docs: R-196 closed, R-204 items 1-3 closed, item 4 open (R-193)

- OPEN-ITEMS: R-196 CLOSED; R-204 items 1-3 CLOSED with item 4 named and
  its dependency stated. Header restates that R-202, the 1.2 GB ciphertext
  deletion and R-198's still-unit-proven retention all REMAIN OPEN.
- capability map: the recovery row keeps its 'with a person present'
  qualifier, names which crutch remains, and cites the three now gone.
- 07-backup-architecture: new 7.0 - what a customer can and cannot do
  ALONE, the four steps in a table with status. This is the section a
  future reader will use to answer that question.
- CONTEXT: standing ruling S-32, superseding S-31 steps 2-5.
- STATUS: rewritten to one screen per its own header; removes a corrupted
  half-overwritten section left from the drill session.
- ROADMAP: R-196 and R-204 collapsed.

CONTEXT.md

@@ -17,6 +17,45 @@
 
 ## Standing rulings
 
+**S-32 — THREE OF S-31's FOUR MANUAL STEPS ARE CLOSED (2026-08-05, R-204 items 1–3 / R-196).
+controller v0.198.0 + hub v0.95.0. Read this BEFORE S-31 — it supersedes S-31's steps 2–5.**
+
+- **Step 1 (the reset code) — CLOSED.** `web.effectiveClaimCode` now calls `settings.ReloadClaimCode()`
+  before applying the settings-vs-config precedence, so a code minted by the SEPARATE
+  `--print-reset-code` process is visible without a restart. **The precedence rule is unchanged** —
+  the defect was the freshness of the settings value, not which source wins. It is a READ-THROUGH on
+  the claim path only, deliberately **not** a watcher, a signal handler or a TTL: a TTL would leave a
+  window in which a superseded code still works, which is worse than the bug. `effectiveClaimCode`
+  now returns an error and **every caller fails closed** (`claimGateActive` keeps the gate UP; an
+  absent settings file is NOT an error — a pre-first-save box legitimately falls back to the
+  controller.yaml bake). **S-31's "restart the controller between minting and claiming" is obsolete.**
+- **Steps 2–4 (the false staleness) — CLOSED.** `offsite.ReissueCredentials` no longer calls
+  `MarkEscrowStale` and no longer emits `escrow_stale`; `offsite_reissued` is untouched. **The
+  mechanism that made this expensive, recorded because it is not obvious:** `stale_at` makes
+  `GetEscrowStatusForCustomer` WITHHOLD `restic_pw_sha256` — which is the exact value the controller's
+  Scenario-F re-check (`report.EscrowAutoConfirmer.reconcileEscrowed`) compares against its live repo
+  password on every ACK. **The precautionary mark was blinding the measurement that would have told
+  the truth**, leaving the box able to report only the hash-LESS reason, which is false. Coverage
+  after removal: that per-ACK comparison (continuous, box-side) plus R-197's `offsite_repo_key_changed`
+  (edge-triggered, hub-side, at a supersession). **`MarkEscrowStale` is KEPT with no caller** — the
+  flag is still read by the ACK, the operator card and the PBS-DR view, and the right way to set it is
+  a future caller that has MEASURED a change; `TestEscrowStaleMechanism_StillWithholdsAndClears` stops
+  it decaying meanwhile. **The manual `/backup/offbox/confirm-escrow` workaround is no longer needed
+  after a Re-issue.**
+- **Step 5 (the restore default) — CLOSED.** `restoreScratchOutcomeMsg` states, for `mode=unit`, what
+  came back, that the customer's own files did NOT, and the step that gets them; the wizard's intent
+  card 1 states its scope before the choice. **The `mode=full` size gate is untouched** and pinned as
+  unchanged. **The default stays `unit`:** all three wizard forms set `mode` explicitly, so changing
+  it would alter nothing the customer sees while silently changing a hand-crafted mode-less POST.
+- **WHAT REMAINS is S-31's step 1-before-the-list: a rebuilt box still cannot obtain an off-site
+  credential unaided** (the one-time password was consumed by its predecessor), so an operator
+  Re-issue is still required. That is **R-193**, it needs an operator ruling, and it is why the
+  capability-map recovery row keeps its *"with a person present"* qualifier.
+- **Live-validated on demo boxes, endpoint-level** (no browser on DooPlex): reset codes on
+  demo-felhom 9201 with `restarts=0` across the mints; the unit-restore outcome and the full-restore
+  size-gate reveal on demo-hp 9201, using `privatebin` so the drill's `calibre-web` scratch was not
+  touched. **The Part 2 change was NOT fired live on demo-hp** — a Re-issue there was out of scope.
+
 **S-31 — THE DRILL PASSED: a customer's file survives a machine rebuild and comes back byte-identical.
 The capability is proven; the customer JOURNEY is four undocumented manual steps (2026-08-04, R-201/R-204).**