deadbyte-mcp 0.15.32 → 0.15.33

package/MANIFEST.SHA256

@@ -49,7 +49,7 @@ ad9821d027ac70612820617ed3c197d465c98e42a9e2a5bbb40f571fb2314894  controller/dea
 8c70a873fd77e5b1579512ec218220182c2bddba63dc50c56ec70a7b449c52d9  controller/deadbyte-desktop-policy.json
 5e8ef223b0dbc52173aaf044a075837eef8964ff0e7e16f83a595e0d17695625  controller/deadbyte-host-policy.json.example
 6f0cc469f51444dd18211fa3346c826abeea4d2ec7a8945f0200dc5c622031ef  controller/DEADBYTE-MCP.cmd
-e6899562e44cc791e056b4bf2c3f1ebfef24cf211ad3251e0665b36d42450d18  controller/deadbyte-process-policy.json
+cd499f8a4fc00663f9943e7b021e63a967fee77c152438ec3db0b628c77275b6  controller/deadbyte-process-policy.json
 d274b099a298c1033fea8f1e8849751693bbc0448778d619400acb82d4f53a3b  controller/deadbyte-semantic-lsp-config.json
 3023d2985f5b6e5cc7c0d08cb8b342b362c93dce7ebd4224635362194be40cf2  controller/README.TXT
 101e613518c73c6aa31c725fe1b5f9a24c995dc9876b7b28e1f3e97ac9f8d362  DEADBYTE-MCP-R27-FINAL/R27-ADMIN-CLOSURE.json
@@ -1343,7 +1343,7 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-f1254116d524eba721c198f8b2aa7c14c1e824820d1644bc1b3b13e811d8e4d7  package.json
+566fc8a38e7558b511369c3f8f6828735dd7382ed28ec48d3262d95de591ea76  package.json
 872947dffd89755b03558b217129f009dc9f4fd1ce55e93c602fc6ea97ba8b48  proof/commander-closure-20260927/CONTINUATION.json
 2959980d295814aaa0df71fdb358d2cbfd01c1357ee36ef6b10c149875bdb262  proof/commander-closure-20260927/RESULT.json
 2c2866309ca3a6fc8de5b03d445f1dcf0778474fa25cefb822b2ab729bc91c62  proof/commander-closure-20260927/SEARCH-CONTINUATION.json
@@ -1408,7 +1408,7 @@ d433aaea5cccd1e184775ac4d915f34e0b39c6c99916dddd009731ad5fd6443f  proof/V073-WIN
 bd0773a9e02e8ab11475c9cc5a7db29a8313233b7eab7f837922737e75ec5938  proof/VERIFY.txt
 2c821808d4596965c577f40191daee224d3aea81989778c4af97f53a83b487db  proof/WINDOWS-CONTAINED-STATUS.txt
 f8bc839c7b4fcb0ea7b7e7ad9448847c3beae6f95f2eb4d407d1b284aaa4ff68  proof/WINDOWS-CONTAINMENT-STATUS.txt
-d794997857413a8ce6358be6f7bc16076430c1783b35fd6ab793e073db1662bc  PROVENANCE.json
+ad94ad04d0ae744e6528b43e0dcaf8ffc27ebe81326ffc2f2704a195c61a1d45  PROVENANCE.json
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
 0b7ec5ee347ddfa6cca59740fc7a8fe3fc5d51406265bb12189e82fa106319d2  R41-PARENT.json
 bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.json
@@ -1417,9 +1417,9 @@ f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.jso
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
 3dc607603fea511e2f428e9546a875ab7e38b6a0bbd5e803e4510de082f30804  R49-PARENT.json
-0bdb79693ddcaf0ea1bcea699ac7c6054e48ce8bbb1dea2afd9a5360a1f45d2b  README.txt
-9a7063641da98ffe033770318f42fb9cb00a02da0e37ea1a1a3626dba5f1f7a1  RELEASE.json
-1cafdc845fff4d51b9f5c8565af0705aad1ca9fc7b03885aa0b81d34f329d432  SBOM.cdx.json
+ed5b11e9895e040d8fe09b810e27c6845d6f51ad139a6ab46374e60ae7d081d4  README.txt
+0480675e951e6ebfec7d0074403571d76ddbf75497be9dfa2c7d185d4931143a  RELEASE.json
+a3f04699a6302367d1ac577e532ffd416e324a8a662560018489bb1bd18eb40a  SBOM.cdx.json
 7c86062c4f69db3179a129d65945ccfab1b1c1c5bcc29b91383eac097d50f2aa  scripts/activate-skill-creator-1.1.1.mjs
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
@@ -1517,6 +1517,7 @@ a62d69eea0c9db8778cd1551185ff6721ee6390d91afcb6863aecb75f9f422d1  scripts/gate-w
 2df3dfb98aabef25e25a61035d9f17d644aecb52257047230142783b3ce5a1a3  scripts/gate-windows-r53.ps1
 89f930eb3d3b9d8972d777a327f16bcfebcf12576a6ada48e53f64d1142adb2d  scripts/gate-windows-r54.ps1
 7dddf9b547f59b4b36ab4a7e7576d598ecd3f9e0ec24807608b2c52b0b6e6963  scripts/gate-windows-r55.ps1
+078066f300debe5cbb4a7dc5565a193e78d247e68089da96d220a91ef14b05c9  scripts/gate-windows-r56.ps1
 9a085b34b9e54023eb0efadcea1e74a1bef44b984105d064768d66910999173e  scripts/gate-windows.ps1
 9e625bdc701298c05eb2a63c208d023a487a1baf306c05940eb29c19fb1d6544  scripts/init-desktop-policy-r40.ps1
 01451045bff624a157e7eea79afd7edfa8cb8212ea0256c8ec744fe1e1b269ff  scripts/init-host-policy.ps1
@@ -1610,6 +1611,7 @@ f344639080f68b7da5cda765b518e0fb91bc8818229b6f460e82b173018ad30c  scripts/window
 2eb7373875a9a6b6eab62dfb10136ec0f3525836015c80f097d9ae2714356b68  scripts/windows-gate-evidence-r53.mjs
 127497b8ac8701da6a1211efb9f311aab3a67c4995430588617210d681139cf2  scripts/windows-gate-evidence-r54.mjs
 93021201c4f37191545502a411886eafef8df031675b716c5d7eb4b50d5e30df  scripts/windows-gate-evidence-r55.mjs
+be332ed7cef04abaec8679198e379d7f42fc67e0833be9f42e25103c88cb5b26  scripts/windows-gate-evidence-r56.mjs
 2255b8eb78ca61267df54448560a671357f04893b6bb1df27b8b9fc8a944d255  scripts/windows-gate-evidence.mjs
 105a5c6dcd54e4fabb416df9eaac093654f3ea39c4233a56e0bc6d53371b2128  scripts/workload-contract-regression-r47.mjs
 c32cb9054a1b9641ae071c00622c0054272bdb0b519ea22c4ff926a1600a2b46  scripts/workload-stream-regression.mjs
@@ -1774,7 +1776,7 @@ fafeb0ec6e31762f14de46a5f021582b9a54de8af4c73c3ecc92ac71020cc8b7  src/remote-ses
 45fcd7e9447545785e851fbeec439551c10a85c93f60a19437729870222c697c  src/runtime-catalog-expectation.mjs
 066c97427989298ff3d7db06e40572f4d634269ea7dfd5836575ea98c52d92bc  src/runtime-coherence.mjs
 ce2223bf6075e96cc02505c1439acce18bb1f204c5e86cf9152bb7194daf3cd2  src/runtime-identity.mjs
-10608193e8dfc09209ecf3483e093798dcbd52f7a5eaed273d8f1376a94e7057  src/runtime-update.mjs
+b0050ff8b0d07d99184cb14d6b8866f87ecf927d71645e4410dae89756c8b9cb  src/runtime-update.mjs
 c61335adb38bfc415fe1cdabfe2c0a87e61579dfd1e52cce91c44d6993479457  src/search-cursor.mjs
 fc5407ef8338ebeeede16225b3249166dc4d45e903d873eb46c15c3df07dc9ad  src/semantic-backend-registry.mjs
 686e9b55b9f4352b941579f186a9b9d348d86af53d052cbd5da953e7d15470ff  src/semantic-code.mjs
@@ -1794,12 +1796,12 @@ c99c2402fb0df4f68634fa906eb198c551c55dad9f0921a7b8ed6e33d503884e  src/tunnel-std
 aa765e9a28c69ff58a5b5a0d29b49ea181af4db9076633b102dbca25861e708e  src/tunnel-stdio-compat.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-baf6d13e168890295bc2f9fe667ae4c679289adeb454c5a9644f7738c5bccef9  src/version.mjs
+2afcfc97ef9d39e24563308cb48a22d6bbaacff95b4a7856f2f14a25fb45c9a0  src/version.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs
 1bd637e7634ca0259791c5108fcf324554f70b1db49e5eac3505287c04bbc3be  STABILIZATION-PROGRESS.md
-db7e4ba5fd294f9d4c4ae02a1575c67a3a935374d9a91f9128546db9607f87b7  TEST-MATRIX.json
+7d84b869cc45f61a00daaf97c56ff8f8e919f9893823b37ea98163546828c872  TEST-MATRIX.json
 e4f1fb97545f23772ddff28ad3f9954a4714f9854062fca62e0e12c1cb2ec4ae  test/agent-backend-r44.test.mjs
 2a78c818058b25efdc143a3a97c832da231ccd6ff9d90c7796d681a0251b85c4  test/agent-crash-child.mjs
 d9461ab7c118ee75d37a2d6f5e637d7e43505af6a9ad8c7ddafffc8ace185a5b  test/agent-crash-worker.mjs
@@ -2044,7 +2046,7 @@ eaaf2547cf06fad4c16db72413ea137143c280a9bc641b3230ee2d85a0b65b5a  test/r44-final
 25a21ccffcf566b020b8f3c6c0a5a3b7ff06b243fff84e405207e458640ba487  test/r47-release-contract.test.mjs
 2871a825520cca851a10f65f42a6033c4c17d7446c1930d7a64316a76aacf681  test/r48-release-contract.test.mjs
 ec6fc253774c318b048dc943c83b496f942d8dd034f6db9439a99a46ae3a6158  test/r49-remote-control-donors.test.mjs
-4cd9657cf8b42f8512ab0aee028696abbe0b0aea371e37aa44cc1ac552b9213c  test/r49-windows-gate.test.mjs
+74a1b45b6256aa97a0974c404ac7af26986ba3956760ba204d1e1f2fff4f8d30  test/r49-windows-gate.test.mjs
 c3f0a8b6ced2c15ed8580fcb261ad65bf3b885e6593d70de7394be63aba8dd1c  test/r51-live-log-polling.test.mjs
 3821085180a09707110e4c1a10e711343e9fb2fcf871c7c1e34149a77c7fba50  test/r51-release-contract.test.mjs
 cc1ca8fe9514ca047ace52cd688f3f4fa5b7680a280d7a31cc2196ce915b91c9  test/r51-runtime-coherence.test.mjs
@@ -2055,7 +2057,9 @@ b0a9cca4f2c5dcf1a24d6e7675b42c72e88339b29ddc9220aa679316ae1467f5  test/r53-relea
 04fe09cdd94ae23cff6a9acebb64d5a09391fd5e7f5fc778dd8dd8e10a3dd3e2  test/r54-offline-predecessor-self-exclusion.test.mjs
 4148924e4edc935398e20a763cb27d903095b978898e8140b695b5642b63fe8c  test/r54-release-contract.test.mjs
 4847402324bff518df66c9b7dbd1091bf8c0f5c5547e70c1a042c963b770bd28  test/r55-offline-predecessor-guardian-family.test.mjs
-3e84d0ba66c5ce76b1890e800f0f45deeb43cdd85e7d6015be2e09aafac42dcf  test/r55-release-contract.test.mjs
+b1e6b35cf8a20214e1797cc1051c5e9c733f8d0f69b564b4ef73edc60132b252  test/r55-release-contract.test.mjs
+f193c42af942d34f03f0e916ba7d8c61ed0b6450ad11df87dbddb4c3cf00d6e7  test/r56-release-contract.test.mjs
+74c25d78ddebb04fad40576b284639eabbfb4487b4ec090fb1dcf6874cef878c  test/r56-rollback-launcher-restore.test.mjs
 e45a6cd299d8d65bdeb9bc0117ce1eb2b47fdebad89a02413ee979c9d0ae3a5c  test/release-activation-gate.test.mjs
 85f6dc2059fd19d03452309ffe67bed5b87da8e6f0ce3a85cab58cba8b197ceb  test/release-generation.test.mjs
 bb58887a2c393cd5aac3fa3bb3a04de2704bd2a30dd2083ea638543485fa7e60  test/release-manifest-windows.test.mjs

