deadbyte-mcp 0.15.32 → 0.15.34

package/scripts/gate-windows-r57.ps1

@@ -0,0 +1,27 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+function Invoke-GateStep {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$NpmArgs)
+    Write-Host "==== $Name ===="
+    & npm.cmd @NpmArgs
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.34 / R57 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+function Invoke-NodeTest {
+    param([Parameter(Mandatory)][string]$Name,[Parameter(Mandatory)][string[]]$TestFiles)
+    Write-Host "==== $Name ===="
+    & node.exe --test --test-concurrency=1 @TestFiles
+    if ($LASTEXITCODE -ne 0) { throw "DEADBYTE 0.15.34 / R57 gate failed at $Name with exit code $LASTEXITCODE" }
+}
+
+Invoke-NodeTest 'r57-package-boundary' @('test/package-boundary.test.mjs')
+Invoke-GateStep 'r57-focused-contracts' @('run','r57:focused:test')
+Write-Host '==== full-regression-evidence ===='
+$matrix=Get-Content -LiteralPath (Join-Path (Split-Path $PSScriptRoot -Parent) 'TEST-MATRIX.json') -Raw | ConvertFrom-Json
+if($matrix.observed_pre_release_evidence.full_regression.status -ne 'PASS'){ throw 'R57 full regression evidence is not PASS' }
+Invoke-GateStep 'manifest-write' @('run','manifest:write')
+Invoke-GateStep 'manifest-verify' @('run','manifest:verify')
+Invoke-GateStep 'doctor' @('run','doctor')
+& node.exe (Join-Path $PSScriptRoot 'windows-gate-evidence-r57.mjs')
+if ($LASTEXITCODE -ne 0) { throw "R57 evidence writer failed with exit code $LASTEXITCODE" }
+Write-Host '==== DEADBYTE 0.15.34 / R57 WINDOWS GATE: PASS ===='

package/scripts/windows-gate-evidence-r56.mjs

@@ -0,0 +1,81 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { doctor } from '../src/doctor-r45.mjs';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const insist=(ok,message)=>{if(!ok)throw new Error(message);};
+const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
+const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
+const provenance=JSON.parse(await readFile(path.join(root,'PROVENANCE.json'),'utf8'));
+const matrix=JSON.parse(await readFile(path.join(root,'TEST-MATRIX.json'),'utf8'));
+const active=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+const manifestSha256=sha256(await readFile(path.join(root,'MANIFEST.SHA256')));
+
+insist(pkg.version==='0.15.33'&&release.version===pkg.version&&release.train==='R56','R56 candidate identity mismatch');
+insist(release.parent.version==='0.15.32','R56 parent mismatch');
+insist(release.parent.manifest_sha256==='e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b','R56 parent manifest mismatch');
+insist(release.parent.generation_manifest_sha256==='740443fd207c5e6ffd5952079214bf6e81e9281a6ec880de9bbe3b8ce1deb00e','R56 parent generation mismatch');
+insist(release.parent.tarball_sha256==='c9e1f5875dd2177cee0089305b40321c128c54ce7f5522e34e507d4ecfb22638','R56 parent tarball mismatch');
+insist(
+  active.release_id===release.runtime_predecessor.release_id&&
+  active.manifest_sha256===release.runtime_predecessor.manifest_sha256&&
+  active.generation_manifest_sha256===release.runtime_predecessor.generation_manifest_sha256,
+  'active runtime is not exact sealed 0.15.32 predecessor'
+);
+insist(release.hotfix?.signed_handoff_launcher_snapshot_required===true,'R56 signed rollback handoff launcher requirement missing');
+insist(release.hotfix?.stored_predecessor_verified_without_live_launcher===true,'R56 stored predecessor verification split missing');
+insist(release.hotfix?.predecessor_launcher_restored_before_pointer_commit===true,'R56 predecessor launcher ordering missing');
+insist(release.hotfix?.successor_launcher_restored_before_recovery_pointer===true,'R56 successor recovery ordering missing');
+insist(release.hotfix?.full_regression==='PASS','R56 full regression metadata is not PASS');
+insist(matrix.observed_pre_release_evidence?.full_regression?.status==='PASS','R56 full regression evidence is not PASS');
+insist(provenance.operator_override?.stable_final_claim===false,'R56 must not claim stable/final');
+insist(matrix.operator_override?.four_hour_soak==='NOT_COMPLETED','R56 matrix must preserve soak bypass');
+
+const health=await doctor();
+insist(health.status==='ok'&&health.package_version===pkg.version&&health.manifest?.verified===true,'R56 doctor evidence invalid');
+
+const evidence={
+ schema:'deadbyte.r56-windows-gate.v1',
+ status:'passed',
+ exit_code:0,
+ version:pkg.version,
+ train:'R56',
+ completed_at_utc:new Date().toISOString(),
+ manifest_sha256:manifestSha256,
+ parent:release.parent,
+ runtime_predecessor:release.runtime_predecessor,
+ hotfix:release.hotfix,
+ operator_override:provenance.operator_override,
+ active_predecessor:{
+  release_id:active.release_id,
+  version:active.version,
+  manifest_sha256:active.manifest_sha256,
+  generation_manifest_sha256:active.generation_manifest_sha256
+ },
+ doctor:{verified_entries:health.manifest.verified_entries},
+ gates:{
+  r56_focused:true,
+  package_boundary:true,
+  full_regression:true,
+  manifest_final_verify:true,
+  four_hour_soak_completed:false
+ }
+};
+const bytes=Buffer.from(JSON.stringify(evidence,null,2)+'\n');
+const dir=path.join(stateRoot,'evidence','release');
+await mkdir(dir,{recursive:true});
+const target=path.join(dir,`r56-windows-gate-${manifestSha256.slice(0,16)}.json`);
+try{
+ const handle=await open(target,'wx',0o600);
+ try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+}catch(error){
+ if(error?.code!=='EEXIST')throw error;
+ const prior=JSON.parse(await readFile(target,'utf8'));
+ insist(prior.schema===evidence.schema&&prior.status==='passed'&&prior.version===evidence.version&&prior.manifest_sha256===manifestSha256,'conflicting R56 gate evidence identity');
+}
+console.log(JSON.stringify({status:'passed',path:target,sha256:sha256(bytes),manifest_sha256:manifestSha256}));

