deadbyte-mcp 0.15.74 → 0.15.76

package/src/remote-device-r44.mjs

@@ -1,6 +1,8 @@
 import { createHash, createPublicKey, randomBytes } from 'node:crypto';
 import { lstat, mkdir, open, readFile, realpath, rename } from 'node:fs/promises';
 import path from 'node:path';
+import {verifySignedRemoteTerminalR200} from './remote-terminal-evidence-r200.mjs';
+import {normalizeRemotePayloadR201} from './remote-payload-boundary-r201.mjs';
 
 const STATE_SCHEMA='deadbyte.remote-device-state.v1';
 const CREDENTIAL_SCHEMA='deadbyte.remote-credential.v1';
@@ -36,6 +38,9 @@ function validateState(value){
     insist(HEX64.test(id)&&r.request_id===id,'remote request identity invalid');
     insist(HEX64.test(r.request_sha256??''),'remote request hash invalid');
     insist(['accepted','executing','completed','failed'].includes(r.state),'remote request state invalid');
+    if(r.transport_state!==undefined)insist(['prepared','acknowledged','ack_missing','timed_out','transport_error','terminal_received','reconciled'].includes(r.transport_state),'remote transport state invalid');
+    if(r.effect_state!==undefined)insist(['unknown','confirmed','failed'].includes(r.effect_state),'remote effect state invalid');
+    if(r.reconciliation_state!==undefined)insist(['signed_terminal','signed_terminal_effect_unknown'].includes(r.reconciliation_state),'remote reconciliation state invalid');
   }
   return value;
 }
@@ -69,12 +74,13 @@ async function withTimeout(operation,timeoutMs,label){
   try{
     return await Promise.race([
       Promise.resolve().then(operation),
-      new Promise((_,reject)=>{timer=setTimeout(()=>reject(new Error(`${label} timed out after ${timeoutMs}ms`)),timeoutMs);timer.unref?.();})
+      new Promise((_,reject)=>{timer=setTimeout(()=>{const error=new Error(`${label} timed out after ${timeoutMs}ms`);error.code='REMOTE_TIMEOUT';reject(error);},timeoutMs);timer.unref?.();})
     ]);
   }finally{if(timer)clearTimeout(timer);}
 }
 export function payloadHash({deviceId,epoch,capabilityId,payload}){
-  return sha(Buffer.from(canonicalJson({device_id:deviceId,epoch,capability_id:capabilityId,payload}),'utf8'));
+  const safePayload=normalizeRemotePayloadR201(payload);
+  return sha(Buffer.from(canonicalJson({device_id:deviceId,epoch,capability_id:capabilityId,payload:safePayload}),'utf8'));
 }
 
