fix(raw-authority): make frontier recovery executable

devtools/validation_lane_catalog_contracts.py

@@ -211,6 +211,7 @@
             "tests/unit/operations/test_mutations.py",
             "tests/unit/operations/test_mutation_actuators.py",
             "tests/unit/operations/test_operation_bindings.py",
+            "tests/unit/maintenance/test_raw_authority_reset.py",
             "tests/unit/annotations/test_importer.py::test_import_roundtrip_keeps_failures_candidates_and_independent_batches",
             "tests/unit/cli/test_excise.py::TestExciseStandalone::test_yes_applies_excision",
         ),
@@ -222,6 +223,7 @@
             "blackboard-post-loop",
             "assertion-candidate-capture-loop",
             "raw-authority-blocker-resolution-loop",
+            "raw-authority-recovery-loop",
             "saved-view-mutation-loop",
             "recall-pack-mutation-loop",
             "workspace-mutation-loop",
@@ -243,6 +245,11 @@
             "raw_authority_plans",
             "raw_authority_blockers",
             "raw_authority_blocker_resolution",
+            "raw_authority_census_ledger",
+            "raw_authority_census_recovery_receipt",
+            "raw_revision_heads",
+            "raw_revision_applications",
+            "raw_authority_index_seed_recovery_receipt",
         ),
         operation_targets=(
             "mutate-add-tag",
@@ -261,6 +268,8 @@
             "mutate-update-index",
             "mutate-rebuild-insights",
             "mutate-resolve-raw-authority-blocker",
+            "mutate-reset-raw-authority-census",
+            "mutate-prune-orphaned-index-revision-seeds",
             "mutate-save-saved-view",
             "mutate-delete-saved-view",
             "mutate-save-recall-pack",

devtools/verify_raw_authority_frontier_executability.py

@@ -8,8 +8,8 @@
 each paired with a ``RawAuthorityActuator``. Only actuators with a real
 ``apply()`` dispatch branch (``_APPLY_DISPATCHED_ACTUATORS``) promise
 "something automatically executes this"; only states in ``_EXECUTABLE_STATES``
-are ever selected by the daemon or the operator break-glass path
-(``item.executable``). polylogue-w32w found a state (``UNRESOLVED_PROVENANCE``)
+are ever selected by daemon convergence (``item.executable``).
+polylogue-w32w found a state (``UNRESOLVED_PROVENANCE``)
 paired with a dispatched actuator (``REFINE_QUARANTINE``) that was NOT in
 ``_EXECUTABLE_STATES`` -- 4,174 blockers demanded an actuator no path could
 ever select, and the gap accumulated silently for weeks because nothing
@@ -200,16 +200,16 @@ def _format_report(report: ExecutabilityReport, *, path: Path) -> str:
         lines.append("")
         lines.append(
             "Frontier states pairing a dispatched actuator with a non-executable "
-            "state -- no path (daemon or operator) would ever select these:"
+            "state -- daemon convergence would never select these:"
         )
         for pair in report.violations:
             lines.append(
                 f"  {rel}:{pair.lineno}: {pair.callee}(state={pair.state}, actuator={pair.actuator}) -- "
                 f"{pair.actuator} has an apply() dispatch branch but {pair.state} is not in _EXECUTABLE_STATES"
             )
         lines.append(
-            "  Fix: either add the state to _EXECUTABLE_STATES (and prove the daemon/operator "
-            "path can safely select it), or pair this classification with a non-dispatched "
+            "  Fix: either add the state to _EXECUTABLE_STATES (and prove the daemon "
+            "convergence path can safely select it), or pair this classification with a non-dispatched "
             "actuator (RawAuthorityActuator.NONE, REACQUIRE, or REQUEST_JUDGMENT)."
         )
     if report.dynamic_sites:

docs/daemon.md

@@ -24,9 +24,9 @@ polylogued status
 Raw-evidence authority is an ordinary daemon invariant. After bounded raw
 materialization, the daemon records one complete accepted-frontier census,
 applies only byte/provenance-safe plans, and leaves conflicts or missing bytes
-as durable remediation references in status. Operators can inspect the same
-ledger with `polylogue ops maintenance raw-authority-frontier`; its apply
-options are break-glass controls for exact plan IDs, not routine maintenance.
+as durable remediation references in status. Operators can inspect and record the same census, without applying plans, with `polylogue ops maintenance raw-authority-frontier`.
+
+The separate `raw-authority-recovery` command is not part of this daemon-owned convergence route. It is an explicit offline operator-maintenance action: it refuses while `polylogued` is running, takes archive ownership and the rebuild lease, and leaves a restartable receipt trail under the archive root.
 
