Physical-disk identity of every storage place + POST /disks/same-disk (felhom.eu architecture/16 §3/§4)

The agent names the physical disk(s) under each storage place from /sys, udev and /proc/mounts only
(partition -> disk, dm/LVM thin -> slaves, loop -> backing file), keys them (eui / serial:<bus>:<model>
:<serial> / vendor WWN) and says proven or unknown (vm, network, usb_bridge, weak_wwn, no_serial).
GET /disks and the hub report's storage_targets gain kind, physical_disks, identity,
identity_reason (golden updated; the hub copy changes in the same session). POST /disks/same-disk
maps two guest paths to places the agent itself made and answers {different, proven, reason};
an absent drive is unmapped, never the root disk. Tests on fixture trees for every spike case,
red-proofed. CHANGELOG entry follows the release (release-complete gate).

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

internal/localapi/disks.go

@@ -188,6 +188,13 @@ type DiskInfo struct {
 	// device that exposes no SMART (USB bridge, unread) is ABSENT, not a misleading zero-value UNKNOWN;
 	// the controller feature-detects presence and renders "Nincs adat" when nil (never alarms).
 	Smart *hub.SmartSummary `json:"smart,omitempty"`
+	// Physical-disk identity (v0.157.0, felhom.eu architecture/16-storage-physical-identity.md §3) — the
+	// same agent-computed verdict the hub report carries. Empty when not computed (an absent drive, no
+	// resolver). Additive; an older controller ignores it.
+	Kind           string   `json:"kind,omitempty"`
+	PhysicalDisks  []string `json:"physical_disks,omitempty"`
+	Identity       string   `json:"identity,omitempty"`
+	IdentityReason string   `json:"identity_reason,omitempty"`
 }
 
 // handleDisks lists the host's drives + data-bearing flags (read-only/benign).
@@ -227,6 +234,8 @@ func (s *Server) handleDisks(w http.ResponseWriter, r *http.Request, vmid int) {
 			// really is the target. Reported here so the controller can name the drive in an
 			// absent-target alarm and hide the destructive controls the agent would refuse anyway.
 			BackupTarget: t.Name == primaryTargetID,
+			// `16` §3: copied from the observer, which computed it from /sys + udev.
+			Kind: t.Kind, PhysicalDisks: t.PhysicalDisks, Identity: t.Identity, IdentityReason: t.IdentityReason,
 		}
 		// Intermediary model: the stable in-guest path + whether felhom-data is bound under the parent.
 		// Only user-data /mnt/<name> drives have a guest path (system/backup mounts never cross in).
@@ -398,6 +407,10 @@ func (s *Server) handleDisks(w http.ResponseWriter, r *http.Request, vmid int) {
 						di.Smart = &sm
 					}
 				}
+				// `16` §3: a registry drive's identity, judged on its OWN mount only (never root's).
+				if p, kind, ok := s.ownMountIdentity(d.MountPath); ok {
+					di.Kind, di.PhysicalDisks, di.Identity, di.IdentityReason = kind, p.PhysicalDisks, p.Identity, p.Reason
+				}
 				// R-118: statfs ONLY while the drive's device is present. With the device gone the raw
 				// mountpoint reverts to a bare directory on the ROOT filesystem, and statfs would report
 				// pve-root's size as this drive's (measured: a 4 GB drive advertising 46 GiB). Same trap