R-923: STATUS, capability map, session report (break the circle)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -2,8 +2,20 @@
 
 **Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.**
 
-**Updated 2026-10-09 (midday): hub 0.144.0; demo-hp, demo-felhom and Tester 1 run agent 0.154.0 and controller
-0.304.0. The open-items list is at 135. Reports: `REPORT-dooplex-survival-2026-10-09.md`, `REPORT-day4-2026-10-09.md`.**
+**Updated 2026-10-09 (afternoon): hub 0.144.0; demo-hp, demo-felhom and Tester 1 run agent 0.154.0 and controller
+0.304.0. The open-items list is at 138. Reports: `REPORT-break-the-circle-2026-10-09.md`, `REPORT-dooplex-survival-2026-10-09.md`, `REPORT-day4-2026-10-09.md`.**
+
+## Afternoon (2026-10-09): the password manager is copied off-site; one page to print
+
+- **Your password manager (Vaultwarden) now goes to ep0 every night**, with the code. You said yes. A test brought it
+  back on a throwaway machine: it starts, with your 1 account and 797 items. Nobody opened the items.
+- **The circle is broken only when you print the sheet.** The copy on ep0 opens with one key, and that key was only
+  in the password manager on DooPlex. The sheet lists the keys to print, with the commands. It holds no value itself.
+- **New finding: the signing keys live only on DooPlex**, with no password and in no backup. If DooPlex is lost, no
+  box can take a signed update again without a visit. Your decision (see the report).
+- **Built, not released:** a household that clears its mail address gets it deleted on the hub (your answer A); a
+  restored hub sends no mail until you release it; the backup no longer stops the apps when another backup is still
+  running. Found and fixed on the way: one box's key could change another household's mail settings.
 
 ## Midday (2026-10-09): the code and the hub can now survive losing DooPlex