docs(recovery): bind target observer operator handoff

[seonghobae]

Finding

PR #299's bounded recovery-target configuration observer has a cross-owner public/operator documentation contract. This PR owns only ADR 0019, physical/PITR doctoring and their focused documentation test; it does not own runtime/schema/provider authority.

Parent #324 is the canonical root architecture/product-gap documentation owner. Its latest change repairs a durable/mutable authority defect in docs/product-technical-gap-baseline.md; this descendant inherits that parent documentation through ordinary ancestry and does not duplicate it into recovery-owned files.

Exact topology

• canonical documentation parent refactor(results): use semantic result application identifiers #324: fix/result-application-semantic-identifiers@782620982520fed46f6b6ef68c7320a61dbb311f;
• previous docs(recovery): bind target observer operator handoff #348 head: 0d8cca0ec9e2ff2dca366eac198017c6e3e1fede;
• exact current docs(recovery): bind target observer operator handoff #348: docs/postgres-recovery-target-observer-handoff@143cbca70a46923b2a56bd419058c419f933dda0;
• ordinary two-parent reconciliation: prior docs(recovery): bind target observer operator handoff #348 as first parent, current refactor(results): use semantic result application identifiers #324 as second parent; branch ref moved with force=false;
• compare from exact current refactor(results): use semantic result application identifiers #324: 25 ahead / 0 behind, merge base exactly refactor(results): use semantic result application identifiers #324;
• effective relative delta remains exactly docs/adr/0019-postgres-physical-pitr-profile.md, docs/doctoring/postgres-physical-pitr-profile.md, and tests/test_postgres_physical_recovery_documentation.py.

The parent change touches only the product-gap baseline, so the recovery-owned three-file slice remains lossless and non-overlapping.

Retained recovery contract

The handoff preserves exactly eight recovery-target settings plus pg_is_in_recovery(), bounded result materialization, fail-closed malformed/duplicate/unknown/oversized/pending-restart/inactive/mismatch handling, caller-owned connection/timeout policy and content-free provenance. Wrong-type or mutated PostgresPitrRecoveryTarget authority that no longer satisfies the reviewed contract is rejected before cursor acquisition/database I/O. PostgreSQL 18's effective recovery_target_inclusive=on default remains explicit when a reviewed name or immediate target has no inclusion edge; time/XID/LSN retain their explicit reviewed inclusion edge.

The seam does not create recovery.signal, provide restore_command, replay/validate WAL, prove archive completeness/timeline ancestry/target attainment, promote recovery, prove application readiness, or establish achieved RPO/RTO, HA/DR or certification.

Exact-current acceptance

The previous repository-local GREEN receipts on #348 0d8cca0e... and parent #324 056025a8... are predecessor evidence only after the parent and descendant moved. They do not transfer.

Fresh exact-current runs are nonterminal:

• docs(recovery): bind target observer operator handoff #348 143cbca70a46923b2a56bd419058c419f933dda0: CI 35603177444 queued; Release Acceptance 35603177440 queued.
• parent refactor(results): use semantic result application identifiers #324 782620982520fed46f6b6ef68c7320a61dbb311f: CI 35603122673 queued; Release Acceptance 35603122824 queued.

Keep Draft until this exact source generation obtains fresh terminal evidence and then-live review/governance requirements are satisfied.

Authority boundary

ADR 0019 remains Accepted only for the already-integrated bounded physical/PITR profile seam; the #299 observation handoff remains proposed until normally integrated. Moving central owner identities, workflow runs, queue state and review/governance topology are resolved from #244 and live central owners immediately before any integration decision rather than frozen into this durable recovery PR.

No wake/no-op commit, blind rerun, gate weakening, self-approval, administrator bypass, predecessor-evidence transfer, force update or destructive rebase is authorized. Refs #102, #109, #111, #121, #122, #184, #198, #200, #203, #204, #229, #233, #244, #278, #299, #306, #308, #309, #312, #316, #321, #324, #340, #341 and #345.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}