docs: v0.122.0 customer-claim gate — REPORT + CONTEXT

CONTEXT.md

@@ -7,7 +7,22 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-07-12 (v0.121.0 — backups page truth pass)
+Last updated: 2026-07-12 (v0.122.0 — customer-claim password gate)
+
+> **2026-07-12 — v0.122.0: CUSTOMER-CLAIM PASSWORD GATE (closes DRILL-day0-vm F-4/F-5). MinAgent
+> 0.81.0 unchanged. Requires hub v0.50.0.** The dashboard password is CUSTOMER-OWNED via a one-time
+> claim code the hub emails to the registered address — the "no password → open dashboard" default
+> is GONE. Unclaimed box (code hash delivered, no password) → serves ONLY `/claim`; every other route
+> → claim page (302) or 401 (API). A set password disables the gate (auth wins). Reset rides the same
+> code engine (login "Elfelejtett jelszó"). Legacy-open (no password + no hash) → red transition
+> banner until the hub delivers a hash. `internal/web/claim.go` (gate + pages + HMAC pre-auth CSRF +
+> 5-try/15-min lockout → `claim_lockout` event), `report/claim_sync.go` (ACK cache, idempotent by
+> generation), settings `Claimed`/`ClaimCode*`/`ClaimConsumedGeneration`, `config.web.claim_code_*`
+> (hub-baked), `--print-reset-code` root hatch. Gate-coverage signature test + 4 red-proofs.
+> **LIVE-PROVEN on drill guest 9201 (0.122.0): gate ON via the real edge (/ → 302 claim page, /api →
+> 401), code emailed to demo-vm-felhom's registered address.** Floor raise 0.120→0.122 = operator's
+> LAST step (supervised). Details: felhom.eu/documentation/audits/DRILL-day0-vm-2026-07-12.md (F-4/F-5
+> RESOLVED).
 
 > **2026-07-12 — v0.121.0: BACKUPS PAGE TRUTH PASS. MinAgent 0.81.0 unchanged. Controller-only, no
 > agent-API change.** Pure UI/data-plumbing on `/backups`; no backup-engine behavior change. Fixes the