fix(reboot): add edge maintenance fallback apply gate

scripts/reboot-recovery/tests/test_reboot_p0_operational_contract.py

@@ -144,6 +144,8 @@ def test_reboot_p0_contract_applies_l0_fallback_to_awoooi_nginx_sources() -> Non
         assert "/50x.html" not in conf
 
     ops_conf = read("ops/nginx/awoooi.wooo.work.conf")
+    assert "192.168.0.125:32334" in ops_conf
+    assert "192.168.0.125:32335" in ops_conf
     for marker in [
         "location /api/ {",
         "location ~ ^/api/v1/(dashboard/stream|agent/thinking) {",
@@ -191,6 +193,24 @@ def test_public_maintenance_probe_does_not_count_fallback_5xx_as_raw(
     assert route["raw_5xx_without_fallback"] is False
 
 
+def test_public_maintenance_edge_apply_script_is_guarded_and_reversible() -> None:
+    script = read("scripts/reboot-recovery/public-maintenance-edge-fallback-apply.sh")
+
+    assert "MODE=\"check\"" in script
+    assert "MODE=\"apply\"" in script
+    assert "MODE=\"rollback\"" in script
+    assert "sudo -n true" in script
+    assert "BLOCKER privileged_edge_apply_channel_unavailable" in script
+    assert "nginx -t" in script
+    assert "systemctl reload nginx" in script
+    assert "BACKUP_CONF=" in script
+    assert "EDGE_FALLBACK_READY=1" in script
+    assert "EDGE_FALLBACK_READY=0" in script
+    assert "raw_secret" not in script.lower()
+    assert "docker restart" not in script
+    assert "reboot " not in script
+
+
 def test_reboot_slo_scorecard_fails_closed_on_raw_public_502(tmp_path: Path) -> None:
     summary = tmp_path / "summary.txt"
     summary.write_text(