v0.210.0 — R-259 and R-258: two pictures that were not true

Both are one shape: something the box already knows, drawn as its opposite.

R-259 — A DISK WE FAILED TO READ WAS DRAWN AS A HEALTHY EMPTY DISK. readDiskUsage
(internal/system/info_linux.go) logged a statfs failure at DEBUG and returned, leaving the caller's
TotalGB/UsedGB/AvailGB/Percent at zero — and usageColor(0) is "nominal". The dashboard's
most-looked-at meter therefore rendered "0.0 GB / 0.0 GB (0%)" with a 0%-wide bar in the healthy
colour. "We could not look" and "there is plenty of room" were the same picture.

readDiskUsage now returns whether the measurement succeeded; SystemInfo gains DiskKnown and
HDDKnown (HDDConfigured is not a substitute: it says a path was configured, not that reading it
worked); and the template draws NO figure, NO percentage and NO meter fill when unknown, saying
"A tarhely merete most nem olvashato ki." instead. A healthy box is byte-identical, colour band
included.

This session rules the convention (felhom.eu CONTEXT.md S-39): an explicit `...Known bool` companion
beside the figures, checked in the template — the shape Offbox.StatsKnown already uses, whose own
comment says "a 0%-wide bar over an unread store is a picture of emptiness, and a picture is a
claim". Pointers and separate error fields are both legitimate Go, but a codebase with three
dialects cannot be gated (ROADMAP G-3 was blocked on exactly this). Existing call sites NOT
converted.

R-258 — THE PER-APP BACKUP TICK WAS GREEN ON PRESENCE, AND RED ONLY ON A GLOBAL CONDITION.
buildAppBackupRows set Tier1LastStatus from status.LastDBDump.Success, which is the box's single
most recent dump RUN, whichever app it belonged to. An app whose own dump failed showed a tick as
long as some other app dumped successfully afterwards; an app with no database took the nil branch
and went green on the mere existence of a restore point.

appDumpVerdict now reads THIS app's own entries in DBDumpStatus.Results (matched on
DumpResult.DB.StackName, failure = non-nil Error). Three states: any failing database -> error; all
clean -> ok; no result recorded -> NO verdict and no icon, titled "Errol a mentesrol nincs
eredmenyunk." The recovery unit carries no per-run outcome of its own, so green cannot honestly be
derived from presence. The global tier1DBStatus label is untouched — it is correct as a global.

RECENCY IS DELIBERATELY NOT ADDED. A tick over a three-week-old restore point is a real weakness,
but an age threshold means inventing a number and the time is already printed beside the icon.
Recorded as an observation, not changed.

AN EXISTING TEST WAS ASSERTING THE DEFECT AND WAS CORRECTED, NOT DELETED:
TestBuildAppBackupRows_Tier1FromRestorePoints expected "ok" for a status with no LastDBDump at all —
green from nothing but a file's existence. It now expects no verdict; its real subject, the
Tier1LastRun time, is unchanged.

The dashboard test EXTRACTS the meter block from the shipped template rather than copying it: a
copied block drifts, and a drifted copy passes while the page it claims to cover has changed — the
fixture-is-not-the-wire mistake this project has now hit twice.

Six red-proofs across both parts, each with the mutation asserted applied.

No new tag on any declared wire — report/builder.go maps into its own types and is untouched;
wire_contract_gate.py confirmed green.

go build / go vet / go test ./... green (28 packages), controller_gates --fast all OK, both run
separately from this commit.