 ## Auto-Discovery
 

docs/evidence/polylogue-xeck9-cursor-authority-census-2026-08-04.md

@@ -50,7 +50,7 @@ The live cursor is ahead of its accepted full-head frontier. That is production
 
 ## Safe reconciliation contract, not performed
 
-There is no cursor-specific dry-run/apply actuator that can safely repair this condition without re-running the real ingest path. Do not use raw-authority frontier application as a shortcut: it is a different break-glass workflow and may persist census observations. The safe sequence for an operator is:
+There is no cursor-specific dry-run/apply actuator that can safely repair this condition without re-running the real ingest path. Do not use raw-authority frontier inspection as a cursor repair shortcut: it records census observations, while daemon convergence applies only executable proof-backed plans under its writer coordinator, and neither path reconciles the cursor condition. The safe sequence for an operator is:
 
 1. Stop or confirm quiescence of the daemon, then capture a backup plan and an initial read-only full status receipt:
 

docs/maintenance.md

@@ -798,6 +798,36 @@ confirm-flag-strength authorization bound to that plan's hash, refusing
 (`preview_stale`) if the blocker was concurrently resolved between preview
 and confirm.
 
+### Raw-authority frontier ownership and recovery
+
+Routine raw-authority frontier application is daemon-owned. The daemon selects
+only executable proof-backed plans under the writer coordinator and validates
+the typed application receipt. `polylogue ops maintenance raw-authority-frontier`
+records an inspection census only; it has no manual plan selector or apply
+option.
+
+### `polylogue ops maintenance raw-authority-recovery` - guarded offline ledger recovery
+
+This command family is the only operator route for the two callerless raw-authority recovery actuators. It is inspect-only by default. The census reset removes only the five poisoned census-planning tables after a verified source-tier backup. The index-seed prune removes only active-index `raw_revision_heads` and `raw_revision_applications` rows whose source raw is absent. Parser census rows, source raws, blob receipts, and present-source revision rows are outside both target sets.
+
+Write an exact plan first, then apply that same plan with the required backup authority:
+
+```bash
+polylogue ops maintenance raw-authority-recovery \
+  --operation reset_raw_authority_census \
+  --plan-file /realm/tmp/work/raw-authority-census-reset.plan.json \
+  --backup-manifest /realm/staging/polylogue-backup/manifest.json \
+  --output-format json
+
+polylogue ops maintenance raw-authority-recovery \
+  --operation reset_raw_authority_census --apply \
+  --plan-file /realm/tmp/work/raw-authority-census-reset.plan.json \
+  --backup-manifest /realm/staging/polylogue-backup/manifest.json \
+  --output-format json
+```
+
+Apply is explicitly an offline operator-maintenance route, not a daemon-writer route. It refuses a running daemon, stale plan or active pointer, changed tier bytes or schema versions, malformed ledger, unexpected candidate set, mismatched backup authority, or changed unrelated rows. It acquires archive ownership and the rebuild lease before revalidation. Before the SQLite mutation it persists an fsynced immutable intent, including the complete plan, under `<archive-root>/.maintenance-state/raw-authority-recovery/`; a source-ledger reset also persists the established source-train continuity intent before committing. Each receipt-directory parent is fsynced while walked. A restart finalizes that intent into the self-hashed receipt only when the planned candidate rows are absent and every planned retained row matches; later append-only index successors are allowed. An uncommitted intent goes back through PREPARE, AUTHORIZE, and EXECUTE. Receipt destinations are restricted to that archive-owned durable location and are published through descriptor-relative no-follow operations that accept regular files only. If the external plan file was lost after a final-receipt failure, rerun `--apply --operation-id <shown-operation-id>` to resume the archive-owned intent, retaining `--receipt-file` when the original plan used a custom archive-owned receipt destination. It does not invoke the broad index reset or reparse path.
+
 ### Measuring Codex UUID-title coverage
 
