R-203: the app and its backup look in the same directory — one resolver, every caller

appbackup's path helpers take a NAMESPACE ROOT. Five call sites passed a bare DRIVE path.
On an enrolled drive the two coincide, so nothing showed; on the system-data fallback they
differ by exactly the felhom-data segment, and the app then bound a directory the off-site
capture set never looked at -- while the run reported ok. Measured live on demo-hp: the app
wrote to /mnt/sys_drive/userdata/media/books, the capture set looked for
/mnt/sys_drive/felhom-data/userdata/media/books.

THE RULE NOW HAS ONE EXPRESSION. appbackup.NamespaceRootFor / IsEnrolledDrive encode the
drive-kind comparison; backup.Manager.namespaceRoot and stacks.Manager.inGuest delegate to
it. There were already TWO copies and they differed -- the backup package's compared without
filepath.Clean, the stacks package's with it, so a trailing slash from config would have
flipped the mode in one and not the other.

Sites routed through it:
  - stacks/deploy.go withPathVars -> ${USERDATA_PATH}   (the live defect)
  - appexport/fabplan.go + export.go                     (via a new provider method)
  - web/handlers.go FileBrowser mounts                   (latent: the system drive is
    deliberately never a registered StoragePath, so this is the identity today)

ComputeFabBuckets now receives the namespace root, which is what ComputeCaptureSet has always
received -- so the export's classified paths and the backup's capture set describe the same
directories by construction instead of by coincidence.

Tests are table-driven over BOTH drive kinds, because this survived by being invisible on the
kind that already worked. Red-proofs observed: restoring the bare-path call fails the
system-drive row with the two paths differing by /felhom-data; inverting the drive-kind
comparison fails every enrolled row.

controller/internal/appexport/estimate_volsize_test.go

@@ -24,6 +24,10 @@ func (p *hddProvider) GetStackNeedsHDD(string) bool      { return true }
 func (p *hddProvider) GetStackHDDMounts(string) []string { return p.mounts }
 func (p *hddProvider) GetStackHDDPath(string) string     { return p.hddPath }
 func (p *hddProvider) GetImportRoot() string             { return "" } // R-75: no import binds in this fixture
+
+// R-203: these fixtures use ENROLLED drive paths, where the namespace root IS the drive path.
+// Delegating keeps that identity explicit rather than hardcoding it.
+func (p *hddProvider) GetStackNamespaceRoot(name string) string { return p.GetStackHDDPath(name) }
 func (p *hddProvider) GetStackClassifiedBinds(string) ([]appbackup.ClassifiedBind, bool) {
 	return p.binds, p.hasBinds
 }

controller/internal/appexport/export.go

@@ -659,7 +659,9 @@ func (e *Exporter) exportHDDData(req ExportRequest, dataDir string, manifest *Ma
 	// Task 4: the class-scoped plan. Legacy / no-block apps get an EMPTY plan (all mounts kept, root
 	// tar with zero excludes) → byte-identical v0.130.0 capture.
 	plan := e.computeFabPlan(req, mounts)
-	ud := appbackup.UserdataDir(filepath.Clean(e.provider.GetStackHDDPath(stackName)))
+	// R-203: a NAMESPACE ROOT, not the drive path (identical on an enrolled drive; one segment short
+	// on the system-data fallback).
+	ud := appbackup.UserdataDir(filepath.Clean(e.provider.GetStackNamespaceRoot(stackName)))
 
 	claimed := make(map[string]string) // subdir → mount that claimed it
 	for _, mount := range mounts {

controller/internal/appexport/fabplan.go

@@ -34,8 +34,12 @@ func (e *Exporter) computeFabPlan(req ExportRequest, mounts []string) fabPlan {
 	if !has {
 		return fabPlan{} // legacy: byte-identical v0.130.0 capture
 	}
-	hddPath := filepath.Clean(e.provider.GetStackHDDPath(req.StackName))
-	fb := appbackup.ComputeFabBuckets(binds, has, hddPath, e.provider.GetImportRoot())
+	// R-203: the shared resolver's root parameter is a NAMESPACE ROOT — that is what the off-site
+	// side has always passed (ComputeCaptureSet ← offbox_capture.go). This site passed the bare drive
+	// path, so on the system-data fallback the export's classified paths and the backup's capture set
+	// described DIFFERENT directories for the same declared bind. They now agree by construction.
+	nsRoot := filepath.Clean(e.provider.GetStackNamespaceRoot(req.StackName))
+	fb := appbackup.ComputeFabBuckets(binds, has, nsRoot, e.provider.GetImportRoot())
 
