agent v0.86.0: DR-tier-by-default — capability inactive state (GatedBy/GateActive, pbsdr gate via DRConfigured) + F-3 root-run provision parent ownership

Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN

CHANGELOG.md

@@ -1,3 +1,32 @@
+## v0.86.0 — DR-tier-by-default: capability `inactive` state + F-3 provision-parent ownership (2026-07-12)
+
+Agent half of the DR-tier-by-default batch (DRILL-day0-vm-2026-07-12; operator decisions: DR
+capability is BAKED on every install, activation is a hub flag, disabled ≠ degraded).
+
+- **Capability `inactive` state** (`internal/capability`): a third status next to ok/degraded —
+  a config-GATED capability whose plumbing is HEALTHY (binary present, sudo granted) but whose
+  feature is off reports `inactive` / reason `disabled by configuration`. The 3 `pbsdr-*` entries
+  are gated (`GatedBy=GatePBSDR`, applied by the stable name prefix in `Manifest()`); broken
+  plumbing (binary missing / grant denied) stays DEGRADED even with the gate off — an un-migrated
+  pre-v1.15.0 box must never look deliberately disabled. `Summarize` counts only real degraded
+  (inactive never error-logs); the startup self-check logs an `inactive` count and now runs AFTER
+  the pbsdr gate wiring so its snapshot matches the first report.
+- **`pbsdr.Manager.DRConfigured()`** — the gate's answer: true when the last-seen descriptor was
+  enabled (any live state except `disabled`); before the first desired-state fetch it falls back
+  to the persisted converged marker, so an applied box never flaps to inactive across a restart.
+- **F-3 — provision parent-dir ownership** (`internal/provision/backhalf.go`): a ROOT-run
+  provision (the Day-0 one-shot) now chowns the just-created `guests/` + `guests/<vmid>/` PARENT
+  dirs to the state-dir's owner (`chown --reference`, NON-recursive — the bootstrap leaf stays
+  the mapped guest-root's). Previously they were left root:root 0700 → the non-root daemon's
+  lanresolver got "permission denied" (drill live-fix now also applied to felhom-pve, which had
+  the same latent state; Peti's host unreachable — deferred). A daemon-run (non-root) provision
+  skips it (`geteuid` seam).
+- Tests + red-proofs: gate-off-healthy→inactive / gate-off-broken→degraded / gate-on→ok /
+  exactly-pbsdr-gated; DRConfigured lifecycle (incl. marker-across-restart + disabled-wins);
+  root-run parent chown issued, non-root not, never recursive. All three mutations proven red.
+- Shipping note: `configs/felhom-pbs-apply` already lives in this repo — host-install v1.15.0
+  (felhom.eu) now ships it like the mkfs/selfupdate wrappers (drill F-7); no publish change here.
+
 ## v0.85.0 — the boot/recovery plane: F12 ordering-cycle fix + F11/F10/F9/F2/F1 + appliance self-heal (2026-07-12)
 
 Fixes the findings CAMPAIGN-3 (`felhom.eu/documentation/audits/CAMPAIGN-3-2026-07-11.md`) raised