hub v0.41.0: OffsiteChecker (fill 90/95 + staleness >48h) + operator freeze lever (SLICE 4)

Sibling checker over the controller report's offsite object: quota-fill
warn/crit + the silently-stuck staleness detector (escrowed-only,
red-proofed; nil-safe on pre-v0.109 reports; same-second tie-guard).
SetOffsiteFrozen flips ONLY readonly on the exactly-1 labelled sub-account
(SSH preserved); Freeze/Unfreeze buttons — manual only, never automatic.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Felhom Hub — Changelog
 
+## v0.41.0 — SLICE 4: OffsiteChecker (fill + staleness) + operator freeze lever (2026-07-09)
+
+The last build item of the offsite arc (pairs with controller v0.109.0's soft-quota gate + report object).
+
+- **`internal/monitor.OffsiteChecker`** — a SIBLING of StorageFillChecker (same born/persistent,
+  escalation-only, recovery-re-arm shape; NOT bolted onto the disk checkers), reading the controller
+  report's new `offsite` object. Two signals: **fill** (`repo_size_bytes` vs `quota_gb` at warn 90 / crit
+  95 — quota 0 = dedicated, never alerts) and **staleness** (`offsite_stale`, warning): enabled+**escrowed**
+  but no run in >48h (or never) — the silently-STUCK detector; a recently-FAILING offsite is not stale
+  (`backup_failed` owns that), and pending/disabled targets never alert (normal onboarding — **companion
+  red-proof:** dropped the escrowed-only filter → the pending customer alerted → test FAILED). Nil-safe on
+  reports without the object (pre-v0.109 controllers). Tie-guard: duplicate same-second latest reports are
+  processed once per sweep. Same 60s sweep as the other checkers.
+- **Freeze lever (operator, MANUAL only):** `Provisioner.SetOffsiteFrozen` — flips ONLY `readonly` on the
+  exactly-1 labelled sub-account via `UpdateSubaccountAccess` (SSH stays on; ambiguity refuses — tested),
+  wired to confirm-gated **Freeze/Unfreeze offsite** buttons next to Re-issue (shared model only; dedicated
+  is Hetzner-enforced). NEVER automatic — freezing also blocks prune, the customer's only way DOWN from
+  over-quota. Route `POST /configs/{id}/offsite-freeze` (`unfreeze=1` reverses); action logged, value-free.
+
 ## v0.40.0 — SLICE 3: store the escrow password-hash + serve escrow status in the report ACK (2026-07-09)
 
 The hub-verified escrow auto-confirm chain, hub third (pairs with agent v0.79.0 + controller v0.108.0).