NK-WP-0054-T05 phase 3b: restore launchers follow the archived identities; startup proof

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56

tests/test_isolated_lldap_recovery.py

@@ -56,6 +56,26 @@ def test_configuration_preserves_original_seed_and_disables_reset_sending(tmp_pa
     assert PASSWORD.encode() not in value and jwt not in value
 
 
+
+@pytest.mark.parametrize('configured', [None, 'ld-admin'])
+def test_configured_admin_follows_the_archived_deployment(tmp_path, configured):
+    # NK-WP-0054-T05: before and after the bind split the restore takes the configured
+    # super-admin from the archived deployment, never a hard-coded name.
+    resources(tmp_path)
+    if configured:
+        path = tmp_path / 'resources/sso/deployment/lldap.json'
+        deployment = json.loads(path.read_text())
+        deployment['spec']['template']['spec']['containers'][0]['env'].append(
+            {'name': 'LLDAP_LDAP_USER_DN', 'value': configured})
+        path.write_text(json.dumps(deployment))
+    data = tmp_path / 'data/lldap'
+    data.mkdir(parents=True)
+    (data / 'lldap_config.toml').write_text('key_seed = "synthetic-original-seed"\n')
+    import tomllib
+    value, _, password, _ = m.configuration(tmp_path)
+    assert tomllib.loads(value.decode())['ldap_user_dn'] == (configured or 'admin')
+    assert password == PASSWORD.encode()
+
 def test_tar_transport_refuses_path_escape():
     with pytest.raises(m.bundle.Refused):
         m.archive_files({'../escape': b'synthetic'})