  assert.throws(()=>parse([1,2.3]),/component invalid/);
+  assert.throws(()=>parse([1,2147483648]),/component invalid/);
+});

package/test/fixtures/r197-junction-swap-worker.mjs

@@ -0,0 +1,21 @@
+import {rename,symlink,realpath,open,writeFile} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {readRangeFromHandle} from '../../src/machine-fs-handle-read-r196.mjs';
+const [file,off,len,doHash]=process.argv.slice(2);
+const dir=path.dirname(file),project=path.dirname(dir),tmp=path.dirname(project);
+const external=path.join(tmp,'external'),backup=path.join(project,'swapped-original');
+try{
+ await writeFile(path.join(tmp,'r197-worker-entered.marker'),'entered\n',{flag:'wx'});
+ await rename(dir,backup);
+ await symlink(external,dir,'junction');
+ const resolved=await realpath(file);
+ if(!resolved.toLowerCase().startsWith((external+path.sep).toLowerCase()))throw Error('R197_SWAP_NOT_OUTSIDE');
+ const handle=await open(file,'r');
+ let result;
+ try{result=await readRangeFromHandle(handle,{offset:Number(off),length:Number(len),hashFile:doHash==='1'});}
+ finally{await handle.close();}
+ const hash=createHash('sha256').update(Buffer.from(result.data_base64,'base64')).digest('hex');
+ await writeFile(path.join(tmp,'r197-escaped-open.marker'),hash+'\n',{flag:'wx'});
+ process.stdout.write(JSON.stringify(result));
+}catch(e){process.stderr.write('R197_RACE_WORKER '+String(e?.stack??e));process.exitCode=1;}

package/test/fixtures/r203-journal-writer.mjs

@@ -0,0 +1,6 @@
+import fs from 'node:fs/promises';
+import {openRemoteDestinationJournalR202} from '../../src/remote-destination-journal-r202.mjs';
+const fixture=JSON.parse(await fs.readFile(process.argv[2],'utf8'));
+const journal=await openRemoteDestinationJournalR202({directory:fixture.directory,device:fixture.device});
+const result=await journal.commitSignedTerminal({request:fixture.request,envelope:fixture.envelope});
+process.stdout.write(JSON.stringify({status:result.status})+'\n');

package/test/process-policy-refresh.test.mjs

@@ -70,13 +70,13 @@ test('R167 process policy binds coherently to the explicit development root', as
   // The distributed policy is pinned to its explicit development provenance,
   // not to the physical extraction path of the exact immutable npm tarball.
   const release = JSON.parse(await readFile(path.join(repoRoot, 'RELEASE.json'), 'utf8'));
-  const approvedRoot = release.r194?.development_policy_root;
-  assert.equal(typeof approvedRoot, 'string', 'R191 development policy root must be explicit in release metadata');
-  assert.ok(path.isAbsolute(approvedRoot), 'R191 development policy root must be absolute');
+  const approvedRoot = release.r206?.development_policy_root;
+  assert.equal(typeof approvedRoot, 'string', 'R206 development policy root must be explicit in release metadata');
+  assert.ok(path.isAbsolute(approvedRoot), 'R206 development policy root must be absolute');
   const expectedRoot = path.resolve(approvedRoot);
   if (process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT) {
     assert.equal(path.resolve(process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT), expectedRoot,
-      'caller-supplied development root cannot override R191 release provenance');
+      'caller-supplied development root cannot override R206 release provenance');
   }
   const policyPath = path.join(repoRoot, 'controller', 'deadbyte-process-policy.json');
   const policy = JSON.parse(await readFile(policyPath, 'utf8'));

