docs: Direction-2a poke + F4/R-22 PROVEN-LIVE (real save→sync-poke delivered; ~31ms poke→tick; self-grant self-heal ~3s) — capability map + ROADMAP + REPORT/CONTEXT

REPORT.md

@@ -49,7 +49,13 @@ Design contract: `documentation/audits/SPIKE-immediate-sync-transport-2026-07-16
   `8.8.8.8` AND `rm -rf /` as the SSH command → `refused non-WG target` (the forced command NEVER
   executes client input, only reads it as an IP candidate). This proves the full hub→ep0→box datagram
   path and the credential-theft blast radius (≤ "make a registered box tick").
-- **Not yet fired end-to-end from an operator save** (the config/floor save UIs are password-gated; CC
-  can't log in) and the box-side tick awaits the demo agent reaching v0.89.0 via the floor train
-  (operator vouch) — see the felhom-agent REPORT. Scenario 3's measured save-to-tick latency is the
-  operator follow-up.
+- **Fired end-to-end from a REAL operator save (2026-07-17):** the operator's Day-0 manifest save
+  (`Artifact manifest set: agent=0.89.0 … min_agent=0.89.0`) immediately logged `poke: sync-poke
+  delivered to 10.77.0.2 via 167.233.158.164:22` + `fleet nudge sent to 1/2 WG peers` — the
+  `handleSetArtifacts`→`PokeAllHosts()` wiring proven live to the box (the 2nd peer is offline). The
+  MinAgent-floor coupling also fired: `managed floor HELD for demo-felhom: agent 0.88.0 < MinAgent 0.89.0`.
+- **Scenario 3 box-side latency measured** once the demo reached v0.89.0: a poke ep0→box delivered in
+  **~31 ms** and fired the immediate desired-state cycle (see the felhom-agent REPORT). Full save→tick
+  ≈ ~0.45 s (SSH-dominated), well under the ≤2–3 s target. All three live legs (Scenario 4 A/B train,
+  Scenario 1 R-22 self-heal, Scenario 3 latency) are proven-live; the capability-map poke + F4 rows are
+  upgraded to PROVEN-LIVE.