docs: v0.89.0 REPORT + CONTEXT (self-grant R-22, escrow live-reload, poke listener; live legs operator-gated)

CONTEXT.md

@@ -5,6 +5,20 @@
 
 ## Current
 
+- **v0.89.0** (2026-07-16) — **agent train: three bundled agent-plane items; built + published to
+  Gitea (sha256 `3969fd91…`); paired with hub 0.59.0 (LIVE).** (1) **pbsdr self-grant (R-22)** —
+  closes the F4 self-deadlock: a 403 on the token-auth `StorageEntry` pre-check now self-grants via
+  the root wrapper + re-reads instead of aborting before the grant (the demo's `felhom-offsite`
+  case). (2) **escrow config live-reload** — `/escrow/preflight`'s `pbs_storage_id` row now reads
+  the live agent.json (late-bound `CurrentPBSStorageID`) so a pbsdr-seeded id flips green with no
+  restart. (3) **agent-plane poke listener (Direction-2a)** — `internal/poke`: contentless UDP poke
+  bound to the box WG /32 (port **51822**), leading-edge debounced, fires the hub-loop out-of-band
+  trigger for an immediate desired-state cycle; enabled with `wg_tunnel.enabled`; first slice of
+  R-13. Red-proofs for all three (run-fail-revert). **OPEN: operator vouch of 0.89.0 in the Day-0
+  manifest + MinAgent floor raise → the floor-driven train updates the demo (still 0.88.0) → THEN
+  the Scenario 1 (R-22 self-heal, rollback re-grant recorded) + Scenario 3 (poke save-to-tick)
+  live legs run.** The ep0 poke leg is already validated live (hub REPORT). Details: REPORT.md.
+
 - **v0.88.0** (2026-07-13 eve) — **controller-driven escrow ceremony (agent half), LIVE on demo
   host + drill VM (63/63 capabilities both).** `--output=json` machine mode (text mode
   byte-identical; extraction into `escrowCeremony()`); the ONE fixed argv