R-109 + R-122: the recipe assembly stops dropping sections (hub v0.83.0)

AssembleDRRecipe's hostHalfShape/appHalfShape are ALLOW-LISTS, not the
forward-compat their comment advertised: a section an emitter adds is silently
discarded until it is named in both the shape struct and AssembledRecipe. No
error, no log, no failing test.

R-122 (found this session): that already happened and shipped. The controller
has emitted offsite_restic since fork-4 — the offsite recovery LOCATION — the
hub stored it for all three real customers, and appHalfShape never listed the
key, so no delivered recipe has ever contained it. It stayed green because the
fixture drAppHalf is hand-written and omits the field.

R-109: the agent's new backup_target is a new top-level host-half section and
would have been dropped identically, making the fix read as shipped while
changing nothing an operator can see.

3 tests built on halves read verbatim out of the live dr_recipe table, plus
2 red-proofs (each mutation asserted to have landed). vet rc=0, suite rc=0, 17 ok.

Registers: R-106 + R-109 dispositioned; R-105/R-106 were READY in ROADMAP with
no OPEN-ITEMS row (→ R-123, registered); R-124 filed on the "root" spelling.

hub/internal/api/testdata/host-report.golden.json

@@ -141,7 +141,8 @@
     ],
     "pbs": {
       "repo_id": "felhom-pbs",
-      "namespace": "root",
+      "namespace": "felhom-spike",
+      "namespace_state": "resolved",
       "latest_snapshot_id": "9001"
     },
     "drives": [
@@ -154,7 +155,13 @@
     ],
     "pve_storage": [
       { "name": "local-lvm", "type": "lvmthin", "content": "rootdir,images" },
-      { "name": "usb-backup", "type": "usb", "content": "backup" }
-    ]
+      { "name": "usb-backup", "type": "usb", "content": "backup" },
+      { "name": "felhom-pbs", "type": "pbs", "content": "backup" }
+    ],
+    "backup_target": {
+      "state": "resolved",
+      "storage_id": "usb-backup",
+      "mount_path": "/mnt/usb-backup"
+    }
   }
 }

hub/internal/store/dr_recipe.go

@@ -79,22 +79,40 @@ type AssembledRecipe struct {
 	PBS           json.RawMessage `json:"pbs,omitempty"`
 	Drives        json.RawMessage `json:"drives,omitempty"`
 	PVEStorage    json.RawMessage `json:"pve_storage,omitempty"`
-	Apps          json.RawMessage `json:"apps,omitempty"`
+	// BackupTarget (R-109) names WHICH storage holds the local whole-guest archives — the agent's
+	// host-half emits it from v0.118.0.
+	BackupTarget json.RawMessage `json:"backup_target,omitempty"`
+	Apps         json.RawMessage `json:"apps,omitempty"`
+	// OffsiteRestic (R-122) is the offsite restic repo's non-secret coordinates — WHERE to recover from.
+	// The controller has emitted it since fork-4 and the hub dropped it for the whole time; see the
+	// allow-list warning on appHalfShape.
+	OffsiteRestic json.RawMessage `json:"offsite_restic,omitempty"`
 }
 
 // hostHalfShape / appHalfShape capture only the top-level keys the assembly stitches; encoding/json
 // drops any unknown top-level key (forward-compat — a newer half with extra sections still parses).
+//
+// THAT FORWARD-COMPAT IS ALSO A TRAP, and it has already cost one shipped section. These two structs are
+// ALLOW-LISTS: a section an emitter adds is silently discarded here until it is named in BOTH the shape
+// struct and AssembledRecipe. `offsite_restic` proved it — the controller emitted it from fork-4, the hub
+// stored it intact for every customer, and the delivered recipe never contained it because nothing here
+// listed the key. Nothing failed; the section simply was not there (R-122).
+//
+// SO: adding a section to either half is a TWO-REPO change. TestAssembleDRRecipe_CarriesEveryEmittedSection
+// pins the current set against captured real halves — extend it in the same commit as any new section.
 type hostHalfShape struct {
 	RecipeVersion int             `json:"recipe_version"`
 	Guests        json.RawMessage `json:"guests"`
 	PBS           json.RawMessage `json:"pbs"`
 	Drives        json.RawMessage `json:"drives"`
 	PVEStorage    json.RawMessage `json:"pve_storage"`
+	BackupTarget  json.RawMessage `json:"backup_target"`
 }
 type appHalfShape struct {
 	RecipeVersion int             `json:"recipe_version"`
 	Customer      json.RawMessage `json:"customer"`
 	Apps          json.RawMessage `json:"apps"`
+	OffsiteRestic json.RawMessage `json:"offsite_restic"`
 }
 
