docs(recovery): rebase restore overlay onto merged main

[cursor]

Why this exists

PR #192 moved from eafbfa9 to 229f8d3 by merging protected main. That rebase did not fix the product/technical overlay: the PRD and TRD still present predecessor #209 as the active pg_restore path, and FR-3 still reads as if arbitrary SQL cannot call set_config.

Draft #213 already carried the overlay, but it is based on eafbfa9 and is now stale. This branch replays the same alignment on the current #192 head so operators do not follow an unsafe restore contract.

Operator action

• Do not merge docs: rebuild canonical product and technical contracts #192 at 229f8d3.
• Do not merge docs(recovery): align restore overlay with successor #212 #213 at f44ec24.
• Do not merge feat(recovery): restore bounded PostgreSQL logical archives #209 at afbe449.
• Review this successor for the documentation overlay only.
• Keep feat(recovery): execute bounded logical PostgreSQL backups #208 and fix(recovery): accept custom-format restore seek positions #212 as the source writers for backup/restore execution.
• After this lands, continue Issue [Resilience/Acquisition] Establish tested PostgreSQL backup and PITR recovery contract #204 with a live isolated custom-format restore drill rather than another five-file rewrite.

What changed

• PRD restore capability now names Draft fix(recovery): accept custom-format restore seek positions #212 as the successor and freezes feat(recovery): restore bounded PostgreSQL logical archives #209.
• PRD FR-3 now states that a role with arbitrary SQL can call set_config; RLS does not prevent that.
• TRD restore paragraph matches the same overlay split, including metadata-fingerprint verification.
• FITNESS and TRACEABILITY register Draft fix(config): sync mandatory Fernet operator contract #210 as the Fernet operator-contract successor to fix(config): separate provisioning and require secret encryption #193, and freeze stale docs(recovery): align restore overlay with successor #212 #213.

No runtime source, schema, workflow, or package metadata changes.

Refs #192, #209, #212, #210, #213, #204.

  

[cursor]

Stale comment

Review: COMMENT at 85949a2

Five-file documentation overlay only. No runtime, schema, workflow, or package-metadata changes.

The predecessor defects this overlay exists to close are closed:

• PRD restore row, TRD restore paragraph, FITNESS, and TRACEABILITY freeze #209. Its EOF-consumption postcondition is not a merge path for seekable PostgreSQL custom archives.
• Draft #212 is named only as the ACTIVE-PR successor. It is not implied shipped. ADR README does not list proposed ADR 0016 as a protected-main decision.
• PRD FR-3 and FITNESS state that a role with arbitrary SQL can call set_config for an arbitrary tenant scope. RLS is defense in depth, not a credential. That matches AGENTS.md, CLAUDE.md, and ADR 0002.

Do not merge #192 at 229f8d3, stale #213 at f44ec24, or #209 at afbe449. Do not race #208 or #212 source writers.

No RIGHT-side must-fix. Land this overlay only after every then-live required check is terminal-success on unchanged 85949a2243d79135c0a2ee4722b4c94fb96662bd. Queued or predecessor evidence does not transfer.

Residual

Sibling Draft #215 (fc7561d) appeared concurrently and binds recovery receipts from exact schema/backup evidence. It is a separate writer. TRACEABILITY already says the overlay register is descriptive and requires a GitHub refetch. Do not fold #215 into this five-file lane.

After this lands, continue Issue #204 with an isolated custom-format restore drill rather than another five-file rewrite.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Canonical-fitness blocker on exact head 85949a2243d79135c0a2ee4722b4c94fb96662bd: the durable product/status documents encode transient PR-state text that is already false. docs/product/PRD.md and docs/DOCUMENTATION_FITNESS.md repeatedly call #212 Draft, while fresh GitHub state has #212 Ready/mergeable at exact head 63a89c7b39d5dad87c7186bdbeaae2c2043f1b66. The same branch's own non-negotiable invariant says transient PR/check state belongs in PR/review evidence, not durable architecture/product documents. The cursor review was accurate when submitted but has been overtaken by repository state.

Please repair this canonical lane narrowly after a fresh full PR/branch inventory: describe #209 as the superseded unsafe predecessor and #212 as the unshipped active successor without persisting Draft/Ready or an exact transient head. Keep protected-main claims unchanged. Also re-evaluate the recovery status paragraph/matrix against newly active #215/#216/#217: it need not enumerate every transient PR, but it must not imply the active recovery graph consists only of #208/#212 now that receipt binding, catalog acceptance, and physical/WAL/PITR profile slices exist. Prefer stable capability-state language (logical execution, post-restore acceptance, evidence binding, physical/PITR profile) over volatile PR state.

No runtime/source change is requested. Keep #214 Draft until the canonical status vocabulary is internally self-consistent and fresh.

[cursor]

Review: COMMENT at 8227e82

Do not merge #214. The 85949a2 CHANGES_REQUESTED finding still holds on this head: durable product/status documents persist transient Draft #212 and Draft #210 labels. #212 is Ready on GitHub; those labels are already false.

Successor is #226. It keeps this overlay, removes the Draft/Ready vocabulary, names the adjacent recovery families as capabilities, and adds tests/test_canonical_status_vocabulary.py so the labels cannot return.

Keep #214 Draft. Review and merge #226 after exact-head required checks are terminal-success. Do not race #208 or #212 source writers from this documentation lane.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

This row still freezes Draft #212. #212 is no longer Draft. Successor #226 names #212 only as the unshipped active restore successor and adds the adjacent recovery families (evidence binding, catalog acceptance, physical/PITR profile, restore-target isolation) without Ready/Draft labels.