docs: DR-tier-by-default batch — decisions 1-5 in CONTEXT, day0 ACL advice reversed, ceremony decision-4 policy block, WG disclosure (tester agreement + GO-LIVE D3), drill F-disposition table, REPORT

Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN

documentation/pilot/GO-LIVE-PACKAGE.md

@@ -21,7 +21,7 @@ catalog `2ebe082a` · felhom.eu `1a1e42ad`/hub v0.35.0 · host-install v1.9.1 ·
 |---|------|----------|
 | D1 | Pool model | **One shared `felhom` pool.** No multi-tenant boxes yet; the pool separates Felhom guests from the host owner's own workloads. Effort goes to preflight pool-membership assertion + local-API per-guest token scoping (verified structural, see G10). |
 | D2 | Pilot topology | **BYO host.** Peti installs Felhom onto his OWN Proxmox server, already running his own LXCs. This reframes containment: not customer-vs-customer, but *Felhom-as-a-guest on a host the operator does not own*. See §2. |
-| D3 | Backup posture | **Local-only for the pilot.** `wg_tunnel.enabled` and `oob.enabled` stay FALSE. Offsite (Tier-1/Tier-2 split + production WG endpoint) is a fast-follow, and the limitation is stated honestly in the tester agreement. |
+| D3 | Backup posture | ~~Local-only for the pilot; `wg_tunnel.enabled` and `oob.enabled` stay FALSE.~~ **SUPERSEDED 2026-07-12 (DR-tier-by-default, decisions 1/5):** every install ships the full DR plumbing with `wg_tunnel.enabled=true` — WG is BASE infrastructure (outbound-only, like the CF tunnel; also the future OOB transport); activation of the PBS-DR tier is the hub's per-customer flag (default ON). `oob.enabled` stays FALSE on BYO. Consent moves to the installer's typed disclosure ack + the tester-agreement WG disclosure line (§2). |
 | D4 | Uninstall drill | **Full provision → uninstall → re-provision drill on the demo box BEFORE Peti's day-0.** Peti's box is never the first live test of anything destructive. |
 | D5 | DR bind-override | **Fix now** (small, spike-validated known-constant override per `SPIKE-dr-bindmount-source-2026-07-07.md`), not deferred to the intermediary-mount re-architecture. |
 | D6 | Packaging | **This one tracking doc + a sequenced set of CC tasks** (GL-1…GL-7). |

documentation/pilot/PETI-tester-agreement.md

@@ -44,12 +44,17 @@ mechanisms:
   credential to the hub. Peti's root password is his own and is never seen or changed.
 - **Out-of-band operator SSH is OFF** (`oob.enabled=false`). Felhom opens no operator tunnel into
   his box.
-- **The offsite WireGuard tunnel is OFF** (`wg_tunnel.enabled=false`). No Felhom-side connection
-  reaches back into his network.
+- **WireGuard tunnel DISCLOSURE (changed 2026-07-12, DR-tier-by-default decision 5):** the install
+  DOES enable an **outbound** WireGuard tunnel (`wg_tunnel.enabled=true`) — it is base
+  infrastructure like the Cloudflare tunnel, carries the offsite/DR backup traffic, and is the
+  future out-of-band management transport. It is strictly box-dials-out (no Felhom-side connection
+  reaches back into the network; the peer has no inbound route), it is listed in the installer's
+  typed host-mutation acknowledgement, and it can be disabled per-customer hub-side on request —
+  with the honest consequence that the DR tier and offsite backup stop working without it.
 
-These are asserted at install time (the byo config-write asserts `oob`/`wg_tunnel`/`lan_resolver`
-are all off before the install is marked complete) and were live-validated on the demo host during
-the GL-6 drill.
+These are asserted at install time (the byo config-write asserts `oob`/`lan_resolver` are off
+before the install is marked complete — `wg_tunnel` moved to the disclosed-default list in
+installer v1.15.0) and were live-validated on the demo host during the GL-6 drill.
 
 ---