deadbyte-mcp 0.15.44 → 0.15.45

package/src/runtime-update.mjs

@@ -1,1896 +1,2056 @@
-import { createHash, createPrivateKey, createPublicKey, randomBytes, sign as cryptoSign, verify as cryptoVerify } from 'node:crypto';
-import { spawn, spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm, writeFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import {
-  atomicWriteActivePointer,
-  materializeReleaseSlot,
-  parseActivePointer,
-  parseManifest,
-  releaseId,
-  renderStableLauncherCmd,
-  renderStableLauncherPs1,
-  sha256Bytes,
-  verifyManifestTree
-} from './release-slot.mjs';
-import { createGenerationBundle, verifyGenerationBundle } from './release-generation.mjs';
-import { resolveStateRoot } from './state-root.mjs';
-
-const HEX64=/^[0-9a-f]{64}$/;
-const SEMVER=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
-const RECEIPT_DOMAIN=Buffer.from('DEADBYTE-R27-SLOT-UPDATE-V1\0','utf8');
-const UPDATE_SCHEMA='deadbyte.r27-slot-update-receipt.v1';
-const HANDOFF_SCHEMA='deadbyte.r27-slot-update-handoff.v1';
-const FAILURE_SCHEMA='deadbyte.r27-slot-update-failure.v1';
-const ROLLBACK_SCHEMA='deadbyte.r31-slot-rollback-receipt.v1';
-const ROLLBACK_FAILURE_SCHEMA='deadbyte.r31-slot-rollback-failure.v1';
-const DEFAULT_STATE_ROOT=undefined;
-const TOP_LAUNCHER=path.join(os.homedir(),'Downloads','DEADBYTE-MCP.cmd');
-const RUNTIME_STABILITY_MS=12000;
-const RUNTIME_STABILITY_POLL_MS=500;
-
-const sha256File=async file=>sha256Bytes(await readFile(file));
-const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
-const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
-  ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
-const canonicalJson=value=>JSON.stringify(canonical(value));
-function normalizePersistentPublicOrigin(value){
-  let publicOrigin;
-  try { publicOrigin=new URL(String(value)); }
-  catch { throw new Error('named tunnel public origin must be one persistent HTTPS origin'); }
-  if(publicOrigin.protocol!=='https:'||publicOrigin.username||publicOrigin.password||publicOrigin.search||publicOrigin.hash||publicOrigin.pathname!=='/'||!publicOrigin.hostname) {
-    throw new Error('named tunnel public origin must be one persistent HTTPS origin without path, query, fragment, or credentials');
-  }
-  if(publicOrigin.hostname.toLowerCase().endsWith('.trycloudflare.com')) throw new Error('named tunnel public origin must be persistent; trycloudflare is forbidden');
-  return publicOrigin.origin;
-}
-export function parseUpdateArgs(argv){
-  const out={stage:null,developmentRoot:null,expectedVersion:null,expectedManifest:null,sourceRoot:null,restoreStandingGrants:false,recoverOfflinePredecessor:false,enableMachineFs:false,enableObservation:false,enableDesktop:false,enableAutonomousSupervisor:false,cloudTransport:null,bridgeBootstrap:null,processPolicyBootstrap:null,hostPolicyBootstrap:null,codingPolicyBootstrap:null,desktopPolicyBootstrap:null,semanticLspBootstrap:null,hostCommandPins:[]};
-  const cloud={},bridge={},processPolicy={},hostPolicy={},codingPolicy={},desktopPolicy={},semanticLsp={},seen=new Set(),hostPinIds=new Set();
-  const bridgeFlags=new Map([
-    ['--bridge-root','root'],['--bridge-script-sha256','scriptSha256']
-  ]);
-  const processPolicyFlags=new Map([
-    ['--process-policy','path'],['--process-policy-sha256','sha256']
-  ]);
-  const hostPolicyFlags=new Map([
-    ['--host-policy','path'],['--host-policy-sha256','sha256']
-  ]);
-  const codingPolicyFlags=new Map([
-    ['--coding-policy','path'],['--coding-policy-sha256','sha256']
-  ]);
-  const desktopPolicyFlags=new Map([
-    ['--desktop-policy','path'],['--desktop-policy-sha256','sha256']
-  ]);
-  const semanticLspFlags=new Map([
-    ['--semantic-lsp-config','path'],['--semantic-lsp-config-sha256','sha256']
-  ]);
-  const cloudFlags=new Map([
-    ['--cloud-cloudflared','cloudflaredPath'],['--cloud-cloudflared-sha256','cloudflaredSha256'],
-    ['--cloud-token-file','tokenFilePath'],['--cloud-token-sha256','tokenFileSha256'],
-    ['--cloud-child-working-directory','childWorkingDirectory'],['--cloud-public-origin','publicOrigin']
-  ]);
-  const valued=new Set(['--stage','--development-root','--expected-version','--expected-manifest','--source-root','--host-command-pin',...bridgeFlags.keys(),...processPolicyFlags.keys(),...hostPolicyFlags.keys(),...codingPolicyFlags.keys(),...desktopPolicyFlags.keys(),...semanticLspFlags.keys(),...cloudFlags.keys()]);
-  for(let index=0;index<argv.length;index++){
-    const arg=argv[index];
-    if(arg==='--restore-standing-grants'||arg==='--recover-offline-predecessor'||arg==='--enable-machine-fs'||arg==='--enable-observation'||arg==='--enable-desktop'||arg==='--enable-autonomous-supervisor'){
-      if(seen.has(arg)) throw new Error(`duplicate self-update argument '${arg}'`);
-      seen.add(arg);
-      if(arg==='--restore-standing-grants') out.restoreStandingGrants=true;
-      else if(arg==='--recover-offline-predecessor') out.recoverOfflinePredecessor=true;
-      else if(arg==='--enable-machine-fs') out.enableMachineFs=true;
-      else if(arg==='--enable-observation') out.enableObservation=true;
-      else if(arg==='--enable-desktop') out.enableDesktop=true;
-      else out.enableAutonomousSupervisor=true;
-      continue;
-    }
-    if(arg==='--host-command-pin'){
-      const value=argv[++index];
-      if(!value) throw new Error('--host-command-pin requires command_id=sha256');
-      const match=/^([A-Za-z0-9._-]{1,64})=([0-9a-f]{64})$/.exec(value);
-      if(!match) throw new Error('host command pin must be command_id=lowercase_sha256');
-      const [,commandId,sha256]=match;
-      if(hostPinIds.has(commandId)) throw new Error(`duplicate host command pin '${commandId}'`);
-      hostPinIds.add(commandId); out.hostCommandPins.push({commandId,sha256}); continue;
-    }
-    if(!valued.has(arg)) throw new Error(`unknown self-update argument '${arg}'`);
-    if(seen.has(arg)) throw new Error(`duplicate self-update argument '${arg}'`);
-    seen.add(arg);
-    const value=argv[++index];
-    if(!value) throw new Error(`${arg} requires a value`);
-    if(arg==='--stage') out.stage=path.resolve(value);
-    else if(arg==='--development-root') out.developmentRoot=path.resolve(value);
-    else if(arg==='--expected-version') out.expectedVersion=value;
-    else if(arg==='--expected-manifest') out.expectedManifest=value.toLowerCase();
-    else if(arg==='--source-root') out.sourceRoot=path.resolve(value);
-    else if(bridgeFlags.has(arg)) bridge[bridgeFlags.get(arg)]=value;
-    else if(processPolicyFlags.has(arg)) processPolicy[processPolicyFlags.get(arg)]=value;
-    else if(hostPolicyFlags.has(arg)) hostPolicy[hostPolicyFlags.get(arg)]=value;
-    else if(codingPolicyFlags.has(arg)) codingPolicy[codingPolicyFlags.get(arg)]=value;
-    else if(desktopPolicyFlags.has(arg)) desktopPolicy[desktopPolicyFlags.get(arg)]=value;
-    else if(semanticLspFlags.has(arg)) semanticLsp[semanticLspFlags.get(arg)]=value;
-    else cloud[cloudFlags.get(arg)]=value;
-  }
-  if(!out.stage) throw new Error('--stage is required');
-  if(!out.developmentRoot) throw new Error('--development-root is required');
-  if(!SEMVER.test(String(out.expectedVersion??''))) throw new Error('--expected-version must be SemVer');
-  if(!HEX64.test(String(out.expectedManifest??''))) throw new Error('--expected-manifest must be lowercase SHA-256 hex');
-  const bridgeFields=[...bridgeFlags.values()],bridgePresent=bridgeFields.filter(key=>bridge[key]!==undefined);
-  if(bridgePresent.length!==0&&bridgePresent.length!==bridgeFields.length) throw new Error('bridge bootstrap requires root plus script SHA-256 as one pair');
-  if(bridgePresent.length===bridgeFields.length){
-    const scriptSha256=String(bridge.scriptSha256).toLowerCase();
-    if(!HEX64.test(scriptSha256)) throw new Error('bridge script SHA-256 must be lowercase hex');
-    out.bridgeBootstrap={root:path.resolve(bridge.root),scriptSha256};
-  }
-  const processPolicyFields=[...processPolicyFlags.values()],processPolicyPresent=processPolicyFields.filter(key=>processPolicy[key]!==undefined);
-  if(processPolicyPresent.length!==0&&processPolicyPresent.length!==processPolicyFields.length) throw new Error('process policy bootstrap requires path plus SHA-256 as one pair');
-  if(processPolicyPresent.length===processPolicyFields.length){
-    const sha256=String(processPolicy.sha256).toLowerCase();
-    if(!HEX64.test(sha256)) throw new Error('process policy SHA-256 must be lowercase hex');
-    out.processPolicyBootstrap={path:path.resolve(processPolicy.path),sha256};
-  }
-  const hostPolicyFields=[...hostPolicyFlags.values()],hostPolicyPresent=hostPolicyFields.filter(key=>hostPolicy[key]!==undefined);
-  if(hostPolicyPresent.length!==0&&hostPolicyPresent.length!==hostPolicyFields.length) throw new Error('host policy bootstrap requires path plus SHA-256 as one pair');
-  if(hostPolicyPresent.length===hostPolicyFields.length){
-    const sha256=String(hostPolicy.sha256).toLowerCase();
-    if(!HEX64.test(sha256)) throw new Error('host policy SHA-256 must be lowercase hex');
-    out.hostPolicyBootstrap={path:path.resolve(hostPolicy.path),sha256};
-  }
-  const codingPolicyFields=[...codingPolicyFlags.values()],codingPolicyPresent=codingPolicyFields.filter(key=>codingPolicy[key]!==undefined);
-  if(codingPolicyPresent.length!==0&&codingPolicyPresent.length!==codingPolicyFields.length) throw new Error('coding policy bootstrap requires path plus SHA-256 as one pair');
-  if(codingPolicyPresent.length===codingPolicyFields.length){
-    const sha256=String(codingPolicy.sha256).toLowerCase();
-    if(!HEX64.test(sha256)) throw new Error('coding policy SHA-256 must be lowercase hex');
-    out.codingPolicyBootstrap={path:path.resolve(codingPolicy.path),sha256};
-  }
-  const desktopPolicyFields=[...desktopPolicyFlags.values()],desktopPolicyPresent=desktopPolicyFields.filter(key=>desktopPolicy[key]!==undefined);
-  if(desktopPolicyPresent.length!==0&&desktopPolicyPresent.length!==desktopPolicyFields.length) throw new Error('desktop policy bootstrap requires path plus SHA-256 as one pair');
-  if(desktopPolicyPresent.length===desktopPolicyFields.length){
-    const sha256=String(desktopPolicy.sha256).toLowerCase();
-    if(!HEX64.test(sha256)) throw new Error('desktop policy SHA-256 must be lowercase hex');
-    out.desktopPolicyBootstrap={path:path.resolve(desktopPolicy.path),sha256};
-  }
-  const semanticLspFields=[...semanticLspFlags.values()],semanticLspPresent=semanticLspFields.filter(key=>semanticLsp[key]!==undefined);
-  if(semanticLspPresent.length!==0&&semanticLspPresent.length!==semanticLspFields.length) throw new Error('semantic LSP config bootstrap requires path plus SHA-256 as one pair');
-  if(semanticLspPresent.length===semanticLspFields.length){
-    const sha256=String(semanticLsp.sha256).toLowerCase();
-    if(!HEX64.test(sha256)) throw new Error('semantic LSP config SHA-256 must be lowercase hex');
-    out.semanticLspBootstrap={path:path.resolve(semanticLsp.path),sha256};
-  }
-  const cloudFields=[...cloudFlags.values()],present=cloudFields.filter(key=>cloud[key]!==undefined);
-  if(present.length!==0&&present.length!==cloudFields.length) throw new Error('named tunnel bootstrap requires cloud path/hash/token/workdir plus persistent public origin');
-  if(present.length===cloudFields.length){
-    for(const key of ['cloudflaredSha256','tokenFileSha256']) cloud[key]=String(cloud[key]).toLowerCase();
-    if(!HEX64.test(cloud.cloudflaredSha256)||!HEX64.test(cloud.tokenFileSha256)) throw new Error('named tunnel dependency SHA-256 must be lowercase hex');
-    const publicOrigin=normalizePersistentPublicOrigin(cloud.publicOrigin);
-    out.cloudTransport={
-      cloudflared:{path:path.resolve(cloud.cloudflaredPath),sha256:cloud.cloudflaredSha256},
-      tokenFile:{path:path.resolve(cloud.tokenFilePath),sha256:cloud.tokenFileSha256},
-      childWorkingDirectory:path.resolve(cloud.childWorkingDirectory),
-      publicOrigin
-    };
-  }
-  return out;
-}
-
-export function parseRollbackArgs(argv){
-  let activationReceipt=null;
-  for(let index=0;index<argv.length;index++){
-    const arg=argv[index];
-    if(arg!=='--rollback-receipt') throw new Error(`unknown rollback argument '${arg}'`);
-    if(activationReceipt!==null) throw new Error("duplicate rollback argument '--rollback-receipt'");
-    const value=argv[++index];
-    if(!value) throw new Error('--rollback-receipt requires a value');
-    activationReceipt=path.resolve(value);
-  }
-  if(!activationReceipt) throw new Error('--rollback-receipt is required');
-  return {activationReceipt};
-}
-
-function powershellPath(){
-  return path.join(process.env.SystemRoot||'C:\\Windows','System32','WindowsPowerShell','v1.0','powershell.exe');
-}
-export function windowsPowerShellEnvironment(base=process.env){
-  const systemRoot=base.SystemRoot||base.SYSTEMROOT||'C:\\Windows';
-  const userProfile=base.USERPROFILE||os.homedir();
-  const programFiles=base.ProgramFiles||base.PROGRAMFILES||'C:\\Program Files';
-  const environment={...base};
-  const inherited=Object.entries(base).filter(([key])=>key.toLowerCase()==='psmodulepath').flatMap(([,value])=>String(value??'').split(';')).filter(Boolean);
-  for(const key of Object.keys(environment)) if(key.toLowerCase()==='psmodulepath') delete environment[key];
-  const modules=[
-    path.join(systemRoot,'System32','WindowsPowerShell','v1.0','Modules'),
-    path.join(userProfile,'Documents','WindowsPowerShell','Modules'),
-    path.join(programFiles,'WindowsPowerShell','Modules'),
-    ...inherited
-  ];
-  const seen=new Set();
-  return {...environment,PSModulePath:modules.filter(modulePath=>{
-    const key=modulePath.toLowerCase();
-    if(seen.has(key)) return false;
-    seen.add(key);return true;
-  }).join(';')};
-}
-function commandEnvironment(exe,base=process.env){
-  return path.resolve(exe).toLowerCase()===path.resolve(powershellPath()).toLowerCase()
-    ?windowsPowerShellEnvironment(base):base;
-}
-function runCaptured(exe,args,{cwd,env,timeoutMs=45000}={}){
-  const baseEnv=env??process.env;
-  const childEnv=commandEnvironment(exe,baseEnv);
-  const result=spawnSync(exe,args,{cwd,env:childEnv,encoding:'utf8',windowsHide:true,timeout:timeoutMs,maxBuffer:16*1024*1024});
-  return {status:result.status,signal:result.signal,error:result.error?{code:result.error.code??null,message:result.error.message}:null,stdout:result.stdout??'',stderr:result.stderr??''};
-}
-function assertRun(result,label){
-  if(result.error||result.status!==0) throw new Error(`${label} failed status=${result.status} error=${result.error?.message??'none'}\n${result.stderr||result.stdout}`);
-  return result.stdout;
-}
-export async function loadPowerShellDataFile(file){
-  const env={...process.env,DEADBYTE_R27_CONFIG_READ:path.resolve(file)};
-  const command="$ErrorActionPreference='Stop'; $v=Import-PowerShellDataFile -LiteralPath $env:DEADBYTE_R27_CONFIG_READ; $v | ConvertTo-Json -Depth 16 -Compress";
-  const result=runCaptured(powershellPath(),['-NoLogo','-NoProfile','-Command',command],{env,timeoutMs:15000});
-  const text=assertRun(result,'PowerShell data-file load').trim();
-  let value; try { value=JSON.parse(text); } catch(error){ throw new Error(`controller config JSON conversion failed: ${error.message}`); }
-  if(!value||typeof value!=='object'||Array.isArray(value)) throw new Error('controller config must be an object');
-  return value;
-}
-async function readJson(file){
-  const text=(await readFile(file,'utf8')).replace(/^\uFEFF/,'');
-  let value; try { value=JSON.parse(text); } catch(error){ throw new Error(`JSON invalid ${file}: ${error.message}`); }
-  return value;
-}
-async function atomicBytes(file,bytes){
-  await mkdir(path.dirname(file),{recursive:true});
-  const temp=`${file}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
-  const handle=await open(temp,'wx');
-  try { await handle.writeFile(bytes); await handle.sync(); } finally { await handle.close(); }
-  let renamed=false;
-  let lastRenameError=null;
-  for(let attempt=0;attempt<20;attempt+=1){
-    try { await rename(temp,file); renamed=true; break; }
-    catch(error){
-      lastRenameError=error;
-      if(!["EPERM","EBUSY","EACCES"].includes(error?.code) || attempt===19) break;
-      await new Promise(resolve=>setTimeout(resolve,Math.min(500,100*(attempt+1))));
-    }
-  }
-  if(!renamed){ await rm(temp,{force:true}).catch(()=>{}); throw lastRenameError; }
-  if(sha256Bytes(await readFile(file))!==sha256Bytes(bytes)) throw new Error(`atomic write readback mismatch: ${file}`);
-}
-async function normalizeComponentIdentities(config){
-  const next=structuredClone(config);
-  for(const name of ['Bridge','Cloud']){
-    const spec=next[name];
-    if(!spec||typeof spec!=='object') throw new Error(`${name} launch specification missing`);
-    if(typeof spec.FilePath!=='string'||!path.isAbsolute(spec.FilePath)) throw new Error(`${name} FilePath must be absolute`);
-    const exe=path.resolve(spec.FilePath);
-    const stat=await lstat(exe);
-    if(!stat.isFile()||stat.isSymbolicLink()) throw new Error(`${name} executable must be a regular file`);
-    const actual=await sha256File(exe);
-    if(spec.FileSha256!==undefined&&spec.FileSha256!==''&&spec.FileSha256!==actual) throw new Error(`${name} executable pin drift detected`);
-    spec.FilePath=exe; spec.FileSha256=actual;
-    const dependencies=spec.Dependencies??[];
-    if(!Array.isArray(dependencies)||dependencies.length>16) throw new Error(`${name} Dependencies invalid`);
-    const normalizedDependencies=[];
-    for(const dependency of dependencies){
-      const depName=String(dependency?.Name??'');
-      const depPath=path.resolve(String(dependency?.Path??''));
-      const depHash=String(dependency?.Sha256??'').toLowerCase();
-      if(!/^[A-Za-z0-9._-]{1,32}$/.test(depName)||!path.isAbsolute(String(dependency?.Path??''))||!HEX64.test(depHash)) throw new Error(`${name} dependency contract invalid`);
-      const depStat=await lstat(depPath); if(!depStat.isFile()||depStat.isSymbolicLink()) throw new Error(`${name} dependency must be a regular file: ${depName}`);
-      const depActual=await sha256File(depPath); if(depActual!==depHash) throw new Error(`${name} dependency pin drift detected: ${depName}`);
-      normalizedDependencies.push({Name:depName,Path:depPath,Sha256:depHash});
-    }
-    spec.Dependencies=normalizedDependencies;
-    if(name==='Cloud'&&spec.Transport!==undefined){
-      const transport=String(spec.Transport);
-      const valid=(transport==='deadbyte.named-tunnel.v1'&&normalizedDependencies.length===3)||
-        (transport==='deadbyte.named-tunnel.v2'&&normalizedDependencies.length===2);
-      if(!valid) throw new Error('Cloud named tunnel transport contract invalid');
-    }
-  }
-  const bridge=next.Bridge;
-  const raw=String(bridge.Arguments??'');
-  const normalized=raw.replaceAll('\\','/');
-  if(!/^[A-Za-z0-9._/-]+\.(?:mjs|js)$/.test(normalized)||path.posix.isAbsolute(normalized)||normalized.split('/').includes('..')) {
-    throw new Error('R27 Bridge Arguments must be one relative .mjs/.js script path');
-  }
-  if(typeof bridge.WorkingDirectory!=='string'||!path.isAbsolute(bridge.WorkingDirectory)) throw new Error('Bridge WorkingDirectory must be absolute');
-  const script=path.resolve(bridge.WorkingDirectory,...normalized.split('/'));
-  const scriptStat=await lstat(script);
-  if(!scriptStat.isFile()||scriptStat.isSymbolicLink()) throw new Error('Bridge script must be a regular file');
-  const scriptHash=await sha256File(script);
-  if(bridge.ScriptSha256!==undefined&&bridge.ScriptSha256!==''&&bridge.ScriptSha256!==scriptHash) throw new Error('Bridge script pin drift detected');
-  bridge.ScriptPath=script; bridge.ScriptSha256=scriptHash;
-  return next;
-}
-
-function bridgeDependencyName(relativePath,usedNames){
-  const normalized=String(relativePath).replaceAll('\\','/').replaceAll('/','_');
-  let name=normalized;
-  if(!/^[A-Za-z0-9._-]{1,32}$/.test(name)||usedNames.has(name)){
-    name=`dep-${sha256Bytes(Buffer.from(String(relativePath),'utf8')).slice(0,20)}`;
-  }
-  if(usedNames.has(name)) throw new Error(`bridge dependency name collision: ${relativePath}`);
-  usedNames.add(name);
-  return name;
-}
-function bridgeStaticRelativeImports(source,file){
-  const found=[];
-  for(const [index,line] of String(source).split(/\r?\n/).entries()){
-    if(/\bimport\s*\(\s*['"]\.\.?\//.test(line)) throw new Error(`bridge dynamic relative import is forbidden: ${file}:${index+1}`);
-    const importStart=/^\s*import\b/.test(line);
-    const exportStart=/^\s*export\b/.test(line)&&/\bfrom\b/.test(line);
-    if(!importStart&&!exportStart) continue;
-    const match=importStart
-      ? /^\s*import\s+(?:(?:[^'"]+?)\s+from\s*)?['"]([^'"]+)['"]\s*;?\s*$/.exec(line)
-      : /^\s*export\s+[^'"]*?\s+from\s*['"]([^'"]+)['"]\s*;?\s*$/.exec(line);
-    if(!match) throw new Error(`bridge import syntax unsupported for dependency binding: ${file}:${index+1}`);
-    if(match[1].startsWith('.')) found.push(match[1]);
-  }
-  return found;
-}
-async function discoverBridgeLocalDependencies(root,entryScript){
-  const absoluteRoot=path.resolve(root),realRoot=await realpath(absoluteRoot);
-  const srcRoot=path.join(absoluteRoot,'src');
-  const queue=[path.resolve(entryScript)],visited=new Set(),files=[];
-  while(queue.length){
-    const current=queue.shift();
-    const currentReal=await realpath(current);
-    const relativeReal=path.relative(realRoot,currentReal);
-    if(relativeReal.startsWith('..')||path.isAbsolute(relativeReal)) throw new Error(`bridge dependency escapes bridge root: ${current}`);
-    if(visited.has(currentReal)) continue;
-    visited.add(currentReal);
-    if(visited.size>16) throw new Error('bridge local dependency closure exceeds 16 files');
-    const stat=await lstat(current);
-    if(!stat.isFile()||stat.isSymbolicLink()) throw new Error(`bridge dependency must be a regular file: ${current}`);
-    const source=await readFile(current,'utf8');
-    const specifiers=bridgeStaticRelativeImports(source,current);
-    if(currentReal!==await realpath(entryScript)) files.push(currentReal);
-    for(const specifier of specifiers){
-      if(!specifier.startsWith('./')) throw new Error(`bridge relative import escapes bridge root: ${specifier}`);
-      if(specifier.includes('?')||specifier.includes('#')) throw new Error(`bridge relative import query/fragment unsupported: ${specifier}`);
-      const resolved=path.resolve(path.dirname(current),specifier);
-      const relative=path.relative(absoluteRoot,resolved);
-      if(relative.startsWith('..')||path.isAbsolute(relative)) throw new Error(`bridge dependency escapes bridge root: ${specifier}`);
-      if(!/\.(?:mjs|js)$/i.test(resolved)) throw new Error(`bridge local dependency must be .mjs/.js: ${specifier}`);
-      queue.push(resolved);
-    }
-  }
-  const unique=[...new Set(files)].sort((a,b)=>a.localeCompare(b));
-  const usedNames=new Set();
-  const dependencies=[];
-  for(const file of unique){
-    const relative=path.relative(srcRoot,file).replaceAll('\\','/');
-    if(relative.startsWith('..')||path.isAbsolute(relative)) throw new Error(`bridge dependency must remain under src: ${file}`);
-    dependencies.push({Name:bridgeDependencyName(relative,usedNames),Path:file,Sha256:await sha256File(file)});
-  }
-  return dependencies;
-}
-
-export async function prepareBridgeSpec(config,bootstrap){
-  if(!bootstrap) return structuredClone(config);
-  if(typeof bootstrap.root!=='string'||!path.isAbsolute(bootstrap.root)||!HEX64.test(String(bootstrap.scriptSha256??''))) {
-    throw new Error('bridge bootstrap requires absolute root plus lowercase script SHA-256');
-  }
-  const root=path.resolve(bootstrap.root),rootStat=await lstat(root);
-  if(!rootStat.isDirectory()||rootStat.isSymbolicLink()) throw new Error('bridge root must be a real directory');
-  const packageFile=path.join(root,'package.json'),script=path.join(root,'src','bridge.mjs');
-  const packageStat=await lstat(packageFile),scriptStat=await lstat(script);
-  if(!packageStat.isFile()||packageStat.isSymbolicLink()) throw new Error('bridge package.json must be a regular file');
-  if(!scriptStat.isFile()||scriptStat.isSymbolicLink()) throw new Error('bridge script must be a regular file');
-  const pkg=JSON.parse(await readFile(packageFile,'utf8'));
-  if(pkg?.name!=='deadbyte-chatgpt-bridge') throw new Error('bridge package identity mismatch');
-  const actual=await sha256File(script),expected=String(bootstrap.scriptSha256).toLowerCase();
-  if(actual!==expected) throw new Error(`bridge script SHA-256 mismatch: expected ${expected}, found ${actual}`);
-  const next=structuredClone(config);
-  if(!next.Bridge||typeof next.Bridge!=='object') throw new Error('Bridge launch specification missing');
-  next.Bridge.WorkingDirectory=root;
-  next.Bridge.Arguments='src\\bridge.mjs';
-  next.Bridge.ScriptPath=script;
-  next.Bridge.ScriptSha256=actual;
-  next.Bridge.Dependencies=await discoverBridgeLocalDependencies(root,script);
-  return next;
-}
-
-export async function prepareReleaseBridgeSpec(config,bootstrap,releaseRoot){
-  if(!bootstrap) return structuredClone(config);
-  if(typeof releaseRoot!=='string'||!path.isAbsolute(releaseRoot))throw new Error('immutable release root required for Bridge binding');
-  // Verify the requested development input, then bind runtime paths only to
-  // the manifest-verified immutable slot produced from that same candidate.
-  const verifiedSource=await prepareBridgeSpec(config,bootstrap);
-  return prepareBridgeSpec(verifiedSource,{
-    root:path.join(path.resolve(releaseRoot),'bridge'),
-    scriptSha256:verifiedSource.Bridge.ScriptSha256
-  });
-}
-
-export async function prepareAutonomousSupervisorSpec(config,{releaseRoot,enable=false}={}){
-  const next=structuredClone(config);
-  if(!enable) return next;
-  if(next.AutonomousRuntimeEnabled!==true) throw new Error('autonomous supervisor bootstrap requires AutonomousRuntimeEnabled');
-  if(typeof releaseRoot!=='string'||!path.isAbsolute(releaseRoot)) throw new Error('autonomous supervisor release root must be absolute');
-  const release=path.resolve(releaseRoot),script=path.join(release,'src','autonomous-supervisor-host.mjs');
-  const scriptStat=await lstat(script);
-  if(!scriptStat.isFile()||scriptStat.isSymbolicLink()) throw new Error('autonomous supervisor script must be a regular release file');
-  const bridge=next.Bridge;
-  if(!bridge||typeof bridge.FilePath!=='string'||!path.isAbsolute(bridge.FilePath)||!HEX64.test(String(bridge.FileSha256??''))) {
-    throw new Error('autonomous supervisor bootstrap requires pinned Bridge executable identity');
-  }
-  const executable=path.resolve(bridge.FilePath),exeStat=await lstat(executable);
-  if(!exeStat.isFile()||exeStat.isSymbolicLink()) throw new Error('autonomous supervisor executable must be a regular file');
-  const executableSha256=await sha256File(executable);
-  if(executableSha256!==String(bridge.FileSha256)) throw new Error('autonomous supervisor executable pin drift detected');
-  next.AutonomousSupervisorEnabled=true;
-  next.Supervisor={
-    FilePath:executable,FileSha256:executableSha256,Arguments:'src\\autonomous-supervisor-host.mjs',WorkingDirectory:release,
-    ScriptPath:script,ScriptSha256:await sha256File(script)
-  };
-  return next;
-}
-
-function quoteWindowsArgument(value){
-  const text=String(value??'');
-  if(text.length<1||/["\r\n\0]/.test(text)) throw new Error('named tunnel argument contains unsafe characters');
-  const trailing=(/\\+$/.exec(text)?.[0].length??0);
-  return `"${text}${'\\'.repeat(trailing)}"`;
-}
-async function verifyPinnedRegularFile(file,expected,label){
-  if(typeof file!=='string'||!path.isAbsolute(file)||!HEX64.test(String(expected??''))) throw new Error(`${label} pin contract invalid`);
-  const absolute=path.resolve(file),stat=await lstat(absolute);
-  if(!stat.isFile()||stat.isSymbolicLink()) throw new Error(`${label} must be a regular file`);
-  const actual=await sha256File(absolute);
-  if(actual!==expected) throw new Error(`${label} SHA-256 mismatch: expected ${expected}, found ${actual}`);
-  return {path:absolute,sha256:actual};
-}
-
-export async function prepareProcessPolicyBootstrap(bootstrap){
-  if(!bootstrap) return null;
-  const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'process policy');
-  const policy=await readJson(pinned.path);
-  if(policy?.schema!=='deadbyte.process-policy.v1'||policy?.enabled!==true) throw new Error('process policy schema/enabled mismatch');
-  return {...pinned,policy};
-}
-
-export async function prepareHostPolicyBootstrap(bootstrap){
-  if(!bootstrap) return null;
-  const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'host policy');
-  const policy=await readJson(pinned.path);
-  if(!['deadbyte.host-policy.v1','deadbyte.host-policy.v2'].includes(policy?.schema)||policy?.enabled!==true||
-     !policy?.commands||typeof policy.commands!=='object'||Array.isArray(policy.commands)) {
-    throw new Error('host policy schema/enabled/commands mismatch');
-  }
-  if(policy.schema==='deadbyte.host-policy.v2'&&(policy.native_exec?.enabled!==true||!Array.isArray(policy.native_exec?.root_ids))) {
-    throw new Error('host policy v2 native_exec contract invalid');
-  }
-  return {...pinned,policy};
-}
-
-export async function prepareCodingPolicyBootstrap(bootstrap){
-  if(!bootstrap) return null;
-  const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'coding policy');
-  const policy=await readJson(pinned.path);
-  if(policy?.schema!=='deadbyte.coding-policy.v1'||policy?.enabled!==true||
-     !policy?.roots||typeof policy.roots!=='object'||Array.isArray(policy.roots)||
-     !policy?.commands||typeof policy.commands!=='object'||Array.isArray(policy.commands)) {
-    throw new Error('coding policy schema/enabled/roots/commands mismatch');
-  }
-  return {...pinned,policy};
-}
-
-export async function prepareDesktopPolicyBootstrap(bootstrap){
-  if(!bootstrap) return null;
-  const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'desktop policy');
-  const policy=await readJson(pinned.path);
-  if(policy?.schema!=='deadbyte.desktop-policy.v1'||policy?.enabled!==true) throw new Error('desktop policy schema/enabled mismatch');
-  for(const name of ['observer','input','grounder']){
-    const provider=policy[name];
-    if(!provider||typeof provider.executable!=='string'||!path.isAbsolute(provider.executable)||!HEX64.test(String(provider.sha256??''))) {
-      throw new Error(`desktop policy ${name} pin invalid`);
-    }
-  }
-  if(!Array.isArray(policy.allowed_actions)||policy.allowed_actions.length<1) throw new Error('desktop policy allowed_actions invalid');
-  return {...pinned,policy};
-}
-
-export async function prepareSemanticLspConfigBootstrap(bootstrap){
-  if(!bootstrap) return null;
-  const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'semantic LSP config');
-  const config=await readJson(pinned.path);
-  if(config?.schema!=='deadbyte.semantic-lsp-config.v1'||!Array.isArray(config.servers)) throw new Error('semantic LSP config schema invalid');
-  return {...pinned,config};
-}
-
-async function preparePinnedCommandPolicy(policy,{commandPins=[],schema,label}={}){
-  if(!policy) return {policy:null,repinned:[],matchedCommandIds:[]};
-  const acceptedSchemas=Array.isArray(schema)?schema:[schema];
-  if(!acceptedSchemas.includes(policy.schema)||policy.enabled!==true||!policy.commands||typeof policy.commands!=='object'||Array.isArray(policy.commands)) {
-    throw new Error(`${label} policy schema/enabled/commands mismatch`);
-  }
-  const requested=new Map();
-  for(const pin of commandPins){
-    const commandId=String(pin?.commandId??''),sha256=String(pin?.sha256??'').toLowerCase();
-    if(!/^[A-Za-z0-9._-]{1,64}$/.test(commandId)||!HEX64.test(sha256)) throw new Error(`${label} command pin contract invalid`);
-    if(requested.has(commandId)) throw new Error(`duplicate ${label} command pin '${commandId}'`);
-    requested.set(commandId,sha256);
-  }
-  const next=structuredClone(policy),repinned=[],matchedCommandIds=[];
-  for(const [commandId,command] of Object.entries(next.commands)){
-    const executable=String(command?.executable??''),expected=String(command?.executable_sha256??'').toLowerCase();
-    if(!path.isAbsolute(executable)||!HEX64.test(expected)) throw new Error(`${label} command '${commandId}' executable pin contract invalid`);
-    const absolute=path.resolve(executable),stat=await lstat(absolute);
-    if(!stat.isFile()||stat.isSymbolicLink()) throw new Error(`${label} command '${commandId}' executable must be a regular file`);
-    const actual=await sha256File(absolute),explicit=requested.get(commandId);
-    if(explicit) matchedCommandIds.push(commandId);
-    if(actual!==expected){
-      if(!explicit) throw new Error(`${label} command '${commandId}' executable pin drift detected; explicit --host-command-pin ${commandId}=${actual} required`);
-      if(explicit!==actual) throw new Error(`${label} command '${commandId}' repin mismatch: supplied ${explicit}, observed ${actual}`);
-      command.executable_sha256=actual;
-      repinned.push({command_id:commandId,executable:absolute,prior_sha256:expected,new_sha256:actual});
-    } else if(explicit&&explicit!==actual){
-      throw new Error(`${label} command '${commandId}' repin mismatch: supplied ${explicit}, observed ${actual}`);
-    }
-  }
-  return {policy:next,repinned,matchedCommandIds};
-}
-
-export async function prepareHostPolicy(policy,{commandPins=[]}={}){
-  if(!policy&&commandPins.length) throw new Error('host command pins supplied but host policy is not configured');
-  const result=await preparePinnedCommandPolicy(policy,{commandPins,schema:['deadbyte.host-policy.v1','deadbyte.host-policy.v2'],label:'host'});
-  const matched=new Set(result.matchedCommandIds);
-  const unknown=commandPins.find(pin=>!matched.has(String(pin?.commandId??'')));
-  if(unknown) throw new Error(`unknown host command pin '${unknown.commandId}'`);
-  return {policy:result.policy,repinned:result.repinned};
-}
-
-export async function prepareAuthorityPolicies({hostPolicy,codingPolicy},{commandPins=[]}={}){
-  const host=await preparePinnedCommandPolicy(hostPolicy,{commandPins,schema:['deadbyte.host-policy.v1','deadbyte.host-policy.v2'],label:'host'});
-  const coding=await preparePinnedCommandPolicy(codingPolicy,{commandPins,schema:'deadbyte.coding-policy.v1',label:'coding'});
-  const matched=new Set([...host.matchedCommandIds,...coding.matchedCommandIds]);
-  const unknown=commandPins.find(pin=>!matched.has(String(pin?.commandId??'')));
-  if(unknown) throw new Error(`unknown authority command pin '${unknown.commandId}'`);
-  return {hostPolicy:host.policy,codingPolicy:coding.policy,hostRepinned:host.repinned,codingRepinned:coding.repinned};
-}
-
-export async function prepareNamedTunnelCloudSpec(config,{releaseRoot,bootstrap=null}={}){
-  const next=structuredClone(config),cloud=next.Cloud??{};
-  const useNamed=bootstrap!==null||cloud.Transport==='deadbyte.named-tunnel.v1'||cloud.Transport==='deadbyte.named-tunnel.v2';
-  if(!useNamed) return next;
-  const release=path.resolve(releaseRoot),hostPath=path.join(release,'bin','deadbyte-tunnel-host.exe');
-  const hostStat=await lstat(hostPath); if(!hostStat.isFile()||hostStat.isSymbolicLink()) throw new Error('named tunnel host must be a regular release file');
-  const hostSha256=await sha256File(hostPath);
-  if(bootstrap!==null){
-    const cloudflared=await verifyPinnedRegularFile(bootstrap.cloudflared.path,bootstrap.cloudflared.sha256,'named tunnel cloudflared');
-    const tokenFile=await verifyPinnedRegularFile(bootstrap.tokenFile.path,bootstrap.tokenFile.sha256,'named tunnel token file');
-    const childWorkingDirectory=path.resolve(bootstrap.childWorkingDirectory),workStat=await lstat(childWorkingDirectory);
-    if(!workStat.isDirectory()||workStat.isSymbolicLink()) throw new Error('named tunnel child working directory must be a real directory');
-    next.Cloud={...cloud,FilePath:hostPath,FileSha256:hostSha256,
-      Arguments:[cloudflared.path,tokenFile.path,childWorkingDirectory].map(quoteWindowsArgument).join(' '),
-      WorkingDirectory:release,Transport:'deadbyte.named-tunnel.v2',Dependencies:[
-        {Name:'cloudflared',Path:cloudflared.path,Sha256:cloudflared.sha256},
-        {Name:'tunnel-token',Path:tokenFile.path,Sha256:tokenFile.sha256}
-      ]};
-  } else {
-    if(cloud.Transport!=='deadbyte.named-tunnel.v2') throw new Error('legacy named tunnel transport requires explicit v2 bootstrap');
-    if(!Array.isArray(cloud.Dependencies)||cloud.Dependencies.length!==2) throw new Error('existing named tunnel dependency contract missing');
-    next.Cloud={...cloud,FilePath:hostPath,FileSha256:hostSha256,WorkingDirectory:release};
-  }
-  return next;
-}
-async function ensureStableMcpPath({stateRoot,sourceRoot}){
-  const bridgeDir=path.join(stateRoot,'bridge');
-  const tokenFile=path.join(bridgeDir,'path-token.txt');
-  let token='';
-  try { token=(await readFile(tokenFile,'utf8')).trim(); } catch(error){
-    if(error?.code!=='ENOENT') throw error;
-    if(!sourceRoot) throw new Error('bridge path token missing and no bootstrap source root supplied');
-    const legacy=(await readFile(path.join(sourceRoot,'controller','runtime','mcp-path.txt'),'utf8')).trim();
-    const match=/^\/mcp\/([0-9a-f]{64})$/.exec(legacy);
-    if(!match) throw new Error('legacy MCP path cannot seed stable token');
-    token=match[1];
-    await mkdir(bridgeDir,{recursive:true});
-    await atomicBytes(tokenFile,Buffer.from(`${token}\n`,'ascii'));
-  }
-  if(!HEX64.test(token)) throw new Error('bridge path token invalid');
-  const stableFile=path.join(bridgeDir,'mcp-path.txt');
-  const desired=Buffer.from(`/mcp/${token}\n`,'ascii');
-  if(existsSync(stableFile)){
-    const found=await readFile(stableFile);
-    if(!found.equals(desired)) throw new Error('stable MCP path file conflicts with token');
-  } else await atomicBytes(stableFile,desired);
-  return {path:stableFile,sha256:sha256Bytes(desired)};
-}
-export async function ensureStableMcpUrl({stateRoot,publicOrigin,mcpPathFile}){
-  const origin=normalizePersistentPublicOrigin(publicOrigin);
-  if(typeof mcpPathFile!=='string'||!path.isAbsolute(mcpPathFile)) throw new Error('stable MCP path file must be absolute');
-  const pathStat=await lstat(mcpPathFile);
-  if(!pathStat.isFile()||pathStat.isSymbolicLink()) throw new Error('stable MCP path file must be a regular file');
-  const mcpPath=(await readFile(mcpPathFile,'ascii')).trim();
-  if(!/^\/mcp\/[0-9a-f]{64}$/.test(mcpPath)) throw new Error('stable MCP path file is invalid');
-  const bridgeDir=path.join(path.resolve(stateRoot),'bridge'),stableFile=path.join(bridgeDir,'mcp-url.txt');
-  const desired=Buffer.from(`${origin}${mcpPath}\n`,'ascii');
-  const before=existsSync(stableFile)?await readFile(stableFile):null;
-  if(!before||!before.equals(desired)) await atomicBytes(stableFile,desired);
-  return {path:stableFile,sha256:sha256Bytes(desired),origin,changed:!before||!before.equals(desired)};
-}
-
-async function snapshotFile(file){
-  try { const bytes=await readFile(file); return {exists:true,bytes,sha256:sha256Bytes(bytes)}; }
-  catch(error){ if(error?.code==='ENOENT') return {exists:false,bytes:null,sha256:null}; throw error; }
-}
-async function restoreFile(file,snapshot){
-  if(snapshot.exists) await atomicBytes(file,snapshot.bytes);
-  else await rm(file,{force:true});
-}
-
-export function parseControllerStatus(text){
-  const number=re=>{const match=re.exec(text);return match?Number(match[1]):null;};
-  return {
-    online:/DEADBYTE MCP = ONLINE/.test(text),
-    offline:/DEADBYTE MCP = OFFLINE/.test(text),
-    bridge_pid:number(/Bridge PID\s*:\s*(\d+)\s*\[verified\]/),
-    cloud_pid:number(/Cloud PID\s*:\s*(\d+)\s*\[verified\]/),
-    local_ready:/Local ready\s*:\s*True/.test(text),
-    process_armed:/Process plane\s*:\s*ARMED \[standing-grant\]/.test(text),
-    coding_armed:/Coding plane\s*:\s*ARMED \[standing-grant\]/.test(text),
-    autonomous_armed:/Autonomous\s*:\s*ARMED \[standing-grant\]/.test(text),
-    desktop_armed:/Desktop plane\s*:\s*ARMED \[standing-grant\]/.test(text),
-    host_armed:/Host plane\s*:\s*ARMED \[standing-grant\]/.test(text)
-  };
-}
-function controlResult(exe,args,{cwd,env,timeoutMs=45000,stdio='pipe'}={}){
-  if(stdio==='ignore'){
-    const result=spawnSync(exe,args,{cwd,env:commandEnvironment(exe,env??process.env),windowsHide:true,timeout:timeoutMs,stdio:'ignore'});
-    return {status:result.status,signal:result.signal,error:result.error?{code:result.error.code??null,message:result.error.message}:null,stdout:'',stderr:''};
-  }
-  return runCaptured(exe,args,{cwd,env,timeoutMs});
-}
-export function legacyContext(sourceRoot){
-  const root=path.resolve(sourceRoot);
-  const candidates=['deadbyte-controller-r26.ps1','deadbyte-controller.ps1'];
-  const controller=candidates.map(name=>path.join(root,'controller',name)).find(existsSync);
-  if(!controller) throw new Error('legacy controller entry missing');
-  return {kind:'legacy',source_root:root,core_root:root,controller_path:controller,
-    cwd:root,runtime_root:path.join(root,'controller','runtime'),state_root:null};
-}
-function slotContext(stateRoot,pointer){
-  return {kind:'slot',source_root:null,core_root:path.resolve(pointer.release_root),
-    controller_path:path.join(pointer.release_root,'controller','deadbyte-controller.ps1'),
-    cwd:path.resolve(pointer.release_root),runtime_root:path.join(path.resolve(stateRoot),'runtime'),
-    state_root:path.resolve(stateRoot),pointer};
-}
-function launcherPath(stateRoot){ return path.join(path.resolve(stateRoot),'bin','DEADBYTE-MCP.ps1'); }
-function controllerInvocation(ctx,command){
-  // Internal control-plane calls use the immutable slot controller directly. The stable launcher is
-  // user-facing and may lag during a slot switch; coupling supervisor state transitions to it creates
-  // a bootstrap dependency and can misreport a healthy predecessor as offline.
