ops(recovery): verify complete hardened recurring backup service

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

docs/bootstrap-recovery-ceremony.md

@@ -496,3 +496,16 @@ The verified first generation stays pinned until a separately reviewed owner
 change. Both archive creation/retrieval/recovery and the backup job setup are now
 complete. NK49 remains active because broader native service/caller and legacy
 custody acceptance are separate open closure criteria.
+
+
+The installed hardened systemd backup service was then run once end to end.
+`Result=success` and `ExecMainStatus=0` cover pre-retention, scheduled capture,
+fresh upload/download verification and post-retention. It produced a second
+verified generation, `net-kingdom-identity-20261016T073927Z-1224cb9362f8.tar.age`,
+SHA256 `2b88375c378aac52fbd82f2bfa21fbbd9af61d8f88abdad2ed3f997dc9993b9c`.
+Actual retention kept both the independently recovered first point and the newer
+point, selected/deleted nothing and removed no local generations. Helpers and
+plaintext were cleaned; failure markers and event outbox remain empty. This
+validates the actual hardened recurring-job path, beyond a direct CLI capture.
+Evidence: `recurring-job-review.json`. No further validation captures are needed
+before the next scheduled run absent a new failure or source change.

docs/evidence/2026-10-16-identity-backup-live/recurring-job-review.json

@@ -0,0 +1,33 @@
+{
+  "schema": "netkingdom.identity-recurring-job-review.v1",
+  "service": {
+    "Result": "success",
+    "ExecMainStatus": "0"
+  },
+  "last_success": {
+    "finished_at": "2026-10-16T07:40:06.300739+00:00",
+    "artifact": "net-kingdom-identity-20261016T073927Z-1224cb9362f8.tar.age",
+    "directory": "/var/lib/net-kingdom-backup/runs/net-kingdom-identity-20261016T073927Z-1224cb9362f8.tar.age",
+    "ciphertext_sha256": "2b88375c378aac52fbd82f2bfa21fbbd9af61d8f88abdad2ed3f997dc9993b9c",
+    "offsite_verified": true
+  },
+  "accepted_recovery_artifact": "net-kingdom-identity-20261016T063159Z-5882771aa2ce.tar.age",
+  "retention": {
+    "status": "retention_applied",
+    "started_at": "2026-10-16T07:40:08.098802+00:00",
+    "protected": "net-kingdom-identity-20261016T063159Z-5882771aa2ce.tar.age",
+    "keep": [
+      "net-kingdom-identity-20261016T063159Z-5882771aa2ce.tar.age",
+      "net-kingdom-identity-20261016T073927Z-1224cb9362f8.tar.age"
+    ],
+    "candidates": [],
+    "deleted": [],
+    "unknown_objects_untouched": true,
+    "local_generations_removed": []
+  },
+  "capture_marker_present": false,
+  "retention_blocked": false,
+  "pending_outbox_events": 0,
+  "helper_cleanup_verified": true,
+  "plaintext_cleanup_verified": true
+}

docs/evidence/2026-10-16-identity-backup-live/rollout-review.json

@@ -57,5 +57,12 @@
   "retention_deletions": 0,
   "health_service_result": "success",
   "health_service_exit": 0,
-  "native_full_service_authentication_proven": false
+  "native_full_service_authentication_proven": false,
+  "installed_hardened_recurring_job_verified": true,
+  "systemd_backup_result": "success",
+  "systemd_backup_exit": 0,
+  "second_actual_generation_verified": true,
+  "pinned_and_newest_retention_verified": true,
+  "no_failed_capture_or_retention_markers": true,
+  "pending_event_outbox": 0
 }

workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md

@@ -595,6 +595,16 @@ legacy credential dispositions remain open. T02 progress/T03 wait retained.
 Evidence: actual archive recovery/review, independent transfer and activation
 receipts in `docs/evidence/2026-10-16-identity-backup-live/`.
 
+2026-10-16 final recurring-job acceptance: the actual installed hardened systemd
+service passed all three phases (retention → capture/upload/readback → retention),
+Result=success/ExecMainStatus=0. Second actual generation
+`net-kingdom-identity-20261016T073927Z-1224cb9362f8.tar.age` verified off-host.
+Retention kept the independently recovered first point and newest point, with
+no candidates/deletions/local pruning; helper/plaintext cleanup passed, failure
+markers and outbox empty. `recurring-job-review.json` records this final native
+path acceptance. Backup/recovery setup is complete; wider NK49 closure remains
+as stated in T02/T03, without falsely marking full service recovery complete.
+
 ## Verify owner-approved recovery and current native callers
 
 ```task