docs(offsite): §3.5 — offsite escrow CREATED (S4 Part 5 done, operator-present)

escrow-create -storage felhom-offsite -identity-bundle -directive -upload on
felhom-pve: fresh R (operator-recorded off-transcript) wraps K + WG key + offsite
PBS token; uploaded to hub. Independently verified in host_escrow (demo-felhom-01:
key_fingerprint=offsite b0:fe:2a…, identity blob 499B, directive present,
created_at=now) with zero knowledge of R. S5 (DR consume) now UNBLOCKED.

This re-run also remediated an earlier escrow whose R had leaked into an agent
transcript (last-write-wins overwrote it with the clean-R blob).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/architecture/06-offsite-connectivity.md

@@ -141,6 +141,18 @@ code, restores the WG key, and re-establishes the tunnel; hub-side the peer entr
 the endpoint: the box is off the offsite network immediately, auditable, no box cooperation
 needed.
 
+**Offsite escrow CREATED — S4 Part 5 DONE (2026-07-04, operator-present; runbook
+`RUNBOOK-offsite-escrow-create`).** `escrow-create -storage felhom-offsite -identity-bundle
+-directive -upload` on felhom-pve minted a fresh R (operator-recorded off-transcript), wrapped the
+offsite client key K + the auto-injected WG private key + the offsite PBS token under it, and
+uploaded the opaque blobs to the hub. Independently verified in `host_escrow` (host `demo-felhom-01`:
+`key_fingerprint` = the offsite key `b0:fe:2a…`, identity blob 499 B, directive with the non-secret
+DR coords, `created_at` = now) — all with **zero knowledge of R**. `tunnel_token` intentionally empty
+(the Cloudflare edge lives in the guest/controller, re-provisioned separately in DR). **S5 (DR
+consume) is now UNBLOCKED:** R + the hub-stored blobs reconstruct K + the WG key (+ the offsite PBS
+token). Note: `host_escrow` is one slot per host (last-write-wins) — the offsite escrow is the one
+that matters for real DR (D6); the dev `felhom-pbs` key still lives on the box.
+
 **Revocation semantics, agent side (S3-final):** the agent registers ONCE (key exists + no local
 marker). A `wireguard` block absent from a PRESENT desired-state = revocation → the agent
 disables the service, KEEPS its marker, and never re-registers on its own — revoked stays