Record managed ledger recovery tasks and redacted rehearsal proof

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a11538-05ea-7b63-b3c7-a2df5f38898d

WORK-RECORDS.md

@@ -14,6 +14,7 @@
 | workplan | EMAIL-WP-0004 | finished | — | workplans/EMAIL-WP-0004-transactional-mail-delivery-service.md |
 | workplan | EMAIL-WP-0005 | finished | — | workplans/EMAIL-WP-0005-test-mailbox-harness.md |
 | workplan | EMAIL-WP-0006 | finished | — | workplans/EMAIL-WP-0006-verification-retry-safety.md |
+| workplan | EMAIL-WP-0007 | active | — | workplans/EMAIL-WP-0007-ledger-backup-recovery.md |
 | task | EMAIL-WP-0001-T01 | done | — | workplans/EMAIL-WP-0001-repo-onboarding.md |
 | task | EMAIL-WP-0001-T02 | done | — | workplans/EMAIL-WP-0001-repo-onboarding.md |
 | task | EMAIL-WP-0001-T03 | done | — | workplans/EMAIL-WP-0001-repo-onboarding.md |
@@ -51,3 +52,7 @@
 | task | EMAIL-WP-0006-T02 | done | — | workplans/EMAIL-WP-0006-verification-retry-safety.md |
 | task | EMAIL-WP-0006-T03 | done | — | workplans/EMAIL-WP-0006-verification-retry-safety.md |
 | task | EMAIL-WP-0006-T04 | done | — | workplans/EMAIL-WP-0006-verification-retry-safety.md |
+| task | EMAIL-WP-0007-T01 | done | — | workplans/EMAIL-WP-0007-ledger-backup-recovery.md |
+| task | EMAIL-WP-0007-T02 | done | — | workplans/EMAIL-WP-0007-ledger-backup-recovery.md |
+| task | EMAIL-WP-0007-T03 | wait | — | workplans/EMAIL-WP-0007-ledger-backup-recovery.md |
+| task | EMAIL-WP-0007-T04 | wait | — | workplans/EMAIL-WP-0007-ledger-backup-recovery.md |

docs/ledger-backup-rehearsal-2026-10-08.json

@@ -0,0 +1,43 @@
+{
+  "scope": "synthetic_local_archive",
+  "provider_contacted": false,
+  "production_data": false,
+  "status": "application_restored_verified",
+  "network": "disabled",
+  "uid": 10001,
+  "checks": {
+    "accepted_verifications": 3,
+    "unknown_verifications": 1,
+    "invalidated_handles": 2,
+    "suppressions": 1,
+    "accepted_deliveries": 1,
+    "unknown_sends": 1
+  },
+  "table_count": 5,
+  "rows_unchanged": true,
+  "schema_unchanged": true,
+  "mail_sent": false,
+  "elapsed_seconds": 0.86,
+  "evidence_boundary": "synthetic_local_archive",
+  "full_repository_tests": {
+    "passed": 120,
+    "skipped": 0,
+    "local_greenmail_harness": true
+  },
+  "node_preflight": {
+    "server_dry_run": true,
+    "live_changes": false,
+    "receiver_spec_changed": false,
+    "image_pinned": true,
+    "pvc_read_only": true,
+    "helper_egress_denied": true
+  },
+  "backup_caller_custody_file_present": false,
+  "live_backup_activated": false,
+  "source_sha256": {
+    "capture-ledger.py": "0d643b2fc031279e414b856ed4a29c293603aeedf142035e7cab739ed3e8061d",
+    "ledger_archive.py": "81e66bd0ca94a4d5a800d9f0f23989d3060877d2f30de867f69baebab773a3a9",
+    "backup-ledger.py": "8a89aa01c0c22e46352f1ad7a6f30b9b5db792639c1acc9a60579f50b7c8c369",
+    "rehearse-ledger.py": "e1063705233175d02703a4d117bee6d2d69dc5bb19edbda446cc160d3188ad9f"
+  }
+}

docs/ledger-backup-review-2026-10-08.md

@@ -136,6 +136,13 @@ loss. Production restore and private-copy expiration are separate owner actions.
  is already hash-locked and offline-verified by RPF-WP-0053; actual email caller
  admission remains missing.
 
+Machine-readable evidence: ledger-backup-rehearsal-2026-10-08.json. The actual
+synthetic packaged drill checked 3 accepted verification operations, 1 unknown
+verification, 2 invalidated handles, 1 suppression, 1 accepted invitation and 1
+unknown invitation reservation; isolated startup/checks took 0.86s. This excludes
+capture/upload/retrieval/decryption and is not full RTO. Private fixture paths and
+all row contents are omitted from the evidence file.
+
 T01/T02 implementation/rehearsal can close on this evidence; T03/T04 remain open
 for actual custody, offsite capture/recovery, post-capture reconciliation contract,
 monitored operation and founder activation. CSOC-WP-0010 remains active for those

workplans/EMAIL-WP-0007-ledger-backup-recovery.md

@@ -11,6 +11,7 @@ created: "2026-10-07"
 updated: "2026-10-08"
 origin: residual
 origin_ref: EMAIL-WP-0006
+state_hub_workstream_id: "35be21a2-343b-52e1-ba5e-32fead7a7831"
 ---
 
 CSOC-WP-0010-T04/T05 request durable recovery of the SQLite delivery/challenge
@@ -24,6 +25,7 @@ a recurring backup. This work does not change SMTP/caller custody or send mail.
 id: EMAIL-WP-0007-T01
 status: done
 priority: high
+state_hub_task_id: "20b72599-da99-5d66-a0ab-8d946e837a2f"
 ```
 
 Prepare a default-dry-run node capture, pinned to the current cluster/image/PVC.
@@ -42,6 +44,7 @@ in this archive. Tests use only synthetic records and no production endpoints.
 id: EMAIL-WP-0007-T02
 status: done
 priority: high
+state_hub_task_id: "c8acba6d-1087-5ffd-a7e6-59608c07c1ff"
 ```
 
 Add attended guarded decrypt/unpack and all-table/schema/row fingerprint checks.
@@ -61,6 +64,7 @@ status: wait
 priority: high
 needs_human: true
 intervention_note: "Platform must admit the separate email-connect archive prefix, caller delivery, retention/capacity, independently retained receipts and recovery escrow; shared uploader support alone is not custody admission."
+state_hub_task_id: "680fe4d6-12af-5296-acf9-15c9a01a0db3"
 ```
 
 Platform profile: platform-pg/application-archives/email-connect/ in the current
@@ -79,6 +83,7 @@ status: wait
 priority: high
 needs_human: true
 intervention_note: "Needs T03 admission and the exact first receiver pause/upload/schedule decision; real offsite retrieval, attended recovery and failure reception remain unproved."
+state_hub_task_id: "66401e5c-a5cf-5e67-beab-e503ae079964"
 ```
 
 Present pinned source hashes, dry-run evidence, coherent ledger scope, bounded