deadbyte-mcp 0.8.7

package/proof/V073-SOURCE-GATE.txt

@@ -0,0 +1,21 @@
+DEADBYTE MCP V0.7.3 SOURCE GATE
+===============================
+SOURCE_TESTS=142
+SOURCE_PASS=142
+SOURCE_FAIL=0
+TUNNEL_STDIO_COMPAT_TESTS=10
+TUNNEL_STDIO_COMPAT_PASS=10
+NODE_SYNTAX_FILES=44
+NODE_SYNTAX=PASS
+STATIC_SECRET_SCAN=PASS
+BROAD_KILL_SCAN=PASS
+SHELL_TRUE_SCAN=PASS
+NPM_PACK_DRY_RUN=PASS
+MCP_PROTOCOL_REVISION=2026-07-28
+STRICT_SDK_LEGACY_POLICY=reject
+INGRESS_ADAPTER=tunnel-stdio-probe-compat-v1
+LEGACY_STARTUP_INITIALIZE_LOCAL_RESPONSE=YES
+LEGACY_CAPABILITY_TRANSLATION=NO
+MODERN_SERVER_DISCOVER_FORWARD=UNCHANGED
+WINDOWS_NATIVE_BATCH_GATE=PENDING_TARGET
+PUBLIC_TUNNEL_GATE=PENDING_TARGET

package/proof/V073-STATIC-SCAN.txt

@@ -0,0 +1,10 @@
+DEADBYTE MCP V0.7.3 STATIC SCAN
+PRIVATE_KEY_LITERAL=ABSENT
+MCP_SECRET_PATH_LITERAL=ABSENT
+SHELL_TRUE=ABSENT
+TASKKILL_BY_IMAGE=ABSENT
+STOP_PROCESS_BY_NAME=ABSENT
+TUNNEL_COMPAT_CHILD_PROCESS=ABSENT
+TUNNEL_COMPAT_FILE_WRITE=ABSENT
+LEGACY_TOOLS_TRANSLATION=ABSENT
+RESULT=PASS

package/proof/V073-WINDOWS-GATE-PENDING.txt

@@ -0,0 +1,5 @@
+DEADBYTE MCP V0.7.3 WINDOWS TARGET GATE
+STATUS=PENDING_TARGET
+REQUIRED_GATE=npm run gate:windows
+ADDED_STAGE=tunnel-stdio-compat-smoke
+DONE_REQUIRES=legacy startup initialize probe + modern 2026-07-28 pass-through + host smoke + AppContainer/Job containment + contained MCP smoke

package/proof/VERIFY.txt

@@ -0,0 +1,7 @@
+DEADBYTE MCP V0.6.0 INDEPENDENT VERIFIER REGRESSION
+STATUS=PASS
+SIGNATURE_VALID=true
+RECEIPT_SHA256=5bc4f1ace478b79fc491811888b039ebffb72d09f7cd51f520f6569a0cc3d0d4
+KEY_ID=64ee8445e138c19a2049dc4242924d056f2b62913ed65364916413eb684a946e
+INPUT_SHA256=8f3be3d122218dc1663c2fd4ea72e6634a7bd624b3ce18f178312cbe78aae78c
+OUTPUT_SHA256=72562501a654ddbb4f8810f8ba9017d02b29516853101456445e7642988fbd1b

package/proof/WINDOWS-CONTAINED-STATUS.txt

@@ -0,0 +1,5 @@
+DEADBYTE MCP V0.6.0
+WINDOWS_CONTAINED_EXECUTION=PENDING_TARGET_BATCH_GATE
+ACTIVE_LOOPBACK_NETWORK_DENIAL=PENDING_TARGET_BATCH_GATE
+AUTHORITY_SMOKE=PENDING_TARGET_BATCH_GATE
+COMMAND_RUN=NOT_EXPOSED

package/proof/WINDOWS-CONTAINMENT-STATUS.txt

@@ -0,0 +1,3 @@
+DEADBYTE MCP V0.6.0
+REGULAR_APPCONTAINER_BASELINE=ACCEPTED_FROM_V0.5.0_PARENT
+V0.6.0_REGRESSION_GATE=PENDING_TARGET_BATCH_GATE

package/scripts/autonomous-benchmark.mjs

@@ -0,0 +1,12 @@
+import { createHash } from 'node:crypto';
+import { canonicalJson } from '../src/canonical-json.mjs';
+
+let digest = '';
+const started = performance.now();
+for (let i = 0; i < 20000; i += 1) {
+  const body = canonicalJson({ i, phase: i % 7, payload: `deadbyte-${i % 97}` });
+  digest = createHash('sha256').update(body).digest('hex');
+}
+const elapsed = performance.now() - started;
+if (!/^[0-9a-f]{64}$/.test(digest)) throw new Error('benchmark digest invalid');
+process.stdout.write(JSON.stringify({ status:'pass', workload:20000, elapsed_ms:Number(elapsed.toFixed(3)), digest_prefix:digest.slice(0,8) }));

package/scripts/autonomous-build.ps1

@@ -0,0 +1,20 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 2.0
+$root = Split-Path -Parent $PSScriptRoot
+$targets = @(
+    'src\autonomous-policy.mjs',
+    'src\autonomous-planner.mjs',
+    'src\autonomous-runtime.mjs',
+    'src\autonomous-mcp-tools.mjs',
+    'src\autonomous-output-contracts.mjs',
+    'src\native-diff.mjs',
+    'src\mcp-server.mjs'
+)
+Push-Location $root
+try {
+    foreach ($target in $targets) {
+        & node.exe --check $target
+        if ($LASTEXITCODE -ne 0) { throw "syntax gate failed: $target" }
+    }
+    Write-Output 'R24 QUICK BUILD PASS'
+} finally { Pop-Location }

package/scripts/autonomous-tests.ps1

@@ -0,0 +1,9 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 2.0
+$root = Split-Path -Parent $PSScriptRoot
+Push-Location $root
+try {
+    & npm.cmd test
+    if ($LASTEXITCODE -ne 0) { throw "npm test failed with exit code $LASTEXITCODE" }
+    Write-Output 'R24 QUICK TEST PASS'
+} finally { Pop-Location }

