Walter-byte · Oct 5, 2026 · Oct 5, 2026
diff --git a/docs/DECISIONS.md b/docs/DECISIONS.md
@@ -1255,10 +1255,11 @@ new application table, public endpoint, provider lock-in, or multi-region HA.
 
 Status
 
-Accepted for repository implementation. A-owned local/off-site backup and
-isolated restore validation passed on 2026-10-05, but scheduled systemd backup
-failed because Docker Compose attempted to read `/srv/wctm/.env` as `wctm`.
-P7.3 production acceptance remains pending a successful live scheduler proof.
+Accepted and production-validated on 2026-10-05. A-owned local/off-site backup
+and isolated restore validation passed. After the first scheduled service start
+failed because Docker Compose attempted to read `/srv/wctm/.env` as `wctm`, the
+corrected service completed backup, off-site SHA-256 verification, and retention
+as `wctm` with `SERVICE_RC=0`. The daily timer was enabled and is active.
 
 ---
 
@@ -1270,15 +1271,13 @@ Date
 
 Decision
 
-Proposed after P7.3 closure: P7.2 is production-complete, while P7.3 still
-requires a successful scheduled-backup systemd proof on authoritative
-`waltpack`. Once P7.3 passes, Phase 7 would remain incomplete and pause before
-P7.4. P7.4–P7.8 would remain unstarted and available for later resumption when
-merchant/pilot evidence justifies them; historical provenance review would
-remain assigned to P7.8. Phase 6 remains deferred and unstarted.
+P7.2 and P7.3 are production-complete on authoritative `waltpack`. Phase 7
+remains incomplete and is intentionally paused before P7.4. P7.4–P7.8 remain
+unstarted and available for later resumption when merchant/pilot evidence
+justifies them; historical provenance review remains assigned to P7.8. Phase 6
+remains deferred and unstarted.
 
-Private Pilot Readiness is proposed as the next active initiative after P7.3
-closure. Its bounded sequence is
+Private Pilot Readiness is the next active initiative. Its bounded sequence is
 privacy/data-flow audit and merchant-facing disclosures; licensing/legal
 baseline; WordPress connector admin UI polish; `wctm.walterbyte.com` onboarding
 and product-surface polish; focused security/quality QA; and a private merchant
@@ -1288,14 +1287,14 @@ task requires separate authorization; this decision implements none of them.
 
 Reason
 
-The deployment and recovery evidence can support a controlled private pilot
-after the scheduled-backup path passes live validation.
+The deployment, recovery, and scheduled-backup path passed live validation and
+support preparation for a controlled private pilot.
 Real merchant usage and payment evidence should guide further infrastructure
 and product investment before resuming the remaining Phase 7 or Phase 6 work.
 
 Status
 
-Proposed; not accepted until P7.3 scheduled-backup production proof passes.
+Accepted on 2026-10-05 after P7.3 scheduled-backup production proof passed.
 
 ---
 

diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md
@@ -79,7 +79,7 @@ n8n is **NOT** part of the production architecture (D-008, prototype only).
 | D-030 | P7.1 uses a temporary decrypt-only previous key, current-key-only writes, and a trusted-shell row-transactional rotation command for the exact five encrypted database fields                                              | Accepted |
 | D-031 | P7.2 separates restricted backend runtime from an ephemeral explicit Prisma migration identity and defines revision-locked fail-fast deployment plus volume-preserving immutable data-service reconciliation               | Accepted |
 | D-032 | P7.3 establishes atomic verified PostgreSQL backups, explicit retention, verified provider-neutral off-host copy, daily systemd scheduling, isolated guarded restore, DR dependencies, and target-only RPO/RTO             | Accepted |
-| D-033 | Proposed Phase 7 pause after P7.3 scheduled-backup proof, with Private Pilot Readiness next and Phase 6/P7.4–P7.8 deferred                                                                                                 | Proposed |
+| D-033 | Pause incomplete Phase 7 after production-validated P7.2/P7.3; make Private Pilot Readiness active while Phase 6/P7.4–P7.8 remain deferred                                                                                 | Accepted |
 
 Next decision number: **D-034**, if a future task produces a genuine
 architectural or product decision.
@@ -1032,7 +1032,7 @@ Final closure evidence:
 
 ---
 
-### Phase 7 — Production Readiness (P7.3 scheduler proof pending)
+### Phase 7 — Production Readiness (paused after production-validated P7.3)
 
 #### P7.1 — Production Security Baseline (complete; production validated)
 
@@ -1210,7 +1210,7 @@ migration and deployment path`.
   PostgreSQL/Redis and named volumes, `deployment path: PASS`, local/public
   health/readiness, and bounded functional smoke. P7.2 is complete.
 
