fill watch: one warning per filesystem (R-1371) — committed, not released

On a box whose guest has one data volume the two built-in fill targets, "/"
(the controller's overlay on the Docker data volume) and /mnt/sys_drive, are one
filesystem. The target list was de-duplicated by path only, so one fill would
send two warnings under two names.

fillTargets now keeps one target per filesystem; the first stays (app area,
system area, drives). The identity is system.FilesystemKey, not st_dev alone:
inside the container "/" is an overlay with its own device number, so an
overlay path takes the device of a Docker-kept file on the data-root
(/etc/hostname, /etc/hosts, /etc/resolv.conf). Measured read-only on demo-hp
9201/9202 and the N100 on 2026-11-10.

Tests: TestR1371_* (3), TestFilesystemKey_* (2). Red seen three times.
No version, no image, no floor: it waits for a release session.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,21 +1,24 @@
-# REPORT — v0.351.0 released: old test builds and old infrastructure images are deleted (2026-11-09, attended)
+# REPORT — one fill warning per filesystem (R-1371) — committed, NOT released (2026-11-10, operator brief)
 
-**Plain words first.** Each box now deletes old controller test builds and old copies of the system images (traefik,
-cloudflared, FileBrowser, Samba) by itself, about 3 minutes after the controller starts. It always keeps the running
-version and the one before it. Released on the operator's „go with A"; every box gets it through the floor.
+**Plain words first.** The controller watches how full the disks are. On a box with one data volume it watched that
+volume twice, under two names. One full disk would have sent two warnings. The controller now watches each filesystem
+once. This is a commit only. No version, no image, no floor change. No box has it. It waits for the next release.
+
+The full report of the run is in `felhom.eu`: `REPORT-endings-kernels-fixes-2026-11-10.md`.
 
 | | |
 |---|---|
-| Version | 0.351.0 from `27360d6a` (CI 2603), image `sha256:1d90563c443022770b2db90a7730f1ea5aea45cc5b0fa64fec9823d60d42d97f`; MinAgent 0.158.1 unchanged |
-| Rulings | `09` §3 decision 56 amended, decision 285 new — operator 2026-11-09 |
-| Tests | `TestControllerRetention_OldTestBuildsGo`, `_BoxOnATestBuildIsJudged`, `TestInfraRetention_*` (4); six code mutants each turned a test red |
-| rc.1 live | Tester 1 (by hand): 12 controller images and 2 infrastructure images deleted, 37 → 24 images, about 1 GB freed (the test builds share most layers) |
-| Release live | per-box floors 12:14 UTC; Tester 1, demo-hp, demo-felhom on 0.351.0 by 12:15; each box's pass deleted what the rule says (demo-felhom: 1 controller + 5 infrastructure images) |
-| Box walk | green on all three; `https_only_check.py` rc 0 |
-| Floor | global 0.351.0 / MinAgent 0.158.1 at 12:18 UTC, read back from the hub log and the configuration page; per-box floors cleared |
+| Change | `fillTargets` / `fillTargetsBy` in `controller/cmd/controller/main.go`; `system.FilesystemKey` (new, `controller/internal/system/fskey*.go`) |
+| Rule | One watch target per filesystem. The first stays: app area, then system area, then drives. A path that cannot be identified is kept |
+| The trap | Inside the container "/" is an overlay. It has its own device number (139 against 64519 on demo-hp). A plain device compare changes nothing on a box. The key of an overlay path is the device of a file Docker keeps on its data volume (`/etc/hostname`, `/etc/hosts`, `/etc/resolv.conf`) |
+| Measured | Read-only, 2026-11-10, demo-hp guests 9201 and 9202 and the N100: felhom.eu `documentation/audits/space-list-2026-11-10/evidence/extra/fs-identity.txt` |
+| Tests | `TestR1371_OneFillSendsOneWarning`, `TestR1371_TargetsByFilesystem`, `TestR1371_ProductionListUsesTheRealIdentity`, `TestFilesystemKey_AnOverlayRootIsTheDockerDataRoot`, `TestFilesystemKey_RealSyscalls` |
+| Red seen | 3 times: no filesystem check (2 warnings); the production list not wired to the real identity; an overlay keeping its own device number |
+| Gates | `python3 scripts/controller_gates.py --fast` |
+| Not proven | On a box. No disk was filled, so two real warnings were never seen; the double count is read from the target list and the measured filesystems |
+| Not fixed here | The guest's own root disk (`/opt/docker/stacks` lies on it) has no fill watcher. It is a design point in felhom.eu `16-storage-physical-identity.md` |
+| Side effect | A registered drive that lies on the same filesystem as a built-in area is now watched under the area's name |
+| Machines | None changed by this commit. The measurement was read-only |
 
-Evidence: felhom.eu `documentation/audits/release-2026-11-09/`.
-
-**Note.** A box that updates from a test build keeps that test build as its „previous" (Tester 1 now keeps rc.1 and
-deleted 0.350.0). That is the rule as written (the previous comes from the self-update's record); only test boxes run
-test builds.
+**Next.** A release session builds it. Then read the watch list in the controller's log on a one-volume box: it must
+name the data volume once.