package/scripts/build-containment.ps1

@@ -0,0 +1,279 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+$Root = Split-Path -Parent $PSScriptRoot
+$Bin = Join-Path $Root 'bin'
+$Native = Join-Path $Root 'native'
+$Proof = Join-Path $Root 'proof'
+$BuildLog = Join-Path $Proof 'CONTAINMENT-BUILD.txt'
+New-Item -ItemType Directory -Force -Path $Bin | Out-Null
+New-Item -ItemType Directory -Force -Path $Proof | Out-Null
+
+$VsWhereCandidates = @()
+if (${env:ProgramFiles(x86)}) {
+    $VsWhereCandidates += (Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe')
+}
+if ($env:ProgramFiles) {
+    $VsWhereCandidates += (Join-Path $env:ProgramFiles 'Microsoft Visual Studio\Installer\vswhere.exe')
+}
+$VsWhereCandidates += 'C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe'
+$VsWhere = ($VsWhereCandidates | Select-Object -Unique | Where-Object { Test-Path -LiteralPath $_ } | Select-Object -First 1)
+if (-not $VsWhere) {
+    throw "vswhere.exe not found; checked: $($VsWhereCandidates -join '; ')"
+}
+
+$Install = (& $VsWhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath | Select-Object -First 1)
+if (-not $Install) {
+    throw 'MSVC x64 C++ toolchain was not found'
+}
+
+$VsDevCmd = Join-Path $Install 'Common7\Tools\VsDevCmd.bat'
+if (-not (Test-Path -LiteralPath $VsDevCmd)) {
+    throw "VsDevCmd.bat not found: $VsDevCmd"
+}
+$CmdExe = if (-not [string]::IsNullOrWhiteSpace([string]$env:ComSpec)) {
+    [System.IO.Path]::GetFullPath([string]$env:ComSpec)
+} else {
+    Join-Path $env:SystemRoot 'System32\cmd.exe'
+}
+if (-not (Test-Path -LiteralPath $CmdExe -PathType Leaf)) { throw "cmd.exe not found: $CmdExe" }
+
+$Launcher = Join-Path $Native 'deadbyte-contain.cpp'
+$Probe = Join-Path $Native 'containment-probe.cpp'
+$BootstrapKernel = Join-Path $Native 'bootstrap-kernel32.cpp'
+$BootstrapAdvapi = Join-Path $Native 'bootstrap-advapi32.cpp'
+$StageLauncher = Join-Path $Native 'appcontainer-stage.cpp'
+$BootstrapExit = Join-Path $Native 'bootstrap-exitcode.cpp'
+$ChildControlStage = Join-Path $Native 'child-control-stage.cpp'
+$ChildControlProbe = Join-Path $Native 'child-control-probe.cpp'
+$ContainedLauncher = Join-Path $Native 'deadbyte-exec.cpp'
+$ContainedWorker = Join-Path $Native 'contained-transform-worker.cpp'
+$ContainedReverseWorker = Join-Path $Native 'contained-reverse-worker.cpp'
+$TunnelHost = Join-Path $Native 'deadbyte-tunnel-host.cpp'
+$ProcessHost = Join-Path $Native 'deadbyte-process-host.cpp'
+$LauncherExe = Join-Path $Bin 'deadbyte-contain.exe'
+$ProbeExe = Join-Path $Bin 'containment-probe.exe'
+$BootstrapKernelExe = Join-Path $Bin 'bootstrap-kernel32.exe'
+$BootstrapAdvapiExe = Join-Path $Bin 'bootstrap-advapi32.exe'
+$StageLauncherExe = Join-Path $Bin 'appcontainer-stage.exe'
+$BootstrapExitExe = Join-Path $Bin 'bootstrap-exitcode.exe'
+$ChildControlStageExe = Join-Path $Bin 'child-control-stage.exe'
+$ChildControlProbeExe = Join-Path $Bin 'child-control-probe.exe'
+$ContainedLauncherExe = Join-Path $Bin 'deadbyte-exec.exe'
+$ContainedWorkerExe = Join-Path $Bin 'contained-transform-worker.exe'
+$ContainedReverseWorkerExe = Join-Path $Bin 'contained-reverse-worker.exe'
+$TunnelHostExe = Join-Path $Bin 'deadbyte-tunnel-host.exe'
+$ProcessHostExe = Join-Path $Bin 'deadbyte-process-host.exe'
+$WorkerRegistryManifest = Join-Path $Bin 'WORKER-REGISTRY.txt'
+$LauncherObj = Join-Path $Bin 'deadbyte-contain.obj'
+$ProbeObj = Join-Path $Bin 'containment-probe.obj'
+$BootstrapKernelObj = Join-Path $Bin 'bootstrap-kernel32.obj'
+$BootstrapAdvapiObj = Join-Path $Bin 'bootstrap-advapi32.obj'
+$StageLauncherObj = Join-Path $Bin 'appcontainer-stage.obj'
+$BootstrapExitObj = Join-Path $Bin 'bootstrap-exitcode.obj'
+$ChildControlStageObj = Join-Path $Bin 'child-control-stage.obj'
+$ChildControlProbeObj = Join-Path $Bin 'child-control-probe.obj'
+$ContainedLauncherObj = Join-Path $Bin 'deadbyte-exec.obj'
+$ContainedWorkerObj = Join-Path $Bin 'contained-transform-worker.obj'
+$ContainedReverseWorkerObj = Join-Path $Bin 'contained-reverse-worker.obj'
+$TunnelHostObj = Join-Path $Bin 'deadbyte-tunnel-host.obj'
+$ProcessHostObj = Join-Path $Bin 'deadbyte-process-host.obj'
+
+Remove-Item -Force -ErrorAction SilentlyContinue $WorkerRegistryManifest, $LauncherExe, $ProbeExe, $BootstrapKernelExe, $BootstrapAdvapiExe, $StageLauncherExe, $BootstrapExitExe, $ChildControlStageExe, $ChildControlProbeExe, $ContainedLauncherExe, $ContainedWorkerExe, $ContainedReverseWorkerExe, $TunnelHostExe, $ProcessHostExe, $LauncherObj, $ProbeObj, $BootstrapKernelObj, $BootstrapAdvapiObj, $StageLauncherObj, $BootstrapExitObj, $ChildControlStageObj, $ChildControlProbeObj, $ContainedLauncherObj, $ContainedWorkerObj, $ContainedReverseWorkerObj, $TunnelHostObj, $ProcessHostObj, $BuildLog
