Require source shutdown proof before automatic recovery
- Automatic recovery waits for the original agent to confirm durable exclusion and disabled container restart before starting each replacement.
- Host owners can review an unreachable source's recovery risk explicitly; recovery targets must belong to the same owner.
- Returning a recovered host to service keeps its original server IDs excluded, and bounded recovery scans continue past unavailable candidates.