-  if(ctx.kind==='slot') return {
-    exe:powershellPath(),
-    args:['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',ctx.controller_path,command],
-    cwd:ctx.cwd,
-    env:{...process.env,DEADBYTE_STATE_ROOT:resolveStateRoot(ctx.state_root),DEADBYTE_CONTROLLER_CONFIG:ctx.pointer.config_path,DEADBYTE_CONTROLLER_RUNTIME_ROOT:ctx.runtime_root}
-  };
-  return {exe:powershellPath(),args:['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',ctx.controller_path,command],cwd:ctx.cwd};
-}
-function controllerCaptured(ctx,command,timeoutMs=45000){
-  const call=controllerInvocation(ctx,command); const result=controlResult(call.exe,call.args,{cwd:call.cwd,env:call.env??process.env,timeoutMs});
-  return assertRun(result,`controller ${command}`);
-}
-export function runControllerStartNoCapture(ctx,timeoutMs=45000){
-  const call=controllerInvocation(ctx,'start');
-  return controlResult(call.exe,call.args,{cwd:call.cwd,env:call.env??process.env,timeoutMs,stdio:'ignore'});
-}
-export async function readControllerStartFailure(ctx){
-  const file=path.join(ctx.runtime_root,'controller-start-failure.json');
-  let bytes;
-  try { bytes=await readFile(file); }
-  catch(error){ if(error?.code==='ENOENT') return null; throw error; }
-  const text=bytes.toString('utf8').replace(/^\uFEFF/,'');
-  let value;
-  try { value=JSON.parse(text); } catch(error){ throw new Error(`controller start failure evidence JSON invalid: ${error.message}`); }
-  if(value?.schema!=='deadbyte.controller-start-failure.v1'||!['start','resume','restart'].includes(String(value?.command??''))||
-      typeof value?.message!=='string'||value.message.length<1||typeof value?.failed_at_utc!=='string') {
-    throw new Error('controller start failure evidence schema invalid');
-  }
-  return {path:file,sha256:sha256Bytes(bytes),...value};
-}
-export async function preserveControllerStartFailure(ctx,evidenceDir){
-  const evidence=await readControllerStartFailure(ctx);
-  if(!evidence) return null;
-  const source=path.join(ctx.runtime_root,'controller-start-failure.json');
-  const bytes=await readFile(source);
-  const sourceSha256=sha256Bytes(bytes);
-  if(sourceSha256!==evidence.sha256) throw new Error('controller start failure evidence changed before preservation');
-  const destination=path.join(path.resolve(evidenceDir),'controller-start-failure.json');
-  await atomicBytes(destination,bytes);
-  const persistedSha256=sha256Bytes(await readFile(destination));
-  if(persistedSha256!==sourceSha256) throw new Error('preserved controller start failure evidence SHA-256 mismatch');
-  return {path:destination,sha256:persistedSha256,schema:evidence.schema,command:evidence.command,
-    failed_at_utc:evidence.failed_at_utc,message:evidence.message};
-}
-async function readLedger(ctx,name){
-  const file=path.join(ctx.runtime_root,`${name}.instance.json`);
-  const value=JSON.parse((await readFile(file,'utf8')).replace(/^\uFEFF/,''));
-  if(value.schema!=='deadbyte.controller.v1'||value.component!==name||!Number.isInteger(Number(value.pid))||
-      !HEX64.test(String(value.instance_nonce))||!HEX64.test(String(value.image_sha256))) {
-    throw new Error(`${name} ledger identity invalid`);
-  }
-  return {schema:value.schema,component:value.component,instance_nonce:String(value.instance_nonce),
-    pid:Number(value.pid),creation_time_utc:String(value.creation_time_utc??''),image_path:String(value.image_path??''),
-    image_sha256:String(value.image_sha256),script_path:String(value.script_path??''),script_sha256:String(value.script_sha256??'')};
-}
-function sameGeneration(a,b){
-  return a.pid===b.pid&&a.instance_nonce===b.instance_nonce&&a.creation_time_utc===b.creation_time_utc&&a.image_sha256===b.image_sha256;
-}
-function activationGuardianOwnedByLineage(item,selfLineage){
-  const name=String(item?.Name??'').toLowerCase();
-  if(name!=='node.exe') return false;
-  const commandLine=String(item?.CommandLine??'');
-  if(!commandLine.toLowerCase().includes('remote-session-guardian.mjs')) return false;
-  const ownerMatch=/(?:^|\s)--owner-pid(?:=|\s+)(\d+)(?=\s|$)/i.exec(commandLine);
-  const nonceMatch=/(?:^|\s)--session-nonce(?:=|\s+)([0-9a-f]{64})(?=\s|$)/i.exec(commandLine);
-  if(!ownerMatch||!nonceMatch) return false;
-  const ownerPid=Number(ownerMatch[1]);
-  const parentPid=Number(item?.ParentProcessId);
-  return Number.isInteger(ownerPid)&&ownerPid>0&&parentPid===ownerPid&&selfLineage.has(ownerPid);
-}
-export function selectOfflineRecoveryBlockers(processes,currentPid=process.pid){
-  const list=(Array.isArray(processes)?processes:[processes]).filter(Boolean);
-  const byPid=new Map();
-  for(const item of list){
-    const pid=Number(item?.ProcessId);
-    if(Number.isInteger(pid)&&pid>0) byPid.set(pid,item);
-  }
-  const selfLineage=new Set();
-  let cursor=Number(currentPid);
-  while(Number.isInteger(cursor)&&cursor>0&&!selfLineage.has(cursor)){
-    selfLineage.add(cursor);
-    const item=byPid.get(cursor);
-    if(!item) break;
-    const parent=Number(item?.ParentProcessId);
-    if(!Number.isInteger(parent)||parent<1||parent===cursor) break;
-    cursor=parent;
-  }
-  const runtimeNames=new Set(['node.exe','cloudflared.exe','deadbyte-tunnel-host.exe']);
-  return list.filter(item=>{
-    const pid=Number(item?.ProcessId);
-    if(selfLineage.has(pid)) return false;
-    if(activationGuardianOwnedByLineage(item,selfLineage)) return false;
-    const name=String(item?.Name??'').toLowerCase();
-    if(!runtimeNames.has(name)) return false;
-    const commandLine=String(item?.CommandLine??'').toLowerCase();
-    return commandLine.includes('deadbyte-mcp')||commandLine.includes('mcp-server.mjs')||
-      commandLine.includes('runtime-self-update.mjs')||commandLine.includes('remote-session-guardian.mjs')||
-      commandLine.includes('deadbyte-tunnel-host.exe');
-  });
-}
-function cleanOfflinePredecessor(ctx){
-  const runtimeRoot=path.resolve(ctx.runtime_root);
-  const blockers=[
-    'bridge.instance.json','cloud.instance.json',
-    'process-grant.json','coding-grant.json','autonomous-grant.json',
-    'desktop-grant.json','host-grant.json'
-  ].filter(name=>existsSync(path.join(runtimeRoot,name)));
-  if(blockers.length) throw new Error('offline predecessor recovery blocked by runtime state: '+blockers.join(','));
-
-  const command="Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine | ConvertTo-Json -Compress";
-  const result=runCaptured(powershellPath(),['-NoLogo','-NoProfile','-Command',command],{timeoutMs:15000});
-  const text=assertRun(result,'runtime process query').trim();
-  if(text){
-    let parsed;
-    try { parsed=JSON.parse(text); } catch(error){ throw new Error('runtime process query JSON invalid: '+error.message); }
-    const relevant=selectOfflineRecoveryBlockers(Array.isArray(parsed)?parsed:[parsed],process.pid);
-    if(relevant.length) throw new Error('offline predecessor recovery blocked by DEADBYTE runtime processes: '+relevant.map(item=>String(item?.Name??'unknown')+'#'+String(item?.ProcessId??'?')).join(','));
-  }
-  return {
-    online:false,offline:true,bridge_pid:null,cloud_pid:null,local_ready:false,
-    process_armed:false,coding_armed:false,autonomous_armed:false,desktop_armed:false,host_armed:false
-  };
-}
-function nodeProcesses(){
-  const command=`Get-CimInstance Win32_Process -Filter \"Name='node.exe'\" | Select-Object ProcessId,ParentProcessId,CreationDate,ExecutablePath,CommandLine | ConvertTo-Json -Compress`;
-  const result=runCaptured(powershellPath(),['-NoLogo','-NoProfile','-Command',command],{timeoutMs:15000});
-  const text=assertRun(result,'node process query').trim(); if(!text) return [];
-  const parsed=JSON.parse(text); return Array.isArray(parsed)?parsed:[parsed];
-}
-export function selectCoreProcess(processes,coreRoot,bridgePid,verifiedBridge=null){
-  const needle=path.join(coreRoot,'src','mcp-server.mjs').replaceAll('/','\\').toLowerCase();
-  const children=processes.filter(item=>Number(item.ParentProcessId)===bridgePid);
-  const visible=children.filter(item=>String(item.CommandLine??'').length>0);
-  const matches=visible.filter(item=>String(item.CommandLine).replaceAll('/','\\').toLowerCase().includes(needle));
-  let item=null,identityBasis=null;
-  if(children.length===1&&visible.length===1&&matches.length===1){
-    item=matches[0]; identityBasis='command_line';
-  } else if(children.length===1&&visible.length===0){
-    if(verifiedBridge?.component!=='bridge'||verifiedBridge.pid!==bridgePid||!path.isAbsolute(String(verifiedBridge.script_path??''))||
-        !HEX64.test(String(verifiedBridge.script_sha256??''))) {
-      throw new Error(`opaque downstream core requires verified Bridge script binding for bridge ${bridgePid}`);
-    }
-    item=children[0]; identityBasis='verified_bridge_single_opaque_node_child';
-  } else {
-    throw new Error(`expected one unambiguous downstream core for bridge ${bridgePid}, found children=${children.length} visible_matches=${matches.length}`);
-  }
-  const pid=Number(item.ProcessId),creationDate=String(item.CreationDate??'');
-  if(!Number.isInteger(pid)||pid<1||creationDate.length<1) throw new Error(`downstream core identity incomplete for bridge ${bridgePid}`);
-  return {pid,parent_pid:Number(item.ParentProcessId),creation_date:creationDate,
-    executable_path:String(item.ExecutablePath??''),command_line:String(item.CommandLine??''),identity_basis:identityBasis};
-}
-function coreProcess(coreRoot,bridge){
-  return selectCoreProcess(nodeProcesses(),coreRoot,bridge.pid,bridge);
-}
-export async function waitForCoreProcess(coreRoot,bridge,{
-  timeoutMs=10000,
-  pollMs=100,
-  processProvider=nodeProcesses,
-  sleepFn=sleep,
-  nowFn=Date.now
+import { createHash, createPrivateKey, createPublicKey, randomBytes, sign as cryptoSign, verify as cryptoVerify } from 'node:crypto';
+import { spawn, spawnSync } from 'node:child_process';
+import { existsSync, lstatSync, realpathSync } from 'node:fs';
+import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  atomicWriteActivePointer,
+  materializeReleaseSlot,
+  parseActivePointer,
+  parseManifest,
+  releaseId,
+  renderStableLauncherCmd,
+  renderStableLauncherPs1,
+  sha256Bytes,
+  verifyManifestTree
+} from './release-slot.mjs';
+import { createGenerationBundle, verifyGenerationBundle } from './release-generation.mjs';
+import { resolveStateRoot } from './state-root.mjs';
+import { verifyProjectOwnerApproval } from './r70-owner-approval.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const SEMVER=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const RECEIPT_DOMAIN=Buffer.from('DEADBYTE-R27-SLOT-UPDATE-V1\0','utf8');
+const UPDATE_SCHEMA='deadbyte.r27-slot-update-receipt.v1';
+const HANDOFF_SCHEMA='deadbyte.r27-slot-update-handoff.v1';
+const FAILURE_SCHEMA='deadbyte.r27-slot-update-failure.v1';
+const ROLLBACK_SCHEMA='deadbyte.r31-slot-rollback-receipt.v1';
+const ROLLBACK_FAILURE_SCHEMA='deadbyte.r31-slot-rollback-failure.v1';
+const DEFAULT_STATE_ROOT=undefined;
+const TOP_LAUNCHER=path.join(os.homedir(),'Downloads','DEADBYTE-MCP.cmd');
+const RUNTIME_STABILITY_MS=12000;
+const RUNTIME_STABILITY_POLL_MS=500;
+
+const sha256File=async file=>sha256Bytes(await readFile(file));
+const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+  ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
+const canonicalJson=value=>JSON.stringify(canonical(value));
+function normalizePersistentPublicOrigin(value){
+  let publicOrigin;
+  try { publicOrigin=new URL(String(value)); }
+  catch { throw new Error('named tunnel public origin must be one persistent HTTPS origin'); }
+  if(publicOrigin.protocol!=='https:'||publicOrigin.username||publicOrigin.password||publicOrigin.search||publicOrigin.hash||publicOrigin.pathname!=='/'||!publicOrigin.hostname) {
+    throw new Error('named tunnel public origin must be one persistent HTTPS origin without path, query, fragment, or credentials');
+  }
+  if(publicOrigin.hostname.toLowerCase().endsWith('.trycloudflare.com')) throw new Error('named tunnel public origin must be persistent; trycloudflare is forbidden');
+  return publicOrigin.origin;
+}
+export function parseUpdateArgs(argv){
+  const out={stage:null,developmentRoot:null,expectedVersion:null,expectedManifest:null,sourceRoot:null,restoreStandingGrants:false,recoverOfflinePredecessor:false,enableMachineFs:false,enableObservation:false,enableDesktop:false,enableAutonomousSupervisor:false,cloudTransport:null,bridgeBootstrap:null,processPolicyBootstrap:null,hostPolicyBootstrap:null,codingPolicyBootstrap:null,autonomousPolicyBootstrap:null,ownerApprovalBootstrap:null,desktopPolicyBootstrap:null,semanticLspBootstrap:null,hostCommandPins:[]};
+  const cloud={},bridge={},processPolicy={},hostPolicy={},codingPolicy={},autonomousPolicy={},ownerApproval={},desktopPolicy={},semanticLsp={},seen=new Set(),hostPinIds=new Set();
+  const bridgeFlags=new Map([
+    ['--bridge-root','root'],['--bridge-script-sha256','scriptSha256']
+  ]);
+  const processPolicyFlags=new Map([
+    ['--process-policy','path'],['--process-policy-sha256','sha256']
+  ]);
+  const hostPolicyFlags=new Map([
+    ['--host-policy','path'],['--host-policy-sha256','sha256']
+  ]);
+  const codingPolicyFlags=new Map([
+    ['--coding-policy','path'],['--coding-policy-sha256','sha256']
+  ]);
+  const autonomousPolicyFlags=new Map([
+    ['--autonomous-policy','path'],['--autonomous-policy-sha256','sha256']
+  ]);
+  const ownerApprovalFlags=new Map([
+    ['--owner-approval','path'],['--owner-approval-sha256','sha256']
+  ]);
+  const desktopPolicyFlags=new Map([
+    ['--desktop-policy','path'],['--desktop-policy-sha256','sha256']
+  ]);
+  const semanticLspFlags=new Map([
+    ['--semantic-lsp-config','path'],['--semantic-lsp-config-sha256','sha256']
+  ]);
+  const cloudFlags=new Map([
+    ['--cloud-cloudflared','cloudflaredPath'],['--cloud-cloudflared-sha256','cloudflaredSha256'],
+    ['--cloud-token-file','tokenFilePath'],['--cloud-token-sha256','tokenFileSha256'],
+    ['--cloud-child-working-directory','childWorkingDirectory'],['--cloud-public-origin','publicOrigin']
+  ]);
+  const valued=new Set(['--stage','--development-root','--expected-version','--expected-manifest','--source-root','--host-command-pin',...bridgeFlags.keys(),...processPolicyFlags.keys(),...hostPolicyFlags.keys(),...codingPolicyFlags.keys(),...autonomousPolicyFlags.keys(),...ownerApprovalFlags.keys(),...desktopPolicyFlags.keys(),...semanticLspFlags.keys(),...cloudFlags.keys()]);
+  for(let index=0;index<argv.length;index++){
+    const arg=argv[index];
+    if(arg==='--restore-standing-grants'||arg==='--recover-offline-predecessor'||arg==='--enable-machine-fs'||arg==='--enable-observation'||arg==='--enable-desktop'||arg==='--enable-autonomous-supervisor'){
+      if(seen.has(arg)) throw new Error(`duplicate self-update argument '${arg}'`);
+      seen.add(arg);
+      if(arg==='--restore-standing-grants') out.restoreStandingGrants=true;
+      else if(arg==='--recover-offline-predecessor') out.recoverOfflinePredecessor=true;
+      else if(arg==='--enable-machine-fs') out.enableMachineFs=true;
+      else if(arg==='--enable-observation') out.enableObservation=true;
+      else if(arg==='--enable-desktop') out.enableDesktop=true;
+      else out.enableAutonomousSupervisor=true;
+      continue;
+    }
+    if(arg==='--host-command-pin'){
+      const value=argv[++index];
+      if(!value) throw new Error('--host-command-pin requires command_id=sha256');
+      const match=/^([A-Za-z0-9._-]{1,64})=([0-9a-f]{64})$/.exec(value);
+      if(!match) throw new Error('host command pin must be command_id=lowercase_sha256');
+      const [,commandId,sha256]=match;
+      if(hostPinIds.has(commandId)) throw new Error(`duplicate host command pin '${commandId}'`);
+      hostPinIds.add(commandId); out.hostCommandPins.push({commandId,sha256}); continue;
+    }
+    if(!valued.has(arg)) throw new Error(`unknown self-update argument '${arg}'`);
+    if(seen.has(arg)) throw new Error(`duplicate self-update argument '${arg}'`);
+    seen.add(arg);
+    const value=argv[++index];
+    if(!value) throw new Error(`${arg} requires a value`);
+    if(arg==='--stage') out.stage=path.resolve(value);
+    else if(arg==='--development-root') out.developmentRoot=path.resolve(value);
+    else if(arg==='--expected-version') out.expectedVersion=value;
+    else if(arg==='--expected-manifest') out.expectedManifest=value.toLowerCase();
+    else if(arg==='--source-root') out.sourceRoot=path.resolve(value);
+    else if(bridgeFlags.has(arg)) bridge[bridgeFlags.get(arg)]=value;
+    else if(processPolicyFlags.has(arg)) processPolicy[processPolicyFlags.get(arg)]=value;
+    else if(hostPolicyFlags.has(arg)) hostPolicy[hostPolicyFlags.get(arg)]=value;
+    else if(codingPolicyFlags.has(arg)) codingPolicy[codingPolicyFlags.get(arg)]=value;
+    else if(autonomousPolicyFlags.has(arg)) autonomousPolicy[autonomousPolicyFlags.get(arg)]=value;
+    else if(ownerApprovalFlags.has(arg)) ownerApproval[ownerApprovalFlags.get(arg)]=value;
+    else if(desktopPolicyFlags.has(arg)) desktopPolicy[desktopPolicyFlags.get(arg)]=value;
+    else if(semanticLspFlags.has(arg)) semanticLsp[semanticLspFlags.get(arg)]=value;
+    else cloud[cloudFlags.get(arg)]=value;
+  }
+  if(!out.stage) throw new Error('--stage is required');
+  if(!out.developmentRoot) throw new Error('--development-root is required');
+  if(!SEMVER.test(String(out.expectedVersion??''))) throw new Error('--expected-version must be SemVer');
+  if(!HEX64.test(String(out.expectedManifest??''))) throw new Error('--expected-manifest must be lowercase SHA-256 hex');
+  const bridgeFields=[...bridgeFlags.values()],bridgePresent=bridgeFields.filter(key=>bridge[key]!==undefined);
+  if(bridgePresent.length!==0&&bridgePresent.length!==bridgeFields.length) throw new Error('bridge bootstrap requires root plus script SHA-256 as one pair');
+  if(bridgePresent.length===bridgeFields.length){
+    const scriptSha256=String(bridge.scriptSha256).toLowerCase();
+    if(!HEX64.test(scriptSha256)) throw new Error('bridge script SHA-256 must be lowercase hex');
+    out.bridgeBootstrap={root:path.resolve(bridge.root),scriptSha256};
+  }
+  const processPolicyFields=[...processPolicyFlags.values()],processPolicyPresent=processPolicyFields.filter(key=>processPolicy[key]!==undefined);
+  if(processPolicyPresent.length!==0&&processPolicyPresent.length!==processPolicyFields.length) throw new Error('process policy bootstrap requires path plus SHA-256 as one pair');
+  if(processPolicyPresent.length===processPolicyFields.length){
+    const sha256=String(processPolicy.sha256).toLowerCase();
+    if(!HEX64.test(sha256)) throw new Error('process policy SHA-256 must be lowercase hex');
+    out.processPolicyBootstrap={path:path.resolve(processPolicy.path),sha256};
+  }
+  const hostPolicyFields=[...hostPolicyFlags.values()],hostPolicyPresent=hostPolicyFields.filter(key=>hostPolicy[key]!==undefined);
+  if(hostPolicyPresent.length!==0&&hostPolicyPresent.length!==hostPolicyFields.length) throw new Error('host policy bootstrap requires path plus SHA-256 as one pair');
+  if(hostPolicyPresent.length===hostPolicyFields.length){
+    const sha256=String(hostPolicy.sha256).toLowerCase();
+    if(!HEX64.test(sha256)) throw new Error('host policy SHA-256 must be lowercase hex');
+    out.hostPolicyBootstrap={path:path.resolve(hostPolicy.path),sha256};
+  }
+  const codingPolicyFields=[...codingPolicyFlags.values()],codingPolicyPresent=codingPolicyFields.filter(key=>codingPolicy[key]!==undefined);
+  if(codingPolicyPresent.length!==0&&codingPolicyPresent.length!==codingPolicyFields.length) throw new Error('coding policy bootstrap requires path plus SHA-256 as one pair');
+  if(codingPolicyPresent.length===codingPolicyFields.length){
+    const sha256=String(codingPolicy.sha256).toLowerCase();
+    if(!HEX64.test(sha256)) throw new Error('coding policy SHA-256 must be lowercase hex');
+    out.codingPolicyBootstrap={path:path.resolve(codingPolicy.path),sha256};
+  }
+  const autonomousPolicyFields=[...autonomousPolicyFlags.values()],autonomousPolicyPresent=autonomousPolicyFields.filter(key=>autonomousPolicy[key]!==undefined);
+  if(autonomousPolicyPresent.length!==0&&autonomousPolicyPresent.length!==autonomousPolicyFields.length) throw new Error('autonomous policy bootstrap requires path plus SHA-256 as one pair');
+  if(autonomousPolicyPresent.length===autonomousPolicyFields.length){
+    const sha256=String(autonomousPolicy.sha256).toLowerCase();
+    if(!HEX64.test(sha256)) throw new Error('autonomous policy SHA-256 must be lowercase hex');
+    out.autonomousPolicyBootstrap={path:path.resolve(autonomousPolicy.path),sha256};
+  }
+  const ownerApprovalFields=[...ownerApprovalFlags.values()],ownerApprovalPresent=ownerApprovalFields.filter(key=>ownerApproval[key]!==undefined);
+  if(ownerApprovalPresent.length!==0&&ownerApprovalPresent.length!==ownerApprovalFields.length) throw new Error('owner approval bootstrap requires path plus SHA-256 as one pair');
+  if(ownerApprovalPresent.length===ownerApprovalFields.length){
+    const sha256=String(ownerApproval.sha256).toLowerCase();
+    if(!HEX64.test(sha256)) throw new Error('owner approval SHA-256 must be lowercase hex');
+    out.ownerApprovalBootstrap={path:path.resolve(ownerApproval.path),sha256};
+  }
+  if(Boolean(out.autonomousPolicyBootstrap)!==Boolean(out.ownerApprovalBootstrap)) throw new Error('autonomous policy bootstrap requires pinned owner approval, and owner approval requires autonomous policy');
+  const desktopPolicyFields=[...desktopPolicyFlags.values()],desktopPolicyPresent=desktopPolicyFields.filter(key=>desktopPolicy[key]!==undefined);
+  if(desktopPolicyPresent.length!==0&&desktopPolicyPresent.length!==desktopPolicyFields.length) throw new Error('desktop policy bootstrap requires path plus SHA-256 as one pair');
+  if(desktopPolicyPresent.length===desktopPolicyFields.length){
+    const sha256=String(desktopPolicy.sha256).toLowerCase();
+    if(!HEX64.test(sha256)) throw new Error('desktop policy SHA-256 must be lowercase hex');
+    out.desktopPolicyBootstrap={path:path.resolve(desktopPolicy.path),sha256};
+  }
+  const semanticLspFields=[...semanticLspFlags.values()],semanticLspPresent=semanticLspFields.filter(key=>semanticLsp[key]!==undefined);
+  if(semanticLspPresent.length!==0&&semanticLspPresent.length!==semanticLspFields.length) throw new Error('semantic LSP config bootstrap requires path plus SHA-256 as one pair');
+  if(semanticLspPresent.length===semanticLspFields.length){
+    const sha256=String(semanticLsp.sha256).toLowerCase();
+    if(!HEX64.test(sha256)) throw new Error('semantic LSP config SHA-256 must be lowercase hex');
+    out.semanticLspBootstrap={path:path.resolve(semanticLsp.path),sha256};
+  }
+  const cloudFields=[...cloudFlags.values()],present=cloudFields.filter(key=>cloud[key]!==undefined);
+  if(present.length!==0&&present.length!==cloudFields.length) throw new Error('named tunnel bootstrap requires cloud path/hash/token/workdir plus persistent public origin');
+  if(present.length===cloudFields.length){
+    for(const key of ['cloudflaredSha256','tokenFileSha256']) cloud[key]=String(cloud[key]).toLowerCase();
+    if(!HEX64.test(cloud.cloudflaredSha256)||!HEX64.test(cloud.tokenFileSha256)) throw new Error('named tunnel dependency SHA-256 must be lowercase hex');
+    const publicOrigin=normalizePersistentPublicOrigin(cloud.publicOrigin);
+    out.cloudTransport={
+      cloudflared:{path:path.resolve(cloud.cloudflaredPath),sha256:cloud.cloudflaredSha256},
+      tokenFile:{path:path.resolve(cloud.tokenFilePath),sha256:cloud.tokenFileSha256},
+      childWorkingDirectory:path.resolve(cloud.childWorkingDirectory),
+      publicOrigin
+    };
+  }
+  return out;
+}
+
+export function parseRollbackArgs(argv){
+  let activationReceipt=null;
+  for(let index=0;index<argv.length;index++){
+    const arg=argv[index];
+    if(arg!=='--rollback-receipt') throw new Error(`unknown rollback argument '${arg}'`);
+    if(activationReceipt!==null) throw new Error("duplicate rollback argument '--rollback-receipt'");
+    const value=argv[++index];
+    if(!value) throw new Error('--rollback-receipt requires a value');
+    activationReceipt=path.resolve(value);
+  }
+  if(!activationReceipt) throw new Error('--rollback-receipt is required');
+  return {activationReceipt};
+}
+
+function powershellPath(){
+  return path.join(process.env.SystemRoot||'C:\\Windows','System32','WindowsPowerShell','v1.0','powershell.exe');
+}
+export function windowsPowerShellEnvironment(base=process.env){
+  const systemRoot=base.SystemRoot||base.SYSTEMROOT||'C:\\Windows';
+  const userProfile=base.USERPROFILE||os.homedir();
+  const programFiles=base.ProgramFiles||base.PROGRAMFILES||'C:\\Program Files';
+  const environment={...base};
+  const inherited=Object.entries(base).filter(([key])=>key.toLowerCase()==='psmodulepath').flatMap(([,value])=>String(value??'').split(';')).filter(Boolean);
+  for(const key of Object.keys(environment)) if(key.toLowerCase()==='psmodulepath') delete environment[key];
+  const modules=[
+    path.join(systemRoot,'System32','WindowsPowerShell','v1.0','Modules'),
+    path.join(userProfile,'Documents','WindowsPowerShell','Modules'),
+    path.join(programFiles,'WindowsPowerShell','Modules'),
+    ...inherited
+  ];
+  const seen=new Set();
+  return {...environment,PSModulePath:modules.filter(modulePath=>{
+    const key=modulePath.toLowerCase();
+    if(seen.has(key)) return false;
+    seen.add(key);return true;
+  }).join(';')};
+}
+function commandEnvironment(exe,base=process.env){
+  return path.resolve(exe).toLowerCase()===path.resolve(powershellPath()).toLowerCase()
+    ?windowsPowerShellEnvironment(base):base;
+}
+function runCaptured(exe,args,{cwd,env,timeoutMs=45000}={}){
+  const baseEnv=env??process.env;
+  const childEnv=commandEnvironment(exe,baseEnv);
+  const result=spawnSync(exe,args,{cwd,env:childEnv,encoding:'utf8',windowsHide:true,timeout:timeoutMs,maxBuffer:16*1024*1024});
+  return {status:result.status,signal:result.signal,error:result.error?{code:result.error.code??null,message:result.error.message}:null,stdout:result.stdout??'',stderr:result.stderr??''};
+}
+function assertRun(result,label){
+  if(result.error||result.status!==0) throw new Error(`${label} failed status=${result.status} error=${result.error?.message??'none'}\n${result.stderr||result.stdout}`);
+  return result.stdout;
+}
+export async function loadPowerShellDataFile(file){
+  const env={...process.env,DEADBYTE_R27_CONFIG_READ:path.resolve(file)};
+  const command="$ErrorActionPreference='Stop'; $v=Import-PowerShellDataFile -LiteralPath $env:DEADBYTE_R27_CONFIG_READ; $v | ConvertTo-Json -Depth 16 -Compress";
+  const result=runCaptured(powershellPath(),['-NoLogo','-NoProfile','-Command',command],{env,timeoutMs:15000});
+  const text=assertRun(result,'PowerShell data-file load').trim();
+  let value; try { value=JSON.parse(text); } catch(error){ throw new Error(`controller config JSON conversion failed: ${error.message}`); }
+  if(!value||typeof value!=='object'||Array.isArray(value)) throw new Error('controller config must be an object');
+  return value;
+}
+async function readJson(file){
+  const text=(await readFile(file,'utf8')).replace(/^\uFEFF/,'');
+  let value; try { value=JSON.parse(text); } catch(error){ throw new Error(`JSON invalid ${file}: ${error.message}`); }
+  return value;
+}
+async function atomicBytes(file,bytes){
+  await mkdir(path.dirname(file),{recursive:true});
+  const temp=`${file}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
+  const handle=await open(temp,'wx');
+  try { await handle.writeFile(bytes); await handle.sync(); } finally { await handle.close(); }
+  let renamed=false;
+  let lastRenameError=null;
+  for(let attempt=0;attempt<20;attempt+=1){
+    try { await rename(temp,file); renamed=true; break; }
+    catch(error){
+      lastRenameError=error;
+      if(!["EPERM","EBUSY","EACCES"].includes(error?.code) || attempt===19) break;
+      await new Promise(resolve=>setTimeout(resolve,Math.min(500,100*(attempt+1))));
+    }
+  }
+  if(!renamed){ await rm(temp,{force:true}).catch(()=>{}); throw lastRenameError; }
+  if(sha256Bytes(await readFile(file))!==sha256Bytes(bytes)) throw new Error(`atomic write readback mismatch: ${file}`);
+}
+async function normalizeComponentIdentities(config){
+  const next=structuredClone(config);
+  for(const name of ['Bridge','Cloud']){
+    const spec=next[name];
+    if(!spec||typeof spec!=='object') throw new Error(`${name} launch specification missing`);
+    if(typeof spec.FilePath!=='string'||!path.isAbsolute(spec.FilePath)) throw new Error(`${name} FilePath must be absolute`);
+    const exe=path.resolve(spec.FilePath);
+    const stat=await lstat(exe);
+    if(!stat.isFile()||stat.isSymbolicLink()) throw new Error(`${name} executable must be a regular file`);
+    const actual=await sha256File(exe);
+    if(spec.FileSha256!==undefined&&spec.FileSha256!==''&&spec.FileSha256!==actual) throw new Error(`${name} executable pin drift detected`);
+    spec.FilePath=exe; spec.FileSha256=actual;
+    const dependencies=spec.Dependencies??[];
+    if(!Array.isArray(dependencies)||dependencies.length>16) throw new Error(`${name} Dependencies invalid`);
+    const normalizedDependencies=[];
+    for(const dependency of dependencies){
+      const depName=String(dependency?.Name??'');
+      const depPath=path.resolve(String(dependency?.Path??''));
+      const depHash=String(dependency?.Sha256??'').toLowerCase();
+      if(!/^[A-Za-z0-9._-]{1,32}$/.test(depName)||!path.isAbsolute(String(dependency?.Path??''))||!HEX64.test(depHash)) throw new Error(`${name} dependency contract invalid`);
+      const depStat=await lstat(depPath); if(!depStat.isFile()||depStat.isSymbolicLink()) throw new Error(`${name} dependency must be a regular file: ${depName}`);
+      const depActual=await sha256File(depPath); if(depActual!==depHash) throw new Error(`${name} dependency pin drift detected: ${depName}`);
+      normalizedDependencies.push({Name:depName,Path:depPath,Sha256:depHash});
+    }
+    spec.Dependencies=normalizedDependencies;
+    if(name==='Cloud'&&spec.Transport!==undefined){
+      const transport=String(spec.Transport);
+      const valid=(transport==='deadbyte.named-tunnel.v1'&&normalizedDependencies.length===3)||
+        (transport==='deadbyte.named-tunnel.v2'&&normalizedDependencies.length===2);
+      if(!valid) throw new Error('Cloud named tunnel transport contract invalid');
+    }
+  }
+  const bridge=next.Bridge;
+  const raw=String(bridge.Arguments??'');
+  const normalized=raw.replaceAll('\\','/');
+  if(!/^[A-Za-z0-9._/-]+\.(?:mjs|js)$/.test(normalized)||path.posix.isAbsolute(normalized)||normalized.split('/').includes('..')) {
+    throw new Error('R27 Bridge Arguments must be one relative .mjs/.js script path');
+  }
+  if(typeof bridge.WorkingDirectory!=='string'||!path.isAbsolute(bridge.WorkingDirectory)) throw new Error('Bridge WorkingDirectory must be absolute');
+  const script=path.resolve(bridge.WorkingDirectory,...normalized.split('/'));
+  const scriptStat=await lstat(script);
+  if(!scriptStat.isFile()||scriptStat.isSymbolicLink()) throw new Error('Bridge script must be a regular file');
+  const scriptHash=await sha256File(script);
+  if(bridge.ScriptSha256!==undefined&&bridge.ScriptSha256!==''&&bridge.ScriptSha256!==scriptHash) throw new Error('Bridge script pin drift detected');
+  bridge.ScriptPath=script; bridge.ScriptSha256=scriptHash;
+  return next;
+}
+
+function bridgeDependencyName(relativePath,usedNames){
+  const normalized=String(relativePath).replaceAll('\\','/').replaceAll('/','_');
+  let name=normalized;
+  if(!/^[A-Za-z0-9._-]{1,32}$/.test(name)||usedNames.has(name)){
+    name=`dep-${sha256Bytes(Buffer.from(String(relativePath),'utf8')).slice(0,20)}`;
+  }
+  if(usedNames.has(name)) throw new Error(`bridge dependency name collision: ${relativePath}`);
+  usedNames.add(name);
+  return name;
+}
+function bridgeStaticRelativeImports(source,file){
+  const found=[];
+  for(const [index,line] of String(source).split(/\r?\n/).entries()){
+    if(/\bimport\s*\(\s*['"]\.\.?\//.test(line)) throw new Error(`bridge dynamic relative import is forbidden: ${file}:${index+1}`);
+    const importStart=/^\s*import\b/.test(line);
+    const exportStart=/^\s*export\b/.test(line)&&/\bfrom\b/.test(line);
+    if(!importStart&&!exportStart) continue;
+    const match=importStart
+      ? /^\s*import\s+(?:(?:[^'"]+?)\s+from\s*)?['"]([^'"]+)['"]\s*;?\s*$/.exec(line)
+      : /^\s*export\s+[^'"]*?\s+from\s*['"]([^'"]+)['"]\s*;?\s*$/.exec(line);
+    if(!match) throw new Error(`bridge import syntax unsupported for dependency binding: ${file}:${index+1}`);
+    if(match[1].startsWith('.')) found.push(match[1]);
+  }
+  return found;
+}
+async function discoverBridgeLocalDependencies(root,entryScript){
+  const absoluteRoot=path.resolve(root),realRoot=await realpath(absoluteRoot);
+  const srcRoot=path.join(absoluteRoot,'src');
+  const queue=[path.resolve(entryScript)],visited=new Set(),files=[];
+  while(queue.length){
+    const current=queue.shift();
+    const currentReal=await realpath(current);
