docs: record verified interactive DeepSeek Herdr recovery

Author: ngallodev

BACKLOG.md

@@ -73,8 +73,11 @@
   Phase1 plan. Native assignment delivery failed: all three returned predecessor
   reports, including after persisted steering and direct follow-ups. Sessions
   were stopped; zero assigned comparisons or correlated worker acknowledgements
-  are established, and all 115 hashes remain pending. Recover task delivery before
-  resuming; no worker result/acceptance is inferred from preparation or launch.
+  were established by that failed attempt. Interactive recovery now runs Codex
+  `--model deepseek-flash` in Herdr `wC:pF` / `wC:pG` / `wC:pH`, with correct
+  worker-issued run/cwd/count launch acknowledgements and actual process Jev-token
+  inheritance verified. The same 115 hashes remain the comparison scope; see the
+  canonical interactive recovery section. No completion/acceptance is inferred.
 - [ ] Review additional bounded missing behaviors: malformed confidence parsing
   `62b44519c68b403ea44d9a85ba8ee74cddee66e6` (first additional localized candidate),
   route handler position `592894a4387a50e1d128ff6a2695ff48f8cc32a5`, late annotation

docs/UPSTREAM_308_CANDIDATE_AUDIT_20260912.md

@@ -156,6 +156,44 @@ run/cwd/branch/hash acknowledgement before comparison resumes. No predecessor
 completion is reissued, and no sealed predecessor evidence is rewritten by recovery.
 This is a preparation/failed-delivery record; Phase1 is incomplete.
 
+### Interactive Herdr recovery — 2026-10-03 UTC
+
+The user explicitly requested interactive **Codex `--model deepseek-flash`**
+workers, with Jev credentials/instructions and indexed worktrees. Three new
+external runs were prepared before launching in the same Herdr workspace:
+
+| Piece | Successor durable run | Herdr pane / agent | Hashes |
+|---|---|---|---:|
+| Runtime/process/resources | `CBM-RECON-DEEPSEEK-RUNTIME-HERDR-PHASE1-20261003` | `wC:pF` / `ds-runtime-phase1` | 39 |
+| Operations/pipeline/query | `CBM-RECON-DEEPSEEK-OPS-HERDR-PHASE1-20261003` | `wC:pG` / `ds-ops-phase1` | 26 |
+| CLI/build/adapter/integration | `CBM-RECON-DEEPSEEK-INTEGRATION-HERDR-PHASE1-20261003` | `wC:pH` / `ds-integration-phase1` | 50 |
+
+All three are observed working and have written correct worker-issued launch
+acknowledgements naming their run, isolated cwd/branch and assigned count. The
+exact assignment sets match the original plan, are disjoint, and all 115 full
+hashes resolve as commits. Completed predecessor comparisons remain excluded.
+The original 367-hash effective ownership crosswalk is refreshed in launch
+evidence, preserving one owner per hash; it is not another canonical ledger.
+
+Their unchanged clean QA `559214af` worktrees retain the prior full nonpersistent
+indexes. Fresh status/root and coverage receipts verify ready graphs and matching
+generations. Each prepared prompt includes the official Jev footer once and all
+source/graph/no-test constraints. The authorized TypeSafe env was sourced directly
+into each pane shell before restarting Codex; actual Codex-process inheritance of
+the token was verified as a boolean, without recording its value. The verified API
+destination is `https://api.typesafe.ai`. Each session uses `--no-daemon`, approvals
+never and full filesystem access within its evidence-only assignment.
+
+Run-owned evidence includes `parent-herdr-launch-receipt.json`,
+`codex-process-env-receipt.json`, `launch-acknowledgement.json`, index/assignment
+receipts and correlated worker acknowledgement evidence. Runtime/operations
+acknowledgements are worker-issued handoff control intents; integration also has
+a journal acknowledgement. Full launch staging is the original Phase1 handoff
+directory's `herdr-launch/`. Detailed batch/stopping handoffs remain required.
+Activity and launch acknowledgement establish execution of the assigned task;
+they establish no source completeness, Jev decision result, review, Jenkins
+validation, acceptance or integration. Phase1 comparison remains in progress.
+
 ## Frozen merge and source audit — 2026-10-02, Sol R2
 
 This section supersedes historical queue, exclusion, fetch and completion claims

docs/UPSTREAM_RECONCILIATION_REPORT_20261002.md

@@ -384,6 +384,15 @@ the canonical plan records the failed-delivery boundary and unexpected predecess
 activity. No result is represented as complete or accepted. The original
 capture tables remain dated evidence, not silently refreshed progress counters.
 
+Interactive recovery now uses three Codex `--model deepseek-flash` sessions in
+Herdr `wC:pF` / `wC:pG` / `wC:pH` under the corresponding
+`CBM-RECON-DEEPSEEK-{RUNTIME,OPS,INTEGRATION}-HERDR-PHASE1-20261003` runs.
+All three are observed working and have correct run/cwd/count launch acknowledgements.
+Actual Codex processes inherited the silently sourced Jev token; destination,
+official footer and matching ready CBM index generations are verified. The exact
+39/26/50 assignments remain disjoint. The canonical interactive recovery section
+owns current status; this is launch evidence, not completed comparison or acceptance.
+
 ## Appendix: non-unresolved auditor checkpoint claims
 
 This is a source-finding snapshot, not another task ledger. It makes the collected