agent v0.86.0: DR-tier-by-default — capability inactive state (GatedBy/GateActive, pbsdr gate via DRConfigured) + F-3 root-run provision parent ownership

Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN

internal/pbsdr/manager.go

@@ -125,6 +125,22 @@ func (m *Manager) Status() *hub.PBSDRStatus {
 	return m.status
 }
 
+// DRConfigured reports whether the DR tier is configured ON for this box — the capability
+// prober's GatePBSDR answer (v0.86.0). True when the last-seen descriptor was enabled (any live
+// status except "disabled"), or, before the first desired-state fetch of this process, when a
+// previously-converged marker exists (so an applied box never flaps to inactive across an agent
+// restart). False = no descriptor ever / descriptor disabled → healthy pbsdr capabilities report
+// "inactive (disabled by configuration)" instead of ok.
+func (m *Manager) DRConfigured() bool {
+	m.mu.Lock()
+	st := m.status
+	m.mu.Unlock()
+	if st != nil {
+		return st.State != "disabled"
+	}
+	return m.loadMarker() != nil
+}
+
 // descriptorHash is the idempotency key: sha256 of the canonical (struct-ordered) JSON.
 func descriptorHash(b *hub.WirePBSDR) string {
 	j, _ := json.Marshal(b)