+    const relativeReal=path.relative(realRoot,currentReal);
+    if(relativeReal.startsWith('..')||path.isAbsolute(relativeReal)) throw new Error(`bridge dependency escapes bridge root: ${current}`);
+    if(visited.has(currentReal)) continue;
+    visited.add(currentReal);
+    if(visited.size>16) throw new Error('bridge local dependency closure exceeds 16 files');
+    const stat=await lstat(current);
+    if(!stat.isFile()||stat.isSymbolicLink()) throw new Error(`bridge dependency must be a regular file: ${current}`);
+    const source=await readFile(current,'utf8');
+    const specifiers=bridgeStaticRelativeImports(source,current);
+    if(currentReal!==await realpath(entryScript)) files.push(currentReal);
+    for(const specifier of specifiers){
+      if(!specifier.startsWith('./')) throw new Error(`bridge relative import escapes bridge root: ${specifier}`);
+      if(specifier.includes('?')||specifier.includes('#')) throw new Error(`bridge relative import query/fragment unsupported: ${specifier}`);
+      const resolved=path.resolve(path.dirname(current),specifier);
+      const relative=path.relative(absoluteRoot,resolved);
+      if(relative.startsWith('..')||path.isAbsolute(relative)) throw new Error(`bridge dependency escapes bridge root: ${specifier}`);
+      if(!/\.(?:mjs|js)$/i.test(resolved)) throw new Error(`bridge local dependency must be .mjs/.js: ${specifier}`);
+      queue.push(resolved);
+    }
+  }
+  const unique=[...new Set(files)].sort((a,b)=>a.localeCompare(b));
+  const usedNames=new Set();
+  const dependencies=[];
+  for(const file of unique){
+    const relative=path.relative(srcRoot,file).replaceAll('\\','/');
+    if(relative.startsWith('..')||path.isAbsolute(relative)) throw new Error(`bridge dependency must remain under src: ${file}`);
+    dependencies.push({Name:bridgeDependencyName(relative,usedNames),Path:file,Sha256:await sha256File(file)});
+  }
+  return dependencies;
+}
+
+export async function prepareBridgeSpec(config,bootstrap){
+  if(!bootstrap) return structuredClone(config);
+  if(typeof bootstrap.root!=='string'||!path.isAbsolute(bootstrap.root)||!HEX64.test(String(bootstrap.scriptSha256??''))) {
+    throw new Error('bridge bootstrap requires absolute root plus lowercase script SHA-256');
+  }
+  const root=path.resolve(bootstrap.root),rootStat=await lstat(root);
+  if(!rootStat.isDirectory()||rootStat.isSymbolicLink()) throw new Error('bridge root must be a real directory');
+  const packageFile=path.join(root,'package.json'),script=path.join(root,'src','bridge.mjs');
+  const packageStat=await lstat(packageFile),scriptStat=await lstat(script);
+  if(!packageStat.isFile()||packageStat.isSymbolicLink()) throw new Error('bridge package.json must be a regular file');
+  if(!scriptStat.isFile()||scriptStat.isSymbolicLink()) throw new Error('bridge script must be a regular file');
+  const pkg=JSON.parse(await readFile(packageFile,'utf8'));
+  if(pkg?.name!=='deadbyte-chatgpt-bridge') throw new Error('bridge package identity mismatch');
+  const actual=await sha256File(script),expected=String(bootstrap.scriptSha256).toLowerCase();
+  if(actual!==expected) throw new Error(`bridge script SHA-256 mismatch: expected ${expected}, found ${actual}`);
+  const next=structuredClone(config);
+  if(!next.Bridge||typeof next.Bridge!=='object') throw new Error('Bridge launch specification missing');
+  next.Bridge.WorkingDirectory=root;
+  next.Bridge.Arguments='src\\bridge.mjs';
+  next.Bridge.ScriptPath=script;
+  next.Bridge.ScriptSha256=actual;
+  next.Bridge.Dependencies=await discoverBridgeLocalDependencies(root,script);
+  return next;
+}
+
+export async function prepareReleaseBridgeSpec(config,bootstrap,releaseRoot){
+  if(!bootstrap) return structuredClone(config);
+  if(typeof releaseRoot!=='string'||!path.isAbsolute(releaseRoot))throw new Error('immutable release root required for Bridge binding');
+  // Verify the requested development input, then bind runtime paths only to
+  // the manifest-verified immutable slot produced from that same candidate.
+  const verifiedSource=await prepareBridgeSpec(config,bootstrap);
+  return prepareBridgeSpec(verifiedSource,{
+    root:path.join(path.resolve(releaseRoot),'bridge'),
+    scriptSha256:verifiedSource.Bridge.ScriptSha256
+  });
+}
+
+export async function prepareAutonomousSupervisorSpec(config,{releaseRoot,enable=false}={}){
+  const next=structuredClone(config);
+  if(!enable) return next;
+  if(next.AutonomousRuntimeEnabled!==true) throw new Error('autonomous supervisor bootstrap requires AutonomousRuntimeEnabled');
+  if(typeof releaseRoot!=='string'||!path.isAbsolute(releaseRoot)) throw new Error('autonomous supervisor release root must be absolute');
+  const release=path.resolve(releaseRoot),script=path.join(release,'src','autonomous-supervisor-host.mjs');
+  const scriptStat=await lstat(script);
+  if(!scriptStat.isFile()||scriptStat.isSymbolicLink()) throw new Error('autonomous supervisor script must be a regular release file');
+  const bridge=next.Bridge;
+  if(!bridge||typeof bridge.FilePath!=='string'||!path.isAbsolute(bridge.FilePath)||!HEX64.test(String(bridge.FileSha256??''))) {
+    throw new Error('autonomous supervisor bootstrap requires pinned Bridge executable identity');
+  }
+  const executable=path.resolve(bridge.FilePath),exeStat=await lstat(executable);
+  if(!exeStat.isFile()||exeStat.isSymbolicLink()) throw new Error('autonomous supervisor executable must be a regular file');
+  const executableSha256=await sha256File(executable);
+  if(executableSha256!==String(bridge.FileSha256)) throw new Error('autonomous supervisor executable pin drift detected');
+  next.AutonomousSupervisorEnabled=true;
+  next.Supervisor={
+    FilePath:executable,FileSha256:executableSha256,Arguments:'src\\autonomous-supervisor-host.mjs',WorkingDirectory:release,
+    ScriptPath:script,ScriptSha256:await sha256File(script)
+  };
+  return next;
+}
+
+function quoteWindowsArgument(value){
+  const text=String(value??'');
+  if(text.length<1||/["\r\n\0]/.test(text)) throw new Error('named tunnel argument contains unsafe characters');
+  const trailing=(/\\+$/.exec(text)?.[0].length??0);
+  return `"${text}${'\\'.repeat(trailing)}"`;
+}
+async function verifyPinnedRegularFile(file,expected,label){
+  if(typeof file!=='string'||!path.isAbsolute(file)||!HEX64.test(String(expected??''))) throw new Error(`${label} pin contract invalid`);
+  const absolute=path.resolve(file),stat=await lstat(absolute);
+  if(!stat.isFile()||stat.isSymbolicLink()) throw new Error(`${label} must be a regular file`);
+  const actual=await sha256File(absolute);
+  if(actual!==expected) throw new Error(`${label} SHA-256 mismatch: expected ${expected}, found ${actual}`);
+  return {path:absolute,sha256:actual};
+}
+
+export async function readPinnedJsonPolicy(bootstrap,label,readBytes=readFile){
+  const file=bootstrap?.path,expected=bootstrap?.sha256;
+  if(typeof file!=='string'||!path.isAbsolute(file)||!HEX64.test(String(expected??''))) throw new Error(`${label} pin contract invalid`);
+  const absolute=path.resolve(file),stat=await lstat(absolute);
+  if(!stat.isFile()||stat.isSymbolicLink()) throw new Error(`${label} must be a regular file`);
+  const bytes=await readBytes(absolute);
+  if(!Buffer.isBuffer(bytes)) throw new Error(`${label} read must return bytes`);
+  const actual=sha256Bytes(bytes);
+  if(actual!==expected) throw new Error(`${label} SHA-256 mismatch: expected ${expected}, found ${actual}`);
+  let policy;
+  try{policy=JSON.parse(bytes.toString('utf8'));}
+  catch{throw new Error(`${label} JSON invalid`);}
+  return {path:absolute,sha256:actual,policy};
+}
+
+export async function prepareProcessPolicyBootstrap(bootstrap){
+  if(!bootstrap) return null;
+  const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'process policy');
+  const policy=await readJson(pinned.path);
+  if(policy?.schema!=='deadbyte.process-policy.v1'||policy?.enabled!==true) throw new Error('process policy schema/enabled mismatch');
+  return {...pinned,policy};
+}
+
+export async function prepareHostPolicyBootstrap(bootstrap){
+  if(!bootstrap) return null;
+  const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'host policy');
+  const policy=await readJson(pinned.path);
+  if(!['deadbyte.host-policy.v1','deadbyte.host-policy.v2'].includes(policy?.schema)||policy?.enabled!==true||
+     !policy?.commands||typeof policy.commands!=='object'||Array.isArray(policy.commands)) {
+    throw new Error('host policy schema/enabled/commands mismatch');
+  }
+  if(policy.schema==='deadbyte.host-policy.v2'&&(policy.native_exec?.enabled!==true||!Array.isArray(policy.native_exec?.root_ids))) {
+    throw new Error('host policy v2 native_exec contract invalid');
+  }
+  return {...pinned,policy};
+}
+
+export async function prepareCodingPolicyBootstrap(bootstrap){
+  if(!bootstrap) return null;
+  const {policy,...pinned}=await readPinnedJsonPolicy(bootstrap,'coding policy');
+  if(policy?.schema!=='deadbyte.coding-policy.v1'||policy?.enabled!==true||
+     !policy?.roots||typeof policy.roots!=='object'||Array.isArray(policy.roots)||
+     !policy?.commands||typeof policy.commands!=='object'||Array.isArray(policy.commands)) {
+    throw new Error('coding policy schema/enabled/roots/commands mismatch');
+  }
+  return {...pinned,policy};
+}
+
+export async function prepareAutonomousPolicyBootstrap(bootstrap){
+  if(!bootstrap) return null;
+  const {policy,...pinned}=await readPinnedJsonPolicy(bootstrap,'autonomous policy');
+  if(policy?.schema!=='deadbyte.autonomous-policy.v1'||policy?.enabled!==true||
+     !HEX64.test(String(policy.coding_policy_sha256??''))||
+     !Array.isArray(policy.root_ids)||policy.root_ids.length<1||
+     !policy.profiles||typeof policy.profiles!=='object'||Array.isArray(policy.profiles)) {
+    throw new Error('autonomous policy schema/enabled/coding digest/roots/profiles mismatch');
+  }
+  return {...pinned,policy};
+}
+
+export function assertAutonomousBootstrapRoots(autonomousPolicy,codingPolicy,selectedCodingSha256=null){
+  const roots=autonomousPolicy?.root_ids;
+  for(const codingRoot of Object.values(codingPolicy?.roots??{})){
+    const candidate=codingRoot?.path;
+    if((codingRoot?.read===true||codingRoot?.write===true||codingRoot?.exec===true)&&
+       typeof candidate==='string'&&path.isAbsolute(candidate)){
+      const resolved=path.resolve(candidate),filesystemRoot=path.parse(resolved).root;
+      const normalize=value=>process.platform==='win32'?value.toLowerCase():value;
+      if(normalize(resolved)===normalize(filesystemRoot)) throw new Error('coding policy contains a broad filesystem root');
+    }
+  }
+  if(!Array.isArray(roots)||roots.length<1||roots.some(id=>typeof id!=='string'||
+     !/^[A-Za-z0-9._-]{1,64}$/.test(id)||!Object.hasOwn(codingPolicy?.roots??{},id))) {
+    throw new Error('autonomous bootstrap root is outside selected coding policy');
+  }
+  const profiles=autonomousPolicy?.profiles??{};
+  if(!profiles||typeof profiles!=='object'||Array.isArray(profiles)) throw new Error('autonomous bootstrap profiles invalid');
+  for(const [id,profile] of Object.entries(profiles)){
+    if(typeof profile?.root_id!=='string'||!roots.includes(profile.root_id)){
+      throw new Error(`autonomous bootstrap profile '${id}' root outside autonomous roots`);
+    }
+  }
+  if(selectedCodingSha256!==null&&autonomousPolicy.coding_policy_sha256!==selectedCodingSha256) {
+    throw new Error('autonomous bootstrap coding policy SHA-256 mismatch');
+  }
+  for(const id of roots){
+    const rootPath=codingPolicy.roots[id]?.path;
+    if(typeof rootPath==='string'&&path.isAbsolute(rootPath)){
+      const resolved=path.resolve(rootPath),filesystemRoot=path.parse(resolved).root;
+      const normalize=value=>process.platform==='win32'?value.toLowerCase():value;
+      if(normalize(resolved)===normalize(filesystemRoot)) throw new Error('autonomous bootstrap requires a project-scoped root');
+    }
+    try{
+      if(typeof rootPath!=='string'||!path.isAbsolute(rootPath)) throw new Error('path invalid');
+      const stat=lstatSync(rootPath);
+      if(!stat.isDirectory()||stat.isSymbolicLink()) throw new Error('not a regular directory');
+      const resolved=path.resolve(rootPath),real=realpathSync(rootPath);
+      const normalize=value=>process.platform==='win32'?value.toLowerCase():value;
+      if(normalize(resolved)!==normalize(path.resolve(real))) throw new Error('path indirection');
+    }catch{ throw new Error(`autonomous bootstrap root '${id}' must be an existing real directory`); }
+  }
+  return roots;
+}
+
+// R70: Admission check for successor POLICY BOOTSTRAP only. This does not
+// grant authority or establish the owner trust anchor by itself.
+export async function verifyAutonomousOwnerBootstrap({
+  stateRoot,bootstrap,autonomousPolicy,codingPolicy,
+  codingPolicySha256,autonomousPolicySha256,expectedManifest,now=new Date()
 }={}){
-  const bridgePid=Number(bridge?.pid);
-  if(!Number.isInteger(bridgePid)||bridgePid<1) throw new Error('downstream core wait requires verified bridge PID');
-  if(!Number.isFinite(timeoutMs)||timeoutMs<0) throw new Error('downstream core wait timeout invalid');
-  if(!Number.isFinite(pollMs)||pollMs<1) throw new Error('downstream core wait poll invalid');
-  if(typeof processProvider!=='function'||typeof sleepFn!=='function'||typeof nowFn!=='function') throw new Error('downstream core wait hooks invalid');
-  const started=Number(nowFn());
-  let lastError=null;
-  while(true){
-    try {
-      const processes=await processProvider();
-      return selectCoreProcess(processes,coreRoot,bridgePid,bridge);
-    } catch(error){
-      const message=String(error?.message??error);
-      const transient=`expected one unambiguous downstream core for bridge ${bridgePid}, found children=0 visible_matches=0`;
-      if(message!==transient) throw error;
-      lastError=error;
-    }
-    const elapsed=Math.max(0,Number(nowFn())-started);
-    if(elapsed>=timeoutMs){
-      throw new Error(`downstream core did not appear for bridge ${bridgePid} within ${timeoutMs}ms: ${String(lastError?.message??lastError)}`);
-    }
-    await sleepFn(Math.min(pollMs,Math.max(1,timeoutMs-elapsed)));
-  }
-}
-async function captureRuntime(ctx){
-  const statusText=controllerCaptured(ctx,'status',15000); const status=parseControllerStatus(statusText);
-  if(!status.online||!status.bridge_pid||!status.cloud_pid||!status.local_ready) throw new Error(`slot update requires ONLINE runtime: ${statusText}`);
-  if(status.host_armed) throw new Error('slot update requires host plane DISARMED');
-  if(status.autonomous_armed&&!status.coding_armed) throw new Error('invalid runtime authority: autonomous armed without coding');
-  const bridge=await readLedger(ctx,'bridge'); const cloud=await readLedger(ctx,'cloud'); const core=coreProcess(ctx.core_root,bridge);
-  return {status,status_text:statusText.trim(),bridge,cloud,core};
-}
-export async function capturePredecessor(ctx,recoverOfflinePredecessor,{allowHostDisarm=true}={}){
-  let statusText,status;
-  try{
-    statusText=controllerCaptured(ctx,'status',15000);
-    status=parseControllerStatus(statusText);
-  }catch(error){
-    if(!recoverOfflinePredecessor) throw error;
-    try{
-      const runtimeDir=ctx.runtime_root;
-      const hasBridge=existsSync(path.join(runtimeDir,'bridge.instance.json'));
-      const hasCloud=existsSync(path.join(runtimeDir,'cloud.instance.json'));
-      if(hasBridge&&hasCloud){
-        const armed=['process-grant.json','coding-grant.json','autonomous-grant.json','desktop-grant.json','host-grant.json']
-          .some(name=>existsSync(path.join(runtimeDir,name)));
-        if(armed) throw new Error('controller status failed while authority grant state is present');
-        const bridge=await readLedger(ctx,'bridge');
-        const cloud=await readLedger(ctx,'cloud');
-        const core=coreProcess(ctx.core_root,bridge);
-        const status={online:true,offline:false,bridge_pid:bridge.pid,cloud_pid:cloud.pid,local_ready:true,
-          process_armed:false,coding_armed:false,autonomous_armed:false,desktop_armed:false,host_armed:false};
-        return {mode:'online-ledger-recovery',status,status_text:`controller status unavailable; verified runtime ledgers established: ${String(error?.message??error)}`,runtime:{status,status_text:'verified by controller ledgers',bridge,cloud,core}};
-      }
-      const offline=cleanOfflinePredecessor(ctx);
-      return {mode:'offline-recovery',status:offline,status_text:`controller status unavailable; clean offline evidence established: ${String(error?.message??error)}`,runtime:null};
-    }catch(recoveryError){
-      throw new Error(`controller status failed and predecessor recovery was not applicable: ${String(error?.message??error)}; ${String(recoveryError?.message??recoveryError)}`);
-    }
-  }
-  if(status.online&&status.bridge_pid&&status.cloud_pid&&status.local_ready){
-    const runtime=await captureRuntime(ctx);
-    return {mode:'online',status:runtime.status,status_text:runtime.status_text,runtime};
-  }
-  if(!recoverOfflinePredecessor) throw new Error(`slot update requires ONLINE runtime: ${statusText}`);
-  if(!status.offline||status.bridge_pid||status.cloud_pid||status.local_ready) throw new Error(`offline predecessor recovery requires clean OFFLINE controller state: ${statusText}`);
-  if(status.host_armed){
-    if(!allowHostDisarm) throw new Error('offline predecessor recovery requires host plane DISARMED');
-    controllerCaptured(ctx,'disarmhost',15000);
-    statusText=controllerCaptured(ctx,'status',15000);
-    status=parseControllerStatus(statusText);
-    if(!status.offline||status.bridge_pid||status.cloud_pid||status.local_ready) throw new Error(`offline predecessor recovery changed controller state while revoking Host authority: ${statusText}`);
-    if(status.host_armed) throw new Error('offline predecessor recovery requires host plane DISARMED');
-  }
-  if(status.autonomous_armed&&!status.coding_armed) throw new Error('invalid runtime authority: autonomous armed without coding');
-  return {mode:'offline-recovery',status,status_text:statusText.trim(),runtime:null};
-}
-async function waitCoreGone(runtime,timeoutMs=10000){
-  const started=Date.now();
-  while(Date.now()-started<timeoutMs){
-    const found=nodeProcesses().find(item=>Number(item.ProcessId)===runtime.core.pid&&String(item.CreationDate??'')===runtime.core.creation_date);
-    if(!found) return true; await sleep(250);
-  }
-  return false;
-}
-async function startAndVerify(ctx,oldRuntime){
-  let start=null;
-  await rm(path.join(ctx.runtime_root,'controller-start-failure.json'),{force:true});
-  for(let attempt=1;attempt<=3;attempt+=1){
-    start=runControllerStartNoCapture(ctx,45000);
-    if(!start.error&&start.status===0) break;
-    if(attempt<3) await sleep(1500);
-  }
-  if(start.error||start.status!==0){
-    let detail='';
-    try {
-      const evidence=await readControllerStartFailure(ctx);
-      if(evidence) detail=` controller=${evidence.message} evidence_sha256=${evidence.sha256}`;
-    } catch(error) { detail=` controller_evidence_error=${error.message}`; }
-    throw new Error(`controller start transport failed status=${start.status} error=${start.error?.message??'none'}${detail}`);
-  }
-  let statusText=''; let status=null;
-  const started=Date.now();
-  while(Date.now()-started<45000){
-    try { statusText=controllerCaptured(ctx,'status',15000); status=parseControllerStatus(statusText); if(status.online&&status.bridge_pid&&status.cloud_pid&&status.local_ready) break; }
-    catch {} await sleep(500);
-  }
-  if(!status?.online||!status.bridge_pid||!status.cloud_pid||!status.local_ready) throw new Error(`new runtime failed ONLINE gate: ${statusText}`);
-  const bridge=await readLedger(ctx,'bridge'); const cloud=await readLedger(ctx,'cloud'); const core=await waitForCoreProcess(ctx.core_root,bridge);
-  if(oldRuntime?.bridge&&sameGeneration(oldRuntime.bridge,bridge)) throw new Error('fresh bridge generation gate failed');
-  if(oldRuntime?.cloud&&sameGeneration(oldRuntime.cloud,cloud)) throw new Error('fresh cloud generation gate failed');
-  if(oldRuntime?.core&&oldRuntime.core.pid===core.pid&&oldRuntime.core.creation_date===core.creation_date) throw new Error('fresh downstream core generation gate failed');
-  return {status,status_text:statusText.trim(),bridge,cloud,core};
-}
-async function stabilizeRuntime(ctx,runtime){
-  const started=Date.now(); let probes=0;
-  while(Date.now()-started<RUNTIME_STABILITY_MS){
-    await sleep(RUNTIME_STABILITY_POLL_MS);
-    const statusText=controllerCaptured(ctx,'status',15000),status=parseControllerStatus(statusText);
-    if(!status.online||!status.local_ready||status.bridge_pid!==runtime.bridge.pid||status.cloud_pid!==runtime.cloud.pid) {
-      throw new Error(`new runtime lost stability gate: ${statusText}`);
-    }
-    const bridge=await readLedger(ctx,'bridge'),cloud=await readLedger(ctx,'cloud');
-    if(!sameGeneration(runtime.bridge,bridge)||!sameGeneration(runtime.cloud,cloud)) throw new Error('new runtime generation changed during stability gate');
-    probes++;
-  }
-  controllerCaptured(ctx,'test',60000);
-  const finalText=controllerCaptured(ctx,'status',15000),final=parseControllerStatus(finalText);
-  if(!final.online||!final.local_ready||final.bridge_pid!==runtime.bridge.pid||final.cloud_pid!==runtime.cloud.pid) {
-    throw new Error(`new runtime failed post-public stability gate: ${finalText}`);
-  }
-  return {duration_ms:Date.now()-started,probes,public_mcp_gate:'passed'};
-}
-async function verifyPackageRoot(root,expectedVersion,expectedManifest,label){
-  const absolute=path.resolve(root); const info=await lstat(absolute);
-  if(!info.isDirectory()||info.isSymbolicLink()) throw new Error(`${label} root must be a real directory`);
-  const manifestBytes=await readFile(path.join(absolute,'MANIFEST.SHA256'));
-  const digest=sha256Bytes(manifestBytes); if(digest!==expectedManifest) throw new Error(`${label} manifest digest mismatch: ${digest}`);
-  const entries=parseManifest(manifestBytes.toString('utf8')); await verifyManifestTree(absolute,entries);
-  const pkg=await readJson(path.join(absolute,'package.json'));
-  if(pkg?.name!=='deadbyte-mcp'||pkg?.version!==expectedVersion) throw new Error(`${label} package identity mismatch`);
-  return {root:absolute,manifest_sha256:digest,entries:entries.size};
-}
-async function verifyStoredInstallation(stateRoot,pointer){
-  const state=path.resolve(stateRoot); const expectedRelease=path.join(state,'releases',releaseId(pointer.version,pointer.manifest_sha256));
-  if(path.resolve(pointer.release_root)!==path.resolve(expectedRelease)) throw new Error('active pointer release root is not content-addressed store path');
-  const release=await verifyPackageRoot(pointer.release_root,pointer.version,pointer.manifest_sha256,'active release');
-  const generation=await verifyGenerationBundle(pointer.generation_root,pointer.generation_manifest_sha256);
-  const expectedConfig=path.join(path.resolve(pointer.generation_root),'controller-config.psd1');
-  if(path.resolve(pointer.config_path)!==path.resolve(expectedConfig)) throw new Error('active pointer config path mismatch');
-  return {release,generation};
-}
-async function verifyActiveInstallation(stateRoot,pointer){
-  const state=path.resolve(stateRoot);
-  const verified=await verifyStoredInstallation(state,pointer);
-  const currentLauncher=await sha256File(launcherPath(state));
-  if(currentLauncher!==pointer.launcher_sha256) throw new Error('active pointer launcher digest mismatch');
-  return verified;
-}
-async function loadPointerIfPresent(stateRoot){
-  const file=path.join(path.resolve(stateRoot),'active-release.json');
-  if(!existsSync(file)) return {file,pointer:null,snapshot:await snapshotFile(file)};
-  const snapshot=await snapshotFile(file); const pointer=parseActivePointer(snapshot.bytes.toString('utf8'));
-  await verifyActiveInstallation(stateRoot,pointer); return {file,pointer,snapshot};
-}
-async function loadControlInputs({stateRoot,sourceRoot,pointerInfo,bridgeBootstrap=null}){
-  let configPath,ctx;
-  if(pointerInfo.pointer){
-    configPath=pointerInfo.pointer.config_path; ctx=slotContext(stateRoot,pointerInfo.pointer);
-  } else {
-    if(!sourceRoot) throw new Error('--source-root is required for initial slot migration');
-    ctx=legacyContext(sourceRoot); configPath=path.join(ctx.source_root,'controller','deadbyte-controller.config.psd1');
-  }
-  let config=await loadPowerShellDataFile(configPath);
-  if(bridgeBootstrap){
-    if(!bridgeBootstrap.root||!path.isAbsolute(bridgeBootstrap.root)||!HEX64.test(String(bridgeBootstrap.scriptSha256??''))) throw new Error('bridge bootstrap requires absolute root plus lowercase script SHA-256');
-    const bootstrapRoot=path.resolve(bridgeBootstrap.root);
-    const bootstrapScript=path.join(bootstrapRoot,'src','bridge.mjs');
-    const bootstrapActual=await sha256File(bootstrapScript);
-    if(bootstrapActual!==String(bridgeBootstrap.scriptSha256).toLowerCase()) throw new Error(`bridge script SHA-256 mismatch: expected ${String(bridgeBootstrap.scriptSha256).toLowerCase()}, found ${bootstrapActual}`);
-    if(!config.Bridge||typeof config.Bridge!=='object') throw new Error('Bridge launch specification missing');
-    config.Bridge.WorkingDirectory=bootstrapRoot;
-    config.Bridge.Arguments='src\\bridge.mjs';
-    config.Bridge.ScriptPath=bootstrapScript;
-    config.Bridge.ScriptSha256=bootstrapActual;
-  }
-  config=await normalizeComponentIdentities(config);
-  const codingPath=String(config.CodingPolicyFile??''); const autonomousPath=String(config.AutonomousPolicyFile??''); const hostPath=String(config.HostPolicyFile??''); const processPath=String(config.ProcessPolicyFile??''); const desktopPath=String(config.DesktopPolicyFile??'');
-  if(!path.isAbsolute(codingPath)||!path.isAbsolute(autonomousPath)) throw new Error('coding/autonomous policy paths must be absolute');
-  if(processPath&&!path.isAbsolute(processPath)) throw new Error('process policy path must be absolute');
-  if(desktopPath&&!path.isAbsolute(desktopPath)) throw new Error('desktop policy path must be absolute');
-  const codingPolicy=await readJson(codingPath); const autonomousPolicy=await readJson(autonomousPath); const hostPolicy=hostPath?await readJson(hostPath):null; const processPolicy=processPath?await readJson(processPath):null; const desktopPolicy=desktopPath?await readJson(desktopPath):null;
-  const legacyCore=typeof config.CoreRoot==='string'&&config.CoreRoot?path.resolve(config.CoreRoot):ctx.core_root;
-  const workspaceRoot=typeof config.WorkspaceRoot==='string'&&config.WorkspaceRoot?path.resolve(config.WorkspaceRoot):path.join(legacyCore,'workspaces');
-  return {ctx,configPath,config,codingPolicy,autonomousPolicy,hostPolicy,processPolicy,desktopPolicy,workspaceRoot};
-}
-export function assertDevelopmentRootSafe(developmentRoot,stateRoot){
-  const dev=path.resolve(developmentRoot),state=path.resolve(stateRoot);
-  const forbidden=[path.join(state,'releases'),path.join(state,'generations'),path.join(state,'runtime')].map(item=>path.resolve(item).toLowerCase());
-  const lower=dev.toLowerCase();
-  if(forbidden.some(prefix=>lower===prefix||lower.startsWith(`${prefix}${path.sep}`))) throw new Error('development root cannot live inside immutable/runtime state stores');
-  return dev;
-}
-async function workspacePlan(currentWorkspace,stateRoot){
-  const source=path.resolve(currentWorkspace),target=path.join(path.resolve(stateRoot),'workspaces');
-  if(source.toLowerCase()===path.resolve(target).toLowerCase()) return {source,target,mode:'existing',moved:false};
-  const sourceExists=existsSync(source),targetExists=existsSync(target);
-  if(targetExists){
-    const info=await lstat(target); if(!info.isDirectory()||info.isSymbolicLink()) throw new Error('stable workspace root must be a real directory');
-    if(sourceExists) throw new Error(`workspace migration conflict: both source and stable target exist (${source}, ${target})`);
-    return {source,target,mode:'target-existing',moved:false};
-  }
-  if(!sourceExists) return {source,target,mode:'create',moved:false};
-  const info=await lstat(source); if(!info.isDirectory()||info.isSymbolicLink()) throw new Error('legacy workspace root must be a real directory');
-  if(path.parse(source).root.toLowerCase()!==path.parse(target).root.toLowerCase()) throw new Error('workspace migration requires same-volume rename');
-  return {source,target,mode:'rename',moved:false};
-}
-async function applyWorkspacePlan(plan){
-  if(plan.mode==='existing'||plan.mode==='target-existing') return plan;
-  const sourceExists=existsSync(plan.source),targetExists=existsSync(plan.target);
-  if(plan.mode==='create'){
-    if(targetExists){ plan.created=true; return plan; }
-    await mkdir(path.dirname(plan.target),{recursive:true});
-    await mkdir(plan.target,{recursive:false}); plan.created=true; return plan;
-  }
-  if(targetExists&&!sourceExists){ plan.moved=true; return plan; }
-  if(sourceExists&&targetExists) throw new Error('workspace migration conflict: both source and stable target exist ('+plan.source+', '+plan.target+')');
-  await mkdir(path.dirname(plan.target),{recursive:true});
-  await rename(plan.source,plan.target); plan.moved=true; return plan;
-}
-async function rollbackWorkspacePlan(plan){
-  if(plan.mode==='rename'&&existsSync(plan.target)&&!existsSync(plan.source)){ await rename(plan.target,plan.source); plan.moved=false; return true; }
-  if(plan.mode==='create'&&existsSync(plan.target)){ await rm(plan.target,{recursive:true,force:true}); plan.created=false; return true; }
-  return false;
-}
-async function launcherPlan(stateRoot){
-  const bin=path.join(path.resolve(stateRoot),'bin');
-  const ps1=path.join(bin,'DEADBYTE-MCP.ps1'),cmd=path.join(bin,'DEADBYTE-MCP.cmd'),top=TOP_LAUNCHER;
-  const ps1Bytes=Buffer.from(renderStableLauncherPs1(),'utf8'),cmdBytes=Buffer.from(renderStableLauncherCmd(),'utf8');
-  return {ps1,cmd,top,ps1Bytes,cmdBytes,launcher_sha256:sha256Bytes(ps1Bytes),
-    snapshots:{ps1:await snapshotFile(ps1),cmd:await snapshotFile(cmd),top:await snapshotFile(top)},installed:false};
-}
-async function installLaunchers(plan){
-  await atomicBytes(plan.ps1,plan.ps1Bytes); await atomicBytes(plan.cmd,plan.cmdBytes); await atomicBytes(plan.top,plan.cmdBytes);
-  plan.installed=true;
-  if(await sha256File(plan.ps1)!==plan.launcher_sha256) throw new Error('stable launcher post-install hash mismatch');
-  return plan;
-}
-async function rollbackLaunchers(plan){
-  if(!plan) return false;
-  const touched=plan.installed===true || (existsSync(plan.ps1)&&sha256Bytes(await readFile(plan.ps1))===plan.launcher_sha256);
-  if(!touched) return false;
-  await restoreFile(plan.ps1,plan.snapshots.ps1); await restoreFile(plan.cmd,plan.snapshots.cmd); await restoreFile(plan.top,plan.snapshots.top);
-  plan.installed=false; return true;
-}
-async function revokeAuthority(ctx,prior){
-  let revoked=false;
-  if(prior.desktop_armed){ controllerCaptured(ctx,'disarmdesktop',15000); revoked=true; }
-  if(prior.autonomous_armed){ controllerCaptured(ctx,'disarmautonomous',15000); revoked=true; }
-  if(prior.coding_armed){ controllerCaptured(ctx,'disarmcoding',15000); revoked=true; }
-  if(prior.process_armed){ controllerCaptured(ctx,'disarmprocess',15000); revoked=true; }
-  const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
-  if(status.process_armed||status.coding_armed||status.autonomous_armed||status.desktop_armed) throw new Error('standing authority revoke gate failed');
-  if(status.host_armed) throw new Error('host plane became armed during revoke');
-  return {revoked,status};
-}
-export function standingAuthorityRestorePlan(prior,enabled){
-  const before={
-    process_armed:prior?.process_armed===true,
-    coding_armed:prior?.coding_armed===true,
-    autonomous_armed:prior?.autonomous_armed===true,
-    desktop_armed:prior?.desktop_armed===true,
-    host_armed:prior?.host_armed===true
-  };
-  if(before.autonomous_armed&&!before.coding_armed) throw new Error('invalid prior authority: autonomous armed without coding');
-  const expected={process_armed:false,coding_armed:false,autonomous_armed:false,desktop_armed:false,host_armed:false};
-  const commands=[];
-  if(enabled){
-    expected.process_armed=before.process_armed;
-    expected.coding_armed=before.coding_armed;
-    expected.autonomous_armed=before.autonomous_armed;
-    if(before.coding_armed) commands.push('armcoding');
-    if(before.autonomous_armed) commands.push('armautonomous');
-    if(before.process_armed) commands.push('armprocess');
-  }
-  return {commands,expected};
-}
-async function restoreStandingAuthority(ctx,prior,enabled){
-  const plan=standingAuthorityRestorePlan(prior,enabled);
-  for(const command of plan.commands) controllerCaptured(ctx,command,15000);
-  const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
-  for(const key of ['process_armed','coding_armed','autonomous_armed']){
-    if(status[key]!==plan.expected[key]) throw new Error(`${key.replace('_armed','')} standing-grant restore gate failed`);