package/test/r130-release-security-contract.test.mjs

@@ -14,14 +14,14 @@ test('current successor retains the R130 security baseline with truthful R190 id
     read('SBOM.cdx.json'),readReleaseLock(root),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.74');
-  assert.equal(release.train,'R194');
-  assert.equal(matrix.train,'R194');
-  assert.equal(release.source_predecessor.version,'0.15.73');
-  assert.equal(release.source_predecessor.train,'R193');
-  assert.match(release.source_predecessor.source_path,/r193-final-closure/i);
-  assert.equal(release.source_predecessor.manifest_status,'FROZEN_R193_CLOSURE_VERIFIED');
-  assert.equal(release.runtime_predecessor.version,'0.15.72');
+    assert.equal(actual,'0.15.75');
+  assert.equal(release.train,'R206');
+  assert.equal(matrix.train,'R206');
+  assert.equal(release.source_predecessor.version,'0.15.75');
+  assert.equal(release.source_predecessor.train,'R205');
+  assert.match(release.source_predecessor.source_path,/r205-evidence-selection-dev/i);
+  assert.equal(release.source_predecessor.manifest_status,'R205_MANIFEST_VERIFIED');
+  assert.equal(release.runtime_predecessor.version,'0.15.74');
   assert.equal(provenance.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(pkg.dependencies['@modelcontextprotocol/client'],'2.3.1');
   assert.equal(pkg.dependencies['@modelcontextprotocol/server'],'2.3.1');

package/test/r132-release-identity.test.mjs

@@ -16,17 +16,17 @@ test('R190 package identity preserves R132 evidence and published R179 source pr
   for(const value of [pkg.version,lock.version,lock.packages[''].version,release.version,prov.version,bom.metadata.component.version,matrix.version,DEADBYTE_VERSION]){
     assert.equal(value,pkg.version);
   }
-  assert.equal(release.train,'R194');
-  assert.equal(matrix.train,'R194');
-  assert.equal(release.source_predecessor.version,'0.15.73');
-  assert.equal(release.source_predecessor.train,'R193');
-  assert.match(release.source_predecessor.source_path,/r193-final-closure/i);
+  assert.equal(release.train,'R206');
+  assert.equal(matrix.train,'R206');
+  assert.equal(release.source_predecessor.version,'0.15.75');
+  assert.equal(release.source_predecessor.train,'R205');
+  assert.match(release.source_predecessor.source_path,/r205-evidence-selection-dev/i);
   assert.equal(prov.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(release.r165.published_source_manifest_sha256,'4adf7d94682fbb71c4a91eb3147ecc48076bbc5d79cb67fcb875cde6a1bb4805');
   assert.equal(release.r165.published_source_tarball_sha256,'812e97609b7c51353ed25f2202129737e43bb4fbe0778c3adec43ec065352641');
-  assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
+  assert.equal(release.source_predecessor.tarball_sha256,null);
   assert.notEqual(release.r179.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
-  assert.equal(release.runtime_predecessor.version,'0.15.72');
+  assert.equal(release.runtime_predecessor.version,'0.15.74');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);
   assert.equal(prov.runtime_predecessor.manifest_sha256,release.runtime_predecessor.manifest_sha256);
   assert.equal(prov.runtime_predecessor.generation_manifest_sha256,release.runtime_predecessor.generation_manifest_sha256);

package/test/r153-prepublish-identity.test.mjs

@@ -26,7 +26,7 @@ test('R153 historical verifier refuses current successor package identity',async
  const state={pkg:JSON.parse(await readFile(path.join(root,'package.json'),'utf8')),
   release:JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8')),
   bridge:JSON.parse(await readFile(path.join(root,'bridge/package.json'),'utf8'))};
- assert.equal(state.pkg.version,'0.15.74');
+ assert.equal(state.pkg.version,'0.15.75');
  assert.throws(()=>verifyR153Lineage(state),/package version/);
  await assert.rejects(verifyR153IdentityTree(root),/package version/);
 });

