Media build part 1 (unreleased): real restart (R-1026), media apps on every PRESENT drive via an owned compose override (R-1023), dead-drive check from mountinfo, removal never deletes shared/:ro binds (R-1027), safety list knows userdata (R-1032), no drive question for media apps (R-1031)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/metadata.go

@@ -59,6 +59,9 @@ type Metadata struct {
 	// SetupGate (v0.280.0, `09` §3 decision 46): a fresh install is CLOSED to everyone but the household until the
 	// app's first setup is done — for an app whose first visitor creates the admin. See setup_gate.go.
 	SetupGate bool `yaml:"setup_gate,omitempty" json:"setup_gate,omitempty"`
+	// MediaLibrary (v0.313.0, R-1023, `15-media-library.md` §2/§3): the app is a MEDIA app — the controller adds one
+	// bind per present, enrolled drive of `<drive>/userdata/media[/<folder>]` at the same path. See media_library.go.
+	MediaLibrary *MediaLibrarySpec `yaml:"media_library,omitempty" json:"media_library,omitempty"`
 	// SetupDoneProbe (v0.280.0) is the app's own read-only "an admin exists" status; absent = the household's button.
 	SetupDoneProbe *SetupDoneProbe `yaml:"setup_done_probe,omitempty" json:"setup_done_probe,omitempty"`
 	// SignupBlock (v0.281.0, `09` §3 decision 47): a traefik matcher for the app's own sign-up address, closed once the
@@ -531,6 +534,11 @@ func (m *Metadata) HasDeployFields() bool {
 func (m *Metadata) UserFacingFields() []DeployField {
 	var fields []DeployField
 	for _, f := range m.DeployFields {
+		// R-1031 (v0.313.0): a media app sees EVERY drive, so the wizard does not ask it for one; its own config goes
+		// on the default drive (DeployStack fills HDD_PATH). Pinned by TestR1031_MediaAppIsNotAskedForADrive.
+		if m.MediaLibrary != nil && f.EnvVar == "HDD_PATH" {
+			continue
+		}
 		if f.Type != "domain" && f.Type != "secret" {
 			fields = append(fields, f)
 		}