R-203: the app and its backup look in the same directory — one resolver, every caller

appbackup's path helpers take a NAMESPACE ROOT. Five call sites passed a bare DRIVE path.
On an enrolled drive the two coincide, so nothing showed; on the system-data fallback they
differ by exactly the felhom-data segment, and the app then bound a directory the off-site
capture set never looked at -- while the run reported ok. Measured live on demo-hp: the app
wrote to /mnt/sys_drive/userdata/media/books, the capture set looked for
/mnt/sys_drive/felhom-data/userdata/media/books.

THE RULE NOW HAS ONE EXPRESSION. appbackup.NamespaceRootFor / IsEnrolledDrive encode the
drive-kind comparison; backup.Manager.namespaceRoot and stacks.Manager.inGuest delegate to
it. There were already TWO copies and they differed -- the backup package's compared without
filepath.Clean, the stacks package's with it, so a trailing slash from config would have
flipped the mode in one and not the other.

Sites routed through it:
  - stacks/deploy.go withPathVars -> ${USERDATA_PATH}   (the live defect)
  - appexport/fabplan.go + export.go                     (via a new provider method)
  - web/handlers.go FileBrowser mounts                   (latent: the system drive is
    deliberately never a registered StoragePath, so this is the identity today)

ComputeFabBuckets now receives the namespace root, which is what ComputeCaptureSet has always
received -- so the export's classified paths and the backup's capture set describe the same
directories by construction instead of by coincidence.

Tests are table-driven over BOTH drive kinds, because this survived by being invisible on the
kind that already worked. Red-proofs observed: restoring the bare-path call fails the
system-drive row with the two paths differing by /felhom-data; inverting the drive-kind
comparison fails every enrolled row.

controller/internal/stacks/deploy.go

@@ -581,7 +581,7 @@ func (m *Manager) composeExecWithEnv(dir string, env map[string]string, args ...
 		cmdEnv = append(cmdEnv, fmt.Sprintf("%s=%s", k, v))
 	}
 	cmdEnv = append(cmdEnv, fmt.Sprintf("DOMAIN=%s", m.cfg.Customer.Domain))
-	cmdEnv = withPathVars(cmdEnv, env["HDD_PATH"], m.GetImportRoot())
+	cmdEnv = withPathVars(cmdEnv, env["HDD_PATH"], m.sysDataPath, m.GetImportRoot())
 	return m.composeExecCustomEnv(dir, cmdEnv, args...)
 }
 
@@ -597,9 +597,13 @@ func (m *Manager) composeExecWithEnv(dir string, env map[string]string, args ...
 // An unresolvable importRoot is left UNSET on purpose (the caller logs it): compose then fails loudly
 // on an unresolved ${IMPORT_PATH} rather than silently falling back to a per-drive path, which would
 // recreate the dead-drop-zone shape R-75 exists to remove.
-func withPathVars(cmdEnv []string, hdd, importRoot string) []string {
+func withPathVars(cmdEnv []string, hdd, sysDataPath, importRoot string) []string {
 	if hdd != "" {
-		cmdEnv = append(cmdEnv, "USERDATA_PATH="+appbackup.UserdataDir(hdd))
+		// R-203: UserdataDir takes a NAMESPACE ROOT, not a bare drive path. Passing `hdd` straight in
+		// bound <hdd>/userdata, which equals the namespace root only on an ENROLLED drive. On the
+		// system-data fallback it is one segment short, so the app wrote to a directory the off-site
+		// capture set never looked at — and the run still reported ok. Measured live on demo-hp.
+		cmdEnv = append(cmdEnv, "USERDATA_PATH="+appbackup.UserdataDir(appbackup.NamespaceRootFor(hdd, sysDataPath)))
 	}
 	if importRoot != "" {
 		cmdEnv = append(cmdEnv, "IMPORT_PATH="+importRoot)

controller/internal/stacks/manager.go

@@ -1196,7 +1196,7 @@ func (m *Manager) stackEnv(stackDir string) []string {
 		// the namespace root (the chosen StoragePath: a Model-A user drive's mount, or the SSD's
 		// felhom-data dir), so the catalog's ${USERDATA_PATH}/... mounts resolve under userdata/.
 		// IMPORT_PATH (R-75) rides along but is derived from the SYSTEM drive, never from HDD_PATH.
-		env = withPathVars(env, appCfg.Env["HDD_PATH"], m.GetImportRoot())
+		env = withPathVars(env, appCfg.Env["HDD_PATH"], m.sysDataPath, m.GetImportRoot())
 	}
 
