docs(recovery): name the live canonical overlay without Draft instructions

[cursor]

Canonical PRD/TRD/documentation-fitness overlay — active Draft

This is the bounded canonical writer for nine documentation files plus five documentation-contract tests. Closed #214/#226 remain predecessor lineage. #324 separately owns root ARCHITECTURE.md, CHANGELOG.md, result-application doctoring, and docs/product-technical-gap-baseline.md; #321 owns the active root README.md/docs/index.md public-documentation surface. This lane does not copy those paths.

Current topology

• protected main: 5913c4bad79d6bc29d7cc1c624abb7db2ea6a77c;
• direct base/integration root test(recovery): cover stale evidence registry cleanup #233: 01d231fde23b82e2ced258d7bfcb4721ed75706d;
• exact current head: bf6dd65d716a7324cf3ac1291dcedfae556fe666;
• compare from exact test(recovery): cover stale evidence registry cleanup #233: 61 ahead / 0 behind, merge base exactly test(recovery): cover stale evidence registry cleanup #233;
• effective relative surface remains exactly 14 files: nine canonical docs plus five documentation-contract tests;
• no production source, schema, workflow, root README/ARCHITECTURE/CHANGELOG, or product-gap baseline is modified.

All movements are ordinary descendants. No force update, destructive rebase, protected-main write, self-approval, synthetic status, review dismissal, or gate weakening is used.

Historical review repairs retained

The three predecessor-head CHANGES_REQUESTED submissions remain historical review evidence rather than current-head approval. Their substantive defects are repaired in this canonical surface:

• feat(reconcile): add tenant-qualified single-flight lock #191 is shipped only as tenant-qualified PostgreSQL session advisory-lock single-flight; no scheduler/durable-lease/result-application/terminal-retirement/distributed-exactly-once claim;
• fix(recovery): accept custom-format restore seek positions #212 is shipped only as bounded custom-format direct pg_restore; feat(recovery): restore bounded PostgreSQL logical archives #209 remains invalid-EOF predecessor evidence and no backup/application/PITR/RPO-RTO claim is inferred;
• fix(recovery): require cluster identity for restore-target isolation #228 is shipped only as exact service-name + caller-observed system_identifier separation; connection provenance/authorization, restore execution and application/PITR/RPO-RTO remain outside the seam;
• protected secret storage remains PostgreSQL-backed with optional Fernet and explicit compatibility rows; mandatory encryption, migration, rotation/recovery and external custody remain unintegrated;
• retained historical documentation refs remain provenance/anchors rather than competing active source writers.

#299 review finding — owner-path repair and real RED

Fresh #299 review still had one valid unresolved documentation/public-surface finding. #229 now supplies the part owned by this canonical lane without pretending the whole cross-owner finding is finished:

• docs/DOCUMENTATION_FITNESS.md records feat(recovery): observe effective PITR target configuration #299 as ACTIVE-PR and states that it observes exactly eight PostgreSQL recovery-target settings plus pg_is_in_recovery() on a caller-owned isolated target;
• docs/TRACEABILITY.md maps that bounded observation into FR-5 and the security/recovery control graph;
• both documents preserve caller-owned connection/timeout authority, module-scoped APIs, and explicit non-guarantees for WAL completeness, target attainment, promotion, application readiness, PITR success, and achieved RPO/RTO;
• tests/test_canonical_status_vocabulary.py requires feat(recovery): observe effective PITR target configuration #299 in the active overlay register, pins the bounded wording, and verifies the two feat(recovery): observe effective PITR target configuration #299 functions are not silently promoted through root pg_llm_batch.__init__ without an explicit public-surface decision.

The first new exact head 045e42b3db7fa47e3e29d3fdbe7531d9e96d6d62 produced a real hosted RED in CI 34553319756: Python 3.12 reached Run unit tests and failed. Inspection found a documentation-contract mismatch introduced by this change itself: TRACEABILITY.md said “eight reviewed recovery-target settings” while the executable contract intentionally required the canonical phrase “eight PostgreSQL recovery-target settings.” Minimum descendant bf6dd65d716a7324cf3ac1291dcedfae556fe666 changes only that term in TRACEABILITY.md. No test was weakened or deselected.