-  }
-  if(status.desktop_armed!==plan.expected.desktop_armed) throw new Error('desktop plane must remain disarmed after slot switch');
-  if(status.host_armed!==plan.expected.host_armed) throw new Error('host plane became armed during slot switch');
-  return status;
-}
-async function stopAndVerify(ctx,runtime){
-  try{ controllerCaptured(ctx,'supervisorstop',15000); }catch(error){
-    if(!/not running|no supervisor|offline|missing/i.test(String(error?.message??error))) throw error;
-  }
-  const output=controllerCaptured(ctx,'stop',30000);
-  if(!(await waitCoreGone(runtime,10000))) throw new Error(`old downstream core ${runtime.core.pid} survived verified stop`);
-  const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
-  if(!status.offline) throw new Error(`controller stop did not reach OFFLINE: ${output}`);
-  return {output:output.trim(),status};
-}
-async function loadUpdateKey(stateRoot){
-  const trust=path.join(path.resolve(stateRoot),'trust');
-  const privateKey=createPrivateKey(await readFile(path.join(trust,'ed25519-private.pem')));
-  const publicKey=createPublicKey(await readFile(path.join(trust,'ed25519-public.pem'))); const derived=createPublicKey(privateKey);
-  if(privateKey.asymmetricKeyType!=='ed25519'||publicKey.asymmetricKeyType!=='ed25519') throw new Error('slot-update trust key must be Ed25519');
-  const der=key=>Buffer.from(key.export({type:'spki',format:'der'})); const keyId=sha256Bytes(der(publicKey));
-  if(sha256Bytes(der(derived))!==keyId) throw new Error('slot-update private/public key mismatch');
-  return {privateKey,publicKey,keyId};
-}
-function signEnvelope(body,key){
-  const bodyBytes=Buffer.from(canonicalJson(body),'utf8'); const signature=cryptoSign(null,Buffer.concat([RECEIPT_DOMAIN,bodyBytes]),key.privateKey);
-  const envelope={body,body_sha256:sha256Bytes(bodyBytes),attestation:{algorithm:'ed25519',domain:'DEADBYTE-R27-SLOT-UPDATE-V1',key_id:key.keyId,signature_base64:signature.toString('base64')}};
-  envelope.receipt_sha256=sha256Bytes(Buffer.from(canonicalJson(envelope),'utf8'));
-  if(!cryptoVerify(null,Buffer.concat([RECEIPT_DOMAIN,bodyBytes]),key.publicKey,signature)) throw new Error('slot-update signature self-check failed');
-  return envelope;
-}
-export function verifySlotUpdateEnvelope(envelope,publicKey){
-  if(!envelope?.body||!envelope?.attestation) return false; const bodyBytes=Buffer.from(canonicalJson(envelope.body),'utf8');
-  if(sha256Bytes(bodyBytes)!==envelope.body_sha256) return false; const {receipt_sha256,...unsigned}=envelope;
-  if(sha256Bytes(Buffer.from(canonicalJson(unsigned),'utf8'))!==receipt_sha256) return false;
-  if(envelope.attestation.algorithm!=='ed25519'||envelope.attestation.domain!=='DEADBYTE-R27-SLOT-UPDATE-V1') return false;
-  const keyId=sha256Bytes(Buffer.from(publicKey.export({type:'spki',format:'der'}))); if(keyId!==envelope.attestation.key_id) return false;
-  return cryptoVerify(null,Buffer.concat([RECEIPT_DOMAIN,bodyBytes]),publicKey,Buffer.from(envelope.attestation.signature_base64,'base64'));
-}
-async function writeEnvelope(file,body,key){ const envelope=signEnvelope(body,key); await atomicBytes(file,Buffer.from(`${JSON.stringify(envelope,null,2)}\n`,'utf8')); return envelope; }
-async function writeState(file,state,phase,extra={}){
-  let observed=null;
-  try { observed=await readJson(file); } catch(error) { if(error?.code!=='ENOENT') throw error; }
-  const observedRank=phaseRank(observed?.phase);
-  const requestedRank=phaseRank(phase);
-  const effectivePhase=observedRank>requestedRank?String(observed.phase):phase;
-  if(observed) Object.assign(state,observed);
-  Object.assign(state,extra,{phase:effectivePhase,updated_at_utc:new Date().toISOString()});
-  await atomicBytes(file,Buffer.from(`${JSON.stringify(state,null,2)}\n`,'utf8'));
-}
-function generationTuple(runtime){
-  if(!runtime) return null;
-  return {bridge:{pid:runtime.bridge.pid,instance_nonce:runtime.bridge.instance_nonce,creation_time_utc:runtime.bridge.creation_time_utc,image_sha256:runtime.bridge.image_sha256},
-    cloud:{pid:runtime.cloud.pid,instance_nonce:runtime.cloud.instance_nonce,creation_time_utc:runtime.cloud.creation_time_utc,image_sha256:runtime.cloud.image_sha256},
-    core:{pid:runtime.core.pid,parent_pid:runtime.core.parent_pid,creation_date:runtime.core.creation_date,
-      command_line:runtime.core.command_line,identity_basis:runtime.core.identity_basis}};
-}
-function publicPointer(pointer){
-  if(!pointer) return null;
-  return {schema:pointer.schema,release_id:pointer.release_id,version:pointer.version,manifest_sha256:pointer.manifest_sha256,
-    release_root:pointer.release_root,generation_root:pointer.generation_root,generation_manifest_sha256:pointer.generation_manifest_sha256,
-    launcher_sha256:pointer.launcher_sha256,config_path:pointer.config_path};
-}
-
-function encodeSnapshot(snapshot){
-  if(!snapshot||typeof snapshot!=='object') throw new Error('snapshot object required');
-  return {exists:snapshot.exists===true,sha256:snapshot.sha256??null,bytes_base64:snapshot.exists&&snapshot.bytes?Buffer.from(snapshot.bytes).toString('base64'):null};
-}
-function decodeSnapshot(snapshot,label){
-  if(!snapshot||typeof snapshot!=='object'||typeof snapshot.exists!=='boolean') throw new Error(label+' snapshot invalid');
-  if(snapshot.exists){
-    if(typeof snapshot.bytes_base64!=='string') throw new Error(label+' snapshot bytes missing');
-    const bytes=Buffer.from(snapshot.bytes_base64,'base64'),actual=sha256Bytes(bytes);
-    if(snapshot.sha256!==actual) throw new Error(label+' snapshot SHA-256 mismatch');
-    return {exists:true,bytes,sha256:actual};
-  }
-  return {exists:false,bytes:null,sha256:null};
-}
-export function rollbackLauncherPlanFromHandoff(body,priorPointer,activePointer,stateRoot=DEFAULT_STATE_ROOT){
-  if(!body||typeof body!=='object') throw new Error('rollback handoff body required');
-  const handoffPrior=body.prior_pointer?parseActivePointer(JSON.stringify(body.prior_pointer)):null;
-  const handoffActive=body.new_pointer?parseActivePointer(JSON.stringify(body.new_pointer)):null;
-  if(!samePublicPointer(handoffPrior,priorPointer)||!samePublicPointer(handoffActive,activePointer)) throw new Error('rollback handoff pointer binding mismatch');
-  const state=path.resolve(stateRoot);
-  const launchers={
-    ps1:path.resolve(String(body.launchers?.ps1??'')),
-    cmd:path.resolve(String(body.launchers?.cmd??'')),
-    top:path.resolve(String(body.launchers?.top??TOP_LAUNCHER)),
-    launcher_sha256:String(body.launchers?.launcher_sha256??''),
-    ps1Bytes:Buffer.from(String(body.launchers?.ps1_bytes??''),'base64'),
-    cmdBytes:Buffer.from(String(body.launchers?.cmd_bytes??''),'base64'),
-    snapshots:{
-      ps1:decodeSnapshot(body.launchers?.snapshots?.ps1,'rollback.launcher.ps1'),
-      cmd:decodeSnapshot(body.launchers?.snapshots?.cmd,'rollback.launcher.cmd'),
-      top:decodeSnapshot(body.launchers?.snapshots?.top,'rollback.launcher.top')
-    },
-    installed:true
+  if(!bootstrap) throw new Error('owner approval bootstrap is required');
+  if(typeof stateRoot!=='string'||!path.isAbsolute(stateRoot)) throw new Error('owner approval state root invalid');
+  if(!HEX64.test(String(codingPolicySha256??''))||
+     !HEX64.test(String(autonomousPolicySha256??''))||
+     !HEX64.test(String(expectedManifest??''))) throw new Error('owner approval digest inputs invalid');
+  const ids=assertAutonomousBootstrapRoots(autonomousPolicy,codingPolicy,codingPolicySha256);
+  if(ids.length!==1) throw new Error('owner approval requires exactly one project-scoped autonomous root');
+  const rootId=ids[0];
+  const projectRoot=codingPolicy.roots[rootId].path;
+  const trustRoot=path.resolve(stateRoot,'trust');
+  const ownerKeyPath=path.join(trustRoot,'r70-owner-public.pem');
+  const normalize=p=>process.platform==='win32'?path.resolve(p).toLowerCase():path.resolve(p);
+  const under=(file,root)=>{
+    const relative=path.relative(normalize(root),normalize(file));
+    return relative===''||(!relative.startsWith('..'+path.sep)&&relative!=='..'&&!path.isAbsolute(relative));
   };
-  if(launchers.ps1!==path.resolve(launcherPath(state))||
-     launchers.cmd!==path.resolve(path.join(state,'bin','DEADBYTE-MCP.cmd'))||
-     launchers.top!==path.resolve(TOP_LAUNCHER)) throw new Error('rollback launcher paths are not canonical');
-  if(!HEX64.test(launchers.launcher_sha256)||sha256Bytes(launchers.ps1Bytes)!==launchers.launcher_sha256) throw new Error('rollback successor launcher bytes/hash mismatch');
-  if(launchers.launcher_sha256!==activePointer.launcher_sha256) throw new Error('rollback successor launcher hash does not match active pointer');
-  if(!launchers.snapshots.ps1.exists||launchers.snapshots.ps1.sha256!==priorPointer.launcher_sha256) throw new Error('rollback predecessor launcher snapshot does not match signed prior pointer');
-  return launchers;
-}
-async function restoreRollbackLaunchers(plan){
-  await restoreFile(plan.ps1,plan.snapshots.ps1);
-  await restoreFile(plan.cmd,plan.snapshots.cmd);
-  await restoreFile(plan.top,plan.snapshots.top);
-  if(await sha256File(plan.ps1)!==plan.snapshots.ps1.sha256) throw new Error('rollback predecessor launcher restore hash mismatch');
-  return plan;
-}
-const UPDATE_PHASE_RANK=Object.freeze({
-  initial:0,candidate_prepared:10,old_runtime_verified:20,shutdown_handoff_armed:25,supervisor_spawned:30,
-  authority_revoked:40,old_runtime_stopped:50,workspace_ready:60,launcher_installed:70,pointer_committed:80,
-  fresh_runtime_verified:90,authority_verified:100,completed:110,superseded:120,failed:1000,failed_receipted:1001,failed_unreceipted:1002,precondition_rejected:1003
-});
-function phaseRank(phase){ return UPDATE_PHASE_RANK[String(phase)]??-1; }
-function activeTransitionPhase(phase){
-  const rank=phaseRank(phase);
-  return rank>=phaseRank('shutdown_handoff_armed')&&rank<phaseRank('completed')&&rank<phaseRank('failed');
-}
-function samePublicPointer(a,b){
-  if(!a&&!b) return true;
-  if(!a||!b) return false;
-  return canonicalJson(publicPointer(a))===canonicalJson(publicPointer(b));
-}
-function statePointer(state,key){
-  if(!state?.[key]) return null;
-  return parseActivePointer(JSON.stringify(state[key]));
-}
-async function spawnDetachedSupervisor({script,handoffPath,cwd}){
-  const absoluteScript=path.resolve(script),absoluteHandoff=path.resolve(handoffPath);
-  const stat=await lstat(absoluteScript);
-  if(!stat.isFile()||stat.isSymbolicLink()) throw new Error('detached updater supervisor script must be a regular file');
-  const child=await new Promise((resolve,reject)=>{
-    const proc=spawn(process.execPath,[absoluteScript,'--resume-handoff',absoluteHandoff],{
-      cwd:path.resolve(cwd),detached:true,windowsHide:true,stdio:'ignore'
-    });
-    const onError=error=>reject(error);
-    proc.once('error',onError);
-    proc.once('spawn',()=>{
-      proc.removeListener('error',onError);
-      proc.unref();
-      resolve(proc);
-    });
-  });
-  if(!child.pid||child.pid<1) throw new Error('detached updater supervisor did not return a valid PID');
-  return {pid:child.pid,script_sha256:await sha256File(absoluteScript)};
-}
-async function acquireSupervisorLease(handoffPath){
-  const lockDir=path.resolve(handoffPath)+'.lock',lockFile=path.join(lockDir,'owner.json');
-  for(let attempt=0;attempt<2;attempt+=1){
-    try{
-      await mkdir(lockDir,{recursive:false});
-      await atomicBytes(lockFile,Buffer.from(JSON.stringify({pid:process.pid,handoff:path.resolve(handoffPath),started_at_utc:new Date().toISOString()})+'\n','utf8'));
-      return async()=>{ await rm(lockDir,{recursive:true,force:true}); };
-    }catch(error){
-      if(error?.code!=='EEXIST') throw error;
-      let owner=null; try{ owner=await readJson(lockFile); }catch{}
-      const ownerPid=Number(owner?.pid),needle=path.resolve(handoffPath).replaceAll('/','\\\\').toLowerCase();
-      const alive=Number.isInteger(ownerPid)&&ownerPid>0&&nodeProcesses().some(item=>
-        Number(item.ProcessId)===ownerPid&&String(item.CommandLine??'').replaceAll('/','\\\\').toLowerCase().includes(needle)
-      );
-      if(alive) throw new Error('slot update supervisor already active pid='+ownerPid);
-      await rm(lockDir,{recursive:true,force:true});
-    }
-  }
-  throw new Error('unable to acquire slot update supervisor lease');
-}
-export function parseResumeHandoffArgs(argv){
-  let handoff=null;
-  for(let index=0;index<argv.length;index+=1){
-    const arg=argv[index];
-    if(arg!=='--resume-handoff') throw new Error("unknown supervisor argument '"+arg+"'");
-    if(handoff!==null) throw new Error("duplicate supervisor argument '--resume-handoff'");
-    const value=argv[++index];
-    if(!value) throw new Error('--resume-handoff requires a value');
-    handoff=path.resolve(value);
-  }
-  if(!handoff) throw new Error('--resume-handoff is required');
-  return {handoff};
-}
-async function readHandoffEnvelope(handoffPath,stateRoot){
-  const envelope=await readJson(handoffPath),key=await loadUpdateKey(stateRoot);
-  if(!verifySlotUpdateEnvelope(envelope,key.publicKey)) throw new Error('slot-update handoff signature invalid');
-  if(envelope.body?.schema!==HANDOFF_SCHEMA) throw new Error('slot-update handoff schema invalid');
-  const body=envelope.body;
-  if(typeof body.update_id!=='string'||!HEX64.test(String(body.supervisor_script_sha256??''))||
-     !path.isAbsolute(String(body.supervisor_script??''))||!path.isAbsolute(String(body.state_path??''))) {
-    throw new Error('slot-update handoff identity invalid');
-  }
-  const actualSupervisorHash=await sha256File(path.resolve(body.supervisor_script));
-  if(actualSupervisorHash!==body.supervisor_script_sha256) throw new Error('slot-update handoff supervisor hash drift');
-  return {envelope,body,key};
-}
-async function writeHandoff({stateRoot,state,journal,statePath,evidenceDir,key,pointerInfo,newPointer,predecessor,priorStatus,workspace,launchers,stableMcpUrl,mcpUrlSnapshot,controlCtx}){
-  const supervisorScript=path.join(path.resolve(newPointer.release_root),'scripts','runtime-self-update.mjs');
-  const supervisorScriptSha256=await sha256File(supervisorScript);
-  const handoffPath=path.join(path.resolve(evidenceDir),'handoff.json');
-  const body={
-    schema:HANDOFF_SCHEMA,update_id:state.update_id,created_at_utc:new Date().toISOString(),
-    state_root:path.resolve(stateRoot),state_path:path.resolve(statePath),handoff_path:path.resolve(handoffPath),
-    supervisor_script:path.resolve(supervisorScript),supervisor_script_sha256:supervisorScriptSha256,
-    prior_pointer:publicPointer(pointerInfo.pointer),new_pointer:publicPointer(newPointer),predecessor_mode:predecessor.mode,
-    old_runtime:generationTuple(predecessor.runtime),
-    prior_authority:{
-      process_armed:priorStatus.process_armed,coding_armed:priorStatus.coding_armed,autonomous_armed:priorStatus.autonomous_armed,
-      desktop_armed:priorStatus.desktop_armed,host_armed:priorStatus.host_armed
-    },
-    pointer_snapshot:encodeSnapshot(pointerInfo.snapshot),
-    workspace:{source:workspace.source,target:workspace.target,mode:workspace.mode,moved:workspace.moved===true,created:workspace.created===true},
-    launchers:{
-      ps1:launchers.ps1,cmd:launchers.cmd,top:launchers.top,launcher_sha256:launchers.launcher_sha256,
-      ps1_bytes:Buffer.from(launchers.ps1Bytes).toString('base64'),cmd_bytes:Buffer.from(launchers.cmdBytes).toString('base64'),
-      snapshots:{
-        ps1:encodeSnapshot(launchers.snapshots.ps1),cmd:encodeSnapshot(launchers.snapshots.cmd),top:encodeSnapshot(launchers.snapshots.top)
-      }
-    },
-    stable_mcp_url:stableMcpUrl?{path:stableMcpUrl.path,sha256:stableMcpUrl.sha256,origin:stableMcpUrl.origin,changed:stableMcpUrl.changed===true}:null,
-    mcp_url_snapshot:stableMcpUrl?.changed?encodeSnapshot(mcpUrlSnapshot):null,
-    restore_standing_grants:state.restore_standing_grants===true
-  };
-  const receipt=await writeEnvelope(handoffPath,body,key);
-  await writeState(statePath,journal,'shutdown_handoff_armed',{
-    handoff_path:handoffPath,handoff_receipt_sha256:receipt.receipt_sha256,
-    supervisor_script:supervisorScript,supervisor_script_sha256:supervisorScriptSha256
+  // Coding commands execute as the owner OS principal, not inside a
+  // filesystem sandbox. Project-scoped write checks cannot protect a trust
+  // anchor while any selected Coding root can execute arbitrary scripts.
+  for(const root of Object.values(codingPolicy.roots)){
+    if(root?.exec===true) throw new Error('owner approval cannot trust an anchor with unsandboxed Coding execution');
+    if(root?.write===true&&typeof root.path==='string'&&path.isAbsolute(root.path)&&
+       under(ownerKeyPath,root.path)) throw new Error('owner trust key is writable by Coding policy');
+  }
+  const trustStat=await lstat(trustRoot);
+  const keyStat=await lstat(ownerKeyPath);
+  if(!trustStat.isDirectory()||trustStat.isSymbolicLink()||
+     !keyStat.isFile()||keyStat.isSymbolicLink()||
+     normalize(await realpath(trustRoot))!==normalize(trustRoot)||
+     normalize(await realpath(ownerKeyPath))!==normalize(ownerKeyPath)){
+    throw new Error('owner trust key must be a regular file below a real trust directory');
+  }
+  const ownerPublicKey=await readFile(ownerKeyPath);
+  const pinned=await readPinnedJsonPolicy(bootstrap,'owner approval');
+  return verifyProjectOwnerApproval({
+    approval:pinned.policy,ownerPublicKey,
+    expected:{rootId,projectRoot,codingPolicySha256,autonomousPolicySha256,
+      reviewedArtifactSha256:expectedManifest},
+    now
   });
-  return {path:handoffPath,body,receipt};
-}
-async function parseCurrentPointer(file){
-  if(!existsSync(file)) return null;
-  return parseActivePointer(await readFile(file,'utf8'));
-}
-async function ensurePointerCommitted(pointerFile,priorPointer,newPointer){
-  const current=await parseCurrentPointer(pointerFile);
-  if(samePublicPointer(current,newPointer)) return {committed:true,already:true};
-  if(!samePublicPointer(current,priorPointer)) throw new Error('active pointer changed unexpectedly before slot commit');
-  await atomicWriteActivePointer(pointerFile,newPointer);
-  const verify=await parseCurrentPointer(pointerFile);
-  if(!samePublicPointer(verify,newPointer)) throw new Error('active pointer commit readback mismatch');
-  return {committed:true,already:false};
-}
-async function coreGone(runtime){
-  return !runtime||!(await nodeProcesses()).some(item=>
-    Number(item.ProcessId)===Number(runtime.core.pid)&&String(item.CreationDate??'')===String(runtime.core.creation_date)
-  );
-}
-async function runtimeAlreadyOnline(ctx,oldRuntime){
-  const statusText=controllerCaptured(ctx,'status',15000),status=parseControllerStatus(statusText);
-  if(!status.online||!status.bridge_pid||!status.cloud_pid||!status.local_ready) return null;
-  const bridge=await readLedger(ctx,'bridge'),cloud=await readLedger(ctx,'cloud'),core=coreProcess(ctx.core_root,bridge);
-  if(oldRuntime?.bridge&&sameGeneration(oldRuntime.bridge,bridge)) throw new Error('fresh bridge generation gate failed');
-  if(oldRuntime?.cloud&&sameGeneration(oldRuntime.cloud,cloud)) throw new Error('fresh cloud generation gate failed');
-  if(oldRuntime?.core&&oldRuntime.core.pid===core.pid&&oldRuntime.core.creation_date===core.creation_date) {
-    throw new Error('fresh downstream core generation gate failed');
-  }
-  return {status,status_text:statusText.trim(),bridge,cloud,core};
-}
-async function ensureFreshRuntime(ctx,oldRuntime){
-  let existing=null;
-  try{ existing=await runtimeAlreadyOnline(ctx,oldRuntime); }
-  catch(error){ if(/generation gate/.test(String(error?.message??''))) throw error; }
-  return existing??await startAndVerify(ctx,oldRuntime);
-}
-async function ensureAuthorityRevoked(ctx,prior){
-  if(!prior.process_armed&&!prior.coding_armed&&!prior.autonomous_armed&&!prior.desktop_armed&&!prior.host_armed){
-    if(prior.online&&prior.bridge_pid&&prior.cloud_pid) return {revoked:false,status:prior};
-    if(existsSync(path.join(ctx.runtime_root,'bridge.instance.json'))&&existsSync(path.join(ctx.runtime_root,'cloud.instance.json'))){
-      try{
-        const bridge=await readLedger(ctx,'bridge'),cloud=await readLedger(ctx,'cloud');
-        return {revoked:false,status:{online:true,offline:false,bridge_pid:bridge.pid,cloud_pid:cloud.pid,local_ready:true,
-          process_armed:false,coding_armed:false,autonomous_armed:false,desktop_armed:false,host_armed:false}};
-      }catch{}
-    }
-    const clean=cleanOfflinePredecessor(ctx);
-    return {revoked:false,status:clean};
-  }
-  const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
-  if(status.host_armed) throw new Error('host plane armed during authority revoke recovery');
-  if(!status.process_armed&&!status.coding_armed&&!status.autonomous_armed&&!status.desktop_armed) {
-    return {revoked:prior.process_armed||prior.coding_armed||prior.autonomous_armed||prior.desktop_armed,status};
-  }
-  return revokeAuthority(ctx,status);
-}
-function handoffPriorPointer(body){
-  return body.prior_pointer?parseActivePointer(JSON.stringify(body.prior_pointer)):null;
-}
-function handoffNewPointer(body){
-  return body.new_pointer?parseActivePointer(JSON.stringify(body.new_pointer)):null;
-}
-async function verifyCompletedUpdateReceipt(body,state,statePath,key){
-  const candidate=handoffNewPointer(body),prior=handoffPriorPointer(body);
-  if(!candidate||!samePublicPointer(candidate,statePointer(state,'new_pointer'))||!samePublicPointer(prior,statePointer(state,'prior_pointer'))) throw new Error('completed update handoff pointer binding mismatch');
-  if(state.expected_version!==candidate.version||state.expected_manifest_sha256!==candidate.manifest_sha256) throw new Error('completed update journal subject mismatch');
-  const expectedPath=path.join(path.dirname(statePath),'receipt.json');
-  if(typeof state.receipt_path!=='string'||!path.isAbsolute(state.receipt_path)||path.resolve(state.receipt_path)!==expectedPath||!HEX64.test(String(state.receipt_sha256??''))) throw new Error('completed update receipt reference invalid');
-  const info=await lstat(expectedPath);
-  if(!info.isFile()||info.isSymbolicLink()) throw new Error('completed update receipt must be a regular file');
-  const receipt=await readJson(expectedPath);
-  if(!verifySlotUpdateEnvelope(receipt,key.publicKey)||receipt.receipt_sha256!==state.receipt_sha256) throw new Error('completed update receipt signature or digest mismatch');
-  const subject=receipt.body;
-  if(subject.schema!==UPDATE_SCHEMA||subject.rollback_performed!==false||subject.update_id!==body.update_id||subject.release_version!==candidate.version||subject.candidate_manifest_sha256!==candidate.manifest_sha256||
-     !samePublicPointer(statePointer(subject,'active_pointer'),candidate)||!samePublicPointer(statePointer(subject,'prior_pointer'),prior)||
-     subject.release_slot?.release_id!==candidate.release_id||subject.release_slot?.release_root!==candidate.release_root||subject.release_slot?.manifest_sha256!==candidate.manifest_sha256||
-     subject.generation?.generation_root!==candidate.generation_root||subject.generation?.generation_manifest_sha256!==candidate.generation_manifest_sha256||subject.launcher?.sha256!==candidate.launcher_sha256) throw new Error('completed update receipt subject binding mismatch');
-  return {receipt_path:expectedPath,receipt_sha256:receipt.receipt_sha256};
-}
-async function resumeSlotUpdate({handoffPath}){
-  const absoluteHandoff=path.resolve(handoffPath),probe=await readJson(absoluteHandoff);
-  const stateRoot=path.resolve(String(probe?.body?.state_root??path.dirname(path.dirname(path.dirname(path.dirname(absoluteHandoff))))));
-  const {body,key}=await readHandoffEnvelope(absoluteHandoff,stateRoot);
-  const statePath=path.resolve(body.state_path),releaseState=await readJson(statePath);
-  if(releaseState.schema!=='deadbyte.r27-slot-update-state.v1'||releaseState.update_id!==body.update_id) throw new Error('handoff state binding mismatch');
-  let phase=String(releaseState.phase??'');
-  if(phase==='completed'){
-    const verifiedReceipt=await verifyCompletedUpdateReceipt(body,releaseState,statePath,key);
-    return {ok:true,resumed:false,completed:true,update_id:body.update_id,state_path:statePath,
-      ...verifiedReceipt,historical_receipt_verified:true,current_runtime_verified:false};
-  }
-  if(phase.startsWith('failed')) throw new Error('slot update already failed at phase='+phase);
-  const priorPointer=handoffPriorPointer(body),candidatePointer=handoffNewPointer(body);
-  const statePrior=statePointer(releaseState,'prior_pointer'),stateCandidate=statePointer(releaseState,'new_pointer');
-  if(!samePublicPointer(priorPointer,statePrior)||!samePublicPointer(candidatePointer,stateCandidate)) throw new Error('handoff pointer binding mismatch');
-  if(!candidatePointer) throw new Error('handoff candidate pointer missing');
-  const pointerFile=path.join(stateRoot,'active-release.json'),currentPointer=await parseCurrentPointer(pointerFile);
-  if(!samePublicPointer(currentPointer,priorPointer)&&!samePublicPointer(currentPointer,candidatePointer)) throw new Error('active pointer is neither handoff predecessor nor candidate');
-  const pointerInfo={file:pointerFile,pointer:currentPointer,snapshot:decodeSnapshot(body.pointer_snapshot,'active pointer')};
-  const ctx=slotContext(stateRoot,priorPointer),newCtx=slotContext(stateRoot,candidatePointer);
-  const priorStatus={
-    process_armed:body.prior_authority?.process_armed===true,coding_armed:body.prior_authority?.coding_armed===true,
-    autonomous_armed:body.prior_authority?.autonomous_armed===true,desktop_armed:body.prior_authority?.desktop_armed===true,
-    host_armed:body.prior_authority?.host_armed===true
-  };
-  if(priorStatus.autonomous_armed&&!priorStatus.coding_armed) throw new Error('invalid prior authority in handoff');
-  const oldRuntime=body.old_runtime?{bridge:body.old_runtime.bridge??null,cloud:body.old_runtime.cloud??null,core:body.old_runtime.core??null}:null;
-  if(oldRuntime?.core&&(!Number.isInteger(Number(oldRuntime.core.pid))||String(oldRuntime.core.creation_date??'').length<1)) throw new Error('handoff old runtime core identity invalid');
-  const launchers={
-    ps1:path.resolve(String(body.launchers?.ps1??'')),cmd:path.resolve(String(body.launchers?.cmd??'')),top:path.resolve(String(body.launchers?.top??TOP_LAUNCHER)),
-    launcher_sha256:String(body.launchers?.launcher_sha256??''),
-    ps1Bytes:Buffer.from(String(body.launchers?.ps1_bytes??''),'base64'),cmdBytes:Buffer.from(String(body.launchers?.cmd_bytes??''),'base64'),
-    snapshots:{
-      ps1:decodeSnapshot(body.launchers?.snapshots?.ps1,'launcher.ps1'),cmd:decodeSnapshot(body.launchers?.snapshots?.cmd,'launcher.cmd'),top:decodeSnapshot(body.launchers?.snapshots?.top,'launcher.top')
-    },
-    installed:phaseRank(phase)>=phaseRank('launcher_installed')
-  };
-  if(!HEX64.test(launchers.launcher_sha256)||sha256Bytes(launchers.ps1Bytes)!==launchers.launcher_sha256) throw new Error('handoff launcher bytes/hash mismatch');
-  const workspace={
-    source:path.resolve(String(body.workspace?.source??releaseState.workspace?.source??'')),
-    target:path.resolve(String(body.workspace?.target??releaseState.workspace?.target??'')),
-    mode:String(body.workspace?.mode??releaseState.workspace?.mode??''),
-    moved:releaseState.workspace?.moved===true,created:releaseState.workspace?.created===true
-  };
-  if(!['existing','target-existing','create','rename'].includes(workspace.mode)) throw new Error('handoff workspace mode invalid');
-  const stableMcpUrl=body.stable_mcp_url?{...body.stable_mcp_url}:releaseState.stable_mcp_url?{...releaseState.stable_mcp_url}:null;
-  const mcpUrlSnapshot=body.mcp_url_snapshot?decodeSnapshot(body.mcp_url_snapshot,'MCP URL'):{exists:false,bytes:null,sha256:null};
-  const cleanup=await acquireSupervisorLease(absoluteHandoff);
-  const journal=releaseState;
-  let pointerCommitted=phaseRank(phase)>=phaseRank('pointer_committed')||samePublicPointer(currentPointer,candidatePointer);
-  let stopped=phaseRank(phase)>=phaseRank('old_runtime_stopped');
-  try{
-    if(phaseRank(phase)<phaseRank('supervisor_spawned')){
-      await writeState(statePath,journal,'supervisor_spawned',{supervisor_pid:process.pid,supervisor_script:body.supervisor_script,supervisor_script_sha256:body.supervisor_script_sha256});
-      phase='supervisor_spawned';
-    }
-    let revoked=phaseRank(phase)>=phaseRank('authority_revoked')||journal.revoked_before_switch===true;
-    let newRuntime=null,stabilization=null;
-
-    if(phaseRank(phase)<phaseRank('authority_revoked')){
-      const revoke=await ensureAuthorityRevoked(ctx,priorStatus);
-      revoked=revoke.revoked;
-      await writeState(statePath,journal,'authority_revoked',{revoked_before_switch:revoked});
-      phase='authority_revoked';
-    }
-    if(!stopped){
-      if(!oldRuntime){
-        cleanOfflinePredecessor(ctx);
-        await writeState(statePath,journal,'old_runtime_stopped',{stop_output:'recovery observed predecessor has no captured runtime and clean offline evidence'});
-      }else{
-        const status=parseControllerStatus(controllerCaptured(ctx,'status',15000)),gone=await coreGone(oldRuntime);
-        if(status.offline&&gone){
-          await writeState(statePath,journal,'old_runtime_stopped',{stop_output:'recovery observed predecessor already OFFLINE'});
-        }else{
-          const stoppedResult=await stopAndVerify(ctx,oldRuntime);
-          await writeState(statePath,journal,'old_runtime_stopped',{stop_output:stoppedResult.output});
-        }
-      }
-      stopped=true; phase='old_runtime_stopped';
-    }
-    if(phaseRank(phase)<phaseRank('workspace_ready')){
-      await applyWorkspacePlan(workspace);
-      await writeState(statePath,journal,'workspace_ready',{workspace:{source:workspace.source,target:workspace.target,mode:workspace.mode,moved:workspace.moved===true,created:workspace.created===true}});
-      phase='workspace_ready';
-    }else{
-      workspace.moved=journal.workspace?.moved===true; workspace.created=journal.workspace?.created===true;
-    }
-    if(phaseRank(phase)<phaseRank('launcher_installed')){
-      await installLaunchers(launchers);
-      await writeState(statePath,journal,'launcher_installed',{launcher_sha256:launchers.launcher_sha256,launcher_path:launchers.ps1,top_launcher:launchers.top});
-      phase='launcher_installed';
-    }
-    if(!pointerCommitted){
-      await ensurePointerCommitted(pointerFile,priorPointer,candidatePointer);
-      pointerCommitted=true;
-      await writeState(statePath,journal,'pointer_committed',{active_pointer:publicPointer(candidatePointer)});
-      phase='pointer_committed';
-    }
-    await verifyActiveInstallation(stateRoot,candidatePointer);
-    newRuntime=await ensureFreshRuntime(newCtx,oldRuntime);
-    stabilization=await stabilizeRuntime(newCtx,newRuntime);
-    await writeState(statePath,journal,'fresh_runtime_verified',{new_runtime:generationTuple(newRuntime),stabilization});
-    phase='fresh_runtime_verified';
-
-    const finalAuthority=await restoreStandingAuthority(newCtx,priorStatus,journal.restore_standing_grants===true);
-    await writeState(statePath,journal,'authority_verified',{final_authority:{
-      process_armed:finalAuthority.process_armed,coding_armed:finalAuthority.coding_armed,autonomous_armed:finalAuthority.autonomous_armed,
-      desktop_armed:finalAuthority.desktop_armed,host_armed:finalAuthority.host_armed
-    }});
-    phase='authority_verified';
-
-    const bodyReceipt={
-      schema:UPDATE_SCHEMA,update_id:body.update_id,release_version:journal.expected_version,candidate_manifest_sha256:journal.expected_manifest_sha256,
-      completed_at_utc:new Date().toISOString(),activation_boundary:'active-release-pointer',
-      mechanism:'immutable-release-slot-plus-atomic-pointer-rename-plus-detached-supervisor-handoff',
-      predecessor_mode:journal.predecessor_mode??body.predecessor_mode,prior_pointer:publicPointer(priorPointer),active_pointer:publicPointer(candidatePointer),
-      release_slot:journal.release_slot,generation:journal.generation,
-      launcher:{path:launchers.ps1,sha256:launchers.launcher_sha256,top_path:launchers.top},
-      workspace:{root:workspace.target,migrated:workspace.moved===true},development_root:journal.development_root,
-      host_repin:journal.host_repin??{requested:false,repinned:false},coding_repin:journal.coding_repin??{requested:false,repinned:false},
-      old_runtime:journal.old_runtime??body.old_runtime,new_runtime:generationTuple(newRuntime),stabilization,
-      authority:{
-        prior:priorStatus,revoked_before_switch:revoked,restore_requested:journal.restore_standing_grants===true,desktop_restore_policy:'explicit-rearm-required',
-        final:{
-          process_armed:finalAuthority.process_armed,coding_armed:finalAuthority.coding_armed,autonomous_armed:finalAuthority.autonomous_armed,
-          desktop_armed:finalAuthority.desktop_armed,host_armed:finalAuthority.host_armed
-        }
-      },
-      rollback_performed:false
