fix(agent99): add bounded control loop restore

scripts/reboot-recovery/tests/test_agent99_vmrun_timeout_guard.py

@@ -5,6 +5,9 @@ ROOT = Path(__file__).resolve().parents[3]
 CONTROL = ROOT / "agent99-control-plane.ps1"
 BREAKGLASS = ROOT / "scripts" / "reboot-recovery" / "agent99-stale-recovery-breakglass.ps1"
 MAINTENANCE = ROOT / "scripts" / "reboot-recovery" / "agent99-control-loop-maintenance.ps1"
+MAINTENANCE_RESTORE = (
+    ROOT / "scripts" / "reboot-recovery" / "agent99-control-loop-maintenance-restore.ps1"
+)
 REGISTER_TASKS = ROOT / "agent99-register-tasks.ps1"
 SRE_INBOX = ROOT / "agent99-sre-alert-inbox.ps1"
 TELEGRAM_INBOX = ROOT / "agent99-telegram-inbox.ps1"
@@ -182,6 +185,44 @@ def test_control_loop_maintenance_freeze_is_exact_and_receipted() -> None:
     assert "hostRebootPerformed = $false" in source
 
 
+def test_control_loop_maintenance_restore_is_bounded_and_receipted() -> None:
+    source = MAINTENANCE_RESTORE.read_text(encoding="utf-8")
+
+    assert 'if ($env:COMPUTERNAME -ne "WOOO-SUPER")' in source
+    assert "Global\\WoooAgent99ControlLoopMaintenanceV1" in source
+    assert 'ValidateSet("Check", "Apply")' in source
+    assert "maintenanceReceiptSha256" in source
+    assert 'schemaVersion -ne "agent99_control_loop_maintenance_v2"' in source
+    assert 'terminal -ne "control_loop_maintenance_frozen"' in source
+    assert 'schemaVersion -ne "agent99_control_loop_maintenance_intent_v1"' in source
+    assert "maintenance_intent_contract_mismatch" in source
+    assert 'if ([bool]$task.Settings.Enabled)' in source
+    assert "StringComparison]::OrdinalIgnoreCase" in source
+    assert "StringComparison]::Ordinal" in source
+    assert 'Join-Path $AgentRoot "agent99-run.ps1"' in source
+    assert 'Enable-ScheduledTask -TaskName $taskName -TaskPath "\\"' in source
+    assert 'Start-ScheduledTask -TaskName $taskName -TaskPath "\\"' in source
+    assert 'Stop-ScheduledTask -TaskName $taskName -TaskPath "\\"' in source
+    assert 'Disable-ScheduledTask -TaskName $taskName -TaskPath "\\"' in source
+    assert source.index("Write-DurableReceipt $operationIntent $operationIntentPath") < source.index(
+        'Enable-ScheduledTask -TaskName $taskName'
+    )
+    assert "control_loop_maintenance_restored" in source
+    assert "maintenance_restore_failed_refrozen" in source
+    assert "maintenance_restore_failed_manual_recovery" in source
+    assert "maintenance_restore_receipt_failed_refrozen" in source
+    assert "maintenance_restore_receipt_failed_manual_recovery" in source
+    assert "Get-RefreezeReadback" in source
+    assert "rollbackReadbackErrors" in source
+    assert "recovery_lease_readback_failed" in source
+    assert "$leaseAbsent" in source
+    assert 'recovery-transport-lease.json") -PathType Leaf' not in source
+    assert "$stream.Flush($true)" in source
+    assert "vmPowerChangePerformed = $false" in source
+    assert "hostRebootPerformed = $false" in source
+    assert "secretValueRead = $false" in source
+
+
 def test_control_loop_deadline_and_queue_batch_are_compatible() -> None:
     control = CONTROL.read_text(encoding="utf-8")
     tasks = REGISTER_TASKS.read_text(encoding="utf-8")