v0.173.0 — R-77: endpoint-drift detection, samba protected-set gate, channel log honesty

Source: felhom.eu/documentation/audits/DIAG-agent-channel-2026-07-26.md

bootstrap.DetectEndpointDrift names a controller.yaml vs bootstrap.json
local_api.endpoint divergence -- one ERROR carrying BOTH values and BOTH paths,
its own event type local_api_endpoint_drift, and its own Hungarian banner shown
ABOVE the channel banner because drift is the cause and "agent unreachable" the
symptom. It writes NOTHING: reconciling from bootstrap.json would clobber a
correct controller.yaml on any half-provisioned or hand-repaired guest, so the
authority ruling is deferred to R-78. Fail-safe silent on absent/unparseable/
incomplete bootstrap and on an empty endpoint (ensureLocalAPI's fill-if-missing
path is untouched). Fingerprint compared as a BOOLEAN only; token never
compared, logged or exposed.

EffectiveProtected now gates samba on Enabled && UserSet, mirroring BOTH of
reconcileSambaAt's early returns, and the doc comment is corrected in the same
change -- it claimed "detection and deployment agree in both directions" while
citing only !smb.Enabled, an assertion that went false when !smb.UserSet was
added. Not over-suppressed: sharing on WITH a password and a dead container
still alarms.

Channel log: the debounce placeholder is stateUnconfirmed (rendered "unseeded")
instead of "up", so a born-down channel no longer logs "up->down" and orUnseeded
stops being dead code. Logging only -- the placeholder is still matched in the
re-arm condition, so F2 born-down alerting is byte-for-byte unchanged and all
nine pre-existing channelhealth tests pass.

Tests 951 -> 959, all green. Red-proofs A (both directions), E and F.
MinAgent unchanged; felhom-agent untouched.

CHANGELOG.md

@@ -1,5 +1,55 @@
 ## Changelog
 
+### v0.173.0 — R-77: endpoint-drift detection, samba protected-set gate, channel log honesty (2026-07-26)
+
+Source: `felhom.eu/documentation/audits/DIAG-agent-channel-2026-07-26.md`.
+
+**Operational repair first (Part 0).** Both production controllers had been dialling their pre-island
+LAN address since 2026-07-25 12:44 — the island migration rewrote `bootstrap.json` and
+`controller.yaml` was never updated. `local_api.endpoint` corrected to `169.254.253.1:8443` on
+demo-felhom and demo-hp (backups at `controller.yaml.pre-r77.bak`); **fingerprint and token agreed on
+both boxes**, so only the address moved. Channel healthy since: zero `[channel]` lines and zero
+`agent_channel_*` hub events after restart.
+
+**Endpoint-drift detection — DETECT AND NAME, never write** (`bootstrap.DetectEndpointDrift`). When
+`controller.yaml` and `bootstrap.json` both carry a complete `local_api` block and their endpoints
+disagree, the controller emits one ERROR naming **both values and both paths**, raises a **new,
+dedicated event type `local_api_endpoint_drift`** (error severity — drift never self-heals), and
+shows its own Hungarian banner *above* the channel banner, because drift is the CAUSE and
+"agent unreachable" the symptom. It **does not reconcile the files**: the mirror-image failure —
+clobbering a correct `controller.yaml` from a stale `bootstrap.json` — is just as bad, fleet-wide.
+That authority ruling is **R-78**. Fail-safe to silence on an absent/unparseable/incomplete bootstrap
+(an unprovisioned guest is not drifted) and on an empty endpoint (that is `ensureLocalAPI`'s
+fill-if-missing path, untouched). The fingerprint is compared and reported as a **boolean only**; the
+token is never compared, logged or exposed.
+
+**Hub allowlist (`felhom.eu` hub v0.74.0) — required, not optional.** `allowedEventTypes` 400s an
+unknown `event_type`, so without the one-line entry the new alert would have been silently inert —
+the exact seam-wiring failure this project has hit four times. Shipped with the controller.
+
+**Samba protected-set gate.** `EffectiveProtected` now requires `smb.Enabled && smb.UserSet`,
+mirroring **both** of `reconcileSambaAt`'s early returns. Sharing enabled without a household
+password means the controller deliberately does not deploy samba, yet the health monitor reported
+`fail` for it — demo-hp reported `health=fail` to the hub from the moment sharing was switched on.
+**The doc comment was corrected in the same change**: it claimed "detection and deployment agree in
+both directions" while citing only `!smb.Enabled`, an assertion that became false when the
+`!smb.UserSet` return was added — a comment documenting a guarantee the code no longer provides is
+how the bug returns. Not over-suppressed: sharing on **with** a password and a dead container still
+alarms. `TestEffectiveProtectedTracksSharingToggle` was updated — its old fixture asserted the buggy
+behaviour.
+
+**Channel log honesty.** The debounce branch seeded an unseeded state to `"up"`, so a **born-down**
+channel logged `up->down:<reason>` and `orUnseeded` was dead code. On 2026-07-25 that implied a
+working channel degrading when neither controller had *ever* reached its agent, and it misdirected
+the first read of the incident. The placeholder is now `stateUnconfirmed`, rendered `unseeded`.
+**Logging only** — the placeholder is still matched in the re-arm condition, so F2 born-down alerting
+is byte-for-byte unchanged; the Scenario-F test asserts sink call **count and arguments**, not just
+the string, and all nine pre-existing channelhealth tests still pass.
+
+Tests 951 → 959, all green. Three red-proofs (A, E, F) recorded in REPORT.md — Scenario A in **both**
+failure directions: no-detection, and the auto-correcting variant that trips the byte-identical
+assertion. **MinAgent unchanged; felhom-agent untouched** (DIAG refuted H1 — the island is healthy).
+
 ### v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces (2026-07-26)
 
 Spike: `felhom.eu/documentation/audits/SPIKE-catalog-data-paths-2026-07-26.md`.