diff --git a/documentation/architecture/06-offsite-connectivity.md b/documentation/architecture/06-offsite-connectivity.md
index fbda352..e192b76 100644
--- a/documentation/architecture/06-offsite-connectivity.md
+++ b/documentation/architecture/06-offsite-connectivity.md
@@ -141,6 +141,18 @@ code, restores the WG key, and re-establishes the tunnel; hub-side the peer entr
 the endpoint: the box is off the offsite network immediately, auditable, no box cooperation
 needed.
 
+**Offsite escrow CREATED — S4 Part 5 DONE (2026-07-04, operator-present; runbook
+`RUNBOOK-offsite-escrow-create`).** `escrow-create -storage felhom-offsite -identity-bundle
+-directive -upload` on felhom-pve minted a fresh R (operator-recorded off-transcript), wrapped the
+offsite client key K + the auto-injected WG private key + the offsite PBS token under it, and
+uploaded the opaque blobs to the hub. Independently verified in `host_escrow` (host `demo-felhom-01`:
+`key_fingerprint` = the offsite key `b0:fe:2a…`, identity blob 499 B, directive with the non-secret
+DR coords, `created_at` = now) — all with **zero knowledge of R**. `tunnel_token` intentionally empty
+(the Cloudflare edge lives in the guest/controller, re-provisioned separately in DR). **S5 (DR
+consume) is now UNBLOCKED:** R + the hub-stored blobs reconstruct K + the WG key (+ the offsite PBS
+token). Note: `host_escrow` is one slot per host (last-write-wins) — the offsite escrow is the one
+that matters for real DR (D6); the dev `felhom-pbs` key still lives on the box.
+
 **Revocation semantics, agent side (S3-final):** the agent registers ONCE (key exists + no local
 marker). A `wireguard` block absent from a PRESENT desired-state = revocation → the agent
 disables the service, KEEPS its marker, and never re-registers on its own — revoked stays