package/scripts/windows-gate-evidence-r57.mjs

@@ -0,0 +1,81 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { doctor } from '../src/doctor-r45.mjs';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const insist=(ok,message)=>{if(!ok)throw new Error(message);};
+const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
+const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
+const provenance=JSON.parse(await readFile(path.join(root,'PROVENANCE.json'),'utf8'));
+const matrix=JSON.parse(await readFile(path.join(root,'TEST-MATRIX.json'),'utf8'));
+const active=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+const manifestSha256=sha256(await readFile(path.join(root,'MANIFEST.SHA256')));
+
+insist(pkg.version==='0.15.34'&&release.version===pkg.version&&release.train==='R57','R57 candidate identity mismatch');
+insist(release.parent.version==='0.15.33','R57 parent mismatch');
+insist(release.parent.manifest_sha256==='776a51cb916e28ddc3cbb2ecd3857151a0e73e0aaf83d4e6308e6674125dd01c','R57 parent manifest mismatch');
+insist(release.parent.generation_manifest_sha256==='20ccc5e4bbf8470b61e0a6d2ad181dad5e8533da980ceba7749e1d6f48d9dbd3','R57 parent generation mismatch');
+insist(release.parent.tarball_sha256==='d84a6df0a972a43c50d5e31242d9217f59858b2d73c4284af296da76d2048e5f','R57 parent tarball mismatch');
+insist(
+  active.release_id===release.runtime_predecessor.release_id&&
+  active.manifest_sha256===release.runtime_predecessor.manifest_sha256&&
+  active.generation_manifest_sha256===release.runtime_predecessor.generation_manifest_sha256,
+  'active runtime is not exact sealed 0.15.33 predecessor'
+);
+insist(release.hotfix?.bounded_core_discovery_after_online===true,'R57 bounded core discovery missing');
+insist(release.hotfix?.retry_only_missing_core===true,'R57 zero-child-only retry contract missing');
+insist(release.hotfix?.ambiguous_core_fail_closed===true,'R57 ambiguous-core fail-closed contract missing');
+insist(release.hotfix?.timeout_fail_closed===true,'R57 timeout fail-closed contract missing');
+insist(release.hotfix?.full_regression==='PASS','R57 full regression metadata is not PASS');
+insist(matrix.observed_pre_release_evidence?.full_regression?.status==='PASS','R57 full regression evidence is not PASS');
+insist(provenance.operator_override?.stable_final_claim===false,'R57 must not claim stable/final');
+insist(matrix.operator_override?.four_hour_soak==='NOT_COMPLETED','R57 matrix must preserve soak bypass');
+
+const health=await doctor();
+insist(health.status==='ok'&&health.package_version===pkg.version&&health.manifest?.verified===true,'R57 doctor evidence invalid');
+
+const evidenceBody={
+ schema:'deadbyte.r57-windows-gate.v1',
+ status:'passed',
+ exit_code:0,
+ version:pkg.version,
+ train:'R57',
+ completed_at_utc:new Date().toISOString(),
+ manifest_sha256:manifestSha256,
+ parent:release.parent,
+ runtime_predecessor:release.runtime_predecessor,
+ hotfix:release.hotfix,
+ operator_override:provenance.operator_override,
+ active_predecessor:{
+  release_id:active.release_id,
+  version:active.version,
+  manifest_sha256:active.manifest_sha256,
+  generation_manifest_sha256:active.generation_manifest_sha256
+ },
+ doctor:{verified_entries:health.manifest.verified_entries},
+ gates:{
+  r57_focused:true,
+  package_boundary:true,
+  full_regression:true,
+  manifest_final_verify:true,
+  four_hour_soak_completed:false
+ }
+};
+const bytes=Buffer.from(JSON.stringify(evidenceBody,null,2)+'\n');
+const dir=path.join(stateRoot,'evidence','release');
+await mkdir(dir,{recursive:true});
+const target=path.join(dir,`r57-windows-gate-${manifestSha256.slice(0,16)}.json`);
+try{
+ const handle=await open(target,'wx',0o600);
+ try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+}catch(error){
+ if(error?.code!=='EEXIST')throw error;
+ const prior=JSON.parse(await readFile(target,'utf8'));
+ insist(prior.schema===evidenceBody.schema&&prior.status==='passed'&&prior.version===evidenceBody.version&&prior.manifest_sha256===manifestSha256,'conflicting R57 gate evidence identity');
+}
+console.log(JSON.stringify({status:'passed',path:target,sha256:sha256(bytes),manifest_sha256:manifestSha256}));

