# REPORT — agent v0.86.0: DR-tier-by-default (capability `inactive` + F-3 parent ownership)

**Date:** 2026-07-12 · **Baselines:** agent v0.85.0 (`bcb8dad`) → **v0.86.0**.
**Source of truth:** the DR-tier-by-default batch spec + `felhom.eu/documentation/audits/DRILL-day0-vm-2026-07-12.md`.
**Scope:** agent half of the batch — the capability `inactive` state (disabled ≠ degraded) and the
F-3 provision parent-dir ownership fix. No escrow/ceremony changes (decision 4: identity-only
escrow is PARKED by policy). Green gate: `go build ./... && go vet ./... && go test ./...` — all
26 packages ok.

## What shipped

1. **Capability `inactive` state** (`internal/capability/probe.go`, `manifest.go`):
   - `StatusInactive = "inactive"`, `ReasonInactive = "disabled by configuration"`.
   - `Capability.GatedBy` + `Prober.GateActive(gate)` — a HEALTHY probe of a gated capability
     whose gate is off is downgraded ok→inactive. Degraded (binary missing / sudo denied) is
     NEVER downgraded: an un-migrated pre-v1.15.0 box must not masquerade as deliberately off.
   - The 3 `pbsdr-*` entries are gated via the stable name prefix in `Manifest()` (a future
     pbsdr-* op is gated automatically; nothing else ever is — pinned by test).
   - `Summarize` counts only real degraded; `logCapabilities` logs an inactive count at INFO and
     now runs AFTER the pbsdr wiring so the startup snapshot equals the first report's.
2. **`pbsdr.Manager.DRConfigured()`** (`internal/pbsdr/manager.go`): the gate's answer — live
   descriptor state (anything but `disabled`), falling back to the persisted converged marker
   before the first desired-state fetch (an applied box never flaps inactive across a restart).
3. **F-3** (`internal/provision/backhalf.go`): a root-run provision chowns `guests/` +
   `guests/<vmid>/` to the state-dir's owner (`chown --reference`, non-recursive; bootstrap leaf
   stays guest-root). Non-root (daemon) runs skip it via the `geteuid` seam.

## Tests + red-proofs (all three mutations proven red, then restored)

| Test | Red-proof mutation | Result |
|---|---|---|
| `TestProbe_GateOffHealthyIsInactive` (+ BinaryMissingStaysDegraded, GateOnOrNilIsOK, ExactlyPBSDRGated) | gate branch in `Probe` disabled (`if false`) | inactive case FAILED; degraded case stayed green ✓ |
| `TestDRConfigured_Lifecycle` (unconfigured→applied→restart-marker→disabled) | `DRConfigured` ignores the `disabled` state | disabled case FAILED ✓ |
| `TestProvision_RootRunOwnsGuestsParents` (root issues, non-root doesn't, never `-R`) | F-3 chown block removed | root case FAILED ✓ |

## Live state touched

- **felhom-pve latent F-3 state FIXED live** (pre-existing `guests{,/9201}` root:root 0700 →
  chowned to felhom-agent, bootstrap subtree untouched — the drill's proven fix).
- **Peti's host: unreachable** — his F-3 check + agent update stay deferred (publish-train D/E/G).

## Shipping notes

- `configs/felhom-pbs-apply` was already in this repo; host-install **v1.15.0** (felhom.eu,
  same-day) now ships it (drill F-7) + `age` (F-10) + `wg_tunnel.enabled: true` (F-9/decision 5).
- Hub-side rendering of the `inactive` chip + the per-customer DR flag = hub v0.51.0 (felhom.eu).
- Deploy: build+push 0.86.0 on 180, deploy to felhom-pve, publish via `scripts/publish-agent.sh`,
  hub Day-0 manifest vouch as operator/browser follow-up.