 export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapability,onCredentialSuperseded=null,relayTimeoutMs=15000,probeRetries=1,reachableTtlMs=75000}={}){
@@ -160,9 +166,9 @@ export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapabi
   async function dispatch({deviceId,epoch,capabilityId,payload={},requestId}={}){
     insist(HEX64.test(requestId??''),'remote request id invalid');
     insist(typeof capabilityId==='string'&&CAP.test(capabilityId),'remote capability id invalid');
-    insist(payload&&typeof payload==='object','remote payload must be JSON object');
-    let payloadJson;try{payloadJson=canonicalJson(payload);}catch{throw new Error('remote payload is not JSON serializable');}
-    const requestSha=payloadHash({deviceId,epoch,capabilityId,payload});
+    const safePayload=normalizeRemotePayloadR201(payload);
+    const payloadJson=canonicalJson(safePayload);
+    const requestSha=payloadHash({deviceId,epoch,capabilityId,payload:safePayload});
     const existing=state.requests[requestId];
     if(existing){
       insist(existing.request_sha256===requestSha,'remote request id conflict');
@@ -170,43 +176,112 @@ export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapabi
     }
     const allowed=await authorizeCapability({deviceId,epoch,capabilityId});
     insist(allowed===true,'remote capability denied by local policy');
+    let claimedNew=false;
     await withLock(async()=>{
       const d=getDevice(deviceId,epoch);insist(d.reported_online&&fresh(d),'remote device not reachable or readiness probe is stale');
       const again=state.requests[requestId];
       if(again){insist(again.request_sha256===requestSha,'remote request id conflict');return;}
       state.requests[requestId]={request_id:requestId,request_sha256:requestSha,device_id:deviceId,epoch,capability_id:capabilityId,
-        payload_sha256:sha(Buffer.from(payloadJson,'utf8')),state:'accepted',created_at_utc:now(),updated_at_utc:now()};
-      await persist();
+        payload_sha256:sha(Buffer.from(payloadJson,'utf8')),state:'accepted',transport_state:'prepared',effect_state:'unknown',
+        created_at_utc:now(),updated_at_utc:now()};
+      await persist();claimedNew=true;
     });
-    if(state.requests[requestId].state!=='accepted')return {...structuredClone(state.requests[requestId]),replay:true};
+    if(!claimedNew)return {...structuredClone(state.requests[requestId]),replay:true};
     let response=null;
     try{
       response=await withTimeout(
-        ()=>relay.request({device_id:deviceId,epoch,capability_id:capabilityId,payload,request_id:requestId,request_sha256:requestSha}),
+        ()=>relay.request({device_id:deviceId,epoch,capability_id:capabilityId,payload:safePayload,request_id:requestId,request_sha256:requestSha}),
         relayTimeoutMs,'remote dispatch'
       );
     }catch(error){
       return withLock(async()=>{
-        const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_error';rec.error=String(error?.message??error);rec.updated_at_utc=now();
+        const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_error';
+        rec.transport_state=error?.code==='REMOTE_TIMEOUT'?'timed_out':'transport_error';rec.effect_state='unknown';
+        rec.error=String(error?.message??error);rec.updated_at_utc=now();
         const d=state.devices[deviceId];if(d&&d.epoch===epoch){d.reachable=false;d.updated_at_utc=now();}
         await persist();return structuredClone(rec);
       });
     }
     if(!response||response.ack!=='accepted'||response.request_id!==requestId){
-      return withLock(async()=>{const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_no_ack';rec.updated_at_utc=now();await persist();return structuredClone(rec);});
+      return withLock(async()=>{const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_no_ack';rec.transport_state='ack_missing';rec.effect_state='unknown';rec.updated_at_utc=now();await persist();return structuredClone(rec);});
     }
-    await withLock(async()=>{const rec=state.requests[requestId];rec.state='executing';rec.acknowledged_at_utc=now();rec.updated_at_utc=now();await persist();});
+    await withLock(async()=>{const rec=state.requests[requestId];rec.state='executing';rec.transport_state='acknowledged';rec.effect_state='unknown';rec.acknowledged_at_utc=now();rec.updated_at_utc=now();await persist();});
     const terminal=response.terminal;
     if(!terminal||!['completed','failed'].includes(terminal.status)){
-      return withLock(async()=>{const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_no_terminal';rec.updated_at_utc=now();await persist();return structuredClone(rec);});
+      return withLock(async()=>{const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_no_terminal';rec.transport_state='acknowledged';rec.effect_state='unknown';rec.updated_at_utc=now();await persist();return structuredClone(rec);});
     }
     return withLock(async()=>{
       const rec=state.requests[requestId];rec.state=terminal.status;
+      rec.transport_state='terminal_received';rec.effect_state=terminal.status==='completed'?'confirmed':'failed';
       if(terminal.status==='completed'){insist(HEX64.test(terminal.result_sha256??''),'remote terminal result hash invalid');rec.result_sha256=terminal.result_sha256;}
       else {rec.error_code=typeof terminal.error_code==='string'?terminal.error_code:'remote_failed';}
       rec.updated_at_utc=now();rec.completed_at_utc=now();await persist();return structuredClone(rec);
     });
   }
+  // Read-only lookup: never calls relay.request, never creates a new request ID,
+  // and never turns a transport timeout into a claim that the mutation failed.
+  async function reconcile({requestId}={}){
+    insist(HEX64.test(requestId??''),'R200 reconciliation request id invalid');
+    insist(typeof relay.lookupTerminal==='function','R200 signed terminal lookup unavailable');
+    const snapshot=await withLock(async()=>{
+      const rec=state.requests[requestId];
+      insist(rec,'R200 reconciliation request unknown');
+      const device=getDevice(rec.device_id,rec.epoch);
+      return {request:structuredClone(rec),device:{
+        device_id:device.device_id,epoch:device.epoch,
+        public_key_spki_base64:device.public_key_spki_base64
+      }};
+    });
+    if(snapshot.request.effect_state!=='unknown')
+      return {...snapshot.request,replay:true,reconciliation:'already_terminal'};
+    let answer=null;
+    try{
+      answer=await withTimeout(()=>relay.lookupTerminal({
+        device_id:snapshot.request.device_id,epoch:snapshot.request.epoch,
+        request_id:requestId,request_sha256:snapshot.request.request_sha256
+      }),relayTimeoutMs,'remote terminal reconciliation');
+    }catch(error){
+      return {...snapshot.request,reconciliation:'unresolved',
+        reconciliation_error_code:error?.code==='REMOTE_TIMEOUT'?'lookup_timeout':'lookup_transport_error'};
+    }
+    if(answer===null||answer===undefined)
+      return {...snapshot.request,reconciliation:'unresolved'};
+    const proof=verifySignedRemoteTerminalR200(answer,snapshot);
+    return withLock(async()=>{
+      const record=state.requests[requestId];
+      insist(record?.request_sha256===snapshot.request.request_sha256,
+        'R200 reconciliation record changed before commit');
+      const current=getDevice(record.device_id,record.epoch);
+      insist(current.public_key_spki_base64===snapshot.device.public_key_spki_base64,
+        'R200 reconciliation pairing changed before commit');
+      if(record.effect_state!=='unknown')
+        return {...structuredClone(record),replay:true,reconciliation:'already_terminal'};
+      record.transport_state='reconciled';
+      record.terminal_evidence_sha256=proof.terminal_evidence_sha256;
+      record.terminal_status=proof.terminal.status;
+      record.signed_by_device_id=proof.signed_by_device_id;
+      record.reconciled_at_utc=now();
+      record.updated_at_utc=now();
+      record.reconciliation_state=proof.effective_state==='unknown'
+        ?'signed_terminal_effect_unknown':'signed_terminal';
+      if(proof.effective_state==='confirmed'){
+        record.state='completed';record.effect_state='confirmed';
+        record.result_sha256=proof.terminal.result_sha256;
+        record.completed_at_utc=now();
+      }else if(proof.effective_state==='failed'){
+        record.state='failed';record.effect_state='failed';
+        record.error_code=proof.terminal.error_code;
+        record.completed_at_utc=now();
+      }else{
+        record.state='failed';record.effect_state='unknown';
+        record.error_code=proof.terminal.error_code;
+      }
+      await persist();
+      return {...structuredClone(record),reconciliation:
+        proof.effective_state==='unknown'?'effect_unknown':'signed_terminal'};
+    });
+  }
+
   async function revoke({deviceId,epoch}={}){
     return withLock(async()=>{
       const d=getDevice(deviceId,epoch);d.revoked=true;d.reported_online=false;d.reachable=false;d.connection_id=null;d.updated_at_utc=now();await persist();
@@ -239,5 +314,5 @@ export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapabi
     return {status:'committed',device_id:deviceId,epoch,credential_sha256:credentialSha,previous_credential_sha256:previous?.credential_sha256??null};
   }
   async function list(){return {status:'ok',devices:Object.values(state.devices).map(pub).sort((a,b)=>a.device_id.localeCompare(b.device_id)),requests:structuredClone(state.requests)};}
-  return Object.freeze({pair,status,reportOnline,probe,dispatch,revoke,rotateCredential,list,state_file:stateFile});
+  return Object.freeze({pair,status,reportOnline,probe,dispatch,reconcile,revoke,rotateCredential,list,state_file:stateFile});
 }

