Prepare immutable caller rollout and independent Scaleway recovery custody

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a11fd9-caf6-7a63-b578-9daaaa134ff2

workplans/EMAIL-WP-0007-ledger-backup-recovery.md

@@ -174,3 +174,54 @@ both timers are disabled. T04 is progress, with first-run/recovery/delivery prov
 T03 retains generation retention/capacity, independently retained receipt/key/image
 escrow and a separate recovery caller. Schedule/RPO admission and incident
 post-capture reconciliation remain required before workplan completion.
+
+## Closure package and Scaleway custody — 2026-10-09
+
+User selected Scaleway, then named `email-connect-backup-primary`. Retain that
+existing IAM application (0eb0f958-77a4-4c70-9aa7-14ba46411415) for routine archive
+publication; CCR-2026-0037 admits only the email-connect archive prefix and excludes
+escrow and administration. This selection is not evidence of additional grants.
+Actual native metadata shows versioning Enabled and a bucket-wide 30-day expiry
+for current and noncurrent objects. No provider configuration was changed.
+
+The public closure contract is deploy/closure/plan.json; preparation evidence is
+deploy/closure/evidence-2026-10-09.json. Proposed schedule is daily 04:15 UTC with
+five-minute jitter, 24-hour RPO target and 26-hour freshness threshold. Proposed
+local capacity floor/budget are both 8 GiB, with 14 daily/4 weekly generations and
+weekly owner-operated expiry by platform-root. The new staged capacity guard
+refuses before capture at low free space or when local retained files approach
+that budget; it never deletes retained objects. These targets are prepared, not
+measured production RTO or enabled operation. Node-installed helpers are unchanged.
+
+A private 47,541,825-byte recovery kit binds the existing protected first backup,
+receiver image, recovery tools and public receipts. It excludes the private age
+identity. SHA256: 97d1a4d4b55729dd226277601637d64b086de21b21c9951c1d7da05c914c350b.
+Rehearsal using its hash-bound bundled image passes without pulling an image,
+under UID10001/network-none, preserving all six tables; elapsed 2.31 seconds is
+application rehearsal only. The kit remains local and has not been uploaded.
+
+Prepared Scaleway custody uses a protected opaque Secret Manager container
+`email-connect-ledger-age-recovery` in nl-ams with no ephemeral policy, and private
+versioned bucket `railiance-email-connect-recovery`, prefix `kits/`, with no expiry.
+This preserves the protected recovery point beyond the primary archive lifecycle.
+Provider containers, project/secret references, separate recovery application and
+effective grants still need owner admission. Existing publisher access cannot
+create these resources. A different durable arrangement is acceptable after its
+actual effective permissions and retention are reconciled with the contract.
+
+scripts/scaleway-recovery-custody.py defaults to preview. Attended execution takes
+--secret-id, --project-id, --identity and a fresh --receipt; SCW_SECRET_KEY stays
+in the operator environment. It checks exact protected metadata, writes/reuses
+only revision 1 and silently verifies the matching age recipient by readback.
+scripts/publish-ledger-recovery-kit.py defaults to preview; execution accepts
+private owner/reader credential files, --kit, --kit-receipt, --output and --receipt.
+It refuses disabled versioning or lifecycle rules, publishes conditionally and
+checks size/hash through a separate reader's version-pinned GET. Different key
+IDs do not prove different application bindings or denied writes. Receipts keep
+those fields false pending native proof, independent account entry and a drill
+from the provider-retrieved kit and escrow identity. No secret values belong in
+chat, argv, evidence, Git or the operations inbox.
+
+Full email regression: 193 passed, zero skips; focused syntax checks pass.
+Timers remain disabled. T03/T04 stay progress until durable independent custody,
+retention/schedule admission and actual recurring operation are evidenced.