Declared repair

Declared repair is the one Stado capability for recovering a service whose runtime, authorization, storage, or delivered version has wedged. It reads the ordered repair array on the service in stado-rs/data/service-catalog.json; the command never invents a repair from the service name. Each row declares the step name, one-sentence incident/restoration summary, whether the step mutates, and the proof the implementation reads afterwards.

Before answering, Stado compares those declaration rows with the typed REPAIR_STEPS: &'static [RepairStep] table in stado-rs/src/cli/repair/steps.rs. A declaration without code and code without a declaration are refusals. Applying more than one step follows catalog order and stops at the first refusal or failed proof.

Invocations

• stado repair list [--service <NAME>] [--json] lists every service and its ordered repair rows, or only the named service. It reads only the compiled service catalog and changes nothing.
• stado repair show <SERVICE> <STEP> [--json] shows the declared summary, mutation mode, proof, and declaration path for one step. It changes nothing.
• stado repair <SERVICE> [--step <STEP>] [--target <TARGET>] [--apply] [--json] resolves the service and optional step from the catalog. Without --apply, it reports every selected step and, when --target is present, includes a read-only host inventory observation; without a target it explicitly reports that no live target was selected. With --apply, --target is required, the implementations run in catalog order, and every step report carries the proof value read by that implementation.

The shipped declaration assigns these steps:

• stado: host, object-api, release-store, link, object-verifier, release-verifier, service-verifier, storage-root.
• stado-control-plane: release-state, agent-skarbiec.
• skarbiec: audit-lock, crypto, acquisition-state.
• brama, weles, oko, and transcript-lake explicitly declare an empty repair array.

Declaration and implementation refusals

The exact capability-owned refusal sentences are:

• <service> declares no repair; add it to stado-rs/data/service-catalog.json.
• <service> declares no repair step <step>; add it to stado-rs/data/service-catalog.json.
• <service> declares no repair steps; add them to stado-rs/data/service-catalog.json.
• <service> declares mutating repair steps but no target was selected; pass --target <TARGET>.
• <service> repair step <step> declares no implementation; add it to stado-rs/src/cli/repair/steps.rs.
• <service> implements repair step <step> but declares no repair; add it to stado-rs/data/service-catalog.json.
• <service> declares repair step <step> more than once; keep one row in stado-rs/data/service-catalog.json.
• <service> repair step <step> has more than one implementation; keep one entry in stado-rs/src/cli/repair/steps.rs.
• <target> storage-root repair ended <state>; <resident-worker-detail>.
• <target> storage-root repair produced no durable completion proof within 360 seconds; inspect transaction <transaction>.
• <target> did not complete host repair; inspect the reported blockers and retry the declared stado host step.
• <target> did not complete release-state repair; inspect the reported host drift and failed deliveries.
• <target> has no target declaration; add it to the fleet registry.
• <target> target declaration disappeared during repair; retry after the registry is stable.
• <target> declares no desired <binary> version; add it to the target's version declaration.

Argument-shape refusals are complete sentences too:

• repair list takes no positional service; pass --service <NAME>.
• repair show takes SERVICE and STEP as positionals, not --service.
• repair show requires SERVICE and STEP.
• repair SERVICE accepts --step, --target, --apply, and --json.
• repair <operation> accepts only its documented declaration filters and --json.

Each implementation can also return its existing incident-specific sentence: missing target declarations and SSH routes, mismatched verifier declarations, absent credential items, an unsupported Skarbiec diagnosis, an unhealthy post-repair endpoint, or a failed durable storage worker are all surfaced rather than converted to a bare code.

Replaced host verbs

The capability removes all thirteen incident verbs and leaves no aliases or wrappers:

1. stado host recover
2. stado host recover-object-api
3. stado host recover-skarbiec-audit
4. stado host recover-skarbiec-crypto
5. stado host recover-skarbiec-acquisition-state
6. stado host repair-link
7. stado host repair-release-store
8. stado host reconcile
9. stado host reconcile-agent-skarbiec
10. stado host reconcile-object-verifier
11. stado host reconcile-release-verifier
12. stado host reconcile-service-verifier
13. stado host storage-root-reconcile

The hidden resident storage worker remains an implementation detail used by the durable transaction after the public declared step starts it; it is not shown by stado host --help.

Stado Desktop

Every host inspector has a Declared repair section. It loads the same compiled catalog through stado repair list --json, groups the ordered steps under stado, stado-control-plane, and skarbiec, and displays each step's incident/restoration summary and proof. Dry run executes the service report against the selected host without applying a step. Apply declared steps… requires an explicit destructive confirmation, then runs the service's declared steps in order. The last dry-run or applied report remains visible per host and service, including each step's status, live observation or proof report, and proof declaration. The link repair, storage reconciliation command display, and machine-enrollment host proof all call the matching declared stado repair step; none retains a removed host verb.