package/src/remote-payload-boundary-r201.mjs

@@ -0,0 +1,71 @@
+// R201: a remote capability may only receive a detached, bounded JSON value.
+// Never use JSON.stringify on caller-owned objects: getters and toJSON can execute.
+import {types as utilTypes} from 'node:util';
+
+const MAX_BYTES=1024*1024;
+const MAX_DEPTH=32;
+const MAX_NODES=4096;
+const MAX_KEYS=256;
+const FORBIDDEN_KEYS=new Set(['__proto__','prototype','constructor','toJSON']);
+function reject(message){throw new Error('remote payload '+message);}
+function checkString(value,label){
+ if(Buffer.byteLength(value,'utf8')>MAX_BYTES)reject(label+' too large');
+ return value;
+}
+export function normalizeRemotePayloadR201(input){
+ let nodes=0;
+ const ancestors=new WeakSet();
+ function visit(value,depth){
+  if(depth>MAX_DEPTH)reject('depth exceeded');
+  if(++nodes>MAX_NODES)reject('node budget exceeded');
+  if(value===null||typeof value==='boolean')return value;
+  if(typeof value==='string')return checkString(value,'string');
+  if(typeof value==='number'){
+   if(!Number.isFinite(value)||Object.is(value,-0)||
+      (Number.isInteger(value)&&!Number.isSafeInteger(value)))reject('number must be finite, safe and unambiguous');
+   return value;
+  }
+  if(typeof value!=='object')reject('non-JSON value');
+  if(utilTypes.isProxy(value))reject('proxy object not allowed');
+  if(ancestors.has(value))reject('cycle detected');
+  const isArray=Array.isArray(value);
+  if(!isArray && ![null,Object.prototype].includes(Object.getPrototypeOf(value)))
+   reject('non-plain object not allowed');
+  ancestors.add(value);
+  try{
+   const descriptors=Object.getOwnPropertyDescriptors(value);
+   const names=Object.keys(descriptors);
+   if(Reflect.ownKeys(value).length!==names.length)reject('symbol property not allowed');
+   if(names.length>MAX_NODES)reject('property budget exceeded');
+   const result=isArray?[]:Object.create(null);
+   if(isArray){
+    const length=descriptors.length?.value;
+    if(!Number.isSafeInteger(length)||length<0||length>MAX_NODES)
+     reject('array length invalid');
+    if(names.length!==length+1)reject('sparse or decorated array not allowed');
+    for(let i=0;i<length;i++){
+     const desc=descriptors[String(i)];
+     if(!desc||!('value' in desc)||!desc.enumerable)reject('sparse or accessor array not allowed');
+     result.push(visit(desc.value,depth+1));
+    }
+   }else{
+    if(names.length>MAX_KEYS)reject('object key budget exceeded');
+    for(const key of names.sort()){
+     if(FORBIDDEN_KEYS.has(key))reject('unsafe key');
+     checkString(key,'key');
+     const desc=descriptors[key];
+     if(!desc?.enumerable||!('value' in desc))reject('accessor or hidden property not allowed');
+     result[key]=visit(desc.value,depth+1);
+    }
+   }
+   return Object.freeze(result);
+  }finally{
+   ancestors.delete(value);
+  }
+ }
+ const safe=visit(input,0);
+ if(!safe||Array.isArray(safe)||typeof safe!=='object')reject('top-level object required');
+ const encoded=JSON.stringify(safe);
+ if(Buffer.byteLength(encoded,'utf8')>MAX_BYTES)reject('encoded byte budget exceeded');
+ return safe;
+}

