feat: drive migration & Tier 2 restic deprecation (v0.18.0)

Phase 1: Deprecate restic as Tier 2 method (rsync only), auto-migrate on startup
Phase 2: Enhanced per-app migration with backup awareness, DB dump copy, auto-cleanup
Phase 3: Full drive migration with decommissioned state, rollback support, wizard UI
Phase 4: Hub report includes decommissioned drive state

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/backup/crossdrive.go

@@ -102,8 +102,8 @@ func (r *CrossDriveRunner) RunAppBackup(ctx context.Context, stackName string) e
 	})
 
 	start := time.Now()
-	r.logger.Printf("[INFO] Cross-drive backup starting: %s → %s (method: %s)",
-		stackName, cfg.DestinationPath, cfg.Method)
+	r.logger.Printf("[INFO] Cross-drive backup starting: %s → %s (rsync)",
+		stackName, cfg.DestinationPath)
 
 	// Trigger fresh DB dump for this app before cross-drive backup
 	if r.dbDumper != nil {
@@ -130,15 +130,7 @@ func (r *CrossDriveRunner) RunAppBackup(ctx context.Context, stackName string) e
 		}
 	}
 
-	var runErr error
-	switch cfg.Method {
-	case "rsync":
-		runErr = r.runRsyncBackup(ctx, stackName, cfg.DestinationPath, mounts)
-	case "restic":
-		runErr = r.runResticBackup(ctx, stackName, cfg.DestinationPath, mounts)
-	default:
-		runErr = fmt.Errorf("unknown backup method: %s", cfg.Method)
-	}
+	runErr := r.runRsyncBackup(ctx, stackName, cfg.DestinationPath, mounts)
 
 	duration := time.Since(start)
 
@@ -150,11 +142,9 @@ func (r *CrossDriveRunner) RunAppBackup(ctx context.Context, stackName string) e
 
 	// Calculate backup size
 	var sizeHuman string
-	if cfg.Method == "rsync" {
-		destDir := AppSecondaryRsyncPath(cfg.DestinationPath, stackName)
-		if sz, err := dirSizeBytes(destDir); err == nil {
-			sizeHuman = humanizeBytes(sz)
-		}
+	destDir := AppSecondaryRsyncPath(cfg.DestinationPath, stackName)
+	if sz, err := dirSizeBytes(destDir); err == nil {
+		sizeHuman = humanizeBytes(sz)
 	}
 
 	r.logger.Printf("[INFO] Cross-drive backup completed: %s (%s)", stackName, duration.Round(time.Second))
@@ -209,6 +199,18 @@ func (r *CrossDriveRunner) IsRunning(stackName string) bool {
 	return r.running[stackName]
 }
 
+// AnyRunning returns true if any cross-drive backup is currently in progress.
+func (r *CrossDriveRunner) AnyRunning() bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	for _, running := range r.running {
+		if running {
+			return true
+		}
+	}
+	return false
+}
+
 // ValidateDestination checks that the destination path exists, is writable,
 // and has sufficient free space. System-drive destinations get stricter limits
 // (≥10 GB free, <90% used) to protect OS stability; external drives just need
@@ -217,6 +219,9 @@ func (r *CrossDriveRunner) ValidateDestination(path string) error {
 	if path == "" {
 		return fmt.Errorf("destination path is empty")
 	}
+	if r.sett.IsDecommissioned(path) {
+		return fmt.Errorf("destination %s is decommissioned — choose an active drive", path)
+	}
 	if _, err := os.Stat(path); os.IsNotExist(err) {
 		return fmt.Errorf("destination %s does not exist", path)
 	}
@@ -326,108 +331,6 @@ func (r *CrossDriveRunner) runRsyncBackup(ctx context.Context, stackName, destBa
 	return nil
 }
 
