v0.75.0: gate userdata MkdirAll on a live mountpoint (no writes into an absent drive)

Belt (ensureUserdataMounts) + FileBrowser sync skip ensure/mount when an external
drive root is not a live mountpoint -> no 'mkdir userdata: permission denied' + no
rootfs-shadow during a drive-absent window. System/local path never gated. Reuses
system.IsMountPoint; matches planDriveGates external-only rule. T1-T4 + red-proofs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/stacks/manager.go

@@ -17,6 +17,7 @@ import (
 	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/crypto"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/system"
 )
 
 // ContainerState represents the current state of a container.
@@ -97,6 +98,9 @@ type Manager struct {
 	backupRunning func() bool         // mutual exclusion with the backup orchestrator (Change 3)
 	migDoneHook   func(*MigrationJob) // fired on successful completion (decommission policy lives in caller)
 	testSeams     *migSeams           // nil in production; tests inject fakes
+	// isMountPoint reports whether a path is a live mountpoint; defaults to system.IsMountPoint.
+	// Injectable so the userdata-belt drive-absent gate is testable (a t.TempDir is never a real mount).
+	isMountPoint func(string) bool
 }
 
 // NewManager creates a new stack manager.
@@ -116,10 +120,11 @@ func NewManager(cfg *config.Config, logger *log.Logger) (*Manager, error) {
 	}
 
 	return &Manager{
-		cfg:        cfg,
-		logger:     logger,
-		composeCmd: composeCmd,
-		stacks:     make(map[string]*Stack),
+		cfg:          cfg,
+		logger:       logger,
+		composeCmd:   composeCmd,
+		stacks:       make(map[string]*Stack),
+		isMountPoint: system.IsMountPoint,
 	}, nil
 }
 
@@ -130,6 +135,15 @@ func (m *Manager) ensureUserdataMounts(stackDir string, env []string) {
 	if userdataPath == "" {
 		return
 	}
+	// Drive-absent gate: an external drive root (not the system/local path) that isn't currently a live
+	// mountpoint means the drive is detached. Creating ${USERDATA_PATH}/... now would write app data onto
+	// the guest ROOTFS, shadowed when the drive returns (data-integrity + rootfs-fill hazard). Skip — the
+	// app is held by the drive gate (planDriveGates). The system/local path is legitimately not a
+	// mountpoint, so it is never gated.
+	if hdd := envLookup(env, "HDD_PATH"); hdd != "" && hdd != m.sysDataPath && !m.isMountPoint(hdd) {
+		m.logger.Printf("[INFO] [stacks] userdata belt: drive %s not mounted — skipping ensure (held by drive gate)", hdd)
+		return
+	}
 	composePath := filepath.Join(stackDir, "docker-compose.yml")
 	for _, src := range ParseComposeUserdataMounts(composePath, userdataPath) {
 		if err := appbackup.EnsureUserdataDir(src); err != nil {