package/src/runtime-update.mjs

@@ -743,6 +743,37 @@ export function selectCoreProcess(processes,coreRoot,bridgePid,verifiedBridge=nu
 function coreProcess(coreRoot,bridge){
   return selectCoreProcess(nodeProcesses(),coreRoot,bridge.pid,bridge);
 }
+export async function waitForCoreProcess(coreRoot,bridge,{
+  timeoutMs=10000,
+  pollMs=100,
+  processProvider=nodeProcesses,
+  sleepFn=sleep,
+  nowFn=Date.now
+}={}){
+  const bridgePid=Number(bridge?.pid);
+  if(!Number.isInteger(bridgePid)||bridgePid<1) throw new Error('downstream core wait requires verified bridge PID');
+  if(!Number.isFinite(timeoutMs)||timeoutMs<0) throw new Error('downstream core wait timeout invalid');
+  if(!Number.isFinite(pollMs)||pollMs<1) throw new Error('downstream core wait poll invalid');
+  if(typeof processProvider!=='function'||typeof sleepFn!=='function'||typeof nowFn!=='function') throw new Error('downstream core wait hooks invalid');
+  const started=Number(nowFn());
+  let lastError=null;
+  while(true){
+    try {
+      const processes=await processProvider();
+      return selectCoreProcess(processes,coreRoot,bridgePid,bridge);
+    } catch(error){
+      const message=String(error?.message??error);
+      const transient=`expected one unambiguous downstream core for bridge ${bridgePid}, found children=0 visible_matches=0`;
+      if(message!==transient) throw error;
+      lastError=error;
+    }
+    const elapsed=Math.max(0,Number(nowFn())-started);
+    if(elapsed>=timeoutMs){
+      throw new Error(`downstream core did not appear for bridge ${bridgePid} within ${timeoutMs}ms: ${String(lastError?.message??lastError)}`);
+    }
+    await sleepFn(Math.min(pollMs,Math.max(1,timeoutMs-elapsed)));
+  }
+}
 async function captureRuntime(ctx){
   const statusText=controllerCaptured(ctx,'status',15000); const status=parseControllerStatus(statusText);
   if(!status.online||!status.bridge_pid||!status.cloud_pid||!status.local_ready) throw new Error(`slot update requires ONLINE runtime: ${statusText}`);
@@ -826,7 +857,7 @@ async function startAndVerify(ctx,oldRuntime){
     catch {} await sleep(500);
   }
   if(!status?.online||!status.bridge_pid||!status.cloud_pid||!status.local_ready) throw new Error(`new runtime failed ONLINE gate: ${statusText}`);
-  const bridge=await readLedger(ctx,'bridge'); const cloud=await readLedger(ctx,'cloud'); const core=coreProcess(ctx.core_root,bridge);
+  const bridge=await readLedger(ctx,'bridge'); const cloud=await readLedger(ctx,'cloud'); const core=await waitForCoreProcess(ctx.core_root,bridge);
   if(oldRuntime?.bridge&&sameGeneration(oldRuntime.bridge,bridge)) throw new Error('fresh bridge generation gate failed');
   if(oldRuntime?.cloud&&sameGeneration(oldRuntime.cloud,cloud)) throw new Error('fresh cloud generation gate failed');
   if(oldRuntime?.core&&oldRuntime.core.pid===core.pid&&oldRuntime.core.creation_date===core.creation_date) throw new Error('fresh downstream core generation gate failed');
@@ -861,16 +892,21 @@ async function verifyPackageRoot(root,expectedVersion,expectedManifest,label){
   if(pkg?.name!=='deadbyte-mcp'||pkg?.version!==expectedVersion) throw new Error(`${label} package identity mismatch`);
   return {root:absolute,manifest_sha256:digest,entries:entries.size};
 }
-async function verifyActiveInstallation(stateRoot,pointer){
+async function verifyStoredInstallation(stateRoot,pointer){
   const state=path.resolve(stateRoot); const expectedRelease=path.join(state,'releases',releaseId(pointer.version,pointer.manifest_sha256));
   if(path.resolve(pointer.release_root)!==path.resolve(expectedRelease)) throw new Error('active pointer release root is not content-addressed store path');
   const release=await verifyPackageRoot(pointer.release_root,pointer.version,pointer.manifest_sha256,'active release');
   const generation=await verifyGenerationBundle(pointer.generation_root,pointer.generation_manifest_sha256);
   const expectedConfig=path.join(path.resolve(pointer.generation_root),'controller-config.psd1');
   if(path.resolve(pointer.config_path)!==path.resolve(expectedConfig)) throw new Error('active pointer config path mismatch');
+  return {release,generation};
+}
+async function verifyActiveInstallation(stateRoot,pointer){
+  const state=path.resolve(stateRoot);
+  const verified=await verifyStoredInstallation(state,pointer);
   const currentLauncher=await sha256File(launcherPath(state));
   if(currentLauncher!==pointer.launcher_sha256) throw new Error('active pointer launcher digest mismatch');
-  return {release,generation};
+  return verified;
 }
