v0.201.0 — a correct recovery code is never called wrong again (CAMPAIGN-11) — MinAgent 0.125.0

R-216: the offsite key recovery is a coupled feature and now says so. featureProbes +
featureMinAgent 0.125.0 + a Supports gate at the unlock entry point, FAILING CLOSED — an
agent that cannot answer is named as such instead of the customer's code being blamed.
Measured live: a 404 from agent 0.120.0 came back as "we did not accept your recovery
code, check that all ten words", in 0.134 s, against a perfect code.

R-218: delete the repo-password short-circuit in needsOffsiteCredential. The declaration
stops when the TIER WORKS, not when a key exists — installing a key is the recovery
screen's whole job, so succeeding at recovery was switching off the mechanism that would
have delivered the coordinates to use it.

R-219: the unlock finishes the job — place the key, bring the tier up, then list. Without
it the promised listing could never render on the shape the screen exists for.

R-217: an unreadable store no longer claims to have opened with unattributable content
(the OffsiteInventory{} zero value). Opened / empty / unreadable are three states.

R-222: a code that is right about a RETAINED earlier package is named, not blamed. States
what the hub knows and promises nothing — no read path exists.

R-215: GET /recovery is gated on the same predicate as the interception.

Five red-proofs, each demonstrated failing and restored.

controller/internal/backup/offbox.go

@@ -1228,6 +1228,32 @@ const OffsiteStateNeedsCredential = "needs_credential"
 // it". A target that exists but is DISABLED is not stranded either — the customer switched it off —
 // so the caller only consults this when there is no enabled target, and a non-nil disabled target
 // short-circuits to false here.
+//
+// ⚠ THE DECLARATION STOPS WHEN THE TIER WORKS, NOT WHEN A KEY EXISTS (R-218, v0.201.0).
+//
+// This used to carry a third condition: hold a repository password ⇒ not stranded, stop declaring.
+// It reads as a sound freshness test and it is the exact opposite on the one path that matters,
+// because installing a repository password is the RECOVERY SCREEN'S WHOLE JOB. Measured live on
+// 2026-08-05 (CAMPAIGN-11 Phase 1):
+//
+//	13:39:54  needs_credential          the box asks
+//	13:42:43  needs_credential          the hub's 2-report debounce is satisfied
+//	13:47:03  hub re-stages the credential — "the box re-consumes on its next cycle"
+//	13:47:35  the customer's unlock succeeds and places the recovered key
+//	13:53:42  (silence)                 …and never asks again
+//
+// Thirty-two seconds after the remedy fired, the customer's own success switched off the mechanism
+// that would have delivered the coordinates for the key they had just recovered. The hub held an
+// unconsumed credential the box had no reason to collect; the box held a correct key and nowhere to
+// use it; the screen said "a few minutes"; nothing was ever going to happen. Two features, each
+// correct alone, cancelling on the path both were built for.
+//
+// The two remaining conditions are the honest ones: no target at all, and the hub is keeping a sealed
+// package for us. Both stay true exactly until the tier is configured — which is the moment the box
+// genuinely no longer needs a credential — and `OffboxReportStatus` stops consulting this predicate
+// the instant a target exists. **Scenario E is unaffected and is pinned by its own test**: a disabled
+// target is non-nil and still short-circuits at the first line, so a box whose customer switched
+// off-site off stays silent.
 func (m *Manager) needsOffsiteCredential(t *settings.OffboxTarget) bool {
 	if t != nil {
 		return false // a target exists (merely disabled) — the customer's own choice, not a rebuild
@@ -1235,9 +1261,6 @@ func (m *Manager) needsOffsiteCredential(t *settings.OffboxTarget) bool {
 	if m.settings == nil || !m.settings.GetHubEscrowIdentityPresent() {
 		return false // the hub holds nothing for us: never had off-site backups
 	}
-	if _, ok := m.OffboxRepoPasswordHash(); ok {
-		return false // we still hold our repository password: not a fresh data area
-	}
 	return true
 }