fix(release): recover-aggregate rebuilds a missing authorization record from the fenced lane #34746

What

aidevops release recover-aggregate fails silently (exit 1, no message) when the per-PR release authorization record is absent, even though the release lane still holds the fenced authorization the original run resolved.

Evidence

Pinned recovery of unpublished v3.39.31 (lane source #34603, reviewed aggregate #34690 pinned via --aggregate-commit, from #34743):

• Every earlier check passes under xtrace: signed-tag validation, pinned resolver (mode aggregate, all 39 manifest sources), receipt, tag-source subset, and absence on all channels.
• It then stops in _full_loop_recovery_begin_state_transaction (.agents/scripts/full-loop-release-aggregate-recovery.sh). _full_loop_read_release_authorization returns 2 because ~/.aidevops/state/full-loop-release/<repo>-34603.authorization.json was never written on this host.
• The lane executor identity is foreign to this host (release-lane-owner.py observe → missing-or-foreign-identity). The lane is remote-publication with snapshot_manifest_bound: true, and its expected_sources holds the original 7-source authorization.
• Nothing was mutated: lane, local tag and remote are unchanged.

Fix

In _full_loop_recovery_begin_state_transaction, when the authorization read returns 2 (absent):

• Rebuild the previous authorization from the lane's expected_sources. Do this only when the lane is active, in remote-publication, has the same source_pr and tag, has no terminal receipt, and its set is a release_authorization_subset of the reviewed aggregate.
• Persist it with _full_loop_persist_release_authorization, print one stderr line naming the reconstruction, then continue the normal CAS transaction.
• Every other read failure still fails closed. Also print a reason on this silent-failure path.

Files

• .agents/scripts/full-loop-release-aggregate-recovery.sh — _full_loop_recovery_begin_state_transaction
• .agents/scripts/tests/test-full-loop-release-aggregate-recovery.sh — add a case for an absent authorization record (reconstructs from a matching lane; refuses a mismatched source, tag or phase)
• .agents/reference/release-aggregation-recovery.md — note under Preconditions

Verification

• bash .agents/scripts/tests/test-full-loop-release-aggregate-recovery.sh
• shellcheck on the changed scripts
• Production: rerun the pinned v3.39.31 recovery

aidevops.sh v3.39.31 plugin for OpenCode v1.19.0 with claude-opus-5-5 spent 8h 59m and 630,217 tokens on this with the user in an interactive session.