R-543 closed: the household is asked for the recovery code (controller v0.245.0)

The tier-3 pause is the zero-knowledge escrow design and is untouched. What was
missing was the ASK, while the backup page promised the copy that had never run.

- VOLUNTEER-first-hour.md: a new step 6, right after the dashboard password and
  before the first app - what the code is, where, write it on PAPER, and that
  Felhom cannot get it back for them. Sections 6..12 renumbered to 7..13.
- day0-install.md A.2b: the operator step for a REBUILT box, which was missing.
  Acknowledged delete -> the hub re-issues by itself; otherwise ONE press of
  "Re-issue PBS credentials" (F-14 ruling 2026-07-13, hub/internal/web/pbsdr.go).
  This is the correction to last night's "zero presses" note.
- 07-backup-architecture.md: 6.1 records tier-3's paused state as a DESIGN, and
  2 records that the household is asked from first login.
- capability map: the first-hour row's last gap closed, with what it still does
  not claim (no volunteer has walked the ask from the written guide).
- register: R-543 CLOSED with the live measurements; R-545 filed (nothing
  un-configures an off-site target). R-511 was already closed yesterday.
- STATUS: the answered publish question removed (1.28.0 is live), readiness yes.
- evidence: red-proofs, the two-box live validation, teardown on three layers,
  and both of my own mistakes in this session.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -14,6 +14,43 @@
 > language, one screen, no identifiers in the prose. Same subjects, different readers; merging them
 > would make one of the two audiences stop reading. `STATUS.md` is also a **view of `OPEN-ITEMS.md`**
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
+## Decisions 2026-09-16 (evening) — the recovery code: the household is asked, the page says „szünetel"
+
+**No new ruling. One correction to the record, from the operator (2026-09-16):** the note saying a
+rebuilt box needs zero presses for its off-site setup was WRONG. The press exists by the F-14 ruling
+of 2026-07-13 — the hub re-issues by itself **only** when the previous box was deleted through the
+acknowledged flow; otherwise `handleHostEnroll` reuses the existing record and mints nothing, and the
+operator presses „Re-issue PBS credentials" once (`hub/internal/web/pbsdr.go`). That ruling stands and
+is now written into `runbooks/day0-install.md` §A.2b, where it was missing.
+
+**R-543 CLOSED — controller v0.245.0.** The tier-3 pause is the zero-knowledge escrow design and was
+not touched. Two copy changes only:
+
+- **`internal/web/escrow_banner.go`** — the R-241 reminder bar, SECOND INSTANCE. `escrowPaused()`
+  reads the same two facts `tier3State` reads (`backupMgr.OffboxConfigured()` and
+  `settings.GetOffboxTarget().EscrowState != "escrowed"`), so the bar and the app rows cannot
+  disagree. **It hangs off `executeTemplate` (server.go), the single render choke point** — not the
+  three `addRecoveryBanner` call sites, because a per-handler helper reaches only the pages someone
+  remembered (the seam-built-but-never-wired class). Login and claim render through
+  `s.tmpl.ExecuteTemplate` directly and never pass through it; `hasAdminSession()` (mirroring
+  `RequireAuth`, legacy-open included) keeps it off the public `/s/<token>` share page. Dismissal:
+  session cookie `felhom_escrow_banner`, no MaxAge/Expires, route `/backup/escrow/banner/dismiss`.
+- **`driveFilesNoteFor` (`internal/web/backup_page_state.go`)** — the tier-1 file sentence takes
+  `tier3State`'s OWN vocabulary instead of the app's shape, and returns (note, linkHref, linkText) so
+  the template renders a real anchor. Assigned at the END of the app-row loop, where `Tier3State` and
+  `Tier2Configured` are both already resolved.
+
+**Trap re-learned, twice in one session, and worth the line:** inside a guest the controller's data
+directory is `/var/lib/docker/volumes/felhom-controller-data/_data/data`; `/opt/docker/felhom-controller/data`
+is the CONTAINER's view of the same files. A teardown script using the container path from a guest
+shell printed „offbox dir now: ABSENT" — true of a path that never existed, false of the thing being
+claimed — and left the target fully configured. Also: the controller answers on the container address
+`172.17.0.2:8080` with the mandatory `Host` header; it is NOT on the guest's `127.0.0.1`, and neither
+guest is reachable from DooPlex at all.
+
+**New row:** R-545 (P3) — nothing un-configures an off-site target; `/backup/offbox/reset` refuses
+unless the repo is ORPHANED and means „start a new remote backup", not „forget this destination".
+
 ## Decisions 2026-09-16 (afternoon) — the backup promise: files protected from day one
 
 **Ruling: the off-site copy is ON for every customer from day one** — shared (a sub-account on the