v0.173.0 — R-77: endpoint-drift detection, samba protected-set gate, channel log honesty

Source: felhom.eu/documentation/audits/DIAG-agent-channel-2026-07-26.md

bootstrap.DetectEndpointDrift names a controller.yaml vs bootstrap.json
local_api.endpoint divergence -- one ERROR carrying BOTH values and BOTH paths,
its own event type local_api_endpoint_drift, and its own Hungarian banner shown
ABOVE the channel banner because drift is the cause and "agent unreachable" the
symptom. It writes NOTHING: reconciling from bootstrap.json would clobber a
correct controller.yaml on any half-provisioned or hand-repaired guest, so the
authority ruling is deferred to R-78. Fail-safe silent on absent/unparseable/
incomplete bootstrap and on an empty endpoint (ensureLocalAPI's fill-if-missing
path is untouched). Fingerprint compared as a BOOLEAN only; token never
compared, logged or exposed.

EffectiveProtected now gates samba on Enabled && UserSet, mirroring BOTH of
reconcileSambaAt's early returns, and the doc comment is corrected in the same
change -- it claimed "detection and deployment agree in both directions" while
citing only !smb.Enabled, an assertion that went false when !smb.UserSet was
added. Not over-suppressed: sharing on WITH a password and a dead container
still alarms.

Channel log: the debounce placeholder is stateUnconfirmed (rendered "unseeded")
instead of "up", so a born-down channel no longer logs "up->down" and orUnseeded
stops being dead code. Logging only -- the placeholder is still matched in the
re-arm condition, so F2 born-down alerting is byte-for-byte unchanged and all
nine pre-existing channelhealth tests pass.

Tests 951 -> 959, all green. Red-proofs A (both directions), E and F.
MinAgent unchanged; felhom-agent untouched.

CONTEXT.md

@@ -7,7 +7,29 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-07-26 (v0.172.0 — R-75 canonical import root + catalog-derived skeleton)
+Last updated: 2026-07-26 (v0.173.0 — R-77 endpoint-drift detection + samba gate + channel log honesty)
+
+> **2026-07-26 — v0.173.0 (R-77).** Source: `audits/DIAG-agent-channel-2026-07-26.md`.
+>
+> **UNRESOLVED AND DELIBERATELY DEFERRED — which file is authoritative for `local_api`?** R-77 ships
+> DETECTION ONLY. `controller.yaml` and `bootstrap.json` can disagree; the controller dials
+> `controller.yaml`. The obvious "fix" — reconcile from `bootstrap.json` on every boot — has a failure
+> mode **as severe as the bug it fixes**: on a guest whose `controller.yaml` is correct and whose
+> `bootstrap.json` is stale (a re-provision that half-completed, a hand-repaired guest, a
+> setup-wizard box), auto-reconcile would clobber a WORKING channel on the next restart — fleet-wide,
+> silently, at the moment of a routine deploy. R-77's position is that **naming the drift is enough**:
+> it would have converted the 17.5 h outage into a specific alert on the first health cycle. The
+> authority ruling is **R-78** and needs its own spike — do not resolve it opportunistically.
+>
+> Corollary for anyone editing `bootstrap.MaybeIngest`/`ensureLocalAPI`: `ensureLocalAPI` is the ONLY
+> writer, it fires only when the endpoint is EMPTY, and `DetectEndpointDrift` must stay write-free.
+> Scenario A's test asserts `controller.yaml` is byte-identical after the check, and its red-proof
+> covers the auto-correcting variant precisely because that is the tempting wrong turn.
+>
+> **Also settled here:** the samba protected-set must mirror EVERY early return in
+> `reconcileSambaAt` (currently two: `!smb.Enabled`, `!smb.UserSet`). A third would need the same
+> mirror, and the doc comment above `EffectiveProtected` must be updated with it.
+
 
 > **2026-07-26 — v0.172.0 (R-75).** Spike `felhom.eu/documentation/audits/SPIKE-catalog-data-paths-2026-07-26.md`;
 > feature doc `felhom.eu/documentation/controller/import-and-data-paths.md`.