Walter-byte · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026
diff --git a/docs/DECISIONS.md b/docs/DECISIONS.md
@@ -1207,8 +1207,7 @@ a new deployment platform or automatic schema mutation.
 
 Status
 
-Accepted for repository implementation. Production acceptance remains pending
-A-owned live validation.
+Accepted. A-owned P7.2 production validation passed on 2026-10-05.
 
 ---
 
@@ -1256,9 +1255,48 @@ new application table, public endpoint, provider lock-in, or multi-region HA.
 
 Status
 
-Accepted for repository implementation. Production scheduling, destination,
-restore exercise, and milestone acceptance remain pending A-owned validation.
+Accepted for repository implementation. A-owned local/off-site backup and
+isolated restore validation passed on 2026-10-05, but scheduled systemd backup
+failed because Docker Compose attempted to read `/srv/wctm/.env` as `wctm`.
+P7.3 production acceptance remains pending a successful live scheduler proof.
 
 ---
 
-Next decision number: D-033.
+## D-033
+
+Date
+
+2026-10-05
+
+Decision
+
+Proposed after P7.3 closure: P7.2 is production-complete, while P7.3 still
+requires a successful scheduled-backup systemd proof on authoritative
+`waltpack`. Once P7.3 passes, Phase 7 would remain incomplete and pause before
+P7.4. P7.4–P7.8 would remain unstarted and available for later resumption when
+merchant/pilot evidence justifies them; historical provenance review would
+remain assigned to P7.8. Phase 6 remains deferred and unstarted.
+
+Private Pilot Readiness is proposed as the next active initiative after P7.3
+closure. Its bounded sequence is
+privacy/data-flow audit and merchant-facing disclosures; licensing/legal
+baseline; WordPress connector admin UI polish; `wctm.walterbyte.com` onboarding
+and product-surface polish; focused security/quality QA; and a private merchant
+pilot with real users. Engineering is frozen except for pilot-blocking defects.
+No new feature expansion or unrestricted public launch is approved. Each pilot
+task requires separate authorization; this decision implements none of them.
+
+Reason
+
+The deployment and recovery evidence can support a controlled private pilot
+after the scheduled-backup path passes live validation.
+Real merchant usage and payment evidence should guide further infrastructure
+and product investment before resuming the remaining Phase 7 or Phase 6 work.
+
+Status
+
+Proposed; not accepted until P7.3 scheduled-backup production proof passes.
+
+---
+
+Next decision number: D-034.
diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md
@@ -2,7 +2,7 @@
 
 **Generated:** 2026-07-19
 
-**Updated:** 2026-10-04
+**Updated:** 2026-10-05
 
 **Reason:** Maintaining implementation continuity
 
@@ -43,7 +43,7 @@ n8n is **NOT** part of the production architecture (D-008, prototype only).
 
 ---
 
-## 3. Architectural Decisions (D-001–D-032)
+## 3. Architectural Decisions (D-001–D-033)
 
 | ID    | Decision                                                                                                                                                                                                                   | Status   |
 | ----- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
@@ -79,8 +79,9 @@ n8n is **NOT** part of the production architecture (D-008, prototype only).
 | D-030 | P7.1 uses a temporary decrypt-only previous key, current-key-only writes, and a trusted-shell row-transactional rotation command for the exact five encrypted database fields                                              | Accepted |
 | D-031 | P7.2 separates restricted backend runtime from an ephemeral explicit Prisma migration identity and defines revision-locked fail-fast deployment plus volume-preserving immutable data-service reconciliation               | Accepted |
 | D-032 | P7.3 establishes atomic verified PostgreSQL backups, explicit retention, verified provider-neutral off-host copy, daily systemd scheduling, isolated guarded restore, DR dependencies, and target-only RPO/RTO             | Accepted |
+| D-033 | Proposed Phase 7 pause after P7.3 scheduled-backup proof, with Private Pilot Readiness next and Phase 6/P7.4–P7.8 deferred                                                                                                 | Proposed |
 
-Next decision number: **D-033**, if a future task produces a genuine
+Next decision number: **D-034**, if a future task produces a genuine
 architectural or product decision.
 
 ---
@@ -1031,7 +1032,7 @@ Final closure evidence:
 
 ---
 
-### Phase 7 — Production Readiness (current)
+### Phase 7 — Production Readiness (P7.3 scheduler proof pending)
 
 #### P7.1 — Production Security Baseline (complete; production validated)
 
@@ -1181,7 +1182,7 @@ Dependency and automated evidence:
   missing or excessive privileges across all 20 application tables, while the
   existing privileged owner remains available for Prisma migration execution.
 