package/test/r160-release-contract.test.mjs

@@ -8,9 +8,9 @@ const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 
 test('R160 historical contract remains distinct from the current package identity',async()=>{
   const [release,provenance]=await Promise.all([read('RELEASE.json'),read('PROVENANCE.json')]);
-  assert.equal(release.runtime_predecessor.version,'0.15.72');
-  assert.equal(release.runtime_predecessor.release_id,'v0.15.72-0a5d9436e06e2d9e');
-  assert.equal(release.runtime_predecessor.manifest_sha256,'0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90');
+  assert.equal(release.runtime_predecessor.version,'0.15.74');
+  assert.equal(release.runtime_predecessor.release_id,'v0.15.74-e84bf4eed16e9443');
+  assert.equal(release.runtime_predecessor.manifest_sha256,'e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47');
   assert.equal(release.r160.runtime_predecessor_version,'0.15.61');
   assert.equal(release.r160.source_predecessor_train,'R159');
   assert.equal(release.r160.public_tool_delta,0);

package/test/r165-live-cli-skew.test.mjs

@@ -17,7 +17,7 @@ const hashMarker=c=>c.repeat(64);
 async function fixture(t,kind){
   assert.equal(typeof envRoot,'string'); assert.ok(path.isAbsolute(envRoot));
   assert.match(sha(await readFile(path.join(envRoot,'MANIFEST.SHA256'))),/^[0-9a-f]{64}$/);
-  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.74');
+  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.75');
   const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r164-skew-e2e-'));
   t.after(async()=>{await rm(dir,{recursive:true,force:true,maxRetries:10,retryDelay:150});});
   const state=path.join(dir,'state'),bin=path.join(state,'bin');

package/test/r167-release-contract.test.mjs

@@ -8,7 +8,7 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 const readOptional=async rel=>{try{return await read(rel);}catch(error){if(error?.code==='ENOENT')return null;throw error;}};
-const VERSION='0.15.74';
+const VERSION='0.15.75';
 const R166_MANIFEST='ad3c091fbbe2bac6d234548724008b67305fd483ad6542f92d5aeb1aa84f5849';
 const R166_TARBALL='3d22412c3cebabd66bfa92ca4dbaaf3ef49acba7f92436a16485d7e4cb18c653';
 
@@ -20,20 +20,20 @@ test('current package identity retains the immutable R167/R173 activation lineag
     provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION];
   if(lock)versions.push(lock.version,lock.packages[''].version);
   for(const version of versions)assert.equal(version,VERSION);
-  assert.equal(release.train,'R194');
-  assert.equal(matrix.train,'R194');
-  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r194:0.15.74');
+  assert.equal(release.train,'R206');
+  assert.equal(matrix.train,'R206');
+  assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r206:0.15.75');
   assert.deepEqual(release.runtime_predecessor,{
-    version:'0.15.72',release_id:'v0.15.72-0a5d9436e06e2d9e',
-    manifest_sha256:'0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90',
-    generation_manifest_sha256:'aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0'
+    version:'0.15.74',release_id:'v0.15.74-e84bf4eed16e9443',
+    manifest_sha256:'e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47',
+    generation_manifest_sha256:'598f896be9ce65e6b0c618e8c8f6eaa2a9d91617a76a146bf3deb385a56d19e7'
   });
-  assert.equal(release.source_predecessor.version,'0.15.73');
-  assert.equal(release.source_predecessor.train,'R193');
-  assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
+  assert.equal(release.source_predecessor.version,'0.15.75');
+  assert.equal(release.source_predecessor.train,'R205');
+  assert.equal(release.source_predecessor.tarball_sha256,null);
   assert.equal(release.r173.source_predecessor_version,'0.15.67');
   assert.equal(release.r167.source_predecessor_manifest_sha256,R166_MANIFEST);
-  assert.equal(provenance.source_predecessor_manifest_file_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
   assert.equal(provenance.r173.source_predecessor_manifest_sha256,'4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8');
   assert.equal(release.r172.source_predecessor_manifest_sha256,'962e227dace247d59aa860211388fbde461c5f9c8a7e8a878e34a14a27d355f8');
   assert.equal(release.r172.source_predecessor_tarball_sha256,'31b194a4fbff7dbdb9f4f275b4ea49c5115f7b0bb2241c0c72d72ef690311a5d');

package/test/r168-release-contract.test.mjs

@@ -13,10 +13,10 @@ const predecessorTarball='fc3ae5b1505e316bc9dfedf8d063cb00641754c8f5f1306a31f8cc
 
