R-201 PASSED: a customer's file survived a machine rebuild and came back byte-identical

CONTEXT.md

@@ -17,23 +17,32 @@
 
 ## Standing rulings
 
-**S-31 — the off-site key IS recoverable after a real rebuild; USING it is blocked by the remedy that
-makes the rebuild survivable (2026-08-04 night drill, R-201/R-204).**
+**S-31 — THE DRILL PASSED: a customer's file survives a machine rebuild and comes back byte-identical.
+The capability is proven; the customer JOURNEY is four undocumented manual steps (2026-08-04, R-201/R-204).**
 
-**Proven on hardware:** demo-hp's controller data volume was destroyed and the sentinel deleted; the
-customer's recovery code produced `8a9e33aa4da6…`, byte-identical to the pre-wipe on-disk key and to
-the hub's independent record, and installed cleanly on the bare box. `identity_blob` was unchanged
-across the wipe — nothing re-escrowed itself.
+**Proven on hardware, end to end:** demo-hp's controller data volume was destroyed and the sentinel
+deleted from disk. The recovery code produced `8a9e33aa4da6…` (byte-identical to the pre-wipe on-disk
+key AND the hub's independent record); it installed on the bare box; the **existing repository opened**
+(`repo_state: null`, 3 snapshots, 42 026 B = the pre-wipe size — not a fresh history); and the customer
+restore flow returned the sentinel at `643166269103a25c…`, **byte-identical**. `identity_blob` was
+unchanged throughout and **no ceremony was run at any point** (superseded rows still 2).
 
-**The wall (R-204), four links, all measured:**
+**But it took four manual steps that are in no design document (R-204), all measured:**
 1. a rebuilt controller cannot configure its off-site tier — the one-time password was consumed by its
    predecessor (`no unconsumed offsite password`, R-193);
 2. the Re-issue that fixes that sets `stale_at` **while `restic_pw_sha256` is unchanged** (R-196);
 3. a stale escrow makes the hub withhold the hash from the ACK → `EscrowAutoConfirmer` can never flip
    `pending → escrowed` → `OffboxRunnable` refuses every run;
-4. the only documented way to clear it is a ceremony, **which supersedes the identity blob and destroys
-   the recovered key**. And before any of it, a rebuilt box is **unclaimed**, so the claim gate
-   intercepts every controller endpoint — a step in no design document.
+4. it was cleared with the **manual** confirm (`/backup/offbox/confirm-escrow`), NOT a ceremony — a
+   ceremony would have superseded the identity blob and destroyed the recovered key;
+5. and the restore's **default `mode=unit` returns the recovery unit, not the customer's files** —
+   `mode=full` is what returns documents. A customer following the obvious path gets the wrong thing
+   and is told nothing.
+
+**Before any of it, a rebuilt box is unclaimed** and the claim gate intercepts every controller
+endpoint. **The local escape hatch does not work unaided:** `--print-reset-code` writes the new hash to
+`settings.json` while the running controller keeps its old copy in memory, so the code never matches —
+**restart the controller between minting and claiming.**
 
 *Facts a future session needs:*
 - **A guest rebuild in this fleet is a controller-DATA-VOLUME loss, not a guest reprovision.** The