B1: data-migration engine (MigrateAll + MigrateApp) + backup mutual-exclusion

internal/stacks/migrate.go: crash-safe, resumable namespace migration over the
controller's /mnt RW mount. Two entry points (whole-namespace + per-app) share one
journaled pipeline: validate -> stop -> copy (rsync -a --checksum, additive; conflict-
merge walk for non-app content) -> verify -> flip+redeploy (RedeployFromEnv) -> cleanup.
CLEANUP (the only destructive step) is gated on all units verified AND all apps
redeployed. Single-flight; mutual exclusion with the backup orchestrator (Change 3).
Non-hollow tests incl. mutation-proven collision + cleanup-gate companions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/backup/backup.go

@@ -36,6 +36,11 @@ type Manager struct {
 	discoverDBs  func(ctx context.Context) ([]DiscoveredDB, error)
 	importDBDump func(ctx context.Context, db DiscoveredDB, dumpPath string) error
 
+	// migrationRunning, if set, reports whether a data migration is in progress. The scheduled
+	// backup paths skip when it returns true (Change 3 — backup ↔ migration mutual exclusion), so a
+	// nightly dump/Tier-2 can't race a migration copy/cleanup on the same drive.
+	migrationRunning func() bool
+
 	mu         sync.Mutex
 	lastDBDump *DBDumpStatus
 	running    bool
@@ -158,8 +163,23 @@ func (m *Manager) groupStacksByDrive() map[string][]StackSummary {
 	return result
 }
 
+// SetMigrationRunningCheck wires the mutual-exclusion guard (Change 3): when fn() reports a
+// migration is active, the scheduled backup paths skip rather than race it.
+func (m *Manager) SetMigrationRunningCheck(fn func() bool) {
+	m.migrationRunning = fn
+}
+
+// migrationActive reports whether a migration is in progress (false when no check is wired).
+func (m *Manager) migrationActive() bool {
+	return m.migrationRunning != nil && m.migrationRunning()
+}
+
 // RunDBDumps discovers and dumps all databases to per-drive, per-app paths.
 func (m *Manager) RunDBDumps(ctx context.Context) error {
+	if m.migrationActive() {
+		m.logger.Printf("[INFO] [backup] DB dump kihagyva: migráció folyamatban")
+		return nil
+	}
 	if err := m.acquireRunning(); err != nil {
 		return err
 	}

controller/internal/backup/migration_exclusion_test.go

@@ -0,0 +1,38 @@
+package backup
+
+import (
+	"context"
+	"io"
+	"log"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
+)
+
+// TestRunDBDumps_SkippedWhileMigrating asserts the scheduled DB-dump path SKIPS when a migration is
+// active (Change 3 — backup ↔ migration mutual exclusion), rather than racing the migration. The
+// companion: without the migrationActive guard, RunDBDumps would proceed (and a non-nil migration
+// check would not matter) — this test FAILS because lastDBDump would be set / discovery attempted.
+func TestRunDBDumps_SkippedWhileMigrating(t *testing.T) {
+	cfg := &config.Config{}
+	cfg.Paths.SystemDataPath = "/mnt/sys_drive"
+	m := NewManager(cfg, nil, log.New(io.Discard, "", 0))
+	m.SetMigrationRunningCheck(func() bool { return true })
+
+	if err := m.RunDBDumps(context.Background()); err != nil {
+		t.Fatalf("RunDBDumps should skip cleanly, got %v", err)
+	}
+	// Skipped before runDBDumpsInternal → no status recorded and the running flag never taken.
+	if m.lastDBDump != nil {
+		t.Errorf("DB dump ran despite an active migration (lastDBDump set)")
+	}
+	if m.IsRunning() {
+		t.Errorf("running flag left set after a skipped dump")
+	}
+
+	// With no migration active, the guard does not block (it proceeds into discovery).
+	m.SetMigrationRunningCheck(func() bool { return false })
+	if m.migrationActive() {
+		t.Errorf("migrationActive should be false when the check returns false")
+	}
+}

controller/internal/backup/tier2.go

@@ -200,6 +200,10 @@ func (m *Manager) RunAllTier2() {
 	if m.stackProvider == nil {
 		return
 	}
+	if m.migrationActive() {
+		m.logger.Printf("[INFO] [backup] Tier 2 kihagyva: migráció folyamatban")
+		return
+	}
 	var n int
 	for _, stack := range m.stackProvider.ListDeployedStacks() {
 		if m.stackProvider.GetStackHDDPath(stack.Name) == "" {