v0.80.0: PBS DR tier slice 2 — the apply-bridge (pbs_dr consumer, felhom-pbs-apply set-only wrapper, verify-pin-before-consume, adoption-first, loud consumed-failed, escrow seed)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/config/config.go

@@ -35,6 +35,10 @@ type Config struct {
 	OOB         OOBConfig         `json:"oob"`
 	SelfUpdate  SelfUpdateConfig  `json:"selfupdate"`
 	LogLevel    string            `json:"log_level"` // debug|info|warn|error (default info)
+
+	// SourcePath is the file this config was loaded from ("" = all-env). Set by Load, never
+	// serialized — the pbsdr bridge's escrow.pbs_storage_id seed writes back to it.
+	SourcePath string `json:"-"`
 }
 
 // OOBConfig configures the dedicated felhom-sshd OOB access instance + belt (TASK H1). **Enabled
@@ -540,6 +544,7 @@ func Load(path string) (Config, error) {
 			return cfg, fmt.Errorf("config: parsing %s: %w", path, err)
 		}
 	}
+	cfg.SourcePath = path // where this config came from (pbsdr's escrow seed writes back here)
 	applyEnv(&cfg)
 	return cfg, nil
 }