-    };
-    const receiptPath=path.join(path.dirname(statePath),'receipt.json'),receipt=await writeEnvelope(receiptPath,bodyReceipt,key);
-    await writeState(statePath,journal,'completed',{receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256});
-    return {ok:true,resumed:true,completed:true,update_id:body.update_id,state_path:statePath,receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256,
-      pointer:candidatePointer,new_runtime:newRuntime,final_authority:finalAuthority,workspace_root:workspace.target};
-  }catch(error){
-    let controllerStartFailure=null,controllerStartFailurePreservationError=null;
-    if(pointerCommitted){
-      try{
-        controllerStartFailure=await preserveControllerStartFailure(newCtx,path.dirname(statePath));
-        const claimed=/evidence_sha256=([0-9a-f]{64})/.exec(String(error?.message??error));
-        if(claimed&&(!controllerStartFailure||controllerStartFailure.sha256!==claimed[1])){
-          controllerStartFailurePreservationError='controller start failure evidence claim mismatch expected='+claimed[1]+' preserved='+(controllerStartFailure?.sha256??'missing');
-        }
-      }catch(preserveError){ controllerStartFailurePreservationError=String(preserveError?.message??preserveError); }
-    }
-    const rollback={attempted:false,new_runtime_stopped:false,pointer_restored:false,launchers_restored:false,workspace_restored:false,mcp_url_restored:false,old_runtime_restarted:false,authority_restored:false,errors:[]};
-    try{
-      if(pointerCommitted){
-        rollback.attempted=true;
-        try{ controllerCaptured(newCtx,'stop',30000); rollback.new_runtime_stopped=true; }catch(stopError){ rollback.errors.push('stop-new:'+stopError.message); }
-      }
-      const currentAfter=await parseCurrentPointer(pointerFile);
-      if(samePublicPointer(currentAfter,candidatePointer)){
-        try{ await restoreFile(pointerFile,pointerInfo.snapshot); rollback.pointer_restored=true; }catch(pointerError){ rollback.errors.push('pointer:'+pointerError.message); }
-      }
-      if(stableMcpUrl?.changed&&mcpUrlSnapshot){
-        try{ await restoreFile(stableMcpUrl.path,mcpUrlSnapshot); rollback.mcp_url_restored=true; }catch(mcpUrlError){ rollback.errors.push('mcp-url:'+mcpUrlError.message); }
-      }
-      if(phaseRank(journal.phase)>=phaseRank('launcher_installed')||launchers.installed){
-        try{ await rollbackLaunchers({...launchers,installed:true}); rollback.launchers_restored=true; }catch(launcherError){ rollback.errors.push('launcher:'+launcherError.message); }
-      }
-      if(phaseRank(journal.phase)>=phaseRank('workspace_ready')||workspace.moved||workspace.created){
-        try{ rollback.workspace_restored=await rollbackWorkspacePlan(workspace); }catch(workspaceError){ rollback.errors.push('workspace:'+workspaceError.message); }
-      }
-      if(stopped&&oldRuntime&&rollback.pointer_restored){
-        try{ await startAndVerify(ctx,oldRuntime); rollback.old_runtime_restarted=true; }catch(startError){ rollback.errors.push('restart-old:'+startError.message); }
-      }
-      if((!stopped||rollback.old_runtime_restarted)&&journal.restore_standing_grants===true){
-        try{ await restoreStandingAuthority(ctx,priorStatus,true); rollback.authority_restored=true; }catch(authorityError){ rollback.errors.push('restore-authority:'+authorityError.message); }
-      }
-    }catch(rollbackError){ rollback.errors.push('rollback:'+rollbackError.message); }
-    const failure={
-      schema:FAILURE_SCHEMA,update_id:body.update_id,release_version:journal.expected_version,candidate_manifest_sha256:journal.expected_manifest_sha256,
-      failed_at_utc:new Date().toISOString(),phase:journal.phase??phase,error:{name:error?.name??'Error',code:error?.code??null,message:String(error?.message??error)},
-      controller_start_failure:controllerStartFailure,controller_start_failure_preservation_error:controllerStartFailurePreservationError,
-      predecessor_mode:journal.predecessor_mode??body.predecessor_mode,prior_pointer:publicPointer(priorPointer),attempted_pointer:publicPointer(candidatePointer),
-      old_runtime:journal.old_runtime??body.old_runtime,rollback
-    };
-    await writeState(statePath,journal,'failed',{failure,rollback}).catch(()=>{});
-    let failureReceipt=null;
-    try{
-      const failurePath=path.join(path.dirname(statePath),'failure-receipt.json');
-      failureReceipt=await writeEnvelope(failurePath,failure,key);
-      await writeState(statePath,journal,'failed_receipted',{failure_receipt_path:failurePath,failure_receipt_sha256:failureReceipt.receipt_sha256});
-    }catch(receiptError){
-      rollback.errors.push('failure-receipt:'+receiptError.message);
-      await writeState(statePath,journal,'failed_unreceipted',{rollback}).catch(()=>{});
-    }
-    const wrapped=new Error('R27 slot update failed in detached supervisor: '+(error?.message??error));
-    wrapped.cause=error; wrapped.statePath=statePath; wrapped.failureReceiptPath=failureReceipt?path.join(path.dirname(statePath),'failure-receipt.json'):null; throw wrapped;
-  }finally{
-    await cleanup();
-  }
-}
-export async function recoverInterruptedSlotUpdates({stateRoot=DEFAULT_STATE_ROOT}={}){
-  stateRoot=resolveStateRoot(stateRoot);
-  const evidenceRoot=path.join(path.resolve(stateRoot),'evidence','updates');
-  if(!existsSync(evidenceRoot)) return {ok:true,launched:0,updates:[]};
-  const entries=await readdir(evidenceRoot,{withFileTypes:true});
-  const pointerPath=path.join(path.resolve(stateRoot),'active-release.json');
-  const activePointer=existsSync(pointerPath)?await parseCurrentPointer(pointerPath):null;
-  let launched=0;const updates=[];
-  for(const entry of entries){
-    if(!entry.isDirectory()) continue;
-    const statePath=path.join(evidenceRoot,entry.name,'state.json');
-    if(!existsSync(statePath)) continue;
-    let state;try{ state=await readJson(statePath); }catch{ continue; }
-    if(!activeTransitionPhase(state?.phase)) continue;
-    if(state?.failure || existsSync(path.join(path.dirname(statePath),'failure-receipt.json'))) continue;
-    const pendingPointer=statePointer(state,'new_pointer');
-    if(activePointer&&pendingPointer&&samePublicPointer(activePointer,pendingPointer)){
-      await writeState(statePath,state,'superseded',{superseded_at_utc:new Date().toISOString(),superseded_by_pointer:publicPointer(activePointer)});
-      continue;
-    }
-    const handoffPath=String(state?.handoff_path??'');
-    if(!handoffPath||!path.isAbsolute(handoffPath)||!existsSync(handoffPath)) continue;
-    const handoff=await readJson(handoffPath);
-    if(handoff?.body?.schema!==HANDOFF_SCHEMA) continue;
-    const script=path.resolve(String(handoff.body.supervisor_script??''));
-    if(await sha256File(script)!==handoff.body.supervisor_script_sha256) throw new Error('interrupted update supervisor hash drift: '+state.update_id);
-    const result=await spawnDetachedSupervisor({script,handoffPath,cwd:path.dirname(script)});
-    launched+=1;updates.push({update_id:state.update_id,state_path:statePath,handoff_path:handoffPath,supervisor_pid:result.pid});
-    await atomicBytes(path.join(path.dirname(statePath),'recovery-launch.json'),Buffer.from(JSON.stringify({update_id:state.update_id,launched_at_utc:new Date().toISOString(),supervisor_pid:result.pid})+'\n','utf8'));
-  }
-  return {ok:true,launched,updates};
-}
-
-export async function performSlotUpdate({stage,developmentRoot,expectedVersion,expectedManifest,sourceRoot=null,stateRoot=DEFAULT_STATE_ROOT,restoreStandingGrants=false,recoverOfflinePredecessor=false,cloudTransport=null,bridgeBootstrap=null,processPolicyBootstrap=null,hostPolicyBootstrap=null,codingPolicyBootstrap=null,desktopPolicyBootstrap=null,semanticLspBootstrap=null,enableMachineFs=false,enableObservation=false,enableDesktop=false,enableAutonomousSupervisor=false,hostCommandPins=[]}){
-  // R64 grants have no signed revocation epoch. The historical boolean restore
-  // cannot prove continuity, and must never materialize a successor grant.
-  if(restoreStandingGrants)throw new Error('R65 standing grant auto-restore disabled: explicit reauthorization required');
-  stateRoot=resolveStateRoot(stateRoot);
-  if(process.platform!=='win32') throw new Error('R27 slot update is Windows-only');
-  const state=path.resolve(stateRoot),stageRoot=path.resolve(stage),development=assertDevelopmentRootSafe(developmentRoot,state);
-  const key=await loadUpdateKey(state),updateId='r27-'+expectedManifest.slice(0,16)+'-'+Date.now().toString(36)+'-'+randomBytes(4).toString('hex');
-  const evidenceDir=path.join(state,'evidence','updates',updateId),statePath=path.join(evidenceDir,'state.json'),failurePath=path.join(evidenceDir,'failure-receipt.json');
-  await mkdir(evidenceDir,{recursive:true});
-  const journal={schema:'deadbyte.r27-slot-update-state.v1',update_id:updateId,stage_root:stageRoot,development_root:development,
-    source_root:sourceRoot?path.resolve(sourceRoot):null,expected_version:expectedVersion,expected_manifest_sha256:expectedManifest,
-    restore_standing_grants:restoreStandingGrants,recover_offline_predecessor:recoverOfflinePredecessor,created_at_utc:new Date().toISOString()};
-  await writeState(statePath,journal,'initial');
-  let pointerInfo=null,control=null,predecessor=null,oldRuntime=null,priorStatus=null,authorityPreparation=null,workspace=null,launchers=null,newPointer=null;
-  let stableMcpUrl=null,mcpUrlSnapshot=null;
-  let mutationBegan=false;
-  try{
-    pointerInfo=await loadPointerIfPresent(state);
-    const stageVerified=await verifyPackageRoot(stageRoot,expectedVersion,expectedManifest,'stage');
-    const developmentVerified=await verifyPackageRoot(development,expectedVersion,expectedManifest,'development');
-    control=await loadControlInputs({stateRoot:state,sourceRoot,pointerInfo,bridgeBootstrap});
-    // Read-only predecessor authority and process identity must be safe before
-    // materializing a slot or changing any stable runtime file.
-    await capturePredecessor(control.ctx,recoverOfflinePredecessor,{allowHostDisarm:false});
-    mutationBegan=true;
-    const slot=await materializeReleaseSlot({source:stageRoot,stateRoot:state,version:expectedVersion,manifestSha256:expectedManifest});
-    const hostBootstrap=await prepareHostPolicyBootstrap(hostPolicyBootstrap);if(hostBootstrap) control.hostPolicy=hostBootstrap.policy;
-    const codingBootstrap=await prepareCodingPolicyBootstrap(codingPolicyBootstrap);if(codingBootstrap) control.codingPolicy=codingBootstrap.policy;
-    const processBootstrap=await prepareProcessPolicyBootstrap(processPolicyBootstrap);
-    if(processBootstrap){ control.processPolicy=processBootstrap.policy;control.config.ProcessRuntimeEnabled=true; }
-    const desktopBootstrap=await prepareDesktopPolicyBootstrap(desktopPolicyBootstrap);if(desktopBootstrap) control.desktopPolicy=desktopBootstrap.policy;
-    const semanticBootstrap=await prepareSemanticLspConfigBootstrap(semanticLspBootstrap);
-    if(semanticBootstrap){ control.config.SemanticLspConfigFile=semanticBootstrap.path;control.config.SemanticLspConfigSha256=semanticBootstrap.sha256; }
-    if(enableMachineFs){
-      if(control.config.CodingRuntimeEnabled!==true) throw new Error('MachineFsRuntimeEnabled requires CodingRuntimeEnabled');
-      control.config.MachineFsRuntimeEnabled=true;
-    }
-    if(enableObservation){
-      if(control.config.MachineRuntimeEnabled===false) throw new Error('ObservationRuntimeEnabled requires MachineRuntimeEnabled');
-      if(control.config.CodingRuntimeEnabled!==true) throw new Error('ObservationRuntimeEnabled requires CodingRuntimeEnabled');
-      control.config.ObservationRuntimeEnabled=true;
-    }
-    if(enableDesktop){
-      if(!control.desktopPolicy) throw new Error('DesktopRuntimeEnabled requires pinned desktop policy bootstrap or existing policy');
-      control.config.DesktopRuntimeEnabled=true;
-    }
-    control.config=await prepareReleaseBridgeSpec(control.config,bridgeBootstrap,slot.release_root);
-    control.config=await prepareNamedTunnelCloudSpec(control.config,{releaseRoot:slot.release_root,bootstrap:cloudTransport});
-    control.config=await prepareAutonomousSupervisorSpec(control.config,{releaseRoot:slot.release_root,enable:enableAutonomousSupervisor});
-    authorityPreparation=await prepareAuthorityPolicies({hostPolicy:control.hostPolicy,codingPolicy:control.codingPolicy},{commandPins:hostCommandPins});
-    control.hostPolicy=authorityPreparation.hostPolicy;control.codingPolicy=authorityPreparation.codingPolicy;
-    const stableMcp=await ensureStableMcpPath({stateRoot:state,sourceRoot:pointerInfo.pointer?null:sourceRoot});
-    control.config.McpPathFile=stableMcp.path;
-    if(cloudTransport?.publicOrigin){
-      const mcpUrlFile=path.join(state,'bridge','mcp-url.txt');mcpUrlSnapshot=await snapshotFile(mcpUrlFile);
-      stableMcpUrl=await ensureStableMcpUrl({stateRoot:state,publicOrigin:cloudTransport.publicOrigin,mcpPathFile:stableMcp.path});
-      control.config.McpUrlFile=stableMcpUrl.path;control.config.McpUrlFileSha256=stableMcpUrl.sha256;
-    }else if(control.config.Cloud?.Transport==='deadbyte.named-tunnel.v2'){
-      if(typeof control.config.McpUrlFile!=='string'||!path.isAbsolute(control.config.McpUrlFile)||!HEX64.test(String(control.config.McpUrlFileSha256??''))) throw new Error('existing named tunnel v2 requires pinned McpUrlFile before update');
-      const pinned=await verifyPinnedRegularFile(control.config.McpUrlFile,control.config.McpUrlFileSha256,'existing named tunnel MCP URL file');
-      control.config.McpUrlFile=pinned.path;control.config.McpUrlFileSha256=pinned.sha256;
-    }
-    workspace=await workspacePlan(control.workspaceRoot,state);launchers=await launcherPlan(state);
-    const generation=await createGenerationBundle({stateRoot:state,releaseRoot:slot.release_root,developmentRoot:development,workspaceRoot:workspace.target,releaseId:slot.release_id,currentConfig:control.config,codingPolicy:control.codingPolicy,autonomousPolicy:control.autonomousPolicy,hostPolicy:control.hostPolicy,processPolicy:control.processPolicy,desktopPolicy:control.desktopPolicy});
-    newPointer={schema:'deadbyte.active-release.v1',release_id:slot.release_id,version:expectedVersion,manifest_sha256:expectedManifest,release_root:slot.release_root,generation_root:generation.generation_root,generation_manifest_sha256:generation.generation_manifest_sha256,launcher_sha256:launchers.launcher_sha256,config_path:generation.config_path};
-    parseActivePointer(JSON.stringify(newPointer));
-    await writeState(statePath,journal,'candidate_prepared',{prior_pointer:publicPointer(pointerInfo.pointer),stage:stageVerified,development:developmentVerified,
-      release_slot:slot,generation:{generation_id:generation.generation_id,generation_root:generation.generation_root,generation_manifest_sha256:generation.generation_manifest_sha256,files:generation.files},
-      workspace:{source:workspace.source,target:workspace.target,mode:workspace.mode},stable_mcp_path:{path:stableMcp.path,sha256:stableMcp.sha256},
-      stable_mcp_url:stableMcpUrl?{path:stableMcpUrl.path,sha256:stableMcpUrl.sha256,origin:stableMcpUrl.origin,changed:stableMcpUrl.changed}:null,
-      bridge:{working_directory:control.config.Bridge.WorkingDirectory,script_path:control.config.Bridge.ScriptPath,script_sha256:control.config.Bridge.ScriptSha256},
-      host_repin:{requested:hostCommandPins.length>0,repinned:authorityPreparation.hostRepinned},coding_repin:{requested:hostCommandPins.length>0,repinned:authorityPreparation.codingRepinned},
-      new_pointer:publicPointer(newPointer)});
-    predecessor=await capturePredecessor(control.ctx,recoverOfflinePredecessor,{allowHostDisarm:false});oldRuntime=predecessor.runtime;priorStatus=predecessor.status;
-    await writeState(statePath,journal,'old_runtime_verified',{predecessor_mode:predecessor.mode,old_runtime:generationTuple(oldRuntime),
-      prior_authority:{process_armed:priorStatus.process_armed,coding_armed:priorStatus.coding_armed,autonomous_armed:priorStatus.autonomous_armed,desktop_armed:priorStatus.desktop_armed,host_armed:priorStatus.host_armed}});
-    const handoff=await writeHandoff({stateRoot:state,state:journal,journal,statePath,evidenceDir,key,pointerInfo,newPointer,predecessor,priorStatus,workspace,launchers,stableMcpUrl,mcpUrlSnapshot,controlCtx:control.ctx});
-    const supervisor=await spawnDetachedSupervisor({script:handoff.body.supervisor_script,handoffPath:handoff.path,cwd:control.ctx.core_root});
-    return {ok:true,handed_off:true,completed:false,update_id:updateId,state_path:statePath,handoff_path:handoff.path,handoff_receipt_sha256:handoff.receipt.receipt_sha256,supervisor_pid:supervisor.pid,pointer:newPointer};
-  }catch(error){
-    const failure={schema:FAILURE_SCHEMA,update_id:updateId,release_version:expectedVersion,candidate_manifest_sha256:expectedManifest,failed_at_utc:new Date().toISOString(),
-      result:mutationBegan?'MUTATION_OUTCOME_REQUIRES_RECONCILIATION':'PRECONDITION_REJECTED',
-      phase:journal.phase??'unknown',error:{name:error?.name??'Error',code:error?.code??null,message:String(error?.message??error)},
-      predecessor_mode:predecessor?.mode??null,prior_pointer:publicPointer(pointerInfo?.pointer??null),attempted_pointer:publicPointer(newPointer),old_runtime:generationTuple(oldRuntime),
-      rollback:{attempted:false,new_runtime_stopped:false,pointer_restored:false,launchers_restored:false,workspace_restored:false,mcp_url_restored:false,old_runtime_restarted:false,authority_restored:false,errors:[]}};
-    await writeState(statePath,journal,'failed',{failure}).catch(()=>{});
-    let failureReceipt=null;
-    try{ failureReceipt=await writeEnvelope(failurePath,failure,key);await writeState(statePath,journal,mutationBegan?'failed_receipted':'precondition_rejected',{failure_receipt_path:failurePath,failure_receipt_sha256:failureReceipt.receipt_sha256});}
-    catch(receiptError){ await writeState(statePath,journal,'failed_unreceipted',{failure_receipt_error:String(receiptError?.message??receiptError)}).catch(()=>{}); }
-    const wrapped=new Error('R27 slot update handoff failed: '+(error?.message??error));wrapped.cause=error;wrapped.statePath=statePath;wrapped.failureReceiptPath=failureReceipt?failurePath:null;throw wrapped;
-  }
 }
 
-export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_STATE_ROOT}){
-  stateRoot=resolveStateRoot(stateRoot);
-  if(process.platform!=='win32') throw new Error('R31 slot rollback is Windows-only');
-  const state=path.resolve(stateRoot),receiptFile=path.resolve(activationReceipt);
-  const key=await loadUpdateKey(state);
-  const activationEnvelope=await readJson(receiptFile);
-  if(!verifySlotUpdateEnvelope(activationEnvelope,key.publicKey)) throw new Error('activation receipt signature invalid');
-  if(activationEnvelope.body?.schema!==UPDATE_SCHEMA||activationEnvelope.body?.rollback_performed!==false) throw new Error('activation receipt is not one successful slot activation');
-  const priorPointer=parseActivePointer(JSON.stringify(activationEnvelope.body.prior_pointer));
-  const activePointer=parseActivePointer(JSON.stringify(activationEnvelope.body.active_pointer));
-  const pointerInfo=await loadPointerIfPresent(state);
-  if(!pointerInfo.pointer||canonicalJson(publicPointer(pointerInfo.pointer))!==canonicalJson(publicPointer(activePointer))) throw new Error('rollback current pointer does not match signed activation pointer');
-
-  const handoffPath=path.join(path.dirname(receiptFile),'handoff.json');
-  const {body:handoffBody}=await readHandoffEnvelope(handoffPath,state);
-  if(handoffBody.update_id!==activationEnvelope.body.update_id) throw new Error('rollback handoff update identity mismatch');
-  const rollbackLaunchers=rollbackLauncherPlanFromHandoff(handoffBody,priorPointer,activePointer,state);
-  await verifyStoredInstallation(state,priorPointer);
-
-  const currentCtx=slotContext(state,pointerInfo.pointer),currentRuntime=await captureRuntime(currentCtx);
-  const revoked=await revokeAuthority(currentCtx,currentRuntime.status);
-  const rollbackId=`r31-rollback-${activationEnvelope.receipt_sha256.slice(0,16)}-${Date.now().toString(36)}-${randomBytes(4).toString('hex')}`;
-  const evidenceDir=path.join(state,'evidence','updates',rollbackId),statePath=path.join(evidenceDir,'state.json'),receiptPath=path.join(evidenceDir,'receipt.json'),failurePath=path.join(evidenceDir,'failure-receipt.json');
-  await mkdir(evidenceDir,{recursive:true});
-  const journal={schema:'deadbyte.r31-slot-rollback-state.v1',rollback_id:rollbackId,activation_receipt:path.resolve(receiptFile),
-    activation_receipt_sha256:activationEnvelope.receipt_sha256,handoff_path:handoffPath,
-    from_pointer:publicPointer(activePointer),to_pointer:publicPointer(priorPointer),created_at_utc:new Date().toISOString()};
-  await writeState(statePath,journal,'verified');
-  let stopped=false,launchersRestored=false,pointerCommitted=false,priorCtx=null,priorRuntime=null;
-  try {
-    await stopAndVerify(currentCtx,currentRuntime); stopped=true;
-    await writeState(statePath,journal,'successor_stopped');
-    await restoreRollbackLaunchers(rollbackLaunchers); launchersRestored=true;
-    await writeState(statePath,journal,'predecessor_launcher_restored',{launcher_sha256:priorPointer.launcher_sha256});
-    await atomicWriteActivePointer(pointerInfo.file,priorPointer); pointerCommitted=true;
-    await verifyActiveInstallation(state,priorPointer);
-    await writeState(statePath,journal,'prior_pointer_restored',{active_pointer:publicPointer(priorPointer)});
-    priorCtx=slotContext(state,priorPointer);
-    priorRuntime=await startAndVerify(priorCtx,currentRuntime);
-    const stabilization=await stabilizeRuntime(priorCtx,priorRuntime);
-    const finalStatus=parseControllerStatus(controllerCaptured(priorCtx,'status',15000));
-    if(finalStatus.process_armed||finalStatus.coding_armed||finalStatus.autonomous_armed||finalStatus.desktop_armed||finalStatus.host_armed) throw new Error('rollback predecessor authority must remain disarmed');
-    const body={schema:ROLLBACK_SCHEMA,rollback_id:rollbackId,activation_receipt_sha256:activationEnvelope.receipt_sha256,
-      completed_at_utc:new Date().toISOString(),from_pointer:publicPointer(activePointer),active_pointer:publicPointer(priorPointer),
-      launcher_restored:true,old_runtime:generationTuple(currentRuntime),new_runtime:generationTuple(priorRuntime),stabilization,
-      authority_revoked:revoked.revoked,rollback_performed:true};
-    const receipt=await writeEnvelope(receiptPath,body,key);
-    await writeState(statePath,journal,'completed',{receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256});
-    return {ok:true,rollback_id:rollbackId,state_path:statePath,receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256,pointer:priorPointer,new_runtime:priorRuntime};
-  } catch(error){
-    const recovery={attempted:false,prior_runtime_stopped:false,successor_launcher_restored:false,successor_pointer_restored:false,successor_runtime_restarted:false,errors:[]};
-    if(stopped){
-      recovery.attempted=true;
-      if(pointerCommitted&&priorCtx){ try { controllerCaptured(priorCtx,'stop',30000); recovery.prior_runtime_stopped=true; } catch(recoveryError){ recovery.errors.push(`stop-prior:${recoveryError.message}`); } }
-      if(launchersRestored){
-        try { await installLaunchers(rollbackLaunchers); recovery.successor_launcher_restored=true; }
-        catch(recoveryError){ recovery.errors.push(`restore-successor-launcher:${recoveryError.message}`); }
-      }
-      if(pointerCommitted){
-        try { await atomicWriteActivePointer(pointerInfo.file,activePointer); await verifyActiveInstallation(state,activePointer); recovery.successor_pointer_restored=true; }
-        catch(recoveryError){ recovery.errors.push(`restore-pointer:${recoveryError.message}`); }
-      }else if(recovery.successor_launcher_restored){
-        try { await verifyActiveInstallation(state,activePointer); recovery.successor_pointer_restored=true; }
-        catch(recoveryError){ recovery.errors.push(`verify-successor-pointer:${recoveryError.message}`); }
-      }
-      try { await startAndVerify(currentCtx,currentRuntime); recovery.successor_runtime_restarted=true; } catch(recoveryError){ recovery.errors.push(`restart-successor:${recoveryError.message}`); }
-    }
-    const failure={schema:ROLLBACK_FAILURE_SCHEMA,rollback_id:rollbackId,activation_receipt_sha256:activationEnvelope.receipt_sha256,
-      failed_at_utc:new Date().toISOString(),phase:journal.phase??'unknown',from_pointer:publicPointer(activePointer),to_pointer:publicPointer(priorPointer),
-      error:{name:error?.name??'Error',message:String(error?.message??error)},recovery};
-    await writeState(statePath,journal,'failed',{error:failure.error,recovery}).catch(()=>{});
-    let failureReceipt=null;
-    try{
-      failureReceipt=await writeEnvelope(failurePath,failure,key);
-      await writeState(statePath,journal,'failed_receipted',{failure_receipt_path:failurePath,failure_receipt_sha256:failureReceipt.receipt_sha256});
-    }catch(receiptError){
-      recovery.errors.push('failure-receipt:'+receiptError.message);
-      await writeState(statePath,journal,'failed_unreceipted',{recovery,failure_receipt_error:String(receiptError?.message??receiptError)}).catch(()=>{});
-    }
-    const wrapped=new Error(`R31 slot rollback failed: ${error?.message??error}`); wrapped.cause=error; wrapped.statePath=statePath; wrapped.failureReceiptPath=failureReceipt?failurePath:null; throw wrapped;
-  }
-}
-
-export async function runSlotUpdateCli(argv=process.argv.slice(2),{stateRoot=DEFAULT_STATE_ROOT}={}){
-  stateRoot=resolveStateRoot(stateRoot);
-  if(argv.includes('--rollback-receipt')){
-    const args=parseRollbackArgs(argv);
-    const result=await performSlotRollback({activationReceipt:args.activationReceipt,stateRoot});
-    console.log('R31_SLOT_ROLLBACK_PASS');
-    console.log('ROLLBACK_ID '+result.rollback_id); console.log('RECEIPT_SHA256 '+result.receipt_sha256);
-    console.log('STATE_PATH '+result.state_path); console.log('ACTIVE_RELEASE '+result.pointer.release_id);
-    return result;
-  }
-  if(argv.includes('--resume-handoff')){
-    const args=parseResumeHandoffArgs(argv);
-    const result=await resumeSlotUpdate({handoffPath:args.handoff});
-    console.log(result.completed?'R27_SLOT_UPDATE_RESUME_PASS':'R27_SLOT_UPDATE_RESUME_DEFERRED');
-    console.log('UPDATE_ID '+result.update_id);
-    console.log('STATE_PATH '+result.state_path);
-    if(result.receipt_sha256) console.log('RECEIPT_SHA256 '+result.receipt_sha256);
-    if(result.historical_receipt_verified===true) console.log('VERIFICATION_SCOPE historical-signed-receipt; current-runtime-not-observed');
-    return result;
-  }
-  if(argv.includes('--recover-interrupted')){
-    const result=await recoverInterruptedSlotUpdates({stateRoot});
-    console.log('R27_SLOT_UPDATE_RECOVERY launched='+result.launched);
-    for(const update of result.updates) console.log('UPDATE_ID '+update.update_id+' SUPERVISOR_PID '+update.supervisor_pid);
-    return result;
-  }
-  const args=parseUpdateArgs(argv);
-  const result=await performSlotUpdate({
-    stage:args.stage,developmentRoot:args.developmentRoot,expectedVersion:args.expectedVersion,expectedManifest:args.expectedManifest,
-    sourceRoot:args.sourceRoot,stateRoot,restoreStandingGrants:args.restoreStandingGrants,recoverOfflinePredecessor:args.recoverOfflinePredecessor,
-    cloudTransport:args.cloudTransport,bridgeBootstrap:args.bridgeBootstrap,processPolicyBootstrap:args.processPolicyBootstrap,
-    hostPolicyBootstrap:args.hostPolicyBootstrap,codingPolicyBootstrap:args.codingPolicyBootstrap,desktopPolicyBootstrap:args.desktopPolicyBootstrap,
-    semanticLspBootstrap:args.semanticLspBootstrap,enableMachineFs:args.enableMachineFs,enableObservation:args.enableObservation,
-    enableDesktop:args.enableDesktop,enableAutonomousSupervisor:args.enableAutonomousSupervisor,hostCommandPins:args.hostCommandPins
-  });
-  if(result.handed_off){
-    console.log('R27_SLOT_UPDATE_HANDOFF version='+args.expectedVersion);
-    console.log('UPDATE_ID '+result.update_id);
-    console.log('HANDOFF_PATH '+result.handoff_path);
-    console.log('HANDOFF_RECEIPT_SHA256 '+result.handoff_receipt_sha256);
-    console.log('SUPERVISOR_PID '+result.supervisor_pid);
-  }else{
-    console.log('R27_SLOT_UPDATE_PASS version='+args.expectedVersion);
-    console.log('UPDATE_ID '+result.update_id);
-    console.log('RECEIPT_SHA256 '+result.receipt_sha256);
-    console.log('STATE_PATH '+result.state_path);
-    console.log('ACTIVE_RELEASE '+result.pointer.release_id);
-  }
-  return result;
-}
-const invoked=process.argv[1]&&path.resolve(process.argv[1])===path.resolve(fileURLToPath(import.meta.url));
-if(invoked){
-  try { await runSlotUpdateCli(); }
-  catch(error){
-    console.error(`R27_SLOT_UPDATE_FAIL ${error?.message??error}`);
-    if(error?.statePath) console.error(`STATE_PATH ${error.statePath}`);
-    if(error?.failureReceiptPath) console.error(`FAILURE_RECEIPT_PATH ${error.failureReceiptPath}`);
-    process.exitCode=1;
-  }
-}
+export async function prepareDesktopPolicyBootstrap(bootstrap){
+  if(!bootstrap) return null;
+  const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'desktop policy');
+  const policy=await readJson(pinned.path);
+  if(policy?.schema!=='deadbyte.desktop-policy.v1'||policy?.enabled!==true) throw new Error('desktop policy schema/enabled mismatch');
+  for(const name of ['observer','input','grounder']){
+    const provider=policy[name];
+    if(!provider||typeof provider.executable!=='string'||!path.isAbsolute(provider.executable)||!HEX64.test(String(provider.sha256??''))) {
+      throw new Error(`desktop policy ${name} pin invalid`);
+    }
+  }
+  if(!Array.isArray(policy.allowed_actions)||policy.allowed_actions.length<1) throw new Error('desktop policy allowed_actions invalid');
+  return {...pinned,policy};
+}
+
+export async function prepareSemanticLspConfigBootstrap(bootstrap){
+  if(!bootstrap) return null;
+  const pinned=await verifyPinnedRegularFile(bootstrap.path,bootstrap.sha256,'semantic LSP config');
+  const config=await readJson(pinned.path);
+  if(config?.schema!=='deadbyte.semantic-lsp-config.v1'||!Array.isArray(config.servers)) throw new Error('semantic LSP config schema invalid');
+  return {...pinned,config};
+}
+
+async function preparePinnedCommandPolicy(policy,{commandPins=[],schema,label}={}){
+  if(!policy) return {policy:null,repinned:[],matchedCommandIds:[]};
+  const acceptedSchemas=Array.isArray(schema)?schema:[schema];
+  if(!acceptedSchemas.includes(policy.schema)||policy.enabled!==true||!policy.commands||typeof policy.commands!=='object'||Array.isArray(policy.commands)) {
+    throw new Error(`${label} policy schema/enabled/commands mismatch`);
+  }
+  const requested=new Map();
+  for(const pin of commandPins){
+    const commandId=String(pin?.commandId??''),sha256=String(pin?.sha256??'').toLowerCase();
+    if(!/^[A-Za-z0-9._-]{1,64}$/.test(commandId)||!HEX64.test(sha256)) throw new Error(`${label} command pin contract invalid`);
+    if(requested.has(commandId)) throw new Error(`duplicate ${label} command pin '${commandId}'`);
+    requested.set(commandId,sha256);
+  }
+  const next=structuredClone(policy),repinned=[],matchedCommandIds=[];
+  for(const [commandId,command] of Object.entries(next.commands)){
+    const executable=String(command?.executable??''),expected=String(command?.executable_sha256??'').toLowerCase();
+    if(!path.isAbsolute(executable)||!HEX64.test(expected)) throw new Error(`${label} command '${commandId}' executable pin contract invalid`);
+    const absolute=path.resolve(executable),stat=await lstat(absolute);
+    if(!stat.isFile()||stat.isSymbolicLink()) throw new Error(`${label} command '${commandId}' executable must be a regular file`);
+    const actual=await sha256File(absolute),explicit=requested.get(commandId);
+    if(explicit) matchedCommandIds.push(commandId);
+    if(actual!==expected){
+      if(!explicit) throw new Error(`${label} command '${commandId}' executable pin drift detected; explicit --host-command-pin ${commandId}=${actual} required`);
+      if(explicit!==actual) throw new Error(`${label} command '${commandId}' repin mismatch: supplied ${explicit}, observed ${actual}`);
+      command.executable_sha256=actual;
+      repinned.push({command_id:commandId,executable:absolute,prior_sha256:expected,new_sha256:actual});
+    } else if(explicit&&explicit!==actual){
+      throw new Error(`${label} command '${commandId}' repin mismatch: supplied ${explicit}, observed ${actual}`);
+    }
+  }
+  return {policy:next,repinned,matchedCommandIds};
+}
+
+export async function prepareHostPolicy(policy,{commandPins=[]}={}){
+  if(!policy&&commandPins.length) throw new Error('host command pins supplied but host policy is not configured');
+  const result=await preparePinnedCommandPolicy(policy,{commandPins,schema:['deadbyte.host-policy.v1','deadbyte.host-policy.v2'],label:'host'});
+  const matched=new Set(result.matchedCommandIds);
