Verify full-scope current containment for management recovery #2840

Parent-Issue: #2822
Blocked-By: #2827

Objective

Produce independently repeatable current containment evidence for a complete, explicitly approved ordinary management recovery scope, including every original generation and the exact replacement consumer, without authorizing recovery or changing existing observation profiles.

Context

This is the missing current-containment prerequisite discovered while implementing #2824. The existing observer correctly supports one selected manager/proxy pair and an external exclusive owner fence. Recovery requires multiple retained generations and issuer-acquired shared fences, so passing existing observations cannot establish the joined scope. The new profile remains on the existing local system Docker engine and ordinary bootstrap trust boundary. It does not change NEW/#2672, the existing ordinary/quarantined profiles, or the original-history policy.

Inspected baseline: e742338. Relevant production sources are containment_observation.py, containment_kernel_subobservation.py, containment_route_manifest.py, installed_bootstrap_source.py and proxy_watch_cli.py. The watcher already takes its original proxy-watch.lock exclusively before tick/reconcile; those actual controller locks are usable custody resources, whereas an invented lock file would not establish controller inhibition. The integration audit is in Draft PR #2838.

Requirements

REQ-601: Read only a protected deployment-fixed finite recovery enrollment and exact full-scope membership for the local system Docker engine, all original manager/proxy objects, source/configuration/root/owner identities, installed watcher/controller identities and one separate exact target consumer; independently enumerate the entire engine and reject unknown, omitted, aliased or changing management candidates, unsupported profiles and request/environment root overrides, treating enrollment as scope selection rather than technical closure or history.
REQ-602: Independently bind every selected original and target to its actual image/package source closure, supported ordinary bootstrap/proxy command, unshadowed mounts and effective protected configuration; recognize the current original-history-capable ordinary bootstrap in this new profile only, preserve unknown/failed original outcomes, and leave legacy ordinary/quarantine and NEW/private-engine admission unchanged.
REQ-603: Independently repeat complete current system/user systemd, timer/socket/path, cron/at, installed local/remote-script and Docker restart-route observations over the union of selected generations and target; all ordinary restart/recreate/alternate-root routes must be enrolled and technically inhibited, every existing watcher must match its actual configuration/source and original proxy-watch.lock, and unknown or unsupported remote origins refuse rather than accepting a manifest or operator list as proof.
REQ-604: For each originally started manager/proxy, verify exact original boot/process/cgroup lifetimes, every remaining cgroup task, retained current namespace-object custody and endpoint-listener absence, without inferring absence from stopped Docker or recycled historical namespace numbers; report never-started objects distinctly without inventing old lifetimes, owner files or historical never-created evidence, leaving their historical justification to the issuer's independent original-provenance join, and allow the exact target to run only under its separately checked identity and disjoint namespace/roots without hiding old tasks or listeners.
REQ-605: Independently verify issuer-acquired shared custody of every existing original owner inode and exclusive custody of every real existing watcher/controller lock using canonical protected paths, file identities, kernel flocks and current holder lifetimes; accept only actual retained namespace/resource descriptors, never relabel inherited shared descriptors as independent acquisition, create no locks or controller changes, and assert no exclusion during the historical gap.
REQ-606: Return non-authorizing typed observations bound to scope/source/resources and the current observer lifetime, and provide a separate-consumer verifier that repeats all actual observations and rejects forged, foreign, omitted, mutated, stale, exited-holder or partial evidence; production-entrypoint tests in an isolated initial-namespace systemd/Docker VM must exercise multiple genuine original generations, failed branches, the exact target, actual overlapping shared/exclusive custody, unknown routes, escaped/nonleader tasks, occupied namespaces/listeners, source/configuration mutation and producer/holder death, preserving original records and unrelated workers and distinguishing component fixtures from native closure evidence.
REQ-607: Document the exact supported recovery profile, actual source and resource authorities, read-only interfaces, unavailable reasons and native reproduction; assess production observability and provide runnable evidence that current observations create no operation admission, dispatch, recovery-success or readiness event.

Acceptance Scenarios

• AS-T01 (REQ-601, REQ-602, REQ-603, REQ-606): Observe a genuine isolated multi-generation ordinary scope plus its exact replacement through the production entrypoint and a separate verifier. Add an omitted stopped manager, alternate-root route, changed source/configuration or foreign engine and require an exact refusal without reducing the observed engine scope.
• AS-T02 (REQ-603, REQ-605, REQ-606): Exercise actual Docker restart, old/new proxy watchers, systemd/timer/socket/path and cron routes. Observe existing controller locks and material lock overlap. An enabled, unsupported, missing or replaced route/lock refuses; watcher reconstruction/reconcile cannot bypass its actual fence.
• AS-T03 (REQ-604, REQ-605, REQ-606): Independently acquire shared original-owner fences while actual namespace resources are pinned. An escaped/nonleader task, occupied namespace/listener, reused historical namespace number, replaced owner file, inherited-as-independent descriptor or dead resource holder refuses. Separate never-started evidence remains a current observation and supplies no historical terminal claim.
• AS-T04 (REQ-601, REQ-602, REQ-604, REQ-606): Substitute a target's Docker identity, source, roots or namespace; refuse instead of using its membership to hide an old generation. Old objects and unrelated worker state remain unchanged.
• AS-T05 (REQ-605, REQ-606, REQ-607): Mutate original evidence/resources between producer and independent verifier or kill the producer/holder. A saved positive report never replaces current observations, and no recovery-success or grant event follows unavailable evidence.

Non-goals

No stopping, starting, restarting, controller inhibition, enrollment mutation, migration, deployment, worker/OAuth operation, original history repair, recovery grant, new Docker broker, global maintenance mode, reboot or stronger hostile-agent boundary. No relaxation of the existing ordinary, quarantined-original or NEW admission contracts.

Preflight ownership

One bounded current observation producer extends the declared scope and retained-resource contract of #2827. It can independently establish non-authorizing current facts without a history-completeness claim or a recovery grant. The original provenance producer owns historical coverage. #2824 owns exact matching to that history, final target/READY validation, retained consumer custody, deployment-wide persistence and at-most-one grant, retaining all REQ-101 through REQ-108 and every integrated AS-B01 through AS-B05 obligation.