# REPORT — storage identity, build A: honest backup copies (2026-10-15)

Brief: „Storage identity, build A — honest backup copies (D1, D2, D4)". Design: `documentation/architecture/16-storage-physical-identity.md`
(now ACCEPTED; §13 = what was built). Evidence: `documentation/audits/storage-identity-buildA-2026-10-15/README.md`.
Method: endpoint level (no browser on DooPlex) — the agent's local API with the guest's token, the dashboard pages and
the Tier-2 endpoint the buttons call, the hub's database with its WAL.

## What shipped

| Component | Version | What | State |
|---|---|---|---|
| agent | v0.157.0 | every storage place: `kind`, `physical_disks`, `identity` + reason, in `GET /disks` and the hub report; `POST /disks/same-disk` | released; on Tester 1, demo-hp, N100 by signed jobs; **not vouched** |
| controller | v0.317.0 (MinAgent 0.157.0) | Tier-2 and the one-copy notice ask the agent (same → no copy; unknown → made, not counted, „cannot check" sentence; a NAS never counts and never hides the notice; an older agent keeps the old rule); the no-drive install sentence with a link | pushed; on the three test boxes by per-box floors; global floor still 0.314.0 |
| hub | v0.154.0 | stores the fields; the host page shows „Physical disk" and „Identity" | deployed |

## What the household sees

- **Tester 1 (a VM):** „A Felhom nem tudja ellenőrizni, hogy a második meghajtó valóban másik lemez-e…”. The copies are
  made; each app says it is not counted as a second copy.
- **demo-hp and N100 (real disks):** nothing changed. Copies counted, no notice.
- **The no-drive sentence** („Ehhez az alkalmazáshoz egy adattároló kell. A Meghajtók oldalon adhatsz hozzá egyet.”):
  unit-proven only; no one-disk box was at hand.
- **A NAS keeps the notice:** unit-proven only; the scratch box cannot reach its agent (R-1083).

## Register

Rows before: 170 · after: 170 · opened 3 · closed 3.
- Closed: R-1072 (fully — the brief expected half), R-1074, R-1075.
- Narrowed: R-1068 (the sentence built; the internal place waits for build B), R-1079 (build A shipped).
- Opened: R-1082 (the drives page offers `/mnt/sys_drive`, which the design rejects — yours), R-1083 (scratch box 9202
  has no local API, so agent features cannot be tested there), R-1084 (the whole-box backup offer promises disk-failure
  protection without checking the disk).

## Claims in the brief or the design that were wrong

1. „Never offer `sys_drive`" (16 §11): the drives page still offers it (R-280) → R-1082, for the operator.
2. „R-1072's half": all of R-1072 closed — the other sentence was already informal.
3. Live NAS proof on a scratch box: 9202 has no `local_api`, so no box could show it → R-1083.
4. 16 §3 „compute at start and on hot-plug": the build computes on every read instead; a swapped disk still never keeps an
   old verdict.
5. The baselines in the brief had moved (another session released controller 0.316.1–0.316.4 meanwhile); build A sits on 0.316.4.

## Documents changed

`16-storage-physical-identity.md` (status, §12 ruled, §13 new) · capability map row **D14** (PARTIAL) + detail ·
`OPEN-ITEMS.md` / `CLOSED-ITEMS.md` · `STATUS.md` (D10 removed; one shipped line; two „do" items) · **system poster: text
only** — the Tier-2 line in `felhom-system-poster.facts.md` and the same text in `felhom-system-poster.html`.

## Waits on the operator

1. Vouch agent 0.157.0 and its bundle. Then CC raises the global floor to 0.317.0 / MinAgent 0.157.0 and clears the
   three per-box floors. If not: every other box stays on 0.314.0 and its old rule.
2. Rule on R-1082 (hide `/mnt/sys_drive` on the drives page, or keep it until build B).
3. A build B task file (internal place, partitions, installer; the D3 space check).

## Teardown

Machine: the three test boxes stay on 0.317.0 (per-box floors); 9202 back on 0.314.0. Host: helper script removed from
demo-hp, felhom-pve, Tester 1's host. Hub: three per-customer floors (to clear after the global floor). Secrets: the
scratch password and token files deleted; none in any commit.