[recovery-daemon] ADR pair — recovery-actuator ADR + ADR-0025 → diagnostics rescope

Parent: Epic #13874 (orchestrator recovery daemon — reactive heal/act). Graduated from Discussion #13871. This is the design-gate sub — the privileged-actuator sub (#13884) is blocked on it.

Problem / scope

The two-daemon split (diagnostics #13860 ↔ recovery #13874) needs its ADR layer to land as a coherent, mutually-referenced pair — the "map ↔ world-atlas" relationship (operator framing):

1. New recovery-actuator ADR (next free number, 0026+) — the recovery daemon's actuator safety-envelope + privilege decision. A buggy privileged actuator can thrash a deployment worse than the fault it answers, so the envelope is fixed BEFORE any privileged-actuator code (mirrors how ADR-0025 gated #13860's impl subs).
2. ADR-0025 rescope — ADR-0025 is currently framed as "self-healing" (the whole organism). Post-split it is the diagnostics half (detect + diagnose) only. Rescope its title/intro to "diagnostics daemon" and add the forward reference to the recovery ADR.

Both ADRs reference each other: ADR-0025 (map: "I detect + diagnose; the recovery ADR is the act half") ↔ recovery ADR (map: "I heal + act; ADR-0025 is the detect half I consume"). Together they are the self-healing organism (the world atlas).

Acceptance Criteria

• New ADR learn/agentos/decisions/0026-recovery-actuator.md (confirm next free number). Design-only, no code.
• Inherits ADR-0025 heal-safety (config+lifecycle-only · persisted anti-thrash · detect≠actuator) via an explicit keep/inherit successor-risk audit (graduation AC-1).
• Rescope ADR-0025 title + intro: "self-healing" → "diagnostics daemon" (the detect+diagnose half); add the forward cross-reference to the recovery ADR. The #13860 epic naming lands coherently. (ADR number stays 0025 for stable referencing; the title/scope is what changes.)
• Mutual cross-reference (map ↔ world-atlas): each ADR points to the other as its complementary half.
• Encodes the B0-privilege-free vs B1-docker-socket decision: B0 (ProcessSupervisorService) covers the supervised-process class with zero new privilege; the docker socket is needed by exactly one class (crash — external container) and is gated behind the recovery ADR. Constrained action set (restart + known config tweaks, never arbitrary code).
• AC-9 — controller-agnostic actuator interface: specified so phase-2's homeostatic loop (Discussion #13873) plugs into the same actuator without a rewrite.
• Decision Record: REQUIRED; cross-family review (§6.2, high-blast). Both ADRs land in one PR to avoid a dangling cross-reference.

Contract Ledger

• Adds: learn/agentos/decisions/0026-recovery-actuator.md.
• Edits: learn/agentos/decisions/0025-orchestrator-container-health-self-healing.md (rescope self-healing → diagnostics + forward ref). Refs #13860.
• Gates: the privileged-actuator sub #13884 (B1 + Rung-3).

Sequencing

ADR-0025 has landed → unblocked. Design lane (author: @neo-opus-grace — shaped #13871 / #13860 / ADR-0025, deepest context). The two ADRs land together (mutual refs).