signalproof-recovery

Stop active writes first, preserve evidence and user data, then verify a known-good rollback target before restoring. Clean up resources owned by the failed operation, restore in dependency order, and verify both target identity and behavior before declaring recovery complete.

Rollback selects and verifies the intended known-good target from evidence, while restore executes the bounded restoration and verifies the resulting behavior. The coordinator routes to each specialist separately because choosing a target and switching to it are distinct decisions.

Stop when the only known-good state would be overwritten, user data would be erased outside granted authority, the target identity is ambiguous, cleanup might touch unowned resources, required elevation is unauthorized, or the same failed recovery repeats without new evidence.

Restoring files alone leaves data, services, configuration, ownership cleanup, and verification unresolved. Complete recovery requires explicit confirmation of the restore boundary, cleanup state, protected data, authority, evidence, and remaining rollback options.

The recovery-continuity specialist preserves journals, ownership identities, remaining rollback options, and unresolved recovery state. Explicit statuses like RECOVERED / PARTIAL or AWAITING AUTHORITY record exactly where the recovery stands for later resumption.