 async function loadPointerIfPresent(stateRoot){
   const file=path.join(path.resolve(stateRoot),'active-release.json');
@@ -1084,6 +1120,41 @@ function decodeSnapshot(snapshot,label){
   }
   return {exists:false,bytes:null,sha256:null};
 }
+export function rollbackLauncherPlanFromHandoff(body,priorPointer,activePointer,stateRoot=DEFAULT_STATE_ROOT){
+  if(!body||typeof body!=='object') throw new Error('rollback handoff body required');
+  const handoffPrior=body.prior_pointer?parseActivePointer(JSON.stringify(body.prior_pointer)):null;
+  const handoffActive=body.new_pointer?parseActivePointer(JSON.stringify(body.new_pointer)):null;
+  if(!samePublicPointer(handoffPrior,priorPointer)||!samePublicPointer(handoffActive,activePointer)) throw new Error('rollback handoff pointer binding mismatch');
+  const state=path.resolve(stateRoot);
+  const launchers={
+    ps1:path.resolve(String(body.launchers?.ps1??'')),
+    cmd:path.resolve(String(body.launchers?.cmd??'')),
+    top:path.resolve(String(body.launchers?.top??TOP_LAUNCHER)),
+    launcher_sha256:String(body.launchers?.launcher_sha256??''),
+    ps1Bytes:Buffer.from(String(body.launchers?.ps1_bytes??''),'base64'),
+    cmdBytes:Buffer.from(String(body.launchers?.cmd_bytes??''),'base64'),
+    snapshots:{
+      ps1:decodeSnapshot(body.launchers?.snapshots?.ps1,'rollback.launcher.ps1'),
+      cmd:decodeSnapshot(body.launchers?.snapshots?.cmd,'rollback.launcher.cmd'),
+      top:decodeSnapshot(body.launchers?.snapshots?.top,'rollback.launcher.top')
+    },
+    installed:true
+  };
+  if(launchers.ps1!==path.resolve(launcherPath(state))||
+     launchers.cmd!==path.resolve(path.join(state,'bin','DEADBYTE-MCP.cmd'))||
+     launchers.top!==path.resolve(TOP_LAUNCHER)) throw new Error('rollback launcher paths are not canonical');
+  if(!HEX64.test(launchers.launcher_sha256)||sha256Bytes(launchers.ps1Bytes)!==launchers.launcher_sha256) throw new Error('rollback successor launcher bytes/hash mismatch');
+  if(launchers.launcher_sha256!==activePointer.launcher_sha256) throw new Error('rollback successor launcher hash does not match active pointer');
+  if(!launchers.snapshots.ps1.exists||launchers.snapshots.ps1.sha256!==priorPointer.launcher_sha256) throw new Error('rollback predecessor launcher snapshot does not match signed prior pointer');
+  return launchers;
+}
+async function restoreRollbackLaunchers(plan){
+  await restoreFile(plan.ps1,plan.snapshots.ps1);
+  await restoreFile(plan.cmd,plan.snapshots.cmd);
+  await restoreFile(plan.top,plan.snapshots.top);
+  if(await sha256File(plan.ps1)!==plan.snapshots.ps1.sha256) throw new Error('rollback predecessor launcher restore hash mismatch');
+  return plan;
+}
 const UPDATE_PHASE_RANK=Object.freeze({
   initial:0,candidate_prepared:10,old_runtime_verified:20,shutdown_handoff_armed:25,supervisor_spawned:30,
   authority_revoked:40,old_runtime_stopped:50,workspace_ready:60,launcher_installed:70,pointer_committed:80,
@@ -1587,19 +1658,28 @@ export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_S
   const activePointer=parseActivePointer(JSON.stringify(activationEnvelope.body.active_pointer));
   const pointerInfo=await loadPointerIfPresent(state);
   if(!pointerInfo.pointer||canonicalJson(publicPointer(pointerInfo.pointer))!==canonicalJson(publicPointer(activePointer))) throw new Error('rollback current pointer does not match signed activation pointer');
-  await verifyActiveInstallation(state,priorPointer);
+
+  const handoffPath=path.join(path.dirname(receiptFile),'handoff.json');
+  const {body:handoffBody}=await readHandoffEnvelope(handoffPath,state);
+  if(handoffBody.update_id!==activationEnvelope.body.update_id) throw new Error('rollback handoff update identity mismatch');
+  const rollbackLaunchers=rollbackLauncherPlanFromHandoff(handoffBody,priorPointer,activePointer,state);
+  await verifyStoredInstallation(state,priorPointer);
+
   const currentCtx=slotContext(state,pointerInfo.pointer),currentRuntime=await captureRuntime(currentCtx);
   const revoked=await revokeAuthority(currentCtx,currentRuntime.status);
   const rollbackId=`r31-rollback-${activationEnvelope.receipt_sha256.slice(0,16)}-${Date.now().toString(36)}-${randomBytes(4).toString('hex')}`;
   const evidenceDir=path.join(state,'evidence','updates',rollbackId),statePath=path.join(evidenceDir,'state.json'),receiptPath=path.join(evidenceDir,'receipt.json');
   await mkdir(evidenceDir,{recursive:true});
   const journal={schema:'deadbyte.r31-slot-rollback-state.v1',rollback_id:rollbackId,activation_receipt:path.resolve(receiptFile),
