diff --git a/scripts/CHANGELOG.md b/scripts/CHANGELOG.md
index d445462..aeddeb5 100644
--- a/scripts/CHANGELOG.md
+++ b/scripts/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Felhom scripts — Changelog
 
+## felhom-poke.sh v1.0.0 — NEW (agent-plane immediate-sync, Direction-2a, 2026-07-16)
+
+The offsite endpoint's THIRD hub forced-command surface (`documentation/runbooks/offsite-endpoint.md`
+§11): a NON-root (`felhom-peersync`, no sudoers grant — a datagram needs no privilege) forced command
+that reads a box's WireGuard /32 from `$SSH_ORIGINAL_COMMAND`, validates it to `10.77.0.0/24`, and
+sends ONE contentless (empty) UDP datagram from wg0 to `<ip>:51822`. That is the last hop of the
+hub→ep0→box "sync now" poke; the box's felhom-agent (v0.89.0) poke listener then runs an immediate
+desired-state cycle. Contentless + confined (the WG kernel independently refuses non-peer /32s —
+`SPIKE-immediate-sync-transport-2026-07-16` P1 EKEYREJECTED). Port **51822** is a shared cross-repo
+constant (felhom-agent `internal/poke.Port`, `hub/internal/poke`, this script's `POKE_PORT`). Hub
+client: `hub/internal/poke`. Installed + live-validated on ep0 2026-07-16 (`poke-fired`; non-WG target
+and arbitrary SSH command both `refused non-WG target` — the forced command never executes client
+input). Peersync/tenantsync surfaces untouched.
+
 ## felhom bare-metal ISO pipeline v1.16.0 — NEW (R-21 slice A, 2026-07-16)
 
 New operator tooling under `scripts/iso/`: a reproducible DooPlex pipeline that turns the official