Prepare platform recovery scheduling contract and refresh blockers

Verify the repaired ESO lane, separate actor ownership from scheduling, and define the first bounded recovery slice and owner contract. Keep role acceptance and live operation admission explicit.

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a100de-2e1c-7e23-9ae9-2da0e0499411

workplans/ACTIVITY-WP-0042-platform-backup-restore-evidence-scheduling.md

@@ -27,8 +27,11 @@ Facts from the repo (2026-10-03):
 - ACT-ADR-007 allowlist is closed. A restore-evidence or Scaleway-backup run
   needs a new code-registered operation plus an ADR successor, tests, a
   credential route and an evidence contract. A definition string cannot add one.
-- The `actcore-backup-offsite` lane depends on ClusterSecretStore
-  `openbao-activity-core`, reported failing since 2026-09-19 (expired token).
+- The old expired-token finding is superseded: RPF-WP-0045 replaced static
+  tokens with Kubernetes auth. On 2026-10-03, read-only railiance01 inspection
+  confirmed `openbao-activity-core` Ready/Valid and `actcore-backup-offsite`
+  Ready/SecretSynced (refresh 09:29:02Z). This verifies the existing Nextcloud
+  lane only; new recovery authority and credential scope remain unapproved.
 
 ## Decide whether activity-core accepts the scheduling role
 
@@ -62,15 +65,15 @@ founder confirmation. activity-core replied with the same position.
 ```task
 id: ACTIVITY-WP-0042-T02
 status: wait
-depends_on: [ACTIVITY-WP-0042-T01]
-blocking_reason: "Depends on T01: no bounded operation or credential lane until the founder accepts the role."
+depends_on: [ACTIVITY-WP-0042-T01, ACTIVITY-WP-0042-T05]
+blocking_reason: "Requires role acceptance (T01) and the agreed platform runner contract (T05) before operation or credential admission."
 priority: medium
 state_hub_task_id: "250c6e8e-7281-5dec-9a92-06081b8c96bb"
 ```
 
 Blocked on T01. Successor to ACT-ADR-007, registry entry (target bounds,
 timeout, idempotency, dry_run explicit), tests, credential route via OpenBao
-(owner railiance-platform) with a repaired `openbao-activity-core` store, and
+(owner railiance-platform; existing store health verified), and
 non-secret evidence mode. Scheduled caller satisfies RPF-WP-0038-T04 only
 once recurring tiered scheduling and retention are accepted by their owners.
 
@@ -94,3 +97,41 @@ otherwise the declaring owner is whoever holds the actor's issuance
 (railiance-platform was also asked). Never infer membership.
 
 2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.
+
+
+## Prepare the concrete scheduling and runner proposal
+
+```task
+id: ACTIVITY-WP-0042-T04
+status: done
+priority: high
+```
+
+User requested investigation and forward progress on 2026-10-03. Reviewed the
+existing definition, bounded-operation registry, platform recovery entry points,
+credential route and actor declaration. Removed the stale ESO blocker after a
+fresh metadata-only check. Concrete recommendation and staged acceptance:
+`docs/platform-recovery-scheduling-plan.md`.
+
+Recommend scheduling-only ownership; platform retains the recovery runner and
+policy. First proposed slice is one disabled/manual apps-pg recovery-evidence
+operation, with offline contract tests before any live admission. T01 is still
+an explicit role choice; this investigation does not record acceptance of it
+or resolve the broader D2 decision. The actor ownership question is separate.
+
+## Agree the platform runner contract
+
+```task
+id: ACTIVITY-WP-0042-T05
+status: wait
+priority: high
+depends_on: [ACTIVITY-WP-0042-T01]
+blocking_reason: "Scheduling role acceptance and platform agreement on the fixed runner contract are needed before adapter admission."
+```
+
+Use the contract table in `docs/platform-recovery-scheduling-plan.md` for an
+owner review: authority verification, exact target, implementation version,
+durable run receipts, overlap/retry behavior, cleanup, resource ceilings and
+credential scope. Existing restore CLIs are not an admitted unattended API.
+This task records the dependency; no external acceptance or message is claimed.
+T02 implements/adopts the agreed contract; T03 does not gate offline design.