v0.317.0: a second copy counts only on a proven different disk; the no-drive install speaks in words (felhom.eu architecture/16, build A)

Tier-2 and the one-copy notice ask the host agent (POST /disks/same-disk, agent 0.157.0): different +
proven -> made and counted; same disk -> not made (D1); unknown (VM, hidden USB serial) -> made, not
counted, the row says why (D2); a NAS never counts and no longer hides the notice (R-1075). An older
agent keeps the st_dev rule, logged once. D4: a data-folder or media app on a box with no drive is
refused in words with a link to the drives page (R-1068's raw-error half). MinAgent 0.157.0.

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

controller/internal/web/handlers.go

@@ -1422,6 +1422,9 @@ type AppBackupRow struct {
 	// Tier2UnitStaleNotice (R-403) — non-empty when the newest run PRESERVED this copy's package
 	// instead of refreshing it, so the card cannot render a preserved package as a fresh one.
 	Tier2UnitStaleNotice string
+	// Tier2UnprovenNotice (v0.317.0, `16` D2) — non-empty when the copy sits on a drive the host agent cannot
+	// prove is another physical disk: the copy exists, it does not count as a second copy.
+	Tier2UnprovenNotice string
 
 	// Drive disconnected — app's home drive is currently disconnected
 	DriveDisconnected bool
@@ -1663,6 +1666,9 @@ func (s *Server) buildAppBackupRows(status *backup.FullBackupStatus, lang string
 				row.Tier2LastStatus = cd.LastStatus
 				row.Tier2LastSuccess = cd.LastSuccess
 				row.Tier2SuccessTracked = cd.SuccessTracked
+				if cd.Unproven {
+					row.Tier2UnprovenNotice = s.msgLang(lang, "backup.tier2.unproven")
+				}
 				// Disclose, do not hide: an older good copy AND the fact that the newest attempt failed.
 				// Suppressing the failure to keep the surface calm is a quieter version of the same lie.
 				row.Tier2StaleCopy = cd.SuccessTracked && cd.LastSuccess != "" && cd.LastStatus == "error"