docs: REPORT + CONTEXT for hub v0.46.0 (deployed, Synced/Healthy)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,19 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-11 — OBSERVABILITY PASS (hub v0.46.0 LIVE Synced/Healthy; agent v0.83.0 + controller
+  v0.116.1 on demo).** Remote pull-only log access to both box components' always-DEBUG capture
+  rings. Hub: `log_bundle_requests`/`log_bundles` store (gzip, newest-3, **72 h TTL** on the 60 s
+  sweep), the **secret gate fail-closed** before storing (`blocked: possible secret`; `[REDACTED]`/
+  checksums pass), report-ACK `controller_log_requested` + heartbeat-envelope `log_tail_requested`
+  channels (consume-once; pre-0.83 agents stay visibly pending), host-detail Diagnostics section
+  (Request controller/agent logs + View/Download; the hosts read-only invariant amended: these two
+  forms are the only actions). Conventions codified:
+  `documentation/runbooks/logging-conventions.md` + CLAUDE.md one-liners in all three repos.
+  **OPEN: operator clicks both request buttons on hub.felhom.eu/hosts/<demo> to close the live
+  round-trip** (UI password-gated; the flow is fully API-test-proven). Hub bearer key rotation
+  still DUE (pre-existing).
+
 - **2026-07-11 — PUBLISH-TRAIN RULES CODIFIED** (`documentation/runbooks/publish-train-rules.md`):
   1. manifest before floor; 2. the manifest screen carries the LIVE DB floor
   (`hub_settings.min_controller_version` overrides env, acts immediately) — save the floor field