fix(agent99): bind host112 apply to immutable receipt

docs/operations/AGENT99-HOST112-CONTROLLED-RECOVERY-CONTRACT.md

@@ -0,0 +1,53 @@
+# Agent99 Host112 controlled recovery contract
+
+Host112 recovery is a bounded, correlated controlled-apply lane. Agent99 uses
+the Windows99 `agent99_ed25519` identity directly to `kali@192.168.0.112`; it
+does not fall back through the 110 jump route for this lane.
+
+## Candidate separation
+
+- The general guest candidate covers systemd, console/LightDM, VMware Tools,
+  SSH, Wazuh Indexer, and the recovery timer.
+- The Wazuh manager candidate is evaluated separately. A healthy manager, a
+  manager cooldown, or a manager resource block does not suppress a valid
+  general guest repair candidate.
+- When the manager was already verified healthy, a general-only apply must
+  retain `manager_attempt_count=0` and
+  `manager_runtime_write_performed=0`.
+
+## Apply closure
+
+Before any apply, Agent99 runs the correlated `sudo --dry-run` with the same
+`trace_id`, `run_id`, and `work_item_id`. The dry-run must have a working direct
+transport, matching identity and boot, a readable preflight result, and no
+runtime or receipt write.
+
+A manager recovery is verified only when all of the following are true for the
+same apply:
+
+1. The direct apply transport completed and the executor returned healthy.
+2. The apply emitted a new immutable receipt with the matching identity and
+   boot, `terminal=verified_healthy`, independent manager verifier ready,
+   `manager_runtime_write_performed=1`, and `manager_attempt_count=1`.
+3. A second correlated `sudo --dry-run` reloads the durable receipt and returns
+   the exact same receipt path, SHA-256, identity, boot, and terminal.
+4. A final ordinary `--check` independently verifies current guest and manager
+   runtime health on the same boot.
+
+The last check is evidence only. A timer or external process that makes the
+manager healthy after a failed apply cannot replace the apply transport or its
+immutable receipt and therefore cannot turn that run green.
+
+## Timeout chain
+
+- Host executor absolute deadline: 420 seconds.
+- Agent99 apply transport: 510 seconds, leaving 90 seconds for transport
+  teardown and receipt delivery.
+- Worst-case Host112 chain, including five 90-second SSH lock waits: 1080
+  seconds.
+- Queue child outer deadline: 1680 seconds, leaving 600 seconds after the
+  Host112 chain.
+- Dispatch client deadline: 1800 seconds, leaving 120 seconds after the queue
+  child deadline.
+
+The control plane validates these reserves before attempting Host112 recovery.