context: offsite overnight soak result + C2 stale-lock finding

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,16 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-10 — offsite arc overnight soak (unattended) — PASS + 1 HIGH finding.** Record:
+  `documentation/audits/CAMPAIGN-offsite-overnight-2026-07-10.md`. F4 re-issue proved LIVE (reset invalidates
+  the old password); restore round-trip 9/9 byte-identical new-box↔USB (immich db-dump exact → old-box
+  archive `u629193*` safe to retire, Viktor's decision); single-flight + crash-restart (zero consume, escrow
+  untouched) PASS. **FINDING C2 (HIGH, OPEN):** a controller crash MID-PRUNE leaves a stale restic exclusive
+  lock the controller can't self-heal → offbox runs fail until manual `restic unlock` (fix candidate:
+  `ensureOffboxRepo` auto-unlocks a self-owned stale lock). Track B (live quota-crossing) + hub-orchestrated
+  Track A blocked — the hub operator config surface is session/CSRF-gated (unattended can't reach it) → Peti
+  runbook. Demo restored to start-state. One expected `backup_failed` email (the crash test).
+
 - **2026-07-10 — SLICE 4 soft-quota + offsite health SHIPPED+LIVE (hub v0.41.0 + controller v0.109.1) —
   the offsite arc is BUILD-COMPLETE.** Controller: `quota_gb` rides the descriptor into the target (hash
   includes it → quota changes re-apply via key-auth-first, no consume); `repo_size_bytes` from restic