v0.317.0: a second copy counts only on a proven different disk; the no-drive install speaks in words (felhom.eu architecture/16, build A)

Tier-2 and the one-copy notice ask the host agent (POST /disks/same-disk, agent 0.157.0): different +
proven -> made and counted; same disk -> not made (D1); unknown (VM, hidden USB serial) -> made, not
counted, the row says why (D2); a NAS never counts and no longer hides the notice (R-1075). An older
agent keeps the st_dev rule, logged once. D4: a data-folder or media app on a box with no drive is
refused in words with a link to the drives page (R-1068's raw-error half). MinAgent 0.157.0.

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

controller/internal/stacks/deploy.go

@@ -390,6 +390,14 @@ func (m *Manager) DeployStack(req DeployRequest) (string, error) {
 			}
 		}
 
+		// D4 (`16` §5, R-1068): a path field left empty on a box with NO drive at all is not a form mistake —
+		// the household has nowhere to put the data. Say so in words with the way forward; never the field
+		// name. (sys_drive is never suggested: it rides in every whole-guest copy, `16` §11.)
+		if field.Required && value == "" && !field.AfterStart && field.Type == "path" && m.defaultMediaDrive() == "" {
+			clearDeploying()
+			m.logger.Printf("[INFO] [stacks] Deploy %s: refused — the box has no drive for %s (D4)", req.StackName, field.EnvVar)
+			return "", util.MsgErrorf(ErrNeedsDrive, "err.stacks.needs_drive")
+		}
 		// Validate required fields (an after_start field is asked after the start — R-1028)
 		if field.Required && value == "" && !field.AfterStart {
 			clearDeploying()