### PATH PROVENANCE — exactly where I looked, with positive controls

== A. What /var/lib/docker actually IS inside the running guest ==
drwx--x--- 12 root root 4096 Sep 21 11:06 /var/lib/docker
drwx--x--- 12 root root 4096 Sep 21 11:06 /var/lib/felhom/docker
/var/lib/docker

== B. Configured data_dir (controller.yaml, path INSIDE the container) ==

== C. POSITIVE CONTROL — the directory I searched really is the controller data dir.
      Listing it via the RUNNING guest, where the symlink resolves correctly:
total 9540
drwxr-xr-x 3 root root    4096 Sep 21 11:06 .
drwxr-xr-x 3 root root    4096 Sep 13 20:20 ..
drwxr-xr-x 9 root root    4096 Sep 21 11:04 catalog-cache
-rw-r--r-- 1 root root  870169 Sep 21 11:06 debug-ring.log
-rw------- 1 root root      32 Sep 13 20:22 encryption.key
-rw-r--r-- 1 root root 4673536 Sep 21 09:22 metrics.db
-rw-r--r-- 1 root root   32768 Sep 21 11:06 metrics.db-shm
-rw-r--r-- 1 root root 4157112 Sep 21 11:06 metrics.db-wal
-rw-r--r-- 1 root root     572 Sep 16 19:18 settings.json
-rw-r--r-- 1 root root     784 Sep 16 19:17 settings.json.bak

      ...and the SAME directory by its physical path (no symlink):
total 9540
drwxr-xr-x 3 root root    4096 Sep 21 11:06 .
drwxr-xr-x 3 root root    4096 Sep 13 20:20 ..
drwxr-xr-x 9 root root    4096 Sep 21 11:04 catalog-cache
-rw-r--r-- 1 root root  870169 Sep 21 11:06 debug-ring.log
-rw------- 1 root root      32 Sep 13 20:22 encryption.key
-rw-r--r-- 1 root root 4673536 Sep 21 09:22 metrics.db
-rw-r--r-- 1 root root   32768 Sep 21 11:06 metrics.db-shm
-rw-r--r-- 1 root root 4157112 Sep 21 11:06 metrics.db-wal
-rw-r--r-- 1 root root     572 Sep 16 19:18 settings.json
-rw-r--r-- 1 root root     784 Sep 16 19:17 settings.json.bak

== D. WHY the host-side read missed it: it is a BIND MOUNT, not a symlink ==
-- guest 9202 LXC config mountpoints (from the host) --
mp0: nvme-scratch:9202/vm-9202-disk-1.raw,mp=/var/lib/felhom,backup=1,size=70G
mp8: /mnt/hdd_1/scratch-drives/scratch_hdd,mp=/mnt/felhom-drives/scratch_hdd
mp9: /var/lib/felhom-agent/guests/9202/bootstrap,mp=/etc/felhom-bootstrap,ro=1
rootfs: nvme-scratch:9202/vm-9202-disk-0.raw,size=32G
-- inside the guest: is /var/lib/docker its own mount? --
/dev/loop1[/docker] /var/lib/docker ext4
-- readlink -f says it is NOT a symlink --
/var/lib/docker

CONCLUSION ON PATHS:
  * INSIDE the running guest the coordinator's path is correct and is what I used for every
    live read:  /var/lib/docker/volumes/felhom-controller-data/_data/data/
  * FROM THE HOST, reading the STOPPED guest via 'pct mount 9202', that same path is an EMPTY
    mountpoint stub, because pct mount maps only the rootfs and does not apply the guest's
    internal bind mounts. The bytes live at
      /var/lib/lxc/9202/rootfs/var/lib/felhom/docker/volumes/felhom-controller-data/_data/data/
  * My FIRST host-side read used the stub path and reported ABSENT. That was a FALSE NEGATIVE,
    found by running 'find' over the whole rootfs rather than trusting the one path.

== E. controller.yaml location (the /etc/felhom guess was wrong too) ==
/mnt -> /mnt
/etc/felhom-bootstrap -> /etc/felhom-bootstrap
/var/lib/docker/volumes/felhom-controller-data/_data -> /opt/docker/felhom-controller
/opt/docker/stacks -> /opt/docker/stacks
/var/run/docker.sock -> /var/run/docker.sock

/var/lib/docker/volumes/felhom-controller-data/_data/controller.yaml
/var/lib/felhom/docker/volumes/felhom-controller-data/_data/controller.yaml
