docs(v1.100 Amendment 2): orphan-NFTBan explicit-intent CSF restore path — DOC SEED

[itcmsgr]

Summary

• Appends Part V (§§52–61) to internal/installer/restore/contract.md defining a narrow explicit-intent override for the orphan-NFTBan-on-DirectAdmin restore case.
• Doc-only. Single file changed, 454 insertions, 0 deletions, §§1–51 untouched.
• Authority basis: auditor disposition of PR-26-code-E srv3 partial run (2026-04-28). Options B and C rejected; Option A (narrow explicit-intent override) approved.

What this changes

Splits the existing G1/AuthorityNFTBan row in §6 into two sub-rows evaluated entirely within Group 1:

Sub-row	Condition	Output	Rule label
G1/AuthorityNFTBan/default	candidate triple absent	REFUSE	unchanged behavior
G1/AuthorityNFTBan/orphan-intent-candidate	AuthorityNFTBan + NoRecord + DirectAdmin + --panel-auto-takeover + --accept-orphan-nftban	delegates to §54 evidence predicate	G1/AuthorityNFTBan/OrphanProceed (all rows true) or G1/EvidenceMismatch (any row false)

The split is ENTIRELY within Group 1; no later group ever defeats a Group 1 outcome. §5 precedence rule preserved.

PROCEED activates only for:

AuthorityNFTBan + NoRecord + DirectAdmin + --panel-auto-takeover
+ --accept-orphan-nftban + ALL §54.1 evidence rows true → PROCEED PanelNative/csf

What this does NOT change

• §§1–51 are byte-unchanged.
• AuthorityExternal, AmbiguityConflictExternal, AmbiguityOrphanNFTBan G1 hard-stops remain absolute under all flag combinations.
• Amendment 1 §31 mutation set (A.1–A.7) and §32 11-step ordering: unchanged.
• §22 state-machine terminals, §19.4 exit codes: unchanged.
• §51.3 Option B (no iptables introspection): unchanged.
• §19.2 layer 4 / main.go:132 writeHistory gate: unchanged.
• INV-PR26-NEW-MUTATION-SURFACES-BOUNDED: holds (decision-only amendment, zero new mutation surfaces).

Locked decisions

• Q1 LOCKED 2026-04-28: flag name = --accept-orphan-nftban.
• Q2 LOCKED 2026-04-28: AmbiguityOrphanNFTBan remains REFUSE under all flag combinations.
• Q3–Q7 remain OPEN; must be locked before amendment-2-code-A opens.

New invariant

INV-AMD2-EXPLICIT-INTENT-IS-NARROW (§52.5) — --accept-orphan-nftban may activate the new lattice row ONLY in combination with --panel-auto-takeover AND Panel == DirectAdmin AND Classifier == AuthorityNFTBan AND Prior == NoRecord AND every §54.1 evidence row holds.

Sequencing

1. This PR — doc seed only. No code, no CI, no host action.
2. amendment-2-code-A (separate PR after this merges) — implements §53 + §54 decision-layer logic.
3. amendment-2-code-E (separate PR after code-A merges) — fresh Tier 1 binary, fresh srv3 destructive run, captures merge-blocking evidence for PR-26 final.

Test plan

• CI passes (no code change; doc-only)
• Auditor confirms §§1–51 byte-unchanged
• Auditor confirms Q1 + Q2 locked verbatim
• Auditor confirms zero G6/ labels and zero stale "Group 6" model (only allowed phrase is the rebuttal sentence at §53.1)
• Auditor confirms no code, no CI gate, no host action

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None