Add canon reset and reingest guardrails

docs/registry-api.md

@@ -99,4 +99,17 @@ GET /exports/libraries/xregistry
 GET /ui/graph-explorer
 GET /exports/graph-explorer/manifest
 GET /exports/graph-explorer
+GET /exports/reset-archive
 ```
+
+## Guarded Reset
+
+```text
+POST /admin/reset-graph-data
+```
+
+The reset endpoint requires `confirm`,
+`reason`, and `archive_sha256`. `confirm` must be
+`RESET-RAILIANCE-FABRIC-GRAPH-DATA`. Operators should prefer the CLI wrapper
+documented in `docs/registry-reset-operations.md`, because it exports the
+archive and computes the checksum before calling the destructive endpoint.

docs/registry-reset-operations.md

@@ -0,0 +1,51 @@
+# Registry Reset Operations
+
+RAIL-FAB-WP-0016 allows a destructive registry graph reset, but only after an
+archive has been produced and the operator uses an explicit confirmation token.
+
+## Export Archive Only
+
+```bash
+railiance-fabric registry export-reset-archive \
+  .railiance-fabric/reset-archive.json \
+  --registry-url http://127.0.0.1:8765
+```
+
+The archive contains:
+
+- repository registrations,
+- current combined graph export,
+- stored graph snapshots,
+- discovery snapshots and accepted graph snapshot links,
+- artifacts,
+- library inventory,
+- prior reset events,
+- rollback notes.
+
+## Guarded Reset
+
+```bash
+railiance-fabric registry reset-graph-data \
+  --registry-url http://127.0.0.1:8765 \
+  --archive .railiance-fabric/reset-archive.json \
+  --confirm RESET-RAILIANCE-FABRIC-GRAPH-DATA \
+  --reason "canon-aligned graph reset before full reingest"
+```
+
+The command first writes the archive, computes its SHA-256, then calls the
+registry reset endpoint. The registry records a reset event with the archive
+path, archive checksum, reason, and dropped row counts.
+
+The reset deletes graph snapshots, discovery snapshots, artifacts, and library
+inventory. Repository registration rows are preserved so reingest can start
+from the known repo list.
+
+## Rollback Limits
+
+The archive is a JSON evidence bundle, not an automatic SQLite restore. Use it
+to inspect or manually reinsert prior registry data if needed. After reset, the
+intended source of truth is a fresh scan and acceptance pass over registered and
+local repositories using the canon-aligned model.
+
+Do not run the reset until the replacement scanner/projection path has passed
+validation and a sample reingest review.