controller/internal/system/info.go

@@ -25,12 +25,26 @@ type SystemInfo struct {
 	DiskUsedGB  float64 `json:"disk_used_gb"`
 	DiskAvailGB float64 `json:"disk_avail_gb"`
 	DiskPercent float64 `json:"disk_percent"`
+	// DiskKnown (R-259) — the statfs on "/" SUCCEEDED. Without it, a failed measurement is
+	// indistinguishable from an empty disk: readDiskUsage returned early on error and left every
+	// figure above at its zero value, `usageColor(0)` is "nominal", and the dashboard drew
+	// „0.0 GB / 0.0 GB (0%)" with a 0%-wide bar in the healthy colour. "We could not look" and
+	// "there is plenty of room" were the same picture.
+	//
+	// This is the house three-state form, and this session rules it THE one (CONTEXT S-39):
+	// an explicit `…Known bool` companion beside the figures, checked in the template before
+	// anything is rendered — the shape `Offbox.StatsKnown` already uses, whose own comment says
+	// "a 0%-wide bar over an unread store is a picture of emptiness, and a picture is a claim".
+	DiskKnown bool `json:"disk_known"`
 
 	HDDTotalGB    float64 `json:"hdd_total_gb,omitempty"`
 	HDDUsedGB     float64 `json:"hdd_used_gb,omitempty"`
 	HDDAvailGB    float64 `json:"hdd_avail_gb,omitempty"`
 	HDDPercent    float64 `json:"hdd_percent,omitempty"`
 	HDDConfigured bool    `json:"hdd_configured"`
+	// HDDKnown (R-259) — as DiskKnown, for the configured HDD path. HDDConfigured is NOT a
+	// substitute: it says a path was configured, not that reading it worked.
+	HDDKnown bool `json:"hdd_known"`
 
 	CPUPercent         float64 `json:"cpu_percent"`
 	LoadAvg1           float64 `json:"load_avg_1"`

controller/internal/system/info_linux.go

@@ -29,12 +29,12 @@ func GetInfo(hddPath string, cpuCollector *CPUCollector) SystemInfo {
 	readMemInfo(&info)
 
 	// --- Root filesystem disk usage ---
-	readDiskUsage("/", &info.DiskTotalGB, &info.DiskUsedGB, &info.DiskAvailGB, &info.DiskPercent)
+	info.DiskKnown = readDiskUsage("/", &info.DiskTotalGB, &info.DiskUsedGB, &info.DiskAvailGB, &info.DiskPercent)
 
 	// --- HDD disk usage (if configured) ---
 	if hddPath != "" {
 		info.HDDConfigured = true
-		readDiskUsage(hddPath, &info.HDDTotalGB, &info.HDDUsedGB, &info.HDDAvailGB, &info.HDDPercent)
+		info.HDDKnown = readDiskUsage(hddPath, &info.HDDTotalGB, &info.HDDUsedGB, &info.HDDAvailGB, &info.HDDPercent)
 	}
 
 	// --- Load average ---
@@ -256,11 +256,17 @@ func parseMemLine(line string) uint64 {
 	return val
 }
 
-func readDiskUsage(path string, totalGB, usedGB, availGB *float64, percent *float64) {
+// readDiskUsage fills the four figures and reports whether the measurement SUCCEEDED (R-259).
+//
+// It used to return nothing. On a statfs error it logged at DEBUG and returned, leaving the
+// caller's floats at zero — and zero renders as a healthy empty disk. The boolean is the whole
+// fix: the caller now knows the difference between "0 GB used" and "we could not look", and the
+// template refuses to draw a picture it does not have.
+func readDiskUsage(path string, totalGB, usedGB, availGB *float64, percent *float64) bool {
 	var stat syscall.Statfs_t
 	if err := syscall.Statfs(path, &stat); err != nil {
 		debugf("[DEBUG] [system] readDiskUsage: statfs(%q) failed: %v", path, err)
-		return
+		return false
 	}
 
 	bsize := uint64(stat.Bsize)
@@ -277,6 +283,7 @@ func readDiskUsage(path string, totalGB, usedGB, availGB *float64, percent *floa
 	}
 	debugf("[DEBUG] [system] readDiskUsage: path=%q bsize=%d total=%.1fGB used=%.1fGB avail=%.1fGB (%.1f%%)",
 		path, bsize, *totalGB, *usedGB, *availGB, *percent)
+	return true
 }
 
 // readLoadAvg reads 1/5/15 minute load averages from /proc/loadavg.