docs: offsite continuity Part B REPORT/CONTEXT; DIAGNOSE incident→fix pointer; capability map (offsite reinstall-continuity + escrow retention); ROADMAP R-25 (TOCTOU hardening) + R-26 (guided old-history recovery)

2026-07-17 10:55:17 +02:00
parent f7e3d50d5a
commit 106c3379b0
5 changed files with 83 additions and 37 deletions
@@ -3,6 +3,15 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.

+- **2026-07-17 — OFFSITE CONTINUITY Part B SHIPPED: hub v0.60.0 (LIVE).** Superseded-escrow
+  retention (data-first, Viktor's ruling). `SaveHostEscrow`'s destructive `ON CONFLICT` overwrite
+  destroyed the old passphrase's only copy (the reinstall-orphan incident); now a new
+  different-sha blob RETAINS the old into the new `host_escrow_superseded` history table (tx, before
+  overwrite); same-sha = idempotent. ACK/restore read the current row unchanged. `escrow_superseded`
+  event + operator retained-count on host detail; registered `offbox_repo_orphaned`/`offbox_repo_reset`.
+  Red-proof `TestSaveHostEscrow_RetainsSuperseded`. Pairs with controller v0.142.0 (Part A
+  orphaned-repo guard). Guided old-history recovery = R-26 (not built). See REPORT.md.
+
 - **2026-07-17 — N100 polish (F5 scripts + F6/F7 controller).** F5 (host-install v1.17.0):
  appliance mode auto-sizes the guest (RAM=clamp(host-4096,min 4096,max host-2048,ceil host-1024) +
  cores=host-1 min 2) when no explicit cap; explicit `--memory`/`--cores` win. Harness red-proof