hub v0.60.0: offsite continuity Part B — superseded-escrow retention (data-first)

- host_escrow_superseded table + SaveHostEscrow retains a different-sha old blob before overwrite (tx); same-sha idempotent (no supersede row); returns superseded bool. ACK/restore read the current row unchanged. CountSuperseded/ListSuperseded; DeleteHost drops retained rows. - escrow_superseded audit event + operator retained-count on host detail; register offbox_repo_orphaned/reset. Red-proof TestSaveHostEscrow_RetainsSuperseded.
2026-07-17 10:47:50 +02:00
parent 1c737db4f4
commit e247dbc1be
13 changed files with 217 additions and 18 deletions
@@ -406,6 +406,9 @@ func (s *Server) hostDetailData(host *store.Host, r *http.Request) map[string]in
 		"NeedsDRMigration":  capabilitiesNeedDRMigration(capabilities),
 		"DRPresent":         drBundle != nil,
 		"EscrowPresent":     escrow != nil,
+		// v0.60.0 Part B: retained superseded escrow blobs (data-first — old passphrases stay
+		// R-recoverable). Operator-only surface.
+		"SupersededEscrowCount": func() int { n, _ := s.store.CountSupersededEscrow(host.HostID); return n }(),
 		// v0.46.0 Diagnostics: pending log pulls + received/blocked bundles (72 h TTL).
 		"LogBundles": s.hostLogBundleRows(host),
 		"CSRFToken":  s.getCSRFToken(r),