[Tim55667757]

Problem and behavior

An already exposed native WireGuard plan could become unrecoverable if its exact installed original stopped before the first native journal, while ready, or after an unchanged rollback. Original observation required a running service, and legacy callbacks cannot bypass the pending protocol reservation.

Add a read-only trusted origin observer for generation-record3 only. Bind the complete original receipt/source/unit, executing kernel, consumed history and exact exposed authority. Recognize quiescence only with complete owned kernel absence, no native job/PIDs and an empty recursive cgroup. Partial or foreign state remains refused; initial Reserve/Expose health admission is unchanged.

Cache and pre-native input recovery select this observer through a trusted code dependency. Native recovery permanently retires the old unit, then uses only the preplanned fresh restoration candidate on rollback, preserving credentials/runtime and both history links. Read-only status reports recovery required. Previously restored input remains exact through all journaled rollback continuation phases; it cannot authorize first admission without a recorded rollback.

Validation

• Native Windows: compileall, naming, Ruff, Linux-targeted mypy (80 source files), 118 focused tests passed; 207 POSIX-only cases explicitly skipped locally.
• Added 5 portable invalid/historical/rebound origin refusal cases and 45 POSIX scenarios covering both original receipt schemas, five pre-native prefixes, forward/rollback outcomes, unchanged/input-restored recovery, six canonical and temporary publication death boundaries, lost-journal refusal, foreign/partial state and unchanged initial health admission.
• Exact-head canonical Linux gate: passed, 3541 tests / 9 explicit skips, 90.38% coverage.
• Exact-head strict installed-wheel EN/RU/ZH documentation: passed, 99 documentation tests and 444 approved units per locale.
• Exact-head reproducible artifact and installed application: passed, 5 installed tests and reproducible wheel/sdist.
• Independent static review of 09c765dd9aeffff0161f17641f6a77a46c35bafe: approved after source/tests, EN/RU/ZH and provenance review. The rollback-continuation P2 and fixture issues are fixed; no remaining actionable findings.

Scope

Updates ADR 0024, engineering documentation and approved source-bound RU/ZH catalogs. Preserves schema/ABI and existing default cache contracts. This is private recovery, not public protocol admission or authenticated common completion/publication.

Continues #128; does not close the incomplete task. No real cloud/SSH/server, WSL, desktop VPN or local network operations. No release.

[Tim55667757]

Independent AI review of exact head 09c765d completed under the owner's delegated review/merge authorization. Reviewed sealed/exposed-only origin proof, strict original receipt/unit/kernel/history binding, complete kernel absence and drained service/cgroup requirements, unchanged initial health admission, trusted cache/input dependency, fresh retirement/restoration, restored-input continuation across canonical/temp interruptions and EN/RU/ZH provenance. Rollback-continuation P2 fixed; no remaining actionable findings. Exact-head Linux: 3541 passed / 9 skipped, 90.38% coverage. Installed-wheel docs: 99 passed. Reproducible artifact/installed application: 5 passed. No live infrastructure or local network operations. This COMMENT records an AI review, not a human approval.

[Tim55667757]

Reviewed