fix(native): recover graphs after relay endpoint retirement

docs/guides/native-candidate.md

@@ -1343,6 +1343,14 @@ For a fully ready graph whose foreground owner died while its pool remains on th
 same boot, `graph recover-live-owner --run-id RUN --expect-receipt SHA256` selects
 only that graph. It requires matching dead foreground and relay-owner identities,
 unchanged receipt and resource inventories, and exclusive publication locks. The
+relay endpoint may also be absent after the managed owner exited: both relay files
+must be absent under the original held operation lock, and the exact dead
+foreground process and ready receipt must select the control root derived for
+this run, runtime owner, and current guest boot. Recovery persists that absence
+witness and rechecks its directory/lock identity, process death, endpoint absence,
+and receipt bytes at cleanup boundaries. A partial publication, replacement
+endpoint or lock, legacy unscoped root, or changed receipt is refused. This path
+does not recreate relay metadata or invent a live-owner acknowledgement. The
 operation stops verified guest dependency listeners, removes owned containers and
 network resources, retains persistent data, retires stale foreground and relay
 publications, and releases the graph's dependency reservation before unlocking the
@@ -1425,8 +1433,10 @@ boot, journal and exact artifact hashes, with no active or pending journal and a
 independently confirmed current retention proof. Eviction of its old stopped
 receipt does not require repeating completed archival. First-time or interrupted
 archival still requires the exact selected cleanup proof and ownership checks.
-The same-boot completion proof does not authorize direct data removal: restore the
-graph and use ordinary cleanup for that operation. Native routed recovery has been
+An explicitly requested data removal can select a completed same-boot recovery
+after publisher retirement. It pins the exact completion, current guest boot and
+archived publisher identity; retries keep the selected proof source and refuse
+changed evidence. This does not fabricate a relay acknowledgement. Native routed recovery has been
 qualified with repeated owner crashes, retained data and an unaffected sibling's
 HTTPS route; this does not establish normal source-mounted worktree parity.
 

packages/runtime-core/README.md

@@ -204,6 +204,23 @@ history format. Stable v4 uses its separate state and is unaffected.
 
 ## Named-volume integrity qualification
 
+The ignored fixture
+`foreground::native_test::same_boot_absent_relay::absent_relay_cleanup_retries_preserve_data_and_live_sibling`
+uses a caller-owned running development pool and a pinned image containing
+`/bin/sh` and `sleep`. Set `HACK_LOCAL_TEST_ROOT` to that private candidate home
+and `HACK_LOCAL_TEST_IMAGE` to the loaded `sha256:<config digest>`. Compile the
+all-feature library test with `--no-run`, then invoke its exact test name with
+`--ignored --exact --nocapture --test-threads=1` under a 300-second external
+watchdog. It starts two unique control-only graphs, lets one managed relay exit
+normally, and checks explicit same-boot recovery after interrupted intent,
+container removal, completed cleanup, and publisher retirement. Persistent data
+and the live sibling must survive; substituted endpoint/lock/directory, receipt
+bytes, and completed-retry process evidence must refuse. It removes only its own
+graph resources on success, including an interrupted explicit volume removal and
+idempotent retry, and never restarts the pool. On failure, inspect its
+retained graph evidence before another attempt. This fixture does not qualify
+application authentication, dependency listeners, browser routing, or publication.
+
 The ignored foreground-owner fixture
 `foreground::native_test::stop14::fourteen_services_retain_named_data_across_cleanup_and_restore`
 qualifies normal retaining cleanup of thirteen running services and one completed
@@ -317,7 +334,10 @@ After confirmed foreground cleanup and clean owner retirement, explicit
 `graph cleanup --run-id <id> --remove-data --json` can remove retained data. The
 operation holds the foreground publication lock, rechecks retirement and resource
 ownership, and records volume identities before removal so an interrupted attempt
-can resume against the same resources. Active owners still handle their own cleanup;
+can resume against the same resources. Completed same-boot recovery is supported
+with exact completion and archived publisher evidence; the removal intent pins its
+proof source so a retry cannot switch to a different recovery generation.
+Active owners still handle their own cleanup;
 stale owner artifacts, uncertain cleanup and changed identities refuse removal.
 Ordinary volume identity is captured when removal is admitted; shared caches also
 retain their existing provenance and shared-resource protections. Persistent data

packages/runtime-core/src/provider/graph/foreground/native_test.rs

@@ -552,5 +552,6 @@ mod host_pin_recovery;
 #[cfg(feature = "native-http-probe")]
 mod retired_rebind_history;
 mod retired_recovery_cleanup;
+mod same_boot_absent_relay;
 mod same_boot_recovery;
 mod source_device_rebind;