# REPORT — v0.317.0: a second copy counts only on a proven different disk; the no-drive install speaks in words (2026-10-15)

Written in ASD-STE100 Simplified Technical English. Design read first: felhom.eu `architecture/16-storage-physical-identity.md`
(§3, §4, §5 D4, §8, §10, §11), `07-backup-architecture.md` §6, `09-update-architecture.md` (MinAgent), `03-host-agent.md`.
Task: storage identity build A (operator rulings D1–D6, 2026-10-15). Agent counterpart: felhom-agent v0.157.0.

## 1. Baselines

| Repo | `main` at start | at commit |
|---|---|---|
| felhom-controller | `9cc7ffcf3b` (brief) → `48d8674876` read | rebased onto `c6a5671` (v0.316.4) |
| felhom-agent | `d2053e7d47` | `52ed52c` (v0.157.0 released) |

## 2. What changed

- `internal/backup/backup.go`: `diskRelation` — the one „same disk?" decision; asks the agent through `SetDiskJudge`; an older
  agent or an `unmapped` path keeps the st_dev rule (logged once). `offDriveCopyState` / `singleCopyWarning`: the notice by `16` §4,
  skips a NAS (R-1075), i18n.
- `internal/backup/tier2.go`, `tier2_shares.go`: target choice — same disk never; unknown made, marked `Unproven`; proven beats unknown;
  the guard re-asks right before the run. `settings.CrossDriveBackup.Unproven` records it; `handlers.go` + `backups_apps.html` show it.
- `internal/agentapi`: `FeatureSameDisk` (MinAgent 0.157.0), `Client.SameDisk`, the identity fields on `DiskInfo`.
- `internal/stacks/deploy.go`, `deploy_errors.go`, `internal/api/router.go`, `deploy.html`: D4 — `ErrNeedsDrive`, 400, `code: needs_drive`,
  the sentence and a link to the drives page.
- `cmd/controller/main.go`: the judge wired. Locales: four new keys in both files; `scripts/i18n_go_keys.json` lists them.

## 3. Tests and red-proofs

| Test | Red-proof (seen failing) |
|---|---|
| `TestDisk16_ProvenDifferent_CountedNoNotice` | — (positive control for the others) |
| `TestDisk16_SameDisk_NotMadeAndNoticeShown` | the same-disk refusal turned off → fails |
| `TestDisk16_Unknown_MadeNotCountedCannotCheck` | the unproven mark set false → fails |
| `TestDisk16_NetworkShare_NeverHidesTheNotice` | the NAS skip removed → fails (R-1075) |
| `TestDisk16_OldAgent_KeepsTheStDevRule` | fails with the same-disk refusal off |
| `TestDisk16_UnprovenCopyIsRecorded` | — |
| `TestD4_NoDriveRefusalSpeaksInWords` | the D4 branch off → fails with the OMV run's raw sentence |
| `TestD4_NeedsDriveIs400`, `TestD4_FilledPathKeepsItsOwnRefusal` | — |
| `TestDiskJudge_IsWiredAtStartup` | the judge made to never call the agent → fails |

`go test ./...` green; `controller_gates.py --fast` green except `observations` (this section fixes it). Ten i18n parity pages
refreshed with `-update-i18n-golden` after moving the old ones aside; the diff of each is ONLY the new lines (the stylesheet line
kept as stored).

## 4. Live proof

Pending at this commit — the next REPORT revision carries it (Tester 1, demo-hp, the N100, a NAS on a scratch box).

## 11. Observations

1. FILED: R-1082 — the drives page offers `/mnt/sys_drive` for attaching (R-280, the reinstall-restore way out) while `16` §11 rejects
   it for household data, and the D4 sentence links to that page. Not changed here: source and design disagree, so it is reported.