# VM101 autonomous HMN recovery — local M07 plan after R18

## Completed foundation

- R14B: transactional LOCAL_REPAIR and unified quarantine.
- R15A: legacy refresh/rebalance paths removed; one health watcher remains.
- R15B2: five-slot generation builder and validator.
- R16: transactional all-or-nothing initial generation activation.
- R17: VM130 shared workflow, publication barrier and finalizer.
- R18: threshold-triggered generation-aware FULL_POOL_REFRESH and transactional active-generation replacement.

## R18 proven result

The generation `r18r08-20260719-060942-3890` replaced `r15b2-20260716-215914` transactionally.

Proven invariants:

1. five ranked candidates were selected from a pool of fifteen;
2. all five slots were applied and verified as one transaction;
3. the active link changed only after endpoint, handshake, route and rule proof;
4. the repair counter reset only after complete proof;
5. the previous generation and manual rollback transaction remain available;
6. provider download and strict test were not repeated in R08;
7. Direct failopen remained disabled.

## State transitions

```text
NORMAL -> LOCAL_REPAIR
LOCAL_REPAIR + counter<threshold -> NORMAL
LOCAL_REPAIR + counter>=threshold -> FULL_POOL_REFRESH_PENDING
FULL_POOL_REFRESH_PENDING -> FULL_POOL_REFRESH_RUNNING
FULL_POOL_REFRESH_RUNNING + complete activation proof -> NORMAL
FULL_POOL_REFRESH_RUNNING + failure -> DEGRADED_POOL_PENDING
```

R18 records `DEGRADED_POOL_PENDING` but does not automatically retry it.

## Next functional boundary

Implement controlled retry scheduling and slot consolidation for `DEGRADED_POOL_PENDING`, while keeping Direct emergency and bootstrap recovery out of scope.