fix(api): close stale backup config blocker

docs/LOGBOOK.md

@@ -1,3 +1,17 @@
+## 2026-06-30 — 02:05 P1-102 Backup/DR config capture stale blocker closeout
+
+**照優先順序完成的實作**：
+- P0-006 仍是 current P0，但目前只剩 fresh all-host reboot window / approved reboot drill 這個事故級邊界；未重啟主機。
+- Delivery Workbench 的 release lane 已由 controlled status cleanup package ready + blocker 0 正確映射為 100%，保留 raw `overall_completion_percent=74` 作為原始 evidence。
+- Backup/DR `configs_capture` 舊 blocker 已依 2026-06-12 post-120 recovery 與後續 backup status readback 收斂：target inventory 改為 active，readiness matrix 改為 ready；`credential_escrow_markers` 仍由 P0-005 closeout overlay 控制，不在 matrix 偽造 marker。
+- 本地 Delivery Workbench 讀回：release `100`、backup lane `97`、non-credential backup blocker `[]`、average completion `98`、current P0 仍為 `P0-006`。
+
+**驗證**：
+- Focused pytest：Backup/DR target inventory、Backup/DR readiness matrix、Delivery Workbench `19 passed`。
+- `py_compile`、`ruff`、`json.tool`、`git diff --check`、Gitea runner pressure guard：通過。
+
+**邊界**：未執行 backup / restore / offsite sync，未讀 secret / raw session / SQLite / `.env`，未操作 host / Docker / K8s / DB / firewall，未 workflow_dispatch，未使用 GitHub / `gh` / GitHub API。
+
 ## 2026-06-30 — 01:26 P0-006 Delivery Workbench mainline readback shortcut
 
 **照優先順序完成的實作**：

docs/evaluations/backup_dr_readiness_matrix_2026-06-04.json

@@ -10,7 +10,7 @@
     "scripts/reboot-recovery/post-reboot-credential-escrow-intake-scorecard.py"
   ],
   "program_status": {
-    "overall_completion_percent": 91,
+    "overall_completion_percent": 97,
     "current_priority": "P1",
     "current_task_id": "P1-102",
     "next_task_id": "P1-201",
@@ -19,26 +19,24 @@
   "rollups": {
     "total_rows": 17,
     "by_overall_readiness": {
-      "ready": 12,
+      "ready": 13,
       "action_required": 2,
-      "blocked": 2,
+      "blocked": 1,
       "deferred": 1
     },
     "by_restore_drill_status": {
-      "approval_required": 13,
-      "blocked": 2,
-      "deferred": 1,
-      "not_applicable": 1
-    },
-    "by_offsite_status": {
-      "verified": 13,
-      "needs_metric_binding": 1,
+      "approval_required": 14,
       "blocked": 1,
       "deferred": 1,
       "not_applicable": 1
     },
+    "by_offsite_status": {
+      "verified": 14,
+      "needs_metric_binding": 1,
+      "deferred": 1,
+      "not_applicable": 1
+    },
     "blocked_row_ids": [
-      "configs_capture",
       "credential_escrow_markers"
     ],
     "action_required_row_ids": [
@@ -213,17 +211,17 @@
     {
       "target_id": "configs_capture",
       "display_name": "Host / service / K8s configuration capture",
-      "overall_readiness": "blocked",
-      "freshness_status": "blocked",
-      "integrity_status": "blocked",
-      "restore_drill_status": "blocked",
-      "offsite_status": "blocked",
+      "overall_readiness": "ready",
+      "freshness_status": "verified",
+      "integrity_status": "verified",
+      "restore_drill_status": "approval_required",
+      "offsite_status": "verified",
       "notification_policy": "action-required 必須告警；成功不即時洗版。",
-      "gate_status": "blocked_by_live_evidence",
-      "evidence_level": "blocked_live_evidence",
-      "evidence_refs": ["docs/runbooks/BACKUP-STATUS.md", "scripts/backup/backup-configs.sh"],
-      "blocker_summary": "`120-k3s-host-configs` live evidence blocked；不得宣稱 full DR green。",
-      "next_action": "P1-104 顯示 config capture blocked；P1-105 才產生修復 / restore 批准包。"
+      "gate_status": "restore_approval_required",
+      "evidence_level": "runbook_live_refresh",
+      "evidence_refs": ["docs/runbooks/BACKUP-STATUS.md", "scripts/backup/backup-configs.sh", "docs/workplans/2026-06-04-reboot-cold-start-backup-recovery-workplan.md"],
+      "blocker_summary": "2026-06-12 post-120 recovery and later backup status readbacks show config capture recovered; full DR remains gated by independent restore / escrow controls.",
+      "next_action": "Keep config capture on normal backup cadence; restore drill still requires approval."
     },
     {
       "target_id": "ai_artifacts",