+
+$Common = '/nologo /std:c++17 /permissive- /W4 /WX /O2 /EHsc /guard:cf /diagnostics:caret /FC /utf-8 /DUNICODE /D_UNICODE /D_WIN32_WINNT=0x0A00 /DWINVER=0x0A00'
+$BootstrapCommon = '/nologo /std:c++17 /permissive- /W4 /WX /O2 /GS- /GR- /Zl /diagnostics:caret /FC /utf-8 /DUNICODE /D_UNICODE /D_WIN32_WINNT=0x0A00 /DWINVER=0x0A00'
+
+function Invoke-MsvcStage {
+    param(
+        [Parameter(Mandatory=$true)][string]$Name,
+        [Parameter(Mandatory=$true)][string]$Command
+    )
+
+    $StageHeader = "==== $Name ===="
+    Write-Host $StageHeader
+    Add-Content -LiteralPath $BuildLog -Value $StageHeader -Encoding UTF8
+
+    # Windows PowerShell 5.1 has no PowerShell pipeline-chain && operator.
+    # Keep cmd.exe's && inside a single-quoted format string so the PowerShell
+    # parser never has to interpret nested backtick-escaped quotes.
+    $Cmd = 'call "{0}" -no_logo -arch=x64 -host_arch=x64 && {1}' -f $VsDevCmd, $Command
+    $Lines = & $CmdExe /d /s /c $Cmd 2>&1
+    $Exit = $LASTEXITCODE
+
+    foreach ($Line in $Lines) {
+        $Text = [string]$Line
+        Write-Host $Text
+        Add-Content -LiteralPath $BuildLog -Value $Text -Encoding UTF8
+    }
+    Add-Content -LiteralPath $BuildLog -Value "exit_code=$Exit" -Encoding UTF8
+
+    if ($Exit -ne 0) {
+        throw "MSVC stage '$Name' failed with exit code $Exit. Full diagnostics: $BuildLog"
+    }
+}
+
+$LauncherCommand = 'cl {0} "{1}" /Fo:"{2}" /Fe:"{3}" userenv.lib advapi32.lib Ole32.lib' -f $Common, $Launcher, $LauncherObj, $LauncherExe
+$ProbeCommand = 'cl {0} /MT "{1}" /Fo:"{2}" /Fe:"{3}" advapi32.lib' -f $Common, $Probe, $ProbeObj, $ProbeExe
+$BootstrapKernelCommand = 'cl {0} "{1}" /Fo:"{2}" /Fe:"{3}" /link /entry:BootstrapEntry /subsystem:console /nodefaultlib kernel32.lib' -f $BootstrapCommon, $BootstrapKernel, $BootstrapKernelObj, $BootstrapKernelExe
+$BootstrapAdvapiCommand = 'cl {0} "{1}" /Fo:"{2}" /Fe:"{3}" /link /entry:BootstrapEntry /subsystem:console /nodefaultlib kernel32.lib advapi32.lib' -f $BootstrapCommon, $BootstrapAdvapi, $BootstrapAdvapiObj, $BootstrapAdvapiExe
+$StageLauncherCommand = 'cl {0} "{1}" /Fo:"{2}" /Fe:"{3}" userenv.lib advapi32.lib Ole32.lib' -f $Common, $StageLauncher, $StageLauncherObj, $StageLauncherExe
+$BootstrapExitCommand = 'cl {0} "{1}" /Fo:"{2}" /Fe:"{3}" /link /entry:BootstrapExitEntry /subsystem:console /nodefaultlib kernel32.lib' -f $BootstrapCommon, $BootstrapExit, $BootstrapExitObj, $BootstrapExitExe
+$ChildControlStageCommand = 'cl {0} /MT "{1}" /Fo:"{2}" /Fe:"{3}" userenv.lib advapi32.lib Ole32.lib' -f $Common, $ChildControlStage, $ChildControlStageObj, $ChildControlStageExe
+$ChildControlProbeCommand = 'cl {0} /MT "{1}" /Fo:"{2}" /Fe:"{3}"' -f $Common, $ChildControlProbe, $ChildControlProbeObj, $ChildControlProbeExe
+$ContainedLauncherCommand = 'cl {0} /MT "{1}" /Fo:"{2}" /Fe:"{3}" userenv.lib advapi32.lib Ole32.lib bcrypt.lib Ws2_32.lib' -f $Common, $ContainedLauncher, $ContainedLauncherObj, $ContainedLauncherExe
+$ContainedWorkerCommand = 'cl {0} /MT "{1}" /Fo:"{2}" /Fe:"{3}" advapi32.lib Ws2_32.lib' -f $Common, $ContainedWorker, $ContainedWorkerObj, $ContainedWorkerExe
+$ContainedReverseWorkerCommand = 'cl {0} /MT "{1}" /Fo:"{2}" /Fe:"{3}" advapi32.lib Ws2_32.lib' -f $Common, $ContainedReverseWorker, $ContainedReverseWorkerObj, $ContainedReverseWorkerExe
+$TunnelHostCommand = 'cl {0} /MT "{1}" /Fo:"{2}" /Fe:"{3}"' -f $Common, $TunnelHost, $TunnelHostObj, $TunnelHostExe
+$ProcessHostCommand = 'cl {0} /MT "{1}" /Fo:"{2}" /Fe:"{3}"' -f $Common, $ProcessHost, $ProcessHostObj, $ProcessHostExe
+
+Invoke-MsvcStage -Name 'launcher' -Command $LauncherCommand
+Invoke-MsvcStage -Name 'probe' -Command $ProbeCommand
+Invoke-MsvcStage -Name 'bootstrap-kernel32' -Command $BootstrapKernelCommand
+Invoke-MsvcStage -Name 'bootstrap-advapi32' -Command $BootstrapAdvapiCommand
+Invoke-MsvcStage -Name 'construction-launcher' -Command $StageLauncherCommand
+Invoke-MsvcStage -Name 'bootstrap-exitcode' -Command $BootstrapExitCommand
+Invoke-MsvcStage -Name 'child-control-launcher' -Command $ChildControlStageCommand
+Invoke-MsvcStage -Name 'child-control-probe' -Command $ChildControlProbeCommand
+Invoke-MsvcStage -Name 'contained-launcher' -Command $ContainedLauncherCommand
