stack/docs/scratchpads/833-constrained-recovery-command.md

#833 constrained recovery command — build scratchpad

• Objective: Deliver WI-6 plus Mos-ruled B1/B2 and R2 Claude-only literal-argv repair: no shell-active recovery mapping bypass, unchanged Pi gate/B2 observer, AC-1/C4 preservation, and an unfired P6 probe.
• Authority: STEP-0 SHA-256 verified 4/4 against the supplied BUILD-BRIEF, SPEC-v5, ratification, and red-team records.
• Base: exact 07553ead337a70a9241f826d27571650262b289c; new branch feat/833-constrained-recovery-command; merge-base assertion passed before any commit.
• Constraints: No rebase/pull during build; no live install/symlink or live broker/socket/tmux/systemd/model-stream activation; no self-review, PR, merge, push, or P6 fire. docs/TASKS.md is orchestrator-owned and will not be modified.
• Plan:
  1. Add red-first unit tests against the recovery broker entrypoint for fresh recovery challenge, normal-receipt replay refusal, observable partial-delivery refusal, and the explicit middle-drop negative capability; commit the RED test and preserve its command output.
  2. Implement the recovery command as a thin driver over shared WI-5 broker transitions and the trusted observer seam; it never accepts caller receipt text.
  3. Add the source-resident skill under packages/mosaic/framework/skills/, plus a tmp-only #824 bridge projection test.
  4. Build an unfired, default-3-run P6 standalone real-socket driver; it is not added to package scripts and will not be run.
  5. Run targeted broker/mutator/receipt suites, lint, and format check; report head to mosaic-100 and stop.
• Risks: The observer can only represent an exact latest message. Tail-preserving middle-drop is intentionally not claimed receipt-detectable (T-C residual deferred to WI-7 server evidence).
• Evidence: Original RED test committed at 3b5513bd6efad0c06b599fc759a66cff4286db04; expected UNKNOWN_ACTION is logged in /home/hermes/agent-work/reviews/833-wi6-red.log. B1/B2 repair RED is f4beedc3e7ac2e142dcbdeefb0e5ee40c20d9b86 in /home/hermes/agent-work/reviews/833-wi6-repair-red.log. R2 adversarial RED is committed at 65e2bd71cf360b6f45c86eec0b06ae24494832d8 in /home/hermes/agent-work/reviews/833-wi6-repair-R2-red.log before the literal-only gate source: the private real-gate/real-daemon battery covers every argv position (executable, path, phase, each flag, each value) for command substitution, backticks, parameter/arithmetic expansion, brace/tilde, process substitution, glob, redirects, control operations, embedded newline, and quotes. P6 remains rebuilt and unfired. The ordinary package Vitest/lint/typecheck/root-format commands cannot resolve their executables in this intentionally dependency-free fresh worktree (node_modules absent); no install/symlink workaround was used.
• Budget: No explicit task token cap was supplied; scope is fixed to WI-6 and no unrelated behavior will be added.