F10 offsite leg resolved on demo-hp: day-0 update-vs-bridge race diagnosed, designed-path repair + tier round-trip proven; R-70/R-71 minted

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NKSN3gSg4TKVBBqkwW2djR

CONTEXT.md

@@ -3,6 +3,20 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-23 — F10 offsite leg RESOLVED on demo-hp (diagnostic + designed-path repair + tier
+  proof; no code changed).** The hub said "Provisioned" while the box said „Még nincs beállítva" —
+  root cause: the day-0 managed update (0.153.0→0.156.0, 07-21 16:28) killed the offsite
+  apply-bridge ~35 s after it consumed the one-time password, before key-install/persist; the box
+  then hit the consume-404 dead-end at every start, silently, for 2 days. Repair = operator
+  **Re-issue** click (converged in 8 s), escrow ceremony via the real wizard (auto-confirm 3 s),
+  then the full proof: paperless-ngx toggled into scope, first offsite run (repo initialized on
+  sub3, 79.8 MB, snapshots=1), probe deleted → `mode=full` restore (snapshot `2bf7f2e1`) → place
+  merged 1 file missing-only → **md5-identical**. Minted **R-70** (last-mile invisible on both
+  surfaces; hub never reads `one_time_secrets.consumed_at`) and **R-71 [P1]** (the race recurs on
+  every fresh onboarding whose ISO floor lags the managed floor). Record:
+  `documentation/audits/DIAG-f10-demo-hp-offsite-2026-07-23.md`. F10's PBS-DR half stays open
+  (F13 + ceremony R-moment).
+
 - **2026-07-22 — hub v0.71.0: the notification train (audit F11+F12+F14-light).** Four rulings now
   standing: **(1) recovery pairing** — `*_recovered` notifies the operator always and the customer
   **iff the customer was mailed the paired stale/down** (evidence = `notification_log` customer-