[vanedaltro]

After a model binary save loses its response, the owner can now discover its invocation namespace, read the durable receipt and explicitly reconcile native evidence without reopening the model draft as a manual editor handle.

• Add separate model recovery/list/receipt/reconcile owner routes and SDK helpers, with exact Session/Location/root and Model-scope checks, current read/ancestor admission, normal read approval, auth/Origin/no-store and bounded workers. Reconciliation never repeats native replacement or dispatches callbacks.
• Bind the journal target to the already authorized header resource before opening a private base. Use the same resource-bound resume for manual recovery and model retries. Cancellable resume/reconciliation preserves unresolved evidence.
• Generate OpenAPI/SDK operations and update README, roadmap and the approved OpenSpec artifacts. Reconcile completed backend/CLI task statuses with the merged increments.
• Add a reproducible 16 MiB core-only benchmark and named Apple M2 evidence for dev/release timing and peak process RSS. Optimized medians: first page 0.54 ms, native save 553 ms, restore 545 ms; peak process RSS 7.45 MiB. This excludes server/TUI/permission overhead and is not full performance acceptance.

Validation: 84 binary-core tests passed (one process-death helper ignored by that selector); 20 production-router binary tests passed, including model/manual/other-Session isolation, read approval/revocation, auth/Origin/no-store, missing receipt and repeated reconciliation preserving source identity/bytes; current OpenAPI artifact check; SDK typecheck and 127 unit/mock tests passed (ten external tests skipped); core/server/app all-target Clippy plus benchmark target Clippy; formatting/diff checks; strict OpenSpec validation (114 items). Five trials per benchmark profile verified complete saved/restored hashes. The rebase onto merged #104 preserves the tested source tree. Cross-platform CI is pending.

Remaining under #94: configured retention/checkpoint/rewind adapters, remaining recovery/accessibility UX and end-to-end/platform acceptance. This PR does not close #94.