v0.117.0: consuming-namespace NAS verification + deploy-view truth (RCA fixes 2+4)

statfs fsclass helper (network/autofs/stub/unknown, fail-open); probe not_network_fs
assertion (stub can never verify — red-proven); deploy-time stub refusal (idle autofs
proceeds — red-proven); distinct stub badge, stub wins over unreachable (unreachable line
byte-identical); deployed select shows stored HDD_PATH (red-proven vs IsDefault-only).
MinAgent unchanged 0.81.0. Gates green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/api/router.go

@@ -47,6 +47,10 @@ type Router struct {
 	// process back with fresh config; tests inject a recorder via SetRestarter.
 	restart func()
 
+	// classifyFSPath classifies a path's filesystem in this process's namespace (the deploy-time
+	// stub gate, RCA fix 2). Defaults to system.ClassifyPathFSTimeout; tests inject fake classes.
+	classifyFSPath func(path string) string
+
 	// triggerReportPush fires an out-of-band, non-blocking hub report push (e.g. after a
 	// geo settings change so the hub reflects the new state immediately). Nil = no-op.
 	triggerReportPush func()
@@ -95,6 +99,7 @@ func (r *Router) SetIntegrationManager(im *integrations.Manager) {
 func NewRouter(cfg *config.Config, configPath string, sett *settings.Settings, stackMgr *stacks.Manager, syncer *catalogsync.Syncer, cpuCollector *system.CPUCollector, backupMgr *backup.Manager, metricsStore *metrics.MetricsStore, updater *selfupdate.Updater, notif *notify.Notifier, logger *log.Logger) *Router {
 	r := &Router{cfg: cfg, configPath: configPath, sett: sett, stackMgr: stackMgr, syncer: syncer, cpuCollector: cpuCollector, backupMgr: backupMgr, metricsStore: metricsStore, updater: updater, notifier: notif, logger: logger}
 	r.restart = func() { gracefulSelfRestart(r.logger) }
+	r.classifyFSPath = system.ClassifyPathFSTimeout
 	return r
 }
 
@@ -102,6 +107,21 @@ func NewRouter(cfg *config.Config, configPath string, sett *settings.Settings, s
 // process is not actually killed.
 func (r *Router) SetRestarter(fn func()) { r.restart = fn }
 
+// refuseNetworkStubDeploy is the deploy-time stub gate (RCA fix 2). Non-empty return = the
+// Hungarian refusal for a registered NETWORK HDD_PATH whose filesystem in THIS namespace is a
+// local stub. Everything else proceeds: idle autofs is HEALTHY (first app access mounts it);
+// classification timeout/unknown fails OPEN (a wedged share is the unreachable badge's business);
+// local (non-network) and empty paths keep today's behavior exactly.
+func (r *Router) refuseNetworkStubDeploy(hdd string) string {
+	if hdd == "" || r.sett == nil || !r.sett.IsNetworkStoragePath(hdd) {
+		return ""
+	}
+	if r.classifyFSPath(hdd) != system.FSClassStub {
+		return ""
+	}
+	return "A kiválasztott hálózati tárhely jelenleg nem érhető el az alkalmazások környezetéből — a telepítés nem indítható. Próbálja újra pár perc múlva, vagy jelezze az üzemeltetőnek."
+}
+
 // SetReportPushTrigger wires the out-of-band hub report push used after geo changes.
 // The provided func MUST be non-blocking (it is called from request handlers).
 func (r *Router) SetReportPushTrigger(fn func()) { r.triggerReportPush = fn }
@@ -403,6 +423,16 @@ func (r *Router) deployStack(w http.ResponseWriter, req *http.Request, name stri
 		return
 	}
 
+	// RCA fix 2 (AUDIT-nas-cwa-rca-2026-07-11): a deploy targeting a registered NETWORK storage path
+	// must see a network filesystem (or its healthy idle autofs trigger) in THIS namespace — the one
+	// the app will consume the path in. A stub (plain local dir after a guest reboot) would silently
+	// send the app's data to the system drive.
+	if msg := r.refuseNetworkStubDeploy(body.Values["HDD_PATH"]); msg != "" {
+		r.logger.Printf("[WARN] [api] Deploy refused for %s: network HDD_PATH %s is a stub in the controller namespace", name, body.Values["HDD_PATH"])
+		writeJSON(w, http.StatusConflict, apiResponse{OK: false, Error: msg})
+		return
+	}
+
 	deployReq := stacks.DeployRequest{
 		StackName: name,
 		Values:    body.Values,