final walk COMPLETE — data PASS, journey FAIL; R-241 filed

THE DATA: PASS. All three sentinels byte-identical out of snapshot f5c53b03,
including the 12 MB binary and the accented Hungarian filename whose NAME BYTES
are identical too. Disk -> restic -> SFTP -> Storage Box -> rebuilt machine ->
disk, intact.

THE JOURNEY: FAIL, and further from the line than the previous walk. The claim
worked first try (302 in 0.164s). Then: / lands on the launcher with no recovery
pointer, /recovery 302s away, and the remote page offers to CREATE a new recovery
code — which would orphan the history the customer's code protects. There is no
field anywhere to enter the code they hold. The operator's documented remedy also
refuses, correctly and fail-closed. Recovery needed three guest command lines.

R-241 — and the cause is a success this same walk proved six hours earlier.
OffsiteRecoveryOffer() shows the screen only when (a) there is NO repository
password (pristine rebuild) or (b) one exists but the history will not open under
it. Overnight the credential self-heal collected the staged credential and applied
the tier, writing a FRESH key at 03:18Z — so (a) is false; and (b) is unreachable
because orphan detection needs a run, and runs are blocked by escrow_state=pending.
The gap is self-locking. Measured keys: on-disk 9b4a9a9d... vs recovered-from-R
30ef574f... This is R-218's shape one level up: succeeding at the self-heal stopped
the box OFFERING the recovery it still needed.

Registers: R-201 moved to its outcome; R-241 filed; capability map's recovery row
stays FAIL with both halves and the cause named; STATUS rewritten for the operator.
Highest ID R-238 -> R-241.

The venue is left with the recovered key in place and the self-heal key moved
aside, never deleted. Teardown still owed.

STATUS.md

@@ -1,6 +1,6 @@
 # STATUS — what works, what's broken, what's next
 
-**Updated 2026-08-06.**
+**Updated 2026-08-07.**
 
 > **A view, not a source.** `documentation/backlog/OPEN-ITEMS.md` is the authority on open work; this
 > page restates part of it in plain words, and **nothing may exist only here**. **Not `CONTEXT.md`**,
@@ -15,12 +15,23 @@ who sets their own password. They install apps from a catalogue of fifty-three,
 home network, and open apps from a launcher or a shared link. Backups run on their own to three
 places — the machine's drive, a second drive, and an encrypted off-site copy.
 
-**The backup promise is proved. The recovery JOURNEY is not.** On 5 August we built a brand-new
-machine from the published disc, gave it three marked files, destroyed it, and tried to get them back
-**the way a household would** — no shortcuts, no command line. The files came back **byte for byte
-identical**, all three, including one with Hungarian accents in its name. But **the journey needed us
-four times**, and the very first thing the machine did was tell the customer their correct recovery
-code was wrong. *(CAMPAIGN 11)*
+**The backup promise is proved again. The recovery JOURNEY still is not — and last night it got
+worse before it gets better.** On 6–7 August we built a brand-new machine from the published disc,
+gave it three marked files, left it alone through a full night's scheduled work, destroyed it, and
+rebuilt it. **The files came back byte for byte identical**, all three, including one with Hungarian
+accents in its name. **But the household had no way to ask for them.** The screen that takes their
+recovery code had switched itself off, and the backup page offered to make them a *new* code — which
+would have locked the old backups away for good. There was no box to type their code into at all.
+
+**The cause is a success.** A repair that runs on its own — and which this same night proved working
+beautifully, with nobody touching anything — hands the machine a fresh key. Holding that key makes the
+machine think it no longer needs rescuing. It is the same mistake the system already fixed once, one
+level higher up. *(R-241)*
+
+**And separately: today's machines do not yet have last week's fixes.** A machine installed tonight
+still gets the older in-house service, so two defects we fixed and closed are still live for a new
+customer. The code is right; it has not been packaged and approved yet. *(R-239)*
+
 
 ## What's broken