feat(backups): freshness check + daily alert timer; record rest-server-ana recovery, fstab hardening, esh-pve-nas gap, worldtree admin-key provisioning

persistent-memory.md

@@ -200,8 +200,15 @@ _As of 2026-06-20:_
   22:53Z** (total 19→20); ana-docker's larger catch-up was still running at hand-off
   (will land). esh-docker-vm/esh-vm-db/vm-esh-nas auto-catch-up at their next 01:00
   timers (or trigger manually). **Full topology + 2-min freshness-check now documented
-  in `docs/runbooks/backups.md`.** STILL OPEN (prevention): backup-freshness alert +
-  fstab `_netdev`/retry hardening + verify esh-pve-nas PBS gap + rotate the 5 creds.
+  in `docs/runbooks/backups.md`.** **PREVENTION DONE (2026-06-20):** (1) freshness
+  alert — `scripts/check-backup-freshness.sh` + daily systemd user timer on nh3-dev
+  (08:00) → althing alert to infra-ops on any stale/down layer (proven end-to-end);
+  (2) fstab hardened — ana-docker `/mnt/backup` → `noauto,x-systemd.automount,…`
+  (autofs self-heals, active next boot; `.bak-pre-harden` saved); (3) esh-pve-nas
+  VERIFIED **not** PBS-covered → esh-vm-db (a DB!) + vm-esh-nas are restic-only.
+  STILL OPEN: rotate the 5 rest-server creds (operator, offline); harden
+  `/mnt/compose` too (also bare defaults); the 3 esh + ana-docker restic clients
+  clear at tonight's 01:00.
 
 - **ana-docker disk incident RESOLVED — root cause was a 94 GB unrotated
   `langfuse-clickhouse` log, NOT (just) image bloat.** ClickHouse logs
@@ -270,6 +277,16 @@ _As of 2026-06-20:_
 
 ## Recent decisions
 
+- `[2026-06-20]` **rest-server-ana recovered + backup prevention shipped + worldtree-dev
+  admin keys provisioned** (operator-directed). rest-server-ana fixed (mount-a +
+  force-recreate via `infra-ops@ana-docker`); freshness alert + fstab hardening landed
+  (see Current-state BACKUP entry + `docs/runbooks/backups.md`). Minted worldtree-dev
+  **admin-tier Heimdall keys** on demo (key_id d113207c) + personal (f4f75adb) via
+  `POST /admin/keys {tier:admin}` + `POST /admin/users/worldtree-dev/tier`, verified
+  read+write, dropped mode-600 to `~/.wt-admin-{demo,personal}` on nh3-dev → worldtree-dev
+  now self-serves key minting (cuts infra-ops out of the per-key loop, like the
+  claude-bot gitea token). Cred rotation (5 rest-server pw) BELAYED per operator.
+
 - `[2026-06-20]` **Worldtree capability-gateway aliases stood up; NO `wt-`
   prefix (operator) — reuse the existing capability convention.** gen/
   gen-reasoning/classifier/summarizer/chat-judge/reranker/scalar-judge