package/src/remote-terminal-evidence-r200.mjs

@@ -0,0 +1,60 @@
+import {createHash,createPublicKey,verify as edVerify} from 'node:crypto';
+import {canonicalJson} from './canonical-json.mjs';
+
+export const REMOTE_TERMINAL_EVIDENCE_SCHEMA='deadbyte.remote-terminal-evidence-r200.v1';
+export const REMOTE_TERMINAL_DOMAIN=Buffer.from('DEADBYTE-REMOTE-TERMINAL-R200\0','utf8');
+const HEX64=/^[0-9a-f]{64}$/;
+const CODE=/^[A-Za-z0-9._-]{1,128}$/;
+function insist(ok,message){if(!ok)throw new Error(message);}
+function exactKeys(value,keys,label){
+ insist(value&&typeof value==='object'&&!Array.isArray(value),label+' invalid');
+ insist(Object.keys(value).sort().join('|')===keys.sort().join('|'),label+' contains unexpected or missing fields');
+}
+function canonicalBase64(value,label){
+ insist(typeof value==='string'&&value.length<=8192&&value.length>0,label+' invalid');
+ const decoded=Buffer.from(value,'base64');
+ insist(decoded.length>0&&decoded.toString('base64')===value,label+' noncanonical');
+ return decoded;
+}
+export function verifySignedRemoteTerminalR200(response,{request,device}={}){
+ exactKeys(response,['evidence','attestation'],'R200 remote terminal envelope');
+ const body=response.evidence,signature=response.attestation;
+ exactKeys(body,['schema','device_id','epoch','request_id','request_sha256','capability_id','terminal'],'R200 remote terminal body');
+ insist(body.schema===REMOTE_TERMINAL_EVIDENCE_SCHEMA,'R200 terminal schema mismatch');
+ insist(HEX64.test(body.device_id??'')&&body.device_id===request?.device_id&&body.device_id===device?.device_id,
+   'R200 terminal device identity mismatch');
+ insist(Number.isSafeInteger(body.epoch)&&body.epoch===request?.epoch&&body.epoch===device?.epoch,
+   'R200 terminal epoch mismatch');
+ insist(HEX64.test(body.request_id??'')&&body.request_id===request?.request_id,
+   'R200 terminal request identity mismatch');
+ insist(HEX64.test(body.request_sha256??'')&&body.request_sha256===request?.request_sha256,
+   'R200 terminal request hash mismatch');
+ insist(body.capability_id===request?.capability_id,'R200 terminal capability mismatch');
+ const terminal=body.terminal;
+ insist(terminal&&typeof terminal==='object'&&!Array.isArray(terminal),'R200 terminal result missing');
+ if(terminal.status==='completed'){
+   exactKeys(terminal,['status','result_sha256'],'R200 completed terminal');
+   insist(HEX64.test(terminal.result_sha256??''),'R200 terminal result digest invalid');
+ }else if(terminal.status==='failed'){
+   exactKeys(terminal,['status','error_code','effect_state'],'R200 failed terminal');
+   insist(CODE.test(terminal.error_code??''),'R200 terminal error code invalid');
+   insist(['unknown','not_started'].includes(terminal.effect_state),
+     'R200 failure effect state must be unknown or not_started');
+ }else throw new Error('R200 terminal status invalid');
+ exactKeys(signature,['algorithm','key_id','signature_base64'],'R200 remote attestation');
+ insist(signature.algorithm==='ed25519'&&signature.key_id===device.device_id,'R200 signer identity mismatch');
+ const sig=canonicalBase64(signature.signature_base64,'R200 Ed25519 signature');
+ insist(sig.length===64,'R200 Ed25519 signature size invalid');
+ const der=canonicalBase64(device.public_key_spki_base64,'R200 paired device public key');
+ insist(createHash('sha256').update(der).digest('hex')===device.device_id,'R200 paired device key mismatch');
+ const key=createPublicKey({key:der,format:'der',type:'spki'});
+ insist(key.asymmetricKeyType==='ed25519','R200 paired device is not Ed25519');
+ const bytes=Buffer.concat([REMOTE_TERMINAL_DOMAIN,Buffer.from(canonicalJson(body),'utf8')]);
+ insist(edVerify(null,bytes,key,sig),'R200 remote terminal signature invalid');
+ return Object.freeze({
+   terminal:Object.freeze({...terminal}),
+   terminal_evidence_sha256:createHash('sha256').update(bytes).digest('hex'),
+   signed_by_device_id:device.device_id,
+   effective_state:terminal.status==='completed'?'confirmed':terminal.effect_state==='not_started'?'failed':'unknown'
+ });
+}

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.74';
+export const DEADBYTE_VERSION = '0.15.76';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/desktop-runtime-r40.test.mjs