The #299 inline thread was replied to but intentionally left unresolved. Root README.md, CHANGELOG.md, the relevant ADR, and operator/doctoring material remain separate live-owner surfaces; those owners must converge rather than being copied into this PR.

Exact-head validation

Predecessor #229 GREEN does not transfer after these changes. Fresh workflow reads on exact current bf6dd65d716a7324cf3ac1291dcedfae556fe666, exact base 01d231fde23b82e2ced258d7bfcb4721ed75706d, are now terminal:

• CI 34553499878: completed / success;
• Release Acceptance 34553499932: completed / success.

These successes establish repository-local exact-head branch evidence for the repaired documentation contract only. Fresh formal-review inventory still contains only predecessor-head CHANGES_REQUESTED submissions and no qualifying independent current-head APPROVED review. Keep Draft. The unresolved cross-owner #299 documentation/public-surface thread also remains non-passing until its remaining owner paths converge.

Merge/release boundary

#233 is not protected yet, so #229 is not a normal merge candidate even with repository-local checks green. After prerequisites integrate, reconcile this exact 14-file delta non-destructively onto the resulting protected ancestry, reacquire every then-live current-head/current-base quality, security, release, review and thread gate, and only then use the normal protected-branch merge path. Branch GREEN is never immutable release authority.

Refs #191, #192, #204, #210, #212, #228, #229, #233, #244, #296, #299, #316, #321, #324, #340, #341.

[seonghobae]

Exact-head evidence refresh for bf6dd65d716a7324cf3ac1291dcedfae556fe666: Release Acceptance 34553499932 is now terminal SUCCESS on this exact head/base envelope. CI 34553499878 remains queued at the latest read, so the current head is not claimed fully GREEN. The first documentation-contract generation 045e42b... remains the real RED; the one-term TRACEABILITY repair is unchanged. No review/thread state is promoted from the predecessor and no merge/readiness transition is taken while CI and independent approval remain incomplete.

[seonghobae]

Exact-head GREEN update: both hosted repository-local gates are now terminal success on bf6dd65d716a7324cf3ac1291dcedfae556fe666 / base 01d231fde23b82e2ced258d7bfcb4721ed75706d: CI 34553499878 SUCCESS, Release Acceptance 34553499932 SUCCESS. This closes the one-term documentation-contract RED introduced at 045e42b... without weakening or deselecting the test. #229 remains Draft: fresh formal-review inventory still contains only the three predecessor-head CHANGES_REQUESTED reviews and no current-head independent APPROVED; #233 is not protected/integrated; and #299's cross-owner README/CHANGELOG/ADR/doctoring review thread remains intentionally unresolved.

[seonghobae]

Owner-path finding from the fresh #318 provider-boundary audit: this PR remains the canonical PRD/TRD writer, but its current provider-interaction wording is an intentionally uncompleted architecture transition rather than final durable truth.

Current docs/product/PRD.md still says pg owns “validated provider Batch API interaction”; current docs/product/TRD.md assigns batch_api_client.py direct provider upload/create/poll/wait/cancel/retrieve responsibility. That matches present package behavior. However #318's durable boundary now requires pg-owned durable/provider-neutral batch lifecycle semantics while contextual-orchestrator owns provider/model discovery, routing/fallback and credentials, with production adoption consuming only an eligible released CO API/client/schema through an ACL/BatchInferencePort-style seam.

Do not move this already-GREEN #229 head just to predeclare unimplemented behavior. When the provider-boundary source owner is serialized and reaches stable exact-head behavior, this PR or its verified successor must update PRD/TRD, TRACEABILITY, UML/component sequence and documentation-fitness status from the resulting code. Preserve standalone/embedding claims only to the extent the implemented port contract actually supports them; do not call the current direct OpenAI-compatible client provider-neutral merely by renaming it.

Refs #201, #229, #233, #244, #317, #318.