docs: R-204 ALL FOUR items closed; R-193 credential half; R-192 by replacement; R-212 filed

- OPEN-ITEMS: R-204 all four CLOSED with both 2026-08-05 rulings recorded (the
  declared-state trigger and its four-meanings-of-absence reasoning; the recovery
  preview's dashboard-password exposure accepted as metadata, not content).
  R-193's credential half CLOSED, screen + deletion still open. R-192 CLOSED by
  REPLACEMENT. R-202 untouched.
- R-212 MINTED (R-211 was the highest, grepped): the orphaned-ciphertext deletion
  HALTED at its STOP because the measured paths do not match the register — three
  set-aside stores totalling ~1.45 GB, and the thing that is exactly 1.2 GB is
  demo-felhom's LIVE repo. Nothing was deleted.
- capability map: all four interventions closed; the row KEEPS a qualifier for a
  new reason — no step needs an operator, but there is no customer-facing recovery
  screen, and the journey has not been re-walked end to end.
- 07-backup-architecture 7.0: the four-step table updated; the declaration-vs-
  inference reasoning and the credential-automatic/key-customer-present split.
- CONTEXT: standing ruling S-33.
- STATUS: the headline change and the deletion STOP.
- REPORT-r204-item4.md rather than REPORT.md: a parallel session is active in this
  shared clone.

STATUS.md

@@ -22,16 +22,16 @@ over; and the file was restored **byte for byte identical**. *(R-201)*
 
 ## What's broken
 
-- **A customer still cannot do that recovery alone — but only one step is left.** Getting from "the
-  key is recoverable" to "the file is back" took four steps that appeared in no instructions. **Three
-  are fixed today** *(R-204)*: the local reset-code tool works on the first try instead of needing the
-  controller restarted; re-issuing the storage credential no longer falsely marks the recovery key
-  "stale" (which used to stop every off-site backup and invite the one act that would have destroyed
-  the recovered key); and the everyday restore now **says in plain Hungarian that it returned the
-  app's settings and database and not your documents**, and names the button that does. **The step
-  that remains is the first one:** a rebuilt machine cannot get a storage credential by itself,
-  because the one-time password was used up by its predecessor — so you still have to press
-  Re-issue. That is a design decision waiting on you, below. *(R-193)*
+- **All four recovery steps are now automatic — but a customer still would not know to start.** The
+  four steps that stood between "the key is recoverable" and "the file is back" are closed *(R-204)*:
+  the reset-code tool works first time; re-issuing the storage credential no longer falsely marks the
+  recovery key "stale"; the everyday restore says in plain Hungarian that it returned the app's
+  settings and database and **not** your documents; and, as of today, **a rebuilt machine asks for its
+  storage credential itself and the hub answers** — no Re-issue click. **What is missing is the
+  offer:** there is no screen that meets the owner of a rebuilt machine, tells them a sealed package
+  is waiting, takes their recovery code and shows what would come back. So nothing needs *you* any
+  more, but it still needs someone who knows to look. **And the whole journey has not been re-run end
+  to end since these fixes** — the four are proved one at a time, not as a single walk. *(R-193)*
 - **Rebuilding a machine still throws away its off-site backup HISTORY.** The machine invents the key
   that encrypts its own off-site backups, and a rebuilt machine invents a brand-new one. Both demo
   machines did this on 3–4 August — 51 backups (~1.2 GB) between them. The old key now survives the
@@ -47,6 +47,14 @@ over; and the file was restored **byte for byte identical**. *(R-201)*
 
 ## What shipped recently
 
+- **2026-08-05** — **A rebuilt machine now asks for its storage credential, and the hub gives it back.**
+  The machine says plainly what it needs — it can tell it has been rebuilt, because its data area is
+  empty *and* the hub is holding a sealed recovery package for it — instead of leaving the hub to guess
+  from a silence that has four possible meanings. The hub waits long enough to be sure it is not a
+  restart, then **re-uses the credential it already holds** before creating a new one at the storage
+  provider. **The recovery ceremony stays manual, deliberately:** a credential can be replaced, your
+  recovery code cannot. *(R-204 item 4, R-193)*
+
 - **2026-08-05** — **The DooPlex server's disk is out of danger: 86% full → 54%, and the storage layer
   is unstuck.** The cause was leftover working data from building our own software — 157 GB of it,
   growing about 5 GB a day, which nothing was allowed to delete. **148 GB came back in 86 seconds.**
@@ -99,10 +107,13 @@ over; and the file was restored **byte for byte identical**. *(R-201)*
   (controller up to 0.135.0, hub up to 0.57.0; everything newer is safely in the registry). **Nothing
   was deleted.** Worth knowing before you spend time on it: they only account for about 27 GB against
   199 GB now free, so this is about clutter, not space. *(R-210)*
-- **The one-shot credential decision — this is now the last thing between a customer and an unaided
-  recovery.** A rebuilt machine has no storage credential of its own, so an operator must press
-  Re-issue. Everything after that point is now self-service. Deciding how a rebuilt machine should get
-  a credential is the remaining design question. *(R-193, R-204 item 4)*
+- **The orphaned-backup deletion is STOPPED and needs your ruling — the list does not match.** You
+  asked for about 1.2 GB in two set-aside stores to be deleted. Measured today, read-only: demo-felhom
+  holds a **live** store of 1.2 GB plus set-aside stores of **1.4 GB** and **3 MB**; demo-hp holds a
+  live store of 582 KB plus a set-aside store of **43 MB**. So there are **three** set-aside stores
+  totalling ~1.45 GB, not two — **and the thing that is exactly 1.2 GB is demo-felhom's LIVE store**,
+  which must not be deleted. **Nothing was deleted.** Tell me which of the three `orphaned` stores to
+  remove. *(R-212)*
 - **The recovery screen you described has been priced, and it can be built.** A freshly installed
   machine that finds a sealed package waiting should say so, offer a box for the recovery code, and
   show what would come back before doing anything. One thing to weigh, deliberately not decided: that