Self-Healing Containment Graphs: Trusted Reconstruction After Transitive Contamination

Correct transitive containment can disable far more legitimate state than an attacker directly compromised. CSR-PUB-0002 defined and measured that effect as containment denial of service (CDoS); CSR-PUB-0003 showed that operational availability can be restored by adding replacement capacity without weakening the containment footprint, while returning a negative decision on its own preregistered joint rule. Both leave the quarantined state itself permanently unavailable. This paper asks whether trusted usable state can be _reconstructed_ after correct containment — without clearing taint, without reducing historical quarantine, without reusing a contaminated identity, and without consulting hidden material truth. We specify a governed repair mechanism in which repaired state is emitted forward under a new identity with fresh provenance rather than restored in place: an admissible frontier is computed from runtime-visible state only, a planner selects an authorized reconstruction method, a verifier re-derives the candidate and rejects on disagreement rather than tie-breaking, a graph-safety gate blocks any admission that would reintroduce prohibited ancestry into the active graph, and a bounded recurrence monitor withdraws admitted state if contamination reappears — without erasing the original decision. Every decision is bound to its inputs by digest. The confirmatory design is a fully paired campaign over the frozen CSR-BENCH-1.0 population: 2,331 base cells per seed × (7 profiles × 9 recovery challenges + 4 negative controls), 30 confirmatory seeds, 4,685,310 trials. Across 4,685,176 materialized trials, governed repair raises verified repair coverage over continuity alone by a median paired difference of +0.600 (probability of superiority 1.000, Holm-adjusted p = 0.0007), and it does so without weakening containment: over 69,928 matched cells the historical quarantine digest is identical, the paired CPI, WCAL and recovery-eligible-record differences are exactly zero, and the counts of taint clears, quarantine reductions, identity reuses, hidden-truth uses, verifier bypasses, incomplete-provenance admissions and prohibited-ancestry admissions are all zero, while every isolated unsafe control records its own distinct violation. The remaining parents do not clear their frozen bars: H2 is inconclusive because 89% of its pairs are incomplete, H3 and H4 each fail a required sub-comparison (one of which has no eligible pairs at all), H5 fails because the frozen median trusted-function-restoration difference is zero, H6 fails a different clause — governed recurrence exceeds single-mechanism substitute reconstruction by more than its 0.005 non-inferiority margin, even though governed repair beats all three single mechanisms on coverage — and H7 is unevaluable because the preregistered high-burden label saturates to a single class. The preregistered joint success rule is therefore not satisfied, and roughly 39% of governed repair targets are irreducible by construction. The scope was fixed in advance and is unchanged by the outcome: a bounded existence-and-direction finding inside a synthetic benchmark, not evidence that any product self-heals a deployed system.