package/PROVENANCE.json

@@ -1,33 +1,36 @@
 {
   "schema": "deadbyte.provenance.v1",
-  "version": "0.15.32",
-  "builder": "deadbyte-r55-activation-guardian-family-hotfix",
-  "source_model": "exact published 0.15.31 artifact -> production activation failure remained at authority_revoked with one transient DEADBYTE Node blocker -> live foreground topology confirmed remote-session guardian is a sibling owned by the deadbyte-cli ancestor -> parent regression reproduced guardian misclassification -> surgical owner/parent/nonce-bound guardian exclusion -> stale-runtime negative controls -> focused/full regression -> package verification -> registry round-trip -> activation/rollback/restore",
+  "version": "0.15.33",
+  "builder": "deadbyte-r56-signed-rollback-launcher-restore-hotfix",
+  "source_model": "exact published and active 0.15.32 artifact -> signed activation receipt verified -> explicit rollback failed before mutation because predecessor verification compared the successor live launcher to the prior launcher digest -> signed activation handoff confirmed exact predecessor launcher snapshots -> parent regression RED -> surgical split stored-installation verification plus signed predecessor launcher restore before pointer commit plus successor launcher recovery ordering -> focused/full regression -> package verification -> registry round-trip -> activation/rollback/restore",
   "signing": "ed25519",
-  "parent_release_id": "v0.15.31-16854fe5b3eb0fa1",
-  "parent_manifest_sha256": "16854fe5b3eb0fa1c6dd2b96e3c5d6f792c5adbc91dd2a71e7fc2771472bbdd4",
-  "parent_tarball_sha256": "ff6eba3036cb00ac639ac8907ad6063e6ea8169cf32aca8721f75b1e403e501a",
-  "parent_activation_status": "PUBLISHED_NOT_ACTIVATED",
+  "parent_release_id": "v0.15.32-e7223f467777f5df",
+  "parent_manifest_sha256": "e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b",
+  "parent_generation_manifest_sha256": "740443fd207c5e6ffd5952079214bf6e81e9281a6ec880de9bbe3b8ce1deb00e",
+  "parent_tarball_sha256": "c9e1f5875dd2177cee0089305b40321c128c54ce7f5522e34e507d4ecfb22638",
+  "parent_activation_status": "ACTIVATED_ROLLBACK_DEFECT_OBSERVED",
   "runtime_predecessor": {
-    "release_id": "v0.15.29-f74eaa1b3d00e6fb",
-    "manifest_sha256": "f74eaa1b3d00e6fb5a36b2358efb815e3686c9fe9dbd3b84d25a713ef957748c",
-    "generation_manifest_sha256": "289b4fc065de0681da6864cc1bbe09aab198ca804945ffc27c786438dad13f5a"
+    "release_id": "v0.15.32-e7223f467777f5df",
+    "manifest_sha256": "e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b",
+    "generation_manifest_sha256": "740443fd207c5e6ffd5952079214bf6e81e9281a6ec880de9bbe3b8ce1deb00e"
   },
-  "source_predecessor_version": "0.15.31",
-  "source_predecessor_tarball_sha256": "ff6eba3036cb00ac639ac8907ad6063e6ea8169cf32aca8721f75b1e403e501a",
-  "source_predecessor_manifest_file_sha256": "16854fe5b3eb0fa1c6dd2b96e3c5d6f792c5adbc91dd2a71e7fc2771472bbdd4",
-  "r55_hotfix": {
-    "defect": "offline predecessor recovery foreground guardian sibling exclusion defect",
-    "activation_ancestry_excluded": true,
-    "foreground_guardian_owner_parent_binding": true,
-    "foreground_guardian_session_nonce_contract": true,
-    "unrelated_stale_runtime_fail_closed": true,
-    "red_parent_0_15_31": "FAIL_1_OF_4",
-    "green_r55_candidate": "PASS_4_OF_4",
+  "source_predecessor_version": "0.15.32",
+  "source_predecessor_tarball_sha256": "c9e1f5875dd2177cee0089305b40321c128c54ce7f5522e34e507d4ecfb22638",
+  "source_predecessor_manifest_file_sha256": "e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b",
+  "r56_hotfix": {
+    "defect": "explicit rollback verifies predecessor against successor launcher before restoring signed predecessor launcher snapshot",
+    "signed_handoff_launcher_snapshot_required": true,
+    "stored_predecessor_verified_without_live_launcher": true,
+    "predecessor_launcher_restored_before_pointer_commit": true,
+    "successor_launcher_restored_before_recovery_pointer": true,
+    "exact_parent_activation_receipt_sha256": "6518a04154f485cfae42e582269634d69a8b05a0183149d5e10006fbdd9d933c",
+    "observed_parent_rollback_failure_receipt_sha256": "00cbd497e4902c67ab39313a378e2fcf32159113b46339ad1d54b5e5a7714205",
+    "red_parent_0_15_32": "FAIL_5_OF_5",
+    "green_r56_candidate": "PASS_5_OF_5",
     "full_regression": "PASS",
     "stable_final_claim": false
   },
-  "reproducibility": "0.15.31 remains immutable; R55 excludes only the foreground guardian whose declared owner PID is in the updater ancestry, whose actual parent PID equals that owner, and whose session nonce matches the 256-bit session contract; unrelated DEADBYTE runtimes remain fail-closed",
+  "reproducibility": "0.15.32 remains immutable and active while R56 is built. Rollback input remains the signed activation receipt; predecessor launcher bytes are accepted only from the signature-verified sibling handoff whose prior/new pointers match that receipt. The predecessor release/generation are verified independently before shutdown; the signed predecessor launcher snapshot is restored before pointer commit. Recovery reinstalls the signed successor launcher before restoring the successor pointer.",
   "operator_override": {
     "four_hour_soak": "NOT_COMPLETED",
     "reason": "owner explicitly directed deploy before the 4-hour hard soak completed",

package/README.txt

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.15.32 / R55 ACTIVATION GUARDIAN FAMILY HOTFIX
+DEADBYTE MCP V0.15.33 / R56 SIGNED ROLLBACK LAUNCHER RESTORE HOTFIX
 =========================
 
