night 2026-10-22: README (backup.volumes excluded, the capped second-drive copy), CONTEXT, REPORT — four fixes on main, not released (0.340.0 next)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -1392,6 +1392,19 @@ retired in v0.126.0 when the moved blocks were legitimately rewritten onto the s
   fallback is a state-only tier (unit + mandatory; optional skipped, honest reason). **NETWORK (NAS)
   storage is never a tier-2 target** — pinned or auto (F-6C-1: rsync `-og` under root_squash →
   wrong-owner restore). Restore reads v2 behind the marker gate; a pre-v2 copy is refused.
+- **The copy runs in a memory-capped container (unreleased, rides 0.340.0; R-1214).** A plain `rsync` charges its page
+  cache to the guest and pushes the apps' working set out (on the 8 GB box: memory „full" pressure > 20 % for minutes at
+  03:30). `rsyncMirror` now runs `rsync -a --delete` in `docker run --rm --memory 512m --memory-swap 512m --network none`
+  of the controller's own image, the source mounted read-only — only when both paths are clean, under `/mnt/`, and
+  contain no symlink (`tier2CappedPath`, `filepath.EvalSymlinks(p) == p`: a link could point the mount elsewhere). A
+  docker start error (exit 125) falls back to plain rsync; any other failure is returned. Measured on 9202 (4 GB, 1.8 GB
+  held, 6 GB copy): full stall 5.7 s → 0.37 s. Tests `r1214_capped_copy_test.go`.
+- **A template may leave a named volume out of every backup (unreleased, rides 0.340.0; R-49, operator D21 = B).**
+  `.felhom.yml` `backup.volumes: [{name: <volume>, class: excluded}]` — every named volume is dumped except
+  `<project>_<name>` (`appbackup.ExcludedDockerVolumes` → `backup.Manager.dumpableVolumes`), so it leaves Tier 1, Tier 2
+  and off-site at once and the stale clean-up removes the old tar. Only `excluded` acts; an undeclared name is ignored
+  and logged; a list that would exclude ALL of an app's named volumes is refused whole. First user: Immich's
+  `immich_ml_cache` (model weights; Immich re-downloads them). Design: `07` §6.2.
 
 **Per-app Tier 2 contents by app type:**