Document the disk health field

Records why there are two sources and why they are not reconciled, so the next person does not simplify the ATA SMART path back in and silently blind the fleet on NVMe hardware.

Also notes that diskhealth is per physical device and is not the same list as disks, and that a null predictfailure is unknown rather than healthy.

plugins/endpoints/AGENT-CONTRACT.md

@@ -68,6 +68,17 @@ arrays. `adopt` is first-contact only.
   "osinfo": { /* opaque object: build, version, install date */ },
   "domain": "shopfloor.example.com",  // domain or workgroup membership
   "pendingreboot": false,             // omit when unknown; absent != false
+  "diskhealth": [                     // per PHYSICAL device; see notes
+    {
+      "deviceid": "0",
+      "model": "Samsung SSD 990 PRO 1TB",
+      "mediatype": "SSD",
+      "bustype": "NVMe",
+      "healthstatus": "Healthy",
+      "predictfailure": false,        // precomputed; null = drive did not answer
+      "source": "physicaldisk"        // or "diskdrive"
+    }
+  ],
   "usercontext": {                    // omitted entirely when nobody is signed in
 	"netuse": [
 	  {
@@ -133,6 +144,22 @@ Notes:
   genuinely empty now"; omit when you simply did not collect it this cycle.
 - `pendingreboot` follows that rule strictly: omit it when the check failed. A
   literal `false` asserts the endpoint is confirmed NOT holding a reboot.
+- `diskhealth` is per PHYSICAL device and is NOT the same list as `disks`, which
+  is per volume. One physical drive can back several volumes or none the
+  operator sees, so the two do not share a key and are not merged.
+- `diskhealth` carries BOTH agent sources and the server does not reconcile
+  them. `source: "physicaldisk"` is MSFT_PhysicalDisk, the only source that
+  reports NVMe at all - the classic ATA SMART class
+  (`MSStorageDriver_FailurePredictStatus`) returns zero instances on an NVMe
+  machine, so an agent collecting only that would report an empty health list on
+  modern hardware and look like "no problems". `source: "diskdrive"` is
+  Win32_DiskDrive.Status, covering ATA/SATA and hosts where the Storage
+  namespace is unavailable. When both answer for one drive and disagree, both
+  rows are shown; that disagreement is the signal.
+- `predictfailure` is precomputed by the agent so an alert is a boolean test
+  rather than a string match against a Windows enum the server would have to
+  keep in sync. `null` means the drive did not answer: unknown, NOT healthy.
+  `healthstatus` keeps the human-readable source value alongside it.
 - `usercontext` is gathered by a probe the agent runs inside the signed-in
   user's session, because mapped drives, user-owned listeners and idle time do
   not exist in the agent's own LocalSystem session 0. It is omitted when no one