Dsh Recovery Proof

Key features

• every referenced prestate, rescue, restored or rollback object is a regular workspace file with the declared SHA-256 and revision
• recovery_manifest_inspect for bounded inline manifest validation
• recovery, failed-apply rollback and stale-plan rejection follow the manifest's exact phase sequence
• rescue evidence exists before apply, failed apply is followed by successful rollback, and stale plans are rejected
• accumulated structural event duration remains within each scenario's RTO threshold