Degrade gracefully when Iroh modules fail

docs/architecture.md

@@ -145,6 +145,11 @@ the daemon lifetime. When endpoint startup succeeds, the Iroh EndpointID is
 recorded as a transport binding for the stable geth node identity. If local UDP
 binding is unavailable, the daemon keeps local control running and reports the
 Iroh startup error through status output.
+The same degraded-local behavior applies when the endpoint starts but a native
+blob, document, gossip, or initial mirroring step fails. Partially initialized
+native handles are released, the endpoint is closed, and `geth status` reports
+the runtime backends as unavailable with the concrete startup blocker. Local
+metadata, diagnosis, backup, and other non-network control remain available.
 
 SSH keys are not transport keys. They are admin trust anchors and signing
 identities for keychain and authorization operations. The bootstrap `geth ssh

docs/roadmap.md

@@ -26,6 +26,17 @@ For deployment-readiness work that cuts across feature areas, see
   - `[x]` Stale, unreachable socket paths are recovered automatically.
   - `[x]` Tests cover stale recovery and live second-daemon rejection.
 
+- `[x]` Keep local control available when Iroh-native startup degrades.
+  Acceptance criteria:
+  - `[x]` Endpoint startup and native blob/docs/gossip initialization failures
+    do not prevent the local control daemon from serving.
+  - `[x]` Partial native runtime handles are released and a partially started
+    endpoint is closed.
+  - `[x]` Status reports each native backend as unavailable with the runtime
+    failure note instead of claiming a compiled backend is healthy.
+  - `[x]` Tests inject a post-endpoint native-store failure and verify clean
+    degradation where UDP endpoint binding is available.
+
 - `[x]` Make startup modes and the daemon lifecycle discoverable.
   Acceptance criteria:
   - `[x]` Base and nested CLI help explain every command family instead of