L04-08: forward rollback with revalidation, and cross-surface parity (#40)

[mberrys]

Summary

L04-08 (#40), the final slice of the L04 Governed Operation Engine stack (refs #5). Rollback now creates a new revision that is revalidated and signed off like any other publication, a CLI rollback surface exists, and the cross-surface parity claim is bound to a named fixture that runs in CI.

Stack position

Slice 8 of 8. Base: l04-07-provenance-signoff (#217). Root of the stack targets dev; land bottom-up.

Per-criterion: already satisfied vs built here

Acceptance criterion	State	Proof
Retain digest-verified prior artifacts	already satisfied	PDFArtifactStore (content-addressed, verify-then-restore) + history retention; unchanged
Rollback creates a new revision and revalidates it	built here	rollbackTo restores the verified prior bytes as a new revision, revalidates through the #38 finalize path, records a RolledBack event carrying {approval, revalidation, sign_off} + report/profile digests; on revalidation failure it fails closed (removes the destination, appends the Failed event)
History rewrite or direct restore of unverified bytes forbidden	already satisfied for bytes; hardened here	a verify()-before-append guard refuses to extend a compromised chain; fault injections: missing profile refuses, rewritten history refuses (no destination, no new event)
Editor, CLI, Action List, PageMaster reach semantically equal outputs and receipts for equivalent plans	built here	UnitTestsProductOperatorLoop::governedPublicationParityAcrossSurfaces drives CLI repair, CLI action-list, the Editor Action List route, and PageMaster over one fixture + plan, against committed receipts in UnitTests/testdata/governed-parity/; check_governed_parity.py now runs in CI over those receipts (closes the d5-cross-surface-identity-equality TODO)
New surface	built here	pdftool rollback (JSON-only), with the full registration train

Parity claim, stated precisely

The recon's "all four surfaces share source_sha256 + effective_profile_digest" is false for PageMaster: it publishes a derived source-identity digest and its own resolved-profile digest. The test therefore asserts literal shared identity across repair / action-list / Editor and pins PageMaster's own digest through its manifest fixture; action-list plan-digest equality holds for the CLI action-list <-> Editor pair.

Required proof

• python scripts/agent/check-change.py --base 1a092d68 --head c587089b --head-branch l04-08-rollback-parity --build-dir <loop-build-l04> -> status: pass, 103/103 checks.
• Provenance: the proof was recorded at the pre-rebase head 9d2728d9. The stack rebase left this slice's own diff unchanged (patch-id verified) and the only later edit is a documentation-only fragment correction, so the proof carries for the code; CI re-runs the mapped lanes on the head above.
• Focused: UnitTestsOperationHistory / UnitTestsGovernedExecution / UnitTestsPdfToolContract / UnitTestsPageMasterExport / UnitTestsProductOperatorLoop -> 5/5; UnitTestsEditorHost 24/24 after the fix below.
• Fix commit 9d2728d: the Editor rollback now runs its revalidation through PDFJobScheduler (the first proof run caught the Editor calling PreflightEngine::run on the interactive thread, which the engine refuses by invariant, preflightengine.cpp:7147); the worker builds its own store because Qt SQL connections are thread-affine.
• Architecture: check-architecture.py (+ diff mode), test_architecture_contracts.py, test_check_governed_parity.py, workflow-contract tests -> green.
• Pre-existing flake UnitTestsPdfWorkerIsolation supervisorFaults(cpu) is a razor-margin race against the 135s client timeout #211 can redden a mapped run; CI agent-fast is authoritative.

Notes

• Closes #40.
• Deferrals, stated: Action List and PageMaster do not get their own rollback surfaces in this slice (Editor + CLI do), recorded in docs; fixture-class registration was skipped because it would require a quality-budgets.yaml metric entry (protected file) — the lane + fixture paths are bound instead.
• Breaking-change: no.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}