fix(server): complete recovery provenance gating

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/DEVELOPING.md

@@ -629,7 +629,7 @@ For an already-created worktree where you want to keep the existing repo-local c
 | `--from-config <path>` | Source config.json to seed from |
 | `--from-data-dir <path>` | Source `PAPERCLIP_HOME` used when deriving the source config |
 | `--from-instance <id>` | Source instance id when deriving the source config |
-| `--seed-mode <mode>` | Seed profile: `minimal` or `full` (default: `minimal`) |
+| `--seed-mode <mode>` | Seed profile: `minimal` or `full` (default: `full`) |
 | `--preserve-live-work` | Explicitly bypass seed quarantine for copied runs, wakeups, monitors, agent timers, and assigned open issues. The worktree run-execution toggle is still reset. |
 | `--yes` | Skip the destructive confirmation prompt |
 | `--allow-live-target` | Override the guard that requires the target worktree DB to be stopped first |

server/src/services/recovery/service.ts

@@ -1087,6 +1087,7 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
     agentId: string,
     since: Date,
     interactionId?: string | null,
+    provenance?: ExecutionProvenance | null,
   ) {
     return db
       .select({ id: heartbeatRuns.id })
@@ -1100,6 +1101,8 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
           interactionId
             ? sql`${heartbeatRuns.contextSnapshot} ->> 'interactionId' = ${interactionId}`
             : sql`true`,
+          provenance ? eq(heartbeatRuns.instanceNonce, provenance.instanceNonce) : undefined,
+          provenance ? eq(heartbeatRuns.seedEpoch, provenance.seedEpoch) : undefined,
           or(gte(heartbeatRuns.createdAt, since), gte(heartbeatRuns.finishedAt, since)),
         ),
       )
@@ -4332,6 +4335,7 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
           agentId,
           acceptedInteractionResolvedAt,
           acceptedContinuationInteraction.id,
+          opts?.executionProvenance,
         );
 
         if (!successfulRunSinceResolution) {