Audit-first rollback semantics for safety–critical deployment pipelines

Deployment runtimes for safety–critical embodied agents keep two records: the live state components execute and the audit chain operators and regulators read. When an upgrade crashes mid-flight, a runtime that fails open keeps the partial deployment running, so the audit chain misstates what runs. We propose audit-first rollback semantics: the revert is attempted before any terminal record is written, and the record states what it did. Provisional state machines with a rollback closure and a bounded soak budget realize the rule; a protocol design extends it to coordinated bridges. We implemented it in a robot-manipulator deployment runtime and compared it with fail-open at 23 enumerated fault sites plus a control and over 10 runs of a 12-point crash grid. The sweep exposed two writes the first implementation left outside its guard and a fallback that lost the divergence flag. With the guard widened, every audit-first trial ended in the specified state; under our stricter coherence check fail-open did so at 5 sites, the ones needing no revert. Over the guarded trials that ended ROLLED_BACK, a terminal record followed within 35.7 ms at the 99th percentile. A terminal record then states what is running or flags that it must be reconciled.