+  const unknown=commandPins.find(pin=>!matched.has(String(pin?.commandId??'')));
+  if(unknown) throw new Error(`unknown host command pin '${unknown.commandId}'`);
+  return {policy:result.policy,repinned:result.repinned};
+}
+
+export async function prepareAuthorityPolicies({hostPolicy,codingPolicy},{commandPins=[]}={}){
+  const host=await preparePinnedCommandPolicy(hostPolicy,{commandPins,schema:['deadbyte.host-policy.v1','deadbyte.host-policy.v2'],label:'host'});
+  const coding=await preparePinnedCommandPolicy(codingPolicy,{commandPins,schema:'deadbyte.coding-policy.v1',label:'coding'});
+  const matched=new Set([...host.matchedCommandIds,...coding.matchedCommandIds]);
+  const unknown=commandPins.find(pin=>!matched.has(String(pin?.commandId??'')));
+  if(unknown) throw new Error(`unknown authority command pin '${unknown.commandId}'`);
+  return {hostPolicy:host.policy,codingPolicy:coding.policy,hostRepinned:host.repinned,codingRepinned:coding.repinned};
+}
+
+export async function prepareNamedTunnelCloudSpec(config,{releaseRoot,bootstrap=null}={}){
+  const next=structuredClone(config),cloud=next.Cloud??{};
+  const useNamed=bootstrap!==null||cloud.Transport==='deadbyte.named-tunnel.v1'||cloud.Transport==='deadbyte.named-tunnel.v2';
+  if(!useNamed) return next;
+  const release=path.resolve(releaseRoot),hostPath=path.join(release,'bin','deadbyte-tunnel-host.exe');
+  const hostStat=await lstat(hostPath); if(!hostStat.isFile()||hostStat.isSymbolicLink()) throw new Error('named tunnel host must be a regular release file');
+  const hostSha256=await sha256File(hostPath);
+  if(bootstrap!==null){
+    const cloudflared=await verifyPinnedRegularFile(bootstrap.cloudflared.path,bootstrap.cloudflared.sha256,'named tunnel cloudflared');
+    const tokenFile=await verifyPinnedRegularFile(bootstrap.tokenFile.path,bootstrap.tokenFile.sha256,'named tunnel token file');
+    const childWorkingDirectory=path.resolve(bootstrap.childWorkingDirectory),workStat=await lstat(childWorkingDirectory);
+    if(!workStat.isDirectory()||workStat.isSymbolicLink()) throw new Error('named tunnel child working directory must be a real directory');
+    next.Cloud={...cloud,FilePath:hostPath,FileSha256:hostSha256,
+      Arguments:[cloudflared.path,tokenFile.path,childWorkingDirectory].map(quoteWindowsArgument).join(' '),
+      WorkingDirectory:release,Transport:'deadbyte.named-tunnel.v2',Dependencies:[
+        {Name:'cloudflared',Path:cloudflared.path,Sha256:cloudflared.sha256},
+        {Name:'tunnel-token',Path:tokenFile.path,Sha256:tokenFile.sha256}
+      ]};
+  } else {
+    if(cloud.Transport!=='deadbyte.named-tunnel.v2') throw new Error('legacy named tunnel transport requires explicit v2 bootstrap');
+    if(!Array.isArray(cloud.Dependencies)||cloud.Dependencies.length!==2) throw new Error('existing named tunnel dependency contract missing');
+    next.Cloud={...cloud,FilePath:hostPath,FileSha256:hostSha256,WorkingDirectory:release};
+  }
+  return next;
+}
+async function ensureStableMcpPath({stateRoot,sourceRoot}){
+  const bridgeDir=path.join(stateRoot,'bridge');
+  const tokenFile=path.join(bridgeDir,'path-token.txt');
+  let token='';
+  try { token=(await readFile(tokenFile,'utf8')).trim(); } catch(error){
+    if(error?.code!=='ENOENT') throw error;
+    if(!sourceRoot) throw new Error('bridge path token missing and no bootstrap source root supplied');
+    const legacy=(await readFile(path.join(sourceRoot,'controller','runtime','mcp-path.txt'),'utf8')).trim();
+    const match=/^\/mcp\/([0-9a-f]{64})$/.exec(legacy);
+    if(!match) throw new Error('legacy MCP path cannot seed stable token');
+    token=match[1];
+    await mkdir(bridgeDir,{recursive:true});
+    await atomicBytes(tokenFile,Buffer.from(`${token}\n`,'ascii'));
+  }
+  if(!HEX64.test(token)) throw new Error('bridge path token invalid');
+  const stableFile=path.join(bridgeDir,'mcp-path.txt');
+  const desired=Buffer.from(`/mcp/${token}\n`,'ascii');
+  if(existsSync(stableFile)){
+    const found=await readFile(stableFile);
+    if(!found.equals(desired)) throw new Error('stable MCP path file conflicts with token');
+  } else await atomicBytes(stableFile,desired);
+  return {path:stableFile,sha256:sha256Bytes(desired)};
+}
+export async function ensureStableMcpUrl({stateRoot,publicOrigin,mcpPathFile}){
+  const origin=normalizePersistentPublicOrigin(publicOrigin);
+  if(typeof mcpPathFile!=='string'||!path.isAbsolute(mcpPathFile)) throw new Error('stable MCP path file must be absolute');
+  const pathStat=await lstat(mcpPathFile);
+  if(!pathStat.isFile()||pathStat.isSymbolicLink()) throw new Error('stable MCP path file must be a regular file');
+  const mcpPath=(await readFile(mcpPathFile,'ascii')).trim();
+  if(!/^\/mcp\/[0-9a-f]{64}$/.test(mcpPath)) throw new Error('stable MCP path file is invalid');
+  const bridgeDir=path.join(path.resolve(stateRoot),'bridge'),stableFile=path.join(bridgeDir,'mcp-url.txt');
+  const desired=Buffer.from(`${origin}${mcpPath}\n`,'ascii');
+  const before=existsSync(stableFile)?await readFile(stableFile):null;
+  if(!before||!before.equals(desired)) await atomicBytes(stableFile,desired);
+  return {path:stableFile,sha256:sha256Bytes(desired),origin,changed:!before||!before.equals(desired)};
+}
+
+async function snapshotFile(file){
+  try { const bytes=await readFile(file); return {exists:true,bytes,sha256:sha256Bytes(bytes)}; }
+  catch(error){ if(error?.code==='ENOENT') return {exists:false,bytes:null,sha256:null}; throw error; }
+}
+async function restoreFile(file,snapshot){
+  if(snapshot.exists) await atomicBytes(file,snapshot.bytes);
+  else await rm(file,{force:true});
+}
+
+export function parseControllerStatus(text){
+  const number=re=>{const match=re.exec(text);return match?Number(match[1]):null;};
+  return {
+    online:/DEADBYTE MCP = ONLINE/.test(text),
+    offline:/DEADBYTE MCP = OFFLINE/.test(text),
+    bridge_pid:number(/Bridge PID\s*:\s*(\d+)\s*\[verified\]/),
+    cloud_pid:number(/Cloud PID\s*:\s*(\d+)\s*\[verified\]/),
+    local_ready:/Local ready\s*:\s*True/.test(text),
+    process_armed:/Process plane\s*:\s*ARMED \[standing-grant\]/.test(text),
+    coding_armed:/Coding plane\s*:\s*ARMED \[standing-grant\]/.test(text),
+    autonomous_armed:/Autonomous\s*:\s*ARMED \[standing-grant\]/.test(text),
+    desktop_armed:/Desktop plane\s*:\s*ARMED \[standing-grant\]/.test(text),
+    host_armed:/Host plane\s*:\s*ARMED \[standing-grant\]/.test(text)
+  };
+}
+function controlResult(exe,args,{cwd,env,timeoutMs=45000,stdio='pipe'}={}){
+  if(stdio==='ignore'){
+    const result=spawnSync(exe,args,{cwd,env:commandEnvironment(exe,env??process.env),windowsHide:true,timeout:timeoutMs,stdio:'ignore'});
+    return {status:result.status,signal:result.signal,error:result.error?{code:result.error.code??null,message:result.error.message}:null,stdout:'',stderr:''};
+  }
+  return runCaptured(exe,args,{cwd,env,timeoutMs});
+}
+export function legacyContext(sourceRoot){
+  const root=path.resolve(sourceRoot);
+  const candidates=['deadbyte-controller-r26.ps1','deadbyte-controller.ps1'];
+  const controller=candidates.map(name=>path.join(root,'controller',name)).find(existsSync);
+  if(!controller) throw new Error('legacy controller entry missing');
+  return {kind:'legacy',source_root:root,core_root:root,controller_path:controller,
+    cwd:root,runtime_root:path.join(root,'controller','runtime'),state_root:null};
+}
+function slotContext(stateRoot,pointer){
+  return {kind:'slot',source_root:null,core_root:path.resolve(pointer.release_root),
+    controller_path:path.join(pointer.release_root,'controller','deadbyte-controller.ps1'),
+    cwd:path.resolve(pointer.release_root),runtime_root:path.join(path.resolve(stateRoot),'runtime'),
+    state_root:path.resolve(stateRoot),pointer};
+}
+function launcherPath(stateRoot){ return path.join(path.resolve(stateRoot),'bin','DEADBYTE-MCP.ps1'); }
+function controllerInvocation(ctx,command){
+  // Internal control-plane calls use the immutable slot controller directly. The stable launcher is
+  // user-facing and may lag during a slot switch; coupling supervisor state transitions to it creates
+  // a bootstrap dependency and can misreport a healthy predecessor as offline.
+  if(ctx.kind==='slot') return {
+    exe:powershellPath(),
+    args:['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',ctx.controller_path,command],
+    cwd:ctx.cwd,
+    env:{...process.env,DEADBYTE_STATE_ROOT:resolveStateRoot(ctx.state_root),DEADBYTE_CONTROLLER_CONFIG:ctx.pointer.config_path,DEADBYTE_CONTROLLER_RUNTIME_ROOT:ctx.runtime_root}
+  };
+  return {exe:powershellPath(),args:['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',ctx.controller_path,command],cwd:ctx.cwd};
+}
+function controllerCaptured(ctx,command,timeoutMs=45000){
+  const call=controllerInvocation(ctx,command); const result=controlResult(call.exe,call.args,{cwd:call.cwd,env:call.env??process.env,timeoutMs});
+  return assertRun(result,`controller ${command}`);
+}
+export function runControllerStartNoCapture(ctx,timeoutMs=45000){
+  const call=controllerInvocation(ctx,'start');
+  return controlResult(call.exe,call.args,{cwd:call.cwd,env:call.env??process.env,timeoutMs,stdio:'ignore'});
+}
+export async function readControllerStartFailure(ctx){
+  const file=path.join(ctx.runtime_root,'controller-start-failure.json');
+  let bytes;
+  try { bytes=await readFile(file); }
+  catch(error){ if(error?.code==='ENOENT') return null; throw error; }
+  const text=bytes.toString('utf8').replace(/^\uFEFF/,'');
+  let value;
+  try { value=JSON.parse(text); } catch(error){ throw new Error(`controller start failure evidence JSON invalid: ${error.message}`); }
+  if(value?.schema!=='deadbyte.controller-start-failure.v1'||!['start','resume','restart'].includes(String(value?.command??''))||
+      typeof value?.message!=='string'||value.message.length<1||typeof value?.failed_at_utc!=='string') {
+    throw new Error('controller start failure evidence schema invalid');
+  }
+  return {path:file,sha256:sha256Bytes(bytes),...value};
+}
+export async function preserveControllerStartFailure(ctx,evidenceDir){
+  const evidence=await readControllerStartFailure(ctx);
+  if(!evidence) return null;
+  const source=path.join(ctx.runtime_root,'controller-start-failure.json');
+  const bytes=await readFile(source);
+  const sourceSha256=sha256Bytes(bytes);
+  if(sourceSha256!==evidence.sha256) throw new Error('controller start failure evidence changed before preservation');
+  const destination=path.join(path.resolve(evidenceDir),'controller-start-failure.json');
+  await atomicBytes(destination,bytes);
+  const persistedSha256=sha256Bytes(await readFile(destination));
+  if(persistedSha256!==sourceSha256) throw new Error('preserved controller start failure evidence SHA-256 mismatch');
+  return {path:destination,sha256:persistedSha256,schema:evidence.schema,command:evidence.command,
+    failed_at_utc:evidence.failed_at_utc,message:evidence.message};
+}
+async function readLedger(ctx,name){
+  const file=path.join(ctx.runtime_root,`${name}.instance.json`);
+  const value=JSON.parse((await readFile(file,'utf8')).replace(/^\uFEFF/,''));
+  if(value.schema!=='deadbyte.controller.v1'||value.component!==name||!Number.isInteger(Number(value.pid))||
+      !HEX64.test(String(value.instance_nonce))||!HEX64.test(String(value.image_sha256))) {
+    throw new Error(`${name} ledger identity invalid`);
+  }
+  return {schema:value.schema,component:value.component,instance_nonce:String(value.instance_nonce),
+    pid:Number(value.pid),creation_time_utc:String(value.creation_time_utc??''),image_path:String(value.image_path??''),
+    image_sha256:String(value.image_sha256),script_path:String(value.script_path??''),script_sha256:String(value.script_sha256??'')};
+}
+function sameGeneration(a,b){
+  return a.pid===b.pid&&a.instance_nonce===b.instance_nonce&&a.creation_time_utc===b.creation_time_utc&&a.image_sha256===b.image_sha256;
+}
+function activationGuardianOwnedByLineage(item,selfLineage){
+  const name=String(item?.Name??'').toLowerCase();
+  if(name!=='node.exe') return false;
+  const commandLine=String(item?.CommandLine??'');
+  if(!commandLine.toLowerCase().includes('remote-session-guardian.mjs')) return false;
+  const ownerMatch=/(?:^|\s)--owner-pid(?:=|\s+)(\d+)(?=\s|$)/i.exec(commandLine);
+  const nonceMatch=/(?:^|\s)--session-nonce(?:=|\s+)([0-9a-f]{64})(?=\s|$)/i.exec(commandLine);
+  if(!ownerMatch||!nonceMatch) return false;
+  const ownerPid=Number(ownerMatch[1]);
+  const parentPid=Number(item?.ParentProcessId);
+  return Number.isInteger(ownerPid)&&ownerPid>0&&parentPid===ownerPid&&selfLineage.has(ownerPid);
+}
+export function selectOfflineRecoveryBlockers(processes,currentPid=process.pid){
+  const list=(Array.isArray(processes)?processes:[processes]).filter(Boolean);
+  const byPid=new Map();
+  for(const item of list){
+    const pid=Number(item?.ProcessId);
+    if(Number.isInteger(pid)&&pid>0) byPid.set(pid,item);
+  }
+  const selfLineage=new Set();
+  let cursor=Number(currentPid);
+  while(Number.isInteger(cursor)&&cursor>0&&!selfLineage.has(cursor)){
+    selfLineage.add(cursor);
+    const item=byPid.get(cursor);
+    if(!item) break;
+    const parent=Number(item?.ParentProcessId);
+    if(!Number.isInteger(parent)||parent<1||parent===cursor) break;
+    cursor=parent;
+  }
+  const runtimeNames=new Set(['node.exe','cloudflared.exe','deadbyte-tunnel-host.exe']);
+  return list.filter(item=>{
+    const pid=Number(item?.ProcessId);
+    if(selfLineage.has(pid)) return false;
+    if(activationGuardianOwnedByLineage(item,selfLineage)) return false;
+    const name=String(item?.Name??'').toLowerCase();
+    if(!runtimeNames.has(name)) return false;
+    const commandLine=String(item?.CommandLine??'').toLowerCase();
+    return commandLine.includes('deadbyte-mcp')||commandLine.includes('mcp-server.mjs')||
+      commandLine.includes('runtime-self-update.mjs')||commandLine.includes('remote-session-guardian.mjs')||
+      commandLine.includes('deadbyte-tunnel-host.exe');
+  });
+}
+function cleanOfflinePredecessor(ctx){
+  const runtimeRoot=path.resolve(ctx.runtime_root);
+  const blockers=[
+    'bridge.instance.json','cloud.instance.json',
+    'process-grant.json','coding-grant.json','autonomous-grant.json',
+    'desktop-grant.json','host-grant.json'
+  ].filter(name=>existsSync(path.join(runtimeRoot,name)));
+  if(blockers.length) throw new Error('offline predecessor recovery blocked by runtime state: '+blockers.join(','));
+
+  const command="Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine | ConvertTo-Json -Compress";
+  const result=runCaptured(powershellPath(),['-NoLogo','-NoProfile','-Command',command],{timeoutMs:15000});
+  const text=assertRun(result,'runtime process query').trim();
+  if(text){
+    let parsed;
+    try { parsed=JSON.parse(text); } catch(error){ throw new Error('runtime process query JSON invalid: '+error.message); }
+    const relevant=selectOfflineRecoveryBlockers(Array.isArray(parsed)?parsed:[parsed],process.pid);
+    if(relevant.length) throw new Error('offline predecessor recovery blocked by DEADBYTE runtime processes: '+relevant.map(item=>String(item?.Name??'unknown')+'#'+String(item?.ProcessId??'?')).join(','));
+  }
+  return {
+    online:false,offline:true,bridge_pid:null,cloud_pid:null,local_ready:false,
+    process_armed:false,coding_armed:false,autonomous_armed:false,desktop_armed:false,host_armed:false
+  };
+}
+function nodeProcesses(){
+  const command=`Get-CimInstance Win32_Process -Filter \"Name='node.exe'\" | Select-Object ProcessId,ParentProcessId,CreationDate,ExecutablePath,CommandLine | ConvertTo-Json -Compress`;
+  const result=runCaptured(powershellPath(),['-NoLogo','-NoProfile','-Command',command],{timeoutMs:15000});
+  const text=assertRun(result,'node process query').trim(); if(!text) return [];
+  const parsed=JSON.parse(text); return Array.isArray(parsed)?parsed:[parsed];
+}
+export function selectCoreProcess(processes,coreRoot,bridgePid,verifiedBridge=null){
+  const needle=path.join(coreRoot,'src','mcp-server.mjs').replaceAll('/','\\').toLowerCase();
+  const children=processes.filter(item=>Number(item.ParentProcessId)===bridgePid);
+  const visible=children.filter(item=>String(item.CommandLine??'').length>0);
+  const matches=visible.filter(item=>String(item.CommandLine).replaceAll('/','\\').toLowerCase().includes(needle));
+  let item=null,identityBasis=null;
+  if(children.length===1&&visible.length===1&&matches.length===1){
+    item=matches[0]; identityBasis='command_line';
+  } else if(children.length===1&&visible.length===0){
+    if(verifiedBridge?.component!=='bridge'||verifiedBridge.pid!==bridgePid||!path.isAbsolute(String(verifiedBridge.script_path??''))||
+        !HEX64.test(String(verifiedBridge.script_sha256??''))) {
+      throw new Error(`opaque downstream core requires verified Bridge script binding for bridge ${bridgePid}`);
+    }
+    item=children[0]; identityBasis='verified_bridge_single_opaque_node_child';
+  } else {
+    throw new Error(`expected one unambiguous downstream core for bridge ${bridgePid}, found children=${children.length} visible_matches=${matches.length}`);
+  }
+  const pid=Number(item.ProcessId),creationDate=String(item.CreationDate??'');
+  if(!Number.isInteger(pid)||pid<1||creationDate.length<1) throw new Error(`downstream core identity incomplete for bridge ${bridgePid}`);
+  return {pid,parent_pid:Number(item.ParentProcessId),creation_date:creationDate,
+    executable_path:String(item.ExecutablePath??''),command_line:String(item.CommandLine??''),identity_basis:identityBasis};
+}
+function coreProcess(coreRoot,bridge){
+  return selectCoreProcess(nodeProcesses(),coreRoot,bridge.pid,bridge);
+}
+export async function waitForCoreProcess(coreRoot,bridge,{
+  timeoutMs=10000,
+  pollMs=100,
+  processProvider=nodeProcesses,
+  sleepFn=sleep,
+  nowFn=Date.now
+}={}){
+  const bridgePid=Number(bridge?.pid);
+  if(!Number.isInteger(bridgePid)||bridgePid<1) throw new Error('downstream core wait requires verified bridge PID');
+  if(!Number.isFinite(timeoutMs)||timeoutMs<0) throw new Error('downstream core wait timeout invalid');
+  if(!Number.isFinite(pollMs)||pollMs<1) throw new Error('downstream core wait poll invalid');
+  if(typeof processProvider!=='function'||typeof sleepFn!=='function'||typeof nowFn!=='function') throw new Error('downstream core wait hooks invalid');
+  const started=Number(nowFn());
+  let lastError=null;
+  while(true){
+    try {
+      const processes=await processProvider();
+      return selectCoreProcess(processes,coreRoot,bridgePid,bridge);
+    } catch(error){
+      const message=String(error?.message??error);
+      const transient=`expected one unambiguous downstream core for bridge ${bridgePid}, found children=0 visible_matches=0`;
+      if(message!==transient) throw error;
+      lastError=error;
+    }
+    const elapsed=Math.max(0,Number(nowFn())-started);
+    if(elapsed>=timeoutMs){
+      throw new Error(`downstream core did not appear for bridge ${bridgePid} within ${timeoutMs}ms: ${String(lastError?.message??lastError)}`);
+    }
+    await sleepFn(Math.min(pollMs,Math.max(1,timeoutMs-elapsed)));
+  }
+}
+async function captureRuntime(ctx){
+  const statusText=controllerCaptured(ctx,'status',15000); const status=parseControllerStatus(statusText);
+  if(!status.online||!status.bridge_pid||!status.cloud_pid||!status.local_ready) throw new Error(`slot update requires ONLINE runtime: ${statusText}`);
+  if(status.host_armed) throw new Error('slot update requires host plane DISARMED');
+  if(status.autonomous_armed&&!status.coding_armed) throw new Error('invalid runtime authority: autonomous armed without coding');
+  const bridge=await readLedger(ctx,'bridge'); const cloud=await readLedger(ctx,'cloud'); const core=coreProcess(ctx.core_root,bridge);
+  return {status,status_text:statusText.trim(),bridge,cloud,core};
+}
+export async function capturePredecessor(ctx,recoverOfflinePredecessor,{allowHostDisarm=true}={}){
+  let statusText,status;
+  try{
+    statusText=controllerCaptured(ctx,'status',15000);
+    status=parseControllerStatus(statusText);
+  }catch(error){
+    if(!recoverOfflinePredecessor) throw error;
+    try{
+      const runtimeDir=ctx.runtime_root;
+      const hasBridge=existsSync(path.join(runtimeDir,'bridge.instance.json'));
+      const hasCloud=existsSync(path.join(runtimeDir,'cloud.instance.json'));
+      if(hasBridge&&hasCloud){
+        const armed=['process-grant.json','coding-grant.json','autonomous-grant.json','desktop-grant.json','host-grant.json']
+          .some(name=>existsSync(path.join(runtimeDir,name)));
+        if(armed) throw new Error('controller status failed while authority grant state is present');
+        const bridge=await readLedger(ctx,'bridge');
+        const cloud=await readLedger(ctx,'cloud');
+        const core=coreProcess(ctx.core_root,bridge);
+        const status={online:true,offline:false,bridge_pid:bridge.pid,cloud_pid:cloud.pid,local_ready:true,
+          process_armed:false,coding_armed:false,autonomous_armed:false,desktop_armed:false,host_armed:false};
+        return {mode:'online-ledger-recovery',status,status_text:`controller status unavailable; verified runtime ledgers established: ${String(error?.message??error)}`,runtime:{status,status_text:'verified by controller ledgers',bridge,cloud,core}};
+      }
+      const offline=cleanOfflinePredecessor(ctx);
+      return {mode:'offline-recovery',status:offline,status_text:`controller status unavailable; clean offline evidence established: ${String(error?.message??error)}`,runtime:null};
+    }catch(recoveryError){
+      throw new Error(`controller status failed and predecessor recovery was not applicable: ${String(error?.message??error)}; ${String(recoveryError?.message??recoveryError)}`);
+    }
+  }
+  if(status.online&&status.bridge_pid&&status.cloud_pid&&status.local_ready){
+    const runtime=await captureRuntime(ctx);
+    return {mode:'online',status:runtime.status,status_text:runtime.status_text,runtime};
+  }
+  if(!recoverOfflinePredecessor) throw new Error(`slot update requires ONLINE runtime: ${statusText}`);
+  if(!status.offline||status.bridge_pid||status.cloud_pid||status.local_ready) throw new Error(`offline predecessor recovery requires clean OFFLINE controller state: ${statusText}`);
+  if(status.host_armed){
+    if(!allowHostDisarm) throw new Error('offline predecessor recovery requires host plane DISARMED');
+    controllerCaptured(ctx,'disarmhost',15000);
+    statusText=controllerCaptured(ctx,'status',15000);
+    status=parseControllerStatus(statusText);
+    if(!status.offline||status.bridge_pid||status.cloud_pid||status.local_ready) throw new Error(`offline predecessor recovery changed controller state while revoking Host authority: ${statusText}`);
+    if(status.host_armed) throw new Error('offline predecessor recovery requires host plane DISARMED');
+  }
+  if(status.autonomous_armed&&!status.coding_armed) throw new Error('invalid runtime authority: autonomous armed without coding');
+  return {mode:'offline-recovery',status,status_text:statusText.trim(),runtime:null};
+}
+async function waitCoreGone(runtime,timeoutMs=10000){
+  const started=Date.now();
+  while(Date.now()-started<timeoutMs){
+    const found=nodeProcesses().find(item=>Number(item.ProcessId)===runtime.core.pid&&String(item.CreationDate??'')===runtime.core.creation_date);
+    if(!found) return true; await sleep(250);
+  }
+  return false;
+}
+async function startAndVerify(ctx,oldRuntime){
+  let start=null;
+  await rm(path.join(ctx.runtime_root,'controller-start-failure.json'),{force:true});
+  for(let attempt=1;attempt<=3;attempt+=1){
+    start=runControllerStartNoCapture(ctx,45000);
+    if(!start.error&&start.status===0) break;
+    if(attempt<3) await sleep(1500);
+  }
+  if(start.error||start.status!==0){
+    let detail='';
+    try {
+      const evidence=await readControllerStartFailure(ctx);
+      if(evidence) detail=` controller=${evidence.message} evidence_sha256=${evidence.sha256}`;
+    } catch(error) { detail=` controller_evidence_error=${error.message}`; }
+    throw new Error(`controller start transport failed status=${start.status} error=${start.error?.message??'none'}${detail}`);
+  }
+  let statusText=''; let status=null;
+  const started=Date.now();
+  while(Date.now()-started<45000){
+    try { statusText=controllerCaptured(ctx,'status',15000); status=parseControllerStatus(statusText); if(status.online&&status.bridge_pid&&status.cloud_pid&&status.local_ready) break; }
+    catch {} await sleep(500);
+  }
+  if(!status?.online||!status.bridge_pid||!status.cloud_pid||!status.local_ready) throw new Error(`new runtime failed ONLINE gate: ${statusText}`);
+  const bridge=await readLedger(ctx,'bridge'); const cloud=await readLedger(ctx,'cloud'); const core=await waitForCoreProcess(ctx.core_root,bridge);
+  if(oldRuntime?.bridge&&sameGeneration(oldRuntime.bridge,bridge)) throw new Error('fresh bridge generation gate failed');
+  if(oldRuntime?.cloud&&sameGeneration(oldRuntime.cloud,cloud)) throw new Error('fresh cloud generation gate failed');
+  if(oldRuntime?.core&&oldRuntime.core.pid===core.pid&&oldRuntime.core.creation_date===core.creation_date) throw new Error('fresh downstream core generation gate failed');
+  return {status,status_text:statusText.trim(),bridge,cloud,core};
+}
+async function stabilizeRuntime(ctx,runtime){
+  const started=Date.now(); let probes=0;
+  while(Date.now()-started<RUNTIME_STABILITY_MS){
+    await sleep(RUNTIME_STABILITY_POLL_MS);
+    const statusText=controllerCaptured(ctx,'status',15000),status=parseControllerStatus(statusText);
+    if(!status.online||!status.local_ready||status.bridge_pid!==runtime.bridge.pid||status.cloud_pid!==runtime.cloud.pid) {
+      throw new Error(`new runtime lost stability gate: ${statusText}`);
+    }
+    const bridge=await readLedger(ctx,'bridge'),cloud=await readLedger(ctx,'cloud');
+    if(!sameGeneration(runtime.bridge,bridge)||!sameGeneration(runtime.cloud,cloud)) throw new Error('new runtime generation changed during stability gate');
+    probes++;
+  }
+  controllerCaptured(ctx,'test',60000);
+  const finalText=controllerCaptured(ctx,'status',15000),final=parseControllerStatus(finalText);
+  if(!final.online||!final.local_ready||final.bridge_pid!==runtime.bridge.pid||final.cloud_pid!==runtime.cloud.pid) {
+    throw new Error(`new runtime failed post-public stability gate: ${finalText}`);
+  }
+  return {duration_ms:Date.now()-started,probes,public_mcp_gate:'passed'};
+}
+async function verifyPackageRoot(root,expectedVersion,expectedManifest,label){
+  const absolute=path.resolve(root); const info=await lstat(absolute);
+  if(!info.isDirectory()||info.isSymbolicLink()) throw new Error(`${label} root must be a real directory`);
+  const manifestBytes=await readFile(path.join(absolute,'MANIFEST.SHA256'));
+  const digest=sha256Bytes(manifestBytes); if(digest!==expectedManifest) throw new Error(`${label} manifest digest mismatch: ${digest}`);
+  const entries=parseManifest(manifestBytes.toString('utf8')); await verifyManifestTree(absolute,entries);
+  const pkg=await readJson(path.join(absolute,'package.json'));
+  if(pkg?.name!=='deadbyte-mcp'||pkg?.version!==expectedVersion) throw new Error(`${label} package identity mismatch`);
+  return {root:absolute,manifest_sha256:digest,entries:entries.size};
+}
+async function verifyStoredInstallation(stateRoot,pointer){
+  const state=path.resolve(stateRoot); const expectedRelease=path.join(state,'releases',releaseId(pointer.version,pointer.manifest_sha256));
+  if(path.resolve(pointer.release_root)!==path.resolve(expectedRelease)) throw new Error('active pointer release root is not content-addressed store path');
+  const release=await verifyPackageRoot(pointer.release_root,pointer.version,pointer.manifest_sha256,'active release');
+  const generation=await verifyGenerationBundle(pointer.generation_root,pointer.generation_manifest_sha256);
+  const expectedConfig=path.join(path.resolve(pointer.generation_root),'controller-config.psd1');
+  if(path.resolve(pointer.config_path)!==path.resolve(expectedConfig)) throw new Error('active pointer config path mismatch');
+  return {release,generation};
+}
+async function verifyActiveInstallation(stateRoot,pointer){
+  const state=path.resolve(stateRoot);
+  const verified=await verifyStoredInstallation(state,pointer);
+  const currentLauncher=await sha256File(launcherPath(state));
+  if(currentLauncher!==pointer.launcher_sha256) throw new Error('active pointer launcher digest mismatch');
+  return verified;
+}
+async function loadPointerIfPresent(stateRoot){
+  const file=path.join(path.resolve(stateRoot),'active-release.json');
+  if(!existsSync(file)) return {file,pointer:null,snapshot:await snapshotFile(file)};
+  const snapshot=await snapshotFile(file); const pointer=parseActivePointer(snapshot.bytes.toString('utf8'));
+  await verifyActiveInstallation(stateRoot,pointer); return {file,pointer,snapshot};
+}
+async function loadControlInputs({stateRoot,sourceRoot,pointerInfo,bridgeBootstrap=null}){
+  let configPath,ctx;
+  if(pointerInfo.pointer){
+    configPath=pointerInfo.pointer.config_path; ctx=slotContext(stateRoot,pointerInfo.pointer);
+  } else {
+    if(!sourceRoot) throw new Error('--source-root is required for initial slot migration');
+    ctx=legacyContext(sourceRoot); configPath=path.join(ctx.source_root,'controller','deadbyte-controller.config.psd1');
+  }
+  let config=await loadPowerShellDataFile(configPath);
+  if(bridgeBootstrap){
+    if(!bridgeBootstrap.root||!path.isAbsolute(bridgeBootstrap.root)||!HEX64.test(String(bridgeBootstrap.scriptSha256??''))) throw new Error('bridge bootstrap requires absolute root plus lowercase script SHA-256');
+    const bootstrapRoot=path.resolve(bridgeBootstrap.root);
+    const bootstrapScript=path.join(bootstrapRoot,'src','bridge.mjs');
+    const bootstrapActual=await sha256File(bootstrapScript);
+    if(bootstrapActual!==String(bridgeBootstrap.scriptSha256).toLowerCase()) throw new Error(`bridge script SHA-256 mismatch: expected ${String(bridgeBootstrap.scriptSha256).toLowerCase()}, found ${bootstrapActual}`);
+    if(!config.Bridge||typeof config.Bridge!=='object') throw new Error('Bridge launch specification missing');
+    config.Bridge.WorkingDirectory=bootstrapRoot;
+    config.Bridge.Arguments='src\\bridge.mjs';
+    config.Bridge.ScriptPath=bootstrapScript;
+    config.Bridge.ScriptSha256=bootstrapActual;
+  }
+  config=await normalizeComponentIdentities(config);
+  const codingPath=String(config.CodingPolicyFile??''); const autonomousPath=String(config.AutonomousPolicyFile??''); const hostPath=String(config.HostPolicyFile??''); const processPath=String(config.ProcessPolicyFile??''); const desktopPath=String(config.DesktopPolicyFile??'');
+  if(!path.isAbsolute(codingPath)||!path.isAbsolute(autonomousPath)) throw new Error('coding/autonomous policy paths must be absolute');
+  if(processPath&&!path.isAbsolute(processPath)) throw new Error('process policy path must be absolute');
+  if(desktopPath&&!path.isAbsolute(desktopPath)) throw new Error('desktop policy path must be absolute');
+  const codingPolicy=await readJson(codingPath); const autonomousPolicy=await readJson(autonomousPath); const hostPolicy=hostPath?await readJson(hostPath):null; const processPolicy=processPath?await readJson(processPath):null; const desktopPolicy=desktopPath?await readJson(desktopPath):null;
+  const legacyCore=typeof config.CoreRoot==='string'&&config.CoreRoot?path.resolve(config.CoreRoot):ctx.core_root;
+  const workspaceRoot=typeof config.WorkspaceRoot==='string'&&config.WorkspaceRoot?path.resolve(config.WorkspaceRoot):path.join(legacyCore,'workspaces');
+  return {ctx,configPath,config,codingPolicy,autonomousPolicy,hostPolicy,processPolicy,desktopPolicy,workspaceRoot};
+}
+export function assertDevelopmentRootSafe(developmentRoot,stateRoot){
+  const dev=path.resolve(developmentRoot),state=path.resolve(stateRoot);
+  const forbidden=[path.join(state,'releases'),path.join(state,'generations'),path.join(state,'runtime')].map(item=>path.resolve(item).toLowerCase());
+  const lower=dev.toLowerCase();
+  if(forbidden.some(prefix=>lower===prefix||lower.startsWith(`${prefix}${path.sep}`))) throw new Error('development root cannot live inside immutable/runtime state stores');
+  return dev;
+}
+async function workspacePlan(currentWorkspace,stateRoot){
+  const source=path.resolve(currentWorkspace),target=path.join(path.resolve(stateRoot),'workspaces');
+  if(source.toLowerCase()===path.resolve(target).toLowerCase()) return {source,target,mode:'existing',moved:false};
+  const sourceExists=existsSync(source),targetExists=existsSync(target);
+  if(targetExists){
+    const info=await lstat(target); if(!info.isDirectory()||info.isSymbolicLink()) throw new Error('stable workspace root must be a real directory');
+    if(sourceExists) throw new Error(`workspace migration conflict: both source and stable target exist (${source}, ${target})`);
+    return {source,target,mode:'target-existing',moved:false};
+  }
+  if(!sourceExists) return {source,target,mode:'create',moved:false};
