docs: concrete operation execution, fencing, and recovery

docs/enhancements/execution-recovery/diagrams/README.md

@@ -0,0 +1,26 @@
+# Execution and recovery diagrams
+
+These diagrams illustrate the [proposed execution contract](../README.md), not
+implemented components. Graphviz DOT files are the editable source; SVG files are
+checked-in renderings. No shared documentation index is modified.
+
+- [Execution path](execution-path.svg), from [DOT](execution-path.dot): authority,
+  local effects and the only permitted result return path. PhysicalMaintenance
+  uses the same broker/journal for technician permits, not a second executor;
+  passive field work has no BMC/boot prerequisite.
+- [Operation state](operation-state.svg), from [DOT](operation-state.dot): unknown
+  and stopping retain custody; only evidence-bearing settlement can become terminal.
+
+From the repository root, with Graphviz installed:
+
+```sh
+dot -Tsvg docs/enhancements/execution-recovery/diagrams/execution-path.dot -o docs/enhancements/execution-recovery/diagrams/execution-path.svg
+dot -Tsvg docs/enhancements/execution-recovery/diagrams/operation-state.dot -o docs/enhancements/execution-recovery/diagrams/operation-state.svg
+git diff --check
+```
+
+Validate XML, local Markdown targets/anchors and pinned source paths after edits.
+Render SVGs to PNG with an SVG renderer and inspect labels/arrows for clipping.
+Graphviz layout may differ by version; do not treat byte equality across versions
+as a protocol test. The failure matrix in the proposal is future acceptance
+work, not tests performed by rendering these diagrams.

docs/enhancements/execution-recovery/diagrams/execution-path.dot

@@ -0,0 +1,29 @@
+digraph execution_path {
+  graph [rankdir=TB, bgcolor="white", pad="0.25", nodesep="0.35", ranksep="0.48", fontname="Helvetica", label="PROPOSED: durable authority, local effects, validated evidence", labelloc=t, fontsize=18];
+  node [shape=box, style="rounded,filled", fillcolor="#eef4fb", color="#456281", fontname="Helvetica", fontsize=12, margin="0.17,0.12"];
+  edge [color="#456281", fontname="Helvetica", fontsize=10];
+  management [label="Management coordinator\nL1: asset slot + subject prior-state + operation + outbox\nAllocation / Preparation / AdoptedCustody / PhysicalMaintenance"];
+  hub [label="Federation hub\nManagement writes exact-target intent\nKarmada reflects selected-cell results"];
+  cell [label="Selected cell\nL2: inbox / L3: step journal\nLocal result writer; no hub/project credentials"];
+  broker [label="Single active effect broker\nS1: durable send marker before transmission\nUnknown send is NOT automatically retried", fillcolor="#fff1d7"];
+  hardware [label="BMC / boot / RAM installer / local disks\nNo assumed hardware epoch enforcement", fillcolor="#fce9e7"];
+  field [label="Authorized technician: passive field procedure\nS1 permit marker; once-only online start\nIndependent witness + old-crew/site exclusion", fillcolor="#fff1d7"];
+  network [label="Networking owner\nOrdered changes + effective fence receipts"];
+  recovery [label="Independent recovery boundaries\nOld egress fence + physical isolation if needed\nRestore epoch interlock", fillcolor="#e9f3e6"];
+  validate [label="Management validation\nL4: evidence / L5: settlement\nUnknown retains custody", fillcolor="#e9f3e6"];
+  management -> hub [label="signed bounded intent"];
+  hub -> cell [label="Karmada delivery"];
+  cell -> broker [label="exact admitted step"];
+  broker -> hardware [label="qualified serialized effect"];
+  broker -> field [label="exact one-use permit (no boot)"];
+  field -> broker [label="start / completion / stop evidence", style=dashed];
+  cell -> network [label="keyed owner request"];
+  network -> cell [label="owner evidence", style=dashed];
+  hardware -> broker [label="receipt or ambiguity", style=dashed];
+  broker -> cell [label="durable local evidence", style=dashed];
+  cell -> hub [label="Karmada reflection ONLY", style=dashed];
+  hub -> validate [label="attributed results"];
+  recovery -> broker [label="exclude old path", color="#527649"];
+  recovery -> hardware [label="stop != token expiry", color="#527649"];
+  recovery -> field [label="physical stop != permit expiry", color="#527649"];
+}