Retained standby recovery rejects the operator pause acknowledgment #4705

🤖 Generated by the Agentic Engineer

Problem

The retained-standby recovery can accept a pause and then stop without recognizing the operator's acknowledgment. The audited controller calls its Warning method, but its controller logging adapter emits that exact acknowledgment at info level. The recovery parser requires warning, so the valid record cannot pass.

The controller and logging adapter provide the public source evidence. A bounded live observation confirms the emitted protocol; private records and identities remain private. This is distinct from the source-version race resolved by #4704.

Proposed repair

Recognize the exact info-level acknowledgment emitted by the pinned operator. Retain the complete structured-record, message, database identity, freshness, reconciliation-ID replay and bound-leader checks. Do not accept arbitrary severity levels.

Acceptance

• Demonstrate RED/GREEN with an independently specified info-level controller record.
• Exercise the recovery's actual acknowledgment consumer with the corrected protocol.
• Reject other levels, malformed or incomplete records, stale/replayed acknowledgments and identity mismatches.
• Keep pause ownership, source, storage, peer, backup and mutation limits unchanged.
• Document that this parser fix does not authorize another dispatch or admit an already paused database into the initial recovery path. That continuation remains separately reviewed and approved.

Rough size: small. Part of #4673.