# Phase 2A maintenance worksheet

```text
PUBLIC_HEALTH_URLS='https://db.lasereverything.net/'
EXTRA_CRITICAL_UNITS=''
LE_PHASE2A_RECOVERY_READY=<UNSET>
LE_PHASE2A_BACKUPS_READY=<UNSET>

maintenance_window=<UNSET>
user_notification=<UNSET>
rollback_decision_owner=<UNSET>
independent_console_access=<UNSET>
independent_root_access=<UNSET>
previous_kernel_boot_procedure=<UNSET>
```

Verified evidence:

- protected Directus archive manifest: `PASS`, return code 0;
- Docker: 88 total, 87 running, retired `directus` intentionally stopped;
- sole unhealthy running container: reviewed unrelated `sonarr`;
- `makearmy-app` running; `bgbye` running and healthy;
- `le-directus-source` and `le-payload-pg` running;
- running restart-policy `no`: `castopod`, `castopod-redis`;
- DrKonqi disposition: exact checksummed 234-unit allowlist preserved;
- NoMachine removed; `nxserver.service` absent and not critical;
- GRUB: normal, fallback, and recovery entries for `linux-zen` and `linux`;
- Snapper snapshots 1–3 exist; `grub-btrfs.cfg` snapshot entries absent;
- `grub-btrfs-snapper.path` active and watching.

The recovery and backup attestations must remain unset until the operator has
personally confirmed recovery access and completed the proportional backup plan.