docs: hub v0.53.0 closing bundle - CHANGELOG + CONTEXT (both operator rulings verbatim) + take-two F-14 disposition (SHIPPED, gated on escrow-acked deletion provenance)

CONTEXT.md

@@ -3,6 +3,28 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-13 — CLOSING BUNDLE SHIPPED: hub v0.53.0** — the last engineering items on the
+  pre-tester board: F-14 gated auto-Reissue (deletion provenance `host_deletions` in-tx +
+  `token_exists` gate → the EXISTING Reissue op + `pbsdr_auto_reissue` audit event; no record /
+  un-acked → refusal byte-unchanged), dead-host roll-up honesty (customer status = worst of
+  controller-derived + per-host `hostStatus` on dashboard//configs/detail, cause chip names the
+  host; the Peti 23h-masking shape is the pinned fixture), operator bearer OUT OF GIT
+  (`Secret/report-api` secretKeyRef non-optional + `REPORT_API_KEY` env override +
+  `scripts/manifest_bearer_gate.py`; VALUE ROTATION = supervised step in
+  documentation/runbooks/secrets.md — the git-history copy is dead only after it).
+  **Two operator rulings (2026-07-13), recorded verbatim — future sessions must treat these as
+  settled:**
+  1. ***F-14:** auto-Reissue of offsite credentials is permitted ONLY when the hub's own deletion
+     record shows the tenancy's owning host was removed through the escrow-ack flow — acknowledged
+     destruction is not silent re-keying. No record → manual Re-issue stays the only path.*
+  2. ***Roll-up:** a customer's status may never look better than its worst expected host. Single
+     staleness definition (`hostStatusOf`) — no second threshold anywhere.*
+  Gate additions: `python scripts/manifest_bearer_gate.py` after ANY manifests/ change (64-hex
+  bearer shapes; felhom.secret.yaml carve-out = visible KNOWN-BACKLOG line). GOTCHA: the repo
+  .gitignore `*secret*` pattern silently un-tracks any "secret"-named script — hence the
+  "bearer" name. The controller repo's controller.yaml.example carried the REAL bearer literal —
+  scrubbed (felhom-controller 51c871a).
+
 - **2026-07-13 — POLISH BATCH SHIPPED: hub v0.52.0 (+ controller v0.123.0)** — take-two F-15
   CLOSED (reset-request response carries the rotated code hash — ACK shape/guarantee — emailed
   codes work immediately; live 1 s apply + first-try accept on Viktor's exact failure path) and