docs: hub v0.64.0 offsite pool-box aggregate (R-5) — REPORT + CONTEXT + capability-map (IMPLEMENTED, data pipeline PROVEN-LIVE) + ROADMAP (R-5 SHIPPED)

CONTEXT.md

@@ -3,6 +3,22 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-17 — OFFSITE POOL-BOX AGGREGATE shipped (hub v0.64.0, R-5).** The operator now sees the
+  shared pool box's real state on the hub: total fill vs capacity, Σ(shared soft quotas)/capacity (the
+  oversubscription ratio), per-customer usage/quota bars, and a box-level operator alert (fill 80/90%,
+  oversub 2.0×). New `monitor.OffsiteBoxChecker` (OffsiteChecker-sibling): fetch-throttled to one Hetzner
+  GET / 15 min, cached `BoxSnapshot`, escalation-only + recovery re-arm; two INDEPENDENT signals (fill +
+  oversub). Capacity = `storage_box_type.size`, usage = `stats.size` (Phase-0-pinned, bytes); Σ(quota)
+  from the ConfigJSON `Descriptor` (`offsite.ReadDescriptor`, new — NEVER the report echo; dedicated +
+  disabled excluded); per-customer USAGE from the report echo. Events scope `"pool-box"` → operator channel
+  only, no SaveEvent. Web: Offsite-tab panel + compact dashboard tile, reading the cached snapshot only
+  (never fetches). **PROVEN-LIVE (data pipeline):** the in-cluster checker computed the real box —
+  `0.2% full (2.6 GB of 1.00 TB), Σ shared quota 150 GB, oversub 0.15x`. **DECISION: thresholds
+  (80/90/2.0×) are Claude's encoding — Viktor's ruling pending; named `Alerting.OffsiteBox*` keys = the
+  one-line flip.** **OPEN:** the UI render is unit-verified only (hub UI password-gated → CC can't
+  screenshot); the alert emails are unit + red-proof verified but NOT fired live (real pool nominal — a
+  live-fire would email Viktor; offered on demand). READ-ONLY against Hetzner throughout. See REPORT.md.
+
 - **2026-07-17 — SYSTEM-INITIATED IMMEDIACY wired per-plane (hub v0.63.0).** The immediate-sync arc
   covered only OPERATOR-initiated changes; **system-initiated** desired-state mutations bumped the
   generation silently, so a freshly onboarded box waited a full agent tick for state the hub had already