v0.80.0: PBS DR tier slice 2 — the apply-bridge (pbs_dr consumer, felhom-pbs-apply set-only wrapper, verify-pin-before-consume, adoption-first, loud consumed-failed, escrow seed)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/hub/report.go

@@ -77,6 +77,14 @@ type HostReport struct {
 	// hub-schema change and are absent when the reporter is not wired.
 	MgmtPlane *MgmtPlaneStatus `json:"mgmt_plane,omitempty"`
 
+	// PBSDR is the PBS-DR-tier bridge status stanza (slice 2). Present only when the pbsdr
+	// consumer is wired. `consumed_failed` is the LOUD persistent state: the one-time token
+	// secret was consumed but the apply failed afterwards — the secret is burned, the bridge
+	// will NOT silently retry, the operator must Re-issue on the hub. Stored opaquely hub-side
+	// (the Wireguard precedent) — additive, no hub-schema change; hub rendering joins in slice 3.
+	// Carries NO secret.
+	PBSDR *PBSDRStatus `json:"pbs_dr,omitempty"`
+
 	// OOB is the operator-access health stanza (TASK H1). It answers the operator's question — "can I
 	// get into this box right now, and if not, why" — from the hub: felhom-sshd up + on which port,
 	// locally reachable, the tunnel handshake age (the OOB path rides wg-felhom), whether the operator
@@ -86,6 +94,21 @@ type HostReport struct {
 	OOB *OOBStatus `json:"oob,omitempty"`
 }
 
+// PBSDRStatus is the per-heartbeat PBS-DR-tier bridge state (slice 2). States:
+// "adopted" (existing entry verified + reconciled, no consume), "applied" (fresh entry created,
+// K born), "waiting_secret" (verified but no unconsumed secret staged — retrying),
+// "verify_failed" (fingerprint/reachability pre-consume check failing — retrying, NOTHING
+// consumed), "consumed_failed" (LOUD: secret burned, apply failed, no auto-retry — operator
+// re-issue required), "disabled" (descriptor enabled:false). Carries no secret.
+type PBSDRStatus struct {
+	State          string `json:"state"`
+	StorageID      string `json:"storage_id,omitempty"`
+	Namespace      string `json:"namespace,omitempty"`
+	Message        string `json:"message,omitempty"`
+	ConsumedFailed bool   `json:"consumed_failed,omitempty"`
+	AppliedAt      string `json:"applied_at,omitempty"` // RFC3339; set on adopted/applied
+}
+
 // OOBStatus is the per-heartbeat operator-access health (TASK H1). Carries no secret.
 type OOBStatus struct {
 	FelhomSshdActive       bool   `json:"felhom_sshd_active"`           // the felhom-sshd unit is active
@@ -372,6 +395,21 @@ type WireDesiredState struct {
 	PBSNamespace     string                `json:"pbs_namespace,omitempty"`
 	RestoreDirective *WireRestoreDirective `json:"restore_directive,omitempty"` // slice 10D (forward-compat)
 	Wireguard        *WireWireguard        `json:"wireguard,omitempty"`         // S3 (doc 06 §3.2; golden-pinned)
+	PBSDR            *WirePBSDR            `json:"pbs_dr,omitempty"`            // PBS DR tier (slice 2 consumer)
+}
+
+// WirePBSDR is the hub's PBS-DR-tier descriptor (PBS DR slice 1, hub/internal/web/pbsdr.go
+// pbsDRDescriptor — field-exact, cross-repo). NON-SECRET by contract: the token secret NEVER
+// rides the desired-state; the agent fetches it consume-once via ConsumePBSToken. Absent/nil on
+// pre-v0.44.0 hubs → the pbsdr consumer no-ops (old-hub compat).
+type WirePBSDR struct {
+	Enabled     bool   `json:"enabled"`
+	StorageID   string `json:"storage_id,omitempty"`
+	PBSTunnelIP string `json:"pbs_tunnel_ip,omitempty"`
+	Datastore   string `json:"datastore,omitempty"`
+	Namespace   string `json:"namespace,omitempty"`
+	TokenID     string `json:"token_id,omitempty"`
+	Fingerprint string `json:"fingerprint,omitempty"`
 }
 
 // WireWireguard is the hub-owned offsite-tunnel assignment (S3) — field-exact with the S2 golden