ops(recovery): verify full archive recovery and activate protected backup timers

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

registry/capabilities/capability.security.bootstrap-recovery.md

@@ -89,6 +89,8 @@ evidence:
   - tools/custody-record/README.md
   - docs/bootstrap-recovery-ceremony.md
   - workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+  - docs/evidence/2026-10-16-identity-backup-live/actual-full-recovery-review.json
+  - docs/evidence/2026-10-16-identity-backup-live/activation-review.json
   tests:
   - tests/test_identity_bundle.py
   - tests/test_identity_offsite.py
@@ -110,8 +112,10 @@ consumer_guidance:
     or autonomous bare-VM restore is established.
   - Actual first full identity bundle captured, sealed and Storage Share readback
     verified on2026-10-16; both scoped readers passed native identity/namespace/audience/ESO
-    checks. Independent human-key full archive proof and complete service authentication
-    remain pending.56 focused implementation checks pass.
+    checks. Independent human-key full archive recovery passed and daily backup/hourly
+    health are active. Complete service authentication/token decryption/audit continuity
+    and an unattended full-estate rebuild remain unproven. 56 focused implementation
+    checks pass.
 ---
 
 # Guarded bootstrap and recovery preparation