v0.318.0: the internal data place, partitions, an honest whole-box backup offer (R-1084), sys_drive never offered (R-1082)

felhom.eu architecture/16 §4-§6 (build B). MinAgent 0.157.0 — the internal place and the partitions appear only when
agent >= 0.158.0 reports them. Tests red-proved; four parity fixtures refreshed (only the new lines).

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

controller/internal/web/attach_sources.go

@@ -143,6 +143,14 @@ func readMountTable() string {
 	return string(b)
 }
 
+// mountTable is readMountTable through the mountsFn test seam (nil → the controller's real /proc/mounts).
+func (s *Server) mountTable() string {
+	if s.mountsFn != nil {
+		return s.mountsFn()
+	}
+	return readMountTable()
+}
+
 // registeredStoragePaths is the set of paths already in the registry, for the exclusion above.
 func (s *Server) registeredStoragePaths() map[string]bool {
 	out := map[string]bool{}
@@ -159,5 +167,41 @@ func (s *Server) registeredStoragePaths() map[string]bool {
 // precondition read, so the picker and the sentence pointing at it cannot disagree — the same
 // single-derivation rule R-252 applied to HasRestoreDestination.
 func (s *Server) attachableStores() []mountedStore {
-	return mountedUnregisteredStores(readMountTable(), s.registeredStoragePaths())
+	return s.attachableStoresFrom(readMountTable())
+}
+
+// attachableStoresFrom is attachableStores for a given mount table (the seam its tests use).
+func (s *Server) attachableStoresFrom(mounts string) []mountedStore {
+	sdp := ""
+	if s.cfg != nil {
+		sdp = s.cfg.Paths.SystemDataPath
+	}
+	return withoutSystemVolume(mountedUnregisteredStores(mounts, s.registeredStoragePaths()), mounts, sdp)
+}
+
+// withoutSystemVolume drops every offered store that lives on the guest's OWN data volume (R-1082, operator ruling
+// 2026-10-16 „hide it now"; felhom.eu architecture/16 §11): /mnt/sys_drive is a folder of that volume, which rides in
+// every whole-box copy, local and off-site — films put there would fill them. Excluded by DEVICE, like the rootfs
+// guard above, so a second bind of the same volume under another /mnt/<name> is hidden too. A box that already
+// REGISTERED sys_drive keeps it: this filters only what is OFFERED. systemDataPath "" falls back to the config
+// default /mnt/sys_drive (fail toward hiding). Pinned by r1082_sysdrive_hidden_test.go.
+func withoutSystemVolume(stores []mountedStore, mountsText, systemDataPath string) []mountedStore {
+	if systemDataPath == "" {
+		systemDataPath = "/mnt/sys_drive"
+	}
+	volumePaths := map[string]bool{path.Clean(systemDataPath): true, "/var/lib/felhom": true, "/var/lib/docker": true}
+	volumeDevices := map[string]bool{}
+	for _, row := range parseMountTable(mountsText) {
+		if volumePaths[path.Clean(row[1])] {
+			volumeDevices[row[0]] = true
+		}
+	}
+	out := stores[:0:0]
+	for _, m := range stores {
+		if volumeDevices[m.Device] || volumePaths[path.Clean(m.Path)] {
+			continue
+		}
+		out = append(out, m)
+	}
+	return out
 }