hub v0.63.0 — system-initiated immediacy: wire poke/bump at every mutation site that lacked one

The immediate-sync arc covered only operator-initiated desired-state changes;
system-initiated mutations bumped the generation silently, so a freshly onboarded
box waited a full agent tick for state the hub had already minted (observed live at
slice-C onboarding). Wire the existing, live-proven notifiers into every system site
on the correct plane — call-site wiring only, no new mechanism.

Agent plane (poke.Notifier):
- web/pbsdr.go: PBSDRAutoProvision (the observed lag), ReissuePBSDR (also lifts the
  pbsdrheal reconciler escalation, zero reconciler changes), handlePBSDRReissue —
  each pokes AFTER the successful SetHostDesired, never on a blocked/error path.
- api: new nil-safe Poker seam (PokeHost/PokeAllHosts + SetPoker); handleAdminSetDesiredState
  pokes the target host; handleAdminSetOperatorPeer fires PokeAllHosts only when the
  fleet generation bump succeeded (fire-after-commit).
- main.go: one poke.Notifier now feeds both planes (SetPoke + SetPoker).

Controller plane (intent.Hub.Bump):
- api/reissueOnReenroll: one nil-guarded bump so a long-polling controller wakes in
  seconds instead of on the 15-min cycle.

Deliberate non-sites (unchanged): WG register (undeliverable pre-tunnel — the agent
fast-tick SECONDARY owns it), WG delete (transport removed), pbsdrheal Restage (no
generation bump → the 60s ticker is the pickup path). internal/pbsdrheal byte-unchanged.

Tests: 10 non-hollow tests (web async channel-synchronized fake sender; api synchronous
fake Poker) with explicit zero-count negatives; representative red-proofs per group
(A/B/C/D) run-fail-restored. Green: go build/vet/test all pass.

hub/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Felhom Hub — Changelog
 
+## v0.63.0 — system-initiated immediacy: wire the proven poke/bump notifiers into every mutation site that lacked one (2026-07-17)
+
+The immediate-sync arc (Dir-1 trigger, Dir-2b wait channel, Dir-2a agent poke) covered only
+**operator-initiated** desired-state changes. **System-initiated** mutations still bumped the
+generation silently, so a freshly onboarded box waited a full agent tick (≤15 min) for state the hub
+had already minted — observed live during slice-C onboarding. This wires the existing, live-proven
+notifiers (`poke.Notifier` for the agent plane, `intent.Hub.Bump` for the controller plane) into
+every system-initiated site that lacked one. No new mechanism — call-site wiring only.
+
+- **Agent-plane pokes (`internal/web/pbsdr.go`):** `PBSDRAutoProvision` (the exact observed lag — the
+  WG-registration hands-free provision) now pokes on success; `ReissuePBSDR` (the shared core, which
+  also gives the **pbsdrheal reconciler's escalation** its immediacy with zero reconciler changes) and
+  the operator button `handlePBSDRReissue` poke after their descriptor bump. All fire ONLY after the
+  successful `SetHostDesired`, never on a blocked/error path.
+- **Agent-plane Poker seam (`internal/api/handler.go`, `internal/api/wg.go`):** a new nil-safe `Poker`
+  interface (`PokeHost`/`PokeAllHosts`, satisfied by `*poke.Notifier`) + `SetPoker`. `handleAdminSetDesiredState`
+  pokes the target host after a successful admin desired-state write; `handleAdminSetOperatorPeer` fires
+  a fleet `PokeAllHosts` — but only when `BumpAllHostGenerations` succeeded (fire-after-commit).
+- **Controller-plane bump (`internal/api/handler.go`):** `reissueOnReenroll` (the clean-slate F2 claim +
+  F3 offsite re-issue) now `intentHub.Bump`s the customer so a long-polling controller wakes in seconds
+  instead of on the 15-min cycle. Nil-guarded; one unconditional bump (coalesced, over-bump harmless).
+- **main.go:** one `poke.Notifier` instance now feeds BOTH planes' system sites — `webServer.SetPoke(n)`
+  **and** `apiHandler.SetPoker(n)`; startup log: "web + api admin seams armed".
+- **Deliberate non-sites (unchanged, documented in REPORT audit table):** WG peer *register* (box tunnel
+  doesn't exist pre-fetch — a poke is undeliverable; the agent fast-tick SECONDARY owns this leg), WG peer
+  *delete* (the mutation removes the transport), and the **pbsdrheal Restage** path (no generation bump →
+  the agent's 60 s pbsdr ticker is the pickup path; a poke there is a verified no-op). `internal/pbsdrheal/`
+  is byte-unchanged.
+- **Tests + red-proofs (run-fail-revert):** 10 new non-hollow tests. Web (async, channel-synchronized
+  fake sender): auto-provision pokes the resolved WG /32, blocked-precondition pokes nothing, reissue-core
+  + operator-button poke, a failed reissue pokes nothing. API (synchronous fake Poker): admin-set pokes
+  the target host only (0 on invalid-JSON), operator-peer fires one fleet poke, nil-seam no-panic; re-enroll
+  advances the intent generation, nil-hub no-panic. Red-proofs demonstrated one representative removal per
+  group (A/B web pokes, C admin poke, D re-enroll bump) — each FAILED red, then restored. Green:
+  `go build/vet/test` all pass.
+
 ## v0.62.0 — R-21 slice C: the universal ISO — unclaimed-appliance registration + operator bind + one-shot delivery (2026-07-17)
 
 The hub half of the universal, **secret-free** bare-metal ISO. A box booted from the generic ISO