R-889: every disk percent is df's (used / (used + available)); the tile says Rendszer, not Rendszer (/) (09 decision 138)

The box divided used by the whole filesystem, so the 5 % reserved for root made a full disk read ~5 points low
(61.8 of 68.7 GB = 90 % where df said 95 %) and the fill alarms fire late. One function, DFUsedPercent, now serves
GetDiskUsage, readDiskUsage, the recovery-unit headroom projection and the deploy page's free percent. Tests use
numbers measured on demo-hp 9201 (/mnt/sys_drive: old 21.5 %, df 23 %); a source scan refuses a percent divided by
the whole filesystem (red-proved by putting the old line back). The label measured the docker data volume, not /.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/system/dfpercent.go

@@ -0,0 +1,20 @@
+package system
+
+// DFUsedPercent is the used percentage the way `df` prints it: used / (used + available). The blocks reserved for root
+// (5 % on ext4 by default) are in neither term, so a full disk reads 100 % here. Every disk percent the box shows or
+// alarms on is computed by this one function (R-889, operator ruling 2026-10-06 — `09` §3 decision 138): until then
+// the box divided by the whole filesystem and read ~5 points LOW on a full disk (61.8 of 68.7 GB = 90 % where `df`
+// said 95 %). `df` rounds up; this does not, so the two agree within one point. Units only need to match.
+// Pinned by TestDFUsedPercent_MatchesDFOnRealNumbers and TestR889_EveryDiskPercentIsTheDFOne.
+func DFUsedPercent(used, avail float64) float64 {
+	if used <= 0 && avail <= 0 {
+		return 0
+	}
+	if used < 0 {
+		used = 0
+	}
+	if avail < 0 {
+		avail = 0
+	}
+	return used / (used + avail) * 100
+}