@@ -100,6 +100,48 @@ test('desktop runtime performs observe-target-fresh-guard-effect-post chain',asy
   }),{ok:true,receipt_sha256:result.receipt_sha256,kind:'desktop_action_completed',receipt_id:result.receipt_id});
 });
 
+test('R196 Desktop explicit postimage is signed separately from injection completion',async()=>{
+  const fx=await fixture();
+  const result=await fx.runtime.action({
+    intentId:H('r196-postimage'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,
+    point:{x:20,y:20},expectedPostcondition:{kind:'frame_image_sha256',expected_sha256:H('after')}
+  });
+  assert.equal(result.injected,true);
+  assert.equal(result.side_effect_state,'confirmed_injected');
+  assert.equal(result.task_success,null,'generic task success must remain unknown');
+  assert.equal(result.postcondition.status,'satisfied');
+  assert.equal(result.postcondition.reason,'exact_post_image_observed');
+  assert.match(result.postcondition_sha256,/^[0-9a-f]{64}$/);
+  const receipt=JSON.parse(await readFile(path.join(fx.evidence,result.receipt_id+'.json'),'utf8'));
+  assert.equal(receipt.payload.postcondition.status,'satisfied');
+  assert.equal(receipt.payload.postcondition_sha256,result.postcondition_sha256);
+  assert.equal(verifyDesktopReceiptObject(receipt,{
+    policySha256:fx.policy.policy_sha256,publicKey:fx.publicKey,keyId:'test-key'
+  }).ok,true,'postcondition evidence must be in signed receipt');
+});
+
+test('R196 Desktop injected input without expected postimage is not application success',async()=>{
+  const before={frame:F('2026-09-19T02:00:00.700Z'),backend:'fake',byte_length:4};
+  const after={frame:F('2026-09-19T02:00:01.000Z'),backend:'fake',byte_length:4};
+  const fx=await fixture({captureFrames:[before,after]});
+  const result=await fx.runtime.action({
+    intentId:H('r196-disabled-like'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,point:{x:20,y:20},
+    expectedPostcondition:{kind:'frame_image_sha256',expected_sha256:H('desired-but-unobserved')}
+  });
+  assert.equal(result.injected,true);
+  assert.equal(result.postcondition.status,'unsatisfied');
+  assert.equal(result.task_success,null);
+});
+
+test('R196 Desktop malformed postcondition fails before input dispatch',async()=>{
+  const fx=await fixture();
+  await assert.rejects(fx.runtime.action({
+    intentId:H('r196-forgery'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,point:{x:20,y:20},
+    expectedPostcondition:{kind:'frame_image_sha256',expected_sha256:H('after'),_internal:true}
+  }),/unsupported desktop postcondition/);
+  assert.equal(fx.calls.length,0);
+});
+
 test('desktop runtime refuses effect when expected frame is stale',async()=>{
   const fx=await fixture({times:['2026-09-19T02:00:03.500Z']});
   await assert.rejects(fx.runtime.action({
@@ -322,3 +364,72 @@ test('T5 UIA grounding re-observes and binds candidate to fresh frame without mu
   assert.equal(JSON.stringify(result).includes('Save'),false);
   assert.equal(fx.calls.length,0);
 });
+
+test('R199 stale UIA RuntimeId must refuse action before input delivery',async()=>{
+  const at='2026-09-19T02:00:00.700Z';
+  const f1={frame:F(at),backend:'fake',byte_length:4};
+  const f2={frame:F('2026-09-19T02:00:00.750Z'),backend:'fake',byte_length:4};
+  const f3={frame:F('2026-09-19T02:00:01.100Z',H('post')),backend:'fake',byte_length:4};
+  let lookups=0;
+  const grounderProvider=async({query})=>{
+    lookups++;
+    assert.equal(query.value,'Save');
+    return {status:'ok',query_sha256:H('R199-Save'),query_kind:'name_exact',ordinal:0,
+      visited:2,truncated:false,provider_receipt_sha256:H('uia-provider'),
+      matches:[{rect:{left:100,top:120,width:80,height:30},control_type:50000,
+        enabled:true,offscreen:false,runtime_id:lookups===1?[17,222,0]:[17,223,0]}]};
+  };
+  const fx=await fixture({captureFrames:[f1,f2,f3],grounderProvider});
+  const q={kind:'name_exact',value:'Save',max_results:8,ordinal:0};
+  const target=await fx.runtime.ground({frameId:fx.expected.frame_id,query:q});
+  await assert.rejects(fx.runtime.action({intentId:H('R199-stale'),kind:'click_primary',
+    expectedFrameId:target.frame.frame_id,targetId:target.target.target_id}),/UIA.*(identity|stale|changed)/i);
+  assert.equal(lookups,2,'re-ground must happen exactly once before effect');
+  assert.equal(fx.calls.length,0,'stale UIA target must never dispatch input');
+});
+test('R199 matching RuntimeId permits guarded input but never claims application success',async()=>{
+  const f1={frame:F('2026-09-19T02:00:00.700Z'),backend:'fake',byte_length:4};
+  const f2={frame:F('2026-09-19T02:00:00.750Z'),backend:'fake',byte_length:4};
+  const f3={frame:F('2026-09-19T02:00:01.100Z',H('post')),backend:'fake',byte_length:4};
+  let lookups=0;
+  const grounderProvider=async()=>({status:'ok',query_sha256:H('R199-Save'),query_kind:'name_exact',ordinal:0,
+    visited:2,truncated:false,provider_receipt_sha256:H('uia-provider'),
+    matches:[{rect:{left:100,top:120,width:80,height:30},control_type:50000,
+      enabled:true,offscreen:false,runtime_id:[17,222,0]}]});
+  const fx=await fixture({captureFrames:[f1,f2,f3],grounderProvider});
+  const target=await fx.runtime.ground({frameId:fx.expected.frame_id,query:{kind:'name_exact',value:'Save',ordinal:0}});
+  const result=await fx.runtime.action({intentId:H('R199-valid'),kind:'click_primary',
+    expectedFrameId:target.frame.frame_id,targetId:target.target.target_id});
+  assert.equal(fx.calls.length,1);
+  assert.equal(result.injected,true);
+  assert.equal(result.task_success,null);
+  assert.equal(result.side_effect_state,'confirmed_injected');
+});
+
+test('R199 UIA target without RuntimeId cannot be used to inject coordinates',async()=>{
+ const f1={frame:F('2026-09-19T02:00:00.700Z'),backend:'fake',byte_length:4};
+ const f2={frame:F('2026-09-19T02:00:00.750Z'),backend:'fake',byte_length:4};
+ const grounderProvider=async()=>({status:'ok',query_sha256:H('legacy'),query_kind:'name_exact',ordinal:0,
+   visited:2,truncated:false,provider_receipt_sha256:H('provider'),
+   matches:[{rect:{left:100,top:120,width:80,height:30},control_type:50000,enabled:true,offscreen:false}]});
+ const fx=await fixture({captureFrames:[f1,f2],grounderProvider});
+ const result=await fx.runtime.ground({frameId:fx.expected.frame_id,query:{kind:'name_exact',value:'Save',ordinal:0}});
+ await assert.rejects(fx.runtime.action({intentId:H('legacy-noid'),kind:'click_primary',
+   expectedFrameId:result.frame.frame_id,targetId:result.target.target_id}),/UIA.*RuntimeId/i);
+ assert.equal(fx.calls.length,0);
+});
+test('R199 recreated UIA element at identical coordinates gets a different target id',async()=>{
+ const f1={frame:F('2026-09-19T02:00:00.700Z'),backend:'fake',byte_length:4};
+ let count=0;
+ const grounderProvider=async()=>({status:'ok',query_sha256:H('stable-query'),query_kind:'name_exact',
+   ordinal:0,visited:2,truncated:false,provider_receipt_sha256:H('provider'),
+   matches:[{rect:{left:100,top:120,width:80,height:30},control_type:50000,
+     enabled:true,offscreen:false,runtime_id:[7,++count,9]}]});
+ const fx=await fixture({captureFrames:[f1,f1],grounderProvider});
+ const query={kind:'name_exact',value:'Save',ordinal:0};
+ const first=await fx.runtime.ground({frameId:fx.expected.frame_id,query});
+ const next=await fx.runtime.ground({frameId:fx.expected.frame_id,query});
+ assert.notEqual(first.target.target_id,next.target.target_id);
+ assert.notEqual(first.grounding.element_token_sha256,next.grounding.element_token_sha256);
+ assert.equal(fx.calls.length,0);
+});

