Remove-decision support end-to-end; in-package trust/provisioning docs; CA-preserving re-setup with fail-closed CA-loss handling.