docs(RMASTER-WP-0025): define universal rapp coverage

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4

docs/adr/ADR-0007-rapp-declaration-contract.md

@@ -2,9 +2,9 @@
 id: RMASTER-ADR-0007
 title: "Rapp Declaration Contract"
 status: accepted
-revision: "accepted-1"
+revision: "accepted-2"
 owner: railiance-master
-last_reviewed: "2026-08-13"
+last_reviewed: "2026-08-23"
 review_interval: 6m
 ---
 
@@ -64,6 +64,27 @@ dimensions. Decision `d07ee5f9` already recorded this from the
    fields. Reef `bound_rapps` is a derived projection of `rapp.bound_reefs`,
    not a hand-maintained registry.
 
+5. **Coverage includes every managed running deployable.** Application,
+   operational, and tooling runtimes participate in the same exactly-one-rapp
+   invariant when they are installed, scheduled, or otherwise operated as a
+   managed deployable. This includes a managed one-shot Job; it does not turn
+   a human command or approval act into a workload. Human access, credential
+   patterns, broker actions, one-off operational acts, and infrastructure
+   resources that are not workloads retain their native actor, lane, activity,
+   or resource identity.
+
+   A running deployable that predates rapp extraction is migration debt. Until
+   an authoritative declaration claims it, workload-based controls report it
+   as `unknown`; they do not infer a rapp from its repository, namespace, path,
+   labels, or apparent owner. A subject explicitly established as not being a
+   workload is `not-applicable`. `unknown` and `not-applicable` are different
+   outcomes and omission must not collapse them.
+
+   Railiance Master remains the sole owner of the normative rapp vocabulary and
+   schemas. Consumer catalogs may store explicit references and integration
+   owners may resolve them, but neither creates a parallel declaration surface
+   or copies rapp metadata as another source of truth.
+
 The detailed shapes, including the single normative form of the rollout,
 smoke, and rollback contracts, live in the schema files and
 `schemas/README.md`.
@@ -81,6 +102,12 @@ smoke, and rollback contracts, live in the schema files and
   `rapp-user-engine`) carry the family prefix and no declaration. They are
   visible to the validator as undeclared and must be declared, renamed, or
   retired by their owners.
+- Operational and tooling deployables are not exempt from family coverage.
+  Existing pre-rapp runtimes may continue during migration, but their workload
+  identity remains visibly `unknown` to controls until declared.
+- Runtime inventory is still required to prove universal coverage. Repository
+  discovery alone cannot establish that every running unit has exactly one
+  authoritative rapp.
 - Calling the validator from `fix-consistency` still waits on
   `the-custodian` admitting the family prefixes into the classification
   standard. That sequencing is not this repo's.