docs: v0.89.0 live legs PROVEN — Scenario 4 A/B train, Scenario 1 R-22 self-heal (~3s), Scenario 3 poke→tick (~31ms)

CONTEXT.md

@@ -14,10 +14,12 @@
   restart. (3) **agent-plane poke listener (Direction-2a)** — `internal/poke`: contentless UDP poke
   bound to the box WG /32 (port **51822**), leading-edge debounced, fires the hub-loop out-of-band
   trigger for an immediate desired-state cycle; enabled with `wg_tunnel.enabled`; first slice of
-  R-13. Red-proofs for all three (run-fail-revert). **OPEN: operator vouch of 0.89.0 in the Day-0
+  R-13. Red-proofs for all three (run-fail-revert). **ALL THREE LIVE LEGS PROVEN on the demo
-  manifest + MinAgent floor raise → the floor-driven train updates the demo (still 0.88.0) → THEN
+  (2026-07-17), demo now LIVE on 0.89.0:** Scenario 4 floor-driven A/B train 0.88→0.89 (operator
-  the Scenario 1 (R-22 self-heal, rollback re-grant recorded) + Scenario 3 (poke save-to-tick)
+  signed+enqueued the `agent_update` op — the vouch+floor alone does NOT trigger it; committed, no
-  live legs run.** The ep0 poke leg is already validated live (hub REPORT). Details: REPORT.md.
+  rollback); Scenario 1 R-22 self-heal (marker aside + ACLs revoked → `pre-check 403 … self-granting
+  (R-22)` → `converged state=adopted` in ~3 s, ACLs restored, offsite active); Scenario 3 poke→tick
+  ~31 ms ep0→box + immediate report cycle (save→tick ≈ ~0.45 s). Details: REPORT.md.
 
 - **v0.88.0** (2026-07-13 eve) — **controller-driven escrow ceremony (agent half), LIVE on demo
   host + drill VM (63/63 capabilities both).** `--output=json` machine mode (text mode

REPORT.md

@@ -56,20 +56,30 @@
 - (Hub side, cross-repo) the MinAgent-floor save does not itself bump per-host desired generation —
   noted in the hub REPORT.
 
-## Live validation (Phase 5 — CC-ownable done; remainder operator-gated)
+## Live validation (Phase 5 — ALL THREE LEGS PROVEN LIVE on the demo, 2026-07-17)
-- **Built + published** agent 0.89.0 to Gitea (sha256 `3969fd91…2609fb1a`, round-trip verified) — the
+- **Built + published** agent 0.89.0 to Gitea (sha256 `3969fd91…2609fb1a`, round-trip verified).
-  binary the floor-driven train (Scenario 4) fetches.
+- **Scenario 4 — floor-driven A/B train (0.88→0.89), PROVEN LIVE.** Operator vouched 0.89.0 + raised
-- **Scenario 4 / Scenario 1 live leg / Scenario 3 latency** require the demo agent to self-update to
+  MinAgent to 0.89.0, then signed+enqueued the `agent_update` op (the self-update trigger — a per-box
-  0.89.0 via the floor train, which needs the operator-password-gated Day-0 manifest vouch + floor
+  operator-signed op; the vouch+floor alone does NOT queue it; CC cannot sign, per DRILL-GL6). The box
-  raise (CC cannot drive that UI). Demo agent is still **0.88.0**. Direct binary replace is forbidden
+  fetched it on its next report and self-updated: `gate decision class=agent_update allowed=true
-  by the spec (the floor train IS the validation), so these legs are the operator follow-up.
+  reason=signed key_id=felhom-op-1` → download (sha `3969fd91…` verified) → `felhom-selfupdate-guarded
-- **Scenario 1 rollback recorded FIRST (as required):** current ACLs on the demo's
+  apply` (root A/B flip) → new daemon `version=0.89.0` → 60 s dwell → `selfupdate: update committed`
-  `/storage/felhom-offsite` are `FelhomAgentStore` for `felhom-agent@pve` (user) and
+  (no rollback). Poke listener bound clean: `poke: listening … addr=10.77.0.2:51822`; 63/63 caps.
-  `felhom-agent@pve!agent` (token), propagate=1. Re-grant rollback =
+- **Scenario 1 — R-22 self-heal, PROVEN LIVE.** Rollback re-grant recorded FIRST (`pveum acl modify
-  `pveum acl modify /storage/felhom-offsite --users felhom-agent@pve --roles FelhomAgentStore` +
+  /storage/felhom-offsite --users felhom-agent@pve --roles FelhomAgentStore` + the `--tokens
-  the `--tokens 'felhom-agent@pve!agent'` twin; the REVOKE that arms the deadlock is the same two with
+  'felhom-agent@pve!agent'` twin — delete syntax is `pveum acl delete`). **Faithful F4 reproduction:**
-  `--delete`. NOT run on 0.88.0 (pre-fix → no self-heal, would break the demo's pbsdr). The ep0 poke
+  moved the pbsdr marker aside (the reinstall's fresh-state — revoke-alone is a no-op because the
-  leg IS validated live — see the hub REPORT.
+  `applied` marker short-circuits Apply before any storage read; an important reproduction finding) +
+  `pveum acl delete` both felhom-offsite ACLs. Next reconcile tick: `08:24:16 pbsdr: pre-check 403 …
+  self-granting via the root wrapper … (R-22) storage_id=felhom-offsite` → `08:24:19 pbsdr: converged
+  state=adopted` — **~3 s, no operator action**. Verified: ACLs self-restored (user+token), marker
+  rewritten (adopted), `pvesm status felhom-offsite` = **active**. Pre-fix = permanent 403→abort loop.
+- **Scenario 3 — poke → tick latency, MEASURED LIVE.** ep0 send `06:28:55.765` UTC → box
+  `08:28:55.796` `poke received → triggering an immediate desired-state cycle from=10.77.0.1` → same
+  instant `out-of-band report triggered (watchdog/poke)`. **~31 ms** ep0→box over the tunnel (spike
+  ~29 ms), sub-ms to the report cycle; WG-confined (from `10.77.0.1`, to the `10.77.0.2`-bound socket).
+  The hub-save→poke fire is separately live-proven (hub REPORT: real manifest save → `sync-poke
+  delivered to 10.77.0.2`); full save→tick ≈ ~0.45 s (SSH-dominated), well under the ≤2–3 s target.
 
 ## R-13
 Item 3 is the FIRST concrete slice of the OOB/mutual-repair arc (the listener + trigger only). R-13