+Invoke-MsvcStage -Name 'contained-worker' -Command $ContainedWorkerCommand
+Invoke-MsvcStage -Name 'contained-reverse-worker' -Command $ContainedReverseWorkerCommand
+Invoke-MsvcStage -Name 'named-tunnel-host' -Command $TunnelHostCommand
+Invoke-MsvcStage -Name 'process-host' -Command $ProcessHostCommand
+
+# LPAC bootstrap contract: the probe must not depend on the dynamic MSVC/UCRT
+# DLLs. LPAC intentionally opts out of ALL_APPLICATION_PACKAGES, so avoid
+# adding broad capabilities merely to make the runtime loader happy.
+$AuditHeader = "==== probe-dependencies ===="
+Write-Host $AuditHeader
+Add-Content -LiteralPath $BuildLog -Value $AuditHeader -Encoding UTF8
+$AuditCmd = 'call "{0}" -no_logo -arch=x64 -host_arch=x64 && dumpbin /nologo /dependents "{1}"' -f $VsDevCmd, $ProbeExe
+$DependencyLines = & $CmdExe /d /s /c $AuditCmd 2>&1
+$AuditExit = $LASTEXITCODE
+$DependencyText = (($DependencyLines | ForEach-Object { [string]$_ }) -join "`n")
+foreach ($Line in $DependencyLines) {
+    $Text = [string]$Line
+    Write-Host $Text
+    Add-Content -LiteralPath $BuildLog -Value $Text -Encoding UTF8
+}
+Add-Content -LiteralPath $BuildLog -Value "exit_code=$AuditExit" -Encoding UTF8
+if ($AuditExit -ne 0) {
+    throw "dumpbin dependency audit failed with exit code $AuditExit. Full diagnostics: $BuildLog"
+}
+$ForbiddenDynamicRuntime = '(?i)\b(?:vcruntime[0-9_]*|msvcp[0-9_]*|ucrtbase)\.dll\b'
+if ($DependencyText -match $ForbiddenDynamicRuntime) {
+    throw "probe unexpectedly depends on dynamic MSVC/UCRT runtime: $($Matches[0]). Full diagnostics: $BuildLog"
+}
+
+function Assert-NoDynamicRuntime {
+    param(
+        [Parameter(Mandatory=$true)][string]$Name,
+        [Parameter(Mandatory=$true)][string]$Executable
+    )
+    $Header = "==== $Name-dependencies ===="
+    Write-Host $Header
+    Add-Content -LiteralPath $BuildLog -Value $Header -Encoding UTF8
+    $Cmd = 'call "{0}" -no_logo -arch=x64 -host_arch=x64 && dumpbin /nologo /dependents "{1}"' -f $VsDevCmd, $Executable
+    $Lines = & $CmdExe /d /s /c $Cmd 2>&1
+    $Exit = $LASTEXITCODE
+    $Text = (($Lines | ForEach-Object { [string]$_ }) -join "`n")
+    foreach ($Line in $Lines) {
+        $Rendered = [string]$Line
+        Write-Host $Rendered
+        Add-Content -LiteralPath $BuildLog -Value $Rendered -Encoding UTF8
+    }
+    Add-Content -LiteralPath $BuildLog -Value "exit_code=$Exit" -Encoding UTF8
+    if ($Exit -ne 0) { throw "$Name dependency audit failed with exit code $Exit. Full diagnostics: $BuildLog" }
+    if ($Text -match $ForbiddenDynamicRuntime) {
+        throw "$Name unexpectedly depends on dynamic MSVC/UCRT runtime: $($Matches[0]). Full diagnostics: $BuildLog"
+    }
+}
+
+Assert-NoDynamicRuntime -Name 'contained-launcher' -Executable $ContainedLauncherExe
+Assert-NoDynamicRuntime -Name 'contained-worker' -Executable $ContainedWorkerExe
+Assert-NoDynamicRuntime -Name 'contained-reverse-worker' -Executable $ContainedReverseWorkerExe
+Assert-NoDynamicRuntime -Name 'named-tunnel-host' -Executable $TunnelHostExe
+Assert-NoDynamicRuntime -Name 'process-host' -Executable $ProcessHostExe
+
+if (-not (Test-Path -LiteralPath $LauncherExe)) { throw "launcher executable missing after successful compile: $LauncherExe" }
+if (-not (Test-Path -LiteralPath $ProbeExe)) { throw "probe executable missing after successful compile: $ProbeExe" }
+if (-not (Test-Path -LiteralPath $BootstrapKernelExe)) { throw "kernel bootstrap executable missing after successful compile: $BootstrapKernelExe" }
+if (-not (Test-Path -LiteralPath $BootstrapAdvapiExe)) { throw "advapi bootstrap executable missing after successful compile: $BootstrapAdvapiExe" }
+if (-not (Test-Path -LiteralPath $StageLauncherExe)) { throw "construction launcher executable missing after successful compile: $StageLauncherExe" }
+if (-not (Test-Path -LiteralPath $BootstrapExitExe)) { throw "exit-code bootstrap executable missing after successful compile: $BootstrapExitExe" }
+if (-not (Test-Path -LiteralPath $ChildControlStageExe)) { throw "child-control launcher executable missing after successful compile: $ChildControlStageExe" }
+if (-not (Test-Path -LiteralPath $ChildControlProbeExe)) { throw "child-control probe executable missing after successful compile: $ChildControlProbeExe" }
+if (-not (Test-Path -LiteralPath $ContainedLauncherExe)) { throw "contained launcher executable missing after successful compile: $ContainedLauncherExe" }
+if (-not (Test-Path -LiteralPath $ContainedWorkerExe)) { throw "contained worker executable missing after successful compile: $ContainedWorkerExe" }
