docs: SLICE 4 — hub README, REPORT, CONTEXT (offsite arc build-complete)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/README.md

@@ -94,7 +94,14 @@ the explicit recovery for a consumed-password dead-end — resets ONLY the resou
 stores it on `host_escrow` (NULL on legacy rows) and serves
 `escrow:{identity_blob_present, restic_pw_sha256, created_at}` in the **report ACK**; the controller
 auto-confirms its pending offbox escrow ONLY on a hash match with its current repo password (blob-presence
-alone never confirms). SLICE 4 (soft-quota) follows.
+alone never confirms).
+**SLICE 4 (v0.41.0) — offsite health monitoring + freeze lever:** `monitor.OffsiteChecker` reads the
+controller report's `offsite` object — fill alerts at 90/95% of `quota_gb` (quota 0 = dedicated, silent)
+and an `offsite_stale` warning when an enabled+escrowed target has no run in >48h (the silently-stuck
+detector; run FAILURES are `backup_failed`'s job; pending/disabled never alert). Nil-safe on pre-v0.109
+reports. The operator **Freeze/Unfreeze offsite** buttons (shared model only, next to Re-issue) flip ONLY
+`readonly` on the exactly-1 labelled sub-account — MANUAL only, never automatic (freezing also blocks
+prune, the customer's only way down from over-quota).
 
 ### Infrastructure Backup — RETIRED (Phase-1, 2026-06-16, hub v0.12.0)