stack/docs/scratchpads/833-constrained-recovery-command.md

#833 constrained recovery command — build scratchpad

• Objective: Deliver WI-6 only: the single ungated constrained recovery command, durable mosaic-context-refresh wrapper skill, AC-1 observable partial-delivery and C4 replay evidence, and an unfired P6 probe.
• Authority: STEP-0 SHA-256 verified 4/4 against the supplied BUILD-BRIEF, SPEC-v5, ratification, and red-team records.
• Base: exact 07553ead337a70a9241f826d27571650262b289c; new branch feat/833-constrained-recovery-command; merge-base assertion passed before any commit.
• Constraints: No rebase/pull during build; no live install/symlink or live broker/socket/tmux/systemd mutation; no self-review, PR, merge, push, or P6 fire. docs/TASKS.md is orchestrator-owned and will not be modified.
• Plan:
  1. Add red-first unit tests against the recovery broker entrypoint for fresh recovery challenge, normal-receipt replay refusal, observable partial-delivery refusal, and the explicit middle-drop negative capability; commit the RED test and preserve its command output.
  2. Implement the recovery command as a thin driver over shared WI-5 broker transitions and the trusted observer seam; it never accepts caller receipt text.
  3. Add the source-resident skill under packages/mosaic/framework/skills/, plus a tmp-only #824 bridge projection test.
  4. Build an unfired, default-3-run P6 standalone real-socket driver; it is not added to package scripts and will not be run.
  5. Run targeted broker/mutator/receipt suites, lint, and format check; report head to mosaic-100 and stop.
• Risks: The observer can only represent an exact latest message. Tail-preserving middle-drop is intentionally not claimed receipt-detectable (T-C residual deferred to WI-7 server evidence).
• Budget: No explicit task token cap was supplied; scope is fixed to WI-6 and no unrelated behavior will be added.