 // AssembleDRRecipe stitches the two stored halves into one operator-facing recipe. Either half may be
@@ -112,6 +130,7 @@ func AssembleDRRecipe(rec *DRRecipe) (AssembledRecipe, error) {
 			return out, err
 		}
 		out.Guests, out.PBS, out.Drives, out.PVEStorage = h.Guests, h.PBS, h.Drives, h.PVEStorage
+		out.BackupTarget = h.BackupTarget
 		if h.RecipeVersion > out.RecipeVersion {
 			out.RecipeVersion = h.RecipeVersion
 		}
@@ -122,6 +141,7 @@ func AssembleDRRecipe(rec *DRRecipe) (AssembledRecipe, error) {
 			return out, err
 		}
 		out.Customer, out.Apps = a.Customer, a.Apps
+		out.OffsiteRestic = a.OffsiteRestic
 		if a.RecipeVersion > out.RecipeVersion {
 			out.RecipeVersion = a.RecipeVersion
 		}

hub/internal/store/dr_recipe_test.go

@@ -15,15 +15,50 @@ import (
 const drHostHalf = `{
   "recipe_version": 1,
   "guests": [ { "vmid": 9201, "cores": 4, "memory_bytes": 12884901888, "disk_bytes": 34359738368 } ],
-  "pbs": { "repo_id": "felhom-pbs", "namespace": "root", "latest_snapshot_id": "9201" },
+  "pbs": { "repo_id": "felhom-pbs", "namespace": "root", "namespace_state": "resolved", "latest_snapshot_id": "9201" },
   "drives": [ { "durable_id": "uuid:da9e7089-cf8e-4617-adcb-a377743fae00", "mount_path": "/mnt/felhom-usb", "intent": "enrolled", "total_bytes": 1000000000000 } ],
-  "pve_storage": [ { "name": "local-lvm", "type": "lvmthin", "content": "rootdir,images" }, { "name": "felhom-usb", "type": "usb", "content": "backup" } ]
+  "pve_storage": [ { "name": "local-lvm", "type": "lvmthin", "content": "rootdir,images" }, { "name": "felhom-usb", "type": "usb", "content": "backup" } ],
+  "backup_target": { "state": "resolved", "storage_id": "felhom-usb", "mount_path": "/mnt/felhom-usb" }
 }`
 
 const drAppHalf = `{
   "recipe_version": 1,
   "customer": { "id": "cust-demo", "display": "Demo Customer", "domain": "demo-felhom.eu" },
-  "apps": [ { "catalog_ref": "romm", "enabled": true, "storage_bindings": [ { "container_path": "/roms", "drive": "felhom-flash", "subpath": "userdata/roms" } ] } ]
+  "apps": [ { "catalog_ref": "romm", "enabled": true, "storage_bindings": [ { "container_path": "/roms", "drive": "felhom-flash", "subpath": "userdata/roms" } ] } ],
+  "offsite_restic": { "host": "u629488-sub1.your-storagebox.de", "user": "u629488-sub1", "port": 23, "repo_path": "/home/felhom-repo" }
+}`
+
+// capturedHostHalf / capturedAppHalf are the halves demo-felhom's controller and agent REALLY stored,
+// read verbatim out of the hub's own dr_recipe table on 2026-07-30 (customer_id='demo-felhom'), with only
+// the app list truncated for length. They exist because drHostHalf/drAppHalf above are hand-written and
+// OMIT sections production supplies — and that omission is exactly why R-122 survived: `offsite_restic`
+// was stored for every real customer and silently dropped by the assembly, with a green suite throughout.
+//
+// capturedHostHalf carries the POST-FIX host half (agent v0.118.0: backup_target + namespace_state); the
+// pre-fix one is quoted in the CHANGELOG entry for comparison.
+const capturedHostHalf = `{
+  "recipe_version": 1,
+  "guests": [ { "vmid": 9201, "cores": 4, "memory_bytes": 12884901888, "disk_bytes": 34359738368 } ],
+  "pbs": { "repo_id": "felhom-pbs", "namespace": "demo-felhom", "namespace_state": "resolved", "latest_snapshot_id": "9201" },
+  "drives": [ { "durable_id": "uuid:47a3361a-91e0-4831-a69d-27f540ed3f48", "mount_path": "/mnt/hdd_1", "intent": "enrolled", "total_bytes": 983351140352 } ],
+  "pve_storage": [
+    { "name": "local-lvm", "type": "lvmthin", "content": "images,rootdir" },
+    { "name": "felhom-backup", "type": "local-dir", "content": "backup" },
+    { "name": "felhom-pbs", "type": "pbs", "content": "backup" },
+    { "name": "local", "type": "local", "content": "backup,import,vztmpl,iso" }
+  ],
+  "backup_target": { "state": "resolved", "storage_id": "felhom-backup", "mount_path": "/mnt/hdd_1" }
+}`
+
+const capturedAppHalf = `{
+  "recipe_version": 1,
+  "customer": { "id": "demo-felhom", "display": "Demo Ügyfél", "domain": "demo-felhom.eu" },
+  "apps": [
+    { "catalog_ref": "bookstack", "enabled": true, "storage_bindings": [] },
+    { "catalog_ref": "immich", "enabled": true, "storage_bindings": [
+      { "container_path": "/external/photos", "drive": "hdd_1", "subpath": "userdata/media/photos" } ] }
+  ],
+  "offsite_restic": { "host": "u629488-sub1.your-storagebox.de", "user": "u629488-sub1", "port": 23, "repo_path": "/home/felhom-repo" }
 }`
 
