fix(deploy): reconcile device plane foundation

infra/deploy-runner/README.md

@@ -476,6 +476,29 @@ node infra/deploy-runner/build-device-plane-artifact.mjs \
 
 Any failed first activation removes only candidate Core/Gateway containers,
 never volumes, restores the source overlay and retains PostgreSQL state.
+The rollback baseline is taken from an explicit pre-apply Docker service
+inventory stored as `runtime-before.json` in the backup. The presence of the
+shared Compose file never implies that Core or Gateway existed before apply.
+
+The exact `device-plane-foundation-20260725-001` failed activation is recovered
+only through the registered
+`deployment/device-plane-foundation-recovery-v1.json` transition. Its artifact
+must reproduce the failed foundation source byte-for-byte. The runner validates
+the exact failed archive, journal, backup partition, partial live source and
+healthy observed Core/Gateway/PostgreSQL generations. Recovery publishes source
+and performs read-only runtime acceptance; it does not build, recreate, restart
+or remove containers. A failed recovery restores source only and leaves runtime
+unchanged.
+
+Build and test that incident-specific deterministic recovery artifact:
+
+```bash
+python3 -m unittest -v \
+  infra.deploy-runner.test_device_plane_foundation_recovery_artifact
+
+node infra/deploy-runner/build-device-plane-foundation-recovery-artifact.mjs \
+  device-plane-foundation-recovery-20260725-002
+```
 
 After the runner is promoted and freshly verified, bootstrap the durable
 prerequisite with a separate artifact before planning the application: