validation record: offsite provisioning live e2e PASS (2026-07-09) + CONTEXT/REPORT

Full hub->Hetzner->controller loop validated on demo-felhom against the new
dedicated-project pool box; 2 snapshots on the new box, key-only. F1/F3 fixed
mid-run (hub v0.38.1, controller v0.106.1); F2/F4/F5/F6 recorded open.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,23 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-09 — offsite provisioning VALIDATED LIVE end-to-end (hub v0.38.1 + controller v0.106.1) — PASS.**
+  Full loop through the real pipeline on `demo-felhom` against the new dedicated-project pool box (611714 /
+  `u629488`, project 15282031): UI save → sub-account 269008 provisioned → descriptor v6 + one-time password →
+  controller config-refresh (≤15 min) → apply-bridge (verify-pin → consume-once → pinned `ssh-copy-id` →
+  `EscrowState=pending`) → run-gate refusal proven → escrow confirm (Option A: the repo password was already
+  escrowed — `WriteOffboxSecrets` preserves it) → first run: **restic repo + 2 snapshots on the new box,
+  key-only**. Two live bugs found+fixed mid-run: **F1** hub v0.38.1 (`applyOffsite` on `context.WithoutCancel` —
+  a re-click canceled the provision between create and password-store, stranding the sub-account) and **F3**
+  controller v0.106.1 (`ssh-copy-id -s` needs `~/.ssh` to exist in the container — died AFTER consuming the
+  password). OPEN: F2 (fresh sub-account DNS lags → first-save scan 502s; retry-with-backoff), F4 (hub has no
+  password-reset path — recovery today is delete-subaccount + re-save), F5 (no save spinner → re-click bait).
+  Phase-0 wiring: `manifests/hub.yaml` now injects `HETZNER_TOKEN`/`HETZNER_POOL_BOX_ID` from
+  Secret/storagebox; scoped-token check = list boxes with it (must see ONLY 611714). Old-box offsite kept as
+  frozen archive until a NEW-box restore round-trip. Record:
+  `documentation/audits/VALIDATION-offsite-provisioning-e2e-2026-07-09.md`. NEXT: SLICE 3 (auto-confirm),
+  SLICE 4 (soft-quota), F2/F4/F5, Peti onboarding runbook.
+
 - **2026-07-09 — offsite provisioning SLICE 2 (hub v0.38.0 + controller v0.106.0).** The controller apply-bridge:
   on startup it reconciles the hub-served `offsite:` descriptor into a key-only offbox target
   (`controller/internal/offsiteapply.Bridge`) — **verify-pin the box host key against the hub-captured