Recover the Stado binary on a host

Use this break-glass path when the target's Stado binary or resolver is missing or broken, so the ordinary declaration-driven delivery cannot run. This is the single canonical procedure; do not replace any part of it with a manual copy or SSH session:

stado repair stado --step host <target> --release <exact-version>

The command uses the last valid canonical registry snapshot. Add --bundled-registry only when that authority is unavailable and you explicitly intend to use the registry bundled into the local Stado build. It then:

1. restores the registry-selected release object API before the first release baseline or catalog read and reports object_api.status plus its detail;
2. downloads the exact canonical signed Stado artifact without invoking the local resolver or a Stado binary on the target;
3. verifies the release manifest, signature, and SHA-256 before activation;
4. preserves the previous binary and installs the verified binary by atomic rename, so the active path is never half-written;
5. runs the newly installed stado resolver --help on the target;
6. atomically restores the prior binary when that probe fails, or removes the invalid install when no prior binary existed; and
7. only after a successful probe runs the existing host recovery.

The JSON answer records the object API health boundary and download, verify, backup, install, resolver, and recovery step results, plus rollback when restoration was required. Keep that one answer with the incident record.

stado release version converge --host <target> --binary stado is the routine path for a healthy fleet: it carries out the registry's managed-binary declaration. host recover --release instead bootstraps Stado itself without the resolver or remote Stado binary that may be broken. Omitting --release keeps the original recovery behavior and changes no binary.