-#### P7.2 — Production Migration & Deployment Path (repository complete; awaiting validation)
+#### P7.2 — Production Migration & Deployment Path (production complete)
 
 - Implementation commit:
   `91e16fd5933ffa4e6386d649f21f9e2592833ed5 chore(ops): establish production
@@ -1202,10 +1203,14 @@ migration and deployment path`.
   continuity and exact image configuration, and leaves apps stopped for cutover.
 - Failure guidance distinguishes safe application-image restoration from
   irreversible/forward-only schema effects and hands database recovery to P7.3.
-  Repository implementation is ready for B review; production acceptance is
-  pending A's combined runbook.
+- A-owned production validation on `waltpack` passed at reviewed revision
+  `034b2f565fd6b2fc50d6942ff1a40ca16598703c`: fresh backend/bot/migration
+  builds, distinct migration identity, 16 applied migrations with safe repeat,
+  removed credential/container, restricted `wctm_runtime`, preserved immutable
+  PostgreSQL/Redis and named volumes, `deployment path: PASS`, local/public
+  health/readiness, and bounded functional smoke. P7.2 is complete.
 
-#### P7.3 — Backup, Restore & Disaster Recovery (repository complete; awaiting validation)
+#### P7.3 — Backup, Restore & Disaster Recovery (scheduled proof pending)
 
 - Implementation commit:
   `ddde3c705b249a29a131a3bfc96763f17b6e9cbc chore(ops): add production backup
@@ -1234,9 +1239,22 @@ and recovery path`.
   app deployment; bounded smoke; post-deployment backup; isolated restore; and
   final permission/migration/backup/secret/health scans.
 
-This repository cycle performs no VPS, production, secret, live database,
-deployment, schema, migration, or product mutation. P7.2 and P7.3 are not
-production-complete. P7.4+, Phase 6, and product work remain unstarted.
+- A-owned backup/off-site/restore validation passed: verified custom dump
+  `wctm-postgres-20261005T133652Z-034b2f565fd6.dump` (2,392,191 bytes,
+  16 migrations), OneDrive three-artifact copy with streamed SHA-256 PASS,
+  isolated network-none restore with 16 migrations/21 public tables and
+  critical counts `tenants=7`, `users=6`, `stores=2`, `orders=54`, cleanup,
+  and clean final health/role/permission/secret scans. The live systemd service
+  then failed with `/srv/wctm/.env` permission denied as `wctm`; the timer was
+  not enabled. P7.3 remains open until the corrected scheduler passes live.
+
+This closure branch performs no VPS, production, secret, live database,
+deployment, schema, migration, or product mutation. Phase 7 remains incomplete;
+P7.4–P7.8 and Phase 6 remain deferred/unstarted. D-033 and Private Pilot
+Readiness are proposed pending P7.3 closure. Scheduled backup now selects the
+sole PostgreSQL container via Docker Compose labels without parsing the full
+app `.env`; `RCLONE_CONFIG` remains in protected external configuration. This
+repository correction has not run on production here.
 
 ## 5. Current Repository Structure
 
@@ -1245,15 +1263,15 @@ NestJS API, `telegram-bot/` for the grammY process, and `wp-content/plugins/` fo
 the lightweight connector. The larger `apps/`, `packages/`, and
 `infrastructure/` layout remains a planned target rather than current structure.
 
-Current work branch: `fix/p7.2-production-build-baseline` from main
-`75913223c214214829452d5ac7740b3a9576a218`.
+Current closure branch: `docs/p7.2-p7.3-production-closure` from main
+`034b2f565fd6b2fc50d6942ff1a40ca16598703c`.
 
 ---
 
 ## 6. Current Blockers
 
-No open Phase-5 or P7.1 blocker remains. Public launch remains gated by
-P7.2/P7.3 production acceptance and unstarted P7.4–P7.8. Historical provenance
+P7.3 scheduled-backup production proof remains open. Public launch also remains
+gated by unstarted P7.4–P7.8 and a separate A decision. Historical provenance
 remains unresolved and assigned to P7.8. Monitoring remains P7.4, DATE-001
 P7.5, network/runtime resilience P7.6, and AuditLog structural immutability
 P7.7.
@@ -1262,12 +1280,13 @@ P7.7.
 
