fix: reconcile native service recovery before fleet updates

.traceweaver/intent-contract.yml

@@ -71,3 +71,20 @@
     }
   ]
 }
+
+service_recovery_amendment_projection:
+  date: 2026-11-02
+  authority_plan: ../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/architecture/continuation-amendment.json
+  plan_sha256: 159af8421e4dde61e4ecc4f47849a1ddd7f07cd6fb158d247256f0bb36ed316e
+  owner_approval: ../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/owner-approval.json
+  implementation_contract_sha256: 91b873c548da7d10a113c8fbb74f09540559ba51339514c738e081d0dc75cf01
+  authority_gate: ../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/execution/go/recovery-source-go.json
+  reviewed_vv: ../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/execution/go/recovery-vv-root-reviewed.json
+  requirement: REQ-FLEETUPDATE-001
+  trace: TRACE-FLEETUPDATE-001
+  verification: VER-FLEETUPDATE-001
+  validation: VAL-FLEETUPDATE-001
+  source_only: true
+  native_acceptance: held
+  production_writes: disabled
+  publication: held

docs/native-service-recovery.md

@@ -0,0 +1,42 @@
+<!-- TRACEWEAVER: file-role=recovery-operations-documentation; req=REQ-FLEETUPDATE-001; trace=TRACE-FLEETUPDATE-001; ver=VER-FLEETUPDATE-001 -->
+# Native IPMI service restoration evidence
+
+Install the reviewed exact DC Overview and CryptoLabs Proxy host wheels into
+the same existing CLI environment. Keep the original proxy serving. Before
+`release select --record-cli` or controller adoption, run locally as Linux root:
+
+```sh
+dc-overview release reconcile-service --service ipmi-monitor --job <exact-active-job-id>
+```
+
+The command accepts only this service and a 32-character lowercase hex native
+job ID. It accepts no path, image, script, force flag or caller observation. It
+resolves the serving proxy's local writable `/data/auth` mount, then holds Fleet
+lifecycle, dispatch and operation exclusion in that order. It does not invoke
+status, replay a worker, stop a container, clear a marker or edit job history.
+
+It verifies exactly one trusted retained pre-job bundle below the fixed
+`/var/backups/cryptolabs/ipmi132` root, its private artifact hashes, original
+container/image/runtime/config/network identity, terminal helper, fresh `/health`
+and read-only stable SQLite/account/link/inventory fingerprints. Missing,
+ambiguous or changed evidence holds. It creates no new baseline or DB copy.
+
+The only new durable updater record is a private `service-recovery-JOB.json`
+receipt. The old desired deployment remains failed. Retry revalidates current
+evidence and returns the same receipt without changing its timestamp. Private
+fingerprints and configuration values never appear in the command response.
+
+After separately approved compatible selection and proxy adoption, new native
+submits require the live `native_service_recovery: 1` capability and carry the
+job/receipt hash binding into their worker. Workers check before pulls and again
+before the first lifecycle effect. Blocked successors retain the dependency.
+Only a verified successful IPMI update retires that original dependency; archived
+receipts are retained without permanently pinning future runtimes.
+
+New jobs persist bounded intent/completion diagnostics around Engine effects.
+Unknown outcomes retain only safe categories and re-observe owned IDs before
+restoration. No historical phases or incident cause are synthesized.
+
+Local source tests are not operational clearance. Exact packaged legacy
+bootstrap, protected release, fresh target custody, actual signed admission and
+site/browser acceptance are separate gates.

requirements.md

@@ -60,3 +60,22 @@ Verification: `VER-PAIR-005`; validation: `VAL-PAIR-005`. See scoped authority a
 The implementation shall preserve existing working links and legacy clients, keep the current pinned WordPress package/publisher boundary, and deliver installed product updates through accepted DC Overview Fleet Management. Deployment and paid-service acceptance shall remain held until observed in the intended environment.
 
 Verification: `VER-PAIR-006`; validation: `VAL-PAIR-006`. See scoped authority and protocol for executable acceptance boundaries.
+
+
+## 2 November 2026 native service recovery amendment
+
+The existing administrative REQ/TRACE/VER/VAL-FLEETUPDATE-001 labels also
+project the exact owner-approved [continuation amendment](../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/architecture/continuation-amendment.json),
+SHA256 `159af8421e4dde61e4ecc4f47849a1ddd7f07cd6fb158d247256f0bb36ed316e`,
+and its [owner receipt](../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/owner-approval.json). The frozen implementation
+contract is [contract.json](../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/execution/contract/contract.json), SHA256
+`91b873c548da7d10a113c8fbb74f09540559ba51339514c738e081d0dc75cf01`.
+This is a linked projection, not a new approval or requirement identity.
+
+The fixed root host command verifies retained pre-job evidence and the exact
+original service before publishing a private job-bound `original_restored`
+receipt. The failed job and active pointer stay intact. Selector, native submit
+and worker revalidate restoration and retain predecessor dependencies through
+blocked successors. New-job phase diagnostics contain only allowlisted facts.
+Source tests do not establish actual Linux bootstrap, release, target or browser
+acceptance; those gates and publication remain held.