docs: escrow-wizard felhom.eu leg REPORT + CONTEXT (ruling F1 recorded; operator follow-ups: supervised wizard pass drill+demo, agent 0.88.0 publish/vouch)

CONTEXT.md

@@ -3,6 +3,18 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-13 eve — ESCROW CEREMONY WIZARD SHIPPED (agent v0.88.0 + controller v0.127.0; this
+  repo: host-install v1.16.0 + RUNBOOK rewrite).** The recovery-code ceremony is now
+  customer-driveable from the controller (`/backup/escrow`): one-shot R reveal, re-stage-first,
+  Scenario-F stale-blob re-check (fired LIVE on both boxes' hash-less blobs at first ACK; drill's
+  repaired via a real ceremony — hub hash now covers). **Ruling F1 (2026-07-13), settled:** *R
+  transiting the Cloudflare tunnel once at reveal is an accepted risk — same trust class as the
+  claim code/login password; LAN-direct delivery is PARKED.* (threat model:
+  runbooks/RUNBOOK-escrow-ceremony.md). host-install v1.16.0 = FELHOM_ESCROW rides the canonical
+  sudoers fetch; hub `hostInstallVersion` synced (gate green), **hub NOT redeployed** (const rides
+  the next train). OPEN: supervised full-browser wizard pass (Viktor's drill login; also demo, to
+  clear its legacy stale warning); agent 0.88.0 publish + Day-0 vouch at the next train.
+
 - **2026-07-13 — CLOSING BUNDLE SHIPPED: hub v0.53.0** — the last engineering items on the
   pre-tester board: F-14 gated auto-Reissue (deletion provenance `host_deletions` in-tx +
   `token_exists` gate → the EXISTING Reissue op + `pbsdr_auto_reissue` audit event; no record /