[Ed1s0nZ]

Problem and behavior

After #346, saving a description-only edit could start a stopped MCP. Ambiguous recovery JSON could also authorize another binary swap, restore an unrelated backup, or delete recovery evidence. This follow-up preserves MCP activation when edit requests omit activation fields and refuses unsupported or contradictory recovery evidence before filesystem changes.

Changes

• Keep explicit Start/Stop, disabled and persisted activation consistent, including config reload.
• Strictly decode recovery records and State (duplicate keys, unknown fields, null/type errors), reconcile hashes and commits, and validate actual binary files against the recovery phase.
• Apply the same evidence boundary to legacy-marker recovery and first-time rollback.
• Add malformed-evidence regressions and valid interrupted-swap/cleanup controls; preserve the existing legacy recovery format.

Verification

Targeted regressions, including six independently discovered phase/State boundary counterexamples, pass. Frozen recovery package race tests, the full Go suite and build passed; the final MCP consistency delta additionally passed handler/MCP race tests and independent GET-to-edit regression tests. All 277 JS tests and shell syntax passed. Independent code review found no remaining blockers. Exact-head cross-platform CI is required before merge. No release or deployment is included.

Unreleased changelog covers both fixes. Design, compatibility constraints and phase verification: docs/feature/self-update-recovery-fixes.md. Invalid/unsupported JSON recovery records now require manual correction rather than guessed mutation; valid producer records remain supported.