 ## 7. Current Task
 
-P7.1 is complete. Production migrated successfully from `hetz` to authoritative
-`waltpack` at `/srv/wctm`; the old `hetz` WCTM deployment was removed and is not
-a rollback host. This is operational evidence, not final P7.2/P7.3 acceptance.
-Both still await their supported A-owned production-validation runbook on
-`waltpack` and remain open. P7.4 is next only after both acceptances and remains
-unstarted. Do not start P7.4+, Phase 6, or product expansion.
+P7.1 and P7.2 are complete. A-owned P7.3 backup/off-site/restore checks passed
+on authoritative `waltpack` at `/srv/wctm`, but the scheduled service failed
+on `.env` access as `wctm` and its timer was not enabled. The earlier migration
+from `hetz` succeeded; its WCTM deployment was removed and is not a rollback
+host. P7.3 requires live scheduler proof. Phase 7 remains incomplete;
+P7.4–P7.8 and Phase 6 are deferred/unstarted. D-033 proposes Private Pilot
+Readiness next after P7.3 closure; no pilot implementation begins here.
 
 ### Last completed product milestone: M22
 

diff --git a/docs/MASTER-ROADMAP.md b/docs/MASTER-ROADMAP.md
@@ -284,7 +284,7 @@ readiness work, or authorize unrestricted public launch.
 ## Phase 7 — Production Readiness
 
 Status:
-🔵 Current phase — next after Phase 5, by explicit A decision D-029
+🔵 In progress through P7.3; Phase 7 remains incomplete
 
 Phase 7 executes before Phase 6. It is production hardening and readiness only;
 it does not include pricing, billing, subscriptions, plan differentiation,
@@ -294,30 +294,37 @@ commercial/product expansion.
 Milestones, in order:
 
 - P7.1 — Production Security Baseline — ✅ Complete
-- P7.2 — Production Migration & Deployment Path — 🟡 Repository implemented;
-  awaiting B review and A-owned production validation
-- P7.3 — Backup, Restore & Disaster Recovery — 🟡 Repository implemented;
-  awaiting B review and A-owned production validation
-- P7.4 — Monitoring & Alerting
-- P7.5 — Data & Time Correctness
-- P7.6 — Network & Runtime Reliability
-- P7.7 — Audit & Operational Integrity
-- P7.8 — Final Launch Readiness Gate
-
-P7.1 is complete following accepted production validation. P7.2 and P7.3 now
-have repository-side implementation for explicit least-privilege migration,
-deterministic deployment, immutable database/cache image reconciliation,
-verified backup/off-host retention/scheduling, isolated restore, and disaster
-recovery. Both remain open pending B review and A-owned live validation; neither
-is production-complete. P7.4 is next only after both are accepted. P7.4–P7.8
-and Phase 6 remain unstarted; Phase 7 is not complete.
+- P7.2 — Production Migration & Deployment Path — ✅ Complete / production validated
+- P7.3 — Backup, Restore & Disaster Recovery — 🟡 Backup/off-site/restore
+  validated; scheduled systemd backup proof pending
+- P7.4 — Monitoring & Alerting — ⬜ Deferred / unstarted
+- P7.5 — Data & Time Correctness — ⬜ Deferred / unstarted
+- P7.6 — Network & Runtime Reliability — ⬜ Deferred / unstarted
+- P7.7 — Audit & Operational Integrity — ⬜ Deferred / unstarted
+- P7.8 — Final Launch Readiness Gate — ⬜ Deferred / unstarted
+
+P7.1 and P7.2 are complete. P7.3 local/off-site backup and isolated restore
+passed, but the scheduled service failed when Docker Compose attempted to read
+`/srv/wctm/.env` as `wctm`. The corrected scheduler awaits live systemd proof;
+the timer remains disabled. D-033 proposes pausing Phase 7 before P7.4 and
+making Private Pilot Readiness next only after P7.3 closure. P7.4–P7.8 and
+Phase 6 remain deferred/unstarted; historical provenance review stays assigned
+to P7.8. No feature expansion or unrestricted public launch is authorized.
+
+## Private Pilot Readiness — Proposed Next Initiative
+
+Status: ⬜ Proposed under D-033, pending P7.3 scheduled-backup proof and a
+separate acceptance. Its proposed scope remains privacy/data-flow and merchant
+disclosures, legal/licensing baseline, connector admin UI and
+`wctm.walterbyte.com` polish, focused QA, then a real-user private merchant
+pilot. No pilot implementation begins in this branch.
 
 ---
 
 ## Phase 6 — SaaS Platform
 
 Status:
-⬜ Deferred / unstarted until Phase 7 completes and A separately authorizes it
+⬜ Deferred / unstarted; requires a separate A decision after pilot evidence
 
 Deliverables
 

diff --git a/docs/PHASE_BREAKDOWN.md b/docs/PHASE_BREAKDOWN.md
@@ -715,10 +715,11 @@ M22 final decision: PASS. Phase 5 final decision: COMPLETE. M17–M22 and all
 approved MVP Telegram product features are complete, Persian/English manager UX
 and backend-authoritative entitlement enforcement are operational, and no open
 Phase-5 feature blocker remains. Phase 6 commercial SaaS work has not started;
-Phase 7 production-readiness is now current by D-029, and unrestricted public
-launch is not approved.
+Phase 7 production-readiness was started by D-029. P7.3 remains open pending
+scheduled-backup proof, so the D-033 pause is proposed, not accepted;
+unrestricted public launch is not approved.
 
