@@ -108,7 +108,7 @@ Use this when you want the first broader public baseline, including DNS identity
 
 Use these after the early baseline is stable and you are ready to add:
 
-- backup and DR
+- backup and DR plan packs and readiness reporting
 - monitoring and maintenance
 - network exposure refinement
 - security hardening and runtime secret layout
 
@@ -7,11 +7,13 @@ This document gives a public-safe sequence for producing, validating, replicatin
 ## Recommended order
 
 1. install the backup and DR helpers
-2. run config, MariaDB, and mailstack backups
-3. verify each resulting backup set
-4. optionally replicate off-host
-5. perform a staged restore drill
-6. repeat the drill in QEMU before production use
+2. generate the live backup and DR plan packs
+3. write the readiness report
+4. run config, MariaDB, and mailstack backups
+5. verify each resulting backup set
+6. optionally replicate off-host
+7. perform a staged restore drill
+8. repeat the drill in QEMU before production use
 
 ## Commands
 
@@ -21,6 +23,20 @@ Install helpers:
 doas ksh scripts/install/install-backup-dr-assets.ksh --apply
 ```
 
+Generate the phase plan packs:
+
+```sh
+OPENBSD_MAILSTACK_NONINTERACTIVE=1 ./scripts/phases/phase-11-apply.ksh
+OPENBSD_MAILSTACK_NONINTERACTIVE=1 ./scripts/phases/phase-12-apply.ksh
+OPENBSD_MAILSTACK_NONINTERACTIVE=1 ./scripts/phases/phase-13-apply.ksh
+```
+
+Write the readiness report:
+
+```sh
+./scripts/ops/backup-dr-readiness-report.ksh --write
+```
+
 Create backups:
 
 ```sh
@@ -47,20 +63,6 @@ Run a staged restore drill:
 doas ksh scripts/ops/run-restore-drill.ksh   --archive /var/backups/openbsd-mailstack/mailstack/latest/mailstack-<timestamp>.tgz   --sha256 /var/backups/openbsd-mailstack/mailstack/latest/mailstack-<timestamp>.sha256
 ```
 
-QEMU rehearsal:
-
-```sh
-ksh maint/qemu/lab-dr-restore-runner.ksh   --archive /path/to/mailstack-backup.tgz   --sha256 /path/to/mailstack-backup.sha256
-```
-
-## Unified Backup Run
-
-A single public-safe runner now exists for the common path:
-
-```sh
-doas ksh scripts/ops/backup-all.ksh --dry-run
-doas ksh scripts/ops/backup-all.ksh --run
-```
+## Notes
 
-That runner can optionally protect archives and replicate the mailstack backup
-when those features are enabled in operator inputs.
+The current repo now treats backup and DR planning as live operator workspace output under `.work/backup-dr/`, not as tracked publishable generated guidance.
@@ -47,13 +47,16 @@ doas ksh scripts/install/provision-dr-site-host.ksh --apply
 - `/srv/openbsd-mailstack-dr/releases`
 - `/var/restore/openbsd-mailstack`
 - `/var/backups/openbsd-mailstack`
-- `/var/lib/openbsd-mailstack-dr`
-- `/var/log/openbsd-mailstack-dr`
+- `/var/lib/openbsd-mailstack`
 
-## Recommended Sequence
+## Related live planning outputs
 
-1. configure `dr-host.conf` and `dr-site.conf`
-2. run the dry run and review the output
-3. apply the bootstrap on the standby host
-4. run `scripts/install/install-backup-schedule-assets.ksh --dry-run`
-5. run a staged restore drill before any live failover
+The backup and DR phase pack now writes the live plan guidance under:
+
+- `.work/backup-dr/phase-11/`
+- `.work/backup-dr/phase-12/`
+- `.work/backup-dr/phase-13/`
+
+The readiness report is written under:
+
+- `.work/backup-dr/readiness/backup-dr-readiness.txt`
@@ -44,8 +44,9 @@ If you are new to the repository:
 4. render the live operator trees and inspect `.work/runtime/rootfs/`, `.work/network-exposure/rootfs/`, `.work/identity/`, or `.work/advanced/` as appropriate, using `services/generated/rootfs/` only as the sanitized example reference
 5. run the phase sequence through the baseline you want to test
 6. build the monitoring layer you want, including the richer static `/_ops/monitor/` site when needed
-7. run post-install checks and the targeted public hardening validation pass
-8. only then move to a real OpenBSD host
+7. generate live backup and DR plan packs under `.work/backup-dr/` when you are ready for phases 11 through 13
+8. run post-install checks and the targeted public hardening validation pass
+9. only then move to a real OpenBSD host
 
 ## Related documents outside this directory
 
 
@@ -19,10 +19,9 @@ Create a usable public backup and DR baseline.
 
 ## Outputs
 
-- generated backup scope summary
-- generated restore workflow summary
-- generated DR site provisioning summary
+- live backup and DR plan pack under `.work/backup-dr/phase-11/`
 - reusable backup, restore, and install helpers in `scripts/`
+- readiness reporting through `scripts/ops/backup-dr-readiness-report.ksh`
 
 ## Run
 
@@ -36,8 +35,12 @@ Verify:
 ./scripts/phases/phase-11-verify.ksh
 ```
 