package/test/desktop-uia-r40.test.mjs

@@ -40,3 +40,18 @@ test('T5 UIA response rejects foreground substitution and oversized query',()=>{
   assert.throws(()=>parseDesktopUiaResponse(raw,{expectedWindow:win,expectedBounds:bounds,query:{kind:'root',value:'',max_results:1,ordinal:0}}),/hwnd mismatch/);
   assert.throws(()=>serializeDesktopUiaRequest({expectedWindow:win,query:{kind:'name_exact',value:'x'.repeat(513)}}),/bytes invalid/);
 });
+
+test('R199 UIA parser keeps bounded native RuntimeId and refuses malformed identities',()=>{
+  const query={kind:'name_exact',value:'Save',max_results:2,ordinal:0};
+  const make=id=>Buffer.from(JSON.stringify({
+    schema:'deadbyte.desktop-uia-ground.v1',foreground_hwnd:win.hwnd,foreground_pid:win.pid,
+    query_kind:query.kind,visited:2,truncated:false,matches:[
+      {left:10,top:20,width:100,height:30,control_type:50000,enabled:true,offscreen:false,runtime_id:id}
+    ]}));
+  const parse=id=>parseDesktopUiaResponse(make(id),{expectedWindow:win,expectedBounds:bounds,query});
+  assert.deepEqual(parse([17,-2147483648,2147483647]).matches[0].runtime_id,[17,-2147483648,2147483647]);
+  assert.throws(()=>parse([]),/RuntimeId missing/);
+  assert.throws(()=>parse(Array(65).fill(1)),/RuntimeId shape/);
+  assert.throws(()=>parse([1,2.3]),/component invalid/);
+  assert.throws(()=>parse([1,2147483648]),/component invalid/);
+});

