Advance blocked assurance and operator callback work

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

scripts/capture_service_observation.py

@@ -14,6 +14,7 @@ import sys
 ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(ROOT / 'scripts'))
 from service_assurance import read_contract, admission
+from recovery_evidence import recovery_signals
 
 
 def query(args, allowed_codes=(0,)):
@@ -94,7 +95,8 @@ def capture():
         add('eso.ready', 'unavailable')
         add('eso.refresh', 'unavailable')
     # No token, Secret, application data/logs or seal/unseal mutation.
-    # Native restore and offsite receipts remain separate attended evidence.
+    # Receipt timestamps are preserved; reads never renew recovery evidence.
+    signals.update(recovery_signals(datetime.now(timezone.utc)))
     return {'schema': 'railiance-platform.observation.v1', 'cluster_uid': uid,
         'captured_at': datetime.now(timezone.utc).isoformat(), 'signals': signals}