hub v0.60.0: offsite continuity Part B — superseded-escrow retention (data-first)

- host_escrow_superseded table + SaveHostEscrow retains a different-sha old blob before overwrite (tx); same-sha idempotent (no supersede row); returns superseded bool. ACK/restore read the current row unchanged. CountSuperseded/ListSuperseded; DeleteHost drops retained rows.
- escrow_superseded audit event + operator retained-count on host detail; register offbox_repo_orphaned/reset. Red-proof TestSaveHostEscrow_RetainsSuperseded.

hub/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Felhom Hub — Changelog
 
+## v0.60.0 — offsite continuity Part B: superseded-escrow retention (data-first) (2026-07-17)
+
+Closes the data-loss half of the reinstall-orphaned-repo incident: `SaveHostEscrow`'s destructive
+`ON CONFLICT` overwrite meant a new escrow blob DESTROYED the old passphrase's only copy — so 18
+snapshots keyed under the old password became unrecoverable. Viktor's ruling (data protection first):
+**retain superseded blobs** so the old passphrase stays customer-R-recoverable. Pairs with controller
+v0.142.0 (Part A orphaned-repo guard). Green: `go build ./... && go vet ./... && go test ./...`.
+
+- **`host_escrow_superseded` (new table) + `SaveHostEscrow` rewrite.** On upload, if the current row
+  seals a DIFFERENT `restic_pw_sha256`, the old row is COPIED into the history table (in one tx)
+  BEFORE the current row is overwritten; a same-sha re-upload (idempotent re-ceremony) refreshes the
+  current row and creates NO supersede row. `SaveHostEscrow` now returns `superseded bool`. Retain
+  ALL (no pruning — the blobs are tiny + R-encrypted, custody unchanged); the hub still never
+  decrypts. **ACK/restore-serving read the CURRENT row (`GetHostEscrow`) — unchanged.** New
+  `CountSupersededEscrow` / `ListSupersededEscrow` (the latter seeds the future R-26 recovery flow).
+  `DeleteHost(deleteEscrow=true)` also drops the retained rows.
+- **Surfaces.** Upload handler emits the hub-internal `escrow_superseded` audit event + logs the
+  retained count; the operator host-detail DR/Backup panel shows "N superseded escrow blob(s)
+  retained". Registered `offbox_repo_orphaned` / `offbox_repo_reset` (controller v0.142.0 pushes) in
+  `allowedEventTypes` + `customerMessages`.
+- Red-proof `TestSaveHostEscrow_RetainsSuperseded` (pre-fix destructive overwrite → old blob gone →
+  FAIL; fixed → retained + retrievable; same-sha idempotent).
+- **Deploy:** bump `manifests/hub.yaml` image tag to `0.60.0` and sync.
+
 ## v0.59.0 — Direction-2a: agent-plane immediate-sync poke sender + ep0 felhom-poke surface (2026-07-16)
 
 Implements the AGENT-plane half of `documentation/audits/SPIKE-immediate-sync-transport-2026-07-16.md`