 AUTHENTICATED MACHINE TRUTH + DURABLE AGENT + CODING + AUTONOMOUS PRODUCTION ENGINE
@@ -7,12 +7,12 @@ NPX PRIMARY OPERATOR UX
 ------------------------
 Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
 
-  npx -y deadbyte-mcp@0.15.32 mcp
-  npx -y deadbyte-mcp@0.15.32 remote
-  npx -y deadbyte-mcp@0.15.32 remote status
-  npx -y deadbyte-mcp@0.15.32 remote restart
-  npx -y deadbyte-mcp@0.15.32 audit status
-  npx -y deadbyte-mcp@0.15.32 audit verify
+  npx -y deadbyte-mcp@0.15.33 mcp
+  npx -y deadbyte-mcp@0.15.33 remote
+  npx -y deadbyte-mcp@0.15.33 remote status
+  npx -y deadbyte-mcp@0.15.33 remote restart
+  npx -y deadbyte-mcp@0.15.33 audit status
+  npx -y deadbyte-mcp@0.15.33 audit verify
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.
@@ -29,6 +29,10 @@ and a random 256-bit session nonce, prevents concurrent foreground sessions, and
 recover only a dead, unguarded stale owner. Explicit subcommands such as `remote status` remain
 one-shot controller operations.
 
+R56 SIGNED ROLLBACK LAUNCHER RESTORE HOTFIX
+------------------------------------------------
+0.15.33 fixes the explicit rollback defect observed after the successful 0.15.32 production activation. The prior immutable release and generation are now verified without incorrectly comparing them to the currently active successor launcher. Rollback then loads the signature-verified activation handoff, requires its prior/new pointers to match the signed activation receipt, restores the signed predecessor launcher snapshot before committing the predecessor pointer, and verifies the complete predecessor installation before restart. If rollback recovery is required, the signed successor launcher bytes are reinstalled before the successor pointer is restored. 0.15.32 remains immutable and published.
+
 R55 ACTIVATION GUARDIAN FAMILY HOTFIX
 --------------------------------------
 0.15.32 fixes the remaining 0.15.31 offline-recovery self-classification defect observed during production activation. R54 excluded the detached updater supervisor's ancestor chain but the foreground remote-session guardian is a sibling owned by the deadbyte-cli ancestor. R55 excludes that guardian only when its declared --owner-pid is in the updater ancestry, its actual ParentProcessId equals that owner, and its 256-bit session nonce matches the foreground-session contract. Unrelated guardians and stale DEADBYTE runtimes still block recovery. 0.15.31 remains immutable and published; production runtime predecessor remains exact 0.15.29 until R55 activation completes.
@@ -280,7 +284,7 @@ CONTROLLER
 ----------
 Primary operator entry point:
 
-  npx -y deadbyte-mcp@0.15.32 remote
+  npx -y deadbyte-mcp@0.15.33 remote
 
 The legacy CMD entry remains compatibility-only for R33 rollback safety.
 
@@ -341,7 +345,7 @@ MCP CLIENT CONFIGURATION
 ------------------------
 The local stdio entry point is quiet and suitable for MCP hosts:
 
-  npx -y deadbyte-mcp@0.15.32 mcp
+  npx -y deadbyte-mcp@0.15.33 mcp
 
 CLAUDE DESKTOP
 Use the standard local-server entry in claude_desktop_config.json:
@@ -350,7 +354,7 @@ Use the standard local-server entry in claude_desktop_config.json:
     "mcpServers": {
       "deadbyte": {
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.32", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.33", "mcp"]
       }
     }
   }
@@ -363,7 +367,7 @@ Create .cursor/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.32", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.33", "mcp"]
       }
     }
   }
@@ -376,7 +380,7 @@ Create .vscode/mcp.json:
       "deadbyte": {
         "type": "stdio",
         "command": "npx",
-        "args": ["-y", "deadbyte-mcp@0.15.32", "mcp"]
+        "args": ["-y", "deadbyte-mcp@0.15.33", "mcp"]
       }
     }
   }
@@ -386,9 +390,9 @@ Add this to ~/.codex/config.toml:
 
   [mcp_servers.deadbyte]
   command = "npx"
-  args = ["-y", "deadbyte-mcp@0.15.32", "mcp"]
+  args = ["-y", "deadbyte-mcp@0.15.33", "mcp"]
 
-The remote device path remains `npx -y deadbyte-mcp@0.15.32 remote`. Remote public MCP uses the
+The remote device path remains `npx -y deadbyte-mcp@0.15.33 remote`. Remote public MCP uses the
 verified HTTPS named-tunnel URL selected by the active generation; do not commit a private device
 URL or tunnel token into a repository.
 

package/RELEASE.json

@@ -1,35 +1,38 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.32",
-  "train": "R55",
-  "label": "ACTIVATION GUARDIAN FAMILY HOTFIX",
+  "version": "0.15.33",
+  "train": "R56",
+  "label": "SIGNED ROLLBACK LAUNCHER RESTORE HOTFIX",
   "protocol_revision": "2026-07-28",
   "parent": {
-    "version": "0.15.31",
-    "release_id": "v0.15.31-16854fe5b3eb0fa1",
-    "manifest_sha256": "16854fe5b3eb0fa1c6dd2b96e3c5d6f792c5adbc91dd2a71e7fc2771472bbdd4",
-    "tarball_sha256": "ff6eba3036cb00ac639ac8907ad6063e6ea8169cf32aca8721f75b1e403e501a",
-    "activation_status": "PUBLISHED_NOT_ACTIVATED"
+    "version": "0.15.32",
+    "release_id": "v0.15.32-e7223f467777f5df",
+    "manifest_sha256": "e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b",
+    "generation_manifest_sha256": "740443fd207c5e6ffd5952079214bf6e81e9281a6ec880de9bbe3b8ce1deb00e",
+    "tarball_sha256": "c9e1f5875dd2177cee0089305b40321c128c54ce7f5522e34e507d4ecfb22638",
+    "activation_status": "ACTIVATED_ROLLBACK_DEFECT_OBSERVED"
   },
   "runtime_predecessor": {
-    "release_id": "v0.15.29-f74eaa1b3d00e6fb",
-    "manifest_sha256": "f74eaa1b3d00e6fb5a36b2358efb815e3686c9fe9dbd3b84d25a713ef957748c",
-    "generation_manifest_sha256": "289b4fc065de0681da6864cc1bbe09aab198ca804945ffc27c786438dad13f5a"
+    "release_id": "v0.15.32-e7223f467777f5df",
+    "manifest_sha256": "e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b",
+    "generation_manifest_sha256": "740443fd207c5e6ffd5952079214bf6e81e9281a6ec880de9bbe3b8ce1deb00e"
   },
   "source_predecessor": {
-    "version": "0.15.31",
-    "tarball_sha256": "ff6eba3036cb00ac639ac8907ad6063e6ea8169cf32aca8721f75b1e403e501a",
-    "manifest_file_sha256": "16854fe5b3eb0fa1c6dd2b96e3c5d6f792c5adbc91dd2a71e7fc2771472bbdd4"
+    "version": "0.15.32",
+    "tarball_sha256": "c9e1f5875dd2177cee0089305b40321c128c54ce7f5522e34e507d4ecfb22638",
+    "manifest_file_sha256": "e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b"
   },
   "hotfix": {
-    "defect": "offline predecessor recovery foreground guardian sibling exclusion defect",
-    "activation_ancestry_excluded": true,
-    "foreground_guardian_owner_parent_binding": true,
-    "foreground_guardian_session_nonce_contract": true,
-    "unrelated_stale_runtime_fail_closed": true,
-    "red_parent_0_15_31": "FAIL_1_OF_4",
-    "green_r55_candidate": "PASS_4_OF_4",
+    "defect": "explicit rollback verifies predecessor against successor launcher before restoring signed predecessor launcher snapshot",
+    "signed_handoff_launcher_snapshot_required": true,
+    "stored_predecessor_verified_without_live_launcher": true,
+    "predecessor_launcher_restored_before_pointer_commit": true,
+    "successor_launcher_restored_before_recovery_pointer": true,
+    "exact_parent_activation_receipt_sha256": "6518a04154f485cfae42e582269634d69a8b05a0183149d5e10006fbdd9d933c",
+    "observed_parent_rollback_failure_receipt_sha256": "00cbd497e4902c67ab39313a378e2fcf32159113b46339ad1d54b5e5a7714205",
+    "red_parent_0_15_32": "FAIL_5_OF_5",
+    "green_r56_candidate": "PASS_5_OF_5",
     "full_regression": "PASS",
     "stable_final_claim": false
   },
@@ -138,6 +141,7 @@
     "human_livelog_single_parse": true,
     "offline_predecessor_host_revoke_before_capture": true,
     "offline_recovery_self_process_exclusion": true,
-    "offline_recovery_foreground_guardian_family_exclusion": true
+    "offline_recovery_foreground_guardian_family_exclusion": true,
+    "signed_rollback_launcher_snapshot_restore": true
   }
 }

package/SBOM.cdx.json

@@ -1,13 +1,13 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:cdx:deadbyte-mcp:r55:0.15.32",
+  "serialNumber": "urn:cdx:deadbyte-mcp:r56:0.15.33",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "deadbyte-mcp",
-      "version": "0.15.32"
+      "version": "0.15.33"
     }
   },
   "components": [
@@ -34,7 +34,7 @@
     {
       "type": "file",
       "name": "deadbyte-hardware-observer-r45.exe",
-      "version": "0.15.32",
+      "version": "0.15.33",
       "hashes": [
         {
           "alg": "SHA-256",

