diff --git a/docs/disaster-recovery.md b/docs/disaster-recovery.md
index 8157bae..191f994 100644
--- a/docs/disaster-recovery.md
+++ b/docs/disaster-recovery.md
@@ -1,6 +1,6 @@
-<!-- verified: 2026-09-06
-     iac@49ff427 : ansible/roles_metadata.yml
-     ansible@ccbda37 : roles/os_update, playbooks/os_update_vms.yml, playbooks/os_update_pve.yml, playbooks/os_update_pbs.yml, playbooks/app_update.yml
+<!-- verified: 2026-09-18
+     iac@f770e1c : ansible/roles_metadata.yml
+     ansible@24e1bf0 : roles/os_update, playbooks/os_update_vms.yml, playbooks/os_update_pve.yml, playbooks/os_update_pbs.yml, playbooks/app_update.yml
      trilium : xJRSQovMncQr, 6AbdS9cUE45T, bW84ccRoAJ5i, p45qNP2sIuhA, 6oESvJYzj1at
 -->
 
@@ -21,23 +21,24 @@ A single backup tool covering everything was the simpler design, and it was reje
 |---|---|---|
 | Infrastructure as Code | A host lost entirely, VM or LXC alike — rebuilt from the same pipeline that built it ([`docs/iac-pipeline.md`](iac-pipeline.md)), against its existing tag-driven config | Secrets — recovered separately via Vault, see [`docs/secrets-and-pki.md`](secrets-and-pki.md), not part of this layer |
 | Proxmox Backup Server | Full VM/LXC backups, including the secrets platform's own seal state and Vault's own data described in [`docs/secrets-and-pki.md`](secrets-and-pki.md) | One host's Docker volume data, a large media storage pool, personal data |
-| Kopia | The gap the layer above leaves — every stack's databases, uploaded files, and app config on the fleet's largest host, covering the ~55 stacks in [`stacks/`](../stacks/) | Anything outside that one host |
+| Kopia | The gap the layer above leaves — every stack's databases, uploaded files, and app config on the fleet's largest host, covering all 41 stacks running there | Anything outside that one host |
 
 This is the real Kopia repository, not a description of it — a dedicated set of directories on its own separate disk, confirmed live:
 
 ```
 $ ls /mnt/samsungssd
-kopia-cache  kopia-config  kopia-repo  kopia-tls
+kopia-cache  kopia-config  kopia-repo  kopia-tls  recovery
 $ df -h /mnt/samsungssd
 Filesystem      Size  Used Avail Use% Mounted on
-/dev/nvme0n1p1  234G   65G  167G  28% /mnt/samsungssd
+/dev/nvme0n1p1  234G   75G  157G  33% /mnt/samsungssd
 ```
 
 Layer 1's "rebuilt against its existing tag-driven config" claim is a real, checkable mechanism too — every role in the pipeline declares which of the three rebuild stages it belongs to:
 
 ```
-$ head -12 roles_metadata.yml
+$ head -14 roles_metadata.yml
 roles_metadata:
+  # Bootstrap roles
   base_users:
     initialization: true
     provisioning: false