+if (-not (Test-Path -LiteralPath $ContainedReverseWorkerExe)) { throw "contained reverse worker executable missing after successful compile: $ContainedReverseWorkerExe" }
+if (-not (Test-Path -LiteralPath $TunnelHostExe)) { throw "named tunnel host executable missing after successful compile: $TunnelHostExe" }
+if (-not (Test-Path -LiteralPath $ProcessHostExe)) { throw "process host executable missing after successful compile: $ProcessHostExe" }
+
+$LauncherHash = (Get-FileHash -LiteralPath $LauncherExe -Algorithm SHA256).Hash.ToLowerInvariant()
+$ProbeHash = (Get-FileHash -LiteralPath $ProbeExe -Algorithm SHA256).Hash.ToLowerInvariant()
+$BootstrapKernelHash = (Get-FileHash -LiteralPath $BootstrapKernelExe -Algorithm SHA256).Hash.ToLowerInvariant()
+$BootstrapAdvapiHash = (Get-FileHash -LiteralPath $BootstrapAdvapiExe -Algorithm SHA256).Hash.ToLowerInvariant()
+$StageLauncherHash = (Get-FileHash -LiteralPath $StageLauncherExe -Algorithm SHA256).Hash.ToLowerInvariant()
+$BootstrapExitHash = (Get-FileHash -LiteralPath $BootstrapExitExe -Algorithm SHA256).Hash.ToLowerInvariant()
+$ChildControlStageHash = (Get-FileHash -LiteralPath $ChildControlStageExe -Algorithm SHA256).Hash.ToLowerInvariant()
+$ChildControlProbeHash = (Get-FileHash -LiteralPath $ChildControlProbeExe -Algorithm SHA256).Hash.ToLowerInvariant()
+$ContainedLauncherHash = (Get-FileHash -LiteralPath $ContainedLauncherExe -Algorithm SHA256).Hash.ToLowerInvariant()
+$ContainedWorkerHash = (Get-FileHash -LiteralPath $ContainedWorkerExe -Algorithm SHA256).Hash.ToLowerInvariant()
+$ContainedReverseWorkerHash = (Get-FileHash -LiteralPath $ContainedReverseWorkerExe -Algorithm SHA256).Hash.ToLowerInvariant()
+$TunnelHostHash = (Get-FileHash -LiteralPath $TunnelHostExe -Algorithm SHA256).Hash.ToLowerInvariant()
+$ProcessHostHash = (Get-FileHash -LiteralPath $ProcessHostExe -Algorithm SHA256).Hash.ToLowerInvariant()
+
+$WorkerRegistryLines = @(
+    'schema=deadbyte.worker-registry.v1',
+    'version=0.6.0',
+    'policy=compile-time-operation-to-executable',
+    'launcher.executable=deadbyte-exec.exe',
+    "launcher.sha256=$ContainedLauncherHash",
+    'operation.lowercase_ascii=contained-transform-v1',
+    'operation.reverse_bytes=contained-reverse-v1',
+    'operation.uppercase_ascii=contained-transform-v1',
+    'worker.contained-reverse-v1.executable=contained-reverse-worker.exe',
+    "worker.contained-reverse-v1.sha256=$ContainedReverseWorkerHash",
+    'worker.contained-transform-v1.executable=contained-transform-worker.exe',
+    "worker.contained-transform-v1.sha256=$ContainedWorkerHash"
+)
+$Utf8NoBom = New-Object System.Text.UTF8Encoding($false)
+[System.IO.File]::WriteAllText($WorkerRegistryManifest, (($WorkerRegistryLines -join "`n") + "`n"), $Utf8NoBom)
+$WorkerRegistryManifestHash = (Get-FileHash -LiteralPath $WorkerRegistryManifest -Algorithm SHA256).Hash.ToLowerInvariant()
+
+[ordered]@{
+    status = 'built'
+    compiler = 'msvc-x64'
+    target = 'windows-10-or-newer'
+    diagnostics = $BuildLog
+    launcher = $LauncherExe
+    launcher_sha256 = $LauncherHash
+    probe = $ProbeExe
+    probe_sha256 = $ProbeHash
+    probe_runtime = 'static-crt'
+    probe_dynamic_crt_dependencies = @()
+    bootstrap_kernel32 = $BootstrapKernelExe
+    bootstrap_kernel32_sha256 = $BootstrapKernelHash
+    bootstrap_advapi32 = $BootstrapAdvapiExe
+    bootstrap_advapi32_sha256 = $BootstrapAdvapiHash
+    construction_launcher = $StageLauncherExe
+    construction_launcher_sha256 = $StageLauncherHash
+    bootstrap_exitcode = $BootstrapExitExe
+    bootstrap_exitcode_sha256 = $BootstrapExitHash
+    child_control_launcher = $ChildControlStageExe
+    child_control_launcher_sha256 = $ChildControlStageHash
+    child_control_probe = $ChildControlProbeExe
+    child_control_probe_sha256 = $ChildControlProbeHash
+    contained_launcher = $ContainedLauncherExe
+    contained_launcher_sha256 = $ContainedLauncherHash
+    contained_worker = $ContainedWorkerExe
+    contained_worker_sha256 = $ContainedWorkerHash
+    contained_reverse_worker = $ContainedReverseWorkerExe
+    contained_reverse_worker_sha256 = $ContainedReverseWorkerHash
+    named_tunnel_host = $TunnelHostExe
+    named_tunnel_host_sha256 = $TunnelHostHash
+    process_host = $ProcessHostExe
+    process_host_sha256 = $ProcessHostHash
+    worker_registry_manifest = $WorkerRegistryManifest
+    worker_registry_manifest_sha256 = $WorkerRegistryManifestHash
+} | ConvertTo-Json

