docs: v0.76.0 REPORT/CONTEXT — campaign-#3 hardening fixes + live re-test evidence

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CONTEXT.md

@@ -7,6 +7,23 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
+Last updated: 2026-06-22 (v0.76.0 — campaign-#3 hardening: settings recovery, restore-name validation, quiesce-marker quarantine)
+
+> **2026-06-22 — v0.76.0 (deployed on 9201): three campaign-#3 hardening fixes.**
+> - **S1**: corrupt `settings.json` no longer crash-loops — `save()` writes a last-known-good `.bak`
+>   (after the primary rename); `Load()` recovers from `.bak`, else preserves the corrupt file as
+>   `*.corrupt-<ts>` + safe defaults. New `Settings.LoadWarning` → dashboard banner. (`main.go` Fatalf
+>   now only on the IO-unreadable path.)
+> - **F2**: `web.validStackName` gates `backupRestoreHandler` + `apiExportStart` (reject `/ \ .. NUL`)
+>   before any restore/export — closes the traversal defense-in-depth gap (no escape had occurred, but
+>   it relied on downstream map-lookups).
+> - **S3**: `quiesce.readMarker` logs `[WARN]` + quarantines a corrupt marker to `*.corrupt-<ts>`
+>   instead of silently dropping it.
+> All three live-validated on 9201 (truncate settings → recover from .bak no crash-loop; traversal
+> restore → rejected, /etc intact; corrupt quiesce marker → quarantined). Tests + red-proofs.
+> Still-open campaign-#3 deferrals (NOT done): time-chaos on a dedicated VM, host reboot (supervised),
+> `.fab` import compose-fuzzing. See `felhom.eu/documentation/tests/test-campaign-3-2026-06-22-findings.md`.
+
 Last updated: 2026-06-22 (v0.75.0 — gate userdata MkdirAll on a live mountpoint)
 
 > **2026-06-22 — v0.75.0 (deployed on 9201): userdata MkdirAll gated on a live mountpoint.**