[Nickfost]

Summary

• Add opt-in mutating remote-reconcile.sh --ref FULL_LOWERCASE_40_SHA for same-policy, same-runtime-engine drained recovery without moving/following default-branch HEAD.
• Preserve existing approval/required-check, strict validation, secret scan, installer lock/transaction and full health paths. Reject active/disabled states, controller/fleet/resource/routing/engine changes. Allow only additive reviewed managed image identities for the unchanged current engine.
• Require applied receipt and state/runtime readback; reject silent LKG persistence failures, read back candidate metadata and recover only to the verified drained baseline. Never automatically admit work.

TDD / local evidence

Base: eea07703cc9d3a05e47724405adc824dead09890
Proposed head: b8673d926a31b741c094f246d35446093d32da42

Observed RED before implementation: unsupported --ref (exit 2 unknown argument). Additional RED/GREEN cycles reproduced suppressed LKG write failure returning success, same-ref health shortcut, missing applied receipt, false rollback health/identity verification, stale installed-state readback, silent persistence/readback mismatch, and malformed input creating temp state.

Local WSL/Linux command-double harness (no credentials/network/SSH/Docker/live hosts):

• python3 -I -B scripts/test_explicit_recovery.py: 20 passed.
• python3 -I -B scripts/test_remote_reconcile.py: 44 passed.
• Existing desired-state tests: 33 passed; config-approval tests: 47 passed (isolated Python with explicit local module path to accommodate existing imports).
• bash -n scripts/remote-reconcile.sh scripts/validate.sh: passed.
• Documentation local-link checker: passed; staged diff whitespace and added-line unsafe execution scan: passed.

Incomplete full validation: the exact-source/base scripts/local_validate.py command was attempted and failed preflight because /usr/local/lib/ci-fleet-validation/executor.py is absent. This WSL environment also lacks jq, ShellCheck, Docker and Go; no privileged executor was provisioned and no full/quick acceptance is claimed. Full suite, container/image-build, installer/systemd integration and signed independent evidence remain mandatory on a disposable prepared Linux execution machine. No live-host test was performed.

Documentation and template impact

Added docs/EXPLICIT-DRAINED-RECOVERY.md and linked from docs/ADDING-A-HOST.md. No schema change. Standalone template guidance tracked separately in RandomDevelopment/ci-fleet-config-template#41 (pending; not synchronized or published).

Review / rollout gates

DRAFT for independent review, not merge-ready. New reviewed supporting engine/manager pin and compatible checkpoint staging are required; this is not a flag drop-in for older pinned managers. Review image bootstrap and rollback interactions on the full integration fixtures. Preserve active-pilot/isolation and publication policy gates; no metadata fabrication, private configuration change, pinned guest-source edit, workflow dispatch, merge, deployment or admission is authorized or performed.

P2 correction evidence (b8673d9)

• Strict RED: candidate-written/readback-failed reproduced exit 2 with the real live-record approval guard rejecting baseline; rollback probe exit 1 without output incorrectly recorded rolled_back. Fresh maintenance report plus exit 1 also incorrectly succeeded.
• GREEN: atomically restore the retained verified baseline record before live approval/checkpoint checks; fresh report plus matching health command exit required (maintenance 0, warning 1). No approval or checkpoint bypass.
• Isolated WSL command-double suites: explicit recovery 26 passed (earlier 20 retained plus 6 regressions), remote reconcile 44 passed, health 61 passed, configuration approval 47 passed. bash -n and Markdown local links (45 files) passed. Full prepared-executor acceptance remains incomplete as documented above.
• Updated docs/EXPLICIT-DRAINED-RECOVERY.md: installed-drained only, no bootstrapability claim, old 312 manager unsupported, protected activation checkpoint required for image-free baseline. Template follow-up remains issue Prevent manager validation from mutating immutable release tree #41, pending.
• Exact-head GitHub readback: draft/open; no check runs/status contexts reported (combined status pending). No merge, deployment, workflows or host/private configuration changes.

[Nickfost]

@codex review

Please review exact head b8673d9, including explicit drained-ref policy and the rollback fixes. If no actionable findings remain, explicitly state the clean result for this exact full commit. Prior delegated review and hosted full-suite success are context, not substitutes for your independent review. No merge or deployment is requested.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T03:04:25.168870Z	b8673d9	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: b8673d926a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b8673d926a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Exclude the current transaction failure from rollback health

When explicit recovery rolls back after final-health rejection or LKG-persistence failure, the manager has already persisted reconciliation status failed. The subsequent full probe reads that record, and scripts/health.py:191–196 treats it as a critical health failure. Consequently, even a correctly restored, otherwise healthy drained baseline reports unhealthy, and this new verification rejects it instead of recording verified rollback. This reproduces with the production health evaluator; the command-double tests miss it because their health reports ignore reconciliation state. Use a nonterminal rollback-in-progress state or otherwise isolate the current transaction's failure from the rollback probe while preserving actual host-health checks.

Useful? React with 👍 / 👎.