-#### P7.3 — Backup, Restore & Disaster Recovery (scheduled proof pending)
+#### P7.3 — Backup, Restore & Disaster Recovery (production complete)
 
 - Implementation commit:
   `ddde3c705b249a29a131a3bfc96763f17b6e9cbc chore(ops): add production backup
@@ -1244,17 +1244,28 @@ and recovery path`.
   16 migrations), OneDrive three-artifact copy with streamed SHA-256 PASS,
   isolated network-none restore with 16 migrations/21 public tables and
   critical counts `tenants=7`, `users=6`, `stores=2`, `orders=54`, cleanup,
-  and clean final health/role/permission/secret scans. The live systemd service
-  then failed with `/srv/wctm/.env` permission denied as `wctm`; the timer was
-  not enabled. P7.3 remains open until the corrected scheduler passes live.
-
-This closure branch performs no VPS, production, secret, live database,
-deployment, schema, migration, or product mutation. Phase 7 remains incomplete;
-P7.4–P7.8 and Phase 6 remain deferred/unstarted. D-033 and Private Pilot
-Readiness are proposed pending P7.3 closure. Scheduled backup now selects the
-sole PostgreSQL container via Docker Compose labels without parsing the full
-app `.env`; `RCLONE_CONFIG` remains in protected external configuration. This
-repository correction has not run on production here.
+  and clean final health/role/permission/secret scans. The first live systemd
+  start failed on `/srv/wctm/.env` access as `wctm`; the corrected scheduler
+  then completed through `wctm-backup.service` with `SERVICE_RC=0`, 16
+  migrations, OneDrive three-artifact transfer, streamed SHA-256 PASS,
+  `retention: PASS`, and a secret-safe journal. The one-shot service exited
+  successfully and the daily timer was enabled and active, with its initial
+  next invocation confirmed for `2026-10-06 02:18:28 UTC`.
+- The scheduled backup `wctm-postgres-20261005T151246Z-unknown.dump`
+  (2,404,925 bytes) was
+  timestamped, checksum-valid and off-site verified. The `unknown` revision is
+  metadata-quality polish. Retention warned on some older manually/root-created
+  sets with relative checksum sidecars, but returned PASS and removed no set
+  incorrectly. These are future operational follow-ups, not P7.3 blockers.
+
+This documentation closure performs no VPS, production, secret, live database,
+deployment, schema, migration, or product mutation. Phase 7 remains paused and
+incomplete; P7.4–P7.8 and Phase 6 remain deferred/unstarted. D-033 is Accepted
+and Private Pilot Readiness is active. Scheduled backup selects the sole
+PostgreSQL container via Docker Compose labels without parsing the full
+app `.env`; `RCLONE_CONFIG` remains in protected external configuration. A
+installed and validated the repository correction on `waltpack`; the protected
+`.env` remains inaccessible to the service account.
 
 ## 5. Current Repository Structure
 
@@ -1270,23 +1281,26 @@ Current closure branch: `docs/p7.2-p7.3-production-closure` from main
 
 ## 6. Current Blockers
 
-P7.3 scheduled-backup production proof remains open. Public launch also remains
-gated by unstarted P7.4–P7.8 and a separate A decision. Historical provenance
-remains unresolved and assigned to P7.8. Monitoring remains P7.4, DATE-001
-P7.5, network/runtime resilience P7.6, and AuditLog structural immutability
-P7.7.
+Public launch remains gated by unstarted P7.4–P7.8 and a separate A decision.
+Historical provenance remains unresolved and assigned to P7.8. Monitoring
+remains P7.4, DATE-001 P7.5, network/runtime resilience P7.6, and AuditLog
+structural immutability P7.7.
 