package/scripts/coding-live-smoke.mjs

@@ -0,0 +1,5 @@
+const n = Number(process.argv[2] ?? '20000');
+if (!Number.isInteger(n) || n < 1 || n > 10000000) process.exit(64);
+let acc = 0;
+for (let i = 0; i < n; i += 1) acc = (acc + i) >>> 0;
+process.stdout.write(`coding-smoke:${acc}\n`);

package/scripts/deferred-slot-operation.mjs

@@ -0,0 +1,84 @@
+import { createHash, createPublicKey, randomBytes } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { mkdir, readFile, realpath, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseActivePointer } from '../src/release-slot.mjs';
+import { runSlotUpdateCli, verifySlotUpdateEnvelope } from '../src/runtime-update.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const RECEIPT_ID=/^r27-[A-Za-z0-9-]+$/;
+const here=path.dirname(fileURLToPath(import.meta.url));
+const packageRoot=path.resolve(here,'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const evidenceRoot=path.join(stateRoot,'evidence','deferred-slot-operations');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const atomicJson=async(file,value)=>{
+  await mkdir(path.dirname(file),{recursive:true});
+  const temp=`${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  await writeFile(temp,`${JSON.stringify(value,null,2)}\n`,{flag:'wx'});
+  await import('node:fs/promises').then(fs=>fs.rename(temp,file));
+};
+function activationArgs(manifestSha){
+  if(!HEX64.test(manifestSha??'')) throw new Error('activate requires one lowercase manifest SHA-256');
+  return ['--stage',packageRoot,'--development-root',packageRoot,'--expected-version','0.8.7',
+    '--expected-manifest',manifestSha,'--process-policy',path.join(packageRoot,'controller','deadbyte-process-policy.json'),
+    '--process-policy-sha256',null,'--enable-machine-fs','--enable-observation'];
+}
+async function rollbackArgs(receiptPath){
+  const resolved=await realpath(path.resolve(receiptPath));
+  const allowed=path.join(stateRoot,'evidence','updates')+path.sep;
+  if(!resolved.startsWith(allowed)||path.basename(resolved).toLowerCase()!=='receipt.json'||!RECEIPT_ID.test(path.basename(path.dirname(resolved)))) {
+    throw new Error('rollback receipt must be one signed activation receipt under the update evidence store');
+  }
+  const envelope=JSON.parse(await readFile(resolved,'utf8'));
+  const publicKey=createPublicKey(await readFile(path.join(stateRoot,'trust','ed25519-public.pem')));
+  if(!verifySlotUpdateEnvelope(envelope,publicKey)||envelope.body?.rollback_performed!==false) throw new Error('rollback activation receipt verification failed');
+  const pointer=parseActivePointer(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+  if(pointer.release_id!==envelope.body?.active_pointer?.release_id||pointer.generation_root!==envelope.body?.active_pointer?.generation_root) {
+    throw new Error('rollback receipt does not identify the active release generation');
+  }
+  return ['--rollback-receipt',resolved];
+}
+async function normalizedArgs(mode,value){
+  if(mode==='activate'){
+    const args=activationArgs(value);
+    args[args.indexOf('--process-policy-sha256')+1]=sha256(await readFile(path.join(packageRoot,'controller','deadbyte-process-policy.json')));
+    return args;
+  }
+  if(mode==='rollback') return rollbackArgs(value);
+  throw new Error("operation must be exactly 'activate' or 'rollback'");
+}
+const rawArgs=process.argv.slice(2);
+const [mode,value,workerFlag,operationIdArg]=rawArgs;
+if(!value||!['activate','rollback'].includes(mode)||!['',undefined,'--worker'].includes(workerFlag)||
+    (workerFlag==='--worker'?rawArgs.length!==4:rawArgs.length!==2)) {
+  throw new Error('usage: deferred-slot-operation.mjs <activate manifest_sha256|rollback activation_receipt>');
+}
+const args=await normalizedArgs(mode,value);
+if(workerFlag==='--worker'){
+  if(!/^[0-9a-f]{32}$/.test(operationIdArg??'')) throw new Error('deferred worker operation id invalid');
+  const statePath=path.join(evidenceRoot,`${operationIdArg}.json`);
+  await new Promise(resolve=>setTimeout(resolve,4000));
+  await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'running',started_at_utc:new Date().toISOString()});
+  try{
+    const result=await runSlotUpdateCli(args,{stateRoot});
+    await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'completed',
+      completed_at_utc:new Date().toISOString(),receipt_path:result.receipt_path,receipt_sha256:result.receipt_sha256,
+      active_release:result.pointer.release_id,generation_root:result.pointer.generation_root});
+  }catch(error){
+    await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationIdArg,mode,state:'failed',
+      completed_at_utc:new Date().toISOString(),error:String(error?.message??error)});
+    process.exitCode=1;
+  }
+}else{
+  const operationId=randomBytes(16).toString('hex');
+  const statePath=path.join(evidenceRoot,`${operationId}.json`);
+  await atomicJson(statePath,{schema:'deadbyte.deferred-slot-operation.v1',operation_id:operationId,mode,state:'scheduled',scheduled_at_utc:new Date().toISOString()});
+  const child=spawn(process.execPath,[fileURLToPath(import.meta.url),mode,value,'--worker',operationId],{
+    cwd:packageRoot,detached:true,stdio:'ignore',windowsHide:true,env:{...process.env,DEADBYTE_STATE_ROOT:stateRoot}
+  });
+  child.unref();
+  console.log(JSON.stringify({status:'scheduled',operation_id:operationId,mode,state_path:statePath,execution_provider:'deadbyte_mcp',rdc_operation_count:0}));
+}