package/test/fixtures/r197-junction-swap-worker.mjs

@@ -0,0 +1,21 @@
+import {rename,symlink,realpath,open,writeFile} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {readRangeFromHandle} from '../../src/machine-fs-handle-read-r196.mjs';
+const [file,off,len,doHash]=process.argv.slice(2);
+const dir=path.dirname(file),project=path.dirname(dir),tmp=path.dirname(project);
+const external=path.join(tmp,'external'),backup=path.join(project,'swapped-original');
+try{
+ await writeFile(path.join(tmp,'r197-worker-entered.marker'),'entered\n',{flag:'wx'});
+ await rename(dir,backup);
+ await symlink(external,dir,'junction');
+ const resolved=await realpath(file);
+ if(!resolved.toLowerCase().startsWith((external+path.sep).toLowerCase()))throw Error('R197_SWAP_NOT_OUTSIDE');
+ const handle=await open(file,'r');
+ let result;
+ try{result=await readRangeFromHandle(handle,{offset:Number(off),length:Number(len),hashFile:doHash==='1'});}
+ finally{await handle.close();}
+ const hash=createHash('sha256').update(Buffer.from(result.data_base64,'base64')).digest('hex');
+ await writeFile(path.join(tmp,'r197-escaped-open.marker'),hash+'\n',{flag:'wx'});
+ process.stdout.write(JSON.stringify(result));
+}catch(e){process.stderr.write('R197_RACE_WORKER '+String(e?.stack??e));process.exitCode=1;}

package/test/fixtures/r203-journal-writer.mjs

@@ -0,0 +1,6 @@
+import fs from 'node:fs/promises';
+import {openRemoteDestinationJournalR202} from '../../src/remote-destination-journal-r202.mjs';
+const fixture=JSON.parse(await fs.readFile(process.argv[2],'utf8'));
+const journal=await openRemoteDestinationJournalR202({directory:fixture.directory,device:fixture.device});
+const result=await journal.commitSignedTerminal({request:fixture.request,envelope:fixture.envelope});
+process.stdout.write(JSON.stringify({status:result.status})+'\n');

package/test/process-policy-refresh.test.mjs

@@ -70,13 +70,13 @@ test('R167 process policy binds coherently to the explicit development root', as
   // The distributed policy is pinned to its explicit development provenance,
   // not to the physical extraction path of the exact immutable npm tarball.
   const release = JSON.parse(await readFile(path.join(repoRoot, 'RELEASE.json'), 'utf8'));
-  const approvedRoot = release.r194?.development_policy_root;
-  assert.equal(typeof approvedRoot, 'string', 'R191 development policy root must be explicit in release metadata');
-  assert.ok(path.isAbsolute(approvedRoot), 'R191 development policy root must be absolute');
+  const approvedRoot = release.r207?.development_policy_root;
+  assert.equal(typeof approvedRoot, 'string', 'R207 development policy root must be explicit in release metadata');
+  assert.ok(path.isAbsolute(approvedRoot), 'R207 development policy root must be absolute');
   const expectedRoot = path.resolve(approvedRoot);
   if (process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT) {
     assert.equal(path.resolve(process.env.DEADBYTE_EXPECTED_DEVELOPMENT_ROOT), expectedRoot,
-      'caller-supplied development root cannot override R191 release provenance');
+      'caller-supplied development root cannot override R207 release provenance');
   }
   const policyPath = path.join(repoRoot, 'controller', 'deadbyte-process-policy.json');
   const policy = JSON.parse(await readFile(policyPath, 'utf8'));

package/test/r130-release-security-contract.test.mjs

@@ -14,14 +14,14 @@ test('current successor retains the R130 security baseline with truthful R190 id
     read('SBOM.cdx.json'),readReleaseLock(root),read('TEST-MATRIX.json')]);
   assert.equal(pkg.name,'deadbyte-mcp');
   for(const actual of [pkg.version,release.version,provenance.version,matrix.version,bom.metadata.component.version,lock.version,lock.packages[''].version,DEADBYTE_VERSION])
-    assert.equal(actual,'0.15.74');
-  assert.equal(release.train,'R194');
-  assert.equal(matrix.train,'R194');
-  assert.equal(release.source_predecessor.version,'0.15.73');
-  assert.equal(release.source_predecessor.train,'R193');
-  assert.match(release.source_predecessor.source_path,/r193-final-closure/i);
-  assert.equal(release.source_predecessor.manifest_status,'FROZEN_R193_CLOSURE_VERIFIED');
-  assert.equal(release.runtime_predecessor.version,'0.15.72');
+    assert.equal(actual,'0.15.76');
+  assert.equal(release.train,'R207');
+  assert.equal(matrix.train,'R207');
+  assert.equal(release.source_predecessor.version,'0.15.75');
+  assert.equal(release.source_predecessor.train,'R206');
+  assert.match(release.source_predecessor.source_path,/r206-release-closure/i);
+  assert.equal(release.source_predecessor.manifest_status,'R206_MANIFEST_VERIFIED');
+  assert.equal(release.runtime_predecessor.version,'0.15.75');
   assert.equal(provenance.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(pkg.dependencies['@modelcontextprotocol/client'],'2.3.1');
   assert.equal(pkg.dependencies['@modelcontextprotocol/server'],'2.3.1');

