Harden WP-0024 recovery execution gates

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

docs/railiance01-coordinated-reboot.md

@@ -38,7 +38,9 @@ the reviewed 1/1 Ready audit-core image. The following are human gates and make
 - approved window id and acknowledgements from all five owners;
 - a named attended driver/abort operator;
 - independent provider-console access, not SSH alone;
-- a current non-secret OpenBao Raft snapshot evidence file;
+- a current non-secret OpenBao Raft snapshot receipt that validates against
+  `docs/openbao-reboot-snapshot-receipt.example.json`, the live cluster id and
+  Raft index, and the default 24-hour freshness bound;
 - explicit availability of two of three Shamir shares through their approved
   out-of-band custody paths.
 
@@ -58,6 +60,9 @@ State Hub.
    verify an on-demand backup before continuing.
 5. Create and escrow a fresh OpenBao Raft snapshot through the approved
    encrypted backup lane. Record only its evidence receipt and verification.
+   Pass that receipt to the preflight with
+   `--openbao-snapshot-evidence /path/to/receipt.json`; a merely existing,
+   stale, placeholder, wrong-cluster, unencrypted, or on-host receipt is denied.
 6. Have both Shamir share custodians present. Prove provider-console access and
    SSH access. Record the exact restart and abort operators.
 7. Re-run the preflight with the approval and attestation flags. The result