C6B-F1 cause 3: anti-hollow guard refuses a needs_hdd bundle with zero data

assertBundleDataComplete's claimed-tar checks pass trivially when discovery
claims nothing (0 claims -> 0 checks) — the exact blind spot that shipped a
4.17 GB app as a 2308-byte config-only bundle. A needs_hdd manifest with
neither HDD data nor volume data now fails the job with an honest Hungarian
error. Red-proof recorded: removing the assertion returns scenario D to
silent hollow success.

controller/internal/appexport/export_additive_test.go

@@ -268,3 +268,39 @@ func TestFabRoundTrip_UserdataPlacement(t *testing.T) {
 		t.Fatalf("restored content differs: got %q want %q", got, marker)
 	}
 }
+
+// Scenario D (§7) — the anti-hollow net (C6B-F1 cause 3): a needs_hdd app where discovery finds
+// NOTHING (mounts absent on disk, no volumes) must FAIL the export with an honest Hungarian
+// error — never success-with-a-hollow-bundle. RED-PROOF: remove the needs_hdd&&no-data assertion
+// from assertBundleDataComplete → this test fails (the pre-fix silent hollow success).
+func TestExport_NeedsHDDNoDataAtAllRefused(t *testing.T) {
+	srcStack := t.TempDir()
+	os.WriteFile(filepath.Join(srcStack, "docker-compose.yml"),
+		[]byte("services:\n  hdd-app:\n    image: alpine\n"), 0644)
+
+	hdd := t.TempDir()
+	prov := &hddProvider{
+		rtProvider: &rtProvider{stackDir: srcStack, stacksDir: t.TempDir(), deployed: true},
+		// the mount does NOT exist on disk and there are no volumes — total discovery blank
+		mounts: []string{filepath.Join(hdd, "userdata")}, hddPath: hdd,
+	}
+	drive := t.TempDir()
+	e := NewExporter(prov, log.New(io.Discard, "", 0), "test")
+	if err := e.StartExport(ExportRequest{StackName: "hdd-app", DestDrive: drive}); err != nil {
+		t.Fatalf("StartExport: %v", err)
+	}
+	job := waitJob(t, e)
+	msg := jobErr(job)
+	if msg == "" {
+		t.Fatal("a needs_hdd export with ZERO discovered data must FAIL — got success (the hollow bundle)")
+	}
+	if !strings.Contains(msg, "nem tartalmaz alkalmazásadatot") {
+		t.Errorf("expected the honest Hungarian no-app-data error, got %q", msg)
+	}
+	entries, _ := os.ReadDir(ExportDir(drive))
+	for _, en := range entries {
+		if strings.HasSuffix(en.Name(), ".fab") {
+			t.Fatalf("a hollow bundle was produced: %s", en.Name())
+		}
+	}
+}