-    activation_receipt_sha256:activationEnvelope.receipt_sha256,from_pointer:publicPointer(activePointer),to_pointer:publicPointer(priorPointer),created_at_utc:new Date().toISOString()};
+    activation_receipt_sha256:activationEnvelope.receipt_sha256,handoff_path:handoffPath,
+    from_pointer:publicPointer(activePointer),to_pointer:publicPointer(priorPointer),created_at_utc:new Date().toISOString()};
   await writeState(statePath,journal,'verified');
-  let stopped=false,pointerCommitted=false,priorCtx=null,priorRuntime=null;
+  let stopped=false,launchersRestored=false,pointerCommitted=false,priorCtx=null,priorRuntime=null;
   try {
     await stopAndVerify(currentCtx,currentRuntime); stopped=true;
     await writeState(statePath,journal,'successor_stopped');
+    await restoreRollbackLaunchers(rollbackLaunchers); launchersRestored=true;
+    await writeState(statePath,journal,'predecessor_launcher_restored',{launcher_sha256:priorPointer.launcher_sha256});
     await atomicWriteActivePointer(pointerInfo.file,priorPointer); pointerCommitted=true;
     await verifyActiveInstallation(state,priorPointer);
     await writeState(statePath,journal,'prior_pointer_restored',{active_pointer:publicPointer(priorPointer)});
@@ -1610,16 +1690,27 @@ export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_S
     if(finalStatus.process_armed||finalStatus.coding_armed||finalStatus.autonomous_armed||finalStatus.desktop_armed||finalStatus.host_armed) throw new Error('rollback predecessor authority must remain disarmed');
     const body={schema:ROLLBACK_SCHEMA,rollback_id:rollbackId,activation_receipt_sha256:activationEnvelope.receipt_sha256,
       completed_at_utc:new Date().toISOString(),from_pointer:publicPointer(activePointer),active_pointer:publicPointer(priorPointer),
-      old_runtime:generationTuple(currentRuntime),new_runtime:generationTuple(priorRuntime),stabilization,authority_revoked:revoked.revoked,rollback_performed:true};
+      launcher_restored:true,old_runtime:generationTuple(currentRuntime),new_runtime:generationTuple(priorRuntime),stabilization,
+      authority_revoked:revoked.revoked,rollback_performed:true};
     const receipt=await writeEnvelope(receiptPath,body,key);
     await writeState(statePath,journal,'completed',{receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256});
     return {ok:true,rollback_id:rollbackId,state_path:statePath,receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256,pointer:priorPointer,new_runtime:priorRuntime};
   } catch(error){
-    const recovery={attempted:false,prior_runtime_stopped:false,successor_pointer_restored:false,successor_runtime_restarted:false,errors:[]};
+    const recovery={attempted:false,prior_runtime_stopped:false,successor_launcher_restored:false,successor_pointer_restored:false,successor_runtime_restarted:false,errors:[]};
     if(stopped){
       recovery.attempted=true;
       if(pointerCommitted&&priorCtx){ try { controllerCaptured(priorCtx,'stop',30000); recovery.prior_runtime_stopped=true; } catch(recoveryError){ recovery.errors.push(`stop-prior:${recoveryError.message}`); } }
-      if(pointerCommitted){ try { await atomicWriteActivePointer(pointerInfo.file,activePointer); await verifyActiveInstallation(state,activePointer); recovery.successor_pointer_restored=true; } catch(recoveryError){ recovery.errors.push(`restore-pointer:${recoveryError.message}`); } }
+      if(launchersRestored){
+        try { await installLaunchers(rollbackLaunchers); recovery.successor_launcher_restored=true; }
+        catch(recoveryError){ recovery.errors.push(`restore-successor-launcher:${recoveryError.message}`); }
+      }
+      if(pointerCommitted){
+        try { await atomicWriteActivePointer(pointerInfo.file,activePointer); await verifyActiveInstallation(state,activePointer); recovery.successor_pointer_restored=true; }
+        catch(recoveryError){ recovery.errors.push(`restore-pointer:${recoveryError.message}`); }
+      }else if(recovery.successor_launcher_restored){
+        try { await verifyActiveInstallation(state,activePointer); recovery.successor_pointer_restored=true; }
+        catch(recoveryError){ recovery.errors.push(`verify-successor-pointer:${recoveryError.message}`); }
+      }
       try { await startAndVerify(currentCtx,currentRuntime); recovery.successor_runtime_restarted=true; } catch(recoveryError){ recovery.errors.push(`restart-successor:${recoveryError.message}`); }
     }
     await writeState(statePath,journal,'failed',{error:{name:error?.name??'Error',message:String(error?.message??error)},recovery}).catch(()=>{});