-## Phase 7 — Production Readiness 🔵 Current
+## Phase 7 — Production Readiness 🔵 In progress / incomplete
 
 ### P7.1 — Production Security Baseline ✅ Complete / Production Validated
 
@@ -760,7 +761,7 @@ production identity was replaced for backend runtime by the validated
 restricted role. Historical release-provenance findings remain without history
 rewrite and are still assigned to P7.8.
 
-### P7.2 — Production Migration & Deployment Path 🟡 Repository Complete / Awaiting Validation
+### P7.2 — Production Migration & Deployment Path ✅ Complete / Production Validated
 
 - D-031 establishes an ephemeral, non-root Compose migration job containing the
   exact checked-out Prisma migration state. A distinct protected migration URL
@@ -772,10 +773,13 @@ rewrite and are still assigned to P7.8.
 - Guarded PostgreSQL/Redis reconciliation requires a verified backup and exact
   named-volume confirmation, preserves volumes, recreates only those services
   on the reviewed immutable references, and verifies health/data continuity.
-- Repository implementation is ready for B review. Production validation and
-  A acceptance remain required; P7.2 is not production-complete.
+- A-owned production validation on `waltpack` passed: fresh images, distinct
+  migration identity, 16 applied migrations with an idempotent repeat, removed
+  ephemeral credential/container, restricted `wctm_runtime`, preserved named
+  volumes/data, corrected deployment PASS, local/public health/readiness, and
+  bounded product smoke. P7.2 is production-complete.
 
-### P7.3 — Backup, Restore & Disaster Recovery 🟡 Repository Complete / Awaiting Validation
+### P7.3 — Backup, Restore & Disaster Recovery 🟡 Scheduled Proof Pending
 
 - D-032 establishes atomic PostgreSQL custom-format backups, SHA-256 and
   readability verification, non-secret metadata, explicit 14-valid-set default
@@ -787,12 +791,17 @@ rewrite and are still assigned to P7.8.
 - The DR runbook covers application/container, deployment, database, and total
   VPS loss; distinguishes APP-key decryption dependency from other service
   credentials; and sets target-only 24-hour RPO/eight-hour RTO objectives.
-- Repository implementation is ready for B review. A must choose the off-host
-  destination, install/enable scheduling, and execute the combined live backup,
-  deployment and isolated-restore runbook. P7.3 is not production-complete.
-
-P7.4 remains next only after P7.2/P7.3 production acceptance. P7.4 through
-P7.8 are unstarted. Phase 7 is not complete.
+- A-owned production validation passed: custom dump and local SHA-256, OneDrive
+  three-artifact transfer with streamed remote SHA-256, isolated network-none
+  restore with 16 migrations/21 public tables and checked critical counts,
+  cleanup, and healthy final service/security scans. Scheduled systemd backup
+  then failed because Docker Compose attempted to read `/srv/wctm/.env` as
+  `wctm`; the timer was not enabled. P7.3 remains open until the corrected
+  scheduler passes live proof. Scheduled off-site execution retains the
+  explicit protected `RCLONE_CONFIG` path.
+
+P7.4–P7.8 remain unstarted/deferred. Phase 7 is incomplete; D-033 proposes a
+pause after P7.3 closure. Historical provenance review remains assigned to P7.8.
 
 ### Approved Phase 7 order
 
@@ -805,11 +814,23 @@ P7.8 are unstarted. Phase 7 is not complete.
 7. P7.7 — Audit & Operational Integrity
 8. P7.8 — Final Launch Readiness Gate
 
+## Private Pilot Readiness ⬜ Proposed next initiative
+
+- Privacy/data-flow audit and merchant-facing disclosures
+- Licensing/legal baseline
+- WordPress connector admin UI polish
+- `wctm.walterbyte.com` onboarding/product-surface polish
+- Focused security/quality QA
+- Private merchant pilot with real users and usage/payment evidence
+
+D-033 proposes the engineering freeze except for pilot-blocking defects after
+P7.3 closes. No pilot implementation is authorized in this task.
+
 ## Phase 6 — SaaS Platform ⬜ Deferred / unstarted
 
 - Subscriptions, plans, billing, dashboard, tenant administration, and usage
-  limits remain deferred until Phase 7 completes and A separately authorizes
-  Phase 6.
+  limits remain deferred until merchant/pilot evidence supports a separate A
+  decision to authorize Phase 6.
 
 ## Phase 8 — Public Launch ⬜ Planned