 test('R172 preserves the immutable R168 publication lineage separately from current identity',async()=>{
  const release=await read('RELEASE.json');
- assert.equal(release.runtime_predecessor.version,'0.15.72');
- assert.equal(release.parent.version,'0.15.72');
- assert.equal(release.runtime_predecessor.release_id,'v0.15.72-0a5d9436e06e2d9e');
- assert.equal(release.parent.release_id,'v0.15.72-0a5d9436e06e2d9e');
+ assert.equal(release.runtime_predecessor.version,'0.15.74');
+ assert.equal(release.parent.version,'0.15.74');
+ assert.equal(release.runtime_predecessor.release_id,'v0.15.74-e84bf4eed16e9443');
+ assert.equal(release.parent.release_id,'v0.15.74-e84bf4eed16e9443');
  assert.notEqual(release.runtime_predecessor.release_id,parent);
  assert.notEqual(release.parent.release_id,parent);
  assert.equal(release.r168.scope,'REMOTE_VERSION_SKEW_FAIL_CLOSED_AND_READONLY_RECONCILIATION');

package/test/r172-release-contract.test.mjs

@@ -16,12 +16,12 @@ test('R190 binds the published source predecessor separately from the active run
   const versions=[pkg.version,bridge.version,release.version,provenance.version,matrix.version,
     bom.metadata.component.version,DEADBYTE_VERSION];
   if(lock)versions.push(lock.version,lock.packages[''].version);
-  for(const value of versions)assert.equal(value,'0.15.74');
-  assert.equal(release.train,'R194'); assert.equal(matrix.train,'R194');
-  assert.equal(release.source_predecessor.version,'0.15.73');
-  assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
-  assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
-  assert.equal(release.runtime_predecessor.release_id,'v0.15.72-0a5d9436e06e2d9e');
+  for(const value of versions)assert.equal(value,'0.15.75');
+  assert.equal(release.train,'R206'); assert.equal(matrix.train,'R206');
+  assert.equal(release.source_predecessor.version,'0.15.75');
+  assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
+  assert.equal(release.source_predecessor.tarball_sha256,null);
+  assert.equal(release.runtime_predecessor.release_id,'v0.15.74-e84bf4eed16e9443');
   assert.equal(release.r173.public_tool_delta,0); assert.equal(release.r173.authority_scope_delta,0);
 });
 

package/test/r173-release-contract.test.mjs

@@ -13,21 +13,21 @@ test('R190 package identity binds the exact published R179 source and live runti
     json('package.json'),readReleaseLock(root),json('bridge/package.json'),json('RELEASE.json'),
     json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json')
   ]);
-  assert.equal(pkg.version,'0.15.74');
-  assert.equal(lock.version,'0.15.74');
-  assert.equal(lock.packages[''].version,'0.15.74');
-  assert.equal(bridge.version,'0.15.74');
-  assert.equal(release.version,'0.15.74');
-  assert.equal(release.train,'R194');
-  assert.equal(matrix.version,'0.15.74');
-  assert.equal(matrix.train,'R194');
-  assert.equal(sbom.metadata.component.version,'0.15.74');
-  assert.equal(release.source_predecessor.version,'0.15.73');
-  assert.equal(release.source_predecessor.train,'R193');
-  assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
-  assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
-  assert.equal(release.runtime_predecessor.version,'0.15.72');
-  assert.equal(provenance.version,'0.15.74');
-  assert.equal(provenance.parent_tarball_sha256,'15ab5d9808cbca342aee3f64c6d1123e8fbb72964674eab460e355c8675bf84d');
+  assert.equal(pkg.version,'0.15.75');
+  assert.equal(lock.version,'0.15.75');
+  assert.equal(lock.packages[''].version,'0.15.75');
+  assert.equal(bridge.version,'0.15.75');
+  assert.equal(release.version,'0.15.75');
+  assert.equal(release.train,'R206');
+  assert.equal(matrix.version,'0.15.75');
+  assert.equal(matrix.train,'R206');
+  assert.equal(sbom.metadata.component.version,'0.15.75');
+  assert.equal(release.source_predecessor.version,'0.15.75');
+  assert.equal(release.source_predecessor.train,'R205');
+  assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
+  assert.equal(release.source_predecessor.tarball_sha256,null);
+  assert.equal(release.runtime_predecessor.version,'0.15.74');
+  assert.equal(provenance.version,'0.15.75');
+  assert.equal(provenance.parent_tarball_sha256,'5da436a3f8068107e74caf6da58ff1e211d4a62f94266853136b601762f36f0c');
   assert.equal(provenance.source_predecessor_manifest_file_sha256,release.source_predecessor.manifest_sha256);
 });

