docs: architecture Part 06 — offsite-connectivity design-of-record (slice roadmap S1-S6)

Records the settled transport decisions (plain WG, host-side agent-managed pilot,
one hub-driven endpoint VM running WG+PBS, hub source-of-truth over WireDesiredState,
one datastore + per-customer namespaces, relay-through-DooPlex rejected). Grounded
at file:line vs felhom.eu@bf099f6 + felhom-agent@4ba1b14. Backlog line resolved to
cite spike + design doc. Docs-only; slices are separate future tasks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,19 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-03 — OFFSITE-CONNECTIVITY DESIGN-OF-RECORD WRITTEN (architecture Part 06)** —
+  `documentation/architecture/06-offsite-connectivity.md`: records the six settled decisions
+  (plain WG / host-side agent-managed `wg-felhom` as the agent-managed-unit PILOT / one shared
+  hub-driven endpoint VM running WG+PBS, NO agent on it / hub = source of truth, `wireguard`
+  block rides `WireDesiredState` on the existing DesiredGeneration channel / one datastore +
+  per-customer namespaces / PBS ON the VM, relay-through-DooPlex REJECTED as non-scaling),
+  the Day-0 join handshake, robustness set (WG-roaming-not-DynDNS, DNS re-resolve watchdog, MTU
+  1420, per-/32 isolation, tunnel-health via storage-target model), trust conformance (outbound
+  only; operator-inbound + game-ingress out of scope), the honest ledger (CGNAT still unmeasured
+  — mobile-hotspot smoke closure; peer-sync push-vs-pull = slice-1 design point), and the S1–S6
+  slice roadmap (**MVP = S1 endpoint + S2 hub schema/desired-state + S3 agent WG service, then S4
+  PBS-over-tunnel**; S5 merges with DR-completeness). day0-install backlog line now cites spike +
+  design doc. Docs-only; slices are separate future tasks.
 - **2026-07-03 — OFFSITE-BACKUP TRANSPORT DECIDED (connectivity spike, GO at the lowest rung)** —
   plain WireGuard, host-side, box-dials-out to a small public endpoint; **no Headscale/DERP needed
   for backup** (separable fleet layer, adoptable later). Live-proven on demo-felhom → throwaway