R-311 proven live (HTTP 422 on hardware); R-308 WITHDRAWN — my quoting bug, not a stale credential

The live test read as a FAILURE for twenty minutes because I stripped only double
quotes from a credentials value wrapped in SINGLE ones, sending a literal ' as part
of the recovery code. Correctly unquoted: the old code returns 422 with
opens_retained=true and the supersession date; a wrong code still returns 400.

The same bug produced the R-308 finding in the previous report. The dashboard
password is fine - HTTP 302 with a session cookie on the first try. Third time this
project has produced a wrong 'the credential is stale' verdict from that one trap.

REPORT.md

@@ -112,8 +112,42 @@ enforcement**, and saying otherwise would have been false.
 | hub | **0.103.0** — see §7 |
 | golden | **0.214.0** baked + published |
 
-**Live validation was endpoint/handler-level, not a click-through**, and the reason is a finding:
-**the dashboard password of record no longer opens `demo-felhom` (R-308)**.
+### Live proof on hardware — the 422, end to end
+
+```
+OLD code (opens retained row 11)   HTTP 422  opens_retained: True
+                                             superseded_at: 2026-08-12T15:18:55Z
+                                             retained_has_restic_pw: True
+                                             "the recovery code is correct, but it belongs to an
+                                              EARLIER sealed package (superseded …), not the one
+                                              currently held"
+WRONG code (negative control)      HTTP 400  "the recovery code did not open the sealed bundle"
+```
+
+The hub half measured directly too: `GET …/escrow/retained` → **200**, `count=2`,
+**`unopenable_count=1`** — that one being retained row id 4, the pre-v0.93.0 row whose material R-198
+destroyed. The withholding rule is doing exactly what it was written for, on real data.
+
+**What was NOT walked, and why.** The customer's rendered sentence was **not** produced end-to-end.
+`recoveryUnlockHandler` redirects to `/backups/remote` when `!recoveryOffer()`, and `demo-felhom`
+holds its own repository password again (restored yesterday), so it is correctly **not** in the
+offered state. Walking it would mean removing that password to fake a rebuilt box — destabilising a
+healthy machine to render a sentence whose logic is pinned by six handler tests and whose upstream 422
+is proven live. I did not. **Method stated: endpoint-level for the agent and hub, handler-level for the
+message.** What the customer DOES see on this box today is the orphan card, and it is honest:
+*„Megnyitni innen egyelőre nem lehet, és ez nem a kódodon múlik."*
+
+### A correction I have to make about my own last report — R-308 was wrong
+
+I reported that the stored controller password no longer opens `demo-felhom`. **It does.** I had
+stripped only DOUBLE quotes from the `~/.config/credentials` value; the values are wrapped in
+**SINGLE** quotes, so I was sending a literal `'` as part of the password. Unquoted correctly it is 13
+characters and logs in first try — **HTTP 302 with a session cookie**.
+
+The same bug then made this session's first live R-311 test read as a **failure** (HTTP 400) for
+twenty minutes, and I nearly filed the fix as broken. It is the **third** wrong "the credential is
+stale" verdict this project has produced from that one trap. R-308 is **withdrawn**; the real lesson
+is filed with it — never let a shell decide what a secret is.
 
 ## 7. What was dropped, named plainly