package/test/r179-release-contract.test.mjs

@@ -7,27 +7,27 @@ import {DEADBYTE_VERSION} from '../src/version.mjs';
 import {readReleaseLock} from './helpers/release-lock.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async file=>JSON.parse(await readFile(path.join(root,file),'utf8'));
-const parent='v0.15.72-0a5d9436e06e2d9e';
-const manifest='0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90';
-const generation='aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0';
+const parent='v0.15.74-e84bf4eed16e9443';
+const manifest='e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47';
+const generation='598f896be9ce65e6b0c618e8c8f6eaa2a9d91617a76a146bf3deb385a56d19e7';
 const tarball='1a7f1fe05a06178b8d772a140be6e0470790b743cef690c3f8f8165cc61075bf';
 test('R190 version, lock snapshot, bridge, matrix, SBOM and provenance identify exact 0.15.70 successor',async()=>{
  const [pkg,lock,bridge,release,provenance,matrix,sbom]=await Promise.all([
   read('package.json'),readReleaseLock(root),read('bridge/package.json'),read('RELEASE.json'),
   read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
  for(const version of [pkg.version,lock.version,lock.packages[''].version,bridge.version,release.version,provenance.version,
-  matrix.version,sbom.metadata.component.version,DEADBYTE_VERSION])assert.equal(version,'0.15.74');
- assert.equal(release.train,'R194');assert.equal(matrix.train,'R194');
- assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r194:0.15.74');
+  matrix.version,sbom.metadata.component.version,DEADBYTE_VERSION])assert.equal(version,'0.15.75');
+ assert.equal(release.train,'R206');assert.equal(matrix.train,'R206');
+ assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r206:0.15.75');
  assert.equal(release.parent.release_id,parent);assert.equal(release.parent.manifest_sha256,manifest);
  assert.equal(release.parent.generation_manifest_sha256,generation);
- assert.equal(release.source_predecessor.version,'0.15.73');
- assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
- assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
+ assert.equal(release.source_predecessor.version,'0.15.75');
+ assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
+ assert.equal(release.source_predecessor.tarball_sha256,null);
  assert.equal(release.runtime_predecessor.release_id,parent);
  assert.equal(provenance.runtime_predecessor.release_id,parent);
- assert.equal(provenance.parent_tarball_sha256,'15ab5d9808cbca342aee3f64c6d1123e8fbb72964674eab460e355c8675bf84d');
- assert.equal(provenance.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
+ assert.equal(provenance.parent_tarball_sha256,'5da436a3f8068107e74caf6da58ff1e211d4a62f94266853136b601762f36f0c');
+ assert.equal(provenance.source_predecessor_tarball_sha256,null);
 });
 test('R179 does not misrepresent owner Autonomous enrollment, protected regression or publication as finished',async()=>{
  const [release,prov,matrix]=await Promise.all(['RELEASE.json','PROVENANCE.json','TEST-MATRIX.json'].map(read));
@@ -48,7 +48,7 @@ test('R190 retains historical R179 and R173 source evidence without promoting it
  assert.equal(release.r173.source_predecessor_version,'0.15.67');
  assert.equal(release.r173.source_predecessor_manifest_sha256,'4fd7bfc76b1de6401c142b607cc84e847434b28c888bc99ceb09c9e8e5adc8f8');
  assert.equal(prov.r173.source_predecessor_version,'0.15.67');
- assert.equal(release.source_predecessor.version,'0.15.73');
+ assert.equal(release.source_predecessor.version,'0.15.75');
  assert.notEqual(release.source_predecessor.tarball_sha256,release.r173.source_predecessor_tarball_sha256);
 });
 test('R184 ships a semantic lock snapshot matching installed package identity and dependencies',async()=>{