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.32",
-  "train": "R55",
+  "version": "0.15.33",
+  "train": "R56",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",
@@ -11,14 +11,14 @@
   },
   "required": [
     {
-      "id": "r55-focused",
-      "command": "npm run r55:focused:test",
-      "expected": "PASS R55 release identity, foreground guardian family exclusion, stale-runtime negative controls, runtime update/coherence"
+      "id": "r56-focused",
+      "command": "npm run r56:focused:test",
+      "expected": "PASS signed rollback handoff launcher restore, ordering, activation recovery regressions, runtime update/slot contracts"
     },
     {
       "id": "full-regression",
       "command": "npm run r48:full:test",
-      "expected": "PASS current R55 successor"
+      "expected": "PASS current R56 successor"
     },
     {
       "id": "package-boundary",
@@ -28,7 +28,7 @@
     {
       "id": "windows-gate",
       "command": "npm run gate:windows",
-      "expected": "PASS R55 focused + full regression + manifest/doctor evidence"
+      "expected": "PASS R56 focused + recorded full regression + manifest/doctor evidence"
     },
     {
       "id": "package-verify",
@@ -37,51 +37,63 @@
     },
     {
       "id": "activation",
-      "command": "npx --yes deadbyte-mcp@0.15.32 remote",
-      "expected": "clean OFFLINE recovery excludes only the bound foreground guardian and activates exact R55 manifest"
+      "command": "npx --yes deadbyte-mcp@0.15.33 remote",
+      "expected": "activate exact R56 from exact active 0.15.32"
     },
     {
-      "id": "machine-truth",
-      "command": "signed machine_ping",
-      "expected": "active release/generation bind exact R55"
+      "id": "rollback",
+      "command": "runtime-update --rollback-receipt <signed R56 activation receipt>",
+      "expected": "restore exact signed 0.15.32 pointer, signed predecessor launcher snapshot, ONLINE runtime, all authority DISARMED"
     },
     {
-      "id": "rollback-restore",
-      "command": "immutable slot rollback/restore",
-      "expected": "0.15.32 -> exact 0.15.29 -> same exact 0.15.32"
+      "id": "restore",
+      "command": "npx --yes deadbyte-mcp@0.15.33 remote",
+      "expected": "restore same exact R56 release/generation and foreground authority contract"
     }
   ],
   "observed_pre_release_evidence": {
-    "red_parent_0_15_31": {
+    "red_parent_0_15_32": {
       "status": "FAIL_EXPECTED",
-      "tests": 4,
-      "failed": 1,
-      "receipt_id": "6ad588e8f12dab44c1888d9d",
-      "receipt_sha256": "07ba973aa9224fbb1dde572af35640a1e07ca47273f1e50958d787bfe2aaf429"
+      "tests": 5,
+      "failed": 5,
+      "receipt_id": "483a2b5bbda756dc85954752",
+      "receipt_sha256": "f3b446306691d61e97896ab4d237abaa20d1243237299812e790233c46451dba"
     },
-    "green_r55_candidate": {
+    "green_r56_candidate": {
       "status": "PASS",
-      "tests": 4,
+      "tests": 5,
       "failed": 0,
-      "receipt_id": "adf874166aedc68ae87737cd",
-      "receipt_sha256": "a217f72cce51a9daf56136f9075ba487adb2a899c291a63af835ea15f8c632f0"
+      "receipt_id": "7bf8f8dd93f175f5d7de118a",
+      "receipt_sha256": "4198930f38a3fc4b7978cfc94ca4509127561c170b05f7566bdf79513e449a8b"
+    },
+    "parent_activation": {
+      "status": "PASS",
+      "release_id": "v0.15.32-e7223f467777f5df",
+      "manifest_sha256": "e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b",
+      "generation_manifest_sha256": "740443fd207c5e6ffd5952079214bf6e81e9281a6ec880de9bbe3b8ce1deb00e",
+      "activation_receipt_sha256": "6518a04154f485cfae42e582269634d69a8b05a0183149d5e10006fbdd9d933c"
+    },
+    "parent_rollback": {
+      "status": "FAIL_EXPECTED",
+      "error": "active pointer launcher digest mismatch",
+      "command_receipt_sha256": "00cbd497e4902c67ab39313a378e2fcf32159113b46339ad1d54b5e5a7714205"
     },
     "full_regression": {
       "status": "PASS",
-      "files": 231,
+      "files": 233,
       "batches": 8,
-      "elapsed_ms": 242242.329,
-      "receipt_id": "8b6f85608e18f37e2722ecc7",
-      "receipt_sha256": "fcfc44696819cd9ea07a24601c6b9fff9c2d306ef9add8c3060d390fe0b77e99",
-      "request_sha256": "8f27d650298e9578b4ac19529167380c797dd8d07a3ef3f5a22a7b980b45b81f"
+      "elapsed_ms": 245761.429,
+      "receipt_id": "3dce7b1649f489fc02b8f055",
+      "receipt_sha256": "35da0a6a0a7d98c08f32f24b5f06df434d353018089acfaf51b9dd51693b7083",
+      "request_sha256": "af035b60299d84e743aa2babaa2321e89555bea4bbb2cd95036f6dc9fe086010"
     }
   },
   "inherited_parent_evidence": {
-    "version": "0.15.31",
+    "version": "0.15.32",
     "parent_full_regression": "PASS",
-    "parent_manifest_sha256": "16854fe5b3eb0fa1c6dd2b96e3c5d6f792c5adbc91dd2a71e7fc2771472bbdd4",
-    "parent_tarball_sha256": "ff6eba3036cb00ac639ac8907ad6063e6ea8169cf32aca8721f75b1e403e501a",
-    "parent_activation": "FAILED_AT_AUTHORITY_REVOKED_TRANSIENT_NODE_BLOCKER",
+    "parent_manifest_sha256": "e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b",
+    "parent_tarball_sha256": "c9e1f5875dd2177cee0089305b40321c128c54ce7f5522e34e507d4ecfb22638",
+    "parent_registry_identity": "PASS",
     "four_hour_soak": "NOT_COMPLETED_OPERATOR_BYPASS"
   },
   "operator_override": {
@@ -114,6 +126,11 @@
       "guardian_owner_parent_binding_required": true,
       "guardian_session_nonce_contract_required": true,
       "unrelated_stale_runtime_fail_closed": true
+    },
+    "r56": {
+      "signed_handoff_launcher_snapshot_required": true,
+      "predecessor_launcher_restored_before_pointer_commit": true,
+      "successor_launcher_restored_before_recovery_pointer": true
     }
   },
   "non_win32": {

