Preserve native-contained managed restart coverage for frozen targets whose committed runtime predates absent-membership recovery. Keep current targets on the strict absent-containment path with both warning receipts and run-ID matching.
The existing verified-source resolver owns selection and explicit sparse acquisition; Docker forwarding and preflight metadata carry the result. Updater, replacement, authentication, serving and survival assertions remain intact. Independent review is scoped-clean, with focused regression, sibling and acquisition proof documented in the PR. Installed-package release qualification remains separate.
Co-authored-by: RomneyDa [email protected]