hub v0.127.0: off-site key registrar (box never gets the storage password), password sealed at rest, daily key check, clean-up window (shipped off) — decisions 68-69, R-820/R-821/R-822

Part A evidence (migration spike, sftp-written repo through the pinned rclone key) and the hub
red-proofs under documentation/audits/offsite-lock-build-2026-10-03/. Manifest bump follows after
the image is built and Secret/offsite-secret-key exists.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/notify/dispatcher.go

@@ -668,6 +668,16 @@ var operatorOnlyEvents = map[string]bool{
 	// the snapshots still hold the data and telling a customer "your backups were deleted"
 	// would be wrong on the usual reading.
 	"offsite_snapshots_dropped": true,
+	// v0.127.0 (decisions 68–69, R-820/R-822). The off-site key registrar, its daily check and the
+	// clean-up window: custody facts about key lines and fingerprints — the household can take no
+	// action on any of them. Listed in the SAME commit that mints them.
+	"offsite_key_installed":       true,
+	"offsite_key_unlocked":        true,
+	"offsite_key_audit_failed":    true,
+	"offsite_repo_moved_aside":    true,
+	"offsite_window_drop":         true,
+	"offsite_window_failed":       true,
+	"offsite_prune_guard_refused": true,
 	// R-197 (v0.93.0). "The sealed offsite repository key changed" is a custody fact about escrow
 	// blobs. A customer can take no action on it — the remedy is the operator's inspection of the
 	// off-site tier — and the text is operator-grade English naming host ids and retained-blob