context: self-health arc complete (hub-side leaf-fp re-key detection, agent v0.48.0 + hub v0.22.1)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

CONTEXT.md

@@ -7,7 +7,20 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-06-29 (v0.91.0 — F2: alert on born/persistent-down channel)
+Last updated: 2026-06-29 (self-health arc COMPLETE — hub-side leaf-fp re-key detection)
+
+> **2026-06-29 — Self-health arc complete (agent v0.48.0 + hub v0.22.1).** The hub now proactively
+> watches every agent's served local-API **leaf fingerprint** fleet-wide: the agent reports
+> `leaf_fingerprint` on its host report (v0.48.0), and the hub `HostLeafChecker` (`monitor/host_leaf.go`)
+> raises `host_leaf_changed` when it changes (trust-on-first-report baseline; empty fp = unknown, never
+> alerts; reads from report_json, no migration; hub-generated so no allowlist change). Independent of the
+> controller channel-check. Live: a leaf regen raised `host_leaf_changed` (`82078fab…→60b5974d…`) AND the
+> controller's `agent_channel_pin_mismatch` — complementary. NOTE: v0.22.0 shipped the checker but the
+> main.go wiring never applied (concurrent file-touch); the LIVE TEST caught it (no event on regen) →
+> fixed in v0.22.1. The original silent-multi-day-outage incident class is now caught from THREE angles
+> (agent capabilities v0.44.0 / controller channel-check v0.90.0+F2 / hub leaf-fp v0.22.x) AND prevented
+> (agent v0.46.0 loud-regenerate + host-install --preserve-state-from). Backlog: the served-fp-vs-pinned-fp
+> authoritative cross-check; the test-run coverage gaps (capability→hub live, host-reboot doubling).
 
 > **2026-06-29 — v0.91.0: F2 (channel-health born-down alerting).** The v0.90.0 channel-health check
 > alerted only on a live up→down transition; a channel broken at **startup/reseed** (e.g. the