felhom.eu/REPORT-storage-identity-2026-10-15.md

REPORT — storage that knows its physical disks: design draft + spike (2026-10-15)

Written in ASD-STE100 Simplified Technical English. Baselines read 19:50: felhom.eu 340804f9af, felhom-controller 83392064ae, felhom-agent d2053e7d47. Read first: 03-host-agent.md, 04-control-plane-authorization.md, 07-backup-architecture.md §6 and §7.5, 15-media-library.md, 02-controller-module-map.md, the agent's /disks code and classifier, the controller's drive model and Tier-2 choice, the installer's step_grows. Design: documentation/architecture/16-storage-physical-identity.md (DRAFT). Evidence: documentation/audits/storage-identity-2026-10-15/.

What waits on you

Answer six questions: 16-storage-physical-identity.md §12 (STATUS D10). My picks: D1 (a), D2 (a), D3 (a), D4 (a), D5 (a), D6 (a). If you do nothing: one-disk boxes keep refusing media apps, and boxes in a VM keep counting same-disk copies as second copies. Nothing is built until you answer.

1. Did the agent-side method name the right physical disk? (Part B)

Case	Right?
1 One disk (N100, demo-hp): every system place → the one SSD	yes
2 Two disks: system vs enrolled drive (demo-hp, N100)	yes
3 Two partitions of one disk (a scratch loop disk)	yes — after one fix in my probe
4a USB bridge that passes the identity (N100's backup drive)	yes
4b USB bridge that hides the serial	not measured — no device (R-1077)
5 / 6 Inside a VM: same host disk vs a different host disk	both „unknown" — correct
7 Network share	„network, unknown" by rule (no live share mounted today)

VM cases in one sentence: inside a VM all virtual disks look the same, so the agent can only say „unknown".

2. The design in eight lines

1. Every storage place gets physical_disks and identity: proven | unknown, with a reason.
2. The agent computes it from /sys and udev; the controller only asks. The hub gets it in the report.
3. A disk's key is bus + model + serial; a vendor-less WWN is not trusted.
4. Tier-2 counts as a second copy only on proven different disks. Otherwise the page says „only one copy", in plain words.
5. A one-disk box gets an internal data place on the system disk, outside the whole-box copy. Media apps then install with no extra step.
6. Films never go into sys_drive: it is inside every whole-box copy.
7. A partition can be a storage place. The classifier judges the partition. Only the installer makes partitions.
8. A VM box is always „unknown". The OMV guide says: a second disk must be a different physical disk.

3. The decisions (my pick first)

• D1 same-disk second copy: do not make it; say „only one copy".
• D2 unknown disks: never count them; the copy is still made.
• D3 installer: mp0 70/130/250 GiB, reserve max(16 GiB, 10 %), the rest is the internal place (512 GB disk → ≈ 152 GiB, 1 TB → ≈ 438, 2 TB → ≈ 1,266).
• D4 old one-disk boxes: a plain sentence; the internal place only by a signed operator job.
• D5 partitions: the installer only this round.
• D6 NAS films (R-1071): a separate decision; this design makes it easier, not harder.

4. What the build task will change

• Agent: place identity in /disks and in the hub report; a „same disk?" call; partitions as candidates; the loop step.
• Controller: Tier-2 and the one-copy notice ask the agent; the sentences move to i18n (informal voice); the install refusal in words; the internal place registered as the default drive.
• Installer: step_grows with the new rule; the internal LV, mounted on the host like a drive.
• Hub: store and show the two new fields.
• Guides and website: the OMV guide's second-disk line; the backup explanation page.

5. Claims in the brief that were wrong

• „That volume is the guest's mp1 /mnt/sys_drive" — wrong. There is no mp1. sys_drive is a folder of mp0 (/var/lib/felhom, backup=1), next to Docker (all three boxes; 07 §7.5.1). This is why films must not go there.
• „The installer … data volume" — partly wrong: the installer computes the size; the agent grows mp0.
• „The classifier must judge the partition, not refuse the whole disk because it has a partition table" — today it does not refuse: it marks the whole disk „data-bearing" and offers only „initialize" (wipe all, customer-confirmed). An empty partition is never offered (measured).
• „Tier-2 = a mirror on the second drive" — incomplete: there is also a state-only fallback onto sys_drive (tier2.go:157-178).
• R-1068's „probable way through — attaching sys_drive" — it would work in code, but it puts films into every whole-box copy. The design rejects it.

6. Commits, register, STATUS

• One commit to felhom.eu (design, evidence, rows, STATUS, this report).
• Doc fix without a row: 07-backup-architecture.md §6.1 still named mp1; corrected (the document contradicted live source).
• Register: 163 → 169. Opened 6 (R-1074 to R-1079), closed 0. Updated R-1068 (now waits on D3/D4).
• STATUS: line D10 in „Waiting on you — decide".
• Boxes put back: the scratch loop disk on demo-hp and the scratch virtual disk on Tester 1 are removed; nothing that held data was written; DooPlex and ep0 not touched. My first loop try left the loop device for about one minute (a missing tool); I removed it at once.
• No product code changed. No changelog entry: this repo has changelogs only for hub, scripts, website and marketing.
• unproven.py: unchanged (35 of 55 not walked).