docs: S2 shipped — hub v0.33.0 CHANGELOG, peersync v1.0.1, 06 §3.2 wire shape + S2 status, CONTEXT, REPORT

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

scripts/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Felhom scripts — Changelog
 
+## felhom-peersync.sh v1.0.1 — strip out of process substitution (exit-swallow fix) (2026-07-04)
+
+The S1 REPORT's exit-swallow class, fixed: `wg syncconf wg0 <(wg-quick strip "$tmp")` hid the
+strip exit code — a corrupt `wg0.conf.head` could feed syncconf empty/partial input that WIPES
+the live peer set while the script exits 0 (and the bad conf is then persisted). v1.0.1 runs
+strip as its own step into `$tmpdir/stripped`; a strip failure aborts BEFORE `wg` is invoked.
+Sandbox red-proof (stub `wg-quick` exiting 1 after partial output + recording stub `wg`):
+pre-fix shape invoked wg and returned rc=0; fixed shape errors first, wg never called.
+Redeployed to the dev endpoint (runbook step 5 install); shellcheck clean.
+
 ## felhom-peersync.sh v1.0.0 — the offsite endpoint's WG reconcile script (2026-07-04)
 
 S1 (doc 06 §5): the forced-command target the hub's wgsync pushes to (runbook