docs: REPORT/README/CONTEXT for v0.94.0 config-refresh (live-validated)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HxLA1mZurFq9kt8hneFeCs

CONTEXT.md

@@ -7,7 +7,20 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-06-29 (self-health arc COMPLETE — hub-side leaf-fp re-key detection)
+Last updated: 2026-06-30 (v0.94.0 — pull-based config-refresh; hub v0.26.0 retires the inbound controls)
+
+> **2026-06-30 — v0.94.0 (deployed on 9201): pull-based config-refresh.** The hub report ACK now also
+> carries a per-customer **`config_version`** (hub v0.26.0; a stored counter bumped on every config save).
+> `OnPushResponse` → `ConfigRefresher.Reconcile` (`internal/report/config_refresh.go`): on a change vs.
+> `settings.applied_config_version`, `bootstrap.RefreshConfig` re-pulls `controller.yaml` (re-merging
+> `local_api` from bootstrap.json; overwrites controller.yaml, never settings.json) → record → graceful
+> self-restart (`api.GracefulSelfRestart`). First-run records baseline (no restart); unchanged = no-op
+> (no storm); failed pull keeps config + retries. This is the box-pulls-config replacement for the hub's
+> retired inbound "Push Config" — the hub never connects into the box. **Companion hub v0.26.0** also
+> retired Trigger Update / Pull Config / Show Diff and dropped geo-disable's inbound notify (kept the
+> hub→Cloudflare WAF removal), and fixed the stale `docker-setup.sh` setup command → host-install.
+> Live-validated on 9201: first-run baseline (applied=1, no restart) → DB bump 1→2 → re-pull+self-restart
+> (session_secret rotated, local_api preserved, RestartCount 0→1) → 4 cycles no-loop → apps stayed up.
 
 > **2026-06-29 — Self-health arc complete (agent v0.48.0 + hub v0.22.1).** The hub now proactively
 > watches every agent's served local-API **leaf fingerprint** fleet-wide: the agent reports