RS-2026-088 DEADBOLT: Hardware-Gated Backup Control Planes

Ransomware gangs do not detonate immediately on access. In the ten minutes before encryption begins, they delete snapshots, shorten retention windows, rotate backup credentials, and stop backup schedulers. Software-only controls that gate these operations share a structural flaw: an attacker with sufficient privilege on the host can subvert the enforcement wrapper before it fires (L185 WRAPKILL) or neutralise the control daemon after it has started (L246 REGICIDE). DEADBOLT moves the enforcement credential outside the software execution domain. When the USB key is absent, the destructive control plane is closed. When it is present and armed, operators can delete, prune, reconfigure, and rotate credentials within a 60-second token window. A write-velocity and entropy tripwire detects bulk encryption and freezes the backup target until a human inserts the key. DEADBOLT does not make backups immutable. It does not stop an attacker with root on the enforcement appliance. Its guarantee is narrower and testable: destructive backup operations require a physically present key. The reference implementation passes 28 of 29 SPECTER AUDIT v1.2.0 checks at 87% line coverage across 268 tests. This is the companion product to KILLKEY (RS-2026-087); the two products share hardware, wire protocol, firmware skeleton, and event-log format.