docs: CAMPAIGN-11 fix pass — REPORT + CONTEXT (controller v0.201.0)

CONTEXT.md

@@ -1776,6 +1776,35 @@ Last updated: 2026-06-13 (v0.60.0 backlog-Medium cleanup)
 
 ---
 
+## CAMPAIGN 11 — what changed in v0.201.0 (2026-08-05)
+
+**The off-site key recovery is a COUPLED feature and now declares it.** It needs agent **0.125.0**
+(`POST /escrow/recover-offsite-password`). `FeatureOffsiteKeyRecovery` has a `featureProbes` row, a
+`featureMinAgent` row and a `Supports` gate at the unlock entry point.
+
+⚠ **That gate FAILS CLOSED — alone in that table.** The package default is fail-open, and that default
+is what produced R-216: an agent that could not answer 404'd, the unlock was attempted anyway, and the
+customer was told their correct recovery code was wrong. Anything but `SupportYes` now says *the
+machine* cannot ask yet, and no attempt is made. Do not "fix" it back to the package default.
+
+**The box declares `needs_credential` until the TIER WORKS, not until a key exists.** The old
+short-circuit on "a repository password is present" is deleted: installing one is the recovery
+screen's whole job, so it made succeeding at recovery switch off the mechanism that delivers the
+coordinates to use it. A disabled target still short-circuits at the first line (Scenario E).
+
+**The unlock finishes the job**: place the key → bring the tier up (`offsiteapply.Bridge.Reconcile`,
+wired via `SetRecoveryTierUp`) → list. Without the middle step the promised listing can never render on
+shape (a), because no key ⇒ no target ⇒ no inventory.
+
+**Four messages, not one.** Wrong code (the only one mentioning typing) · the machine cannot ask ·
+the store could not be read / the connection details have not arrived · the code belongs to a RETAINED
+earlier package. The last one is driven by the ACK's `superseded_present`/`superseded_at` (hub
+v0.97.0) and **promises nothing** — no read path for a superseded package exists.
+
+**Still open from the campaign:** R-214 (console pairing banner), R-220 (drives unenrollable after a
+rebuild), R-221 (a rebuilt box cannot run the escrow ceremony), R-223 (the Day-0 manifest still vouches
+agent 0.120.0 — operator decision).
+
 ## R-203 (v0.197.0) — the namespace-root contract, and what `ok` now means
 
 **The contract, in one line:** `appbackup`'s path helpers (`UserdataDir`, `PrimaryBackupPath`,