-// --- restic ---
-
-func (r *CrossDriveRunner) runResticBackup(ctx context.Context, stackName, destBase string, mounts []string) error {
-	repoPath := SecondaryResticRepoPath(destBase)
-
-	// Get or create the cross-drive restic password
-	password, err := r.sett.GetOrCreateCrossDrivePassword()
-	if err != nil {
-		return fmt.Errorf("getting restic password: %w", err)
-	}
-
-	// H6: Write password to temp file with safe cleanup order (close before deferred remove).
-	pwFile, err := os.CreateTemp("", "felhom-crossdrive-pw-*")
-	if err != nil {
-		return fmt.Errorf("creating password file: %w", err)
-	}
-	pwPath := pwFile.Name()
-	if _, err := pwFile.WriteString(password); err != nil {
-		pwFile.Close()
-		os.Remove(pwPath)
-		return fmt.Errorf("writing password file: %w", err)
-	}
-	pwFile.Close()
-	defer os.Remove(pwPath)
-
-	// Ensure repo is initialized
-	if err := r.ensureResticRepo(ctx, repoPath, pwPath); err != nil {
-		return err
-	}
-
-	// Run restic backup
-	args := []string{
-		"backup", "--repo", repoPath,
-		"--password-file", pwPath,
-		"--tag", stackName,
-		"--tag", "cross-drive",
-	}
-	// Include user data (HDD mounts)
-	args = append(args, mounts...)
-	// Include app config dir (compose + app.yaml + .felhom.yml)
-	if composePath, ok := r.stackProvider.GetStackComposePath(stackName); ok {
-		args = append(args, filepath.Dir(composePath))
-	}
-	// Include DB dump dir for this app (from its home drive)
-	appDrive := r.getAppDrivePath(stackName)
-	dumpDir := AppDBDumpPath(appDrive, stackName)
-	if _, err := os.Stat(dumpDir); err == nil {
-		args = append(args, dumpDir)
-	}
-
-	// Include infrastructure paths (same as primary restic)
-	args = append(args, r.stacksDir)
-	if _, err := os.Stat(r.controllerYAMLPath); err == nil {
-		args = append(args, r.controllerYAMLPath)
-	}
-
-	cmd := exec.CommandContext(ctx, "restic", args...)
-	r.logger.Printf("[DEBUG] restic backup: %v", args)
-	if out, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("restic backup failed: %v (%s)", err, strings.TrimSpace(string(out)))
-	}
-
-	// H5: Prune old snapshots to prevent unbounded accumulation.
-	return r.pruneResticRepo(ctx, repoPath, pwPath)
-}
-
-// pruneResticRepo forgets old snapshots in a cross-drive restic repo, keeping recent ones.
-func (r *CrossDriveRunner) pruneResticRepo(ctx context.Context, repoPath, pwPath string) error {
-	args := []string{
-		"forget", "--repo", repoPath,
-		"--password-file", pwPath,
-		"--keep-daily", "7",
-		"--keep-weekly", "4",
-		"--prune",
-	}
-	cmd := exec.CommandContext(ctx, "restic", args...)
-	r.logger.Printf("[DEBUG] restic forget (prune): %s", repoPath)
-	if out, err := cmd.CombinedOutput(); err != nil {
-		// Non-fatal: log warning but don't fail the backup
-		r.logger.Printf("[WARN] restic forget failed for %s: %v (%s)", repoPath, err, strings.TrimSpace(string(out)))
-	}
-	return nil
-}
-
-func (r *CrossDriveRunner) ensureResticRepo(ctx context.Context, repoPath, pwFile string) error {
-	// Check if repo config exists
-	if _, err := os.Stat(filepath.Join(repoPath, "config")); err == nil {
-		return nil // already initialized
-	}
-
-	if err := os.MkdirAll(repoPath, 0755); err != nil {
-		return fmt.Errorf("creating restic repo dir: %w", err)
-	}
-
-	cmd := exec.CommandContext(ctx, "restic", "init", "--repo", repoPath, "--password-file", pwFile)
-	r.logger.Printf("[INFO] Initializing cross-drive restic repo at %s", repoPath)
-	if out, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("restic init failed: %v (%s)", err, strings.TrimSpace(string(out)))
-	}
-	return nil
-}
-
 // copyStackDBDumps copies DB dump files for the given stack from its home drive.
 // DB dumps are at <drive>/backups/primary/<stack>/db-dumps/<stack>_<dbtype>.sql.
 func (r *CrossDriveRunner) copyStackDBDumps(stackName, destDir string) error {
@@ -537,11 +440,11 @@ func (r *CrossDriveRunner) AutoEnableSmallApps() {
 			continue
 		}
 
-		// Find destination: first storage path that differs from the app's home drive
+		// Find destination: first active storage path that differs from the app's home drive
 		appDrive := r.getAppDrivePath(stack.Name)
 		var destPath string
 		for _, sp := range storagePaths {
-			if sp.Path != appDrive {
+			if sp.Path != appDrive && !sp.Disconnected && !sp.Decommissioned {
 				destPath = sp.Path
 				break
 			}