package/scripts/final-closure-verify.mjs

@@ -0,0 +1,159 @@
+import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
+import { lstat, readFile, readdir } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const UPDATE_DOMAIN=Buffer.from('DEADBYTE-R27-SLOT-UPDATE-V1\0','utf8');
+const CLOSURE_DOMAIN=Buffer.from('DEADBYTE-R33-FINAL-CLOSURE-V1\0','utf8');
+const PING_DOMAIN=Buffer.from('DEADBYTE-MACHINE-PING-V1\0','utf8');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+  ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
+const canonicalJson=value=>JSON.stringify(canonical(value));
+const same=(a,b)=>canonicalJson(a)===canonicalJson(b);
+function insist(ok,msg){ if(!ok) throw new Error(msg); }
+
+function parseManifest(text){
+  const out=new Map();
+  for(const [i,line] of text.split(/\r?\n/).entries()){
+    if(!line) continue;
+    const m=/^([0-9a-f]{64})  ([^\0]+)$/.exec(line); insist(m,`manifest line ${i+1} malformed`);
+    insist(!path.posix.isAbsolute(m[2])&&!m[2].split('/').includes('..')&&!out.has(m[2]),`unsafe/duplicate manifest path ${m[2]}`);
+    out.set(m[2],m[1]);
+  }
+  return out;
+}
+async function walk(root,rel=''){
+  const dir=path.join(root,...(rel?rel.split('/'):[]));
+  const names=(await readdir(dir)).sort((a,b)=>a.localeCompare(b,'en'));
+  const files=[];
+  for(const name of names){
+    const childRel=rel?`${rel}/${name}`:name;
+    const full=path.join(root,...childRel.split('/'));
+    const st=await lstat(full); insist(!st.isSymbolicLink(),`symlink forbidden: ${childRel}`);
+    if(st.isDirectory()) files.push(...await walk(root,childRel));
+    else { insist(st.isFile(),`non-file forbidden: ${childRel}`); files.push(childRel); }
+  }
+  return files;
+}
+async function verifyTree(root,manifestName,expectedDigest){
+  const manifestBytes=await readFile(path.join(root,manifestName));
+  insist(sha256(manifestBytes)===expectedDigest,`${manifestName} digest mismatch`);
+  const entries=parseManifest(manifestBytes.toString('utf8'));
+  const actual=(await walk(root)).filter(rel=>rel!==manifestName).sort((a,b)=>a.localeCompare(b,'en'));
+  const expected=[...entries.keys()].sort((a,b)=>a.localeCompare(b,'en'));
+  insist(same(actual,expected),`${manifestName} exact tree mismatch`);
+  for(const [rel,digest] of entries){
+    insist(sha256(await readFile(path.join(root,...rel.split('/'))))===digest,`${manifestName} file hash mismatch: ${rel}`);
+  }
+  return entries.size;
+}
+function publicKeyInfo(publicPem){
+  const key=createPublicKey(publicPem); insist(key.asymmetricKeyType==='ed25519','public key must be Ed25519');
+  const der=Buffer.from(key.export({type:'spki',format:'der'}));
+  return {key,key_id:sha256(der),spki_base64:der.toString('base64')};
+}
+function verifyUpdateEnvelope(env,keyInfo){
+  insist(env?.body&&env?.attestation,'update envelope malformed');
+  const bodyBytes=Buffer.from(canonicalJson(env.body),'utf8');
+  insist(sha256(bodyBytes)===env.body_sha256,'update body hash mismatch');
+  const {receipt_sha256,...unsigned}=env;
+  insist(sha256(Buffer.from(canonicalJson(unsigned),'utf8'))===receipt_sha256,'update receipt hash mismatch');
+  insist(env.attestation.algorithm==='ed25519'&&env.attestation.domain==='DEADBYTE-R27-SLOT-UPDATE-V1','update attestation contract mismatch');
+  insist(env.attestation.key_id===keyInfo.key_id,'update signer mismatch');
+  insist(cryptoVerify(null,Buffer.concat([UPDATE_DOMAIN,bodyBytes]),keyInfo.key,Buffer.from(env.attestation.signature_base64,'base64')),'update signature invalid');
+  return true;
+}
+function verifyPing(ping,status,pointer){
+  insist(ping?.status==='ok'&&ping.schema==='deadbyte.machine-ping.v1','machine ping malformed');
+  insist(status?.status==='ok'&&typeof status.public_key_spki_base64==='string','machine status malformed');
+  const der=Buffer.from(status.public_key_spki_base64,'base64');
+  insist(der.toString('base64')===status.public_key_spki_base64,'machine SPKI base64 non-canonical');
+  const machineKey=createPublicKey({key:der,format:'der',type:'spki'});
+  insist(machineKey.asymmetricKeyType==='ed25519','machine key must be Ed25519');
+  const machineId=sha256(der);
+  insist(status.machine_id===machineId&&ping.machine_id===machineId&&ping.attestation?.key_id===machineId,'machine id/key mismatch');
+  insist(ping.release_id===pointer.release_id&&ping.release_manifest_sha256===pointer.manifest_sha256,'machine ping release binding mismatch');
+  insist(ping.generation_manifest_sha256===pointer.generation_manifest_sha256,'machine ping generation binding mismatch');
+  const {status:_s,attestation:_a,...body}=ping;
+  const bytes=Buffer.from(canonicalJson(body),'utf8');
+  insist(cryptoVerify(null,Buffer.concat([PING_DOMAIN,bytes]),machineKey,Buffer.from(ping.attestation.signature_base64,'base64')),'machine ping signature invalid');
+}
+
+export async function verifyFinalClosureObject(envelope,{stateRoot=path.join(os.homedir(),'.deadbyte-mcp')}={}){
+  insist(envelope?.body?.schema==='deadbyte.r33-final-closure.v1','closure schema mismatch');
+  insist(envelope.body.version==='0.8.7','closure version mismatch');
+  insist(envelope.body.release_label==='R33 FINAL MACHINE BASELINE','closure release label mismatch');
+  const keyInfo=publicKeyInfo(await readFile(path.join(stateRoot,'trust','ed25519-public.pem')));
+  const bodyBytes=Buffer.from(canonicalJson(envelope.body),'utf8');
+  insist(sha256(bodyBytes)===envelope.body_sha256,'closure body hash mismatch');
+  const {closure_sha256,...unsigned}=envelope;
+  insist(sha256(Buffer.from(canonicalJson(unsigned),'utf8'))===closure_sha256,'closure envelope hash mismatch');
+  insist(envelope.attestation?.algorithm==='ed25519'&&envelope.attestation?.domain==='DEADBYTE-R33-FINAL-CLOSURE-V1','closure attestation contract mismatch');
