v0.308.0: controller batch 2026-10-12 — clear-address warning (R-922), secret sweep over every page (R-255), read_failed (R-266), no NVMe heat band (R-333), share globe (R-577), Hungarian dates and numbers (R-562), lost-drive option pinned (R-521)

Operator rulings 2026-10-12, 09 §3 decisions 196, 204-207, 223, 227. MinAgent 0.131.0 unchanged.
R-255's sweep found one leak, fixed here: an optional-config secret_input was rendered into its
settings page; it is now revealed on demand. Hungarian parity fixtures re-captured once for R-562.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/report/builder.go

@@ -91,7 +91,7 @@ func BuildReport(
 
 	// Storage — root filesystem + all registered storage paths
 	r.Storage = []StorageReport{
-		{Mount: "/", Label: "SSD", TotalGB: sysInfo.DiskTotalGB, UsedGB: sysInfo.DiskUsedGB, Percent: sysInfo.DiskPercent},
+		rootStorageEntry(sysInfo),
 	}
 	for _, sp := range storagePaths {
 		if sp.Decommissioned {
@@ -328,3 +328,14 @@ func buildStacksReport(stackMgr *stacks.Manager) StacksReport {
 
 	return sr
 }
+
+// rootStorageEntry is the report's "/" entry. When the root statfs failed (DiskKnown false) the
+// zeros it carries are not a measurement, so the entry says so (R-266): the hub skips banding it
+// instead of reading a failed read as an empty disk.
+func rootStorageEntry(sysInfo system.SystemInfo) StorageReport {
+	return StorageReport{
+		Mount: "/", Label: "SSD",
+		TotalGB: sysInfo.DiskTotalGB, UsedGB: sysInfo.DiskUsedGB, Percent: sysInfo.DiskPercent,
+		ReadFailed: !sysInfo.DiskKnown,
+	}
+}

controller/internal/report/storage_readfailed_test.go

@@ -0,0 +1,37 @@
+package report
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/system"
+)
+
+// R-266: a failed root statfs reaches the hub as read_failed, not as a 0-of-0 disk the hub would band
+// as "0 % used". A measured disk carries no read_failed at all (omitempty), so an old hub sees no change.
+func TestRootStorageEntry_ReadFailed(t *testing.T) {
+	failed := rootStorageEntry(system.SystemInfo{DiskKnown: false})
+	if !failed.ReadFailed {
+		t.Fatal("root statfs failed (DiskKnown false) but the storage entry does not say read_failed")
+	}
+	if failed.TotalGB != 0 || failed.UsedGB != 0 || failed.Percent != 0 || failed.Mount != "/" {
+		t.Errorf("failed entry changed its numbers or mount: %+v", failed)
+	}
+	b, _ := json.Marshal(failed)
+	if !strings.Contains(string(b), `"read_failed":true`) {
+		t.Errorf("wire form lacks read_failed: %s", b)
+	}
+
+	ok := rootStorageEntry(system.SystemInfo{DiskKnown: true, DiskTotalGB: 100, DiskUsedGB: 40, DiskPercent: 40})
+	if ok.ReadFailed {
+		t.Error("a measured root disk is marked read_failed")
+	}
+	b, _ = json.Marshal(ok)
+	if strings.Contains(string(b), "read_failed") {
+		t.Errorf("a measured disk must not carry read_failed on the wire: %s", b)
+	}
+	if ok.TotalGB != 100 || ok.Percent != 40 {
+		t.Errorf("measured numbers lost: %+v", ok)
+	}
+}

controller/internal/report/types.go

@@ -94,6 +94,11 @@ type StorageReport struct {
 	Disconnected   bool    `json:"disconnected,omitempty"`
 	Decommissioned bool    `json:"decommissioned,omitempty"`
 	MigratedTo     string  `json:"migrated_to,omitempty"`
+	// ReadFailed (R-266, v0.308.0) — the measurement behind this entry FAILED (today: the root "/"
+	// statfs, SystemInfo.DiskKnown false). The numbers stay the zeros the failed read left; the hub
+	// must not band them as "0 % used". Absent (false) means the numbers were measured. Pinned by
+	// TestRootStorageEntry_ReadFailed.
+	ReadFailed bool `json:"read_failed,omitempty"`
 }
 
 // ContainerReport holds aggregate and per-container status.