+  const info=await lstat(source); if(!info.isDirectory()||info.isSymbolicLink()) throw new Error('legacy workspace root must be a real directory');
+  if(path.parse(source).root.toLowerCase()!==path.parse(target).root.toLowerCase()) throw new Error('workspace migration requires same-volume rename');
+  return {source,target,mode:'rename',moved:false};
+}
+async function applyWorkspacePlan(plan){
+  if(plan.mode==='existing'||plan.mode==='target-existing') return plan;
+  const sourceExists=existsSync(plan.source),targetExists=existsSync(plan.target);
+  if(plan.mode==='create'){
+    if(targetExists){ plan.created=true; return plan; }
+    await mkdir(path.dirname(plan.target),{recursive:true});
+    await mkdir(plan.target,{recursive:false}); plan.created=true; return plan;
+  }
+  if(targetExists&&!sourceExists){ plan.moved=true; return plan; }
+  if(sourceExists&&targetExists) throw new Error('workspace migration conflict: both source and stable target exist ('+plan.source+', '+plan.target+')');
+  await mkdir(path.dirname(plan.target),{recursive:true});
+  await rename(plan.source,plan.target); plan.moved=true; return plan;
+}
+async function rollbackWorkspacePlan(plan){
+  if(plan.mode==='rename'&&existsSync(plan.target)&&!existsSync(plan.source)){ await rename(plan.target,plan.source); plan.moved=false; return true; }
+  if(plan.mode==='create'&&existsSync(plan.target)){ await rm(plan.target,{recursive:true,force:true}); plan.created=false; return true; }
+  return false;
+}
+async function launcherPlan(stateRoot){
+  const bin=path.join(path.resolve(stateRoot),'bin');
+  const ps1=path.join(bin,'DEADBYTE-MCP.ps1'),cmd=path.join(bin,'DEADBYTE-MCP.cmd'),top=TOP_LAUNCHER;
+  const ps1Bytes=Buffer.from(renderStableLauncherPs1(),'utf8'),cmdBytes=Buffer.from(renderStableLauncherCmd(),'utf8');
+  return {ps1,cmd,top,ps1Bytes,cmdBytes,launcher_sha256:sha256Bytes(ps1Bytes),
+    snapshots:{ps1:await snapshotFile(ps1),cmd:await snapshotFile(cmd),top:await snapshotFile(top)},installed:false};
+}
+async function installLaunchers(plan){
+  await atomicBytes(plan.ps1,plan.ps1Bytes); await atomicBytes(plan.cmd,plan.cmdBytes); await atomicBytes(plan.top,plan.cmdBytes);
+  plan.installed=true;
+  if(await sha256File(plan.ps1)!==plan.launcher_sha256) throw new Error('stable launcher post-install hash mismatch');
+  return plan;
+}
+async function rollbackLaunchers(plan){
+  if(!plan) return false;
+  const touched=plan.installed===true || (existsSync(plan.ps1)&&sha256Bytes(await readFile(plan.ps1))===plan.launcher_sha256);
+  if(!touched) return false;
+  await restoreFile(plan.ps1,plan.snapshots.ps1); await restoreFile(plan.cmd,plan.snapshots.cmd); await restoreFile(plan.top,plan.snapshots.top);
+  plan.installed=false; return true;
+}
+async function revokeAuthority(ctx,prior){
+  let revoked=false;
+  if(prior.desktop_armed){ controllerCaptured(ctx,'disarmdesktop',15000); revoked=true; }
+  if(prior.autonomous_armed){ controllerCaptured(ctx,'disarmautonomous',15000); revoked=true; }
+  if(prior.coding_armed){ controllerCaptured(ctx,'disarmcoding',15000); revoked=true; }
+  if(prior.process_armed){ controllerCaptured(ctx,'disarmprocess',15000); revoked=true; }
+  const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
+  if(status.process_armed||status.coding_armed||status.autonomous_armed||status.desktop_armed) throw new Error('standing authority revoke gate failed');
+  if(status.host_armed) throw new Error('host plane became armed during revoke');
+  return {revoked,status};
+}
+export function standingAuthorityRestorePlan(prior,enabled){
+  const before={
+    process_armed:prior?.process_armed===true,
+    coding_armed:prior?.coding_armed===true,
+    autonomous_armed:prior?.autonomous_armed===true,
+    desktop_armed:prior?.desktop_armed===true,
+    host_armed:prior?.host_armed===true
+  };
+  if(before.autonomous_armed&&!before.coding_armed) throw new Error('invalid prior authority: autonomous armed without coding');
+  const expected={process_armed:false,coding_armed:false,autonomous_armed:false,desktop_armed:false,host_armed:false};
+  const commands=[];
+  if(enabled){
+    expected.process_armed=before.process_armed;
+    expected.coding_armed=before.coding_armed;
+    expected.autonomous_armed=before.autonomous_armed;
+    if(before.coding_armed) commands.push('armcoding');
+    if(before.autonomous_armed) commands.push('armautonomous');
+    if(before.process_armed) commands.push('armprocess');
+  }
+  return {commands,expected};
+}
+async function restoreStandingAuthority(ctx,prior,enabled){
+  const plan=standingAuthorityRestorePlan(prior,enabled);
+  for(const command of plan.commands) controllerCaptured(ctx,command,15000);
+  const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
+  for(const key of ['process_armed','coding_armed','autonomous_armed']){
+    if(status[key]!==plan.expected[key]) throw new Error(`${key.replace('_armed','')} standing-grant restore gate failed`);
+  }
+  if(status.desktop_armed!==plan.expected.desktop_armed) throw new Error('desktop plane must remain disarmed after slot switch');
+  if(status.host_armed!==plan.expected.host_armed) throw new Error('host plane became armed during slot switch');
+  return status;
+}
+async function stopAndVerify(ctx,runtime){
+  try{ controllerCaptured(ctx,'supervisorstop',15000); }catch(error){
+    if(!/not running|no supervisor|offline|missing/i.test(String(error?.message??error))) throw error;
+  }
+  const output=controllerCaptured(ctx,'stop',30000);
+  if(!(await waitCoreGone(runtime,10000))) throw new Error(`old downstream core ${runtime.core.pid} survived verified stop`);
+  const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
+  if(!status.offline) throw new Error(`controller stop did not reach OFFLINE: ${output}`);
+  return {output:output.trim(),status};
+}
+async function loadUpdateKey(stateRoot){
+  const trust=path.join(path.resolve(stateRoot),'trust');
+  const privateKey=createPrivateKey(await readFile(path.join(trust,'ed25519-private.pem')));
+  const publicKey=createPublicKey(await readFile(path.join(trust,'ed25519-public.pem'))); const derived=createPublicKey(privateKey);
+  if(privateKey.asymmetricKeyType!=='ed25519'||publicKey.asymmetricKeyType!=='ed25519') throw new Error('slot-update trust key must be Ed25519');
+  const der=key=>Buffer.from(key.export({type:'spki',format:'der'})); const keyId=sha256Bytes(der(publicKey));
+  if(sha256Bytes(der(derived))!==keyId) throw new Error('slot-update private/public key mismatch');
+  return {privateKey,publicKey,keyId};
+}
+function signEnvelope(body,key){
+  const bodyBytes=Buffer.from(canonicalJson(body),'utf8'); const signature=cryptoSign(null,Buffer.concat([RECEIPT_DOMAIN,bodyBytes]),key.privateKey);
+  const envelope={body,body_sha256:sha256Bytes(bodyBytes),attestation:{algorithm:'ed25519',domain:'DEADBYTE-R27-SLOT-UPDATE-V1',key_id:key.keyId,signature_base64:signature.toString('base64')}};
+  envelope.receipt_sha256=sha256Bytes(Buffer.from(canonicalJson(envelope),'utf8'));
+  if(!cryptoVerify(null,Buffer.concat([RECEIPT_DOMAIN,bodyBytes]),key.publicKey,signature)) throw new Error('slot-update signature self-check failed');
+  return envelope;
+}
+export function verifySlotUpdateEnvelope(envelope,publicKey){
+  if(!envelope?.body||!envelope?.attestation) return false; const bodyBytes=Buffer.from(canonicalJson(envelope.body),'utf8');
+  if(sha256Bytes(bodyBytes)!==envelope.body_sha256) return false; const {receipt_sha256,...unsigned}=envelope;
+  if(sha256Bytes(Buffer.from(canonicalJson(unsigned),'utf8'))!==receipt_sha256) return false;
+  if(envelope.attestation.algorithm!=='ed25519'||envelope.attestation.domain!=='DEADBYTE-R27-SLOT-UPDATE-V1') return false;
+  const keyId=sha256Bytes(Buffer.from(publicKey.export({type:'spki',format:'der'}))); if(keyId!==envelope.attestation.key_id) return false;
+  return cryptoVerify(null,Buffer.concat([RECEIPT_DOMAIN,bodyBytes]),publicKey,Buffer.from(envelope.attestation.signature_base64,'base64'));
+}
+async function writeEnvelope(file,body,key){ const envelope=signEnvelope(body,key); await atomicBytes(file,Buffer.from(`${JSON.stringify(envelope,null,2)}\n`,'utf8')); return envelope; }
+async function writeState(file,state,phase,extra={}){
+  let observed=null;
+  try { observed=await readJson(file); } catch(error) { if(error?.code!=='ENOENT') throw error; }
+  const observedRank=phaseRank(observed?.phase);
+  const requestedRank=phaseRank(phase);
+  const effectivePhase=observedRank>requestedRank?String(observed.phase):phase;
+  if(observed) Object.assign(state,observed);
+  Object.assign(state,extra,{phase:effectivePhase,updated_at_utc:new Date().toISOString()});
+  await atomicBytes(file,Buffer.from(`${JSON.stringify(state,null,2)}\n`,'utf8'));
+}
+function generationTuple(runtime){
+  if(!runtime) return null;
+  return {bridge:{pid:runtime.bridge.pid,instance_nonce:runtime.bridge.instance_nonce,creation_time_utc:runtime.bridge.creation_time_utc,image_sha256:runtime.bridge.image_sha256},
+    cloud:{pid:runtime.cloud.pid,instance_nonce:runtime.cloud.instance_nonce,creation_time_utc:runtime.cloud.creation_time_utc,image_sha256:runtime.cloud.image_sha256},
+    core:{pid:runtime.core.pid,parent_pid:runtime.core.parent_pid,creation_date:runtime.core.creation_date,
+      command_line:runtime.core.command_line,identity_basis:runtime.core.identity_basis}};
+}
+function publicPointer(pointer){
+  if(!pointer) return null;
+  return {schema:pointer.schema,release_id:pointer.release_id,version:pointer.version,manifest_sha256:pointer.manifest_sha256,
+    release_root:pointer.release_root,generation_root:pointer.generation_root,generation_manifest_sha256:pointer.generation_manifest_sha256,
+    launcher_sha256:pointer.launcher_sha256,config_path:pointer.config_path};
+}
+
+function encodeSnapshot(snapshot){
+  if(!snapshot||typeof snapshot!=='object') throw new Error('snapshot object required');
+  return {exists:snapshot.exists===true,sha256:snapshot.sha256??null,bytes_base64:snapshot.exists&&snapshot.bytes?Buffer.from(snapshot.bytes).toString('base64'):null};
+}
+function decodeSnapshot(snapshot,label){
+  if(!snapshot||typeof snapshot!=='object'||typeof snapshot.exists!=='boolean') throw new Error(label+' snapshot invalid');
+  if(snapshot.exists){
+    if(typeof snapshot.bytes_base64!=='string') throw new Error(label+' snapshot bytes missing');
+    const bytes=Buffer.from(snapshot.bytes_base64,'base64'),actual=sha256Bytes(bytes);
+    if(snapshot.sha256!==actual) throw new Error(label+' snapshot SHA-256 mismatch');
+    return {exists:true,bytes,sha256:actual};
+  }
+  return {exists:false,bytes:null,sha256:null};
+}
+export function rollbackLauncherPlanFromHandoff(body,priorPointer,activePointer,stateRoot=DEFAULT_STATE_ROOT){
+  if(!body||typeof body!=='object') throw new Error('rollback handoff body required');
+  const handoffPrior=body.prior_pointer?parseActivePointer(JSON.stringify(body.prior_pointer)):null;
+  const handoffActive=body.new_pointer?parseActivePointer(JSON.stringify(body.new_pointer)):null;
+  if(!samePublicPointer(handoffPrior,priorPointer)||!samePublicPointer(handoffActive,activePointer)) throw new Error('rollback handoff pointer binding mismatch');
+  const state=path.resolve(stateRoot);
+  const launchers={
+    ps1:path.resolve(String(body.launchers?.ps1??'')),
+    cmd:path.resolve(String(body.launchers?.cmd??'')),
+    top:path.resolve(String(body.launchers?.top??TOP_LAUNCHER)),
+    launcher_sha256:String(body.launchers?.launcher_sha256??''),
+    ps1Bytes:Buffer.from(String(body.launchers?.ps1_bytes??''),'base64'),
+    cmdBytes:Buffer.from(String(body.launchers?.cmd_bytes??''),'base64'),
+    snapshots:{
+      ps1:decodeSnapshot(body.launchers?.snapshots?.ps1,'rollback.launcher.ps1'),
+      cmd:decodeSnapshot(body.launchers?.snapshots?.cmd,'rollback.launcher.cmd'),
+      top:decodeSnapshot(body.launchers?.snapshots?.top,'rollback.launcher.top')
+    },
+    installed:true
+  };
+  if(launchers.ps1!==path.resolve(launcherPath(state))||
+     launchers.cmd!==path.resolve(path.join(state,'bin','DEADBYTE-MCP.cmd'))||
+     launchers.top!==path.resolve(TOP_LAUNCHER)) throw new Error('rollback launcher paths are not canonical');
+  if(!HEX64.test(launchers.launcher_sha256)||sha256Bytes(launchers.ps1Bytes)!==launchers.launcher_sha256) throw new Error('rollback successor launcher bytes/hash mismatch');
+  if(launchers.launcher_sha256!==activePointer.launcher_sha256) throw new Error('rollback successor launcher hash does not match active pointer');
+  if(!launchers.snapshots.ps1.exists||launchers.snapshots.ps1.sha256!==priorPointer.launcher_sha256) throw new Error('rollback predecessor launcher snapshot does not match signed prior pointer');
+  return launchers;
+}
+async function restoreRollbackLaunchers(plan){
+  await restoreFile(plan.ps1,plan.snapshots.ps1);
+  await restoreFile(plan.cmd,plan.snapshots.cmd);
+  await restoreFile(plan.top,plan.snapshots.top);
+  if(await sha256File(plan.ps1)!==plan.snapshots.ps1.sha256) throw new Error('rollback predecessor launcher restore hash mismatch');
+  return plan;
+}
+const UPDATE_PHASE_RANK=Object.freeze({
+  initial:0,candidate_prepared:10,old_runtime_verified:20,shutdown_handoff_armed:25,supervisor_spawned:30,
+  authority_revoked:40,old_runtime_stopped:50,workspace_ready:60,launcher_installed:70,pointer_committed:80,
+  fresh_runtime_verified:90,authority_verified:100,completed:110,superseded:120,failed:1000,failed_receipted:1001,failed_unreceipted:1002,precondition_rejected:1003
+});
+function phaseRank(phase){ return UPDATE_PHASE_RANK[String(phase)]??-1; }
+function activeTransitionPhase(phase){
+  const rank=phaseRank(phase);
+  return rank>=phaseRank('shutdown_handoff_armed')&&rank<phaseRank('completed')&&rank<phaseRank('failed');
+}
+function samePublicPointer(a,b){
+  if(!a&&!b) return true;
+  if(!a||!b) return false;
+  return canonicalJson(publicPointer(a))===canonicalJson(publicPointer(b));
+}
+function statePointer(state,key){
+  if(!state?.[key]) return null;
+  return parseActivePointer(JSON.stringify(state[key]));
+}
+async function spawnDetachedSupervisor({script,handoffPath,cwd}){
+  const absoluteScript=path.resolve(script),absoluteHandoff=path.resolve(handoffPath);
+  const stat=await lstat(absoluteScript);
+  if(!stat.isFile()||stat.isSymbolicLink()) throw new Error('detached updater supervisor script must be a regular file');
+  const child=await new Promise((resolve,reject)=>{
+    const proc=spawn(process.execPath,[absoluteScript,'--resume-handoff',absoluteHandoff],{
+      cwd:path.resolve(cwd),detached:true,windowsHide:true,stdio:'ignore'
+    });
+    const onError=error=>reject(error);
+    proc.once('error',onError);
+    proc.once('spawn',()=>{
+      proc.removeListener('error',onError);
+      proc.unref();
+      resolve(proc);
+    });
+  });
+  if(!child.pid||child.pid<1) throw new Error('detached updater supervisor did not return a valid PID');
+  return {pid:child.pid,script_sha256:await sha256File(absoluteScript)};
+}
+async function acquireSupervisorLease(handoffPath){
+  const lockDir=path.resolve(handoffPath)+'.lock',lockFile=path.join(lockDir,'owner.json');
+  for(let attempt=0;attempt<2;attempt+=1){
+    try{
+      await mkdir(lockDir,{recursive:false});
+      await atomicBytes(lockFile,Buffer.from(JSON.stringify({pid:process.pid,handoff:path.resolve(handoffPath),started_at_utc:new Date().toISOString()})+'\n','utf8'));
+      return async()=>{ await rm(lockDir,{recursive:true,force:true}); };
+    }catch(error){
+      if(error?.code!=='EEXIST') throw error;
+      let owner=null; try{ owner=await readJson(lockFile); }catch{}
+      const ownerPid=Number(owner?.pid),needle=path.resolve(handoffPath).replaceAll('/','\\\\').toLowerCase();
+      const alive=Number.isInteger(ownerPid)&&ownerPid>0&&nodeProcesses().some(item=>
+        Number(item.ProcessId)===ownerPid&&String(item.CommandLine??'').replaceAll('/','\\\\').toLowerCase().includes(needle)
+      );
+      if(alive) throw new Error('slot update supervisor already active pid='+ownerPid);
+      await rm(lockDir,{recursive:true,force:true});
+    }
+  }
+  throw new Error('unable to acquire slot update supervisor lease');
+}
+export function parseResumeHandoffArgs(argv){
+  let handoff=null;
+  for(let index=0;index<argv.length;index+=1){
+    const arg=argv[index];
+    if(arg!=='--resume-handoff') throw new Error("unknown supervisor argument '"+arg+"'");
+    if(handoff!==null) throw new Error("duplicate supervisor argument '--resume-handoff'");
+    const value=argv[++index];
+    if(!value) throw new Error('--resume-handoff requires a value');
+    handoff=path.resolve(value);
+  }
+  if(!handoff) throw new Error('--resume-handoff is required');
+  return {handoff};
+}
+async function readHandoffEnvelope(handoffPath,stateRoot){
+  const envelope=await readJson(handoffPath),key=await loadUpdateKey(stateRoot);
+  if(!verifySlotUpdateEnvelope(envelope,key.publicKey)) throw new Error('slot-update handoff signature invalid');
+  if(envelope.body?.schema!==HANDOFF_SCHEMA) throw new Error('slot-update handoff schema invalid');
+  const body=envelope.body;
+  if(typeof body.update_id!=='string'||!HEX64.test(String(body.supervisor_script_sha256??''))||
+     !path.isAbsolute(String(body.supervisor_script??''))||!path.isAbsolute(String(body.state_path??''))) {
+    throw new Error('slot-update handoff identity invalid');
+  }
+  const actualSupervisorHash=await sha256File(path.resolve(body.supervisor_script));
+  if(actualSupervisorHash!==body.supervisor_script_sha256) throw new Error('slot-update handoff supervisor hash drift');
+  return {envelope,body,key};
+}
+async function writeHandoff({stateRoot,state,journal,statePath,evidenceDir,key,pointerInfo,newPointer,predecessor,priorStatus,workspace,launchers,stableMcpUrl,mcpUrlSnapshot,controlCtx}){
+  const supervisorScript=path.join(path.resolve(newPointer.release_root),'scripts','runtime-self-update.mjs');
+  const supervisorScriptSha256=await sha256File(supervisorScript);
+  const handoffPath=path.join(path.resolve(evidenceDir),'handoff.json');
+  const body={
+    schema:HANDOFF_SCHEMA,update_id:state.update_id,created_at_utc:new Date().toISOString(),
+    state_root:path.resolve(stateRoot),state_path:path.resolve(statePath),handoff_path:path.resolve(handoffPath),
+    supervisor_script:path.resolve(supervisorScript),supervisor_script_sha256:supervisorScriptSha256,
+    prior_pointer:publicPointer(pointerInfo.pointer),new_pointer:publicPointer(newPointer),predecessor_mode:predecessor.mode,
+    old_runtime:generationTuple(predecessor.runtime),
+    prior_authority:{
+      process_armed:priorStatus.process_armed,coding_armed:priorStatus.coding_armed,autonomous_armed:priorStatus.autonomous_armed,
+      desktop_armed:priorStatus.desktop_armed,host_armed:priorStatus.host_armed
+    },
+    pointer_snapshot:encodeSnapshot(pointerInfo.snapshot),
+    workspace:{source:workspace.source,target:workspace.target,mode:workspace.mode,moved:workspace.moved===true,created:workspace.created===true},
+    launchers:{
+      ps1:launchers.ps1,cmd:launchers.cmd,top:launchers.top,launcher_sha256:launchers.launcher_sha256,
+      ps1_bytes:Buffer.from(launchers.ps1Bytes).toString('base64'),cmd_bytes:Buffer.from(launchers.cmdBytes).toString('base64'),
+      snapshots:{
+        ps1:encodeSnapshot(launchers.snapshots.ps1),cmd:encodeSnapshot(launchers.snapshots.cmd),top:encodeSnapshot(launchers.snapshots.top)
+      }
+    },
+    stable_mcp_url:stableMcpUrl?{path:stableMcpUrl.path,sha256:stableMcpUrl.sha256,origin:stableMcpUrl.origin,changed:stableMcpUrl.changed===true}:null,
+    mcp_url_snapshot:stableMcpUrl?.changed?encodeSnapshot(mcpUrlSnapshot):null,
+    restore_standing_grants:state.restore_standing_grants===true
+  };
+  const receipt=await writeEnvelope(handoffPath,body,key);
+  await writeState(statePath,journal,'shutdown_handoff_armed',{
+    handoff_path:handoffPath,handoff_receipt_sha256:receipt.receipt_sha256,
+    supervisor_script:supervisorScript,supervisor_script_sha256:supervisorScriptSha256
+  });
+  return {path:handoffPath,body,receipt};
+}
+async function parseCurrentPointer(file){
+  if(!existsSync(file)) return null;
+  return parseActivePointer(await readFile(file,'utf8'));
+}
+async function ensurePointerCommitted(pointerFile,priorPointer,newPointer){
+  const current=await parseCurrentPointer(pointerFile);
+  if(samePublicPointer(current,newPointer)) return {committed:true,already:true};
+  if(!samePublicPointer(current,priorPointer)) throw new Error('active pointer changed unexpectedly before slot commit');
+  await atomicWriteActivePointer(pointerFile,newPointer);
+  const verify=await parseCurrentPointer(pointerFile);
+  if(!samePublicPointer(verify,newPointer)) throw new Error('active pointer commit readback mismatch');
+  return {committed:true,already:false};
+}
+async function coreGone(runtime){
+  return !runtime||!(await nodeProcesses()).some(item=>
+    Number(item.ProcessId)===Number(runtime.core.pid)&&String(item.CreationDate??'')===String(runtime.core.creation_date)
+  );
+}
+async function runtimeAlreadyOnline(ctx,oldRuntime){
+  const statusText=controllerCaptured(ctx,'status',15000),status=parseControllerStatus(statusText);
+  if(!status.online||!status.bridge_pid||!status.cloud_pid||!status.local_ready) return null;
+  const bridge=await readLedger(ctx,'bridge'),cloud=await readLedger(ctx,'cloud'),core=coreProcess(ctx.core_root,bridge);
+  if(oldRuntime?.bridge&&sameGeneration(oldRuntime.bridge,bridge)) throw new Error('fresh bridge generation gate failed');
+  if(oldRuntime?.cloud&&sameGeneration(oldRuntime.cloud,cloud)) throw new Error('fresh cloud generation gate failed');
+  if(oldRuntime?.core&&oldRuntime.core.pid===core.pid&&oldRuntime.core.creation_date===core.creation_date) {
+    throw new Error('fresh downstream core generation gate failed');
+  }
+  return {status,status_text:statusText.trim(),bridge,cloud,core};
+}
+async function ensureFreshRuntime(ctx,oldRuntime){
+  let existing=null;
+  try{ existing=await runtimeAlreadyOnline(ctx,oldRuntime); }
+  catch(error){ if(/generation gate/.test(String(error?.message??''))) throw error; }
+  return existing??await startAndVerify(ctx,oldRuntime);
+}
+async function ensureAuthorityRevoked(ctx,prior){
+  if(!prior.process_armed&&!prior.coding_armed&&!prior.autonomous_armed&&!prior.desktop_armed&&!prior.host_armed){
+    if(prior.online&&prior.bridge_pid&&prior.cloud_pid) return {revoked:false,status:prior};
+    if(existsSync(path.join(ctx.runtime_root,'bridge.instance.json'))&&existsSync(path.join(ctx.runtime_root,'cloud.instance.json'))){
+      try{
+        const bridge=await readLedger(ctx,'bridge'),cloud=await readLedger(ctx,'cloud');
+        return {revoked:false,status:{online:true,offline:false,bridge_pid:bridge.pid,cloud_pid:cloud.pid,local_ready:true,
+          process_armed:false,coding_armed:false,autonomous_armed:false,desktop_armed:false,host_armed:false}};
+      }catch{}
+    }
+    const clean=cleanOfflinePredecessor(ctx);
+    return {revoked:false,status:clean};
+  }
+  const status=parseControllerStatus(controllerCaptured(ctx,'status',15000));
+  if(status.host_armed) throw new Error('host plane armed during authority revoke recovery');
+  if(!status.process_armed&&!status.coding_armed&&!status.autonomous_armed&&!status.desktop_armed) {
+    return {revoked:prior.process_armed||prior.coding_armed||prior.autonomous_armed||prior.desktop_armed,status};
+  }
+  return revokeAuthority(ctx,status);
+}
+function handoffPriorPointer(body){
+  return body.prior_pointer?parseActivePointer(JSON.stringify(body.prior_pointer)):null;
+}
+function handoffNewPointer(body){
+  return body.new_pointer?parseActivePointer(JSON.stringify(body.new_pointer)):null;
+}
+async function verifyCompletedUpdateReceipt(body,state,statePath,key){
+  const candidate=handoffNewPointer(body),prior=handoffPriorPointer(body);
+  if(!candidate||!samePublicPointer(candidate,statePointer(state,'new_pointer'))||!samePublicPointer(prior,statePointer(state,'prior_pointer'))) throw new Error('completed update handoff pointer binding mismatch');
+  if(state.expected_version!==candidate.version||state.expected_manifest_sha256!==candidate.manifest_sha256) throw new Error('completed update journal subject mismatch');
+  const expectedPath=path.join(path.dirname(statePath),'receipt.json');
+  if(typeof state.receipt_path!=='string'||!path.isAbsolute(state.receipt_path)||path.resolve(state.receipt_path)!==expectedPath||!HEX64.test(String(state.receipt_sha256??''))) throw new Error('completed update receipt reference invalid');
+  const info=await lstat(expectedPath);
+  if(!info.isFile()||info.isSymbolicLink()) throw new Error('completed update receipt must be a regular file');
+  const receipt=await readJson(expectedPath);
+  if(!verifySlotUpdateEnvelope(receipt,key.publicKey)||receipt.receipt_sha256!==state.receipt_sha256) throw new Error('completed update receipt signature or digest mismatch');
+  const subject=receipt.body;
+  if(subject.schema!==UPDATE_SCHEMA||subject.rollback_performed!==false||subject.update_id!==body.update_id||subject.release_version!==candidate.version||subject.candidate_manifest_sha256!==candidate.manifest_sha256||
+     !samePublicPointer(statePointer(subject,'active_pointer'),candidate)||!samePublicPointer(statePointer(subject,'prior_pointer'),prior)||
+     subject.release_slot?.release_id!==candidate.release_id||subject.release_slot?.release_root!==candidate.release_root||subject.release_slot?.manifest_sha256!==candidate.manifest_sha256||
+     subject.generation?.generation_root!==candidate.generation_root||subject.generation?.generation_manifest_sha256!==candidate.generation_manifest_sha256||subject.launcher?.sha256!==candidate.launcher_sha256) throw new Error('completed update receipt subject binding mismatch');
+  return {receipt_path:expectedPath,receipt_sha256:receipt.receipt_sha256};
+}
+async function resumeSlotUpdate({handoffPath}){
+  const absoluteHandoff=path.resolve(handoffPath),probe=await readJson(absoluteHandoff);
+  const stateRoot=path.resolve(String(probe?.body?.state_root??path.dirname(path.dirname(path.dirname(path.dirname(absoluteHandoff))))));
+  const {body,key}=await readHandoffEnvelope(absoluteHandoff,stateRoot);
+  const statePath=path.resolve(body.state_path),releaseState=await readJson(statePath);
+  if(releaseState.schema!=='deadbyte.r27-slot-update-state.v1'||releaseState.update_id!==body.update_id) throw new Error('handoff state binding mismatch');
+  let phase=String(releaseState.phase??'');
+  if(phase==='completed'){
+    const verifiedReceipt=await verifyCompletedUpdateReceipt(body,releaseState,statePath,key);
+    return {ok:true,resumed:false,completed:true,update_id:body.update_id,state_path:statePath,
+      ...verifiedReceipt,historical_receipt_verified:true,current_runtime_verified:false};
+  }
+  if(phase.startsWith('failed')) throw new Error('slot update already failed at phase='+phase);
+  const priorPointer=handoffPriorPointer(body),candidatePointer=handoffNewPointer(body);
+  const statePrior=statePointer(releaseState,'prior_pointer'),stateCandidate=statePointer(releaseState,'new_pointer');
+  if(!samePublicPointer(priorPointer,statePrior)||!samePublicPointer(candidatePointer,stateCandidate)) throw new Error('handoff pointer binding mismatch');
+  if(!candidatePointer) throw new Error('handoff candidate pointer missing');
+  const pointerFile=path.join(stateRoot,'active-release.json'),currentPointer=await parseCurrentPointer(pointerFile);
+  if(!samePublicPointer(currentPointer,priorPointer)&&!samePublicPointer(currentPointer,candidatePointer)) throw new Error('active pointer is neither handoff predecessor nor candidate');
+  const pointerInfo={file:pointerFile,pointer:currentPointer,snapshot:decodeSnapshot(body.pointer_snapshot,'active pointer')};
+  const ctx=slotContext(stateRoot,priorPointer),newCtx=slotContext(stateRoot,candidatePointer);
+  const priorStatus={
+    process_armed:body.prior_authority?.process_armed===true,coding_armed:body.prior_authority?.coding_armed===true,
+    autonomous_armed:body.prior_authority?.autonomous_armed===true,desktop_armed:body.prior_authority?.desktop_armed===true,
+    host_armed:body.prior_authority?.host_armed===true
+  };
+  if(priorStatus.autonomous_armed&&!priorStatus.coding_armed) throw new Error('invalid prior authority in handoff');
+  const oldRuntime=body.old_runtime?{bridge:body.old_runtime.bridge??null,cloud:body.old_runtime.cloud??null,core:body.old_runtime.core??null}:null;
+  if(oldRuntime?.core&&(!Number.isInteger(Number(oldRuntime.core.pid))||String(oldRuntime.core.creation_date??'').length<1)) throw new Error('handoff old runtime core identity invalid');
+  const launchers={
+    ps1:path.resolve(String(body.launchers?.ps1??'')),cmd:path.resolve(String(body.launchers?.cmd??'')),top:path.resolve(String(body.launchers?.top??TOP_LAUNCHER)),
+    launcher_sha256:String(body.launchers?.launcher_sha256??''),
+    ps1Bytes:Buffer.from(String(body.launchers?.ps1_bytes??''),'base64'),cmdBytes:Buffer.from(String(body.launchers?.cmd_bytes??''),'base64'),
+    snapshots:{
+      ps1:decodeSnapshot(body.launchers?.snapshots?.ps1,'launcher.ps1'),cmd:decodeSnapshot(body.launchers?.snapshots?.cmd,'launcher.cmd'),top:decodeSnapshot(body.launchers?.snapshots?.top,'launcher.top')
+    },
+    installed:phaseRank(phase)>=phaseRank('launcher_installed')
+  };
+  if(!HEX64.test(launchers.launcher_sha256)||sha256Bytes(launchers.ps1Bytes)!==launchers.launcher_sha256) throw new Error('handoff launcher bytes/hash mismatch');
+  const workspace={
+    source:path.resolve(String(body.workspace?.source??releaseState.workspace?.source??'')),
+    target:path.resolve(String(body.workspace?.target??releaseState.workspace?.target??'')),
+    mode:String(body.workspace?.mode??releaseState.workspace?.mode??''),
+    moved:releaseState.workspace?.moved===true,created:releaseState.workspace?.created===true
+  };
+  if(!['existing','target-existing','create','rename'].includes(workspace.mode)) throw new Error('handoff workspace mode invalid');
+  const stableMcpUrl=body.stable_mcp_url?{...body.stable_mcp_url}:releaseState.stable_mcp_url?{...releaseState.stable_mcp_url}:null;
+  const mcpUrlSnapshot=body.mcp_url_snapshot?decodeSnapshot(body.mcp_url_snapshot,'MCP URL'):{exists:false,bytes:null,sha256:null};
+  const cleanup=await acquireSupervisorLease(absoluteHandoff);
+  const journal=releaseState;
+  let pointerCommitted=phaseRank(phase)>=phaseRank('pointer_committed')||samePublicPointer(currentPointer,candidatePointer);
+  let stopped=phaseRank(phase)>=phaseRank('old_runtime_stopped');
+  try{
+    if(phaseRank(phase)<phaseRank('supervisor_spawned')){
+      await writeState(statePath,journal,'supervisor_spawned',{supervisor_pid:process.pid,supervisor_script:body.supervisor_script,supervisor_script_sha256:body.supervisor_script_sha256});
+      phase='supervisor_spawned';
+    }
+    let revoked=phaseRank(phase)>=phaseRank('authority_revoked')||journal.revoked_before_switch===true;
+    let newRuntime=null,stabilization=null;
+
+    if(phaseRank(phase)<phaseRank('authority_revoked')){
+      const revoke=await ensureAuthorityRevoked(ctx,priorStatus);
+      revoked=revoke.revoked;
+      await writeState(statePath,journal,'authority_revoked',{revoked_before_switch:revoked});
+      phase='authority_revoked';
+    }
+    if(!stopped){
+      if(!oldRuntime){
+        cleanOfflinePredecessor(ctx);
+        await writeState(statePath,journal,'old_runtime_stopped',{stop_output:'recovery observed predecessor has no captured runtime and clean offline evidence'});
+      }else{
+        const status=parseControllerStatus(controllerCaptured(ctx,'status',15000)),gone=await coreGone(oldRuntime);
+        if(status.offline&&gone){
+          await writeState(statePath,journal,'old_runtime_stopped',{stop_output:'recovery observed predecessor already OFFLINE'});
+        }else{
+          const stoppedResult=await stopAndVerify(ctx,oldRuntime);
+          await writeState(statePath,journal,'old_runtime_stopped',{stop_output:stoppedResult.output});
+        }
+      }
+      stopped=true; phase='old_runtime_stopped';
+    }
+    if(phaseRank(phase)<phaseRank('workspace_ready')){
+      await applyWorkspacePlan(workspace);
+      await writeState(statePath,journal,'workspace_ready',{workspace:{source:workspace.source,target:workspace.target,mode:workspace.mode,moved:workspace.moved===true,created:workspace.created===true}});
+      phase='workspace_ready';
+    }else{
+      workspace.moved=journal.workspace?.moved===true; workspace.created=journal.workspace?.created===true;
+    }
+    if(phaseRank(phase)<phaseRank('launcher_installed')){
+      await installLaunchers(launchers);
+      await writeState(statePath,journal,'launcher_installed',{launcher_sha256:launchers.launcher_sha256,launcher_path:launchers.ps1,top_launcher:launchers.top});
+      phase='launcher_installed';
+    }
+    if(!pointerCommitted){
+      await ensurePointerCommitted(pointerFile,priorPointer,candidatePointer);
+      pointerCommitted=true;
