fix(deploy): reconcile device plane foundation

device-plane/deployment/device-plane-foundation-recovery-v1.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "nodedc.device-plane.foundation-recovery.v1",
+  "mode": "failed-foundation-live-runtime-adoption",
+  "failedPatchId": "device-plane-foundation-20260725-001",
+  "failedArtifactSha256": "23d428de547854ad8b1a026671e2f850386ab0be98bde80f016f1e9db631ee24",
+  "backupId": "device-plane-device-plane-foundation-20260725-001-20260725-223441",
+  "sourceAction": "publish-exact-failed-artifact-source",
+  "runtimeAction": "read-only-acceptance",
+  "preservedServices": [
+    "device-control-core",
+    "device-gateway",
+    "device-postgres"
+  ],
+  "databaseVolume": "nodedc-device-plane-postgres-data",
+  "rollback": "source-only-runtime-unchanged"
+}

device-plane/docs/IMPLEMENTATION_BASELINE.md

@@ -1,7 +1,11 @@
 # Device Plane Implementation Baseline
 
-Status: local fail-closed foundation implemented; no runtime or production
-mutation.
+Status: PostgreSQL, Control Core and Gateway foundation are running healthy on
+Synology with public ingress, discovery ingest and commands disabled. The first
+application artifact is terminal-failed because its health gate timed out and
+its automatic rollback could not model the DB-bootstrap predecessor. Recovery
+is a separate source-only canonical transition; the failed artifact is never
+retried.
 
 ## Product boundary
 
@@ -72,6 +76,14 @@ The canonical runner selects only `device-control-core` and `device-gateway`
 with `--no-deps`. Its health acceptance is scoped to the selected services and
 requires the fail-closed fields to remain disabled. A failed first activation
 removes only candidate stateless services and never requests volume removal.
+Rollback now records an explicit pre-apply service inventory in the backup;
+the existence of the shared Compose file does not imply that Core or Gateway
+existed before apply.
+
+The exact foundation recovery validates the failed archive, journal, backup,
+partial live source and observed healthy image/container generations. It then
+publishes the matching source and performs read-only runtime acceptance. It
+does not build, restart, recreate or remove any service.
 
 ## Network boundary
 
@@ -157,15 +169,13 @@ raw TCP remain forbidden until separate reviewed acceptance slices.
 
 ## Next source slice
 
-1. Review, hash and promote the canonical runner candidate through the
-   standalone root administrative gate; do not stage an application artifact
-   before fresh `verify-install`.
-2. Build, plan and accept the separate one-time PostgreSQL prerequisite
-   bootstrap artifact; ordinary application artifacts must continue to exclude
-   the database service.
+1. Promote the reviewed recovery-capable runner through the standalone root
+   administrative gate and run a fresh `verify-install`.
+2. Plan and apply the exact source-only foundation recovery artifact once, then
+   reconcile its journal/backup and repeat runtime acceptance.
 3. Obtain or capture the exact official B2 INTERNAL framing and acknowledgement
    contract; keep ingress disabled until its fixtures pass.
 4. Add an authenticated internal Core/Gateway discovery boundary and explicit
    platform-admin claim operation.
-5. Build, audit and stage the first deterministic application artifact only
-   after the runner extension is installed and verified.
+5. Open raw TCP ingress only in a later reviewed slice after quarantine,
+   framing, rate-limit and audit acceptance.

device-plane/docs/TEST_MATRIX.md

@@ -20,6 +20,11 @@
 | Database preservation | Ordinary application artifacts never select `device-postgres` |
 | Database bootstrap | Exact descriptor selects PostgreSQL only when both container and volume are absent |
 | Bootstrap rollback | Candidate container may be removed; named volume is never removed |
+| Rollback predecessor | Backup records actual pre-apply services; Compose presence cannot invent Core/Gateway |
+| Failed-001 evidence | Recovery requires exact failed archive, journal and backup digests |
+| Partial source | Recovery accepts only DB-bootstrap source plus the observed healthy foundation runtime |
+| Recovery mutation | Source is published without build, restart, recreate or service removal |
+| Recovery rollback | Failed acceptance restores source only and leaves runtime unchanged |
 | Artifact policy | `.env`, secrets, runtime state, tests, logs and `node_modules` are excluded |
 | Artifact reproducibility | Repeated builds for the same patch id are byte-identical |
 | Runner compatibility | Existing canonical Platform registry tests remain green |