docs: R-21 slice C — REPORT/CONTEXT + capability-map (universal-ISO chain, slice C live-verified) + ROADMAP (R-21 SHIPPED A+B+C, R-27 self-bind future)

CONTEXT.md

@@ -3,6 +3,22 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-17 — R-21 SLICE C SHIPPED: the universal secret-free ISO (hub v0.62.0 + scripts v1.19.0, LIVE).**
+  The distributed ISO carries NO customer secret. A box booted from `build-felhom-iso.sh --pairing`
+  self-registers as an UNCLAIMED APPLIANCE (`POST /api/v1/appliance/register`, keyed by SMBIOS-uuid +
+  MAC set — the DMI-verdict tiebreaker; token = sha256-stored, 256-bit), the operator BINDS it to a
+  customer on the Hosts page (new "Unclaimed appliances" section, SSH-key fingerprints, host-count
+  display-only), and the hub delivers customer-id + retrieval passphrase ONCE (one-shot poll: 404
+  no-oracle / 204 unbound / 200 deliver / 410 gone). The bootstrap is **one unit, two modes** — direct
+  (env-baked, byte-identical, regression-proven zero-appliance-calls) vs pairing (register→poll→write
+  env→fall through to direct). Red-proofs: one-shot delivery + register idempotency (both proven red).
+  Live-verified through the public ingress (register→token, 204, bogus→404). Artifact proven secret-free
+  (baked env = hub URL only; manifest `secret-bearing: no`). **Bind is operator-password-gated** → the
+  live boot→bind→day-0 composition (+ physical N100) folds into the supervised rehearsal, which now runs
+  the COMPLETE final flow in one pass (RESET demo → generic ISO → bind → day-0). SSH-key pinning =
+  stored + fingerprints displayed (host-attach on bind deferred, no clean surface). Self-bind page = R-27.
+  R-21 now SHIPPED (A+B+C). See REPORT.md.
+
 - **2026-07-17 — R-21 SLICE B SHIPPED: firmware loader option (scripts v1.18.0).** Closes N100 **F1
   (HIGH)** — cheap AMI (`AN3PLUS 0.01`-class) firmware can't USB-boot the ISO's stock GRUB
   (`relocation 0x0`). `build-felhom-iso.sh --loader shim|mkimage` (default **shim**, unchanged;