[novelKR]

Records the qualification of Gateway recovery (P1-RECOVERY) by P1R-C06: what the runs on the frozen candidate 1c0eadd showed, the supported modes, and the three harness corrections that came before it. Documentation only: the code tree stays the candidate's.

No pin change. No change to the installed service, the DevGuard release or the policy.

Issue

Part of #101: P1R-C06, its report (the CodeSpace side of PR7). This PR does not close an issue. DevGuard's milestone ledger records the result in its own PR after this one merges.

Item	Value
Base	main at 1c0eadd (#115's merge), the candidate
Head	30165c9
Code tree	SHA-256 cb18534dedbd001a1de2f42c930ee303d41791dee279a36a7e5fe1b7de808d38 on the base and on the head, as the candidate suite recorded it; everything this PR changes is under docs/
Pins	Codex gitlink 6b9826e3 with the recorded patch, DevGuard 6e7e065; both unchanged

Summary

Before: the protocol and its harness were frozen in #112, and #113, #114 and #115 each corrected the harness and made a new candidate. The protocol and the guides said that no combination was qualified yet, so the independent Runner was not a supported mode anywhere.

After: the independent Runner is qualified on macOS for one exact combination: CodeSpace 1c0eadd (or a later commit with the same code tree), DevGuard's client 6e7e065, the release 0.1.0-6e7e065-94d85365 under the policy with the codespace consumer, Codex 6b9826e with the recorded patch, and Rust 1.95.0. It covers uds with --runner-lifecycle independent and a Runner the operator starts, pipe and PTY executions, participations off and required, and both in one gateway. Linux off is CI functional verification only, Linux required stays unsupported until DG-LINUX, and restoring processes after the Runner itself restarts stays unsupported. The independent mode stays opt-in, and the default stays in-process.

How.

• docs/recovery-qualification-report.md, new, with its Korean translation: each claim with its level, the exact combination, every run with its result, the functional suites' check counts, the six intervals of the restart measurement, the completion evidence, the regressions, the amendments, the evidence directories with their MANIFEST.json SHA-256 (the 23 of the earlier candidates included), and what stays outside P1-RECOVERY.
• docs/recovery-qualification.md, docs/runner-isolation.md, docs/operations.md and docs/devguard-integration.md, with their translations: the status lines name the qualified combination and link the report.
• docs/translations.json: the new pair, in the project group after the protocol, and the recorded hashes of the changed pairs.

Contract changes

None. No tool schema, error code, status value, ID or code changes.

Tests

The qualification runs, on the qualification host (Mac mini, Apple M1, macOS 27.0), on the candidate's binaries, in the minimal environment with Rust 1.95.0. Each run is sealed, and verify recomputed its verdicts from the raw files:

Run	Result	MANIFEST.json SHA-256
The five check suites	passed: 55 scenarios (34 with off, 21 with required) with 650 checks, none failed; the two gaps recorded as not run	ea8f534f…, 45123bc3…, 299e646f…, a1766269…, 37fcf791…
candidate	passed	c7b26e3d…22ad
recovery --rehearsal	inconclusive only because a rehearsal is shorter than the protocol, as designed; its functional scenarios and both intervals passed	ef5ab907…0894
recovery	qualified: the functional scenarios passed, and all six intervals of the three repetitions	1f6f7ba8…790b
CS-RG's candidate	passed	caff08ef…898f
CS-RG's matrix	passed: 45 of 45 scenarios (22 in in-process, 23 in uds)	33443fce…011f
CS-RG's faults	passed: 27 of 27 cases	bb29b613…5936
CS-RG's authority	passed: 10 of 10 phases	7cebeacf…bb65

The recovery run, from 16:42 to 18:52 UTC on 2026-10-18 under DG-1's cold load against the installed release, in every interval:

Item	Worst interval	Target
Gateway restarts	26 in an idle interval, 76 under load	at least 80% of the plan of one every 25 seconds (24 and 72)
Status p99	3.283 ms	500 ms
Termination acknowledgement p99	0.739 ms	1,000 ms
A timeout target's end after its original deadline	119.4 ms	2,000 ms
Scope ended p99, and DevGuard's release p99	92.6 ms, and 195.3 ms	reported
I/O echo p99, and refusal p99	22.942 ms, and 53.347 ms	reported

After each of the 308 restarts the next gateway found every long-running process running. The other process's 4,710 requests, under the previous, the current or no epoch, were all refused STALE_CONTROLLER and changed nothing, and no rival gateway reached the Runner. Each of the 308 approvals ran its command once, none of the 654 tagged commands that started ran twice, and none of the 233 that were refused ran. No attempt was launched twice, no uncertain attempt was admitted again and nothing stayed charged. In the second repetition's load interval one status slot of each target was missed, so its maximum shows as missing; its p99 was 1.475 ms. DG-1's load made 583 runs, all of which succeeded. Every host sample was at memory pressure level 1, the Runner stayed within the codespace reservation (at most 15.25 MiB, 15 threads and a mean of 2.9 mCPU), and the service kept process ID 23023 throughout. A scan of the 35 directories and the console and verify logs beside them, 13,454 files (282 MiB), found no private key, authorization header, token, credential digest, session variable or environment dump. Its only matches were eight lines of the CS-RG faults run's MANIFEST.json, which pair the files of the credential fault case in each runner mode, whose names contain "credential", with their own SHA-256.

CI on the candidate's commit passed every job twice: the push run after #115's merge (run 39114783991) and the scheduled run with the full profile (run 39169645390).

Verified in the cloud (Linux) on this head:

• python3 scripts/check_docs.py: "Documentation registry verified: 22 paired documents".
• The documentation site with the pinned Node 24.21.0: npm test --prefix docs-site, npm run build --prefix docs-site, python3 -B docs-site/scripts/site.py check and site.py check --commit on this head passed ("Site verified: 195 hashed files, 47 HTML pages").
• The harness's code_tree gives cb18534d…8d38 for this head and for 1c0eadd.
• The report's tables and totals were generated from the summaries of the sealed evidence that the qualification host produced, each checked by its SHA-256, and the Korean page has the same numbers, anchors and table rows.
• The scan's script found every pattern planted in a test tree, printing only names, and nothing in 5,941 files of the harness's own evidence from Linux runs.

CI on this head: passed in run 39194719505: the plan, the policy scan, format and upstream pin, and the rust gate. The plan selected no Rust leg, because nothing outside docs/ changed. The documentation site's run 39194719751 built and checked the site; it deploys only from main.

Security scenarios

• Rollback honesty. The rollback in the operations guide drains the Runner and returns to a combination qualified before (in-process, or uds with --runtime-bin) with the same release and policy, and keeps the operations database. A Runner that was lost is settled as Runner loss, never reported as recovered, and restoring processes after the Runner restarts is claimed as unsupported.
• What is published. The report names hashes of binaries, evidence manifests and DevGuard's qualification record. It names no credential, credential digest, host.toml hash, child environment or host path; the host.toml hash stays in the sealed record on the host. The evidence itself was scanned and holds no credential, credential digest or environment, as above.
• Claims match the evidence. Each claim names its level, and the unsupported modes, the two gaps, the untested replay on the runner wire, the unmeasured warm load and CS-RG's control path, not measured again on this candidate, are stated as such.

Out of scope

• Restoring processes after the Runner itself restarts, making the independent mode the default (a separate decision under DevGuard's ADR-002), DG-LINUX, and any change to DevGuard's release or policy, such as more than one instance for the codespace consumer.
• Any other combination: a new pin, release, policy, host, toolchain or code change is a new candidate.
• Making the gateway's guidance on how long WORKSPACE_BUSY lasts exact, a code change noted in the report's amendments.
• DevGuard's ledger, updated in a follow-up PR in novelKR/DevGuard.