 ---
 
 ## 7. Current Task
 
-P7.1 and P7.2 are complete. A-owned P7.3 backup/off-site/restore checks passed
-on authoritative `waltpack` at `/srv/wctm`, but the scheduled service failed
-on `.env` access as `wctm` and its timer was not enabled. The earlier migration
-from `hetz` succeeded; its WCTM deployment was removed and is not a rollback
-host. P7.3 requires live scheduler proof. Phase 7 remains incomplete;
-P7.4–P7.8 and Phase 6 are deferred/unstarted. D-033 proposes Private Pilot
-Readiness next after P7.3 closure; no pilot implementation begins here.
+P7.1–P7.3 are production-complete. A-owned backup/off-site/restore and corrected
+scheduled service checks passed on authoritative `waltpack` at `/srv/wctm`;
+the daily timer is enabled and active. The earlier migration from `hetz`
+succeeded; its WCTM deployment was removed and is not a rollback host. Phase 7
+is intentionally paused/incomplete before P7.4; P7.4–P7.8 and Phase 6 remain
+deferred/unstarted. Accepted D-033 makes Private Pilot Readiness the next active
+initiative: privacy/data-flow audit and merchant disclosures, licensing/legal
+baseline, WordPress connector admin UI polish, `wctm.walterbyte.com`
+onboarding/product-surface polish, focused security/quality QA, and controlled
+private merchant pilots. Engineering is frozen except for pilot-blocking
+defects. No pilot implementation or broad public launch is authorized here.
 
 ### Last completed product milestone: M22
 

diff --git a/docs/MASTER-ROADMAP.md b/docs/MASTER-ROADMAP.md
@@ -284,7 +284,7 @@ readiness work, or authorize unrestricted public launch.
 ## Phase 7 — Production Readiness
 
 Status:
-🔵 In progress through P7.3; Phase 7 remains incomplete
+⏸ Paused after P7.3; Phase 7 remains incomplete
 
 Phase 7 executes before Phase 6. It is production hardening and readiness only;
 it does not include pricing, billing, subscriptions, plan differentiation,
@@ -295,29 +295,28 @@ Milestones, in order:
 
 - P7.1 — Production Security Baseline — ✅ Complete
 - P7.2 — Production Migration & Deployment Path — ✅ Complete / production validated
-- P7.3 — Backup, Restore & Disaster Recovery — 🟡 Backup/off-site/restore
-  validated; scheduled systemd backup proof pending
+- P7.3 — Backup, Restore & Disaster Recovery — ✅ Complete / production validated
 - P7.4 — Monitoring & Alerting — ⬜ Deferred / unstarted
 - P7.5 — Data & Time Correctness — ⬜ Deferred / unstarted
 - P7.6 — Network & Runtime Reliability — ⬜ Deferred / unstarted
 - P7.7 — Audit & Operational Integrity — ⬜ Deferred / unstarted
 - P7.8 — Final Launch Readiness Gate — ⬜ Deferred / unstarted
 
-P7.1 and P7.2 are complete. P7.3 local/off-site backup and isolated restore
-passed, but the scheduled service failed when Docker Compose attempted to read
-`/srv/wctm/.env` as `wctm`. The corrected scheduler awaits live systemd proof;
-the timer remains disabled. D-033 proposes pausing Phase 7 before P7.4 and
-making Private Pilot Readiness next only after P7.3 closure. P7.4–P7.8 and
-Phase 6 remain deferred/unstarted; historical provenance review stays assigned
-to P7.8. No feature expansion or unrestricted public launch is authorized.
-
-## Private Pilot Readiness — Proposed Next Initiative
-
-Status: ⬜ Proposed under D-033, pending P7.3 scheduled-backup proof and a
-separate acceptance. Its proposed scope remains privacy/data-flow and merchant
-disclosures, legal/licensing baseline, connector admin UI and
-`wctm.walterbyte.com` polish, focused QA, then a real-user private merchant
-pilot. No pilot implementation begins in this branch.
+P7.1–P7.3 are complete. P7.3 passed local/off-site backup, isolated restore,
+and corrected scheduled systemd execution on `waltpack`; the daily timer is
+enabled and active. D-033 accepts the Phase 7 pause before P7.4 and makes
+Private Pilot Readiness the next active initiative. P7.4–P7.8 and Phase 6
+remain deferred/unstarted; historical provenance review stays assigned to P7.8.
+No feature expansion or unrestricted public launch is authorized.
+
+## Private Pilot Readiness — Active Initiative
+
+Status: 🔵 Active under accepted D-033. Its bounded scope is privacy/data-flow
+audit and merchant disclosures, licensing/legal baseline, WordPress connector
+admin UI polish, `wctm.walterbyte.com` onboarding/product-surface polish,
+focused security/quality QA, and controlled private merchant pilots with real
+users. Engineering remains frozen except for pilot-blocking defects. No pilot
+implementation begins in this branch.
 
