Account for runtime RCON passwords in config drift

docs/guides/maintenance.md

@@ -148,7 +148,9 @@ Missing keys block teardown. Submitted rebuild verification continues while paus
 
 Drift includes missing promoted files, changed bytes, and extra files in managed
 script, config, and plugin directories. Config comparison includes the composed
-baseline, overlays, and the selected map. Unmanaged default config is exempt until
+baseline, overlays, selected map, and the RCON password assigned to the current
+instance at launch. Launches and beta config writes use the same password rendering
+as drift checks, including Plutainer's startup newline handling. Unmanaged default config is exempt until
 a baseline is promoted. Missing mounts are scan errors, not empty directories.
 Routine drift scans run every five minutes per server, reducing file traffic
 while health observations continue every minute. **Check now**, a replacement
@@ -156,6 +158,14 @@ registration, or a new lifecycle submission bypasses the drift interval. Failed
 file scans retry on the next observer pass; post-rebuild verification still reads
 fresh files.
 
+For older instances whose only difference is Plutainer's expected password rewrite,
+a successful scan reconciles the recorded config hash without changing server
+files or rebuilding. The entire file must match the expected runtime config;
+unexpected passwords and other config edits still count as drift. Current launch
+credentials remain available through history cleanup while the instance is live.
+If that launch history was already expired, the check reports unavailable evidence
+instead of guessing a password or requesting a rebuild.
+
 Drift repair creates a Campaign capturing observed differences and requests a
 Provisioning rebuild. The Campaign observes that rebuild without requesting
 another restart. Its detection evidence and the actual launch recipe remain