package/controller/deadbyte-process-policy.json

@@ -1,15 +1,15 @@
 {
   "schema": "deadbyte.process-policy.v1",
   "enabled": true,
-  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.32-r55\\controller\\runtime\\process-grant.json",
-  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.32-r55\\controller\\runtime\\process-state",
+  "grant_file": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.33-r56\\controller\\runtime\\process-grant.json",
+  "state_dir": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.33-r56\\controller\\runtime\\process-state",
   "native_host": {
-    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.32-r55\\bin\\deadbyte-process-host.exe",
+    "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.33-r56\\bin\\deadbyte-process-host.exe",
     "sha256": "daf9cfb371bee88cafbf5597eaa507fec504dbe0b0ddd40d0c3c2e02817f49e4"
   },
   "roots": {
     "core": {
-      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.32-r55",
+      "path": "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.33-r56",
       "deny_paths": [
         "node_modules",
         "controller/runtime",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.32",
+  "version": "0.15.33",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
@@ -42,7 +42,7 @@
     "contained:run": "node src/contained-cli.mjs workspaces/demo input.txt",
     "contained:smoke": "node src/contained-smoke.mjs",
     "mcp:contained:smoke": "node src/mcp-contained-smoke-client.mjs",
-    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r55.ps1",
+    "gate:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r56.ps1",
     "authority:smoke": "node src/authority-smoke.mjs",
     "mcp:remote:smoke": "node src/remote-mcp-smoke-client.mjs",
     "mcp:host:smoke": "node src/mcp-host-smoke-client.mjs",
@@ -77,7 +77,8 @@
     "r52:focused:test": "node --test --test-concurrency=1 test/r52-release-contract.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/r52-host-revocation.test.mjs test/r51-runtime-coherence.test.mjs test/r51-live-log-polling.test.mjs test/coding-runtime.test.mjs test/remote-live-log-r37.test.mjs test/runtime-self-update.test.mjs",
     "r53:focused:test": "node --test --test-concurrency=1 test/r53-release-contract.test.mjs test/stabilization-update-child-root.test.mjs test/stabilization-state-root.test.mjs test/stabilization-guardian.test.mjs test/stabilization-semver.test.mjs test/stabilization-powershell.test.mjs test/release-slot.test.mjs test/runtime-self-update.test.mjs test/r51-runtime-coherence.test.mjs test/remote-session-cli.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/r52-host-revocation.test.mjs",
     "r54:focused:test": "node --test --test-concurrency=1 test/r54-release-contract.test.mjs test/r54-offline-predecessor-self-exclusion.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/runtime-self-update.test.mjs test/r51-runtime-coherence.test.mjs test/remote-session-cli.test.mjs",
-    "r55:focused:test": "node --test --test-concurrency=1 test/r55-release-contract.test.mjs test/r55-offline-predecessor-guardian-family.test.mjs test/r54-offline-predecessor-self-exclusion.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/runtime-self-update.test.mjs test/r51-runtime-coherence.test.mjs test/remote-session-cli.test.mjs"
+    "r55:focused:test": "node --test --test-concurrency=1 test/r55-release-contract.test.mjs test/r55-offline-predecessor-guardian-family.test.mjs test/r54-offline-predecessor-self-exclusion.test.mjs test/r52-offline-predecessor-recovery.test.mjs test/runtime-self-update.test.mjs test/r51-runtime-coherence.test.mjs test/remote-session-cli.test.mjs",
+    "r56:focused:test": "node --test --test-concurrency=1 test/r56-release-contract.test.mjs test/r56-rollback-launcher-restore.test.mjs test/r55-offline-predecessor-guardian-family.test.mjs test/r54-offline-predecessor-self-exclusion.test.mjs test/runtime-self-update.test.mjs test/release-slot.test.mjs test/r51-runtime-coherence.test.mjs"
   },
   "bundleDependencies": [
     "@modelcontextprotocol/server",

package/scripts/gate-windows-r56.ps1

@@ -0,0 +1,27 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+function Invoke-GateStep {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$NpmArgs)
+    Write-Host "==== $Name ===="
+    & npm.cmd @NpmArgs
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.33 / R56 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+function Invoke-NodeTest {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$TestFiles)
+    Write-Host "==== $Name ===="
+    & node.exe --test --test-concurrency=1 @TestFiles
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.33 / R56 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+Invoke-NodeTest 'r56-package-boundary' @('test/package-boundary.test.mjs')
+Invoke-GateStep 'r56-focused-contracts' @('run','r56:focused:test')
+Write-Host '==== full-regression-evidence ===='
+$matrix=Get-Content -LiteralPath (Join-Path (Split-Path $PSScriptRoot -Parent) 'TEST-MATRIX.json') -Raw | ConvertFrom-Json
+if($matrix.observed_pre_release_evidence.full_regression.status -ne 'PASS'){ throw 'R56 full regression evidence is not PASS' }
+Invoke-GateStep 'manifest-write' @('run','manifest:write')
+Invoke-GateStep 'manifest-verify' @('run','manifest:verify')
+Invoke-GateStep 'doctor' @('run','doctor')
+& node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence-r56.mjs')
+if ($LASTEXITCODE -ne 0) { throw "R56 evidence writer failed with exit code $LASTEXITCODE" }
+Write-Host '==== DEADBYTE 0.15.33 / R56 WINDOWS GATE: PASS ===='

package/scripts/windows-gate-evidence-r56.mjs

@@ -0,0 +1,81 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { doctor } from '../src/doctor-r45.mjs';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const insist=(ok,message)=>{if(!ok)throw new Error(message);};
+const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
+const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
+const provenance=JSON.parse(await readFile(path.join(root,'PROVENANCE.json'),'utf8'));
+const matrix=JSON.parse(await readFile(path.join(root,'TEST-MATRIX.json'),'utf8'));
+const active=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+const manifestSha256=sha256(await readFile(path.join(root,'MANIFEST.SHA256')));
+
+insist(pkg.version==='0.15.33'&&release.version===pkg.version&&release.train==='R56','R56 candidate identity mismatch');
+insist(release.parent.version==='0.15.32','R56 parent mismatch');
+insist(release.parent.manifest_sha256==='e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b','R56 parent manifest mismatch');
+insist(release.parent.generation_manifest_sha256==='740443fd207c5e6ffd5952079214bf6e81e9281a6ec880de9bbe3b8ce1deb00e','R56 parent generation mismatch');
+insist(release.parent.tarball_sha256==='c9e1f5875dd2177cee0089305b40321c128c54ce7f5522e34e507d4ecfb22638','R56 parent tarball mismatch');
+insist(
+  active.release_id===release.runtime_predecessor.release_id&&
+  active.manifest_sha256===release.runtime_predecessor.manifest_sha256&&
+  active.generation_manifest_sha256===release.runtime_predecessor.generation_manifest_sha256,
+  'active runtime is not exact sealed 0.15.32 predecessor'
+);
+insist(release.hotfix?.signed_handoff_launcher_snapshot_required===true,'R56 signed rollback handoff launcher requirement missing');
+insist(release.hotfix?.stored_predecessor_verified_without_live_launcher===true,'R56 stored predecessor verification split missing');
+insist(release.hotfix?.predecessor_launcher_restored_before_pointer_commit===true,'R56 predecessor launcher ordering missing');
+insist(release.hotfix?.successor_launcher_restored_before_recovery_pointer===true,'R56 successor recovery ordering missing');
+insist(release.hotfix?.full_regression==='PASS','R56 full regression metadata is not PASS');
+insist(matrix.observed_pre_release_evidence?.full_regression?.status==='PASS','R56 full regression evidence is not PASS');
+insist(provenance.operator_override?.stable_final_claim===false,'R56 must not claim stable/final');
+insist(matrix.operator_override?.four_hour_soak==='NOT_COMPLETED','R56 matrix must preserve soak bypass');
+
+const health=await doctor();
+insist(health.status==='ok'&&health.package_version===pkg.version&&health.manifest?.verified===true,'R56 doctor evidence invalid');
+
+const evidence={
+ schema:'deadbyte.r56-windows-gate.v1',
+ status:'passed',
+ exit_code:0,
+ version:pkg.version,
+ train:'R56',
+ completed_at_utc:new Date().toISOString(),
+ manifest_sha256:manifestSha256,
+ parent:release.parent,
+ runtime_predecessor:release.runtime_predecessor,
+ hotfix:release.hotfix,
+ operator_override:provenance.operator_override,
+ active_predecessor:{
+  release_id:active.release_id,
+  version:active.version,
+  manifest_sha256:active.manifest_sha256,
+  generation_manifest_sha256:active.generation_manifest_sha256
+ },
+ doctor:{verified_entries:health.manifest.verified_entries},
+ gates:{
+  r56_focused:true,
+  package_boundary:true,
+  full_regression:true,
+  manifest_final_verify:true,
+  four_hour_soak_completed:false
+ }
+};
+const bytes=Buffer.from(JSON.stringify(evidence,null,2)+'\n');
+const dir=path.join(stateRoot,'evidence','release');
+await mkdir(dir,{recursive:true});
+const target=path.join(dir,`r56-windows-gate-${manifestSha256.slice(0,16)}.json`);
+try{
+ const handle=await open(target,'wx',0o600);
+ try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+}catch(error){
+ if(error?.code!=='EEXIST')throw error;
+ const prior=JSON.parse(await readFile(target,'utf8'));
+ insist(prior.schema===evidence.schema&&prior.status==='passed'&&prior.version===evidence.version&&prior.manifest_sha256===manifestSha256,'conflicting R56 gate evidence identity');
+}
+console.log(JSON.stringify({status:'passed',path:target,sha256:sha256(bytes),manifest_sha256:manifestSha256}));

