v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

${IMPORT_PATH} = <system namespace root>/userdata/import — ONE drop-zone per box,
on the system drive, injected at BOTH compose-env builders with NO per-drive
fallback (unresolvable leaves it unset so compose fails loudly rather than
quietly building a second, dead drop-zone).

Third BindRoot (RootImport) + Import list in BackupSpec, extended through
ValidateBackupSpec/ClassifyBinds. Load-bearing: a stale `userdata: import/<app>`
entry against the moved bind would be a WHOLE-BLOCK reject, taking the app's
mandatory hdd classification with it.

Exhaustive-root audit: resolveAbs/structuralGuard/ComputeCaptureSet/
ComputeFabBuckets now take importRoot explicitly (an import bind resolved
against hddPath would name a directory on the wrong drive); unresolvable is
refused loudly into Skipped. GetImportRoot added to both provider interfaces.

Catalog-derived skeleton: UserdataSkeleton() -> UserdataSkeletonCarry() +
BuildUserdataSkeleton(), SORTED. The carry-list makes zero-removals true by
construction (`documents` is in no catalog app but on both boxes) and is the
fresh-box floor. The sort is not tidiness: the naive map-order derivation
measured 20 distinct outputs from 20 identical runs, which with fbNeedsRecreate
is a fleet-wide FileBrowser restart loop.

One authoritative compose parser: ParseComposeUserdataMounts now delegates to
ParseComposeClassifiableBinds. Import root excluded from per-app migration.

Surfaces: FileBrowser /srv/beolvasas source; app-page "Hova tegyem a fajlokat?"
with PathEscape deep links (never QueryEscape) and class-driven copy;
data_paths: annotation with the Fork-3 asymmetry; system-owned beolvasas SMB
share refused server-side at handler AND store, button omitted in template.

Caught on the way: the sharing template's row struct was function-local, so
adding {{if .System}} would have 500'd every share row. ShareRow is now
package-level and the render test uses the handler's own type.

Tests 915 -> 949, all green. MinAgent unchanged.

controller/internal/appexport/estimate_volsize_test.go

@@ -23,6 +23,7 @@ type hddProvider struct {
 func (p *hddProvider) GetStackNeedsHDD(string) bool      { return true }
 func (p *hddProvider) GetStackHDDMounts(string) []string { return p.mounts }
 func (p *hddProvider) GetStackHDDPath(string) string     { return p.hddPath }
+func (p *hddProvider) GetImportRoot() string             { return "" } // R-75: no import binds in this fixture
 func (p *hddProvider) GetStackClassifiedBinds(string) ([]appbackup.ClassifiedBind, bool) {
 	return p.binds, p.hasBinds
 }

controller/internal/appexport/fabplan.go

@@ -35,7 +35,7 @@ func (e *Exporter) computeFabPlan(req ExportRequest, mounts []string) fabPlan {
 		return fabPlan{} // legacy: byte-identical v0.130.0 capture
 	}
 	hddPath := filepath.Clean(e.provider.GetStackHDDPath(req.StackName))
-	fb := appbackup.ComputeFabBuckets(binds, has, hddPath)
+	fb := appbackup.ComputeFabBuckets(binds, has, hddPath, e.provider.GetImportRoot())
 
 	deselect := sliceSet(req.DeselectOptional)
 	optIn := sliceSet(req.OptInExcluded)
@@ -117,7 +117,7 @@ func (e *Exporter) fabEstimateSplit(stackName string, est *ExportEstimate, volum
 		return
 	}
 	hddPath := filepath.Clean(e.provider.GetStackHDDPath(stackName))
-	fb := appbackup.ComputeFabBuckets(binds, has, hddPath)
+	fb := appbackup.ComputeFabBuckets(binds, has, hddPath, e.provider.GetImportRoot())
 	est.HasClassification = true
 
 	toItems := func(cps []appbackup.CapturePath) ([]FabItem, int64) {

controller/internal/appexport/fabplan_test.go

@@ -23,6 +23,7 @@ type fabProv struct {
 }
 
 func (p *fabProv) GetStackHDDPath(string) string     { return p.hddPath }
+func (p *fabProv) GetImportRoot() string             { return "" } // R-75: no import binds in this fixture
 func (p *fabProv) GetStackHDDMounts(string) []string { return p.mounts }
 func (p *fabProv) GetStackClassifiedBinds(string) ([]appbackup.ClassifiedBind, bool) {
 	return p.binds, p.has

controller/internal/appexport/provider.go

@@ -17,6 +17,9 @@ type ExportStackProvider interface {
 	GetStackHDDMounts(name string) []string
 	// GetStackHDDPath returns the raw HDD_PATH env var from app.yaml.
 	GetStackHDDPath(name string) string
+	// GetImportRoot returns the CANONICAL drop-zone root (R-75), on the SYSTEM drive. ${IMPORT_PATH}
+	// binds resolve against THIS, never against GetStackHDDPath. Empty when unresolvable.
+	GetImportRoot() string
 	// GetStackClassifiedBinds returns the app's backup-classified compose binds + whether it carries a
 	// (valid) backup block (Task 2). Drives the `.fab` class-scoped export plan (Task 4); a legacy app
 	// (false) exports the v0.130.0 full-root capture unchanged.

controller/internal/appexport/roundtrip_test.go

@@ -37,6 +37,7 @@ func (p *rtProvider) GetStackComposePath(string) (string, bool) {
 }
 func (p *rtProvider) GetStackHDDMounts(string) []string { return nil }
 func (p *rtProvider) GetStackHDDPath(string) string     { return "" }
+func (p *rtProvider) GetImportRoot() string             { return "" } // R-75: no import binds in this fixture
 func (p *rtProvider) GetStackClassifiedBinds(string) ([]appbackup.ClassifiedBind, bool) {
 	return nil, false
 }