validation: new-box restore round-trip PASS (9/9 sha-identical) + old-archive retirement decision

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,14 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-10 — new-box restore round-trip VALIDATED + old-box archive RETIRED.** Record:
+  `documentation/audits/VALIDATION-newbox-restore-2026-07-10.md`. Both toggled apps restored from the
+  production pool box via the real endpoint — **9/9 sha256-identical** (immich 44MB db-dump exact,
+  `d78466fcbf…4526b`, agreeing with the campaign's independent round). ~10s/app. **Viktor's decision:
+  RETIRE the old archive** — he deletes `u629193-sub1` in the old project's console (the PBS-storage-1 box
+  itself stays for dev). C2 fixed same day as controller v0.110.0 (crash-lock self-heal, live-proven).
+  Offsite arc: build-complete + restore-proven both directions; remaining = the Peti onboarding runbook.
+
 - **2026-07-10 — offsite arc overnight soak (unattended) — PASS + 1 HIGH finding.** Record:
   `documentation/audits/CAMPAIGN-offsite-overnight-2026-07-10.md`. F4 re-issue proved LIVE (reset invalidates
   the old password); restore round-trip 9/9 byte-identical new-box↔USB (immich db-dump exact → old-box