 Codex sessions without a resolvable title (thread name / authored history /

docs/plans/mutation-census.yaml

@@ -154,6 +154,9 @@ rows:
       - polylogue.mcp.server_cutover._dispatch_write (operation=delete_annotation, via delete_annotation)
 
   # --- Phase 3: executor-routed (raw-authority blocker resolution) -----------
+  # Routine raw-authority frontier application is intentionally not an
+  # operator mutation row. It is a daemon convergence sub-route under the
+  # writer coordinator; the operator frontier command is inspection-only.
   # Tonight-discovered operator gap (2026-07-21/22): resolve_raw_authority_
   # blocker had a working CLI adapter (raw-authority-blocker-resolve, its own
   # --yes gate) but NO census entry and no authorization path shared with any
@@ -170,6 +173,26 @@ rows:
     adapters:
       - polylogue.cli.commands.maintenance._raw_identity.raw_authority_blocker_resolve_command
 
+  - operation: mutate-reset-raw-authority-census
+    spec_name: mutate-reset-raw-authority-census
+    status: executor-routed
+    execution_owner: offline-operator-maintenance
+    recovery_continuation: offline-durable-intent
+    actuator: polylogue.maintenance.raw_authority_recovery.ResetRawAuthorityCensusActuator
+    surfaces: [cli]
+    adapters:
+      - polylogue.cli.commands.maintenance._raw_authority_recovery.raw_authority_recovery_command
+
+  - operation: mutate-prune-orphaned-index-revision-seeds
+    spec_name: mutate-prune-orphaned-index-revision-seeds
+    status: executor-routed
+    execution_owner: offline-operator-maintenance
+    recovery_continuation: offline-durable-intent
+    actuator: polylogue.maintenance.raw_authority_recovery.PruneOrphanedIndexRevisionSeedsActuator
+    surfaces: [cli]
+    adapters:
+      - polylogue.cli.commands.maintenance._raw_authority_recovery.raw_authority_recovery_command
+
   # --- Phase 4: executor-routed (saved-view/recall-pack/workspace family) ----
 
   - operation: mutate-save-saved-view

docs/test-quality-workflows.md

@@ -24,11 +24,11 @@ Current registry snapshot:
 
