Record failed custody finish diagnosis and tested recovery helper repair

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

docs/evidence/2026-10-03-root-custody-finish-failure-audit.json

@@ -0,0 +1,28 @@
+{
+  "scope": "failed-attended-finish-stage-audit",
+  "raw_logs_emitted": false,
+  "lookup_succeeded": true,
+  "events": [
+    {
+      "time": "2026-10-03T18:54:37.880715204Z",
+      "request_id": "b29f3261-7fd3-84e9-7aa4-493205e469a4",
+      "stage": "custody_read",
+      "error_present": false,
+      "permission_denied": false
+    },
+    {
+      "time": "2026-10-03T18:54:38.14371374Z",
+      "request_id": "e474bc4b-9265-f3d9-d0f3-cdf6ec7eb038",
+      "stage": "backup_lane_read",
+      "error_present": false,
+      "permission_denied": false
+    },
+    {
+      "time": "2026-10-03T18:54:38.4374245Z",
+      "request_id": "d4c3df09-30e0-36f7-c66f-8d000e23dfe2",
+      "stage": "operator_backup_read",
+      "error_present": false,
+      "permission_denied": false
+    }
+  ]
+}

docs/evidence/2026-10-03-root-grant-delivery-progress.md

@@ -179,3 +179,37 @@ was retrieved through a fresh remote clone and matched byte-for-byte; the owner
 retains its safe remote readback receipt. Provider archive generation is
 explicitly unverified; the prepared attended direct encrypted history roundtrip
 is still required. All authorized source work is implemented and synced.
+
+## Failed recovery finish attempt — 2026-10-03
+
+Founder ran the prepared helper with fresh receipt path
+`/tmp/platform-root-finish-20261003T185421Z-333977.json`. Warden reported child
+nonzero and session revoked; no receipt was created. Recovery/provider readiness
+is not established. The helper's catch-all exit without a safe failure receipt
+was an implementation gap and is being repaired before another attended retry.
+
+Independent [bounded audit lookup](2026-10-03-root-custody-finish-failure-audit.json)
+confirms successful custody, governed backup-lane and operator backup-bundle
+reads at 18:54:37–38 UTC, with no errors. The failure is therefore after those
+reads, within the backup roundtrip preparation/execution. Its exact stage cannot
+be inferred from suppressed exceptions. No IAM widening is justified. Local
+imports, validator/schema pins, retained-state validation and installed age
+binaries pass offline preflight. Owner repair adds allowlisted stage/failure
+receipts and full-command failure tests while keeping all raw diagnostics private.
+
+Producer repair committed `33ff822`: stdlib entry reserves a fresh mode-0600
+receipt before imports, with fixed stage/error codes for expected failures and
+safe numeric HTTP/artifact metadata. Foreign exception text is never emitted.
+The installed wrapper was independently smoke-checked outside the attended
+envelope: it refused before owner reads and created the expected safe failure
+receipt, with no raw output. Producer suite passed 32 tests, including full
+private attended-HOME command execution with the real validator and age crypto
+against disposable owner/provider fixtures, startup/dependency, stale receipt,
+auth, quota, crypto, upload/download and incident/escrow failures.
+
+Recovery decryption now verifies the existing independent local escrow recipient
+against the governed lane and decrypts downloaded history with that escrow key;
+no key is created, reset or printed. A mismatch is a specific recovery blocker.
+Corrected attended retry with a new receipt is necessary to prove the actual
+provider roundtrip or expose its precise safe failure stage. The original
+failure's exact cause is still unknown, and provider readiness remains unproven.