[lweberru]

Hosted recovery drills need to stop the Runner belonging to a specifically authorized disposable Application instance, including a Runner claimed from the warm pool. This adds private structured identifier/timestamp observations only when a live standard Application Plan has produced its native OpenTofu version event, plus a completion marker. No inputs, native messages, backend keys, credentials or State are logged.

The operator CLI defaults to observation. Its explicit single-stop mode validates the fixed CF API, actual isolated Dev Runner organization/space/template, full instance/job identifiers, recent post-arming events and the exact active one-shot task or warm Runner app. It rejects stale/finished/ambiguous observations and never touches the template, pool size, State, locks or approvals. A stop request is explicitly not recovery qualification; CF exit, terminal-job handling and fresh-Plan behavior remain separate live evidence. Apply interruption is not enabled by this tool. Complete English/German instructions are included.

Validation: complete Configurator check passed (1,052 tests passed, 71 gated skips); worker suite passed (113 passed, 4 gated skips), including native-progress-before-completion observations and exclusion of platform jobs; 18 Python lab/controller isolation guards passed; Python compilation and diff checks passed. A preliminary check caught a test-option TypeScript error, corrected before the final successful check. No hosted interruption or customer Plan/Apply has been run.

Assistant facts, prompts, or capabilities are unchanged. After successful CI this change can use the explicitly authorized Dev skip-Assistant-qualification path while retaining the active Assistant and Runner pool size 1. Related acceptance: #90, #95. The local first-Apply checkpoint investigation #140 remains open.

A read-only live startup probe validated the actual CF target/organization/space/template and attached bounded log observers. With no target job started, it timed out as explicitly inconclusive, closed its log processes and performed no stop. The final guard tests also cover the actual CLI configuration path and empty HTTP 204 stop acknowledgements.

Before a stop request, a new owner-only receipt durably records the exact instance/job/Runner/task intent and fsyncs the file and directory. Existing receipts cannot be overwritten after restart; ambiguous CF responses retain the intent. HTTP failures use the CF CLI fail flag, while successful empty 204 responses are supported. Added tests cover receipt ordering, permissions, ambiguous failures, reuse rejection and private error suppression. The final Worker helper reuses existing contract schemas without introducing a new direct dependency. The full 1,052-pass check was repeated successfully for that final Worker source.