v0.104.0: off-box unit discovery (durable, deployment-independent) + no-silent-success

offbox located each toggled app's recovery unit via AppNamespaceRoot→GetAppDrivePath,
which reads the app's LIVE app.yaml HDD_PATH and silently falls back to systemDataPath
when the app isn't deployed → looked on the wrong drive, backed up nothing, reported
ok/0 (DIAG root cause). Now:

- discoverOffboxUnit/offboxCandidateNSRoots scan the durable storage registry
  (schedulable non-decommissioned paths ∪ systemDataPath) for backups/primary/<app>,
  independent of deploy state; newest-by-manifest-CreatedAt wins on drive churn.
- RunOffboxBackup: runOffboxInternal returns (backedUp, missing, err); 0-of-N toggled →
  hard error + operator alert; partial → ok + new OffboxTarget.LastWarning (shown on
  /backups, preserved across config edit).
- AppNamespaceRoot + primary WRITE paths unchanged.
- 6 non-hollow tests (A-E + edge) + both companion red-proofs run (reverted).
- NOT yet live-validated against the Storage Box (spike creds torn down).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -7,7 +7,19 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-07-07 (v0.103.0 — F-C2-1 config-loader auth-integrity fix)
+Last updated: 2026-07-09 (v0.104.0 — off-box unit discovery + no-silent-success)
+
+> **2026-07-09 — v0.104.0: off-box discovery over inference + no-silent-success.** The Storage-Box spike
+> found offbox reporting `ok`/0 snapshots while backing up nothing; DIAG pinned it: offbox resolved each
+> toggled app's recovery unit via `AppNamespaceRoot`→`GetAppDrivePath`, which reads the app's *live*
+> `app.yaml` `HDD_PATH` and **silently falls back to `systemDataPath`** when the app isn't deployed → it
+> looked on the wrong drive. **Decision: DISCOVER, don't infer** — scan the durable storage registry
+> (schedulable, non-decommissioned paths ∪ systemDataPath) for `backups/primary/<app>`, deployment-state
+> independent; newest-by-manifest wins on drive churn. **Silent-success closed:** 0-of-N toggled → hard
+> error + operator alert; partial → `ok` + customer `LastWarning`. Write paths + `AppNamespaceRoot`
+> untouched. Unit suite + both companion red-proofs green. **NEXT:** supervised box re-provision + a real
+> offbox→Storage-Box endpoint round-trip (this task did NOT re-point at the live box — spike creds were
+> torn down). Deployed to 9201; see REPORT.md.
 
 > **2026-07-07 — v0.103.0: F-C2-1 (LIVE on 9201).** The config loader ran `os.ExpandEnv` over the
 > whole YAML before parse, silently corrupting a bcrypt `web.password_hash` (`$2a$10$…` → `"a0"`) — a