docs: SLICE 3 — hub README, REPORT, CONTEXT

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,18 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-09 — SLICE 3 hub-verified escrow auto-confirm SHIPPED+LIVE (hub v0.40.0 + controller v0.108.0 +
+  agent v0.79.0).** Replaces the operator-trust confirm with a verified fact: ceremony hashes the sealed
+  repo password (agent, `restic_pw_sha256,omitempty` on the escrow upload — contract test moved in lockstep)
+  → hub stores it (additive `host_escrow` migration, NULL on legacy rows) + serves
+  `escrow:{identity_blob_present,restic_pw_sha256,created_at}` in the report ACK → controller
+  (`report.EscrowAutoConfirmer`) flips pending→escrowed ONLY on hash match with its local repo password.
+  **Red-proofed core: blob-presence alone never confirms** (stale blob = false custody claim); mismatch
+  warns once per hash naming the ceremony; never un-confirms; flip wipes the agent-staged secret. Hashers
+  pinned by the same cross-repo vector. Manual confirm = deprecated fallback (legacy blobs — demo included,
+  hash-NULL verified live; the escrowed demo produced zero confirm activity = Scenario E live). Full happy
+  chain proves out at the next real enable (Peti). NEXT: SLICE 4 soft-quota, Peti runbook.
+
 - **2026-07-09 — offsite hardening bundle SHIPPED+LIVE (hub v0.39.0 + controller v0.107.0 + agent v0.78.0).**
   The e2e's sharp edges closed before slices 3–4: **F4** "Re-issue offsite credentials" (explicit operator
   recovery for consumed-password dead-ends — exactly-1 label scope, fresh one-time secret, ConfigVersion