v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

${IMPORT_PATH} = <system namespace root>/userdata/import — ONE drop-zone per box,
on the system drive, injected at BOTH compose-env builders with NO per-drive
fallback (unresolvable leaves it unset so compose fails loudly rather than
quietly building a second, dead drop-zone).

Third BindRoot (RootImport) + Import list in BackupSpec, extended through
ValidateBackupSpec/ClassifyBinds. Load-bearing: a stale `userdata: import/<app>`
entry against the moved bind would be a WHOLE-BLOCK reject, taking the app's
mandatory hdd classification with it.

Exhaustive-root audit: resolveAbs/structuralGuard/ComputeCaptureSet/
ComputeFabBuckets now take importRoot explicitly (an import bind resolved
against hddPath would name a directory on the wrong drive); unresolvable is
refused loudly into Skipped. GetImportRoot added to both provider interfaces.

Catalog-derived skeleton: UserdataSkeleton() -> UserdataSkeletonCarry() +
BuildUserdataSkeleton(), SORTED. The carry-list makes zero-removals true by
construction (`documents` is in no catalog app but on both boxes) and is the
fresh-box floor. The sort is not tidiness: the naive map-order derivation
measured 20 distinct outputs from 20 identical runs, which with fbNeedsRecreate
is a fleet-wide FileBrowser restart loop.

One authoritative compose parser: ParseComposeUserdataMounts now delegates to
ParseComposeClassifiableBinds. Import root excluded from per-app migration.

Surfaces: FileBrowser /srv/beolvasas source; app-page "Hova tegyem a fajlokat?"
with PathEscape deep links (never QueryEscape) and class-driven copy;
data_paths: annotation with the Fork-3 asymmetry; system-owned beolvasas SMB
share refused server-side at handler AND store, button omitted in template.

Caught on the way: the sharing template's row struct was function-local, so
adding {{if .System}} would have 500'd every share row. ShareRow is now
package-level and the render test uses the handler's own type.

Tests 915 -> 949, all green. MinAgent unchanged.

CONTEXT.md

@@ -7,7 +7,37 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-07-24 (v0.169.0 — disk-health card + degradation notification "Lemezek állapota")
+Last updated: 2026-07-26 (v0.172.0 — R-75 canonical import root + catalog-derived skeleton)
+
+> **2026-07-26 — v0.172.0 (R-75).** Spike `felhom.eu/documentation/audits/SPIKE-catalog-data-paths-2026-07-26.md`;
+> feature doc `felhom.eu/documentation/controller/import-and-data-paths.md`.
+>
+> **RULING — the import root is CANONICAL on the system drive, overriding the spike's Fork-1
+> recommendation of per-drive roots.** The spike weighed sidebar clutter and per-app link ambiguity and
+> concluded per-drive; the operator overruled it on an argument the spike missed: each drop-zone app has
+> exactly ONE ingest bind, so on a two-drive box every import folder except the app's own would look like
+> a drop-zone and silently do nothing — and because `import/*` is `class: excluded`, files stranded there
+> are never backed up either. A canonical root is the only shape with no dead drop-zone. Recorded as a
+> deliberate deviation, not an oversight.
+>
+> **Phase-0 probe changed the shape of Part 6.** The system drive is NOT a registered `StoragePath` on
+> either demo box (`/mnt/felhom-drives/hdd_1` on demo-felhom; `nvme-1tb` + `Felhom-Share` on demo-hp),
+> so `sharingResolvePath` REFUSES `<sysroot>/userdata/import` — verified against the real guard with a
+> passing control. Registering the drive was rejected (it would make the 50 GB volume holding the
+> recovery units a customer-visible drive, deploy target and wipe candidate, and `SharingDeniedRoots`
+> would then deny the namespace-consistent shape anyway). **Chosen: leave it unregistered and have the
+> controller write the `beolvasas` share directly** — the picker guard validates CUSTOMER-supplied paths,
+> a controller-generated constant is a different trust class. No guard was weakened.
+>
+> Also note: `withUserdataPath` computes `USERDATA_PATH` as `<hdd>/userdata`, NOT
+> `NamespaceRoot(hdd)/userdata`. For an app on the system drive those disagree
+> (`/mnt/sys_drive/userdata` vs the `felhom-data` namespace). Latent — no app with a userdata bind has
+> ever been deployed there — but it is a real inconsistency, left untouched here.
+>
+> The other three forks followed the spike unchanged: all-apps skeleton / deployed-only in the UI;
+> unknown role fails OPEN while a malformed path whole-block rejects; drop-zone copy driven by the
+> derived backup class.
+
 
 > **2026-07-24 — v0.169.0 (disk-health card + degradation alert).** Consumes the agent's new `smart`
 > field (agent v0.94.0; MinAgent floor unchanged — feature-detect by presence). **Rulings:** (1) ONE