Record completed owner recovery preparation and final sync receipts

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

workplans/NK-WP-0045-root-grant-custody-record.md

@@ -354,8 +354,9 @@ Producer prepared `scripts/root-custody-finish-attended.sh`: it checks the
 current live source against retained high-water state, uses the current governed
 Nextcloud Backup account/lane, enforces quota, encrypts baseline/history with
 age, creates one uniquely named object and verifies provider readback/decryption.
-It does not overwrite/delete backups or rotate credentials. Eighteen producer/
-finish tests passed. It also checks whether the historical local backup-share
+It does not overwrite/delete backups or rotate credentials. Nineteen producer/
+finish tests passed, including real age crypto with a disposable in-memory
+provider. It also checks whether the historical local backup-share
 URL inadvertently surfaced during inspection matches the current lane, using
 booleans only; a current match stops before upload for the owner incident flow.
 No raw credentials are retained in evidence.
@@ -364,3 +365,11 @@ T06 is complete, with user-engine synced `d955cd7` and runtime owner `f108c65`.
 T05 and the workplan return to blocked solely on the prepared attended recovery
 execution and its owner receipt. The founder's own OIDC/MFA terminal is required
 by the owner execution contract; no approval decision is reopened.
+
+Producer final owner sync: `b8f8a7ada65f0a86b90a54812365757838102991`, exact
+expected/derived commit applied on primary/railiance01, clean and ahead/behind 0.
+Non-authoritative recovery copy of the non-secret baseline/history was retained
+in owner source commit `a252447058105eed0931d34f1a906f39ce7c2e5e` and retrieved
+through a fresh remote clone with exact byte matching. That proves remote source
+retrieval, not a provider archive generation. The attended direct history backup
+roundtrip is the remaining evidence gate.