docs: SPIKE — offsite-backup connectivity: plain WireGuard wins the ladder (transport decision made)

P0-P7 probe ladder on real ends (demo-felhom PVE host <-> throwaway Hetzner).
Verdict: GO at H1 — plain host-side WG, box-dials-out to a small public endpoint;
Headscale is a separable fleet layer, not a traversal necessity. Line is plain-NAT
(not CGNAT) with zero IPv6 — recorded honestly; CGNAT vantage deferred to Peti VM 110.
Real 2 GiB worst-case PBS backup over the tunnel at the full home uplink, pin intact.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/runbooks/day0-install.md

@@ -118,10 +118,12 @@ Notes:
 - vmid picking: the agent's token is pool-scoped, so the hub's guest inventory only shows
   Felhom-pool guests — other guests on a shared box are invisible there. Always pick from
   `pct list` + `qm list` on the box (`documentation/runbooks/provisioning.md`).
-- Offsite backup (`felhom-pbs`) is NOT part of a go-live today: the PBS host is LAN-only until the
-  Headscale/WireGuard work lands. Go-live standard = **local backups only** (that is what the
-  Part C command configures); offsite DR is retrofitted later via `--rescope-acl` /
-  `--acl-storages` without reinstalling.
+- Offsite backup (`felhom-pbs`) is NOT part of a go-live today: the PBS host is LAN-only. The
+  transport decision is now MADE — plain WireGuard, host-side, box-dials-out to a small public
+  endpoint (spike-proven: `documentation/audits/SPIKE-connectivity-wireguard-2026-07-03.md`);
+  what remains is the production connectivity spec + endpoint VM. Go-live standard = **local
+  backups only** (that is what the Part C command configures); offsite DR is retrofitted later
+  via `--rescope-acl` / `--acl-storages` without reinstalling.
 
 ---