Merge remote-tracking branch 'gitea/main' into codex/host188-checkmode-diagnostics-v3-20260718

# Conflicts:
#	scripts/reboot-recovery/tests/test_host112_manager_recovery_contract.py

apps/api/tests/test_agent99_transport_recovery_deploy_contract.py

@@ -32,6 +32,7 @@ def test_agent99_uses_dedicated_identity_and_preferred_jump_route() -> None:
 def test_agent99_auto_recovery_is_single_flight_and_slo_measured() -> None:
     source = CONTROL.read_text(encoding="utf-8")
     contract = CONTRACT_CHECK.read_text(encoding="utf-8")
+    synthetic = (ROOT / "agent99-synthetic-tests.ps1").read_text(encoding="utf-8")
     trigger = source[source.index("function Start-AgentRecoveryFromObservation") :]
     trigger = trigger[: trigger.index("function Get-AgentRecoverySloConfig")]
     identity = source[source.index("function New-AgentCanonicalControlledDispatchIdentity") :]
@@ -113,10 +114,37 @@ def test_agent99_auto_recovery_is_single_flight_and_slo_measured() -> None:
     assert "Test-AgentControlledDispatchIdentity $dispatchIdentityEnvelope" in consumer
     assert '"controlled_dispatch_identity_invalid"' in consumer
     assert consumer.index('"controlled_dispatch_identity_invalid"') < consumer.index(
-        '$process = Start-Process -FilePath "powershell.exe"'
+        "$execution = Invoke-AgentBoundedProcess"
     )
+    assert '$process = Start-Process -FilePath "powershell.exe"' not in consumer
     assert 'Add-Check "recovery:auto_trigger_controlled_identity"' in contract
     assert 'Add-Check "recovery:queue_identity_fail_closed"' in contract
+    assert "$queueIdentityRejectionIndex = $control.IndexOf" in contract
+    assert "$queueBoundedExecutorIndex = $control.IndexOf" in contract
+    assert "'$execution = Invoke-AgentBoundedProcess'" in contract
+    assert "$queueIdentityRejectionIndex -ge 0" in contract
+    assert "$queueBoundedExecutorIndex -ge 0" in contract
+    assert "$queueIdentityRejectionIndex -lt $queueBoundedExecutorIndex" in contract
+    assert "-TimeoutSeconds $script:Agent99QueueOuterDeadlineSeconds" in contract
+    assert (
+        '-not $control.Contains(\'$process = Start-Process -FilePath "powershell.exe" '
+        "-ArgumentList $args')"
+    ) in contract
+    assert (
+        '$control.IndexOf(\'$process = Start-Process -FilePath "powershell.exe" '
+        "-ArgumentList $args')"
+    ) not in contract
+    assert 'Add-SyntheticCheck "recovery:host112_timeout_contract"' in synthetic
+    assert "$control.Contains('$execution = Invoke-AgentBoundedProcess')" in synthetic
+    assert (
+        "$control.Contains('-TimeoutSeconds $script:Agent99QueueOuterDeadlineSeconds')"
+        in synthetic
+    )
+    assert (
+        "-not $control.Contains("
+        "'$process.WaitForExit($script:Agent99QueueOuterDeadlineSeconds * 1000)')"
+        in synthetic
+    )
     assert 'correlationKey = $dispatchIdentity.idempotencyKey' in contract
     assert 'canonicalDigest = $dispatchIdentity.canonicalDigest' in contract
     assert 'Record-AgentEvent "recovery_slo_result"' in source