hub v0.74.0: allow local_api_endpoint_drift; R-77 docs + R-78/79/80

The allowlist entry is REQUIRED, not cosmetic: handleEvent 400s an unknown
event_type, so controller v0.173.0's new drift alert would be silently inert
without it. Shipped with the controller that emits it.

Docs:
- RUNBOOK-local-api-endpoint-drift.md — how to repair a drift, including the
  step everyone will want to skip (establish which value is CORRECT from what
  the agent is actually bound to, rather than assuming bootstrap.json wins) and
  what success looks like (SILENCE, not a "recovered" line, because a fresh
  controller's healthy first observation is not logged). Records both
  2026-07-26 repairs.
- ROADMAP: R-77 shipped; R-78 the local_api authority ruling, with the
  clobber-a-working-channel risk spelled out in BOTH directions so it is not
  resolved opportunistically; R-79 the whole-surface English-strings sweep;
  R-80 expected_backup_missed, flagged as likely outranking R-77 because 7.3
  days of stale backup materially exceeds the ~1.5-day channel outage, so the
  causal link the DIAG hedged on cannot be the whole story.
- Capability map: note against the drive-wizard row (every agent-backed
  capability rides this channel) that a silent drift class is now detected.
  NO row status flips — detection is not prevention.

hub/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Felhom Hub — Changelog
 
+## v0.74.0 — allow `local_api_endpoint_drift` (controller v0.173.0 / R-77) (2026-07-26)
+
+One line in `allowedEventTypes`. It is **not optional**: `handleEvent` 400s an unknown `event_type`
+("Invalid event_type"), so the controller's new drift alert would have been **silently inert** without
+it — the exact seam-wiring failure class this project has hit four times. Shipped with the controller
+that emits it, not after.
+
+Operator-only, `error` severity (drift never self-heals), and deliberately **not** an `agent_channel_*`
+type: during the 2026-07-25 island-migration outage the generic "agent unreachable" event was the only
+signal for 17.5 h and it hid a specific, fixable config fault. Naming the cause separately from the
+symptom is the whole point. No customer notification toggle, matching the other `agent_channel_*` and
+`host_*` operator events.
+
+Source: `documentation/audits/DIAG-agent-channel-2026-07-26.md`.
+
 ## v0.73.2 — sync `hostInstallVersion` → 1.19.0 (R-50 island host-install) (2026-07-25)
 
 `hostInstallVersion` (the script version the operator customer page's install-command generator

hub/internal/api/handler.go

@@ -1563,15 +1563,15 @@ var allowedEventTypes = map[string]bool{
 	// controller v0.134.1 — enlarged offsite push refused by the quota gate (warning; the controller's
 	// dynamic Hungarian message is customer-grade — deliberately NO customerMessages entry, which would
 	// discard the numbers (templates.go:129 priority)).
-	"offbox_enlarge_blocked":      true,
+	"offbox_enlarge_blocked": true,
 	// controller v0.142.0 — offsite-repo continuity: the remote repo is orphaned (reinstall shape) /
 	// was reset (move-aside + re-init). Customer-grade messages below.
-	"offbox_repo_orphaned":        true,
-	"offbox_repo_reset":           true,
-	"storage_disconnected":        true,
-	"storage_reconnected":         true,
-	"disk_warning":                true,
-	"disk_critical":               true,
+	"offbox_repo_orphaned": true,
+	"offbox_repo_reset":    true,
+	"storage_disconnected": true,
+	"storage_reconnected":  true,
+	"disk_warning":         true,
+	"disk_critical":        true,
 	// controller v0.169.0 — per-disk SMART degradation (Rendben→Figyelmeztetés/Hiba). The controller
 	// sends a dynamic Hungarian message (disk label + the triggering attribute names), so — like
 	// offbox_enlarge_blocked — there is deliberately NO customerMessages entry (which would discard the
@@ -1594,6 +1594,10 @@ var allowedEventTypes = map[string]bool{
 	"agent_channel_construction_error": true,
 	"agent_channel_unknown":            true,
 	"agent_channel_recovered":          true,
+	// controller v0.173.0 (R-77): controller.yaml and bootstrap.json disagree on local_api.endpoint.
+	// Operator-only, deliberately NOT an agent_channel_* type — during the 2026-07-25 island-migration
+	// outage the generic "unreachable" alert was the only signal and it hid a specific config fault.
+	"local_api_endpoint_drift": true,
 	// Hub-generated events
 	"node_stale":     true,
 	"node_down":      true,