package/test/r190-release-contract.test.mjs

@@ -8,17 +8,17 @@ test('R190 candidate identity separates published source 0.15.69 from active run
   json('package.json'),json('bridge/package.json'),json('RELEASE.json'),json('PROVENANCE.json'),
   json('TEST-MATRIX.json'),json('SBOM.cdx.json'),readFile(new URL('../src/version.mjs',import.meta.url),'utf8')]);
  for(const value of [pkg.version,bridge.version,release.version,provenance.version,matrix.version,
-  sbom.metadata.component.version])assert.equal(value,'0.15.74');
- assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.74'/);
- assert.equal(release.train,'R194');assert.equal(matrix.train,'R194');
- assert.equal(release.source_predecessor.version,'0.15.73');
- assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
- assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
- assert.equal(release.runtime_predecessor.version,'0.15.72');
- assert.equal(release.runtime_predecessor.release_id,'v0.15.72-0a5d9436e06e2d9e');
- assert.equal(provenance.source_predecessor_version,'0.15.73');
+  sbom.metadata.component.version])assert.equal(value,'0.15.75');
+ assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.75'/);
+ assert.equal(release.train,'R206');assert.equal(matrix.train,'R206');
+ assert.equal(release.source_predecessor.version,'0.15.75');
+ assert.equal(release.source_predecessor.tarball_sha256,null);
+ assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
+ assert.equal(release.runtime_predecessor.version,'0.15.74');
+ assert.equal(release.runtime_predecessor.release_id,'v0.15.74-e84bf4eed16e9443');
+ assert.equal(provenance.source_predecessor_version,'0.15.75');
  assert.equal(provenance.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
- assert.match(sbom.serialNumber,/r194:0\.15\.74$/);
+ assert.match(sbom.serialNumber,/r206:0\.15\.75$/);
 });
 
 test('R190 release metadata records verified recovery without claiming publication or activation',async()=>{

package/test/r191-release-contract.test.mjs

@@ -6,23 +6,23 @@ import path from 'node:path';
 import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const json=async f=>JSON.parse(await readFile(path.join(root,f),'utf8'));
-const predecessor='v0.15.72-0a5d9436e06e2d9e';
-const publishedManifest='0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90';
-const publishedTarball='15ab5d9808cbca342aee3f64c6d1123e8fbb72964674eab460e355c8675bf84d';
+const predecessor='v0.15.74-e84bf4eed16e9443';
+const publishedManifest='e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47';
+const publishedTarball='5da436a3f8068107e74caf6da58ff1e211d4a62f94266853136b601762f36f0c';
 test('R191 exact version identity includes bundled bridge, lock snapshot, SBOM, provenance and matrix',async()=>{
  const [pkg,bridge,lock,release,provenance,matrix,bom]=await Promise.all(['package.json','bridge/package.json','docs/R184-package-lock.json','RELEASE.json','PROVENANCE.json','TEST-MATRIX.json','SBOM.cdx.json'].map(json));
- for(const ver of [pkg.version,bridge.version,lock.version,lock.packages[''].version,release.version,provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION])assert.equal(ver,'0.15.74');
- for(const train of [release.train,matrix.train])assert.equal(train,'R194');
- assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r194:0.15.74');
+ for(const ver of [pkg.version,bridge.version,lock.version,lock.packages[''].version,release.version,provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION])assert.equal(ver,'0.15.75');
+ for(const train of [release.train,matrix.train])assert.equal(train,'R206');
+ assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r206:0.15.75');
  assert.equal(release.parent.release_id,predecessor);
  assert.equal(provenance.parent_release_id,predecessor);
- assert.equal(release.source_predecessor.version,'0.15.73');
- assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
- assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
- assert.equal(provenance.source_predecessor_version,'0.15.73');
+ assert.equal(release.source_predecessor.version,'0.15.75');
+ assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
+ assert.equal(release.source_predecessor.tarball_sha256,null);
+ assert.equal(provenance.source_predecessor_version,'0.15.75');
  assert.equal(provenance.parent_tarball_sha256,publishedTarball);
- assert.equal(provenance.source_predecessor_tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
- assert.equal(provenance.source_predecessor_manifest_file_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
+ assert.equal(provenance.source_predecessor_tarball_sha256,null);
+ assert.equal(provenance.source_predecessor_manifest_file_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
  assert.equal(release.r191_activation_repair.npm_publish,'NOT_RUN');
  assert.equal(release.r191_activation_repair.production_activation,'NOT_RUN');
  assert.equal(release.r190_foreground_recovery.status,'PREPUBLISH_VERIFIED');

