docs: architecture Part 06 — offsite-connectivity design-of-record (slice roadmap S1-S6)

Records the settled transport decisions (plain WG, host-side agent-managed pilot,
one hub-driven endpoint VM running WG+PBS, hub source-of-truth over WireDesiredState,
one datastore + per-customer namespaces, relay-through-DooPlex rejected). Grounded
at file:line vs felhom.eu@bf099f6 + felhom-agent@4ba1b14. Backlog line resolved to
cite spike + design doc. Docs-only; slices are separate future tasks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

scripts/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Felhom scripts — Changelog
 
+## docs — architecture Part 06: offsite connectivity design-of-record (2026-07-03)
+
+`documentation/architecture/06-offsite-connectivity.md` — the settled offsite-backup-transport
+design, authored from the spike verdict + operator-resolved forks (recorded, not re-litigated):
+plain WG (D1), host-side **agent-managed** `wg-felhom` as the agent-managed-unit pilot on the
+sudoers `*.mount` install pattern (D2), one shared hub-driven endpoint VM running WG + the
+offsite PBS with no agent (D3, CF-token pattern), hub source-of-truth with a `wireguard` block
+riding the existing `WireDesiredState`/DesiredGeneration channel (D4), one datastore +
+per-customer namespaces (D5), and PBS **on** the VM — relay-through-DooPlex rejected as
+non-scaling (D6). Includes the Day-0 join handshake, the robustness set (NOT-DynDNS roaming,
+endpoint DNS re-resolve watchdog, MTU 1420, per-/32 topological isolation, tunnel-health through
+the storage-target reachability model), trust conformance, the honest open ledger (CGNAT
+unmeasured → mobile-hotspot smoke test; peer-sync push-vs-pull = slice-1 design point), and the
+S1–S6 slice roadmap (MVP = S1→S2→S3, then S4; S5 merges with DR-completeness). All claims cited
+at file:line against felhom.eu @ bf099f6 + felhom-agent @ 4ba1b14. `day0-install.md` backlog line
+now points at spike + design doc. Docs-only.
+
 ## docs — SPIKE: offsite-backup connectivity — plain WireGuard WINS the ladder; Headscale = separable fleet layer (2026-07-03)
 
 `documentation/audits/SPIKE-connectivity-wireguard-2026-07-03.md` — the offsite-backup transport