docs: DR-tier-by-default batch — decisions 1-5 in CONTEXT, day0 ACL advice reversed, ceremony decision-4 policy block, WG disclosure (tester agreement + GO-LIVE D3), drill F-disposition table, REPORT

Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN

CONTEXT.md

@@ -3,6 +3,32 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-12 — DR-TIER-BY-DEFAULT BATCH SHIPPED: installer v1.15.0 + hub v0.51.0 (+ agent
+  v0.86.0 in felhom-agent)** — closes DRILL-day0-vm F-1/F-2/F-3/F-7/F-8/F-9/F-10 and F-6 (by
+  policy). **The five operator decisions (2026-07-12), recorded verbatim — future sessions must
+  treat these as settled:**
+  1. *Every install deploys the full DR plumbing uniformly (pbs-apply wrapper, `age`, WG enabled,
+     full ACL). **Capability is baked; activation is a hub flag.***
+  2. ***DR tier defaults ON for new customers.** Disabling is the per-customer exception — and it
+     removes the Felhom-side cost entirely (no PBS namespace, no endpoint dependency).*
+  3. ***Offsite app backup requires the DR tier ON** (fork-4 needs the ceremony; the ceremony
+     needs PBS). Enforced hub-side by extending the drill-proven dependency guard.*
+  4. ***Identity-only escrow is formally PARKED** — closed by policy, not implemented. Revisit
+     only if a customer class demands lean-tier offsite. Record in the ceremony runbook + CONTEXT
+     so future sessions know it was a decision, not an oversight.*
+  5. ***WG is base infrastructure, not a DR component** — always-on like cloudflared; it is also
+     the future OOB-management transport. BYO consent: a disclosure line lands in the
+     tester-agreement doc; per-customer hub disable remains possible.*
+  Mechanics: installer ships `felhom-pbs-apply` + `age` + `wg_tunnel.enabled: true` (byo wg-off
+  assert RETIRED — consent = typed disclosure ack + tester-agreement line), single VERSION source
+  gated by `scripts/hostinstall_gates.py` (cross-checks the hub Setup-tab const), default ACL
+  keeps felhom-pbs (doc advice REVERSED — narrowing caused the drill 403). Hub: per-customer
+  `dr_tier` flag (new default ON; legacy backfilled from descriptor reality, one-time),
+  cascade-not-error semantics + per-stage status on the edit form, WG-registration
+  auto-provision hook (scenario A hands-free), offsite-requires-DR guard (exact F-6 message),
+  host-page capability chips (agent 0.86.0 `inactive` = neutral; pre-1.15 "binary not found" →
+  migration hint). felhom-pve's latent F-3 state fixed live; Peti's box unreachable (his F-3
+  check + D/E/G deferred).
 - **2026-07-12 — HUB v0.50.0 SHIPPED + LIVE: customer-claim password arc (closes DRILL-day0-vm
   F-4/F-5).** The customer OWNS the dashboard password via a one-time claim code the hub emails to
   the registered address (`bcrypt(code)` stored, plaintext only in the send). `internal/claim`