package/test/r192-release-identity.test.mjs

@@ -3,21 +3,21 @@ import {readFile} from 'node:fs/promises';import {createHash} from 'node:crypto'
 import {DEADBYTE_VERSION} from '../src/version.mjs';
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const read=async name=>JSON.parse(await readFile(path.join(root,name),'utf8'));
-const prevHash='0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90';
-const prevTar='15ab5d9808cbca342aee3f64c6d1123e8fbb72964674eab460e355c8675bf84d';
+const prevHash='e84bf4eed16e9443fbd0bf9f0f562e26b01db778647aefcc8b12fd7f48636b47';
+const prevTar='5da436a3f8068107e74caf6da58ff1e211d4a62f94266853136b601762f36f0c';
 test('R193 current identity retains exact published R192 predecessor evidence',async()=>{
  const [pkg,bridge,lock,release,prov,matrix,bom]=await Promise.all([
  read('package.json'),read('bridge/package.json'),read('docs/R184-package-lock.json'),
  read('RELEASE.json'),read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
  for(const actual of [pkg.version,bridge.version,lock.version,lock.packages[''].version,
  release.version,prov.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION])
-   assert.equal(actual,'0.15.74');
- assert.equal(release.train,'R194');assert.equal(matrix.train,'R194');
- assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r194:0.15.74');
- assert.equal(release.parent.release_id,'v0.15.72-0a5d9436e06e2d9e');
+   assert.equal(actual,'0.15.75');
+ assert.equal(release.train,'R206');assert.equal(matrix.train,'R206');
+ assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r206:0.15.75');
+ assert.equal(release.parent.release_id,'v0.15.74-e84bf4eed16e9443');
  assert.equal(release.parent.manifest_sha256,prevHash);
- assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
- assert.equal(release.source_predecessor.manifest_sha256,'e0b3f8b333f1c1260a97b178d1a8beff5742355296a9fe7daba378612604a3bd');
+ assert.equal(release.source_predecessor.tarball_sha256,null);
+ assert.equal(release.source_predecessor.manifest_sha256,'166eebde18d53a9ec46f738383c289733f9cd37918b3572b7515d1ab9b122c92');
  assert.equal(prov.parent_tarball_sha256,prevTar);
  assert.equal(prov.parent_manifest_sha256,prevHash);
  assert.equal(release.r192.production_activation,'NOT_RUN');
@@ -33,7 +33,7 @@ test('R192 foreground reader enforces caller-safe telemetry rather than changing
  assert.match(log,/sanitizeAuditArgs\(compact\[6\]\)/);
  const [policy,release]=await Promise.all([
  read('controller/deadbyte-process-policy.json'),read('RELEASE.json')]);
- const approved=release.r194.development_policy_root;
+ const approved=release.r206.development_policy_root;
  assert.equal(typeof approved,'string');
  assert.ok(path.isAbsolute(approved));
  assert.equal(path.resolve(policy.roots.core.path),path.resolve(approved));