package/src/runtime-update.mjs

@@ -861,16 +861,21 @@ async function verifyPackageRoot(root,expectedVersion,expectedManifest,label){
   if(pkg?.name!=='deadbyte-mcp'||pkg?.version!==expectedVersion) throw new Error(`${label} package identity mismatch`);
   return {root:absolute,manifest_sha256:digest,entries:entries.size};
 }
-async function verifyActiveInstallation(stateRoot,pointer){
+async function verifyStoredInstallation(stateRoot,pointer){
   const state=path.resolve(stateRoot); const expectedRelease=path.join(state,'releases',releaseId(pointer.version,pointer.manifest_sha256));
   if(path.resolve(pointer.release_root)!==path.resolve(expectedRelease)) throw new Error('active pointer release root is not content-addressed store path');
   const release=await verifyPackageRoot(pointer.release_root,pointer.version,pointer.manifest_sha256,'active release');
   const generation=await verifyGenerationBundle(pointer.generation_root,pointer.generation_manifest_sha256);
   const expectedConfig=path.join(path.resolve(pointer.generation_root),'controller-config.psd1');
   if(path.resolve(pointer.config_path)!==path.resolve(expectedConfig)) throw new Error('active pointer config path mismatch');
+  return {release,generation};
+}
+async function verifyActiveInstallation(stateRoot,pointer){
+  const state=path.resolve(stateRoot);
+  const verified=await verifyStoredInstallation(state,pointer);
   const currentLauncher=await sha256File(launcherPath(state));
   if(currentLauncher!==pointer.launcher_sha256) throw new Error('active pointer launcher digest mismatch');
-  return {release,generation};
+  return verified;
 }
 async function loadPointerIfPresent(stateRoot){
   const file=path.join(path.resolve(stateRoot),'active-release.json');
@@ -1084,6 +1089,41 @@ function decodeSnapshot(snapshot,label){
   }
   return {exists:false,bytes:null,sha256:null};
 }
+export function rollbackLauncherPlanFromHandoff(body,priorPointer,activePointer,stateRoot=DEFAULT_STATE_ROOT){
+  if(!body||typeof body!=='object') throw new Error('rollback handoff body required');
+  const handoffPrior=body.prior_pointer?parseActivePointer(JSON.stringify(body.prior_pointer)):null;
+  const handoffActive=body.new_pointer?parseActivePointer(JSON.stringify(body.new_pointer)):null;
+  if(!samePublicPointer(handoffPrior,priorPointer)||!samePublicPointer(handoffActive,activePointer)) throw new Error('rollback handoff pointer binding mismatch');
+  const state=path.resolve(stateRoot);
+  const launchers={
+    ps1:path.resolve(String(body.launchers?.ps1??'')),
+    cmd:path.resolve(String(body.launchers?.cmd??'')),
+    top:path.resolve(String(body.launchers?.top??TOP_LAUNCHER)),
+    launcher_sha256:String(body.launchers?.launcher_sha256??''),
+    ps1Bytes:Buffer.from(String(body.launchers?.ps1_bytes??''),'base64'),
+    cmdBytes:Buffer.from(String(body.launchers?.cmd_bytes??''),'base64'),
+    snapshots:{
+      ps1:decodeSnapshot(body.launchers?.snapshots?.ps1,'rollback.launcher.ps1'),
+      cmd:decodeSnapshot(body.launchers?.snapshots?.cmd,'rollback.launcher.cmd'),
+      top:decodeSnapshot(body.launchers?.snapshots?.top,'rollback.launcher.top')
+    },
+    installed:true
+  };
+  if(launchers.ps1!==path.resolve(launcherPath(state))||
+     launchers.cmd!==path.resolve(path.join(state,'bin','DEADBYTE-MCP.cmd'))||
+     launchers.top!==path.resolve(TOP_LAUNCHER)) throw new Error('rollback launcher paths are not canonical');
+  if(!HEX64.test(launchers.launcher_sha256)||sha256Bytes(launchers.ps1Bytes)!==launchers.launcher_sha256) throw new Error('rollback successor launcher bytes/hash mismatch');
+  if(launchers.launcher_sha256!==activePointer.launcher_sha256) throw new Error('rollback successor launcher hash does not match active pointer');
+  if(!launchers.snapshots.ps1.exists||launchers.snapshots.ps1.sha256!==priorPointer.launcher_sha256) throw new Error('rollback predecessor launcher snapshot does not match signed prior pointer');
+  return launchers;
+}
+async function restoreRollbackLaunchers(plan){
+  await restoreFile(plan.ps1,plan.snapshots.ps1);
+  await restoreFile(plan.cmd,plan.snapshots.cmd);
+  await restoreFile(plan.top,plan.snapshots.top);
+  if(await sha256File(plan.ps1)!==plan.snapshots.ps1.sha256) throw new Error('rollback predecessor launcher restore hash mismatch');
+  return plan;
+}
 const UPDATE_PHASE_RANK=Object.freeze({
   initial:0,candidate_prepared:10,old_runtime_verified:20,shutdown_handoff_armed:25,supervisor_spawned:30,
   authority_revoked:40,old_runtime_stopped:50,workspace_ready:60,launcher_installed:70,pointer_committed:80,
@@ -1587,19 +1627,28 @@ export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_S
   const activePointer=parseActivePointer(JSON.stringify(activationEnvelope.body.active_pointer));
   const pointerInfo=await loadPointerIfPresent(state);
   if(!pointerInfo.pointer||canonicalJson(publicPointer(pointerInfo.pointer))!==canonicalJson(publicPointer(activePointer))) throw new Error('rollback current pointer does not match signed activation pointer');
-  await verifyActiveInstallation(state,priorPointer);
+
+  const handoffPath=path.join(path.dirname(receiptFile),'handoff.json');
+  const {body:handoffBody}=await readHandoffEnvelope(handoffPath,state);
+  if(handoffBody.update_id!==activationEnvelope.body.update_id) throw new Error('rollback handoff update identity mismatch');
+  const rollbackLaunchers=rollbackLauncherPlanFromHandoff(handoffBody,priorPointer,activePointer,state);
+  await verifyStoredInstallation(state,priorPointer);
+
   const currentCtx=slotContext(state,pointerInfo.pointer),currentRuntime=await captureRuntime(currentCtx);
   const revoked=await revokeAuthority(currentCtx,currentRuntime.status);
   const rollbackId=`r31-rollback-${activationEnvelope.receipt_sha256.slice(0,16)}-${Date.now().toString(36)}-${randomBytes(4).toString('hex')}`;
   const evidenceDir=path.join(state,'evidence','updates',rollbackId),statePath=path.join(evidenceDir,'state.json'),receiptPath=path.join(evidenceDir,'receipt.json');
   await mkdir(evidenceDir,{recursive:true});
   const journal={schema:'deadbyte.r31-slot-rollback-state.v1',rollback_id:rollbackId,activation_receipt:path.resolve(receiptFile),
-    activation_receipt_sha256:activationEnvelope.receipt_sha256,from_pointer:publicPointer(activePointer),to_pointer:publicPointer(priorPointer),created_at_utc:new Date().toISOString()};
+    activation_receipt_sha256:activationEnvelope.receipt_sha256,handoff_path:handoffPath,
+    from_pointer:publicPointer(activePointer),to_pointer:publicPointer(priorPointer),created_at_utc:new Date().toISOString()};
   await writeState(statePath,journal,'verified');
-  let stopped=false,pointerCommitted=false,priorCtx=null,priorRuntime=null;
+  let stopped=false,launchersRestored=false,pointerCommitted=false,priorCtx=null,priorRuntime=null;
   try {
     await stopAndVerify(currentCtx,currentRuntime); stopped=true;
     await writeState(statePath,journal,'successor_stopped');
+    await restoreRollbackLaunchers(rollbackLaunchers); launchersRestored=true;
+    await writeState(statePath,journal,'predecessor_launcher_restored',{launcher_sha256:priorPointer.launcher_sha256});
     await atomicWriteActivePointer(pointerInfo.file,priorPointer); pointerCommitted=true;
     await verifyActiveInstallation(state,priorPointer);
     await writeState(statePath,journal,'prior_pointer_restored',{active_pointer:publicPointer(priorPointer)});
@@ -1610,16 +1659,27 @@ export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_S
     if(finalStatus.process_armed||finalStatus.coding_armed||finalStatus.autonomous_armed||finalStatus.desktop_armed||finalStatus.host_armed) throw new Error('rollback predecessor authority must remain disarmed');
     const body={schema:ROLLBACK_SCHEMA,rollback_id:rollbackId,activation_receipt_sha256:activationEnvelope.receipt_sha256,
       completed_at_utc:new Date().toISOString(),from_pointer:publicPointer(activePointer),active_pointer:publicPointer(priorPointer),
-      old_runtime:generationTuple(currentRuntime),new_runtime:generationTuple(priorRuntime),stabilization,authority_revoked:revoked.revoked,rollback_performed:true};
+      launcher_restored:true,old_runtime:generationTuple(currentRuntime),new_runtime:generationTuple(priorRuntime),stabilization,
+      authority_revoked:revoked.revoked,rollback_performed:true};
     const receipt=await writeEnvelope(receiptPath,body,key);
     await writeState(statePath,journal,'completed',{receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256});
     return {ok:true,rollback_id:rollbackId,state_path:statePath,receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256,pointer:priorPointer,new_runtime:priorRuntime};
   } catch(error){
-    const recovery={attempted:false,prior_runtime_stopped:false,successor_pointer_restored:false,successor_runtime_restarted:false,errors:[]};
+    const recovery={attempted:false,prior_runtime_stopped:false,successor_launcher_restored:false,successor_pointer_restored:false,successor_runtime_restarted:false,errors:[]};
     if(stopped){
       recovery.attempted=true;
       if(pointerCommitted&&priorCtx){ try { controllerCaptured(priorCtx,'stop',30000); recovery.prior_runtime_stopped=true; } catch(recoveryError){ recovery.errors.push(`stop-prior:${recoveryError.message}`); } }
-      if(pointerCommitted){ try { await atomicWriteActivePointer(pointerInfo.file,activePointer); await verifyActiveInstallation(state,activePointer); recovery.successor_pointer_restored=true; } catch(recoveryError){ recovery.errors.push(`restore-pointer:${recoveryError.message}`); } }
+      if(launchersRestored){
+        try { await installLaunchers(rollbackLaunchers); recovery.successor_launcher_restored=true; }
+        catch(recoveryError){ recovery.errors.push(`restore-successor-launcher:${recoveryError.message}`); }
+      }
+      if(pointerCommitted){
+        try { await atomicWriteActivePointer(pointerInfo.file,activePointer); await verifyActiveInstallation(state,activePointer); recovery.successor_pointer_restored=true; }
+        catch(recoveryError){ recovery.errors.push(`restore-pointer:${recoveryError.message}`); }
+      }else if(recovery.successor_launcher_restored){
+        try { await verifyActiveInstallation(state,activePointer); recovery.successor_pointer_restored=true; }
+        catch(recoveryError){ recovery.errors.push(`verify-successor-pointer:${recoveryError.message}`); }
+      }
       try { await startAndVerify(currentCtx,currentRuntime); recovery.successor_runtime_restarted=true; } catch(recoveryError){ recovery.errors.push(`restart-successor:${recoveryError.message}`); }
     }
     await writeState(statePath,journal,'failed',{error:{name:error?.name??'Error',message:String(error?.message??error)},recovery}).catch(()=>{});

