fix(deploy): reconcile device plane foundation

device-plane/docs/IMPLEMENTATION_BASELINE.md

@@ -1,7 +1,11 @@
 # Device Plane Implementation Baseline
 
-Status: local fail-closed foundation implemented; no runtime or production
-mutation.
+Status: PostgreSQL, Control Core and Gateway foundation are running healthy on
+Synology with public ingress, discovery ingest and commands disabled. The first
+application artifact is terminal-failed because its health gate timed out and
+its automatic rollback could not model the DB-bootstrap predecessor. Recovery
+is a separate source-only canonical transition; the failed artifact is never
+retried.
 
 ## Product boundary
 
@@ -72,6 +76,14 @@ The canonical runner selects only `device-control-core` and `device-gateway`
 with `--no-deps`. Its health acceptance is scoped to the selected services and
 requires the fail-closed fields to remain disabled. A failed first activation
 removes only candidate stateless services and never requests volume removal.
+Rollback now records an explicit pre-apply service inventory in the backup;
+the existence of the shared Compose file does not imply that Core or Gateway
+existed before apply.
+
+The exact foundation recovery validates the failed archive, journal, backup,
+partial live source and observed healthy image/container generations. It then
+publishes the matching source and performs read-only runtime acceptance. It
+does not build, restart, recreate or remove any service.
 
 ## Network boundary
 
@@ -157,15 +169,13 @@ raw TCP remain forbidden until separate reviewed acceptance slices.
 
 ## Next source slice
 
-1. Review, hash and promote the canonical runner candidate through the
-   standalone root administrative gate; do not stage an application artifact
-   before fresh `verify-install`.
-2. Build, plan and accept the separate one-time PostgreSQL prerequisite
-   bootstrap artifact; ordinary application artifacts must continue to exclude
-   the database service.
+1. Promote the reviewed recovery-capable runner through the standalone root
+   administrative gate and run a fresh `verify-install`.
+2. Plan and apply the exact source-only foundation recovery artifact once, then
+   reconcile its journal/backup and repeat runtime acceptance.
 3. Obtain or capture the exact official B2 INTERNAL framing and acknowledgement
    contract; keep ingress disabled until its fixtures pass.
 4. Add an authenticated internal Core/Gateway discovery boundary and explicit
    platform-admin claim operation.
-5. Build, audit and stage the first deterministic application artifact only
-   after the runner extension is installed and verified.
+5. Open raw TCP ingress only in a later reviewed slice after quarantine,
+   framing, rate-limit and audit acceptance.