R-105 (decision 169): retire the never-built slim DR record fields (no writer, no reader); 05 §9/§11, 06 §3.5 corrected

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/06-offsite-connectivity.md

@@ -162,7 +162,11 @@ needed.
 offsite client key K + the auto-injected WG private key + the offsite PBS token under it, and
 uploaded the opaque blobs to the hub. Independently verified in `host_escrow` (host `demo-felhom-01`:
 `key_fingerprint` = the offsite key `b0:fe:2a…`, identity blob 499 B, directive with the non-secret
-DR coords, `created_at` = now) — all with **zero knowledge of R**. `tunnel_token` intentionally empty
+DR coords, `created_at` = now) — all with **zero knowledge of R**. **[FACT, 2026-10-07 — R-105, `09` §3 decision
+169] The directive is RETIRED:** it was written only by this by-hand `-directive` flag (the customer's escrow wizard
+never sent one, so every wizard escrow stored `{}` over it), and nothing read it. The flag is gone (the agent release after 2026-10-07)
+and the hub no longer stores it; the re-enroll routes serve `{}`. The DR coordinates live in the DR
+recipe and tenantsync. `tunnel_token` intentionally empty
 (the Cloudflare edge lives in the guest/controller, re-provisioned separately in DR). **S5 (DR
 consume) is now UNBLOCKED:** R + the hub-stored blobs reconstruct K + the WG key (+ the offsite PBS
 token). Note: `host_escrow` is one slot per host (last-write-wins) — the offsite escrow is the one