diff --git a/REPORT-storage-identity-buildA-2026-10-15.md b/REPORT-storage-identity-buildA-2026-10-15.md
new file mode 100644
index 00000000..5610ec66
--- /dev/null
+++ b/REPORT-storage-identity-buildA-2026-10-15.md
@@ -0,0 +1,60 @@
+# REPORT — storage identity, build A: honest backup copies (2026-10-15)
+
+Brief: „Storage identity, build A — honest backup copies (D1, D2, D4)". Design: `documentation/architecture/16-storage-physical-identity.md`
+(now ACCEPTED; §13 = what was built). Evidence: `documentation/audits/storage-identity-buildA-2026-10-15/README.md`.
+Method: endpoint level (no browser on DooPlex) — the agent's local API with the guest's token, the dashboard pages and
+the Tier-2 endpoint the buttons call, the hub's database with its WAL.
+
+## What shipped
+
+| Component | Version | What | State |
+|---|---|---|---|
+| agent | v0.157.0 | every storage place: `kind`, `physical_disks`, `identity` + reason, in `GET /disks` and the hub report; `POST /disks/same-disk` | released; on Tester 1, demo-hp, N100 by signed jobs; **not vouched** |
+| controller | v0.317.0 (MinAgent 0.157.0) | Tier-2 and the one-copy notice ask the agent (same → no copy; unknown → made, not counted, „cannot check" sentence; a NAS never counts and never hides the notice; an older agent keeps the old rule); the no-drive install sentence with a link | pushed; on the three test boxes by per-box floors; global floor still 0.314.0 |
+| hub | v0.154.0 | stores the fields; the host page shows „Physical disk" and „Identity" | deployed |
+
+## What the household sees
+
+- **Tester 1 (a VM):** „A Felhom nem tudja ellenőrizni, hogy a második meghajtó valóban másik lemez-e…”. The copies are
+ made; each app says it is not counted as a second copy.
+- **demo-hp and N100 (real disks):** nothing changed. Copies counted, no notice.
+- **The no-drive sentence** („Ehhez az alkalmazáshoz egy adattároló kell. A Meghajtók oldalon adhatsz hozzá egyet.”):
+ unit-proven only; no one-disk box was at hand.
+- **A NAS keeps the notice:** unit-proven only; the scratch box cannot reach its agent (R-1083).
+
+## Register
+
+Rows before: 170 · after: 170 · opened 3 · closed 3.
+- Closed: R-1072 (fully — the brief expected half), R-1074, R-1075.
+- Narrowed: R-1068 (the sentence built; the internal place waits for build B), R-1079 (build A shipped).
+- Opened: R-1082 (the drives page offers `/mnt/sys_drive`, which the design rejects — yours), R-1083 (scratch box 9202
+ has no local API, so agent features cannot be tested there), R-1084 (the whole-box backup offer promises disk-failure
+ protection without checking the disk).
+
+## Claims in the brief or the design that were wrong
+
+1. „Never offer `sys_drive`" (16 §11): the drives page still offers it (R-280) → R-1082, for the operator.
+2. „R-1072's half": all of R-1072 closed — the other sentence was already informal.
+3. Live NAS proof on a scratch box: 9202 has no `local_api`, so no box could show it → R-1083.
+4. 16 §3 „compute at start and on hot-plug": the build computes on every read instead; a swapped disk still never keeps an
+ old verdict.
+5. The baselines in the brief had moved (another session released controller 0.316.1–0.316.4 meanwhile); build A sits on 0.316.4.
+
+## Documents changed
+
+`16-storage-physical-identity.md` (status, §12 ruled, §13 new) · capability map row **D14** (PARTIAL) + detail ·
+`OPEN-ITEMS.md` / `CLOSED-ITEMS.md` · `STATUS.md` (D10 removed; one shipped line; two „do" items) · **system poster: text
+only** — the Tier-2 line in `felhom-system-poster.facts.md` and the same text in `felhom-system-poster.html`.
+
+## Waits on the operator
+
+1. Vouch agent 0.157.0 and its bundle. Then CC raises the global floor to 0.317.0 / MinAgent 0.157.0 and clears the
+ three per-box floors. If not: every other box stays on 0.314.0 and its old rule.
+2. Rule on R-1082 (hide `/mnt/sys_drive` on the drives page, or keep it until build B).
+3. A build B task file (internal place, partitions, installer; the D3 space check).
