docs: SLICE 4 — hub README, REPORT, CONTEXT (offsite arc build-complete)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,19 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-10 — SLICE 4 soft-quota + offsite health SHIPPED+LIVE (hub v0.41.0 + controller v0.109.1) —
+  the offsite arc is BUILD-COMPLETE.** Controller: `quota_gb` rides the descriptor into the target (hash
+  includes it → quota changes re-apply via key-auth-first, no consume); `repo_size_bytes` from restic
+  stats; pre-run gate (≥100% refuses NEW backups Hungarian-loudly, **prune still runs** — red-proofed;
+  restore never gated; ≥80% warns); /backups usage bar. Hub: `monitor.OffsiteChecker` (fill 90/95 of
+  quota + `offsite_stale` >48h for enabled+escrowed only — red-proofed; nil-safe on old reports) +
+  **manual-only Freeze/Unfreeze lever** (readonly on the exactly-1 labelled sub-account, SSH preserved).
+  **Live:** key-auth-first proven against the real box (the deploy's own re-apply); that re-apply exposed
+  + fixed v0.109.1 (re-apply must preserve EscrowState + runtime status — it demoted the escrowed demo);
+  demo repaired (manual confirm + run: escrowed, 45 MB / 50 GB, checker healthy 0 events, usage bar
+  renders). Freeze + 100%-refusal NOT live-exercised (STOP; red-proofs cover). NEXT: Peti onboarding
+  runbook, NEW-box restore round-trip → old-box retirement.
+
 - **2026-07-09 — SLICE 3 hub-verified escrow auto-confirm SHIPPED+LIVE (hub v0.40.0 + controller v0.108.0 +
   agent v0.79.0).** Replaces the operator-trust confirm with a verified fact: ceremony hashes the sealed
   repo password (agent, `restic_pw_sha256,omitempty` on the escrow upload — contract test moved in lockstep)