felhom.eu/REPORT-storage-identity-2026-10-15.md

# REPORT — storage that knows its physical disks: design draft + spike (2026-10-15)

Written in ASD-STE100 Simplified Technical English. Baselines read 19:50: felhom.eu `340804f9af`, felhom-controller
`83392064ae`, felhom-agent `d2053e7d47`. Read first: `03-host-agent.md`, `04-control-plane-authorization.md`,
`07-backup-architecture.md` §6 and §7.5, `15-media-library.md`, `02-controller-module-map.md`, the agent's `/disks`
code and classifier, the controller's drive model and Tier-2 choice, the installer's `step_grows`.
Design: `documentation/architecture/16-storage-physical-identity.md` (DRAFT). Evidence: `documentation/audits/storage-identity-2026-10-15/`.

## What waits on you

**Answer six questions: `16-storage-physical-identity.md` §12 (STATUS D10).** My picks: D1 (a), D2 (a), D3 (a), D4 (a),
D5 (a), D6 (a). If you do nothing: one-disk boxes keep refusing media apps, and boxes in a VM keep counting same-disk
copies as second copies. Nothing is built until you answer.

## 1. Did the agent-side method name the right physical disk? (Part B)

| Case | Right? |
|---|---|
| 1 One disk (N100, demo-hp): every system place → the one SSD | yes |
| 2 Two disks: system vs enrolled drive (demo-hp, N100) | yes |
| 3 Two partitions of one disk (a scratch loop disk) | yes — after one fix in my probe |
| 4a USB bridge that passes the identity (N100's backup drive) | yes |
| 4b USB bridge that hides the serial | not measured — no device (R-1077) |
| 5 / 6 Inside a VM: same host disk vs a different host disk | both „unknown" — correct |
| 7 Network share | „network, unknown" by rule (no live share mounted today) |

**VM cases in one sentence:** inside a VM all virtual disks look the same, so the agent can only say „unknown".

## 2. The design in eight lines

1. Every storage place gets `physical_disks` and `identity: proven | unknown`, with a reason.
2. The agent computes it from `/sys` and udev; the controller only asks. The hub gets it in the report.
3. A disk's key is bus + model + serial; a vendor-less WWN is not trusted.
4. Tier-2 counts as a second copy only on proven different disks. Otherwise the page says „only one copy", in plain words.
5. A one-disk box gets an internal data place on the system disk, outside the whole-box copy. Media apps then install with no extra step.
6. Films never go into `sys_drive`: it is inside every whole-box copy.
7. A partition can be a storage place. The classifier judges the partition. Only the installer makes partitions.
8. A VM box is always „unknown". The OMV guide says: a second disk must be a different physical disk.

## 3. The decisions (my pick first)

- D1 same-disk second copy: **do not make it**; say „only one copy".
- D2 unknown disks: **never count them**; the copy is still made.
- D3 installer: **`mp0` 70/130/250 GiB, reserve max(16 GiB, 10 %), the rest is the internal place** (512 GB disk → ≈ 152 GiB, 1 TB → ≈ 438, 2 TB → ≈ 1,266).
- D4 old one-disk boxes: **a plain sentence**; the internal place only by a signed operator job.
- D5 partitions: **the installer only** this round.
- D6 NAS films (R-1071): **a separate decision**; this design makes it easier, not harder.

## 4. What the build task will change

- Agent: place identity in `/disks` and in the hub report; a „same disk?" call; partitions as candidates; the loop step.
- Controller: Tier-2 and the one-copy notice ask the agent; the sentences move to i18n (informal voice); the install refusal in words; the internal place registered as the default drive.
- Installer: `step_grows` with the new rule; the internal LV, mounted on the host like a drive.
- Hub: store and show the two new fields.
- Guides and website: the OMV guide's second-disk line; the backup explanation page.

## 5. Claims in the brief that were wrong

- „That volume is the guest's `mp1 /mnt/sys_drive`" — wrong. There is no `mp1`. `sys_drive` is a folder of `mp0`
  (`/var/lib/felhom`, `backup=1`), next to Docker (all three boxes; `07` §7.5.1). This is why films must not go there.
- „The installer … data volume" — partly wrong: the installer computes the size; the agent grows `mp0`.
- „The classifier must judge the partition, not refuse the whole disk because it has a partition table" — today it
  does not refuse: it marks the whole disk „data-bearing" and offers only „initialize" (wipe all, customer-confirmed).
  An empty partition is never offered (measured).
- „Tier-2 = a mirror on the second drive" — incomplete: there is also a state-only fallback onto `sys_drive` (`tier2.go:157-178`).
- R-1068's „probable way through — attaching `sys_drive`" — it would work in code, but it puts films into every
  whole-box copy. The design rejects it.

## 6. Commits, register, STATUS

- One commit to felhom.eu (design, evidence, rows, STATUS, this report).
- Doc fix without a row: `07-backup-architecture.md` §6.1 still named `mp1`; corrected (the document contradicted live source).
- **Register: 163 → 169.** Opened 6 (R-1074 to R-1079), closed 0. Updated R-1068 (now waits on D3/D4).
- STATUS: line D10 in „Waiting on you — decide".
- Boxes put back: the scratch loop disk on demo-hp and the scratch virtual disk on Tester 1 are removed; nothing that
  held data was written; DooPlex and ep0 not touched. My first loop try left the loop device for about one minute (a
  missing tool); I removed it at once.
- No product code changed. No changelog entry: this repo has changelogs only for hub, scripts, website and marketing.
- `unproven.py`: unchanged (35 of 55 not walked).