Review fixes for 0.340.0: C5 a catch-up releases the whole-guest backup when its backup legs end (red-proved); C3 the R-1187 c refusal text fits an unhealthy app; C6 two comments; C8 README backup.volumes wording; unreleased

controller/README.md

@@ -1399,10 +1399,11 @@ retired in v0.126.0 when the moved blocks were legitimately rewritten onto the s
   contain no symlink (`tier2CappedPath`, `filepath.EvalSymlinks(p) == p`: a link could point the mount elsewhere). A
   docker start error (exit 125) falls back to plain rsync; any other failure is returned. Measured on 9202 (4 GB, 1.8 GB
   held, 6 GB copy): full stall 5.7 s → 0.37 s. Tests `r1214_capped_copy_test.go`.
-- **A template may leave a named volume out of every backup (unreleased, rides 0.340.0; R-49, operator D21 = B).**
+- **A template may leave a named volume out of the app-data backups (unreleased, rides 0.340.0; R-49, operator D21 = B).**
   `.felhom.yml` `backup.volumes: [{name: <volume>, class: excluded}]` — every named volume is dumped except
   `<project>_<name>` (`appbackup.ExcludedDockerVolumes` → `backup.Manager.dumpableVolumes`), so it leaves Tier 1, Tier 2
-  and off-site at once and the stale clean-up removes the old tar. Only `excluded` acts; an undeclared name is ignored
+  and off-site at once and the stale clean-up removes the old tar. NOT left out: the household's `.fab` export (it still
+  carries the volume) and the whole-guest PBS snapshot (it holds the guest's disk). Only `excluded` acts; an undeclared name is ignored
   and logged; a list that would exclude ALL of an app's named volumes is refused whole. First user: Immich's
   `immich_ml_cache` (model weights; Immich re-downloads them). Design: `07` §6.2.