+
+## Teardown
+
+Machine: the three test boxes stay on 0.317.0 (per-box floors); 9202 back on 0.314.0. Host: helper script removed from
+demo-hp, felhom-pve, Tester 1's host. Hub: three per-customer floors (to clear after the global floor). Secrets: the
+scratch password and token files deleted; none in any commit.
diff --git a/STATUS.md b/STATUS.md
index 20d03fd3..3522a636 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -2,7 +2,7 @@
**Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.**
-**Updated 2026-10-15 (evening).** Agent 0.156.1 + its bundle on all three boxes; controller 0.317.0 on demo-hp (the app page in one column; a version number can now only be pushed once, and only from a clean tree); 0.314.0 is still the floor since 13:11 UTC — raised by CC with its own token after all three test boxes ran it (the first release with no golden; vouched golden 0.313.0); hub 0.153.0 (access tokens — CC uses its own token now, not your password). Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
+**Updated 2026-10-15 (night).** Storage identity build A: agent 0.157.0 (not vouched yet), controller 0.317.0 and hub 0.154.0 — on the three test boxes only (per-box floors); the global floor stays 0.314.0 until you vouch the agent. Controller 0.317.0 also carries the app page in one column (a version number can now only be pushed once, and only from a clean tree); 0.314.0 is still the floor since 13:11 UTC — raised by CC with its own token after all three test boxes ran it (the first release with no golden; vouched golden 0.313.0); hub 0.153.0 (access tokens — CC uses its own token now, not your password). Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
`documentation/backlog/STATUS-HISTORY.md`. Reports: `REPORT-night-2026-10-14.md`, `REPORT-immich-rollout-2026-10-14.md`, `REPORT-seo-felho-tarhely-2026-10-14.md`, `REPORT-immich-repair-2026-10-14.md`, `REPORT-power-cut-fixes-2026-10-14.md`, `REPORT-night-power-2026-10-13.md`, `REPORT-poweroff.md`.
## What works
@@ -21,6 +21,7 @@
- The hub is closed again after the 2026-10-12 security review; one box cannot read another's data.
- Felhom runs in a virtual machine on OpenMediaVault 8, tried on an exact copy of the first outside tester's box: install, bind, claim, apps, backup, and back by itself after an OMV restart. The Hungarian guide for him is `documentation/pilot/GUIDE-omv-kvm-hu.md`; open: one-disk Jellyfin (R-1068), NAS films for Jellyfin (R-1071, yours), no disk health in a VM (R-1073, yours). Waits on you: send the guide; delete test customer Tester4 in the hub.
+- A second local copy counts only when it is on a different physical disk, and the box can prove it. Inside a virtual machine the box makes the copy but says „A Felhom nem tudja ellenőrizni…" (Tester 1). On real disks nothing changes (demo-hp, N100). A NAS never hides the „only one copy" notice. A box with no drive refuses a media app in words, with a link to the Meghajtók page. Live on the three test boxes; the NAS and no-drive parts are unit-tested only. Next: build B (the internal place on one-disk boxes, R-1079). Your rulings D1–D6 are in the design (`architecture/16-storage-physical-identity.md`).
## What is broken
- Several root-level weaknesses wait on your four decisions below (R-954, R-971, R-982, R-985).
@@ -45,9 +46,10 @@
| D7 | R-990, R-989 | Rule yes / no / later on the forum ideas (`audits/forum-research-2026-10-12/FELHOM.md` §5) and the selfh.st ideas (`audits/selfhst-survey-2026-10-12/FELHOM.md` §6) | — | — | nothing changes; the research ages | — |
| D8 | R-206 | Install DooPlex's Docker settings from git (restarts Docker), and prune the build cache weekly: yes or no? | **Yes, in a quiet window** | — | a rebuild of DooPlex still has the settings in git | — |
| D9 | R-1062 | The N100's USB drive is also its whole-box backup drive. Split it in two anyway? | **No — keep one drive**; the lived-in box keeps its nightly whole-box backup | Split: the box loses its local whole-box backup (or add a second drive first) | it stays one drive; multi-drive tests stay on Tester 1 | — |
-| D10 | R-1079 | Storage that knows its physical disks (`architecture/16-storage-physical-identity.md` §12, six questions D1–D6): a same-disk second copy, „unknown" disks (VMs), the one-disk internal place and its reserve, old one-disk boxes, partitions, NAS films | **D1 (a) no same-disk copy · D2 (a) never count unknown · D3 (a) internal place, reserve max(16 GiB, 10 %) · D4 (a) a plain sentence · D5 (a) installer only · D6 (a) separate** | Other picks: more space spent on false copies, or films inside the whole-box copies | One-disk boxes keep refusing media apps; VM boxes keep counting same-disk copies | the build task |
## Waiting on you — do
+- **Vouch agent 0.157.0 and its config bundle** (hub → Configuration → Artifacts). Then CC raises the global floor to controller 0.317.0 with MinAgent 0.157.0 and clears the three per-box floors. If not: households stay on 0.314.0 and keep counting a same-disk copy as a second copy; the three test boxes keep their own floor.