+  insist(envelope.attestation.key_id===keyInfo.key_id,'closure signer mismatch');
+  insist(cryptoVerify(null,Buffer.concat([CLOSURE_DOMAIN,bodyBytes]),keyInfo.key,Buffer.from(envelope.attestation.signature_base64,'base64')),'closure signature invalid');
+
+  const pointer=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+  insist(same(pointer,envelope.body.active_pointer),'active pointer drift');
+  insist(pointer.version==='0.8.7','active pointer version mismatch');
+  insist(pointer.release_id===`v${pointer.version}-${pointer.manifest_sha256.slice(0,16)}`,'release id/content address mismatch');
+  const releaseFiles=await verifyTree(pointer.release_root,'MANIFEST.SHA256',pointer.manifest_sha256);
+  const generationFiles=await verifyTree(pointer.generation_root,'GENERATION.SHA256',pointer.generation_manifest_sha256);
+  insist(sha256(await readFile(path.join(stateRoot,'bin','DEADBYTE-MCP.ps1')))===pointer.launcher_sha256,'launcher hash mismatch');
+  const evidence=envelope.body.evidence;
+  insist(evidence&&evidence.parity&&evidence.activation&&evidence.rollback&&evidence.restore&&evidence.windows_gate,'closure evidence set incomplete');
+  for(const [name,item] of Object.entries(evidence)){
+    if(!item?.path||!HEX64.test(item.sha256??'')) continue;
+    insist(sha256(await readFile(item.path))===item.sha256,`${name} evidence hash mismatch`);
+  }
+  const parity=JSON.parse(await readFile(evidence.parity.path,'utf8'));
+  insist(parity.schema==='deadbyte.r33-parity.v1'&&parity.status==='passed','parity evidence invalid');
+  insist(parity.release_id===pointer.release_id&&parity.manifest_sha256===pointer.manifest_sha256,'parity release binding mismatch');
+  insist(parity.rdc_operation_count===0&&parity.execution_provider==='deadbyte_mcp','parity execution provider mismatch');
+  insist(parity.successor_disarmed?.tool_count===68&&parity.successor_disarmed?.coding_armed===false&&parity.successor_disarmed?.autonomous_armed===false,'final public disarmed gate invalid');
+  for(const key of ['tree_read','precondition_mutation','search','owned_process','observation','coding_loop','autonomy','interrupted_recovery','evidence_verification']) insist(parity.requirements?.[key]===true,`parity requirement missing ${key}`);
+
+  const activation=JSON.parse(await readFile(evidence.activation.path,'utf8'));
+  const rollback=JSON.parse(await readFile(evidence.rollback.path,'utf8'));
+  const restore=JSON.parse(await readFile(evidence.restore.path,'utf8'));
+  verifyUpdateEnvelope(activation,keyInfo); verifyUpdateEnvelope(rollback,keyInfo); verifyUpdateEnvelope(restore,keyInfo);
+  insist(activation.body.schema==='deadbyte.r27-slot-update-receipt.v1'&&activation.body.rollback_performed===false,'activation receipt invalid');
+  insist(rollback.body.schema==='deadbyte.r31-slot-rollback-receipt.v1'&&rollback.body.rollback_performed===true,'rollback receipt invalid');
+  insist(restore.body.schema==='deadbyte.r27-slot-update-receipt.v1'&&restore.body.rollback_performed===false,'restore receipt invalid');
+  insist(activation.body.active_pointer?.manifest_sha256===pointer.manifest_sha256,'activation candidate mismatch');
+  insist(rollback.body.from_pointer?.manifest_sha256===pointer.manifest_sha256,'rollback source mismatch');
+  insist(restore.body.active_pointer?.manifest_sha256===pointer.manifest_sha256&&same(restore.body.active_pointer,pointer),'restore/current pointer mismatch');
+  insist(rollback.body.activation_receipt_sha256===activation.receipt_sha256,'rollback not bound to activation');
+  const windowsGate=JSON.parse(await readFile(evidence.windows_gate.path,'utf8'));
+  insist(windowsGate.schema==='deadbyte.r33-windows-gate.v1'&&windowsGate.status==='passed'&&windowsGate.exit_code===0,'Windows gate evidence invalid');
+  insist(windowsGate.manifest_sha256===pointer.manifest_sha256,'Windows gate manifest binding mismatch');
+  insist(windowsGate.marker==='DEADBYTE V0.8.7 / R33 WINDOWS BATCH GATE: PASS','Windows gate PASS marker mismatch');
+
+  const machine=envelope.body.machine;
+  insist(machine?.status?.release_id===pointer.release_id&&machine.status.generation_manifest_sha256===pointer.generation_manifest_sha256,'machine status binding mismatch');
+  verifyPing(machine.ping,machine.status,pointer);
+  insist(machine.ping.nonce===machine.nonce,'machine ping nonce binding mismatch');
+
+  const grantNames=['process-grant.json','coding-grant.json','autonomous-grant.json','host-grant.json'];
+  insist(envelope.body.authority?.all_disarmed===true,'closure authority not disarmed');
+  for(const name of grantNames){
+    let exists=true; try { await lstat(path.join(stateRoot,'runtime',name)); } catch(error){ if(error?.code==='ENOENT') exists=false; else throw error; }
+    insist(!exists,`authority grant still present: ${name}`);
+    insist(envelope.body.authority.grants_absent?.[name]===true,`closure grant absence not recorded: ${name}`);
+  }
+  return {ok:true,status:'passed',release_id:pointer.release_id,manifest_sha256:pointer.manifest_sha256,
+    generation_manifest_sha256:pointer.generation_manifest_sha256,release_files:releaseFiles,generation_files:generationFiles,
+    machine_id:machine.status.machine_id,parity_sha256:evidence.parity.sha256,closure_sha256:envelope.closure_sha256};
+}
+
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked){
+  const file=process.argv[2];
+  if(!file) throw new Error('usage: node scripts/final-closure-verify.mjs <closure.json>');
+  try {
+    const envelope=JSON.parse(await readFile(path.resolve(file),'utf8'));
+    console.log(JSON.stringify(await verifyFinalClosureObject(envelope),null,2));
+  } catch(error){ console.error(error instanceof Error?error.stack:String(error)); process.exitCode=1; }
+}