# Disposition — backups-IA finding 2 (MEDIUM): legacy-boot SystemDisks → dead drive wizard

**Origin:** the v0.124.0 backups-IA validation (2026-07-13; recorded in felhom-controller
CHANGELOG v0.124.0 + the drill live run): on a legacy-boot PVE (LVM root, no mounted ESP) the
agent's `SystemDisks` resolved no raw system disk → `sysKnown=false` → every disk classified
system → the drive wizard could never offer a candidate; the hot-added 5 GB scsi disk stayed
invisible on the drill box.

**Disposition: RESOLVED 2026-07-13 — felhom-agent v0.87.0** (repo felhom-agent, commit
`3c174bc`; operator ruling approved 2026-07-13). The root filesystem's backing device is walked
recursively through `/sys/block/<dev>/slaves` down to physical disks (dm AND md; topology,
never VG names); those + any mounted-ESP holder are system. Per-branch conservatism: any
unresolvable slave fails the WHOLE walk → the unchanged all-system fail-safe — which is back to
being the walk-FAILURE error case, not the legacy-boot common case. The catastrophic direction
(a root-backing disk offered as a candidate) is pinned by the signature test
`TestSystemDisks_WalkTopologies` (never weaken) + red-proofs A/B/D.

**Live evidence (2026-07-13):** drill host (legacy shape) on 0.87.0 — the exact IA replay:
hot-added 5 GB scsi disk → `GET /disks/candidates` now returns it as an initialize candidate
(`/dev/sdb`, QEMU HARDDISK, not data-bearing); the root disk sda is NOT offered. felhom-pve
(EFI+LVM shape) regression: `/disks` roles + candidates byte-identical pre/post upgrade.
Remaining supervised leg: wizard enroll+format through the customer UI (operator session,
GO before format) + Day-0 manifest vouch of agent 0.87.0.
