hub v0.51.0: DR-tier-by-default — per-customer dr_tier flag (default ON, legacy backfill from reality), cascade stages, WG-registration auto-provision hook, offsite-requires-DR guard (F-6 policy), host-page capability chips (inactive=neutral)

Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN

hub/internal/web/templates/config_form_body.html

@@ -140,16 +140,15 @@
                 {{end}}{{end}}{{end}}
             </details>
 
-            <details class="card" {{if .PBSDR.Enabled}}open{{end}}>
-                <summary><h2 style="display:inline">PBS DR tier (ep0)</h2></summary>
+            <details class="card" {{if .PBSDR.DRTier}}open{{end}}>
+                <summary><h2 style="display:inline">DR tier (PBS, ep0)</h2></summary>
                 <div class="form-grid" style="margin-top: 1rem;">
                     <div class="form-group">
-                        <label><input type="checkbox" name="pbsdr_enabled" {{if .PBSDR.Enabled}}checked{{end}}>
-                            Enable PBS DR (provisions the ep0 namespace + token on save; the host agent applies the storage entry)</label>
+                        <label><input type="checkbox" name="dr_tier" {{if .PBSDR.DRTier}}checked{{end}}>
+                            DR tier — offsite disaster-recovery via PBS (the DEFAULT for new customers; disabling is the exception and removes the Felhom-side cost entirely)</label>
+                        <small class="form-hint">One flag, ordered rollout: the ep0 namespace + token provision automatically once the host's WG tunnel peer registers; the host agent applies the storage entry on its next tick. Offsite app backup requires this tier (the escrow ceremony depends on the PBS key).</small>
                         {{if not .PBSDR.Supported}}
-                        <small class="form-hint">Not configured on this hub (no tenantsync key) — enabling will fail until it is.</small>
-                        {{else if .PBSDR.NoHost}}
-                        <small class="form-hint">No host enrolled for this customer yet — enabling fails until the agent enrolls and reports its WG key.</small>
+                        <small class="form-hint">Not configured on this hub (no tenantsync key) — the flag is stored, but provisioning waits until it is.</small>
                         {{end}}
                     </div>
                     <div class="form-group">
@@ -159,8 +158,21 @@
                         <small class="form-hint">The storage-entry id the agent creates on the box. Default felhom-pbs; the demo host's adopted manual entry is felhom-offsite.</small>
                     </div>
                 </div>
+                {{if .PBSDR.DRTier}}
+                <!-- v0.51.0 cascade status (scenario D): per-stage reality vs the stored intent,
+                     reusing the fail-closed guard wording. Neutral states, never red — waiting is
+                     honest, not broken. -->
+                <ul class="form-hint" style="margin-top:.5rem; list-style:none; padding-left:0; display:grid; gap:.25rem">
+                    <li>{{if not .PBSDR.NoHost}}<span class="badge badge-ok">done</span> host enrolled ({{.PBSDR.HostID}}){{else}}<span class="badge badge-neutral">waiting</span> no host enrolled yet — the Day-0 install enrolls it{{end}}</li>
+                    <li>{{if .PBSDR.WGPeer}}<span class="badge badge-ok">done</span> WG tunnel peer registered{{else}}<span class="badge badge-neutral">waiting</span> the host has not reported a WG key yet — the tunnel peer must exist before the PBS DR tier (registration is hands-free once the agent starts){{end}}</li>
+                    <li>{{if .PBSDR.Provisioned}}<span class="badge badge-ok">done</span> descriptor provisioned (namespace {{.PBSDR.Namespace}}, token {{.PBSDR.TokenID}}){{else}}<span class="badge badge-neutral">waiting</span> provisions automatically when the WG peer registers{{end}}</li>
+                    <li>{{if .PBSDR.EscrowPresent}}<span class="badge badge-ok">done</span> key escrow present (ceremony done){{else}}<span class="badge badge-neutral">waiting</span> ceremony possible once the descriptor is applied on the box (run it with the customer — R-moment){{end}}</li>
+                </ul>
+                {{end}}
+                {{if and .PBSDR.Provisioned (not .PBSDR.DRTier)}}
+                <p class="form-hint" style="margin-top:.5rem">Tier OFF with a provisioned namespace: runs stop and the box reports the DR capabilities inactive; the ep0 namespace + data are KEPT (teardown of an ever-on tier is a deliberate manual operator action).</p>
+                {{end}}
                 {{if .PBSDR.Provisioned}}
-                <p class="form-hint" style="margin-top:.5rem">Provisioned: namespace {{.PBSDR.Namespace}}, token {{.PBSDR.TokenID}} (host {{.PBSDR.HostID}}) — the token secret is delivered to the host agent once (never shown here).</p>
                 <!-- The offsite F4 precedent: explicit operator re-key for a consumed-secret dead-end.
                      Rides the parent form via formaction; _csrf submits with it. -->
                 <button type="submit" class="btn btn-outline" style="margin-top:.5rem"