drill R-201: prepared and HALTED before the wipe — a mandatory data directory was missing from the off-site snapshot while the run said ok (R-203)

CONTEXT.md

@@ -17,6 +17,27 @@
 
 ## Standing rulings
 
+**S-30 — the R-201 drill was PREPARED and HALTED BEFORE THE WIPE (2026-08-04). Nothing was wiped.**
+
+It stopped at step 4 because the sentinel file was **not in the off-site snapshot** while the run
+reported `ok` (**R-203**): the deploy-time `${USERDATA_PATH}` root and the backup-time `NamespaceRoot`
+disagree for an app whose `HDD_PATH` equals `system_data_path` — and the same compose used both roots.
+Wiping would have destroyed the only copy of the sentinel and proven nothing.
+
+*Established live on the way, all firsts, and all worth carrying:*
+- **A rebuilt box's off-site run REFUSES** — `repo_state: orphaned`, the orphan card, and
+  `offbox_repo_orphaned` at the hub. It does **not** silently start a fresh history. Closes R-193's Q3.
+- **The orphan reset works**: move-aside to `/home/felhom-repo.orphaned-20260804`, never delete.
+- **demo-hp's pre-rebuild off-site history is permanently unrecoverable** — its key is in superseded
+  row id 3 with `identity_blob` NULL, superseded **four hours before** v0.93.0 fixed the retention.
+- **Neither pre-existing off-site-toggled app has a restorable file leg** — both are named-volume-only,
+  which the tier tars but the customer restore never unpacks. Any drill needing a recoverable file
+  needs an app with a **mandatory userdata path**; `calibre-web` is now deployed on demo-hp as that
+  fixture, with the sentinel in place.
+
+*Still not established, unchanged:* **no file has ever been restored from an off-site backup after a
+wipe**, and Part 0's install path (controller v0.196.0) has never run against a live recovery.
+
 **S-29 — a box may fetch its OWN sealed recovery blob with its OWN credential; the operator-driven DR
 path is a separate thing and stays gated (2026-08-04, R-199; hub v0.94.0 + agent v0.125.0 + controller
 v0.195.0).**