Deliver registry-valid prescriptions through the host pipeline

Context

PR #16858 was correctly closed under a terminal Drop+Supersede review: it added a pure admission helper, but no production module called it. Its own spec manually composed admission with renderPrescribedEnvironment(), manufacturing the exact edge whose absence the ticket claimed to repair.

The usable salvage is preserved on commit 21844cfaaf: registry-derived env bindings, current-registry revalidation, a closed compose-service target kind, and order-invariant whole-competition refusal. This ticket lands that code only as part of the first real producer-to-deployment chain.

Live latest-open sweep: checked the latest 30 open issues at 2026-08-10T09:33:08.425Z; no equivalent found. The recent A2A claim sweep found Vega's explicit “salvage repaired, no PR until a real materializer calls it” handoff and no competing implementation claim.

The Problem

A deployment prescription currently cannot change a deployment:

[no production producer] -> [uncalled admission] -> renderer -> [no host materializer] -> Compose

The merged renderer proves only that hand-built env text can influence docker compose config. The canonical deploy pipeline never reads a prescription ledger, the current orchestrator-state named volume is not host-readable, and no post-up --wait receipt binds a prescription to a delivered deployment.

There is also no current diagnosis-side value-selection policy. ContainerHealthControllerService records that raise-ceiling requires a knob transaction; it does not invent one. This ticket therefore uses an explicit trusted host/operator caller as the first producer. It does not claim autonomous value selection.

The Architectural Reality

• recoveryKnobRegistry.mjs is the closed authority for target service, leaf paths, env bindings, bounds, context, and invariants.
• deploymentPrescriptionEnvironment.mjs renders already-admitted key/value pairs; it is not an admission or ordering authority.
• RecoveryActuatorService remains the future automatic producer boundary because it already owns authority fencing and record terminals, but it cannot append a transaction that no policy has selected.
• ai/examples/cloud-deployment/deploy-pipeline.sh is the existing host-side owner of compose up -d --build --wait; materialization belongs before that effect, and delivery receipt capture belongs after it.
• Persistent prescription state must live outside a moving checkout. The backup host-root pattern is the sibling precedent; the container-only orchestrator-state volume is not a host pipeline input.

The Fix

Deliver one vertical slice:

1. Add one trusted append store for semantic deployment prescriptions. The sink stamps sequence and producer provenance, validates the whole knob transaction, performs compare-and-append per target+knob, accepts only idempotent replay, and refuses stale/conflicting succession.
2. Add a host maintenance entrypoint with explicit append and materialize operations. It is the first production caller. Caller-supplied env keys and producer fields are rejected; env bindings come from the registry.
3. Fold the repaired #16858 admission salvage into that caller. Equal-sequence different payload poisons the whole competition; input order cannot choose the deployed value.
4. Atomically materialize a persistent host env file, preserving every non-owned line byte-for-byte. The default Compose .env path is linked to that persistent carrier; an unexpected target refuses rather than overwriting operator data.
5. Invoke materialization from the reference deploy pipeline before compose up; after --wait, write a receipt bound to active prescription ids, materialized digest, deployed revision, and the successful deployment outcome.
6. Prove the existing container-memory-ceiling knob reaches the real Compose model; do not reintroduce the withdrawn service-heap descriptors.

Contract Ledger Matrix

Decision Record impact

Aligned with ADR-0026 §2.4 and §2.8. This adds no actuator action and no autonomous recreation privilege. It records semantic intent and lets the already-authorized host deployment pipeline deliver it. A later automatic value-selection policy must use the same ingress and earn its own authority accounting.

Acceptance Criteria

• A production host entrypoint appends through one trusted ingress; a source grep no longer finds the ledger/admission code reachable only from specs.
• Sequence and producer provenance are sink-stamped; caller-forged producer/env/target-kind fields write zero bytes.
• Compare-and-append is deterministic: stale completion cannot replace newer context, replay is idempotent, and equal-watermark differing payload refuses the whole competition under both input orders.
• Every materialized key is registry-derived and the complete transaction is revalidated against current bounds/context.
• Materialization is atomic and preserves unrelated env lines, comments, ordering, and a token sentinel byte-for-byte outside owned keys.
• The deploy pipeline materializes before compose up, aborts before Docker on refusal, and emits a post-health delivery receipt rather than a “recorded” claim.
• A real docker compose config witness shows an admitted container-memory-ceiling prescription changes the resolved memory limit; missing/refused controls resolve the default.
• Focused unit/importer suites and the deploy-pipeline rehearsal pass.

Out of Scope

• Automatic diagnosis-side value selection.
• New actuator action classes or autonomous container recreation.
• The withdrawn KB/MC V8 heap descriptors.
• A writable deploy-tree mount inside the orchestrator.
• Direct mutation of a live client deployment during tests.

Avoided Traps

A helper definition is not a production caller. The PR must contain the actual host entrypoint and pipeline invocation.

A spec-composed edge is not reachability evidence. The effect witness enters through the production CLI/pipeline surface.

Recorded is not delivered. The receipt is written only after the existing health-gated deployment effect.

A persistent file must not become a secret eraser. Materialization owns registry keys only and preserves all unrelated bytes.

Related

Parent #16695 · supersedes closed #16857 / PR #16858 · renderer PR #16821 · placement #16676 · ADR-0026 §2.4/§2.8

Retrieval Hint: #16695 deployment prescription trusted appender host materializer pipeline receipt · salvage commit 21844cfaaf