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.32';
+export const DEADBYTE_VERSION = '0.15.34';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/r49-windows-gate.test.mjs

@@ -4,9 +4,13 @@ import test from 'node:test';
 
 const read=path=>readFile(new URL(`../${path}`,import.meta.url),'utf8');
 
-test('R55 canonical Windows gate is successor-bound and preserves R54/R53/R52/R51/R50/R49 historical gates',async()=>{
-  const [pkgText,gate,evidence,historicalR54,historicalEvidenceR54,historicalR53,historicalEvidenceR53,historicalR52,historicalEvidenceR52,historicalR51,historicalEvidenceR51,historicalR50,historicalR49,deferred]=await Promise.all([
+test('R57 canonical Windows gate is successor-bound and preserves R56/R55/R54/R53/R52/R51/R50/R49 historical gates',async()=>{
+  const [pkgText,gate,evidence,historicalR56,historicalEvidenceR56,historicalR55,historicalEvidenceR55,historicalR54,historicalEvidenceR54,historicalR53,historicalEvidenceR53,historicalR52,historicalEvidenceR52,historicalR51,historicalEvidenceR51,historicalR50,historicalR49,deferred]=await Promise.all([
     read('package.json'),
+    read('scripts/gate-windows-r57.ps1'),
+    read('scripts/windows-gate-evidence-r57.mjs'),
+    read('scripts/gate-windows-r56.ps1'),
+    read('scripts/windows-gate-evidence-r56.mjs'),
     read('scripts/gate-windows-r55.ps1'),
     read('scripts/windows-gate-evidence-r55.mjs'),
     read('scripts/gate-windows-r54.ps1'),
@@ -22,18 +26,22 @@ test('R55 canonical Windows gate is successor-bound and preserves R54/R53/R52/R5
     read('scripts/deferred-slot-operation-r46.mjs')
   ]);
   const pkg=JSON.parse(pkgText);
-  assert.match(pkg.scripts['gate:windows'],/gate-windows-r55\.ps1$/);
-  assert.match(gate,/DEADBYTE 0\.15\.32 \/ R55 WINDOWS GATE: PASS/);
-  assert.match(gate,/r55-package-boundary/);
-  assert.match(gate,/r55-focused-contracts/);
-  assert.match(gate,/full-regression/);
+  assert.match(pkg.scripts['gate:windows'],/gate-windows-r57\.ps1$/);
+  assert.match(gate,/DEADBYTE 0\.15\.34 \/ R57 WINDOWS GATE: PASS/);
+  assert.match(gate,/r57-package-boundary/);
+  assert.match(gate,/r57-focused-contracts/);
+  assert.match(gate,/full-regression-evidence/);
   assert.match(gate,/manifest-verify/);
   assert.match(gate,/doctor/);
-  assert.match(evidence,/deadbyte\.r55-windows-gate\.v1/);
-  assert.match(evidence,/pkg\.version==='0\.15\.32'/);
-  assert.match(evidence,/release\.train==='R55'/);
-  assert.match(evidence,/release\.parent\.version==='0\.15\.31'/);
+  assert.match(evidence,/deadbyte\.r57-windows-gate\.v1/);
+  assert.match(evidence,/pkg\.version==='0\.15\.34'/);
+  assert.match(evidence,/release\.train==='R57'/);
+  assert.match(evidence,/release\.parent\.version==='0\.15\.33'/);
   assert.match(evidence,/four_hour_soak_completed:false/);
+  assert.match(historicalR56,/DEADBYTE 0\.15\.33 \/ R56 WINDOWS GATE: PASS/);
+  assert.match(historicalEvidenceR56,/deadbyte\.r56-windows-gate\.v1/);
+  assert.match(historicalR55,/DEADBYTE 0\.15\.32 \/ R55 WINDOWS GATE: PASS/);
+  assert.match(historicalEvidenceR55,/deadbyte\.r55-windows-gate\.v1/);
   assert.match(historicalR54,/DEADBYTE 0\.15\.31 \/ R54 WINDOWS GATE: PASS/);
   assert.match(historicalEvidenceR54,/deadbyte\.r54-windows-gate\.v1/);
   assert.match(historicalR53,/DEADBYTE 0\.15\.30 \/ R53 WINDOWS GATE: PASS/);
@@ -46,10 +54,5 @@ test('R55 canonical Windows gate is successor-bound and preserves R54/R53/R52/R5
   assert.match(historicalR49,/DEADBYTE 0\.15\.26 \/ R49 WINDOWS GATE: PASS/);
   assert.match(deferred,/const expectedVersion=packageIdentity\.version/);
   assert.match(deferred,/'--expected-version',expectedVersion/);
-  assert.match(deferred,/async function awaitHandoffCompletion/);
   assert.match(deferred,/verifySlotUpdateEnvelope\(envelope,publicKey\)/);
-  assert.match(deferred,/active pointer does not match signed activation receipt/);
-  assert.match(deferred,/failure-receipt\.json/);
-  assert.match(deferred,/await awaitHandoffCompletion\(await runSlotUpdateCli/);
-  assert.doesNotMatch(deferred,/'--expected-version','0\.15\.5'/);
 });

package/test/r55-release-contract.test.mjs

@@ -5,8 +5,10 @@ import { readFile } from 'node:fs/promises';
 const root=new URL('../',import.meta.url);
 const read=rel=>readFile(new URL(rel,root),'utf8');
 const json=rel=>read(rel).then(JSON.parse);
+const currentPackage=await json('package.json');
+const r55test=currentPackage.version==='0.15.32'?test:test.skip;
 
-test('R55 release identity is coherent across package lock source metadata SBOM and gate',async()=>{
+r55test('R55 release identity is coherent across package lock source metadata SBOM and gate',async()=>{
   const [pkg,lock,release,provenance,matrix,sbom,versionSource]=await Promise.all([
     json('package.json'),json('package-lock.json'),json('RELEASE.json'),json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs')
   ]);
@@ -25,7 +27,7 @@ test('R55 release identity is coherent across package lock source metadata SBOM
   assert.match(pkg.scripts['r55:focused:test'],/r55-offline-predecessor-guardian-family\.test\.mjs/);
 });
 
-test('R55 source predecessor is exact immutable published 0.15.31 while runtime predecessor remains exact 0.15.29',async()=>{
+r55test('R55 source predecessor is exact immutable published 0.15.31 while runtime predecessor remains exact 0.15.29',async()=>{
   const [release,provenance]=await Promise.all([json('RELEASE.json'),json('PROVENANCE.json')]);
   assert.equal(release.parent.version,'0.15.31');
   assert.equal(release.parent.release_id,'v0.15.31-16854fe5b3eb0fa1');
@@ -44,7 +46,7 @@ test('R55 source predecessor is exact immutable published 0.15.31 while runtime
   assert.deepEqual(provenance.runtime_predecessor,release.runtime_predecessor);
 });
 
