R-201 night run: the off-site key IS recoverable after a real rebuild (proven); the verdict is blocked by R-204

CONTEXT.md

@@ -17,6 +17,33 @@
 
 ## Standing rulings
 
+**S-31 — the off-site key IS recoverable after a real rebuild; USING it is blocked by the remedy that
+makes the rebuild survivable (2026-08-04 night drill, R-201/R-204).**
+
+**Proven on hardware:** demo-hp's controller data volume was destroyed and the sentinel deleted; the
+customer's recovery code produced `8a9e33aa4da6…`, byte-identical to the pre-wipe on-disk key and to
+the hub's independent record, and installed cleanly on the bare box. `identity_blob` was unchanged
+across the wipe — nothing re-escrowed itself.
+
+**The wall (R-204), four links, all measured:**
+1. a rebuilt controller cannot configure its off-site tier — the one-time password was consumed by its
+   predecessor (`no unconsumed offsite password`, R-193);
+2. the Re-issue that fixes that sets `stale_at` **while `restic_pw_sha256` is unchanged** (R-196);
+3. a stale escrow makes the hub withhold the hash from the ACK → `EscrowAutoConfirmer` can never flip
+   `pending → escrowed` → `OffboxRunnable` refuses every run;
+4. the only documented way to clear it is a ceremony, **which supersedes the identity blob and destroys
+   the recovered key**. And before any of it, a rebuilt box is **unclaimed**, so the claim gate
+   intercepts every controller endpoint — a step in no design document.
+
+*Facts a future session needs:*
+- **A guest rebuild in this fleet is a controller-DATA-VOLUME loss, not a guest reprovision.** The
+  2026-08-03 incident R-193 is filed against ran with guest 9201 up throughout — no `pct destroy`, no
+  `pct restore`, no `--selftest=provision`. Reproduce it that way.
+- **A good snapshot is not durable against a later bad run on the same day.** `forget --keep-daily 7
+  --group-by host,tags` keeps one per tag per day; a later, worse snapshot evicts a good one.
+- **Never run a ceremony while a recovery is in flight** — it supersedes the identity blob. Under
+  v0.93.0 the old blob is retained, but nothing serves a superseded blob back (R-199).
+
 **S-30 — the R-201 drill was PREPARED and HALTED BEFORE THE WIPE (2026-08-04). Nothing was wiped.**
 
 It stopped at step 4 because the sentinel file was **not in the off-site snapshot** while the run