docs: REPORT/README/CONTEXT for v0.58.0 prevention layer (9201 re-provision validated)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CONTEXT.md

@@ -13,6 +13,17 @@ Last updated: 2026-06-12 (storage UX polish)
 > is tracked in `CHANGELOG.md`, `controller/README.md`, and the auto-memory `MEMORY.md`. Live version:
 > **v0.45.0**.
 >
+> **2026-06-13 — v0.58.0 OS/Docker-data split prevention layer (Phase 2; Phase 1 = agent v0.29.0):**
+> - OS rootfs + Docker data split onto separate local-lvm volumes (golden bakes 32G rootfs + 256G
+>   /var/lib/docker, backup=1, **overlay2** so images live on the data vol). Infra protected by
+>   PREVENTION not placement: `system.GetDockerVolumeHeadroom()` (statfs "/" = data vol) reserves
+>   max(5GB,10%); `deployStack` refuses HTTP 507 below buffer; deploy.html banner+disable; monitor
+>   (warn80/crit90) watches the same vol; log rotation baked into the golden daemon.json.
+> - Live-validated by DESTROYING + RE-PROVISIONING 9201 from the split golden: split layout, overlay2,
+>   images on data vol, lean rootfs, OS isolation (data vol 100% → rootfs healthy), deploy gate 507,
+>   ActualBudget volume on data vol, hub config pull, external access via CF. RomM/USB re-enroll = the
+>   documented final restore step (RomM data safe on host USB). See memory [[os-data-split]].
+>
 > **2026-06-13 — v0.57.0 UI fixes (Part A of the UI-fixes/storage-spike spec):**
 > - A1: fixed the RIGHT storage list — `#host-storage-bars` (the JS-filled, agent-PVE-storage list:
 >   `local`/`local-lvm`/`felhom-pbs`/`felhom-usb`), which reordered on every poll. Now