hub v0.159.0: a refused whole-guest backup has its own alarm (R-1150); a reinstall re-issues the claim code and the off-site login when the old host is stale or off (R-1154)

R-1150: the agent's localapi:backup-cadence-cap is a separate per-host state in
HostCapabilityChecker: alone it raises whole_guest_backup_refused (warning, plain text,
agent reason in details) and whole_guest_backup_refusal_cleared (info); other critical
caps keep agent_capability_degraded/_recovered unchanged. New types operator-only and
hub-origin only (not in allowedEventTypes: the suspected controller must not post them).
agent_capability_degraded/_recovered join operatorOnlyEvents (the checker's "never the
customer" claim was configuration only).

R-1154: handleHostEnroll's reuse path re-issues (claim code + off-site login) when no
controller wait is open and either deliberate_off_at is held or both the host report and
the controller report are older than alerting.stale_threshold (wired from main); once per
silence (host_reenroll_reissued record, also written at mint); a live box gets nothing
re-issued and the skip is recorded (host_reenroll_not_reissued). 05 section 8 [DESIGN].

Tests red-proved; go build/vet/test green.

documentation/architecture/05-hub-architecture.md

@@ -222,6 +222,25 @@ Today: `GET /config/{id}` with an `X-Retrieval-Password` (Hungarian passphrase)
 The existing `configgen` deep-merge + Hungarian-passphrase machinery is the base; it grows the
 agent-first + key-pinning + restore-mode steps.
 
+**A reinstall over an existing host record re-issues when the old box is gone [DESIGN, 2026-10-19 — R-1154, brief
+2026-10-19; hub v0.159.0].** `POST /host-enroll` is the installer's step 4, run on every pass (a `--resume` too), with
+the customer's passphrase; an existing host record is REUSED (same id and key — the reinstalled box takes it over).
+The clean-slate re-issues (the claim code, the off-site login — both live in the CONTROLLER) used to run only when a
+record was minted, so a reinstall that kept the old record skipped both in silence. The reuse path now runs them
+when, and only when, the old box is gone: **no controller wait connection open now**, and either the household
+switched the box off on purpose (`deliberate_off_at` inside its hold) or **both** the agent's host report and the
+controller's report are older than `alerting.stale_threshold` (or absent) — the threshold and comparison
+`hostStatus` uses, no second definition. **Once per silence:** not again when it already ran since the host's last
+report (an installer `--resume` before the new agent's first report). **Why this rule and not "re-issue on every
+reuse":** a live box re-enrolls legitimately (a `--resume` after its agent started, a repair re-run), and re-issuing
+there rotates the household's claim code and resets its off-site login under a running box; not re-issuing costs a
+reinstall two operator presses, which the skip record now names. The controller report counts because the codes
+live there: a box whose agent is broken but whose controller reports is live. **Known residual:** a reinstall done
+less than the threshold after the old box's last report is still treated as live — it is recorded
+(`host_reenroll_not_reissued`, operator-only, info) instead of silent, and the operator presses the two buttons or
+deletes the old host first. The re-issue writes `host_reenroll_reissued` (also the once-per-silence record); both
+types are hub-origin only. `hub/internal/api/reenroll.go`, pinned by `hub/internal/api/r1154_reenroll_test.go`.
+
 ## 9. DR model
 
 The headline: the **old heavy infra-backup push retires** — not because the hub authors everything