+Readiness report:
+
+```sh
+./scripts/ops/backup-dr-readiness-report.ksh --write
+```
+
 ## Refinement
 
-Phase 11 now includes a public-safe standby host bootstrap path through
-`scripts/install/provision-dr-site-host.ksh`, in addition to the DR portal asset
-installer.
+Phase 11 now writes a live plan pack into a gitignored work root instead of tracked repo guidance files. It also includes a public-safe standby host bootstrap path through `scripts/install/provision-dr-site-host.ksh`, in addition to the DR portal asset installer.
@@ -15,8 +15,8 @@ Extend the Phase 11 baseline with integrity and controlled restore behavior.
 
 ## Outputs
 
-- generated integrity workflow summary
-- generated restore mode summary
+- live integrity plan pack under `.work/backup-dr/phase-12/`
+- archive protection guidance tied to the actual helper scripts
 - verification helper usage guidance
 
 ## Run
@@ -33,6 +33,6 @@ Verify:
 
 ## Refinement
 
-Phase 12 now has a concrete helper for archive protection:
+Phase 12 now writes a gitignored live plan pack instead of tracked generated guidance. It also keeps a concrete helper for archive protection:
 
 - `scripts/ops/protect-backup-set.ksh`
@@ -12,10 +12,10 @@ Extend the Phase 11 and 12 baseline with off-host copy planning, restore drills,
 
 ## Outputs
 
-- generated off-host replication summary
-- generated restore drill summary
-- generated post-restore validation checklist
+- live off-host and drill plan pack under `.work/backup-dr/phase-13/`
+- post-restore validation checklist in the same gitignored work root
 - QEMU restore drill runner under `maint/qemu/`
+- readiness reporting through `scripts/ops/backup-dr-readiness-report.ksh`
 
 ## Run
 
@@ -31,5 +31,4 @@ Verify:
 
 ## Refinement
 
-Phase 13 can now be exercised from the unified backup runner and the DR host
-bootstrap workflow, not only from individual backup scripts.
+Phase 13 can now be exercised from a unified backup and DR readiness surface, not only from individual backup scripts and tracked generated notes.
@@ -17,9 +17,9 @@ This document maps the public phase documents and scripts to the current public-
 | Phase 08, webmail and admin access | materially usable | Roundcube, PostfixAdmin, nginx web-plane assets, and phase-scoped summary and verify coverage |
 | Phase 09, DNS and identity publishing | materially usable | DNS publishing guidance and shared DNS input model |
 | Phase 10, operations and resilience | materially usable | install, post-install, operator workflow, and resilience docs |
-| Phase 11, backup and disaster recovery | materially usable | backup helpers, restore helpers, DR docs |
-| Phase 12, advanced backup security and integrity | materially usable | archive protection, verification, and backup hygiene |
-| Phase 13, off-host replication and restore testing | materially usable | off-host replication helpers, QEMU restore drill path |
+| Phase 11, backup and disaster recovery | materially usable | backup helpers, restore helpers, DR docs, and live plan packs |
+| Phase 12, advanced backup security and integrity | materially usable | archive protection, verification, backup hygiene, and live integrity plan packs |
+| Phase 13, off-host replication and restore testing | materially usable | off-host replication helpers, QEMU restore drill path, and live drill plan packs |
 | Phase 14, monitoring and reporting baseline | materially usable | monitoring collectors, reporting helpers, nginx ops assets, newsyslog assets, and the richer static `/_ops/monitor/` site model |
 | Phase 15, security hardening and authentication model | materially usable | `doas`, SSH hardening, and authentication policy helpers |
 | Phase 16, secrets handling and key material management | materially usable | host-local runtime secret layout, repo hygiene, and verification helpers |
 
@@ -8,7 +8,7 @@ The public repository now provides a materially usable public-safe baseline for:
 - phase 02 through 08 now include phase-scoped summaries and targeted verify coverage on top of the shared core runtime renderer
 - core mail runtime rendering and staged example output
 - install order, QEMU validation, and first production deployment guidance
-- backup, disaster recovery, restore drills, DR site assets, and DR host bootstrap
+- backup, disaster recovery, restore drills, DR site assets, DR host bootstrap, and live backup and DR plan packs
 - monitoring, diagnostics, reporting, visibility helpers, and the richer static `/_ops/monitor/` site path
 - maintenance, upgrade, regression, and rollback helpers
 - PF, WireGuard, DNS, and Vultr DDNS baseline assets
 
@@ -65,3 +65,8 @@ The remaining private boundaries are now specific:
 - real operator identities, passwords, PATs, API tokens, and private keys
 - site-specific control-plane doctrine tied to a real deployment
 - provider-specific integrations that have not been generalized into operator-input-driven public-safe workflows
+
+
+## Live backup and DR planning outputs
+
+Backup and DR planning output is now written into the gitignored live workspace under `.work/backup-dr/`. These artifacts are operator-specific working material, not tracked publishable repo examples.