docs: SPIKE — offsite-backup connectivity: plain WireGuard wins the ladder (transport decision made)

P0-P7 probe ladder on real ends (demo-felhom PVE host <-> throwaway Hetzner).
Verdict: GO at H1 — plain host-side WG, box-dials-out to a small public endpoint;
Headscale is a separable fleet layer, not a traversal necessity. Line is plain-NAT
(not CGNAT) with zero IPv6 — recorded honestly; CGNAT vantage deferred to Peti VM 110.
Real 2 GiB worst-case PBS backup over the tunnel at the full home uplink, pin intact.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,21 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-03 — OFFSITE-BACKUP TRANSPORT DECIDED (connectivity spike, GO at the lowest rung)** —
+  plain WireGuard, host-side, box-dials-out to a small public endpoint; **no Headscale/DERP needed
+  for backup** (separable fleet layer, adoptable later). Live-proven on demo-felhom → throwaway
+  Hetzner: 11.4-min idle hold, PBS API through the tunnel with the exact-cert pin intact
+  (positive + negative), real 2 GiB worst-case backup at 4.26 MiB/s (= the home uplink; tunnel
+  overhead ~5%), UDP 51820 *and* 443 both pass. P0 honesty: the operator's line is plain-NAT
+  (fixed public IP, One Hungary), NOT CGNAT, and has zero IPv6 — CGNAT confirmation deferred to
+  Peti's VM 110 (second ISP). P7 surprise: kernel WG *works* inside the unprivileged guest (no TUN
+  needed) — host placement stands on architecture (backups originate host-side; cloudflared
+  precedent), not infeasibility. Evidence + architecture recommendation (endpoint VM shapes, key
+  custody via IdentityBundle escrow, per-peer /32 isolation):
+  `documentation/audits/SPIKE-connectivity-wireguard-2026-07-03.md`. **This unblocks the
+  DR-completeness work: next task = production connectivity spec** (endpoint VM, agent-managed WG
+  service, hub peer registry, escrow join). Throwaway Hetzner box parked powered-off (secrets
+  shredded); demo-felhom verified residue-free.
 - **2026-07-03 — 4th skill: `felhom-app-catalog`** (catalog authoring workflow; points at
   app-catalog REUSE.md §1–2, no duplicated tables; auto-discovered by `install_skills.py`, 4/4
   found fresh-session). Proven by finalizing SparkyFitness live on demo (image-inspected