+- **Rule on R-1082:** the drives page still offers `/mnt/sys_drive` to attach, but the design you accepted says household data must not go there. Pick: **hide it** (my pick — films there would ride in every whole-box backup) or keep it until build B gives one-disk boxes their own place. If not: a household can still put films into the whole-box backup.
- **Nézd meg az AdventureLog és a Plex oldalát a demo-hp-n, a rendes címén** (`felhom.enkisfelhom.hu`). A túl nagy keret javítva: a tartalom most 32 képpontra van a bal oszloptól és 36-ra a tetejétől (előtte 80 és 64 volt). Az alkalmazás oldala mostantól egy hasábban van: egy szélesség, vékony vonalak a szakaszok között, aláhúzott fül, és doboz csak ott, ahol az alkalmazás vár rád (kék) vagy ahol valami kockázatos (sárga). A „sikeres frissítés" sáv kis szürke sorrá vált a név alatt. Ha nem nézed meg: a felület él, csak senki nem látta még böngészőben.
- **Nézd meg az új alkalmazás oldalt a demo-hp-n (egy telepített és egy nem telepített app).** Egy alkalmazás mostantól egy oldal négy füllel (Beállítások · Adatok és mentés · Útmutató · Napló), az Indítás/Újraindítás/Leállítás a „Működés" kártyán van, és a „Vissza" az alkalmazáshoz visz, nem a listához. Mondd meg, jó-e így az elrendezés. Ha nem nézed meg: a felület él, csak senki nem látta még böngészőben — a robot a DooPlexen nem tud kattintani.
- **The N100 sheet (about 30 minutes):** `documentation/audits/n100-lived-in-2026-10-15/SHEET.md` — install Plex and claim it, make the admins in Prowlarr/Sonarr/Radarr, add your download sources in Prowlarr, add one show and one film. Then say „done". If not: the media apps wait, safe behind their gate.
diff --git a/documentation/architecture/00-capability-map.md b/documentation/architecture/00-capability-map.md
index 9f28a961..4dd91559 100644
--- a/documentation/architecture/00-capability-map.md
+++ b/documentation/architecture/00-capability-map.md
@@ -179,6 +179,7 @@
| [D11](capability-map-detail/D.md#d11) | Decommission (migrate-first and anyway-paths), eject | agent, controller | **PROVEN-LIVE** | — | `audits/storage-lifecycle-acceptance-2026-06-15.md` (2026-06-15) |
| [D12](capability-map-detail/D.md#d12) | Boot ordering: automount + networking survive reboot; appliance self-heal watchdog | agent v0.85 | **PROVEN-LIVE** | — | `audits/CAMPAIGN-4-2026-07-13.md` (2026-07-13); `audits/CAMPAIGN-6A-2026-07-14.md` (2026-07-14) |
| [D13](capability-map-detail/D.md#d13) | Media apps see EVERY drive; a drive added, pulled, back or safely removed is handled per app (notice, real restart, wiring, torrents paused/resumed) | controller v0.313.0, catalog `0188430`, hub v0.151.0 | **PROVEN-LIVE** | Tier-0 boxes (Tester 1, demo-hp 9201); the fleet with golden 0.313.0 + the floor | `audits/media-build-2026-10-15/G/` (2026-10-15); `audits/media-drive-events-2026-10-14/` (2026-10-14) |
+| [D14](capability-map-detail/D.md#d14) | A second local copy COUNTS only on a proven different physical disk: the agent knows each place's disks; a VM box makes the copy but says it cannot check; a same-disk copy is not made; a NAS never hides the one-copy notice; a box with no drive refuses a data-folder app in words | agent v0.157.0, controller v0.317.0, hub v0.154.0 | **PARTIAL** | live: VM `unknown` (Tester 1) and two real-disk boxes `proven` (demo-hp, N100); unit only: the same-disk skip, the NAS notice, the no-drive sentence; `usb_bridge` never seen on a device | `audits/storage-identity-buildA-2026-10-15/README.md` (2026-10-15); `architecture/16-storage-physical-identity.md` §13 |
## E. Access, networking & household use
diff --git a/documentation/architecture/16-storage-physical-identity.md b/documentation/architecture/16-storage-physical-identity.md
index 2ba182dd..3c613031 100644
--- a/documentation/architecture/16-storage-physical-identity.md
+++ b/documentation/architecture/16-storage-physical-identity.md
@@ -5,7 +5,9 @@
> Operator ruling 2026-10-15: „Felhom must support drives split into parts; the agent and the controller must know
> whether two storage places sit on the same physical disk." Triggered by the OMV test (`audits/omv-vm-2026-10-15/`,
> R-1068). Spike: `audits/storage-identity-2026-10-15/` (Part B there). Marks as in `01`: **[FACT]** read in a named
-> file or measured; **[DESIGN]** a proposal. **Status: DRAFT — waits on the operator's rulings in §11. Nothing is built.**
+> file or measured; **[DESIGN]** a proposal. **Status: ACCEPTED 2026-10-15** — the operator ruled D1–D6 as recommended (§12). **Build A shipped 2026-10-15**
+> (§3, §4, §5's D4 sentence, §8, §10); **§5's internal place, §6 and §7 wait for build B** — what is built, and where the
+> build differs from this text, is §13.
