The recovery plan needs prerequisites online before the services that depend on them. Implement the ordering so invalid dependency graphs are reported rather than producing an unsafe restart sequence.
Build the implementation in Bash under /app, with /app/run.sh as its entry point. Read one JSON request from standard input and write one JSON result to standard output. Input has dependencies mapping every service to prerequisite names, running service names, and targets to recover. Return start_order for the dependency closure of targets excluding already-running services. Use depth-first traversal over sorted targets and sorted unique dependencies, append a service after its dependencies. Running services are trusted and their dependencies need not be restarted. Unknown service names anywhere and cycles encountered in the recovery closure must be rejected.
Reject inputs that violate an explicit validation rule with exit status 2, no standard output, and {"error":"invalid_input"} on standard error. For valid input, exit with status 0. Keep the implementation reusable for new inputs; it must work offline and must not depend on the example data being the only data it receives.
Repair or replace the unfinished /app/run.sh and add source files under /app. Malformed JSON must use the same invalid-input response. Do not read /tests or /oracle from the application.