 	// App-email relay env (appended LAST so it wins over any app.yaml default). Returns nil unless

controller/internal/stacks/migrate.go

@@ -277,8 +277,24 @@ func (m *Manager) startMigration(scope, sourcePath, appName, targetPath string,
 // inGuest reports whether drivePath is a user drive (its in-guest mount IS the felhom-data namespace
 // root) vs the system/SSD path (which holds a felhom-data SUBDIR). Compares cleaned paths so the
 // decision is stable regardless of slash style.
+// StackNamespaceRoot resolves an app's felhom-data NAMESPACE ROOT from its HDD_PATH (R-203). Exported
+// because the export adapter needs the same answer the backup side already computes, and only this
+// Manager holds the system-data path. Empty HDD_PATH → empty (the caller decides what that means).
+func (m *Manager) StackNamespaceRoot(name string) string {
+	cfg := m.LoadAppConfigByName(name)
+	if cfg == nil {
+		return ""
+	}
+	hdd := cfg.Env["HDD_PATH"]
+	if hdd == "" {
+		return ""
+	}
+	return appbackup.NamespaceRootFor(hdd, m.sysDataPath)
+}
+
 func (m *Manager) inGuest(drivePath string) bool {
-	return filepath.Clean(drivePath) != filepath.Clean(m.sysDataPath)
+	// R-203: the ONE expression of the rule now lives in appbackup; this is the stacks-side name for it.
+	return appbackup.IsEnrolledDrive(drivePath, m.sysDataPath)
 }
 
 // appSourceNS resolves an app's current source drive path + felhom-data namespace root from its

controller/internal/stacks/userdata_belt_test.go

@@ -78,8 +78,9 @@ func TestEnsureUserdataMounts_CreatesBeltDirs(t *testing.T) {
 // adds nothing when it's empty. Regression for the initial-deploy bug where ${USERDATA_PATH} resolved
 // to "" and bound a bogus root-owned dir at the container root.
 func TestWithPathVars(t *testing.T) {
+	const sysDataPath = "/mnt/sys_drive"
 	const importRoot = "/mnt/sys_drive/felhom-data/userdata/import"
-	got := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-usb", importRoot)
+	got := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-usb", sysDataPath, importRoot)
 	want := "USERDATA_PATH=" + appbackup.UserdataDir("/mnt/felhom-usb")
 	found := false
 	for _, e := range got {
@@ -91,7 +92,7 @@ func TestWithPathVars(t *testing.T) {
 		t.Errorf("USERDATA_PATH not injected: got %v, want %q", got, want)
 	}
 	// companion: empty HDD_PATH → no USERDATA_PATH at all
-	for _, e := range withPathVars([]string{"DOMAIN=x"}, "", importRoot) {
+	for _, e := range withPathVars([]string{"DOMAIN=x"}, "", sysDataPath, importRoot) {
 		if strings.HasPrefix(e, "USERDATA_PATH") {
 			t.Errorf("USERDATA_PATH must NOT be set when HDD_PATH is empty: %q", e)
 		}
@@ -103,15 +104,16 @@ func TestWithPathVars(t *testing.T) {
 // root-owned dir at the container root. And the unresolvable case must leave the variable UNSET —
 // never fall back to a per-drive path, which would recreate the dead-drop-zone shape R-75 removes.
 func TestWithPathVars_ImportPath(t *testing.T) {
+	const sysDataPath = "/mnt/sys_drive"
 	const importRoot = "/mnt/sys_drive/felhom-data/userdata/import"
 