 	deselect := sliceSet(req.DeselectOptional)
 	optIn := sliceSet(req.OptInExcluded)
@@ -82,7 +86,10 @@ func (e *Exporter) computeFabPlan(req ExportRequest, mounts []string) fabPlan {
 	}
 
 	plan := fabPlan{SkipMounts: map[string]bool{}}
-	ud := appbackup.UserdataDir(hddPath)
+	// R-203: UserdataDir takes a NAMESPACE ROOT, not the drive path. Identical on an enrolled drive;
+	// one segment short on the system-data fallback, which is where the export plan then skipped (or
+	// failed to skip) the wrong directory.
+	ud := appbackup.UserdataDir(nsRoot)
 	for _, m := range mounts {
 		mc := filepath.Clean(m)
 		if mc == filepath.Clean(ud) {
@@ -116,8 +123,8 @@ func (e *Exporter) fabEstimateSplit(stackName string, est *ExportEstimate, volum
 	if !has {
 		return
 	}
-	hddPath := filepath.Clean(e.provider.GetStackHDDPath(stackName))
-	fb := appbackup.ComputeFabBuckets(binds, has, hddPath, e.provider.GetImportRoot())
+	nsRoot := filepath.Clean(e.provider.GetStackNamespaceRoot(stackName)) // R-203, as above
+	fb := appbackup.ComputeFabBuckets(binds, has, nsRoot, e.provider.GetImportRoot())
 	est.HasClassification = true
 
 	toItems := func(cps []appbackup.CapturePath) ([]FabItem, int64) {

controller/internal/appexport/fabplan_test.go

@@ -24,6 +24,10 @@ type fabProv struct {
 
 func (p *fabProv) GetStackHDDPath(string) string     { return p.hddPath }
 func (p *fabProv) GetImportRoot() string             { return "" } // R-75: no import binds in this fixture
+
+// R-203: these fixtures use ENROLLED drive paths, where the namespace root IS the drive path.
+// Delegating keeps that identity explicit rather than hardcoding it.
+func (p *fabProv) GetStackNamespaceRoot(name string) string { return p.GetStackHDDPath(name) }
 func (p *fabProv) GetStackHDDMounts(string) []string { return p.mounts }
 func (p *fabProv) GetStackClassifiedBinds(string) ([]appbackup.ClassifiedBind, bool) {
 	return p.binds, p.has

controller/internal/appexport/provider.go

@@ -20,6 +20,11 @@ type ExportStackProvider interface {
 	// GetImportRoot returns the CANONICAL drop-zone root (R-75), on the SYSTEM drive. ${IMPORT_PATH}
 	// binds resolve against THIS, never against GetStackHDDPath. Empty when unresolvable.
 	GetImportRoot() string
+	// GetStackNamespaceRoot returns the app's felhom-data NAMESPACE ROOT — the directory that directly
+	// contains backups/ and userdata/. It is NOT GetStackHDDPath: on an enrolled drive the two are the
+	// same, and on the system-data fallback the namespace root has one more segment (R-203). Every
+	// appbackup path helper takes THIS, never the drive path. Empty when the app has no HDD_PATH.
+	GetStackNamespaceRoot(name string) string
 	// GetStackClassifiedBinds returns the app's backup-classified compose binds + whether it carries a
 	// (valid) backup block (Task 2). Drives the `.fab` class-scoped export plan (Task 4); a legacy app
 	// (false) exports the v0.130.0 full-root capture unchanged.

controller/internal/appexport/roundtrip_test.go

@@ -38,6 +38,10 @@ func (p *rtProvider) GetStackComposePath(string) (string, bool) {
 func (p *rtProvider) GetStackHDDMounts(string) []string { return nil }
 func (p *rtProvider) GetStackHDDPath(string) string     { return "" }
 func (p *rtProvider) GetImportRoot() string             { return "" } // R-75: no import binds in this fixture
+
+// R-203: these fixtures use ENROLLED drive paths, where the namespace root IS the drive path.
+// Delegating keeps that identity explicit rather than hardcoding it.
+func (p *rtProvider) GetStackNamespaceRoot(name string) string { return p.GetStackHDDPath(name) }
 func (p *rtProvider) GetStackClassifiedBinds(string) ([]appbackup.ClassifiedBind, bool) {
 	return nil, false
 }