felhom-controller/REPORT.md

REPORT — .fab exclusion scoping (Task 4) — controller v0.136.0

Summary

Task 4: the .fab column of the matrix (SQ5 verdict + ruling #1 + Viktor's R1-C). The SQ6 over-capture is fixed for classified apps — a manual export's userdata root tar is now exclude-scoped (keeps only ancestors/descendants of a selected bind), so sibling apps' content no longer rides along; an all-excluded app produces no userdata tar at all. Mechanics unchanged from v0.130.0 (one root tar + per-mount skip), so the manifest stays v1 and the import side is untouched; legacy apps export byte-identically. Mandatory is a server-side floor; optional is a pre-selected checkbox; excluded is opt-in behind the two-number warning.

Baselines (live-verified at session start)

Repo	main @ start	Version	→
felhom-controller	5f21613	v0.135.0	v0.136.0

Files

• mod internal/appbackup/captureset.go — extracted resolveGuardCollapse (shared pipeline); new ComputeFabBuckets + FabBuckets.
• new internal/appexport/fabplan.go — fabPlan, computeFabPlan, fabUserdataExcludes + classifyFabRel, tarDirectoryExcluding, fabEstimateSplit.
• mod internal/appexport/export.go — ExportRequest += DeselectOptional/OptInExcluded; dirLister seam; exportHDDData consumes the plan; tarDirectory → thin wrapper.
• mod internal/appexport/estimate.go — ExportEstimate class-split fields (additive); FabItem.
• mod internal/appexport/provider.go + cmd/controller/main.go — GetStackClassifiedBinds on the export seam + adapter.
• mod internal/web/handler_export.go + handler_export_download.go — both start handlers carry the selections (two-call-site).
• mod internal/web/templates/app_export.html — the class-selection UI.
• tests new fabbuckets_test.go, fabplan_test.go, fabexport_test.go, fab_export_test.go; provider fakes updated.
• CHANGELOG / REPORT / CONTEXT / README.

Untouched (§5/§12): manifest.go, validate.go, restore.go, every import handler, ExportDataMounts — the verdict rests on the import side staying byte-identical.

Tests — results

go build ./... && go vet ./... && go test ./... — green. New: bucket/guard/no-containment (ComputeFabBuckets); plan scenarios A–F + §8 (unmatched-mount-kept, skip-when-none, mandatory floor, nested excludes); tarDirectoryExcluding FS-level; export-level bundle tests (exclude-scoped tar, legacy full-root, all-excluded no-tar); the two-call-site bundle test across BOTH start pipelines.

§10 red-proofs (mutate → FAIL → revert), all verified

ID	Mutation	Test
A	legacy routed through the classified plan (drop short-circuit)	FabExport_LegacyFullRoot (userdata tar skipped)
B	always-tar the userdata root	FabExport_AllExcludedNoUserdataTar (tar present)
C	invert the keep-rule	FabExport_ExcludeScopedUserdataTar (mandatory excluded)
D3	drop the server-side mandatory floor	FabPlan_MandatoryFloor (mandatory deselected)
E	skip guards for excluded buckets	ComputeFabBuckets_GuardsAllClasses (traversal enters a bucket)
F	drop selection fields from one start handler	Fab_SelectionsRideBothStartPipelines/download (opted-in content absent)

All reverted; post-revert full suite green; no residue.

Deploy / verify

<filled after deploy>

§13 live validation

<filled after the live legs>

6D-pending

<updated after §13>

Observations

• ComputeCaptureSet was refactored to share resolveGuardCollapse with ComputeFabBuckets (no duplicate pipeline); its existing tests stayed green through the refactor.
• The estimate split is in the shared EstimateExport, so both estimate pipelines surface it by construction; the genuine two-call-site risk (and the F red-proof) is on the START selections, which the bundle test exercises per-handler.