> Paths: A = `felhom-agent/`, C = `felhom-controller/controller/`, E = `felhom.eu/`.
## 1. Today, in one table (Part A)
@@ -171,7 +173,7 @@ data-bearing. The agent never trusts a guest path it cannot map to a host mount
- **Ask the hypervisor (OMV/libvirt) which host disk backs a virtual disk** — Felhom has no access there, and it would trust a party it does not control.
- **Let the dashboard create partitions** — a new destructive power for the household with no recovery; not needed for the cases in hand.
-## 12. Decisions for the operator (D1–D6) — STOP here
+## 12. Decisions for the operator (D1–D6) — RULED 2026-10-15: all six as recommended
| # | Question | Options | Recommendation | If you do nothing |
|---|---|---|---|---|
@@ -186,3 +188,27 @@ data-bearing. The agent never trusts a guest path it cannot map to a host mount
partition candidates, the loop step) · controller (Tier-2 and the notice ask the agent; i18n sentences; the install
refusal in words; register the internal place) · installer (`step_grows` + the internal LV) · hub (store and show the two
fields) · website and guides (the OMV guide's second-disk line; the backup explanation page).
+
+## 13. Build status
+
+**Build A — honest backup copies (D1, D2, D4), shipped 2026-10-15** (agent v0.157.0, controller v0.317.0 with MinAgent
+0.157.0, hub v0.154.0; evidence `audits/storage-identity-buildA-2026-10-15/`):
+
+| Section | Built | Proven |
+|---|---|---|
+| §3 model | the agent computes `kind`, `physical_disks`, `identity` + reason for every PVE storage and every own mount; `GET /disks` and the hub report carry them | live: N100 and demo-hp `proven`, Tester 1 `unknown/vm`, the PBS store `network`; the hub stores and shows them |
+| §4 tiers | `POST /disks/same-disk`; Tier-2 choice, the pre-run guard and the one-copy notice ask it (D1: same disk → no copy; D2: unknown → copy made, not counted); a NAS never counts and never hides the notice (R-1075) | live: Tester 1 shows the „cannot check" notice and its copies are made, not counted; demo-hp and N100 count theirs, no notice. **Unit only:** the same-disk skip (no box has two places on one disk), the NAS notice (no box with a NAS can reach the agent, R-1083) |
+| §5 D4 | the install of a data-folder app on a box with no drive answers „Ehhez az alkalmazáshoz egy adattároló kell. A Meghajtók oldalon adhatsz hozzá egyet." with a link to the Meghajtók page; never the field name | **unit only** — no one-disk box was at hand |
+| §8 VMs | every place on a VM box is `unknown/vm` | live, Tester 1 |
+| §10 | the agent maps only paths to mounts it made; an absent drive (its folder on the root disk) is `unmapped`, never „the system disk" | unit, and live (`unmapped` for an absent drive on demo-hp) |
+
+**Where the build differs from the text above:**
+- §3 „When": the identity is computed **on every read** (each `GET /disks`, each report, each same-disk call), not cached
+ at start and on hot-plug. The rule's purpose — a swapped disk never inherits an old verdict — holds with no cache.
+- `usb_bridge`: built from the spike's rule, **never seen on a real device** (the N100's USB enclosure passes the real serial).
+- §4 said the notice closes „R-1072's half": it closed all of R-1072 — the other sentence was already informal.
+- An older agent (no same-disk call): the controller keeps the pre-build `st_dev` rule and logs it once.
