felhom-controller/REPORT.md

REPORT — felhom-controller v0.51.0

Offsite-backup UI (felhom-pbs = real DR) + Model-A double-nest fix. Pairs with felhom-agent v0.28.0 (whole-guest backup re-targeted to the offsite PBS tier). Live-deployed in guest 9201 on demo-felhom.

Backups page — whole-guest backup shown as real DR

• backupTargetLabel returns "Biztonsági szerver – külön hardver (PBS)" for a PBS-stored backup (detected via backupIsPBS on the target id / archive volid), so the customer sees the backup survives a host hardware failure.
• The app-data section's "Távoli mentés" card stops reading "nincs beállítva": new guestBackupView.Offsite flag drives it to "külön hardveren (PBS)" with a ✓ when the whole-guest backup landed on PBS.
• The restore-test "Visszaállítás ellenőrizve" trust signal is unchanged (already wired).
• Live: agent /backup/status reports target_id=felhom-pbs; /restore-test/status reports pass:true, verified:"boot+running", source_tier:"pbs" → the page renders the PBS label, the offsite card, and verified-restorable.

Model-A double-nest fix

• Under slice-10 Model A the host agent binds <drive>/felhom-data onto the guest mountpoint, so an enrolled drive's in-guest mount IS the felhom-data namespace root (basename need not be felhom-data, e.g. /mnt/felhom-usb). The backup path helpers were re-prepending felhom-data, producing .../felhom-data/felhom-data/... on the host (confirmed live: /mnt/felhom-usb/felhom-data/felhom-data/...).
• appbackup path helpers now take a namespace ROOT (no internal felhom-data join) plus a new NamespaceRoot(drivePath, inGuestDrive). backup.Manager.namespaceRoot/AppNamespaceRoot resolve provenance (drivePath != systemDataPath ⟺ a registered in-guest drive → namespace root as-is; the SSD-only systemDataPath fallback appends felhom-data).
• All parallel constructions updated coherently so writes, deletion (GetStackBackupData, RemoveStack backups-base + ProtectedHDDPaths — legacy double-nest dirs KEPT protected), the wipe-warning secondary scan, and export all agree. api.router passes the namespace root across the package boundary. Result: a drive-resident app's DB-dump lands single-nested at <drive>/backups/... in-guest = <drive>/felhom-data/backups/... on the host.
• New appbackup test asserts no doubled felhom-data segment for an in-guest drive and exactly one for the system fallback. Full go build ./... + tests green.

Decommission (P3) — NO controller change

• Permanent decommission is operator-signature-gated (never customer-confirmable), so it is wired entirely agent-side (hub jobs-queue → signed-jobs runner). The controller deliberately exposes no decommission UI. (felhom-agent v0.28.0.)

Live deploy

• gitea.dooplex.hu/admin/felhom-controller:0.51.0 running + healthy in guest 9201 (bootstrap-launched via /etc/felhom-controller-image; prior 0.50.0). Startup clean (catalog sync, health ok, FileBrowser mounts synced).