 ---
 

diff --git a/docs/PHASE_BREAKDOWN.md b/docs/PHASE_BREAKDOWN.md
@@ -715,11 +715,11 @@ M22 final decision: PASS. Phase 5 final decision: COMPLETE. M17–M22 and all
 approved MVP Telegram product features are complete, Persian/English manager UX
 and backend-authoritative entitlement enforcement are operational, and no open
 Phase-5 feature blocker remains. Phase 6 commercial SaaS work has not started;
-Phase 7 production-readiness was started by D-029. P7.3 remains open pending
-scheduled-backup proof, so the D-033 pause is proposed, not accepted;
-unrestricted public launch is not approved.
+Phase 7 production-readiness was started by D-029. P7.3 is production-complete;
+accepted D-033 pauses Phase 7 before P7.4. Unrestricted public launch is not
+approved.
 
-## Phase 7 — Production Readiness 🔵 In progress / incomplete
+## Phase 7 — Production Readiness ⏸ Paused / incomplete
 
 ### P7.1 — Production Security Baseline ✅ Complete / Production Validated
 
@@ -779,7 +779,7 @@ rewrite and are still assigned to P7.8.
   volumes/data, corrected deployment PASS, local/public health/readiness, and
   bounded product smoke. P7.2 is production-complete.
 
-### P7.3 — Backup, Restore & Disaster Recovery 🟡 Scheduled Proof Pending
+### P7.3 — Backup, Restore & Disaster Recovery ✅ Complete / Production Validated
 
 - D-032 establishes atomic PostgreSQL custom-format backups, SHA-256 and
   readability verification, non-secret metadata, explicit 14-valid-set default
@@ -794,14 +794,15 @@ rewrite and are still assigned to P7.8.
 - A-owned production validation passed: custom dump and local SHA-256, OneDrive
   three-artifact transfer with streamed remote SHA-256, isolated network-none
   restore with 16 migrations/21 public tables and checked critical counts,
-  cleanup, and healthy final service/security scans. Scheduled systemd backup
-  then failed because Docker Compose attempted to read `/srv/wctm/.env` as
-  `wctm`; the timer was not enabled. P7.3 remains open until the corrected
-  scheduler passes live proof. Scheduled off-site execution retains the
-  explicit protected `RCLONE_CONFIG` path.
+  cleanup, and healthy final service/security scans. After correction of the
+  initial Compose `.env` access failure, `wctm-backup.service` completed as
+  dedicated `wctm` with `SERVICE_RC=0`, verified remote SHA-256, and completed
+  retention. The daily timer is enabled and active. The protected `.env` remains
+  inaccessible to `wctm`; scheduled off-site execution retains the protected
+  writable `RCLONE_CONFIG` path. P7.3 is production-complete.
 
-P7.4–P7.8 remain unstarted/deferred. Phase 7 is incomplete; D-033 proposes a
-pause after P7.3 closure. Historical provenance review remains assigned to P7.8.
+P7.4–P7.8 remain unstarted/deferred. Phase 7 is paused and incomplete under
+accepted D-033. Historical provenance review remains assigned to P7.8.
 
 ### Approved Phase 7 order
 
@@ -814,7 +815,7 @@ pause after P7.3 closure. Historical provenance review remains assigned to P7.8.
 7. P7.7 — Audit & Operational Integrity
 8. P7.8 — Final Launch Readiness Gate
 
-## Private Pilot Readiness ⬜ Proposed next initiative
+## Private Pilot Readiness 🔵 Active initiative
 
 - Privacy/data-flow audit and merchant-facing disclosures
 - Licensing/legal baseline
@@ -823,8 +824,8 @@ pause after P7.3 closure. Historical provenance review remains assigned to P7.8.
 - Focused security/quality QA
 - Private merchant pilot with real users and usage/payment evidence
 
-D-033 proposes the engineering freeze except for pilot-blocking defects after
-P7.3 closes. No pilot implementation is authorized in this task.
+Accepted D-033 freezes engineering except for pilot-blocking defects. Pilot
+tasks require separate authorization; none is implemented in this branch.
 
 ## Phase 6 — SaaS Platform ⬜ Deferred / unstarted