+- §11 rejects `sys_drive` for household data, but the drives page still offers `/mnt/sys_drive` to attach (R-280) — R-1082.
+
+**Build B — waits:** §5's internal place, §6 partitions, §7 the installer (and the D3 space check the operator asked for).
+
diff --git a/documentation/architecture/capability-map-detail/D.md b/documentation/architecture/capability-map-detail/D.md
index 79b6225c..fbee7e74 100644
--- a/documentation/architecture/capability-map-detail/D.md
+++ b/documentation/architecture/capability-map-detail/D.md
@@ -237,3 +237,34 @@ the unmount, the drive returns by itself and the torrents resume; G6 13 hardlink
---
+
+## D14 — A second local copy counts only on a proven different physical disk
+
+*Map row: [D14](../00-capability-map.md#d14) · added 2026-10-15.*
+
+**Scenario:** a household's Tier-2 copy is worth something against a disk failure only when it sits on another physical
+disk. The agent reads, for every storage place, the physical disk(s) under it and whether it can prove them; the
+controller asks it before it makes or counts a copy.
+
+**Components:** agent v0.157.0 (place identity in `GET /disks` and the hub report, `POST /disks/same-disk`), controller
+v0.317.0 (Tier-2 choice and guard, the one-copy notice, the no-drive install sentence; MinAgent 0.157.0), hub v0.154.0
+(the host page shows the disks and the verdict). Design: `architecture/16-storage-physical-identity.md` §3–§4, §13.
+
+**Status:** **PARTIAL** (2026-10-15).
+
+**Proven live:** Tester 1 (a box inside a VM): every place `unknown/vm`; `/backups` shows „A Felhom nem tudja
+ellenőrizni…”; a Tier-2 run copied the apps and marked them not counted. demo-hp and the N100 (real disks): every place
+`proven`; drive vs system data „different, proven”; Tier-2 copies counted; no notice. An absent drive is `unmapped`,
+never „the system disk”. The hub stores and shows the fields for all three.
+
+**Unit only (red-proved):** the same-disk skip (no box has two places on one disk), the NAS notice (the scratch box cannot
+reach its agent, R-1083), the no-drive install sentence (no one-disk box at hand, R-1068). `usb_bridge` is built from the
+spike's rule and was never seen on a device.
+
+**Gaps:** the whole-box backup offer still trusts any second drive (R-1084); build B — the internal place, partitions,
+the installer (R-1079).
+
+**Evidence:** `audits/storage-identity-buildA-2026-10-15/README.md`.
+
+---
+
diff --git a/documentation/architecture/felhom-system-poster.facts.md b/documentation/architecture/felhom-system-poster.facts.md
index c38ced0b..ab9bb382 100644
--- a/documentation/architecture/felhom-system-poster.facts.md
+++ b/documentation/architecture/felhom-system-poster.facts.md
@@ -82,7 +82,7 @@ Title: **"Where a household's data is copied"**
| Tier | What it copies | Where | When | Kept | Locked by |
|---|---|---|---|---|---|
| **Tier 1 — recovery unit** | each app: its settings, database dump, volumes | data drive 1, on the box | nightly at **02:30** (W) | 1 point per app | not encrypted (it never leaves the home) |
-| **Tier 2 — cross-drive** | a mirror of Tier 1, plus the app's files | data drive 2, on the box (only if the household has 2 drives) | nightly **03:30** | mirror | not encrypted |
+| **Tier 2 — cross-drive** | a mirror of Tier 1, plus the app's files | data drive 2, on the box (counted only on a different physical disk; in a VM made, not counted) | nightly **03:30** | mirror | not encrypted |
| **Tier 3 — off-site, per app** | Tier 1 + the app's must-keep files | **Hetzner Storage Box** (Germany), one folder per household | nightly **04:15** | 7 daily, 4 weekly, 6 monthly | the household's own restic password |
| **Whole guest — local** | the guest's system (not the data drives) | the box's own system disk | daily, in the window **04:30–08:30** | up to 3 copies (fewer on a small disk) | not encrypted |
| **Whole guest — off-site** | the same | **ep0** (Hetzner, Germany), one namespace per household | weekly, same window | last 2 | the household's own key, escrowed with a recovery code |
diff --git a/documentation/architecture/felhom-system-poster.html b/documentation/architecture/felhom-system-poster.html
index a01cb971..4e400aa8 100644
--- a/documentation/architecture/felhom-system-poster.html
+++ b/documentation/architecture/felhom-system-poster.html
@@ -385,7 +385,7 @@ document.addEventListener('DOMContentLoaded', async function() {