fix: preserve workspace finalization during watchdog recovery (#16247)

Keep task completion separate from runtime and workspace settlement. Permit verified board file-only repair of successful legacy retained-source runs without authorizing replay.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

maps/agent-access-map/recovery.md

@@ -141,12 +141,17 @@ API: `present` — representative operation IDs:
 
 - `POST /api/issues/{id}/recovery-actions/retry-workspace-export`.
 - `POST /api/issues/{id}/recovery-actions/resume-workspace-finalization`.
+- `POST /api/issues/{id}/recovery-actions/resolve` for retained-source file repair.
 - `POST /api/execution-workspaces/{id}/reconcile-branch`.
 
 Agent access: `restricted` — Board/runtime management APIs; agent reads diagnosis and
 performs permitted workspace work.
 
 Policy: Export retry and branch reconciliation require board runtime management.
+Retained legacy file-only repair requires the board, exact stopped-source receipts,
+and recovered-file evidence. It can record repair for a successful legacy turn
+without changing its result or authorizing replay. Queued and running sources
+remain denied. Source-only reconciliation regressions cover this boundary.
 Physical-owner stop confirmation uses the separate `runtime:confirm_owner_stop`
 action. It requires active company owner/admin membership, trusted local board
 access, or instance administration. Agents and ordinary runtime managers are denied.

maps/feature-map/recovery.md

@@ -137,6 +137,13 @@ cover evidence/confirmation, read-only access, stale or missing stop proof,
 source-only repair, and preserved task status. These tests use fixtures; separately
 verify original files and their attached artifact before recording a real repair.
 
+Repeat source-only repair with a `succeeded` legacy run that still has a retained
+file obligation. Its result must remain successful, its current task owner and
+status must stay unchanged, and later saved input must become eligible for normal
+admission. A running or queued source and a normal retry of a successful turn
+remain denied. The [reconciliation regressions](../../server/src/services/workspace-restore-reconciliation.test.ts)
+cover these cases and stop-receipt validation without claiming live provider proof.
+
 For an abandoned native copyback owner, the harness verifies the exact stopped
 deployment and the reconciler restores saved work automatically. Task users see
 no process details or shutdown form. The documented operator API handles older