[abruption]

Closes #118

Summary

• keep restored identities under a terminal quarantine tombstone and build recovery into a separate fresh state
• add deterministic inspection, reconciliation, control fencing, peer re-pairing, and activation commands with fixed operation IDs
• atomically revoke the old managed principal and register a generation-zero fresh principal only after fresh-key possession proof
• require every peer to sign an explicit approval before accepting either side of the new pin; control receipts never update peer pins
• preserve archived receipts and native-effect evidence, including when the archived private key is unavailable
• document the supported end-to-end workflow in English, Korean, Japanese, and Simplified Chinese

Safety properties

• deleting the legacy recovery marker does not remove the terminal tombstone or reactivate the old identity
• unknown receipts/effects, offline peers, partial peer commits, and an unfinished control fence block activation
• phase retries reuse durable operation IDs and return committed receipts without producing a second effect
• status output reports gates, ownership, generations, peers, and routes without keys, tokens, message bodies, or peer certificates

Verification

• npm test — 11 files, 80 tests passed
• python -m unittest discover -s tests -v — 453 tests passed, 12 optional tests skipped
• SESSION_PEER_CONTROL_INTEGRATION=1 python -m unittest discover -s tests/control_integration -t . -v — 9 tests passed against the actual Node/Python fixture
• SESSION_PEER_DIST_DIR=dist python -m unittest tests.distribution.test_distribution_contents -v — 3 tests passed
• wheel and sdist built successfully with the new recovery module included