feat(mosaic): add constrained context recovery command

packages/mosaic/framework/skills/mosaic-context-refresh/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: mosaic-context-refresh
+description: Run the constrained Mosaic context-recovery flow after compaction or directive-loss. This is a thin wrapper over the broker-backed recovery command; it never treats a receipt as a safety or residency proof.
+---
+
+# mosaic-context-refresh
+
+Use this only after compaction, session resume, or confirmed directive drift. It invokes the
+**single ungated mutator**, `tools/lease-broker/recover-context.py`; every other consequential
+mutator remains behind the verified lease gate.
+
+## Wrapper procedure
+
+1. The runtime supplies the exact validated normative-fragment construction and the current
+   compaction/request epochs, then invokes:
+
+   ```bash
+   python3 "$MOSAIC_HOME/tools/lease-broker/recover-context.py" begin \
+     --construction "$MOSAIC_CONTEXT_REFRESH_CONSTRUCTION" \
+     --compaction-epoch "$MOSAIC_COMPACTION_EPOCH" \
+     --request-epoch "$MOSAIC_REQUEST_EPOCH"
+   ```
+
+   The command delegates to the shipped WI-5 broker transition: revoke first, build the canonical
+   `B_payload`/`H_payload`, enter `PENDING_DELIVERY`, and mint a fresh one-time challenge. It prints
+   the terminal receipt envelope to deliver exactly as returned.
+
+2. The current assistant message copies that one terminal receipt verbatim. It does not compute a
+   hash, add prose, quote a prior receipt, or present a caller-supplied receipt/challenge.
+3. At `message_end`, the trusted runtime `ReceiptObserver` seam invokes:
+
+   ```bash
+   python3 "$MOSAIC_HOME/tools/lease-broker/recover-context.py" complete
+   ```
+
+   Completion supplies no receipt or challenge argument. The broker observes the exact latest
+   assistant entry, commits evidence, consumes its own fresh challenge, and promotes VERIFIED last.
+   If observation is absent, malformed, stale, or duplicated, recovery remains UNVERIFIED and a
+   retry begins a new cycle.
+
+## Scope and honesty
+
+- A receipt from the normal verification path cannot be replayed through recovery: recovery mints a
+  distinct current challenge and does not accept caller-provided receipt text as evidence.
+- Observable absent, malformed, prefix-truncated, and adapter-mutated terminal receipts do not
+  promote. “Tail-only” is non-promoting only when the delivered terminal bytes are concretely
+  malformed or incomplete.
+- **Negative capability:** a tail-preserving middle drop is not represented as receipt-detectable.
+  It is a T-C injection-contract residual deferred to WI-7 server-side evidence; do not claim this
+  skill or receipt catches it.
+- The receipt is a T-A delivery/liveness prerequisite only. It never proves obedience, comprehension,
+  durable residency, or safety; the whole mutator-class gate and server-side branch protection retain
+  those roles.
+
+This source-resident skill is projected by the Mosaic skill bridge after framework install/upgrade.
+Do not create a live symlink manually.