Start DISCTL-WP-0002: policies, registers, runbooks, playbooks

Expand AssetRegister and DataRegister with T0/T4 stack assets.
Add ResiliencePolicy, PanicSheet, full-server-loss runbook, and five
incident playbooks. Update README with mirror status. Mark T02-T05,
T07-T08 done; T01 and T06 in progress.

DataRegister.yaml

@@ -1,10 +1,10 @@
 # Resilience Control Plane — data register (initial seed)
 # DISCTL-WP-0003-T01 — data classes covered by railiance-backup lanes
-# Full data inventory (Bubble, Stripe exports, member data, etc.) follows in DISCTL-WP-0002-T02.
+# Stack data classes (T0/T4): DISCTL-WP-0002-T02. Backup lanes: DISCTL-WP-0003-T01.
 
-schema_version: "0.1"
+schema_version: "0.2"
 updated: "2026-07-07"
-register_scope: backup_lane_data_classes
+register_scope: backup_lanes_and_stack
 
 data_classes:
   - id: data-custodian-state-hub
@@ -201,6 +201,82 @@ data_classes:
     gaps:
       - "Not inventoried in AssetRegister T0 section yet — DISCTL-WP-0002-T02 follow-up"
 
+  - id: data-dns-zone-records
+    name: DNS zone records (*.coulomb.social)
+    tier: T0
+    source_of_truth: IONOS DNS panel
+    backup_stream: null
+    backup: manual export after changes
+    recovery_method: Re-enter records from export; cutover per PanicSheet.md
+    rpo: manual
+    rto: 2h
+    owner: Bernd
+    status: at_risk
+    gaps:
+      - "No standing zone export on file"
+
+  - id: data-stripe-customers
+    name: Stripe customers / subscriptions / payment history
+    tier: T0
+    source_of_truth: Stripe (authoritative)
+    backup_stream: null
+    backup: none automated
+    recovery_method: Stripe dashboard; scheduled CSV/Data Pipeline export (not established)
+    rpo: 24h-7d
+    rto: 24h
+    owner: Bernd
+    status: at_risk
+
+  - id: data-bubble-members
+    name: Bubble.io member / application database
+    tier: T4
+    source_of_truth: Bubble.io platform
+    backup_stream: null
+    backup: none automated
+    recovery_method: Bubble database export per vendor docs
+    rpo: 24h
+    rto: 24h
+    owner: Bernd
+    status: at_risk
+    gaps:
+      - "Export cadence not established"
+
+  - id: data-openbao-secrets
+    name: OpenBao secret material (runtime)
+    tier: T0
+    source_of_truth: OpenBao on railiance01
+    backup_stream: null
+    backup: sealed recovery vault (partial)
+    recovery_method: Unseal + restore; rotate after breach — never blind restore
+    rpo: immediate rotation on incident
+    rto: 2-4h
+    owner: Bernd
+    status: at_risk
+
+  - id: data-openrouter-usage
+    name: OpenRouter API keys and usage metadata
+    tier: T4
+    source_of_truth: OpenRouter account + OpenBao
+    backup_stream: null
+    backup: OpenBao credential paths
+    recovery_method: Issue new key; switch to alternate provider
+    rpo: N/A
+    rto: 1-4h
+    owner: Bernd
+    status: operational
+
+  - id: data-disaster-control-git
+    name: disaster-control repository content
+    tier: T1
+    source_of_truth: gitea.coulomb.social/coulomb/disaster-control
+    backup_stream: backup-gitea-canonical
+    backup: git push only; no mirror yet
+    recovery_method: git clone from off-Gitea mirror (T01) or gitea dump
+    rpo: 24h
+    rto: 4h
+    owner: Bernd
+    status: at_risk
+
 status_legend:
   operational: "Backup mechanism exists and has run successfully"
   manual_only: "Restore path exists but backup is operator-triggered only"