-test('R55 records the guardian sibling RED to GREEN and preserves fail-closed negative controls',async()=>{
+r55test('R55 records the guardian sibling RED to GREEN and preserves fail-closed negative controls',async()=>{
   const [release,provenance,matrix]=await Promise.all([json('RELEASE.json'),json('PROVENANCE.json'),json('TEST-MATRIX.json')]);
   assert.equal(release.hotfix.activation_ancestry_excluded,true);
   assert.equal(release.hotfix.foreground_guardian_owner_parent_binding,true);

package/test/r56-release-contract.test.mjs

@@ -0,0 +1,65 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+
+const root=new URL('../',import.meta.url);
+const read=rel=>readFile(new URL(rel,root),'utf8');
+const json=rel=>read(rel).then(JSON.parse);
+const currentPackage=await json('package.json');
+const r56test=currentPackage.version==='0.15.33'?test:test.skip;
+
+r56test('R56 release identity is coherent across package lock source metadata SBOM and gate',async()=>{
+  const [pkg,lock,release,provenance,matrix,sbom,versionSource]=await Promise.all([
+    json('package.json'),json('package-lock.json'),json('RELEASE.json'),json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs')
+  ]);
+  assert.equal(pkg.version,'0.15.33');
+  assert.equal(lock.version,pkg.version);
+  assert.equal(lock.packages[''].version,pkg.version);
+  assert.match(versionSource,/DEADBYTE_VERSION = '0\.15\.33'/);
+  assert.equal(release.version,pkg.version);
+  assert.equal(release.train,'R56');
+  assert.equal(provenance.version,pkg.version);
+  assert.equal(matrix.version,pkg.version);
+  assert.equal(matrix.train,'R56');
+  assert.equal(sbom.metadata.component.version,pkg.version);
+  assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r56:0.15.33');
+  assert.match(pkg.scripts['gate:windows'],/gate-windows-r56\.ps1/);
+  assert.match(pkg.scripts['r56:focused:test'],/r56-rollback-launcher-restore\.test\.mjs/);
+});
+
+r56test('R56 source and runtime predecessor are exact active published 0.15.32',async()=>{
+  const [release,provenance]=await Promise.all([json('RELEASE.json'),json('PROVENANCE.json')]);
+  assert.equal(release.parent.version,'0.15.32');
+  assert.equal(release.parent.release_id,'v0.15.32-e7223f467777f5df');
+  assert.equal(release.parent.manifest_sha256,'e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b');
+  assert.equal(release.parent.generation_manifest_sha256,'740443fd207c5e6ffd5952079214bf6e81e9281a6ec880de9bbe3b8ce1deb00e');
+  assert.equal(release.parent.tarball_sha256,'c9e1f5875dd2177cee0089305b40321c128c54ce7f5522e34e507d4ecfb22638');
+  assert.equal(release.parent.activation_status,'ACTIVATED_ROLLBACK_DEFECT_OBSERVED');
+  assert.equal(release.source_predecessor.version,'0.15.32');
+  assert.deepEqual(release.runtime_predecessor,{
+    release_id:'v0.15.32-e7223f467777f5df',
+    manifest_sha256:'e7223f467777f5dfeb20fd2cc7a6eca22619a44ed95e5bc0b32d9c7aabba361b',
+    generation_manifest_sha256:'740443fd207c5e6ffd5952079214bf6e81e9281a6ec880de9bbe3b8ce1deb00e'
+  });
+  assert.equal(provenance.parent_manifest_sha256,release.parent.manifest_sha256);
+  assert.equal(provenance.parent_generation_manifest_sha256,release.parent.generation_manifest_sha256);
+  assert.deepEqual(provenance.runtime_predecessor,release.runtime_predecessor);
+});
+
+r56test('R56 records signed rollback launcher ordering RED to GREEN and preserves non-final claim',async()=>{
+  const [release,provenance,matrix]=await Promise.all([json('RELEASE.json'),json('PROVENANCE.json'),json('TEST-MATRIX.json')]);
+  assert.equal(release.hotfix.signed_handoff_launcher_snapshot_required,true);
+  assert.equal(release.hotfix.stored_predecessor_verified_without_live_launcher,true);
+  assert.equal(release.hotfix.predecessor_launcher_restored_before_pointer_commit,true);
+  assert.equal(release.hotfix.successor_launcher_restored_before_recovery_pointer,true);
+  assert.equal(release.hotfix.exact_parent_activation_receipt_sha256,'6518a04154f485cfae42e582269634d69a8b05a0183149d5e10006fbdd9d933c');
+  assert.equal(release.hotfix.observed_parent_rollback_failure_receipt_sha256,'00cbd497e4902c67ab39313a378e2fcf32159113b46339ad1d54b5e5a7714205');
+  assert.equal(release.hotfix.red_parent_0_15_32,'FAIL_5_OF_5');
+  assert.equal(release.hotfix.green_r56_candidate,'PASS_5_OF_5');
+  assert.equal(matrix.observed_pre_release_evidence.red_parent_0_15_32.receipt_sha256,'f3b446306691d61e97896ab4d237abaa20d1243237299812e790233c46451dba');
+  assert.equal(matrix.observed_pre_release_evidence.green_r56_candidate.receipt_sha256,'4198930f38a3fc4b7978cfc94ca4509127561c170b05f7566bdf79513e449a8b');
+  assert.equal(release.hotfix.stable_final_claim,false);
+  assert.equal(provenance.operator_override.four_hour_soak,'NOT_COMPLETED');
+  assert.equal(provenance.operator_override.stable_final_claim,false);
+  assert.equal(matrix.operator_override.stable_final_claim,false);
+});

