[lweberru]

A failed Application Apply currently leaves the same order permanently blocked at the disabled Cloud Plan button. This adds a checkpoint-bound way to request a fresh Plan without creating another order or losing its State binding.

For a normally reported apply_failed, the original Application Owner can check the Application checkpoint and enable replanning directly, without another Platform Owner approval or waiting for the old grant to expire. SQL requires terminal execution, a consumed package-bound ticket, matching output evidence and no recovery record. The API reads the exact bound S3 key, verifies the order contract, checks locks before and after reading, and rechecks a five-minute encrypted proof on confirmation. State contents and backend credentials never leave the server.

Uncertain completion retains a separate original-approver operator-attestation path after execution windows expire. State-write failures, separate recovery State, locks and mismatched checkpoints stay blocked. Clearance records neither independently verified cloud consistency nor Apply permission: historical dispatches and State remain unchanged, and SQL requires a newly created Plan before any subsequent Apply. The normal Plan refresh and explicit Apply review remain mandatory.

Both UI languages explain the block and the next action. No cloud mutations, customer Plan/Apply, State edits, credential rotation or deployment were performed.

Validation:

• Full application check: 1,040 passed; 71 environment-gated tests skipped.
• Real isolated database suite: 66 passed, including both clearance modes, concurrent idempotence, role/tenant boundaries, consumed-ticket replay rejection and the fresh-Plan/Apply lifecycle.
• Platform-State database regressions: 63 passed.
• Desktop/mobile organisation and Application browser flows: 118 passed, including selfservice, stale proof and operator review.
• Final focused API/checkpoint tests: 96 passed; one native-engine test skipped. Typecheck, build, lint and diff checks passed.
• Independent review of API/UI/contracts/docs found no remaining security blocker; SQL was separately reviewed and exercised against the real database.

This deliberately keeps the deployed Application Accelerator source pin unchanged so existing partially applied orders remain compatible. Merge/deploy this recovery path before the separate source update in #135; that PR will need its pending migration numbers rebased afterwards. No release workflow or Assistant qualification gate is changed.