+      await writeState(statePath,journal,'pointer_committed',{active_pointer:publicPointer(candidatePointer)});
+      phase='pointer_committed';
+    }
+    await verifyActiveInstallation(stateRoot,candidatePointer);
+    newRuntime=await ensureFreshRuntime(newCtx,oldRuntime);
+    stabilization=await stabilizeRuntime(newCtx,newRuntime);
+    await writeState(statePath,journal,'fresh_runtime_verified',{new_runtime:generationTuple(newRuntime),stabilization});
+    phase='fresh_runtime_verified';
+
+    const finalAuthority=await restoreStandingAuthority(newCtx,priorStatus,journal.restore_standing_grants===true);
+    await writeState(statePath,journal,'authority_verified',{final_authority:{
+      process_armed:finalAuthority.process_armed,coding_armed:finalAuthority.coding_armed,autonomous_armed:finalAuthority.autonomous_armed,
+      desktop_armed:finalAuthority.desktop_armed,host_armed:finalAuthority.host_armed
+    }});
+    phase='authority_verified';
+
+    const bodyReceipt={
+      schema:UPDATE_SCHEMA,update_id:body.update_id,release_version:journal.expected_version,candidate_manifest_sha256:journal.expected_manifest_sha256,
+      completed_at_utc:new Date().toISOString(),activation_boundary:'active-release-pointer',
+      mechanism:'immutable-release-slot-plus-atomic-pointer-rename-plus-detached-supervisor-handoff',
+      predecessor_mode:journal.predecessor_mode??body.predecessor_mode,prior_pointer:publicPointer(priorPointer),active_pointer:publicPointer(candidatePointer),
+      release_slot:journal.release_slot,generation:journal.generation,
+      launcher:{path:launchers.ps1,sha256:launchers.launcher_sha256,top_path:launchers.top},
+      workspace:{root:workspace.target,migrated:workspace.moved===true},development_root:journal.development_root,
+      host_repin:journal.host_repin??{requested:false,repinned:false},coding_repin:journal.coding_repin??{requested:false,repinned:false},
+      old_runtime:journal.old_runtime??body.old_runtime,new_runtime:generationTuple(newRuntime),stabilization,
+      authority:{
+        prior:priorStatus,revoked_before_switch:revoked,restore_requested:journal.restore_standing_grants===true,desktop_restore_policy:'explicit-rearm-required',
+        final:{
+          process_armed:finalAuthority.process_armed,coding_armed:finalAuthority.coding_armed,autonomous_armed:finalAuthority.autonomous_armed,
+          desktop_armed:finalAuthority.desktop_armed,host_armed:finalAuthority.host_armed
+        }
+      },
+      rollback_performed:false
+    };
+    const receiptPath=path.join(path.dirname(statePath),'receipt.json'),receipt=await writeEnvelope(receiptPath,bodyReceipt,key);
+    await writeState(statePath,journal,'completed',{receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256});
+    return {ok:true,resumed:true,completed:true,update_id:body.update_id,state_path:statePath,receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256,
+      pointer:candidatePointer,new_runtime:newRuntime,final_authority:finalAuthority,workspace_root:workspace.target};
+  }catch(error){
+    let controllerStartFailure=null,controllerStartFailurePreservationError=null;
+    if(pointerCommitted){
+      try{
+        controllerStartFailure=await preserveControllerStartFailure(newCtx,path.dirname(statePath));
+        const claimed=/evidence_sha256=([0-9a-f]{64})/.exec(String(error?.message??error));
+        if(claimed&&(!controllerStartFailure||controllerStartFailure.sha256!==claimed[1])){
+          controllerStartFailurePreservationError='controller start failure evidence claim mismatch expected='+claimed[1]+' preserved='+(controllerStartFailure?.sha256??'missing');
+        }
+      }catch(preserveError){ controllerStartFailurePreservationError=String(preserveError?.message??preserveError); }
+    }
+    const rollback={attempted:false,new_runtime_stopped:false,pointer_restored:false,launchers_restored:false,workspace_restored:false,mcp_url_restored:false,old_runtime_restarted:false,authority_restored:false,errors:[]};
+    try{
+      if(pointerCommitted){
+        rollback.attempted=true;
+        try{ controllerCaptured(newCtx,'stop',30000); rollback.new_runtime_stopped=true; }catch(stopError){ rollback.errors.push('stop-new:'+stopError.message); }
+      }
+      const currentAfter=await parseCurrentPointer(pointerFile);
+      if(samePublicPointer(currentAfter,candidatePointer)){
+        try{ await restoreFile(pointerFile,pointerInfo.snapshot); rollback.pointer_restored=true; }catch(pointerError){ rollback.errors.push('pointer:'+pointerError.message); }
+      }
+      if(stableMcpUrl?.changed&&mcpUrlSnapshot){
+        try{ await restoreFile(stableMcpUrl.path,mcpUrlSnapshot); rollback.mcp_url_restored=true; }catch(mcpUrlError){ rollback.errors.push('mcp-url:'+mcpUrlError.message); }
+      }
+      if(phaseRank(journal.phase)>=phaseRank('launcher_installed')||launchers.installed){
+        try{ await rollbackLaunchers({...launchers,installed:true}); rollback.launchers_restored=true; }catch(launcherError){ rollback.errors.push('launcher:'+launcherError.message); }
+      }
+      if(phaseRank(journal.phase)>=phaseRank('workspace_ready')||workspace.moved||workspace.created){
+        try{ rollback.workspace_restored=await rollbackWorkspacePlan(workspace); }catch(workspaceError){ rollback.errors.push('workspace:'+workspaceError.message); }
+      }
+      if(stopped&&oldRuntime&&rollback.pointer_restored){
+        try{ await startAndVerify(ctx,oldRuntime); rollback.old_runtime_restarted=true; }catch(startError){ rollback.errors.push('restart-old:'+startError.message); }
+      }
+      if((!stopped||rollback.old_runtime_restarted)&&journal.restore_standing_grants===true){
+        try{ await restoreStandingAuthority(ctx,priorStatus,true); rollback.authority_restored=true; }catch(authorityError){ rollback.errors.push('restore-authority:'+authorityError.message); }
+      }
+    }catch(rollbackError){ rollback.errors.push('rollback:'+rollbackError.message); }
+    const failure={
+      schema:FAILURE_SCHEMA,update_id:body.update_id,release_version:journal.expected_version,candidate_manifest_sha256:journal.expected_manifest_sha256,
+      failed_at_utc:new Date().toISOString(),phase:journal.phase??phase,error:{name:error?.name??'Error',code:error?.code??null,message:String(error?.message??error)},
+      controller_start_failure:controllerStartFailure,controller_start_failure_preservation_error:controllerStartFailurePreservationError,
+      predecessor_mode:journal.predecessor_mode??body.predecessor_mode,prior_pointer:publicPointer(priorPointer),attempted_pointer:publicPointer(candidatePointer),
+      old_runtime:journal.old_runtime??body.old_runtime,rollback
+    };
+    await writeState(statePath,journal,'failed',{failure,rollback}).catch(()=>{});
+    let failureReceipt=null;
+    try{
+      const failurePath=path.join(path.dirname(statePath),'failure-receipt.json');
+      failureReceipt=await writeEnvelope(failurePath,failure,key);
+      await writeState(statePath,journal,'failed_receipted',{failure_receipt_path:failurePath,failure_receipt_sha256:failureReceipt.receipt_sha256});
+    }catch(receiptError){
+      rollback.errors.push('failure-receipt:'+receiptError.message);
+      await writeState(statePath,journal,'failed_unreceipted',{rollback}).catch(()=>{});
+    }
+    const wrapped=new Error('R27 slot update failed in detached supervisor: '+(error?.message??error));
+    wrapped.cause=error; wrapped.statePath=statePath; wrapped.failureReceiptPath=failureReceipt?path.join(path.dirname(statePath),'failure-receipt.json'):null; throw wrapped;
+  }finally{
+    await cleanup();
+  }
+}
+export async function recoverInterruptedSlotUpdates({stateRoot=DEFAULT_STATE_ROOT}={}){
+  stateRoot=resolveStateRoot(stateRoot);
+  const evidenceRoot=path.join(path.resolve(stateRoot),'evidence','updates');
+  if(!existsSync(evidenceRoot)) return {ok:true,launched:0,updates:[]};
+  const entries=await readdir(evidenceRoot,{withFileTypes:true});
+  const pointerPath=path.join(path.resolve(stateRoot),'active-release.json');
+  const activePointer=existsSync(pointerPath)?await parseCurrentPointer(pointerPath):null;
+  let launched=0;const updates=[];
+  for(const entry of entries){
+    if(!entry.isDirectory()) continue;
+    const statePath=path.join(evidenceRoot,entry.name,'state.json');
+    if(!existsSync(statePath)) continue;
+    let state;try{ state=await readJson(statePath); }catch{ continue; }
+    if(!activeTransitionPhase(state?.phase)) continue;
+    if(state?.failure || existsSync(path.join(path.dirname(statePath),'failure-receipt.json'))) continue;
+    const pendingPointer=statePointer(state,'new_pointer');
+    if(activePointer&&pendingPointer&&samePublicPointer(activePointer,pendingPointer)){
+      await writeState(statePath,state,'superseded',{superseded_at_utc:new Date().toISOString(),superseded_by_pointer:publicPointer(activePointer)});
+      continue;
+    }
+    const handoffPath=String(state?.handoff_path??'');
+    if(!handoffPath||!path.isAbsolute(handoffPath)||!existsSync(handoffPath)) continue;
+    const handoff=await readJson(handoffPath);
+    if(handoff?.body?.schema!==HANDOFF_SCHEMA) continue;
+    const script=path.resolve(String(handoff.body.supervisor_script??''));
+    if(await sha256File(script)!==handoff.body.supervisor_script_sha256) throw new Error('interrupted update supervisor hash drift: '+state.update_id);
+    const result=await spawnDetachedSupervisor({script,handoffPath,cwd:path.dirname(script)});
+    launched+=1;updates.push({update_id:state.update_id,state_path:statePath,handoff_path:handoffPath,supervisor_pid:result.pid});
+    await atomicBytes(path.join(path.dirname(statePath),'recovery-launch.json'),Buffer.from(JSON.stringify({update_id:state.update_id,launched_at_utc:new Date().toISOString(),supervisor_pid:result.pid})+'\n','utf8'));
+  }
+  return {ok:true,launched,updates};
+}
+
+export async function performSlotUpdate({stage,developmentRoot,expectedVersion,expectedManifest,sourceRoot=null,stateRoot=DEFAULT_STATE_ROOT,restoreStandingGrants=false,recoverOfflinePredecessor=false,cloudTransport=null,bridgeBootstrap=null,processPolicyBootstrap=null,hostPolicyBootstrap=null,codingPolicyBootstrap=null,autonomousPolicyBootstrap=null,ownerApprovalBootstrap=null,desktopPolicyBootstrap=null,semanticLspBootstrap=null,enableMachineFs=false,enableObservation=false,enableDesktop=false,enableAutonomousSupervisor=false,hostCommandPins=[]}){
+  // R64 grants have no signed revocation epoch. The historical boolean restore
+  // cannot prove continuity, and must never materialize a successor grant.
+  if(restoreStandingGrants)throw new Error('R65 standing grant auto-restore disabled: explicit reauthorization required');
+  if(Boolean(autonomousPolicyBootstrap)!==Boolean(ownerApprovalBootstrap)) throw new Error('autonomous policy bootstrap requires pinned owner approval');
+  stateRoot=resolveStateRoot(stateRoot);
+  if(process.platform!=='win32') throw new Error('R27 slot update is Windows-only');
+  const state=path.resolve(stateRoot),stageRoot=path.resolve(stage),development=assertDevelopmentRootSafe(developmentRoot,state);
+  const key=await loadUpdateKey(state),updateId='r27-'+expectedManifest.slice(0,16)+'-'+Date.now().toString(36)+'-'+randomBytes(4).toString('hex');
+  const evidenceDir=path.join(state,'evidence','updates',updateId),statePath=path.join(evidenceDir,'state.json'),failurePath=path.join(evidenceDir,'failure-receipt.json');
+  await mkdir(evidenceDir,{recursive:true});
+  const journal={schema:'deadbyte.r27-slot-update-state.v1',update_id:updateId,stage_root:stageRoot,development_root:development,
+    source_root:sourceRoot?path.resolve(sourceRoot):null,expected_version:expectedVersion,expected_manifest_sha256:expectedManifest,
+    restore_standing_grants:restoreStandingGrants,recover_offline_predecessor:recoverOfflinePredecessor,created_at_utc:new Date().toISOString()};
+  await writeState(statePath,journal,'initial');
+  let pointerInfo=null,control=null,predecessor=null,oldRuntime=null,priorStatus=null,authorityPreparation=null,workspace=null,launchers=null,newPointer=null;
+  let stableMcpUrl=null,mcpUrlSnapshot=null;
+  let mutationBegan=false;
+  try{
+    pointerInfo=await loadPointerIfPresent(state);
+    const stageVerified=await verifyPackageRoot(stageRoot,expectedVersion,expectedManifest,'stage');
+    const developmentVerified=await verifyPackageRoot(development,expectedVersion,expectedManifest,'development');
+    control=await loadControlInputs({stateRoot:state,sourceRoot,pointerInfo,bridgeBootstrap});
+    const codingBootstrap=await prepareCodingPolicyBootstrap(codingPolicyBootstrap);
+    const autonomousBootstrap=await prepareAutonomousPolicyBootstrap(autonomousPolicyBootstrap);
+    let ownerApprovalProof=null;
+    if(autonomousBootstrap){
+      if(hostCommandPins.length>0) throw new Error('autonomous bootstrap cannot combine with command repinning');
+      const selectedCoding=codingBootstrap?.policy??control.codingPolicy;
+      const selectedCodingSha256=codingBootstrap?.sha256??await sha256File(control.config.CodingPolicyFile);
+      ownerApprovalProof=await verifyAutonomousOwnerBootstrap({
+        stateRoot:state,bootstrap:ownerApprovalBootstrap,autonomousPolicy:autonomousBootstrap.policy,
+        codingPolicy:selectedCoding,codingPolicySha256:selectedCodingSha256,
+        autonomousPolicySha256:autonomousBootstrap.sha256,expectedManifest
+      });
+    }
+    // Read-only predecessor authority and process identity must be safe before
+    // materializing a slot or changing any stable runtime file.
+    await capturePredecessor(control.ctx,recoverOfflinePredecessor,{allowHostDisarm:false});
+    mutationBegan=true;
+    const slot=await materializeReleaseSlot({source:stageRoot,stateRoot:state,version:expectedVersion,manifestSha256:expectedManifest});
+    const hostBootstrap=await prepareHostPolicyBootstrap(hostPolicyBootstrap);if(hostBootstrap) control.hostPolicy=hostBootstrap.policy;
+    if(codingBootstrap) control.codingPolicy=codingBootstrap.policy;
+    if(autonomousBootstrap) control.autonomousPolicy=autonomousBootstrap.policy;
+    const processBootstrap=await prepareProcessPolicyBootstrap(processPolicyBootstrap);
+    if(processBootstrap){ control.processPolicy=processBootstrap.policy;control.config.ProcessRuntimeEnabled=true; }
+    const desktopBootstrap=await prepareDesktopPolicyBootstrap(desktopPolicyBootstrap);if(desktopBootstrap) control.desktopPolicy=desktopBootstrap.policy;
+    const semanticBootstrap=await prepareSemanticLspConfigBootstrap(semanticLspBootstrap);
+    if(semanticBootstrap){ control.config.SemanticLspConfigFile=semanticBootstrap.path;control.config.SemanticLspConfigSha256=semanticBootstrap.sha256; }
+    if(enableMachineFs){
+      if(control.config.CodingRuntimeEnabled!==true) throw new Error('MachineFsRuntimeEnabled requires CodingRuntimeEnabled');
+      control.config.MachineFsRuntimeEnabled=true;
+    }
+    if(enableObservation){
+      if(control.config.MachineRuntimeEnabled===false) throw new Error('ObservationRuntimeEnabled requires MachineRuntimeEnabled');
+      if(control.config.CodingRuntimeEnabled!==true) throw new Error('ObservationRuntimeEnabled requires CodingRuntimeEnabled');
+      control.config.ObservationRuntimeEnabled=true;
+    }
+    if(enableDesktop){
+      if(!control.desktopPolicy) throw new Error('DesktopRuntimeEnabled requires pinned desktop policy bootstrap or existing policy');
+      control.config.DesktopRuntimeEnabled=true;
+    }
+    control.config=await prepareReleaseBridgeSpec(control.config,bridgeBootstrap,slot.release_root);
+    control.config=await prepareNamedTunnelCloudSpec(control.config,{releaseRoot:slot.release_root,bootstrap:cloudTransport});
+    control.config=await prepareAutonomousSupervisorSpec(control.config,{releaseRoot:slot.release_root,enable:enableAutonomousSupervisor});
+    authorityPreparation=await prepareAuthorityPolicies({hostPolicy:control.hostPolicy,codingPolicy:control.codingPolicy},{commandPins:hostCommandPins});
+    control.hostPolicy=authorityPreparation.hostPolicy;control.codingPolicy=authorityPreparation.codingPolicy;
+    const stableMcp=await ensureStableMcpPath({stateRoot:state,sourceRoot:pointerInfo.pointer?null:sourceRoot});
+    control.config.McpPathFile=stableMcp.path;
+    if(cloudTransport?.publicOrigin){
+      const mcpUrlFile=path.join(state,'bridge','mcp-url.txt');mcpUrlSnapshot=await snapshotFile(mcpUrlFile);
+      stableMcpUrl=await ensureStableMcpUrl({stateRoot:state,publicOrigin:cloudTransport.publicOrigin,mcpPathFile:stableMcp.path});
+      control.config.McpUrlFile=stableMcpUrl.path;control.config.McpUrlFileSha256=stableMcpUrl.sha256;
+    }else if(control.config.Cloud?.Transport==='deadbyte.named-tunnel.v2'){
+      if(typeof control.config.McpUrlFile!=='string'||!path.isAbsolute(control.config.McpUrlFile)||!HEX64.test(String(control.config.McpUrlFileSha256??''))) throw new Error('existing named tunnel v2 requires pinned McpUrlFile before update');
+      const pinned=await verifyPinnedRegularFile(control.config.McpUrlFile,control.config.McpUrlFileSha256,'existing named tunnel MCP URL file');
+      control.config.McpUrlFile=pinned.path;control.config.McpUrlFileSha256=pinned.sha256;
+    }
+    workspace=await workspacePlan(control.workspaceRoot,state);launchers=await launcherPlan(state);
+    const generation=await createGenerationBundle({stateRoot:state,releaseRoot:slot.release_root,developmentRoot:development,workspaceRoot:workspace.target,releaseId:slot.release_id,currentConfig:control.config,codingPolicy:control.codingPolicy,autonomousPolicy:control.autonomousPolicy,hostPolicy:control.hostPolicy,processPolicy:control.processPolicy,desktopPolicy:control.desktopPolicy});
+    newPointer={schema:'deadbyte.active-release.v1',release_id:slot.release_id,version:expectedVersion,manifest_sha256:expectedManifest,release_root:slot.release_root,generation_root:generation.generation_root,generation_manifest_sha256:generation.generation_manifest_sha256,launcher_sha256:launchers.launcher_sha256,config_path:generation.config_path};
+    parseActivePointer(JSON.stringify(newPointer));
+    await writeState(statePath,journal,'candidate_prepared',{prior_pointer:publicPointer(pointerInfo.pointer),stage:stageVerified,development:developmentVerified,
+      release_slot:slot,generation:{generation_id:generation.generation_id,generation_root:generation.generation_root,generation_manifest_sha256:generation.generation_manifest_sha256,files:generation.files},
+      workspace:{source:workspace.source,target:workspace.target,mode:workspace.mode},stable_mcp_path:{path:stableMcp.path,sha256:stableMcp.sha256},
+      stable_mcp_url:stableMcpUrl?{path:stableMcpUrl.path,sha256:stableMcpUrl.sha256,origin:stableMcpUrl.origin,changed:stableMcpUrl.changed}:null,
+      bridge:{working_directory:control.config.Bridge.WorkingDirectory,script_path:control.config.Bridge.ScriptPath,script_sha256:control.config.Bridge.ScriptSha256},
+      host_repin:{requested:hostCommandPins.length>0,repinned:authorityPreparation.hostRepinned},coding_repin:{requested:hostCommandPins.length>0,repinned:authorityPreparation.codingRepinned},
+      owner_approval:ownerApprovalProof?{subject_sha256:ownerApprovalProof.subject_sha256,owner_key_id:ownerApprovalProof.owner_key_id,
+        root_id:ownerApprovalProof.root_id,scope:ownerApprovalProof.scope,expires_at_utc:ownerApprovalProof.expires_at_utc}:null,
+      new_pointer:publicPointer(newPointer)});
+    predecessor=await capturePredecessor(control.ctx,recoverOfflinePredecessor,{allowHostDisarm:false});oldRuntime=predecessor.runtime;priorStatus=predecessor.status;
+    await writeState(statePath,journal,'old_runtime_verified',{predecessor_mode:predecessor.mode,old_runtime:generationTuple(oldRuntime),
+      prior_authority:{process_armed:priorStatus.process_armed,coding_armed:priorStatus.coding_armed,autonomous_armed:priorStatus.autonomous_armed,desktop_armed:priorStatus.desktop_armed,host_armed:priorStatus.host_armed}});
+    const handoff=await writeHandoff({stateRoot:state,state:journal,journal,statePath,evidenceDir,key,pointerInfo,newPointer,predecessor,priorStatus,workspace,launchers,stableMcpUrl,mcpUrlSnapshot,controlCtx:control.ctx});
+    const supervisor=await spawnDetachedSupervisor({script:handoff.body.supervisor_script,handoffPath:handoff.path,cwd:control.ctx.core_root});
+    return {ok:true,handed_off:true,completed:false,update_id:updateId,state_path:statePath,handoff_path:handoff.path,handoff_receipt_sha256:handoff.receipt.receipt_sha256,supervisor_pid:supervisor.pid,pointer:newPointer};
+  }catch(error){
+    const failure={schema:FAILURE_SCHEMA,update_id:updateId,release_version:expectedVersion,candidate_manifest_sha256:expectedManifest,failed_at_utc:new Date().toISOString(),
+      result:mutationBegan?'MUTATION_OUTCOME_REQUIRES_RECONCILIATION':'PRECONDITION_REJECTED',
+      phase:journal.phase??'unknown',error:{name:error?.name??'Error',code:error?.code??null,message:String(error?.message??error)},
+      predecessor_mode:predecessor?.mode??null,prior_pointer:publicPointer(pointerInfo?.pointer??null),attempted_pointer:publicPointer(newPointer),old_runtime:generationTuple(oldRuntime),
+      rollback:{attempted:false,new_runtime_stopped:false,pointer_restored:false,launchers_restored:false,workspace_restored:false,mcp_url_restored:false,old_runtime_restarted:false,authority_restored:false,errors:[]}};
+    await writeState(statePath,journal,'failed',{failure}).catch(()=>{});
+    let failureReceipt=null;
+    try{ failureReceipt=await writeEnvelope(failurePath,failure,key);await writeState(statePath,journal,mutationBegan?'failed_receipted':'precondition_rejected',{failure_receipt_path:failurePath,failure_receipt_sha256:failureReceipt.receipt_sha256});}
+    catch(receiptError){ await writeState(statePath,journal,'failed_unreceipted',{failure_receipt_error:String(receiptError?.message??receiptError)}).catch(()=>{}); }
+    const wrapped=new Error('R27 slot update handoff failed: '+(error?.message??error));wrapped.cause=error;wrapped.statePath=statePath;wrapped.failureReceiptPath=failureReceipt?failurePath:null;throw wrapped;
+  }
+}
+
+export async function performSlotRollback({activationReceipt,stateRoot=DEFAULT_STATE_ROOT}){
+  stateRoot=resolveStateRoot(stateRoot);
+  if(process.platform!=='win32') throw new Error('R31 slot rollback is Windows-only');
+  const state=path.resolve(stateRoot),receiptFile=path.resolve(activationReceipt);
+  const key=await loadUpdateKey(state);
+  const activationEnvelope=await readJson(receiptFile);
+  if(!verifySlotUpdateEnvelope(activationEnvelope,key.publicKey)) throw new Error('activation receipt signature invalid');
+  if(activationEnvelope.body?.schema!==UPDATE_SCHEMA||activationEnvelope.body?.rollback_performed!==false) throw new Error('activation receipt is not one successful slot activation');
+  const priorPointer=parseActivePointer(JSON.stringify(activationEnvelope.body.prior_pointer));
+  const activePointer=parseActivePointer(JSON.stringify(activationEnvelope.body.active_pointer));
+  const pointerInfo=await loadPointerIfPresent(state);
+  if(!pointerInfo.pointer||canonicalJson(publicPointer(pointerInfo.pointer))!==canonicalJson(publicPointer(activePointer))) throw new Error('rollback current pointer does not match signed activation pointer');
+
+  const handoffPath=path.join(path.dirname(receiptFile),'handoff.json');
+  const {body:handoffBody}=await readHandoffEnvelope(handoffPath,state);
+  if(handoffBody.update_id!==activationEnvelope.body.update_id) throw new Error('rollback handoff update identity mismatch');
+  const rollbackLaunchers=rollbackLauncherPlanFromHandoff(handoffBody,priorPointer,activePointer,state);
+  await verifyStoredInstallation(state,priorPointer);
+
+  const currentCtx=slotContext(state,pointerInfo.pointer),currentRuntime=await captureRuntime(currentCtx);
+  const revoked=await revokeAuthority(currentCtx,currentRuntime.status);
+  const rollbackId=`r31-rollback-${activationEnvelope.receipt_sha256.slice(0,16)}-${Date.now().toString(36)}-${randomBytes(4).toString('hex')}`;
+  const evidenceDir=path.join(state,'evidence','updates',rollbackId),statePath=path.join(evidenceDir,'state.json'),receiptPath=path.join(evidenceDir,'receipt.json'),failurePath=path.join(evidenceDir,'failure-receipt.json');
+  await mkdir(evidenceDir,{recursive:true});
+  const journal={schema:'deadbyte.r31-slot-rollback-state.v1',rollback_id:rollbackId,activation_receipt:path.resolve(receiptFile),
+    activation_receipt_sha256:activationEnvelope.receipt_sha256,handoff_path:handoffPath,
+    from_pointer:publicPointer(activePointer),to_pointer:publicPointer(priorPointer),created_at_utc:new Date().toISOString()};
+  await writeState(statePath,journal,'verified');
+  let stopped=false,launchersRestored=false,pointerCommitted=false,priorCtx=null,priorRuntime=null;
+  try {
+    await stopAndVerify(currentCtx,currentRuntime); stopped=true;
+    await writeState(statePath,journal,'successor_stopped');
+    await restoreRollbackLaunchers(rollbackLaunchers); launchersRestored=true;
+    await writeState(statePath,journal,'predecessor_launcher_restored',{launcher_sha256:priorPointer.launcher_sha256});
+    await atomicWriteActivePointer(pointerInfo.file,priorPointer); pointerCommitted=true;
+    await verifyActiveInstallation(state,priorPointer);
+    await writeState(statePath,journal,'prior_pointer_restored',{active_pointer:publicPointer(priorPointer)});
+    priorCtx=slotContext(state,priorPointer);
+    priorRuntime=await startAndVerify(priorCtx,currentRuntime);
+    const stabilization=await stabilizeRuntime(priorCtx,priorRuntime);
+    const finalStatus=parseControllerStatus(controllerCaptured(priorCtx,'status',15000));
+    if(finalStatus.process_armed||finalStatus.coding_armed||finalStatus.autonomous_armed||finalStatus.desktop_armed||finalStatus.host_armed) throw new Error('rollback predecessor authority must remain disarmed');
+    const body={schema:ROLLBACK_SCHEMA,rollback_id:rollbackId,activation_receipt_sha256:activationEnvelope.receipt_sha256,
+      completed_at_utc:new Date().toISOString(),from_pointer:publicPointer(activePointer),active_pointer:publicPointer(priorPointer),
+      launcher_restored:true,old_runtime:generationTuple(currentRuntime),new_runtime:generationTuple(priorRuntime),stabilization,
+      authority_revoked:revoked.revoked,rollback_performed:true};
+    const receipt=await writeEnvelope(receiptPath,body,key);
+    await writeState(statePath,journal,'completed',{receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256});
+    return {ok:true,rollback_id:rollbackId,state_path:statePath,receipt_path:receiptPath,receipt_sha256:receipt.receipt_sha256,pointer:priorPointer,new_runtime:priorRuntime};
+  } catch(error){
+    const recovery={attempted:false,prior_runtime_stopped:false,successor_launcher_restored:false,successor_pointer_restored:false,successor_runtime_restarted:false,errors:[]};
+    if(stopped){
+      recovery.attempted=true;
+      if(pointerCommitted&&priorCtx){ try { controllerCaptured(priorCtx,'stop',30000); recovery.prior_runtime_stopped=true; } catch(recoveryError){ recovery.errors.push(`stop-prior:${recoveryError.message}`); } }
+      if(launchersRestored){
+        try { await installLaunchers(rollbackLaunchers); recovery.successor_launcher_restored=true; }
+        catch(recoveryError){ recovery.errors.push(`restore-successor-launcher:${recoveryError.message}`); }
+      }
+      if(pointerCommitted){
+        try { await atomicWriteActivePointer(pointerInfo.file,activePointer); await verifyActiveInstallation(state,activePointer); recovery.successor_pointer_restored=true; }
+        catch(recoveryError){ recovery.errors.push(`restore-pointer:${recoveryError.message}`); }
+      }else if(recovery.successor_launcher_restored){
+        try { await verifyActiveInstallation(state,activePointer); recovery.successor_pointer_restored=true; }
+        catch(recoveryError){ recovery.errors.push(`verify-successor-pointer:${recoveryError.message}`); }
+      }
+      try { await startAndVerify(currentCtx,currentRuntime); recovery.successor_runtime_restarted=true; } catch(recoveryError){ recovery.errors.push(`restart-successor:${recoveryError.message}`); }
+    }
+    const failure={schema:ROLLBACK_FAILURE_SCHEMA,rollback_id:rollbackId,activation_receipt_sha256:activationEnvelope.receipt_sha256,
+      failed_at_utc:new Date().toISOString(),phase:journal.phase??'unknown',from_pointer:publicPointer(activePointer),to_pointer:publicPointer(priorPointer),
+      error:{name:error?.name??'Error',message:String(error?.message??error)},recovery};
+    await writeState(statePath,journal,'failed',{error:failure.error,recovery}).catch(()=>{});
+    let failureReceipt=null;
+    try{
+      failureReceipt=await writeEnvelope(failurePath,failure,key);
+      await writeState(statePath,journal,'failed_receipted',{failure_receipt_path:failurePath,failure_receipt_sha256:failureReceipt.receipt_sha256});
+    }catch(receiptError){
+      recovery.errors.push('failure-receipt:'+receiptError.message);
+      await writeState(statePath,journal,'failed_unreceipted',{recovery,failure_receipt_error:String(receiptError?.message??receiptError)}).catch(()=>{});
+    }
+    const wrapped=new Error(`R31 slot rollback failed: ${error?.message??error}`); wrapped.cause=error; wrapped.statePath=statePath; wrapped.failureReceiptPath=failureReceipt?failurePath:null; throw wrapped;
+  }
+}
+
+export async function runSlotUpdateCli(argv=process.argv.slice(2),{stateRoot=DEFAULT_STATE_ROOT}={}){
+  stateRoot=resolveStateRoot(stateRoot);
+  if(argv.includes('--rollback-receipt')){
+    const args=parseRollbackArgs(argv);
+    const result=await performSlotRollback({activationReceipt:args.activationReceipt,stateRoot});
+    console.log('R31_SLOT_ROLLBACK_PASS');
+    console.log('ROLLBACK_ID '+result.rollback_id); console.log('RECEIPT_SHA256 '+result.receipt_sha256);
+    console.log('STATE_PATH '+result.state_path); console.log('ACTIVE_RELEASE '+result.pointer.release_id);
+    return result;
+  }
+  if(argv.includes('--resume-handoff')){
+    const args=parseResumeHandoffArgs(argv);
+    const result=await resumeSlotUpdate({handoffPath:args.handoff});
+    console.log(result.completed?'R27_SLOT_UPDATE_RESUME_PASS':'R27_SLOT_UPDATE_RESUME_DEFERRED');
+    console.log('UPDATE_ID '+result.update_id);
+    console.log('STATE_PATH '+result.state_path);
+    if(result.receipt_sha256) console.log('RECEIPT_SHA256 '+result.receipt_sha256);
+    if(result.historical_receipt_verified===true) console.log('VERIFICATION_SCOPE historical-signed-receipt; current-runtime-not-observed');
+    return result;
+  }
+  if(argv.includes('--recover-interrupted')){
+    const result=await recoverInterruptedSlotUpdates({stateRoot});
+    console.log('R27_SLOT_UPDATE_RECOVERY launched='+result.launched);
+    for(const update of result.updates) console.log('UPDATE_ID '+update.update_id+' SUPERVISOR_PID '+update.supervisor_pid);
+    return result;
+  }
+  const args=parseUpdateArgs(argv);
+  const result=await performSlotUpdate({
+    stage:args.stage,developmentRoot:args.developmentRoot,expectedVersion:args.expectedVersion,expectedManifest:args.expectedManifest,
+    sourceRoot:args.sourceRoot,stateRoot,restoreStandingGrants:args.restoreStandingGrants,recoverOfflinePredecessor:args.recoverOfflinePredecessor,
+    cloudTransport:args.cloudTransport,bridgeBootstrap:args.bridgeBootstrap,processPolicyBootstrap:args.processPolicyBootstrap,
+    hostPolicyBootstrap:args.hostPolicyBootstrap,codingPolicyBootstrap:args.codingPolicyBootstrap,
+    autonomousPolicyBootstrap:args.autonomousPolicyBootstrap,ownerApprovalBootstrap:args.ownerApprovalBootstrap,desktopPolicyBootstrap:args.desktopPolicyBootstrap,
+    semanticLspBootstrap:args.semanticLspBootstrap,enableMachineFs:args.enableMachineFs,enableObservation:args.enableObservation,
+    enableDesktop:args.enableDesktop,enableAutonomousSupervisor:args.enableAutonomousSupervisor,hostCommandPins:args.hostCommandPins
+  });
+  if(result.handed_off){
+    console.log('R27_SLOT_UPDATE_HANDOFF version='+args.expectedVersion);
+    console.log('UPDATE_ID '+result.update_id);
+    console.log('HANDOFF_PATH '+result.handoff_path);
+    console.log('HANDOFF_RECEIPT_SHA256 '+result.handoff_receipt_sha256);
+    console.log('SUPERVISOR_PID '+result.supervisor_pid);
+  }else{
+    console.log('R27_SLOT_UPDATE_PASS version='+args.expectedVersion);
+    console.log('UPDATE_ID '+result.update_id);
+    console.log('RECEIPT_SHA256 '+result.receipt_sha256);
+    console.log('STATE_PATH '+result.state_path);
+    console.log('ACTIVE_RELEASE '+result.pointer.release_id);
+  }
+  return result;
+}
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===path.resolve(fileURLToPath(import.meta.url));
+if(invoked){
+  try { await runSlotUpdateCli(); }
+  catch(error){
+    console.error(`R27_SLOT_UPDATE_FAIL ${error?.message??error}`);
+    if(error?.statePath) console.error(`STATE_PATH ${error.statePath}`);
+    if(error?.failureReceiptPath) console.error(`FAILURE_RECEIPT_PATH ${error.failureReceiptPath}`);
+    process.exitCode=1;
+  }
+}