v0.173.0 — R-77: endpoint-drift detection, samba protected-set gate, channel log honesty

Source: felhom.eu/documentation/audits/DIAG-agent-channel-2026-07-26.md

bootstrap.DetectEndpointDrift names a controller.yaml vs bootstrap.json
local_api.endpoint divergence -- one ERROR carrying BOTH values and BOTH paths,
its own event type local_api_endpoint_drift, and its own Hungarian banner shown
ABOVE the channel banner because drift is the cause and "agent unreachable" the
symptom. It writes NOTHING: reconciling from bootstrap.json would clobber a
correct controller.yaml on any half-provisioned or hand-repaired guest, so the
authority ruling is deferred to R-78. Fail-safe silent on absent/unparseable/
incomplete bootstrap and on an empty endpoint (ensureLocalAPI's fill-if-missing
path is untouched). Fingerprint compared as a BOOLEAN only; token never
compared, logged or exposed.

EffectiveProtected now gates samba on Enabled && UserSet, mirroring BOTH of
reconcileSambaAt's early returns, and the doc comment is corrected in the same
change -- it claimed "detection and deployment agree in both directions" while
citing only !smb.Enabled, an assertion that went false when !smb.UserSet was
added. Not over-suppressed: sharing on WITH a password and a dead container
still alarms.

Channel log: the debounce placeholder is stateUnconfirmed (rendered "unseeded")
instead of "up", so a born-down channel no longer logs "up->down" and orUnseeded
stops being dead code. Logging only -- the placeholder is still matched in the
re-arm condition, so F2 born-down alerting is byte-for-byte unchanged and all
nine pre-existing channelhealth tests pass.

Tests 951 -> 959, all green. Red-proofs A (both directions), E and F.
MinAgent unchanged; felhom-agent untouched.

controller/cmd/controller/main.go

@@ -1016,6 +1016,20 @@ func main() {
 		sched.Every("agent-channel-health", 60*time.Second, chChecker.Check)
 	}
 
+	// local_api endpoint drift (R-77, from the 2026-07-25 outage): controller.yaml and bootstrap.json
+	// can disagree indefinitely and silently — the island migration rewrote the latter and the
+	// controller kept dialling the former for 17.5 h, alerting only "agent unreachable". This NAMES
+	// the fault; it deliberately does not reconcile the files (R-78 owns which one wins).
+	//
+	// Startup-only is sufficient and correct: both files are read at boot and neither changes under a
+	// running controller, so a periodic re-check would add noise without adding signal.
+	if d := bootstrap.DetectEndpointDrift(*configPath, cfg, logger); d != nil {
+		alertMgr.SetEndpointDriftAlert(true, d.HungarianMessage())
+		if notifier != nil {
+			notifier.NotifyEndpointDrift(d.EnglishMessage(), d.FingerprintAgrees)
+		}
+	}
+
 	// Wire debug callbacks (only in debug mode)
 	if cfg.Logging.Level == "debug" {
 		dc := &web.DebugCallbacks{}