docs(H1): doc06 §4.5/§4.6 amendment + endpoint runbook §9 + scripts CHANGELOG + REPORT + CONTEXT

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/architecture/06-offsite-connectivity.md

@@ -224,16 +224,30 @@ production endpoint exists.
   11.4-minute fully-idle window (P2) at ~150 B/s of overhead traffic; **further proven through a
   live mobile-carrier NAT for a 32-minute fully-idle soak, zero stalls** (2026-07-04 CGNAT smoke
   test, §7).
-- **4.5 Isolation.** Per-peer `/32` `AllowedIPs`; IP forwarding stays **off** on the endpoint; its
-  firewall admits, from the WG interface, only the PBS port — so a box can reach the PBS API and
-  nothing else, and boxes cannot see each other **by topology** (spike P6). Public surface: SSH
-  (operator) + the WG UDP port, nothing more. PBS tenancy on top: namespace + per-customer token +
-  per-customer key (D5).
-- **4.6 Tunnel health → hub.** The tunnel is a storage dependency, so it reports like one — the
-  storage-manifest model (01 §8: agent "continuously checks presence/reachability, and reports
-  per-target status; a disconnected target → actionable notification") gains a tunnel-health
-  input: no handshake within ~3 keepalive periods → the offsite target reports unreachable → the
-  existing alerting path carries it. No new alarm channel.
+- **4.5 Isolation.** Per-peer `/32` `AllowedIPs`; boxes cannot see each other (spike P6). PBS tenancy
+  on top: namespace + per-customer token + per-customer key (D5).
+  **AMENDED 2026-07-05 (TASK H1 — OOB operator access).** Forwarding is no longer blanket-**off**; it
+  is **ON but per-pair allow-listed**. The endpoint runs `net.ipv4.ip_forward=1` (sysctl.d) and a
+  static forward posture: `ct established,related accept`; **per (operator, box) pair** `ip saddr
+  <operator/32> ip daddr <box/32> accept`; and **box↔box `iifname wg0 oifname wg0` DROP is now an
+  EXPLICIT rule** (previously implicit under the absent capability), backed by the base-chain `policy
+  drop`. These rules live in the endpoint's static nftables (NOT in `felhom-peersync`, which still
+  manages only the peer *list*). Net effect: the operator peer reaches a box's `felhom-sshd`; boxes
+  still cannot reach each other or the operator (only conntrack replies flow). The box side adds a
+  second layer independent of the endpoint: a dedicated `felhom-sshd` on a claimed non-22 port, gated
+  by the host-local `inet felhom_oob` belt (reachable only from the operator `/32` over `wg-felhom`;
+  the customer's stock sshd on :22 is never touched). Live-proven: operator→box SSH works; a dummy
+  tunnel peer is dropped box↔box (counter); the operator `/32` is **rendered** into the box's
+  `wg-felhom` AllowedIPs so it survives the agent's self-heal ([OF-1]); PBS unaffected.
+- **4.6 Tunnel health → hub.** The tunnel is a storage dependency, so it reports like one: no handshake
+  within ~3 keepalive periods → the offsite target reports unreachable → the existing alerting path
+  carries it. No new alarm channel.
+  **EXTENDED 2026-07-05 (TASK H1).** The agent's heartbeat now also carries an **`oob` stanza**
+  (`felhom_sshd_active`, `felhom_sshd_port`, `reachable`, `config_invalid`, `operator_peer_configured`,
+  `operator_key_configured`, `wg_handshake_age_s`) — the operator's "can I get into this box right
+  now, and if not, why" signal. It reaches the hub over HTTPS even when `felhom-sshd` or the tunnel is
+  DOWN (channel independence). The hub raises a transition-based **`oob_degraded`/`oob_recovered`**
+  warning (felhom-sshd down while the operator peer is configured, OR config invalid).
 
 ---