 ## Runtime Coverage
 
-- covered runtime paths: `37`
-- covered runtime artifacts: `57`
-- covered runtime operations: `55`
+- covered runtime paths: `38`
+- covered runtime artifacts: `62`
+- covered runtime operations: `57`
 - covered maintenance targets: `5`
-- covered declared operation targets: `77`
+- covered declared operation targets: `79`
 - uncovered runtime paths: —
 - uncovered runtime artifacts: —
 - uncovered runtime operations: —
@@ -399,7 +399,7 @@ These projections explain which executable lanes, inferred fixture scenarios, or
 | `validation-lane` | `maintenance-workflows` | — | — | — | — | — | — | `contract`<br>`maintenance` | Health, maintenance selection, cache/live provenance, and machine output |
 | `validation-lane` | `memory-budget` | `session-query-loop` | `message_fts`<br>`session_query_results` | — | — | `query-sessions` | — | `live`<br>`retrieval`<br>`readiness` | Live archive grouped retrieval command under an explicit RSS budget |
 | `validation-lane` | `mixed-consumer-contracts` | — | — | — | — | — | — | — | CLI, facade, and readiness surfaces consuming the same evidence/inference insight model |
-| `validation-lane` | `mutation-routes` | `tag-mutation-loop`<br>`metadata-mutation-loop`<br>`mark-mutation-loop`<br>`annotation-mutation-loop`<br>`blackboard-post-loop`<br>`assertion-candidate-capture-loop`<br>`raw-authority-blocker-resolution-loop`<br>`saved-view-mutation-loop`<br>`recall-pack-mutation-loop`<br>`workspace-mutation-loop`<br>`correction-mutation-loop`<br>`session-delete-loop`<br>`session-excision-loop`<br>`identity-reset-loop`<br>`message-fts-readiness-loop`<br>`session-insight-repair-loop` | `sessions`<br>`assertions`<br>`archive_deleted_session`<br>`raw_sessions`<br>`blob_refs`<br>`excision_receipt`<br>`suppression_rows`<br>`raw_authority_plans`<br>`raw_authority_blockers`<br>`raw_authority_blocker_resolution` | — | — | `mutate-add-tag`<br>`mutate-remove-tag`<br>`mutate-bulk-tag-sessions`<br>`mutate-set-metadata`<br>`mutate-delete-metadata`<br>`mutate-add-mark`<br>`mutate-remove-mark`<br>`mutate-save-annotation`<br>`mutate-delete-annotation`<br>`mutate-blackboard-post`<br>`mutate-capture-assertion-candidate`<br>`mutate-import-annotation-batch`<br>`mutate-rebuild-index`<br>`mutate-update-index`<br>`mutate-rebuild-insights`<br>`mutate-resolve-raw-authority-blocker`<br>`mutate-save-saved-view`<br>`mutate-delete-saved-view`<br>`mutate-save-recall-pack`<br>`mutate-delete-recall-pack`<br>`mutate-save-workspace`<br>`mutate-delete-workspace`<br>`mutate-record-correction`<br>`mutate-delete-correction`<br>`mutate-clear-corrections`<br>`mutate-delete-session`<br>`mutate-session-excision`<br>`mutate-identity-reset` | — | `contract`<br>`mutation`<br>`operation-executor` | Executor-routed mutation actuators and transaction receipts over their declared runtime closures |
+| `validation-lane` | `mutation-routes` | `tag-mutation-loop`<br>`metadata-mutation-loop`<br>`mark-mutation-loop`<br>`annotation-mutation-loop`<br>`blackboard-post-loop`<br>`assertion-candidate-capture-loop`<br>`raw-authority-blocker-resolution-loop`<br>`raw-authority-recovery-loop`<br>`saved-view-mutation-loop`<br>`recall-pack-mutation-loop`<br>`workspace-mutation-loop`<br>`correction-mutation-loop`<br>`session-delete-loop`<br>`session-excision-loop`<br>`identity-reset-loop`<br>`message-fts-readiness-loop`<br>`session-insight-repair-loop` | `sessions`<br>`assertions`<br>`archive_deleted_session`<br>`raw_sessions`<br>`blob_refs`<br>`excision_receipt`<br>`suppression_rows`<br>`raw_authority_plans`<br>`raw_authority_blockers`<br>`raw_authority_blocker_resolution`<br>`raw_authority_census_ledger`<br>`raw_authority_census_recovery_receipt`<br>`raw_revision_heads`<br>`raw_revision_applications`<br>`raw_authority_index_seed_recovery_receipt` | — | — | `mutate-add-tag`<br>`mutate-remove-tag`<br>`mutate-bulk-tag-sessions`<br>`mutate-set-metadata`<br>`mutate-delete-metadata`<br>`mutate-add-mark`<br>`mutate-remove-mark`<br>`mutate-save-annotation`<br>`mutate-delete-annotation`<br>`mutate-blackboard-post`<br>`mutate-capture-assertion-candidate`<br>`mutate-import-annotation-batch`<br>`mutate-rebuild-index`<br>`mutate-update-index`<br>`mutate-rebuild-insights`<br>`mutate-resolve-raw-authority-blocker`<br>`mutate-reset-raw-authority-census`<br>`mutate-prune-orphaned-index-revision-seeds`<br>`mutate-save-saved-view`<br>`mutate-delete-saved-view`<br>`mutate-save-recall-pack`<br>`mutate-delete-recall-pack`<br>`mutate-save-workspace`<br>`mutate-delete-workspace`<br>`mutate-record-correction`<br>`mutate-delete-correction`<br>`mutate-clear-corrections`<br>`mutate-delete-session`<br>`mutate-session-excision`<br>`mutate-identity-reset` | — | `contract`<br>`mutation`<br>`operation-executor` | Executor-routed mutation actuators and transaction receipts over their declared runtime closures |
 | `validation-lane` | `pipeline-probe-chatgpt` | `source-acquisition-loop`<br>`raw-reparse-loop`<br>`raw-archive-ingest-loop` | `configured_sources`<br>`source_payload_stream`<br>`raw_validation_state`<br>`artifact_observation_rows`<br>`validation_backlog`<br>`parse_backlog`<br>`parse_quarantine`<br>`archive_session_rows` | — | — | `acquire-raw-sessions`<br>`plan-validation-backlog`<br>`plan-parse-backlog`<br>`ingest-archive-runtime` | — | — | Synthetic ChatGPT parse-stage pipeline probe under explicit runtime and RSS budgets |
 | `validation-lane` | `probabilistic-enrichment-cleanup-live` | `archive-debt-query-loop`<br>`message-fts-readiness-loop`<br>`retrieval-band-readiness-loop` | `archive_readiness`<br>`embedding_status_results`<br>`message_fts`<br>`archive_debt_results`<br>`session_insight_readiness`<br>`retrieval_band_readiness` | — | — | `query-archive-debt`<br>`cli.json-contract`<br>`project-archive-readiness` | — | `insights`<br>`debt`<br>`live`<br>`maintenance`<br>`preview` | Bounded live archive lane for cleanup/debt preview and maintenance budgets |
 | `validation-lane` | `probabilistic-enrichment-contracts` | — | — | — | — | — | — | — | Session-enrichment contracts across CLI, facade, storage, and retrieval-band status |