package/test/r132-release-identity.test.mjs

@@ -16,17 +16,17 @@ test('R190 package identity preserves R132 evidence and published R179 source pr
   for(const value of [pkg.version,lock.version,lock.packages[''].version,release.version,prov.version,bom.metadata.component.version,matrix.version,DEADBYTE_VERSION]){
     assert.equal(value,pkg.version);
   }
-  assert.equal(release.train,'R194');
-  assert.equal(matrix.train,'R194');
-  assert.equal(release.source_predecessor.version,'0.15.73');
-  assert.equal(release.source_predecessor.train,'R193');
-  assert.match(release.source_predecessor.source_path,/r193-final-closure/i);
+  assert.equal(release.train,'R207');
+  assert.equal(matrix.train,'R207');
+  assert.equal(release.source_predecessor.version,'0.15.75');
+  assert.equal(release.source_predecessor.train,'R206');
+  assert.match(release.source_predecessor.source_path,/r206-release-closure/i);
   assert.equal(prov.r160.source_predecessor_manifest_status,'STALE_REJECTED');
   assert.equal(release.r165.published_source_manifest_sha256,'4adf7d94682fbb71c4a91eb3147ecc48076bbc5d79cb67fcb875cde6a1bb4805');
   assert.equal(release.r165.published_source_tarball_sha256,'812e97609b7c51353ed25f2202129737e43bb4fbe0778c3adec43ec065352641');
-  assert.equal(release.source_predecessor.tarball_sha256,'13c3dd23a535609aa53173b328c7d9299d5dcada684f3253a88af6a4b300c534');
+  assert.equal(release.source_predecessor.tarball_sha256,'c2ebb079e7725f3a2f2c7d8f98ef42059e94e51f402d99c1825f46e020237ee9');
   assert.notEqual(release.r179.source_predecessor_tarball_sha256,release.source_predecessor.tarball_sha256);
-  assert.equal(release.runtime_predecessor.version,'0.15.72');
+  assert.equal(release.runtime_predecessor.version,'0.15.75');
   assert.equal(prov.runtime_predecessor.release_id,release.runtime_predecessor.release_id);
   assert.equal(prov.runtime_predecessor.manifest_sha256,release.runtime_predecessor.manifest_sha256);
   assert.equal(prov.runtime_predecessor.generation_manifest_sha256,release.runtime_predecessor.generation_manifest_sha256);

package/test/r153-prepublish-identity.test.mjs

@@ -26,7 +26,7 @@ test('R153 historical verifier refuses current successor package identity',async
  const state={pkg:JSON.parse(await readFile(path.join(root,'package.json'),'utf8')),
   release:JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8')),
   bridge:JSON.parse(await readFile(path.join(root,'bridge/package.json'),'utf8'))};
- assert.equal(state.pkg.version,'0.15.74');
+ assert.equal(state.pkg.version,'0.15.76');
  assert.throws(()=>verifyR153Lineage(state),/package version/);
  await assert.rejects(verifyR153IdentityTree(root),/package version/);
 });

package/test/r160-release-contract.test.mjs

@@ -8,9 +8,9 @@ const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
 
 test('R160 historical contract remains distinct from the current package identity',async()=>{
   const [release,provenance]=await Promise.all([read('RELEASE.json'),read('PROVENANCE.json')]);
-  assert.equal(release.runtime_predecessor.version,'0.15.72');
-  assert.equal(release.runtime_predecessor.release_id,'v0.15.72-0a5d9436e06e2d9e');
-  assert.equal(release.runtime_predecessor.manifest_sha256,'0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90');
+  assert.equal(release.runtime_predecessor.version,'0.15.75');
+  assert.equal(release.runtime_predecessor.release_id,'v0.15.75-9039fff265696091');
+  assert.equal(release.runtime_predecessor.manifest_sha256,'9039fff265696091f9217ba4f19526c6c74a967f9ff48b75ac6e340b5f431248');
   assert.equal(release.r160.runtime_predecessor_version,'0.15.61');
   assert.equal(release.r160.source_predecessor_train,'R159');
   assert.equal(release.r160.public_tool_delta,0);

package/test/r165-live-cli-skew.test.mjs

@@ -17,7 +17,7 @@ const hashMarker=c=>c.repeat(64);
 async function fixture(t,kind){
   assert.equal(typeof envRoot,'string'); assert.ok(path.isAbsolute(envRoot));
   assert.match(sha(await readFile(path.join(envRoot,'MANIFEST.SHA256'))),/^[0-9a-f]{64}$/);
-  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.74');
+  assert.equal(JSON.parse(await readFile(path.join(envRoot,'package.json'),'utf8')).version,'0.15.76');
   const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r164-skew-e2e-'));
   t.after(async()=>{await rm(dir,{recursive:true,force:true,maxRetries:10,retryDelay:150});});
   const state=path.join(dir,'state'),bin=path.join(state,'bin');