docs: S2 shipped — hub v0.33.0 CHANGELOG, peersync v1.0.1, 06 §3.2 wire shape + S2 status, CONTEXT, REPORT

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,21 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-04 — S2 SHIPPED: box-facing WG registration + wireguard desired-state block + /offsite UI (hub v0.33.0)** —
+  doc-06 row S2. DECISIONS: the WG assignment is **hub-owned state, merged into served
+  desired-state at READ time** — stored `desired_json` stays a pure operator blob; admin PUT with
+  a top-level `wireguard` key → 400 (no copy-paste clobber); **re-key-in-place keeps the /32**
+  (stable tunnel addressing across rotation/DR); one bound peer per host (partial unique index);
+  generation bumps ONLY on real change (register/re-key/adopt/bound-delete — idempotent paths
+  move nothing). `POST /hosts/{id}/wg` self-scoped per-host key; NEW golden
+  `desired-state-wireguard.golden.json` = the S3 cross-repo contract (byte-identical agent copy
+  rule). peersync **v1.0.1** (strip out of process substitution — the S1 exit-swallow finding;
+  sandbox red-proofed) redeployed to the dev endpoint. Live-proven on the REAL demo-felhom-01
+  record via the real per-host key: gen 2→3, served block = golden shape, endpoint `wg show`
+  carried the peer, v0.63.0 agent tolerated the unknown key (fetch clean, guests untouched),
+  then removed → gen 4, all baselines restored. `/offsite` page unit-proven (live view is
+  operator-password-gated — eyeball after next login). Next: **S3** (agent keygen +
+  registration + `wg-felhom` service + escrow join + CGNAT smoke — risky/supervised).
 - **2026-07-04 — S1 SHIPPED: offsite endpoint live + hub peer-sync (hub v0.32.1)** — the doc-06
   roadmap's first slice, done-criterion met live. Peer-sync design point RESOLVED: **hub pushes
   over SSH** to a forced-command `felhom-peersync` script (pull rejected: weakens immediate