polylogue/artifacts/runtime.py

@@ -635,6 +635,46 @@
         code_refs=("polylogue.operations.mutation_actuators.BlockerResolveActuator",),
         readiness_surfaces=("cli", "maintenance"),
     ),
+    ArtifactNode(
+        name="raw_authority_census_ledger",
+        layer=ArtifactLayer.DURABLE,
+        description="Poisonable source-tier census-planning bookkeeping cleared only by guarded recovery.",
+        depends_on=("raw_sessions",),
+        code_refs=("polylogue.maintenance.raw_authority_recovery",),
+        readiness_surfaces=("cli", "maintenance"),
+    ),
+    ArtifactNode(
+        name="raw_authority_census_recovery_receipt",
+        layer=ArtifactLayer.DURABLE,
+        description="Immutable receipt for a guarded raw-authority census-ledger recovery.",
+        depends_on=("raw_authority_census_ledger",),
+        code_refs=("polylogue.maintenance.raw_authority_recovery",),
+        readiness_surfaces=("cli", "maintenance"),
+    ),
+    ArtifactNode(
+        name="raw_revision_heads",
+        layer=ArtifactLayer.PROJECTION,
+        description="Active-index raw revision frontier heads used by orphan-seed recovery.",
+        depends_on=("raw_sessions",),
+        code_refs=("polylogue.storage.sqlite.archive_tiers.index",),
+        readiness_surfaces=("cli", "maintenance"),
+    ),
+    ArtifactNode(
+        name="raw_revision_applications",
+        layer=ArtifactLayer.PROJECTION,
+        description="Active-index raw revision decisions used by orphan-seed recovery.",
+        depends_on=("raw_sessions",),
+        code_refs=("polylogue.storage.sqlite.archive_tiers.index",),
+        readiness_surfaces=("cli", "maintenance"),
+    ),
+    ArtifactNode(
+        name="raw_authority_index_seed_recovery_receipt",
+        layer=ArtifactLayer.DURABLE,
+        description="Immutable receipt for a guarded active-index orphan-seed prune.",
+        depends_on=("raw_revision_heads", "raw_revision_applications"),
+        code_refs=("polylogue.maintenance.raw_authority_recovery",),
+        readiness_surfaces=("cli", "maintenance"),
+    ),
 )
 
 RUNTIME_ARTIFACT_PATHS: tuple[ArtifactPath, ...] = (
@@ -920,6 +960,18 @@
         description="Raw evidence plans and blockers through their durable operator resolution receipt.",
         nodes=("raw_sessions", "raw_authority_plans", "raw_authority_blockers", "raw_authority_blocker_resolution"),
     ),
+    ArtifactPath(
+        name="raw-authority-recovery-loop",
+        description="Guarded source census reset and active-index orphan-seed recovery with immutable receipts.",
+        nodes=(
+            "raw_sessions",
+            "raw_authority_census_ledger",
+            "raw_authority_census_recovery_receipt",
+            "raw_revision_heads",
+            "raw_revision_applications",
+            "raw_authority_index_seed_recovery_receipt",
+        ),
+    ),
     ArtifactPath(
         name="saved-view-mutation-loop",
         description="Session query context through durable saved-view assertion mutation.",