Safe removal (R-1044), found on Tester 1 G4: the drive gate leaves a safely removed drive alone (no false RETURNED/ABSENT, no mail); presence = backing device, not the agent's state

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/intermediary_test.go

@@ -291,3 +291,20 @@ func TestPlanDriveGates(t *testing.T) {
 		t.Errorf("internal SSD/system path must NEVER be gated (only /mnt/felhom-drives/ externals)")
 	}
 }
+
+// R-1044 (found on Tester 1, Part G4, 2026-10-15): a SAFELY REMOVED drive belongs to reconcileEjectedDrives only. The
+// periodic gate saw it still bound during the 32-second removal and called it RETURNED (clearing the removal's
+// disconnected mark), then ABSENT 30 s later — with a „disconnected" mail for a removal the household asked for.
+// COMPANION RED-PROOF: drop the EjectedAt skip in planDriveGates → both cases below produce an action. Restored.
+func TestPlanDriveGates_SkipsSafelyRemovedDrive(t *testing.T) {
+	p := "/mnt/felhom-drives/media_d"
+	removed := settings.StoragePath{Path: p, Disconnected: true, EjectedAt: "2026-10-15T08:10:20Z"}
+	still := []agentapi.DiskInfo{{GuestPath: p, MountPath: "/mnt/media_d", State: "attached", BoundUnderParent: true}}
+	if a := planDriveGates([]settings.StoragePath{removed}, still); len(a) != 0 {
+		t.Fatalf("a safely removed drive still bound during the removal must not be RETURNED by the gate: %+v", a)
+	}
+	removed.Disconnected = false
+	if a := planDriveGates([]settings.StoragePath{removed}, nil); len(a) != 0 {
+		t.Fatalf("a safely removed drive that is gone must not be gated ABSENT (no mail for a safe removal): %+v", a)
+	}
+}