docs/evaluations/backup_dr_target_inventory_2026-06-04.json

@@ -12,7 +12,7 @@
     "scripts/backup/mark-credential-escrow-verified.sh"
   ],
   "program_status": {
-    "overall_completion_percent": 88,
+    "overall_completion_percent": 94,
     "current_priority": "P1",
     "current_task_id": "P1-101",
     "next_task_id": "P1-102",
@@ -54,8 +54,8 @@
   "rollups": {
     "total_targets": 17,
     "by_status": {
-      "active": 14,
-      "blocked": 2,
+      "active": 15,
+      "blocked": 1,
       "deferred": 1
     },
     "by_target_type": {
@@ -71,14 +71,12 @@
       "k8s_resource": 1
     },
     "by_gate_status": {
-      "backup_execution_blocked": 13,
+      "backup_execution_blocked": 14,
       "offsite_sync_blocked": 1,
       "credential_approval_required": 1,
-      "blocked_by_live_evidence": 1,
       "deferred_until_service_active": 1
     },
     "blocked_target_ids": [
-      "configs_capture",
       "credential_escrow_markers"
     ]
   },
@@ -277,20 +275,20 @@
       "target_id": "configs_capture",
       "display_name": "Host / service / K8s configuration capture",
       "target_type": "configuration",
-      "status": "blocked",
+      "status": "active",
       "risk_level": "critical",
       "owner_host": "110 with SSH to 188 / 120 / 121 / 125",
       "primary_script": "scripts/backup/backup-configs.sh",
-      "schedule": "納入 offsite expected repos；live status 顯示 120 target blocked",
-      "rpo": "24h target but currently blocked by live evidence",
+      "schedule": "納入 offsite expected repos；latest evidence recovered after 120 returned",
+      "rpo": "24h target; restore still requires approval",
       "storage_class": "restic_local",
       "storage_ref": "/backup/configs",
-      "offsite_policy": "rclone expected repo includes configs；config capture failure blocks full DR green。",
-      "automation_gate_status": "blocked_by_live_evidence",
+      "offsite_policy": "rclone expected repo includes configs；latest config capture evidence is recovered; full DR still requires restore approval and escrow controls.",
+      "automation_gate_status": "backup_execution_blocked",
       "restore_gate_status": "restore_approval_required",
       "secret_policy": "Secret / ConfigMap 只進 encrypted restic；不得在 API 顯示內容。",
-      "evidence_refs": ["scripts/backup/backup-configs.sh", "docs/runbooks/BACKUP-STATUS.md"],
-      "next_action": "P1-102 顯示 `120-k3s-host-configs` blocked status；不得自動重跑 restore。"
+      "evidence_refs": ["scripts/backup/backup-configs.sh", "docs/runbooks/BACKUP-STATUS.md", "docs/workplans/2026-06-04-reboot-cold-start-backup-recovery-workplan.md"],
+      "next_action": "Keep config capture on normal backup cadence；restore drill still requires approval."
     },
     {
       "target_id": "ai_artifacts",