docs: DR-tier-by-default batch — decisions 1-5 in CONTEXT, day0 ACL advice reversed, ceremony decision-4 policy block, WG disclosure (tester agreement + GO-LIVE D3), drill F-disposition table, REPORT

Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN

REPORT.md

@@ -2,37 +2,49 @@
 
 > **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
 
-## Hub v0.50.0 — customer-claim password arc (closes DRILL-day0-vm F-4/F-5) — 2026-07-12
+## DR-tier-by-default batch — installer v1.15.0 + hub v0.51.0 (+ agent v0.86.0) — 2026-07-12
 
-Hub half of the customer-owned dashboard-password gate (controller v0.122.0 is the other half).
-The customer sets + owns the password via a one-time claim code the hub emails to the registered
-address; the hub stores only `bcrypt(code)`. **DEPLOYED: `felhom-hub:0.50.0` live on k3s (ArgoCD
-synced/healthy, `Listening on :8080` at 18:47 CEST).**
+**Spec:** the DR-tier-by-default batch (uniform deployment, hub-controlled activation). Closes
+drill findings F-1/F-2/F-3/F-7/F-8/F-9/F-10 shipped + **F-6 closed by policy** (decision 4:
+identity-only escrow PARKED). Baselines re-confirmed at start: password arc fully deployed (hub
+0.50.0 live, ctrl 0.122.0 + floor raised, drill box claimed); hub target shifted 0.50.0→**0.51.0**
+(the arc took the spec's number — the 0.48→0.49 precedent).
 
-### What shipped
+### Shipped (this repo)
 
-- **`internal/claim`** — the code engine: `EnsureIssued` (idempotent Day-0/live-box issue+email),
-  `Resend` (operator rotate), `RequestReset` (controller-forwarded, 3/day cap), `MarkClaimed`
-  (set-only + one confirmation email). Plaintext code exists ONLY inside the email send.
-- **`store.customer_claims`** — `RotateClaimCode` (generation bump = single active code; PRESERVES
-  `claimed_at`), `GetClaim`, `MarkClaimed` (set-only), `BumpResetCount`.
-- **Delivery**: `GET /api/v1/config/{id}` issues the first code + bakes `web.claim_code_*` into the
-  generated controller.yaml; the report ACK serves `claim {code_hash, generation, issued_at}`
-  (allowlisted) + ingests `claimed` (set-only); `POST /api/v1/claim/reset-request` (self-scoped).
-- **UI**: customer-page Setup tab claim chip + "Kód újraküldése" (`POST /configs/{id}/claim-resend`).
-- **Emails**: three Hungarian templates (claim / reset / claimed) via the notify dispatcher.
-- 15 tests (engine, ACK/config, UI); red-proofs for the generation bump + reset-non-DoS proven.
+- **`scripts/felhom-host-install.sh` v1.15.0** — F-7 ships `felhom-pbs-apply` (wrapper pattern,
+  uninstall parity); F-10 installs `age`; F-9/decision-5 renders `wg_tunnel.enabled: true` BOTH
+  modes (byo wg-off assert retired; consent = typed disclosure ack, WG now on the disclosed
+  list); default ACL keeps `felhom-pbs` (byo missing-storage refusal exempts it — pre-positioned
+  grant); F-1 single `SCRIPT_VERSION` source; F-2 honest dry-run auth lines; F-8 loud root@pam
+  rotation pointer (4b + final summary). `bash -n` clean; mode-harness 31/31 green.
+- **`scripts/hostinstall_gates.py`** (NEW committed gate) — version single-source + hub-const
+  cross-check, age, pbs-apply ship+remove, wg default-on + assert retirement, felhom-pbs in ACL.
+  All red-proofed; the age assertion hardened TWICE by its own red-proof (prefix regex matched
+  `agekit`; loose regex matched the dry-run print).
+- **Hub v0.51.0** — per-customer `dr_tier` flag (column + one-time backfill from descriptor
+  reality; new-customer default ON); cascade-not-error semantics + per-stage status (scenario D);
+  `PBSDRAutoProvision` fired by the WG-registration hook (scenario A hands-free); offsite-
+  requires-DR guard with the exact F-6 message (scenario C); host-page capability chips
+  (`inactive` = neutral, degraded stays loud + migration hint); Setup-tab copy 1.15.0.
+  Green gate: build/vet/test — 14 packages ok. Red-proofs: coupling guard, flag default,
+  backfill enabled-check, auto-provision unhook — all proven red then restored.
+- **Docs:** day0-install.md (ACL narrowing advice REVERSED — the drill 403; DR-default note;
+  commands drop `--acl-storages`; byo wg disclosure), RUNBOOK-escrow-ceremony.md (decision-4
+  policy block), PETI-tester-agreement.md + GO-LIVE-PACKAGE.md D3 (WG disclosure/supersede),
+  CONTEXT.md (decisions 1–5 verbatim), DRILL-day0-vm §7 F-disposition table, REUSE.md rows
+  (+ path-citation fixes; reuse_refs_check green).
 
-### Live validation
+### Sibling repo (felhom-agent v0.86.0, commit `c20814e`)
 
-Drill box demo-vm-felhom: on the first report after hub 0.50.0 + controller 0.122.0, the hub issued
-+ emailed the claim code to the registered address and the ACK delivered the hash — the controller
-gate flipped ON (proven via the real Cloudflare edge: `/` → 302 claim page, `/api` → 401). Observed:
-the hub issues a code for EVERY reporting managed customer on first report (peti + demo also received
-emails) — benign, since a pre-v0.122 controller ignores the ACK claim field and has no gate.
+Capability `inactive` state ("disabled by configuration"; broken plumbing stays degraded) gated
+by `pbsdr.Manager.DRConfigured` (marker-backed); F-3 root-run provision parent chown
+(`--reference`, non-recursive). felhom-pve's latent F-3 state confirmed + fixed live; Peti's box
+unreachable (check deferred).
 
-### Version note
+### Pending (deploy + validation phase)
 
-Hub was at v0.49.0; this is v0.50.0. Controller v0.122.0 committed + image built. The **floor raise
-to 0.122.0 is the operator's supervised LAST step** (after the drill/demo claim validation) — a
-gated controller must never reach a box before its hub can deliver the code hash.
+Build/deploy hub 0.51.0 (ArgoCD manifest bump) + agent 0.86.0 (felhom-pve + publish + Day-0
+manifest vouch) + installer serve-verify; then the §13 "Day-0 take two" re-drill on qm 300 —
+**requires Viktor's GO** (rolls back to `pre-day0-clean`, deletes the drill escrow via the
+stale-host flow). Scenario B/C hub-side validation via tests + UI screenshots (drill box stays ON).