 // TestDRRecipe_StoreRoundTrip: each half upserts independently and preserves the other; GetDRRecipe
@@ -196,6 +231,113 @@ func TestAssembleDRRecipe_NoSecrets(t *testing.T) {
 	walk(v)
 }
 
+// TestAssembleDRRecipe_CarriesEveryEmittedSection is the guard the allow-list needed and never had.
+//
+// It asserts the CONSEQUENCE — what an operator downloading the recipe actually receives — against the
+// halves production really stores, not hand-written structs. Every section either emitter produces must
+// survive to the assembled output. When the hostHalfShape/appHalfShape allow-lists and the emitters drift
+// apart, this fails; that drift is what dropped `offsite_restic` for the entire life of the feature
+// (R-122) and would have dropped `backup_target` on the day R-109 shipped.
+func TestAssembleDRRecipe_CarriesEveryEmittedSection(t *testing.T) {
+	asm, err := AssembleDRRecipe(&DRRecipe{
+		CustomerID: "demo-felhom", RecipeVersion: 1,
+		HostHalfJSON: capturedHostHalf, AppHalfJSON: capturedAppHalf,
+	})
+	if err != nil {
+		t.Fatalf("captured real halves failed to assemble: %v", err)
+	}
+	b, _ := json.Marshal(asm)
+	var got map[string]any
+	if err := json.Unmarshal(b, &got); err != nil {
+		t.Fatal(err)
+	}
+	// Every section BOTH emitters produce today. A new section added to either half without a row here
+	// (and in the shape struct) is the defect this test exists to catch.
+	for _, section := range []string{
+		"recipe_version", "customer", "guests", "pbs", "drives", "pve_storage", "backup_target",
+		"apps", "offsite_restic",
+	} {
+		if _, ok := got[section]; !ok {
+			t.Errorf("section %q was DROPPED by the assembly — the operator's recipe does not contain it "+
+				"(add it to hostHalfShape/appHalfShape AND AssembledRecipe)", section)
+		}
+	}
+	// And the values, not just the keys: a present-but-empty section is the same gap wearing a hat.
+	if !jsonContains(t, asm.BackupTarget, "felhom-backup") || !jsonContains(t, asm.BackupTarget, "/mnt/hdd_1") {
+		t.Errorf("backup_target reached the operator without naming the live target: %s", asm.BackupTarget)
+	}
+	if !jsonContains(t, asm.OffsiteRestic, "u629488-sub1.your-storagebox.de") {
+		t.Errorf("offsite_restic reached the operator without the repo host: %s", asm.OffsiteRestic)
+	}
+	if !jsonContains(t, asm.PBS, "demo-felhom") {
+		t.Errorf("pbs coord lost the per-customer namespace: %s", asm.PBS)
+	}
+}
+
+// TestAssembleDRRecipe_NamesTheLiveBackupTargetAmongTwoCandidates is the R-109 consequence at the DELIVERY
+// boundary: the recipe an operator downloads for a box with two content=backup storages must name the live
+// one unambiguously. Assembly-level, because a correct host half that the hub drops helps nobody.
+func TestAssembleDRRecipe_NamesTheLiveBackupTargetAmongTwoCandidates(t *testing.T) {
+	asm, err := AssembleDRRecipe(&DRRecipe{HostHalfJSON: capturedHostHalf, AppHalfJSON: capturedAppHalf})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The fixture must still pose the problem: two plausible content=backup storages.
+	var storages []struct{ Name, Type, Content string }
+	if err := json.Unmarshal(asm.PVEStorage, &storages); err != nil {
+		t.Fatal(err)
+	}
+	candidates := 0
+	for _, s := range storages {
+		if strings.Contains(s.Content, "backup") && (s.Type == "local-dir" || s.Type == "local") {
