docs: R-204 ALL FOUR items closed; R-193 credential half; R-192 by replacement; R-212 filed

- OPEN-ITEMS: R-204 all four CLOSED with both 2026-08-05 rulings recorded (the
  declared-state trigger and its four-meanings-of-absence reasoning; the recovery
  preview's dashboard-password exposure accepted as metadata, not content).
  R-193's credential half CLOSED, screen + deletion still open. R-192 CLOSED by
  REPLACEMENT. R-202 untouched.
- R-212 MINTED (R-211 was the highest, grepped): the orphaned-ciphertext deletion
  HALTED at its STOP because the measured paths do not match the register — three
  set-aside stores totalling ~1.45 GB, and the thing that is exactly 1.2 GB is
  demo-felhom's LIVE repo. Nothing was deleted.
- capability map: all four interventions closed; the row KEEPS a qualifier for a
  new reason — no step needs an operator, but there is no customer-facing recovery
  screen, and the journey has not been re-walked end to end.
- 07-backup-architecture 7.0: the four-step table updated; the declaration-vs-
  inference reasoning and the credential-automatic/key-customer-present split.
- CONTEXT: standing ruling S-33.
- STATUS: the headline change and the deletion STOP.
- REPORT-r204-item4.md rather than REPORT.md: a parallel session is active in this
  shared clone.

CONTEXT.md

@@ -17,6 +17,52 @@
 
 ## Standing rulings
 
+**S-33 — THE BOX DECLARES, THE HUB ANSWERS. R-204 item 4 / R-193's credential half closed
+(2026-08-05, controller v0.199.0 + hub v0.96.0). Read with S-32; together they close all four of the
+drill's manual interventions.**
+
+**THE RULING AND ITS REASONING (operator, 2026-08-05).** Automate the rebuilt box's credential, and
+**the trigger is a state the BOX DECLARES — never the hub inferring from a report.** From the hub an
+ABSENT off-site object has FOUR meanings — never configured, mid-restart, a transient config read
+failure, rebuilt-and-stranded — and the hub cannot tell them apart. The box can, from two local facts:
+its data area is fresh (no repository password) AND the hub holds a sealed recovery package for it
+(the ACK's `identity_blob_present`). **Both are required.** Freshness alone is a box that never had
+off-site backups — declaring on it would make the whole fleet ask for credentials.
+
+**SECOND RULING RECORDED:** the dashboard-password exposure on the future recovery-preview screen is
+**metadata** (backup dates, app names), not content, and is **ACCEPTED**.
+
+*Mechanism facts a future session needs:*
+
+- **The ACK field used to be discarded.** `EscrowAutoConfirmer.Reconcile` returns early when the box is
+  neither pending nor escrowed — exactly a rebuilt box — so `identity_blob_present` was thrown away
+  every cycle. It is now recorded FIRST, before every gate, in the confirmer itself (already the one
+  place the ACK's escrow object arrives, and already wired; a second consumer would be a second wiring
+  point, and this project's built-but-never-wired count is six). Last-write-wins, not set-only: a
+  customer RESET must be able to turn the declaration back off.
+- **The declaration is inert to every existing reader, established from their code:** it carries
+  `enabled:false` and zero sizes, and `OffsiteChecker.isStale` returns early on `!Enabled` while
+  `fillBand` returns OK on a zero quota/size. A configured box's report JSON is byte-identical to
+  v0.198.0's — no `state` key at all.
+- **`reportHasOffsite` had to be tightened, and it is the ninth comment-vs-code entry — caught before
+  it shipped.** Its comment asserted *"presence == applied-on-the-box"*. Left as bare presence it would
+  have read a request for help as proof the tier was applied. It now requires `enabled:true`, provably
+  a no-op for every pre-v0.199.0 report shape.
+- **Restage before mint is possible because the stored value SURVIVES a consume** —
+  `ConsumeOneTimeSecret` stamps `consumed_at` and nothing else, and `value` is `TEXT NOT NULL`. This was
+  established from the schema, NOT inherited from the PBS analogy; the two secrets are different objects
+  and assuming a shared shape is how two sessions confused the credentials.
+- **The debounce is TWO DISTINCT REPORTS, derived from the ~15-minute report cadence** — one would act
+  on a blip, three would leave a stranded customer waiting ~45 minutes. It counts fresh evidence, not
+  reconciler ticks, so the 5-minute sweep cannot shorten it.
+- **§8.4's deliberately-unhealed state exists and is excluded UPSTREAM, by construction:** the regressed
+  shape (a box that lost its target while still holding its repository password) cannot reach the
+  reconciler, because the declaration predicate requires the repository password to be absent.
+- **R-192's counting guard is REPLACED, not repaired.** A declaration outranks both inferred shapes and
+  the delivery checker stands down with a record — two mechanisms healing one customer would
+  double-issue, and that one can only mint.
+- **NEVER widen this to the ceremony. Credential automatic, key customer-present.**
+
 **S-32 — THREE OF S-31's FOUR MANUAL STEPS ARE CLOSED (2026-08-05, R-204 items 1–3 / R-196).
 controller v0.198.0 + hub v0.95.0. Read this BEFORE S-31 — it supersedes S-31's steps 2–5.**