Stop recovery when endpoint resolution changes

docs/roadmap/remediation.md

@@ -356,7 +356,9 @@ runbook checks URL resolution and queries that exact endpoint, retaining tags
 on failed or unresolved checks. Local wrapper fixtures use separate fetch and
 push repositories; a lost acknowledgment changes the configured push URL, and
 recovery still finds the intended object at the captured endpoint while the
-fetch endpoint reports absence. Focused publication/wrapper tests pass.
+fetch endpoint reports absence. The guarded runbook commands are exercised
+verbatim, including refusing a query after URL rewriting changes the endpoint.
+Focused publication/wrapper tests pass.
 
 ### R10 — Medium: The boundary checker bans valid command-internal composition