+			candidates++
+		}
+	}
+	if candidates < 2 {
+		t.Fatalf("fixture no longer poses the R-109 problem: %d content=backup dir storages", candidates)
+	}
+
+	var bt struct {
+		State     string `json:"state"`
+		StorageID string `json:"storage_id"`
+		MountPath string `json:"mount_path"`
+	}
+	if len(asm.BackupTarget) == 0 {
+		t.Fatal("backup_target absent from the delivered recipe — the restorer must still guess (R-109)")
+	}
+	if err := json.Unmarshal(asm.BackupTarget, &bt); err != nil {
+		t.Fatal(err)
+	}
+	if bt.State != "resolved" || bt.StorageID != "felhom-backup" || bt.MountPath != "/mnt/hdd_1" {
+		t.Errorf("delivered backup_target = %+v, want resolved/felhom-backup at /mnt/hdd_1", bt)
+	}
+	if bt.StorageID == "local" || bt.MountPath == "/var/lib/vz" {
+		t.Errorf("delivered recipe names the FROZEN target %q at %q", bt.StorageID, bt.MountPath)
+	}
+}
+
+// TestAssembleDRRecipe_UnknownBackupTargetSurvivesVerbatim: the agent's explicit unknown must reach the
+// operator AS an unknown. Passing it through as a resolved-looking section, or dropping it so the recipe
+// merely lacks the field, would both turn "I could not tell" into something else.
+func TestAssembleDRRecipe_UnknownBackupTargetSurvivesVerbatim(t *testing.T) {
+	const unknownHost = `{
+	  "recipe_version": 1, "guests": [], "drives": [], "pve_storage": [],
+	  "backup_target": { "state": "unknown", "reason": "agent_backup_config_unavailable" }
+	}`
+	asm, err := AssembleDRRecipe(&DRRecipe{HostHalfJSON: unknownHost})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !jsonContains(t, asm.BackupTarget, "unknown") ||
+		!jsonContains(t, asm.BackupTarget, "agent_backup_config_unavailable") {
+		t.Errorf("the unknown state did not survive assembly: %s", asm.BackupTarget)
+	}
+	// It must not have acquired a target on the way through.
+	if strings.Contains(string(asm.BackupTarget), "storage_id") {
+		t.Errorf("assembly invented a storage_id for an unknown target: %s", asm.BackupTarget)
+	}
+}
+
 func jsonContains(t *testing.T, raw json.RawMessage, substr string) bool {
 	t.Helper()
 	return len(raw) > 0 && string(raw) != "null" && strings.Contains(string(raw), substr)

hub/internal/store/testdata/dr-recipe.golden.json

@@ -4,7 +4,7 @@
   "guests": [
     { "vmid": 9201, "cores": 4, "memory_bytes": 12884901888, "disk_bytes": 34359738368 }
   ],
-  "pbs": { "repo_id": "felhom-pbs", "namespace": "root", "latest_snapshot_id": "9201" },
+  "pbs": { "repo_id": "felhom-pbs", "namespace": "root", "namespace_state": "resolved", "latest_snapshot_id": "9201" },
   "drives": [
     {
       "durable_id": "uuid:da9e7089-cf8e-4617-adcb-a377743fae00",
@@ -17,6 +17,7 @@
     { "name": "local-lvm", "type": "lvmthin", "content": "rootdir,images" },
     { "name": "felhom-usb", "type": "usb", "content": "backup" }
   ],
+  "backup_target": { "state": "resolved", "storage_id": "felhom-usb", "mount_path": "/mnt/felhom-usb" },
   "apps": [
     {
       "catalog_ref": "romm",
@@ -25,5 +26,11 @@
         { "container_path": "/roms", "drive": "felhom-flash", "subpath": "userdata/roms" }
       ]
     }
-  ]
+  ],
+  "offsite_restic": {
+    "host": "u629488-sub1.your-storagebox.de",
+    "user": "u629488-sub1",
+    "port": 23,
+    "repo_path": "/home/felhom-repo"
+  }
 }