docs: SPIKE — offsite-backup connectivity: plain WireGuard wins the ladder (transport decision made)

P0-P7 probe ladder on real ends (demo-felhom PVE host <-> throwaway Hetzner).
Verdict: GO at H1 — plain host-side WG, box-dials-out to a small public endpoint;
Headscale is a separable fleet layer, not a traversal necessity. Line is plain-NAT
(not CGNAT) with zero IPv6 — recorded honestly; CGNAT vantage deferred to Peti VM 110.
Real 2 GiB worst-case PBS backup over the tunnel at the full home uplink, pin intact.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

scripts/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Felhom scripts — Changelog
 
+## docs — SPIKE: offsite-backup connectivity — plain WireGuard WINS the ladder; Headscale = separable fleet layer (2026-07-03)
+
+`documentation/audits/SPIKE-connectivity-wireguard-2026-07-03.md` — the offsite-backup transport
+decision, empirically grounded on both real ends (demo-felhom PVE host ⟷ throwaway Hetzner box,
+end state: powered off, secrets shredded). Headline results: the operator's line is **plain-NAT
+with a fixed public IP, not CGNAT, and has zero IPv6** (P0 honesty — CGNAT confirmation deferred
+to Peti's VM 110); plain outbound WG held an 11.4-min idle window and carried a **real 2 GiB
+worst-case PBS backup at 4.26 MiB/s = the full home uplink** (~5% tunnel overhead), TLS pin
+intact through the tunnel (positive + negative proof); UDP 51820 **and** 443 both pass; kernel WG
+surprisingly *works* inside the unprivileged guest (P7 — host placement stands on architecture,
+not infeasibility). Recommendation: host-side agent-managed WG (cloudflared pattern), key in the
+escrowed IdentityBundle, small public endpoint VM (PBS-on-VM vs rendezvous-relay deferred to the
+spec). `runbooks/day0-install.md` backlog line resolved to point here; `CONTEXT.md` notes the
+DR-completeness task is unblocked (next: the production connectivity spec).
+
 ## skills — NEW: felhom-app-catalog (4th skill) + SparkyFitness as its worked example (2026-07-03)
 
 `skills/felhom-app-catalog/SKILL.md` — the catalog **authoring workflow** (research → inspect the