Accept independent outage recovery and Storage Share guide publication

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

registry/capabilities/capability.security.bootstrap-recovery.md

@@ -52,8 +52,8 @@ discovery:
     privacyIDEA keys plus linked PostgreSQL dump
   - Public-recipient age sealing, Storage Share create/readback, separate retention
     and attended independent-key archive verification
-  - Railiance bootstrap handoff and a prepared independent-provider download path
-    requiring neither OpenBao nor SSO; actual outage-path owner drill remains pending
+  - Railiance bootstrap handoff and actual independent-provider retrieval requiring
+    neither OpenBao nor SSO; operator archive recovery passed on 2026-10-16
   excludes:
   - Source repairs and disposable native fixtures do not prove estate root isolation
     or recovery
@@ -75,6 +75,7 @@ availability:
   - tools/bootstrap-recovery/run-offline-recovery.sh
   - docs/disaster-recovery-storage-share.md
   - docs/identity-service-restore-packet.md
+  - docs/storage-share-recovery-publication.md
   - tools/bootstrap-recovery/verify-identity.py
   consumption_modes:
   - CLI
@@ -152,7 +153,8 @@ For an outage, use [the Storage Share recovery guide](../../docs/disaster-recove
 and the self-contained kit built by `tools/bootstrap-recovery/recovery-kit.py`.
 The private operator handoff publishes the versioned guide/kit with readback,
 retrieves the protected generation using independently held provider access,
-and prompts separately for the human-held age key. Source/fixture preparation
-passed; consult NK-WP-0049-T23/T26 for actual outage drill/publication acceptance.
+and prompts separately for the human-held age key. Actual publication/readback
+and independent outage-path archive recovery passed on 2026-10-16; T23/T26 are
+done. See [the published location and trusted kit digest](../../docs/storage-share-recovery-publication.md).
 The [isolated service packet](../../docs/identity-service-restore-packet.md)
 records the remaining service-owner admission and native tests.