docs: R-204 item 4 (box half) — CONTEXT + REPORT (controller v0.199.0)

CONTEXT.md

@@ -7,7 +7,40 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-08-05 (v0.198.0 — R-204 items 1 & 3: the reset code and the restore scope)
+Last updated: 2026-08-05 (v0.199.0 — R-204 item 4: a rebuilt box declares it needs a credential)
+
+> **2026-08-05 — v0.199.0 (R-204 item 4 / R-193).** The last of the four manual interventions the
+> 2026-08-04 drill needed. **Operator ruling: automate it, and the trigger is a state the BOX
+> DECLARES.** From the hub an absent off-site object has FOUR meanings — never configured,
+> mid-restart, a transient config read failure, rebuilt-and-stranded — and the hub cannot tell them
+> apart. The box can.
+>
+> **The declaration needs BOTH halves** (`backup.needsOffsiteCredential`): a fresh data area (no
+> repository password) AND a hub-held recovery package (the ACK's `identity_blob_present`). Freshness
+> alone is a box that never had off-site backups; dropping that condition makes the whole fleet ask
+> for credentials, which is what `TestOffsiteDeclare_NeverHadOffsiteSaysNothing` catches. A merely
+> DISABLED target is the customer's own choice and never declares.
+>
+> **The ACK field stopped being discarded.** `EscrowAutoConfirmer.Reconcile` returns early when the box
+> is neither pending nor escrowed — exactly a rebuilt box — so the fact was thrown away every cycle. It
+> is recorded FIRST, before every gate, via `RecordPresence`, wired in main.go and asserted by
+> `TestMainWiresRecordPresence` (AST, comments dropped). Last-write-wins, not set-only, so a customer
+> RESET turns the declaration back off; a nil ACK escrow records nothing.
+>
+> **Inert to every existing reader:** `enabled:false` + zero sizes, so the hub's `isStale` and
+> `fillBand` both short-circuit; an unknown `state` string is ignored by encoding/json. **A configured
+> box's report JSON is byte-identical to v0.198.0's.** The one reader that would have misread it is the
+> hub's `reportHasOffsite`, tightened in hub v0.96.0 to require `enabled:true`.
+>
+> *Live:* both demo boxes now record `hub_escrow_identity_present=true` in settings.json (the recorder
+> working on a HEALTHY box). demo-felhom 9201, arranged reversibly into the stranded shape, produced
+> report id=16743 carrying `{enabled:false, state:needs_credential, quota_gb:0, repo_size_bytes:0}`;
+> the single declaration was absorbed by the hub's debounce (no self-heal event) and the box was
+> restored the same minute. **The hub half is felhom.eu v0.96.0.**
+>
+> *Rider:* `.githooks/pre-push` in all four repos now refuses a push from a clone outside
+> `/mnt/5_hdd/felhom.eu`. Proven both ways against a scratch clone.
+
 
 > **2026-08-05 — v0.198.0 (R-204 items 1 & 3).** The 2026-08-04 drill (R-201) passed only because a
 > person was there; four manual interventions stood between a recovered key and a restored file. Two