-	got := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/hdd_1", importRoot)
+	got := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/hdd_1", sysDataPath, importRoot)
 	if !slices.Contains(got, "IMPORT_PATH="+importRoot) {
 		t.Errorf("IMPORT_PATH not injected: got %v", got)
 	}
 	// It is CANONICAL: it must not be derived from HDD_PATH. A second app on a different drive gets
 	// the identical value — that is the whole point of the canonical root.
-	other := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/nvme-1tb", importRoot)
+	other := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/nvme-1tb", sysDataPath, importRoot)
 	if !slices.Contains(other, "IMPORT_PATH="+importRoot) {
 		t.Errorf("IMPORT_PATH must not vary with HDD_PATH: got %v", other)
 	}
@@ -121,7 +123,7 @@ func TestWithPathVars_ImportPath(t *testing.T) {
 		}
 	}
 	// Unresolvable → UNSET (compose then fails loudly on ${IMPORT_PATH}).
-	for _, e := range withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/hdd_1", "") {
+	for _, e := range withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/hdd_1", sysDataPath, "") {
 		if strings.HasPrefix(e, "IMPORT_PATH") {
 			t.Errorf("IMPORT_PATH must NOT be set when the import root is unresolvable: %q", e)
 		}

controller/internal/stacks/userdata_path_r203_test.go

@@ -0,0 +1,60 @@
+package stacks
+
+import (
+	"strings"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/appbackup"
+)
+
+// R-203 Scenario A/B — what the DEPLOY sets as ${USERDATA_PATH}, table-driven over both drive kinds.
+// This is the site the drill caught: on the system-data fallback the app bound a directory the
+// off-site capture set never looked at, and the run still reported ok.
+func TestWithPathVars_UserdataRootByDriveKind(t *testing.T) {
+	const sys = "/mnt/sys_drive"
+	const importRoot = "/mnt/sys_drive/felhom-data/userdata/import"
+	cases := []struct{ name, hdd, want string }{
+		// Scenario B — enrolled drives: BYTE-IDENTICAL to pre-R-203.
+		{"enrolled usb", "/mnt/felhom-usb", "/mnt/felhom-usb/userdata"},
+		{"enrolled hdd", "/mnt/felhom-drives/hdd_1", "/mnt/felhom-drives/hdd_1/userdata"},
+		// Scenario A — the system-data fallback: the canonical namespace root, which is what the
+		// skeleton builder creates and what the capture set resolves against.
+		{"system drive", "/mnt/sys_drive", "/mnt/sys_drive/felhom-data/userdata"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := withPathVars([]string{"DOMAIN=x"}, tc.hdd, sys, importRoot)
+			want := "USERDATA_PATH=" + tc.want
+			for _, e := range got {
+				if e == want {
+					return
+				}
+			}
+			var actual string
+			for _, e := range got {
+				if strings.HasPrefix(e, "USERDATA_PATH=") {
+					actual = e
+				}
+			}
+			t.Fatalf("USERDATA_PATH = %q, want %q — the app would bind a directory the backup does not capture", actual, want)
+		})
+	}
+}
+
+// The deploy-time bind and the backup-time capture root must be the SAME directory. Asserted against
+// the resolver the off-site capture set actually uses, so the two cannot drift apart again silently.
+func TestDeployBindMatchesCaptureRoot(t *testing.T) {
+	const sys = "/mnt/sys_drive"
+	for _, hdd := range []string{"/mnt/felhom-usb", "/mnt/felhom-drives/hdd_1", "/mnt/sys_drive"} {
+		var bind string
+		for _, e := range withPathVars(nil, hdd, sys, "") {
+			if strings.HasPrefix(e, "USERDATA_PATH=") {
+				bind = strings.TrimPrefix(e, "USERDATA_PATH=")
+			}
+		}
+		captureRoot := appbackup.UserdataDir(appbackup.NamespaceRootFor(hdd, sys))
+		if bind != captureRoot {
+			t.Fatalf("drive %q: deploy binds %q, backup captures %q", hdd, bind, captureRoot)
+		}
+	}
+}