package/test/r56-rollback-launcher-restore.test.mjs

@@ -0,0 +1,103 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { pathToFileURL } from 'node:url';
+import os from 'node:os';
+import path from 'node:path';
+
+const target=process.env.R56_RUNTIME_UPDATE_PATH
+  ? path.resolve(process.env.R56_RUNTIME_UPDATE_PATH)
+  : path.resolve(new URL('../src/runtime-update.mjs',import.meta.url).pathname.replace(/^\/(?:[A-Za-z]:)/,m=>m.slice(1)));
+const runtimeUpdate=await import(pathToFileURL(target).href+'?r56='+Date.now());
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const stateRoot=path.resolve(process.env.R56_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const topLauncher=path.resolve(path.join(os.homedir(),'Downloads','DEADBYTE-MCP.cmd'));
+
+function pointer(version,manifest,launcher){
+  const releaseId=`v${version}-${manifest.slice(0,16)}`;
+  const genId=`${releaseId}-g${'9'.repeat(16)}`;
+  return {
+    schema:'deadbyte.active-release.v1',
+    release_id:releaseId,
+    version,
+    manifest_sha256:manifest,
+    release_root:path.join(stateRoot,'releases',releaseId),
+    generation_root:path.join(stateRoot,'generations',genId),
+    generation_manifest_sha256:'8'.repeat(64),
+    launcher_sha256:launcher,
+    config_path:path.join(stateRoot,'generations',genId,'controller-config.psd1')
+  };
+}
+function snapshot(bytes){
+  const b=Buffer.from(bytes);
+  return {exists:true,sha256:sha256(b),bytes_base64:b.toString('base64')};
+}
+function fixture(){
+  const priorBytes=Buffer.from('prior-launcher-r55\r\n');
+  const activeBytes=Buffer.from('active-launcher-r56\r\n');
+  const cmdBytes=Buffer.from('@echo off\r\n');
+  const prior=pointer('0.15.29','1'.repeat(64),sha256(priorBytes));
+  const active=pointer('0.15.32','2'.repeat(64),sha256(activeBytes));
+  const body={
+    prior_pointer:prior,
+    new_pointer:active,
+    launchers:{
+      ps1:path.join(stateRoot,'bin','DEADBYTE-MCP.ps1'),
+      cmd:path.join(stateRoot,'bin','DEADBYTE-MCP.cmd'),
+      top:topLauncher,
+      launcher_sha256:sha256(activeBytes),
+      ps1_bytes:activeBytes.toString('base64'),
+      cmd_bytes:cmdBytes.toString('base64'),
+      snapshots:{
+        ps1:snapshot(priorBytes),
+        cmd:snapshot(cmdBytes),
+        top:snapshot(cmdBytes)
+      }
+    }
+  };
+  return {prior,active,body};
+}
+
+test('R56 exposes rollback launcher planning from the signed activation handoff',()=>{
+  assert.equal(typeof runtimeUpdate.rollbackLauncherPlanFromHandoff,'function');
+});
+
+test('R56 accepts a prior launcher snapshot whose hash differs from the active launcher and binds both signed pointers',()=>{
+  const {prior,active,body}=fixture();
+  const plan=runtimeUpdate.rollbackLauncherPlanFromHandoff(body,prior,active,stateRoot);
+  assert.equal(plan.snapshots.ps1.sha256,prior.launcher_sha256);
+  assert.equal(plan.launcher_sha256,active.launcher_sha256);
+  assert.notEqual(plan.snapshots.ps1.sha256,plan.launcher_sha256);
+});
+
+test('R56 rejects a predecessor launcher snapshot that does not match the signed prior pointer',()=>{
+  const {prior,active,body}=fixture();
+  body.launchers.snapshots.ps1=snapshot(Buffer.from('wrong-prior-launcher\r\n'));
+  assert.throws(()=>runtimeUpdate.rollbackLauncherPlanFromHandoff(body,prior,active,stateRoot),/predecessor launcher snapshot/i);
+});
+
+test('R56 rejects handoff pointer drift instead of using unsigned rollback state',()=>{
+  const {prior,active,body}=fixture();
+  const drift={...prior,manifest_sha256:'3'.repeat(64),release_id:`v0.15.29-${'3'.repeat(16)}`,release_root:path.join(stateRoot,'releases',`v0.15.29-${'3'.repeat(16)}`)};
+  assert.throws(()=>runtimeUpdate.rollbackLauncherPlanFromHandoff(body,drift,active,stateRoot),/pointer binding mismatch/i);
+});
+
+test('R56 rollback verifies stored predecessor bytes before stop, restores signed predecessor launcher before pointer commit, and reinstalls successor launcher before recovery pointer',async()=>{
+  const source=await readFile(target,'utf8');
+  const start=source.indexOf('export async function performSlotRollback');
+  const end=source.indexOf('export async function runSlotUpdateCli',start);
+  assert.ok(start>=0&&end>start);
+  const perform=source.slice(start,end);
+  const stored=perform.indexOf('verifyStoredInstallation(state,priorPointer)');
+  const stop=perform.indexOf('stopAndVerify(currentCtx,currentRuntime)');
+  const restoreLauncher=perform.indexOf('restoreRollbackLaunchers(rollbackLaunchers)');
+  const commit=perform.indexOf('atomicWriteActivePointer(pointerInfo.file,priorPointer)');
+  const verifyPrior=perform.indexOf('verifyActiveInstallation(state,priorPointer)');
+  const reinstall=perform.indexOf('installLaunchers(rollbackLaunchers)');
+  const restoreSuccessor=perform.indexOf('atomicWriteActivePointer(pointerInfo.file,activePointer)');
+  assert.ok(stored>=0&&stored<stop);
+  assert.ok(restoreLauncher>stop&&restoreLauncher<commit);
+  assert.ok(verifyPrior>commit);
+  assert.ok(reinstall>verifyPrior&&reinstall<restoreSuccessor);
+});