docs: hub v0.63.0 system-initiated immediacy — REPORT + CONTEXT + capability-map (immediacy row) + ROADMAP (R-28 agent fast-tick SECONDARY)

CONTEXT.md

@@ -3,6 +3,22 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-17 — SYSTEM-INITIATED IMMEDIACY wired per-plane (hub v0.63.0).** The immediate-sync arc
+  covered only OPERATOR-initiated changes; **system-initiated** desired-state mutations bumped the
+  generation silently, so a freshly onboarded box waited a full agent tick for state the hub had already
+  minted (observed live at slice-C onboarding). Decision: wire the existing, live-proven notifiers into
+  every system site on the CORRECT plane — agent-plane `poke.Notifier` at `PBSDRAutoProvision` (the exact
+  lag), `ReissuePBSDR` (which also lifts the pbsdrheal reconciler's escalation with zero reconciler
+  changes), `handlePBSDRReissue`, and the two admin api desired-state writers (new nil-safe `Poker` seam);
+  controller-plane `intent.Hub.Bump` at `reissueOnReenroll`. All fire AFTER the store write only. The
+  **pbsdrheal Restage path is deliberately poke-free** (no generation bump → the agent's 60 s pbsdr ticker
+  is its pickup path — a poke there is a verified no-op); the WG register/delete bumps stay poke-free
+  (undeliverable pre-tunnel / transport removed — the agent fast-tick SECONDARY owns the register leg).
+  The **first-hold-baseline race** is still OPEN by design (a bump landing during a fresh controller's
+  FIRST wait is recorded as baseline without firing — the ruled fix is carrying `intent_gen` in the report
+  ACK, its own future task). Unit-tested + red-proofed; live legs fire only on real system events (fold
+  into the rehearsal bind sequence). See REPORT.md + hub/CHANGELOG.md v0.63.0.
+
 - **2026-07-17 — R-21 SLICE C SHIPPED: the universal secret-free ISO (hub v0.62.0 + scripts v1.19.0, LIVE).**
   The distributed ISO carries NO customer secret. A box booted from `build-felhom-iso.sh --pairing`
   self-registers as an UNCLAIMED APPLIANCE (`POST /api/v1/appliance/register`, keyed by SMBIOS-uuid +