docs: v0.64.0 shipped — CHANGELOG + CONTEXT + REPORT (S3 live-validated on felhom-pve)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CHANGELOG.md

@@ -1,3 +1,41 @@
+## v0.64.0 — S3 offsite WG tunnel: keygen + registration + agent-managed wg-quick@wg-felhom + escrow join (2026-07-04)
+
+The agent half of doc 06 §3.3 (felhom.eu S1/S2 built the endpoint + hub half). **DEFAULT OFF —
+the safety gate:** `wg_tunnel.enabled` defaults to false; a v0.64.0 rollout without explicit
+config is a no-op (no keygen, no registration, no report stanza). Enabled explicitly on
+felhom-pve only; the default flips when the production endpoint exists.
+
+- **`internal/wgtunnel`** (new; the lanresolver host-service shape): pure-Go keygen
+  (x/crypto curve25519; key 0600 in 0700 StateDir/wg; corrupt file = refuse, NEVER overwrite —
+  it may be the escrowed identity; stored form canonical-clamped — x/crypto clamps derivation
+  internally, so the STORED bytes are the property that matters, red-proof-anchored); one-shot
+  registration (`POST /hosts/{id}/wg`, marker-gated, exponential backoff cap 15 m);
+  desired-state consumption via the new `desired.Syncer.AddConsumer` raw seam (panic-contained);
+  conf render golden-tested (MTU 1420, AllowedIPs = pbs_tunnel_ip/32, keepalive 25 — doc 06 §4
+  client constants; all inputs strictly validated); hash-gated apply (steady state = ZERO
+  execs), restart-not-reload on conf change, self-heal enable, adopt-lost-marker,
+  re-key-on-mismatch. **Revocation semantics (doc 06 §3.5 completed): block absent from a
+  PRESENT desired-state → disable + marker KEPT + never re-register** (the operator re-adds the
+  peer using the reported pubkey); absent DATA (failed fetch) is never a teardown signal.
+- **`internal/hub`**: `WireDesiredState.Wireguard` (field-exact with the S2 cross-repo golden,
+  copied byte-identical + decode test), `RegisterWG` client (typed errors, token-free),
+  `HostReport.Wireguard` status stanza `{pubkey, registered, active, last_handshake_age_s,
+  assigned_ip}` via the collector's `WireguardReporter` seam.
+- **Sudoers/capabilities**: `Cmnd_Alias FELHOM_WG` (fixed-path conf install, enable/restart/
+  disable, `wg show wg-felhom latest-handshakes` — the ONLY wg read; `wg show … dump` is
+  FORBIDDEN, its interface line carries the PRIVATE KEY) + 6 manifest entries (Critical=false
+  until S4 makes the tunnel load-bearing).
+- **Escrow**: `IdentityBundle.WGPrivateKey` (omitempty) + escrow-create auto-inject when the key
+  file exists (`escrow.AttachWGKey`; field NAME only in logs). Honest limit: pre-S3 blobs cannot
+  be retro-fitted (R is never retained) — S5 DR falls back to fresh-key re-registration, which
+  keeps the box's /32 (hub S2 re-key-in-place).
+- `--selftest=wgtunnel` single-shot for supervised bring-up.
+- Live-validated on felhom-pve (agent restart tolerance, host reboot with unit persistence,
+  revocation drill, 30-min keepalive soak, escrow inject) — see REPORT.md. Five red-proofs run
+  + reverted. GOTCHA learned: the hub envelope's `poll_interval_seconds` (hub-side constant
+  900 s) silently overrides the agent's configured cadence on the FIRST cycle — the agent-side
+  `poll_seconds` is only the pre-first-heartbeat default.
+
 ## configs: build-golden.sh v2.0.0 — mandatory controller tag + bootstrap .path unit (B5 + B1) (2026-07-03)
 
 Golden-bake script only — **no agent code, no binary, no agent version bump** (docs/config