Document the 1.4.0 release candidate

docs/RECOVERY_AND_PERFORMANCE.md

@@ -41,14 +41,42 @@ reported as degraded committed success, not as permission to repeat a mutation.
 The live viewer pins one validated index identity. Index replacement makes the running snapshot
 stale and causes a later visualize request to start a fresh worker.
 
+Milestone 5 maintains exact-oracle recovery proofs for four independently disposable artifacts:
+
+- A corrupt index attestation is rejected, then `synchronize()` recreates the exact attestation
+  after complete verification while preserving canonical bytes, snapshot hash, and index identity.
+- A corrupt manual-render receipt reports `unverified/receipt_corrupt`; explicit rendering restores
+  the exact output bytes and semantic receipt, and normal and deep status return `current`.
+- A corrupt generation-diff receipt reports `unverified/corrupt_receipt`; a complete index build
+  recreates the exact current-graph baseline with `baseline/no_meaningful_transition`.
+- A corrupt portable-graph manifest reports missing publication evidence; explicit rendering
+  restores the exact artifact bytes and semantic manifest, and status returns `current`.
+
+These proofs are maintained by `tests/test_milestone5_recovery.py`. They do not promote receipts,
+attestations, or manifests to canonical authority.
+
 ## Proposal and application recovery
 
 Hash or base conflicts are not cache failures. Retrieve the current changeset and diff, then
 review the new exact hash. Rebase is allowed only when every touched node, relationship, source,
 permission, and graph invariant still matches. A content conflict requires a new proposal.
 
-If a canonical serializer fails its round-trip check, use its reported rollback state. Do not
-reapply a changeset whose application may already have committed. See
+Generic canonical create, update, and delete publication compares exact target identity at the
+commit boundary. Concurrent target mutation fails closed. In-process failures roll back only when
+the exact displaced state remains provable; otherwise DocForge preserves foreign data and returns
+`application_recovery_required` with retained evidence.
+
+Canonical application is not journaled across several files. Each file publication is atomic, but
+process or host death between publications can leave a partial canonical application. Inspect the
+named canonical targets, the active proposal, and `.docforge/application/transaction-*` before
+deciding whether to restore or create a new proposal. Do not retry the old approved hash merely
+because a process ended.
+
+If semantic application committed but private transaction cleanup degraded, the result remains
+`applied`. The proposal is closed and its compact lifecycle receipt records
+`application_recovery.status = "cleanup_required"`, retained paths, and remediation. Preserve and
+inspect those files. Remove only artifacts proven to be DocForge-owned. If a canonical serializer
+fails its round-trip check before success, use its reported rollback state. See
 [migrating from v1](MIGRATING_FROM_V1.md) for rollback planning.
 
 ## Milestone 4 scale evidence
@@ -80,7 +108,18 @@ make gate
 make adoption-m4
 make benchmark-m4-full
 make docs-check
+make compatibility-m5
+make migration-m5
+make concurrency-m5
+make recovery-m5
+make task-evidence-m5
+make release-gate
+make fresh-clone-m5
 ```
 
 The main gate includes smoke benchmarks. Full milestone evidence is recorded separately from a
-clean candidate so smoke or dirty-tree results cannot become release claims.
+clean candidate so smoke or dirty-tree results cannot become release claims. `release-gate`
+aggregates the complete quality, compatibility, migration, concurrency, recovery, task-evidence,
+fresh-wheel, identity, reproducible-artifact, secret-scan, and full benchmark proofs.
+`fresh-clone-m5` repeats that aggregate gate from anonymous HTTPS at one exact published commit
+after verifying the frozen annotated `v1.0.0` migration tag.