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.32';
+export const DEADBYTE_VERSION = '0.15.33';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/r49-windows-gate.test.mjs

@@ -4,9 +4,11 @@ import test from 'node:test';
 
 const read=path=>readFile(new URL(`../${path}`,import.meta.url),'utf8');
 
-test('R55 canonical Windows gate is successor-bound and preserves R54/R53/R52/R51/R50/R49 historical gates',async()=>{
-  const [pkgText,gate,evidence,historicalR54,historicalEvidenceR54,historicalR53,historicalEvidenceR53,historicalR52,historicalEvidenceR52,historicalR51,historicalEvidenceR51,historicalR50,historicalR49,deferred]=await Promise.all([
+test('R56 canonical Windows gate is successor-bound and preserves R55/R54/R53/R52/R51/R50/R49 historical gates',async()=>{
+  const [pkgText,gate,evidence,historicalR55,historicalEvidenceR55,historicalR54,historicalEvidenceR54,historicalR53,historicalEvidenceR53,historicalR52,historicalEvidenceR52,historicalR51,historicalEvidenceR51,historicalR50,historicalR49,deferred]=await Promise.all([
     read('package.json'),
+    read('scripts/gate-windows-r56.ps1'),
+    read('scripts/windows-gate-evidence-r56.mjs'),
     read('scripts/gate-windows-r55.ps1'),
     read('scripts/windows-gate-evidence-r55.mjs'),
     read('scripts/gate-windows-r54.ps1'),
@@ -22,18 +24,20 @@ test('R55 canonical Windows gate is successor-bound and preserves R54/R53/R52/R5
     read('scripts/deferred-slot-operation-r46.mjs')
   ]);
   const pkg=JSON.parse(pkgText);
-  assert.match(pkg.scripts['gate:windows'],/gate-windows-r55\.ps1$/);
-  assert.match(gate,/DEADBYTE 0\.15\.32 \/ R55 WINDOWS GATE: PASS/);
-  assert.match(gate,/r55-package-boundary/);
-  assert.match(gate,/r55-focused-contracts/);
-  assert.match(gate,/full-regression/);
+  assert.match(pkg.scripts['gate:windows'],/gate-windows-r56\.ps1$/);
+  assert.match(gate,/DEADBYTE 0\.15\.33 \/ R56 WINDOWS GATE: PASS/);
+  assert.match(gate,/r56-package-boundary/);
+  assert.match(gate,/r56-focused-contracts/);
+  assert.match(gate,/full-regression-evidence/);
   assert.match(gate,/manifest-verify/);
   assert.match(gate,/doctor/);
-  assert.match(evidence,/deadbyte\.r55-windows-gate\.v1/);
-  assert.match(evidence,/pkg\.version==='0\.15\.32'/);
-  assert.match(evidence,/release\.train==='R55'/);
-  assert.match(evidence,/release\.parent\.version==='0\.15\.31'/);
+  assert.match(evidence,/deadbyte\.r56-windows-gate\.v1/);
+  assert.match(evidence,/pkg\.version==='0\.15\.33'/);
+  assert.match(evidence,/release\.train==='R56'/);
+  assert.match(evidence,/release\.parent\.version==='0\.15\.32'/);
   assert.match(evidence,/four_hour_soak_completed:false/);
+  assert.match(historicalR55,/DEADBYTE 0\.15\.32 \/ R55 WINDOWS GATE: PASS/);
+  assert.match(historicalEvidenceR55,/deadbyte\.r55-windows-gate\.v1/);
   assert.match(historicalR54,/DEADBYTE 0\.15\.31 \/ R54 WINDOWS GATE: PASS/);
   assert.match(historicalEvidenceR54,/deadbyte\.r54-windows-gate\.v1/);
   assert.match(historicalR53,/DEADBYTE 0\.15\.30 \/ R53 WINDOWS GATE: PASS/);
@@ -46,10 +50,5 @@ test('R55 canonical Windows gate is successor-bound and preserves R54/R53/R52/R5
   assert.match(historicalR49,/DEADBYTE 0\.15\.26 \/ R49 WINDOWS GATE: PASS/);
   assert.match(deferred,/const expectedVersion=packageIdentity\.version/);
   assert.match(deferred,/'--expected-version',expectedVersion/);
-  assert.match(deferred,/async function awaitHandoffCompletion/);
   assert.match(deferred,/verifySlotUpdateEnvelope\(envelope,publicKey\)/);
-  assert.match(deferred,/active pointer does not match signed activation receipt/);
-  assert.match(deferred,/failure-receipt\.json/);
-  assert.match(deferred,/await awaitHandoffCompletion\(await runSlotUpdateCli/);
-  assert.doesNotMatch(deferred,/'--expected-version','0\.15\.5'/);
 });

package/test/r55-release-contract.test.mjs

@@ -5,8 +5,10 @@ import { readFile } from 'node:fs/promises';
 const root=new URL('../',import.meta.url);
 const read=rel=>readFile(new URL(rel,root),'utf8');
 const json=rel=>read(rel).then(JSON.parse);
+const currentPackage=await json('package.json');
+const r55test=currentPackage.version==='0.15.32'?test:test.skip;
 
-test('R55 release identity is coherent across package lock source metadata SBOM and gate',async()=>{
+r55test('R55 release identity is coherent across package lock source metadata SBOM and gate',async()=>{
   const [pkg,lock,release,provenance,matrix,sbom,versionSource]=await Promise.all([
     json('package.json'),json('package-lock.json'),json('RELEASE.json'),json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs')
   ]);
@@ -25,7 +27,7 @@ test('R55 release identity is coherent across package lock source metadata SBOM
   assert.match(pkg.scripts['r55:focused:test'],/r55-offline-predecessor-guardian-family\.test\.mjs/);
 });
 
-test('R55 source predecessor is exact immutable published 0.15.31 while runtime predecessor remains exact 0.15.29',async()=>{
+r55test('R55 source predecessor is exact immutable published 0.15.31 while runtime predecessor remains exact 0.15.29',async()=>{
   const [release,provenance]=await Promise.all([json('RELEASE.json'),json('PROVENANCE.json')]);
   assert.equal(release.parent.version,'0.15.31');
   assert.equal(release.parent.release_id,'v0.15.31-16854fe5b3eb0fa1');
@@ -44,7 +46,7 @@ test('R55 source predecessor is exact immutable published 0.15.31 while runtime
   assert.deepEqual(provenance.runtime_predecessor,release.runtime_predecessor);
 });
 
-test('R55 records the guardian sibling RED to GREEN and preserves fail-closed negative controls',async()=>{
+r55test('R55 records the guardian sibling RED to GREEN and preserves fail-closed negative controls',async()=>{
   const [release,provenance,matrix]=await Promise.all([json('RELEASE.json'),json('PROVENANCE.json'),json('TEST-MATRIX.json')]);
   assert.equal(release.hotfix.activation_ancestry_excluded,true);
   assert.equal(release.hotfix.foreground_guardian_owner_parent_binding,true);

package/test/r56-release-contract.test.mjs

@@ -0,0 +1,63 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+
+const root=new URL('../',import.meta.url);
+const read=rel=>readFile(new URL(rel,root),'utf8');
+const json=rel=>read(rel).then(JSON.parse);
+
+test('R56 release identity is coherent across package lock source metadata SBOM and gate',async()=>{
+  const [pkg,lock,release,provenance,matrix,sbom,versionSource]=await Promise.all([
+    json('package.json'),json('package-lock.json'),json('RELEASE.json'),json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs')
+  ]);
+  assert.equal(pkg.version,'0.15.33');
+  assert.equal(lock.version,pkg.version);
+  assert.equal(lock.packages[''].version,pkg.version);
+  assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.33'/);
+  assert.equal(release.version,pkg.version);
+  assert.equal(release.train,'R56');
+  assert.equal(provenance.version,pkg.version);
+  assert.equal(matrix.version,pkg.version);
+  assert.equal(matrix.train,'R56');
+  assert.equal(sbom.metadata.component.version,pkg.version);
+  assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r56:0.15.33');
+  assert.match(pkg.scripts['gate:windows'],/gate-windows-r56\.ps1/);
+  assert.match(pkg.scripts['r56:focused:test'],/r56-rollback-launcher-restore\.test\.mjs/);
+});
+
+test('R56 source and runtime predecessor are exact active published 0.15.32',async()=>{
+  const [release,provenance]=await Promise.all([json('RELEASE.json'),json('PROVENANCE.json')]);
+  assert.equal(release.parent.version,'0.15.32');
+  assert.equal(release.parent.release_id,'v0.15.32-e7223f467777f5df');
+  assert.equal(release.parent.manifest_sha256,'e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b');
+  assert.equal(release.parent.generation_manifest_sha256,'740443fd207c5e6ffd5952079214bf6e81e9281a6ec880de9bbe3b8ce1deb00e');
+  assert.equal(release.parent.tarball_sha256,'c9e1f5875dd2177cee0089305b40321c128c54ce7f5522e34e507d4ecfb22638');
+  assert.equal(release.parent.activation_status,'ACTIVATED_ROLLBACK_DEFECT_OBSERVED');
+  assert.equal(release.source_predecessor.version,'0.15.32');
+  assert.deepEqual(release.runtime_predecessor,{
+    release_id:'v0.15.32-e7223f467777f5df',
+    manifest_sha256:'e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b',
+    generation_manifest_sha256:'740443fd207c5e6ffd5952079214bf6e81e9281a6ec880de9bbe3b8ce1deb00e'
+  });
+  assert.equal(provenance.parent_manifest_sha256,release.parent.manifest_sha256);
+  assert.equal(provenance.parent_generation_manifest_sha256,release.parent.generation_manifest_sha256);
+  assert.deepEqual(provenance.runtime_predecessor,release.runtime_predecessor);
+});
+
+test('R56 records signed rollback launcher ordering RED to GREEN and preserves non-final claim',async()=>{
+  const [release,provenance,matrix]=await Promise.all([json('RELEASE.json'),json('PROVENANCE.json'),json('TEST-MATRIX.json')]);
+  assert.equal(release.hotfix.signed_handoff_launcher_snapshot_required,true);
+  assert.equal(release.hotfix.stored_predecessor_verified_without_live_launcher,true);
+  assert.equal(release.hotfix.predecessor_launcher_restored_before_pointer_commit,true);
+  assert.equal(release.hotfix.successor_launcher_restored_before_recovery_pointer,true);
+  assert.equal(release.hotfix.exact_parent_activation_receipt_sha256,'6518a04154f485cfae42e582269634d69a8b05a0183149d5e10006fbdd9d933c');
+  assert.equal(release.hotfix.observed_parent_rollback_failure_receipt_sha256,'00cbd497e4902c67ab39313a378e2fcf32159113b46339ad1d54b5e5a7714205');
+  assert.equal(release.hotfix.red_parent_0_15_32,'FAIL_5_OF_5');
+  assert.equal(release.hotfix.green_r56_candidate,'PASS_5_OF_5');
+  assert.equal(matrix.observed_pre_release_evidence.red_parent_0_15_32.receipt_sha256,'f3b446306691d61e97896ab4d237abaa20d1243237299812e790233c46451dba');
+  assert.equal(matrix.observed_pre_release_evidence.green_r56_candidate.receipt_sha256,'4198930f38a3fc4b7978cfc94ca4509127561c170b05f7566bdf79513e449a8b');
+  assert.equal(release.hotfix.stable_final_claim,false);
+  assert.equal(provenance.operator_override.four_hour_soak,'NOT_COMPLETED');
+  assert.equal(provenance.operator_override.stable_final_claim,false);
+  assert.equal(matrix.operator_override.stable_final_claim,false);
+});

package/test/r56-rollback-launcher-restore.test.mjs

@@ -0,0 +1,103 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { pathToFileURL } from 'node:url';
+import os from 'node:os';
+import path from 'node:path';
+
+const target=process.env.R56_RUNTIME_UPDATE_PATH
+  ? path.resolve(process.env.R56_RUNTIME_UPDATE_PATH)
+  : path.resolve(new URL('../src/runtime-update.mjs',import.meta.url).pathname.replace(/^\/(?:[A-Za-z]:)/,m=>m.slice(1)));
+const runtimeUpdate=await import(pathToFileURL(target).href+'?r56='+Date.now());
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const stateRoot=path.resolve(process.env.R56_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const topLauncher=path.resolve(path.join(os.homedir(),'Downloads','DEADBYTE-MCP.cmd'));
+
+function pointer(version,manifest,launcher){
+  const releaseId=`v${version}-${manifest.slice(0,16)}`;
+  const genId=`${releaseId}-g${'9'.repeat(16)}`;
+  return {
+    schema:'deadbyte.active-release.v1',
+    release_id:releaseId,
+    version,
+    manifest_sha256:manifest,
+    release_root:path.join(stateRoot,'releases',releaseId),
+    generation_root:path.join(stateRoot,'generations',genId),
+    generation_manifest_sha256:'8'.repeat(64),
+    launcher_sha256:launcher,
+    config_path:path.join(stateRoot,'generations',genId,'controller-config.psd1')
+  };
+}
+function snapshot(bytes){
+  const b=Buffer.from(bytes);
+  return {exists:true,sha256:sha256(b),bytes_base64:b.toString('base64')};
+}
+function fixture(){
+  const priorBytes=Buffer.from('prior-launcher-r55\r\n');
+  const activeBytes=Buffer.from('active-launcher-r56\r\n');
+  const cmdBytes=Buffer.from('@echo off\r\n');
+  const prior=pointer('0.15.29','1'.repeat(64),sha256(priorBytes));
+  const active=pointer('0.15.32','2'.repeat(64),sha256(activeBytes));
+  const body={
+    prior_pointer:prior,
+    new_pointer:active,
+    launchers:{
+      ps1:path.join(stateRoot,'bin','DEADBYTE-MCP.ps1'),
+      cmd:path.join(stateRoot,'bin','DEADBYTE-MCP.cmd'),
+      top:topLauncher,
+      launcher_sha256:sha256(activeBytes),
+      ps1_bytes:activeBytes.toString('base64'),
+      cmd_bytes:cmdBytes.toString('base64'),
+      snapshots:{
+        ps1:snapshot(priorBytes),
+        cmd:snapshot(cmdBytes),
+        top:snapshot(cmdBytes)
+      }
+    }
+  };
+  return {prior,active,body};
+}
+
+test('R56 exposes rollback launcher planning from the signed activation handoff',()=>{
+  assert.equal(typeof runtimeUpdate.rollbackLauncherPlanFromHandoff,'function');
+});
+
+test('R56 accepts a prior launcher snapshot whose hash differs from the active launcher and binds both signed pointers',()=>{
+  const {prior,active,body}=fixture();
+  const plan=runtimeUpdate.rollbackLauncherPlanFromHandoff(body,prior,active,stateRoot);
+  assert.equal(plan.snapshots.ps1.sha256,prior.launcher_sha256);
+  assert.equal(plan.launcher_sha256,active.launcher_sha256);
+  assert.notEqual(plan.snapshots.ps1.sha256,plan.launcher_sha256);
+});
+
+test('R56 rejects a predecessor launcher snapshot that does not match the signed prior pointer',()=>{
+  const {prior,active,body}=fixture();
+  body.launchers.snapshots.ps1=snapshot(Buffer.from('wrong-prior-launcher\r\n'));
+  assert.throws(()=>runtimeUpdate.rollbackLauncherPlanFromHandoff(body,prior,active,stateRoot),/predecessor launcher snapshot/i);
+});
+
+test('R56 rejects handoff pointer drift instead of using unsigned rollback state',()=>{
+  const {prior,active,body}=fixture();
+  const drift={...prior,manifest_sha256:'3'.repeat(64),release_id:`v0.15.29-${'3'.repeat(16)}`,release_root:path.join(stateRoot,'releases',`v0.15.29-${'3'.repeat(16)}`)};
+  assert.throws(()=>runtimeUpdate.rollbackLauncherPlanFromHandoff(body,drift,active,stateRoot),/pointer binding mismatch/i);
+});
+
+test('R56 rollback verifies stored predecessor bytes before stop, restores signed predecessor launcher before pointer commit, and reinstalls successor launcher before recovery pointer',async()=>{
+  const source=await readFile(target,'utf8');
+  const start=source.indexOf('export async function performSlotRollback');
+  const end=source.indexOf('export async function runSlotUpdateCli',start);
+  assert.ok(start>=0&&end>start);
+  const perform=source.slice(start,end);
+  const stored=perform.indexOf('verifyStoredInstallation(state,priorPointer)');
+  const stop=perform.indexOf('stopAndVerify(currentCtx,currentRuntime)');
+  const restoreLauncher=perform.indexOf('restoreRollbackLaunchers(rollbackLaunchers)');
+  const commit=perform.indexOf('atomicWriteActivePointer(pointerInfo.file,priorPointer)');
+  const verifyPrior=perform.indexOf('verifyActiveInstallation(state,priorPointer)');
+  const reinstall=perform.indexOf('installLaunchers(rollbackLaunchers)');
+  const restoreSuccessor=perform.indexOf('atomicWriteActivePointer(pointerInfo.file,activePointer)');
+  assert.ok(stored>=0&&stored<stop);
+  assert.ok(restoreLauncher>stop&&restoreLauncher<commit);
+  assert.ok(verifyPrior>commit);
+  assert.ok(reinstall>verifyPrior&&reinstall<restoreSuccessor);
+});