felhom.eu/REPORT-storage-identity-buildA-2026-10-15.md

REPORT — storage identity, build A: honest backup copies (2026-10-15)

Brief: „Storage identity, build A — honest backup copies (D1, D2, D4)". Design: documentation/architecture/16-storage-physical-identity.md (now ACCEPTED; §13 = what was built). Evidence: documentation/audits/storage-identity-buildA-2026-10-15/README.md. Method: endpoint level (no browser on DooPlex) — the agent's local API with the guest's token, the dashboard pages and the Tier-2 endpoint the buttons call, the hub's database with its WAL.

What shipped

Component	Version	What	State
agent	v0.157.0	every storage place: kind, physical_disks, identity + reason, in GET /disks and the hub report; POST /disks/same-disk	released; on Tester 1, demo-hp, N100 by signed jobs; not vouched
controller	v0.317.0 (MinAgent 0.157.0)	Tier-2 and the one-copy notice ask the agent (same → no copy; unknown → made, not counted, „cannot check" sentence; a NAS never counts and never hides the notice; an older agent keeps the old rule); the no-drive install sentence with a link	pushed; on the three test boxes by per-box floors; global floor still 0.314.0
hub	v0.154.0	stores the fields; the host page shows „Physical disk" and „Identity"	deployed

What the household sees

• Tester 1 (a VM): „A Felhom nem tudja ellenőrizni, hogy a második meghajtó valóban másik lemez-e…”. The copies are made; each app says it is not counted as a second copy.
• demo-hp and N100 (real disks): nothing changed. Copies counted, no notice.
• The no-drive sentence („Ehhez az alkalmazáshoz egy adattároló kell. A Meghajtók oldalon adhatsz hozzá egyet.”): unit-proven only; no one-disk box was at hand.
• A NAS keeps the notice: unit-proven only; the scratch box cannot reach its agent (R-1083).

Register

Rows before: 170 · after: 170 · opened 3 · closed 3.

• Closed: R-1072 (fully — the brief expected half), R-1074, R-1075.
• Narrowed: R-1068 (the sentence built; the internal place waits for build B), R-1079 (build A shipped).
• Opened: R-1082 (the drives page offers /mnt/sys_drive, which the design rejects — yours), R-1083 (scratch box 9202 has no local API, so agent features cannot be tested there), R-1084 (the whole-box backup offer promises disk-failure protection without checking the disk).

Claims in the brief or the design that were wrong

1. „Never offer sys_drive" (16 §11): the drives page still offers it (R-280) → R-1082, for the operator.
2. „R-1072's half": all of R-1072 closed — the other sentence was already informal.
3. Live NAS proof on a scratch box: 9202 has no local_api, so no box could show it → R-1083.
4. 16 §3 „compute at start and on hot-plug": the build computes on every read instead; a swapped disk still never keeps an old verdict.
5. The baselines in the brief had moved (another session released controller 0.316.1–0.316.4 meanwhile); build A sits on 0.316.4.

Documents changed

16-storage-physical-identity.md (status, §12 ruled, §13 new) · capability map row D14 (PARTIAL) + detail · OPEN-ITEMS.md / CLOSED-ITEMS.md · STATUS.md (D10 removed; one shipped line; two „do" items) · system poster: text only — the Tier-2 line in felhom-system-poster.facts.md and the same text in felhom-system-poster.html.

Waits on the operator

1. Vouch agent 0.157.0 and its bundle. Then CC raises the global floor to 0.317.0 / MinAgent 0.157.0 and clears the three per-box floors. If not: every other box stays on 0.314.0 and its old rule.
2. Rule on R-1082 (hide /mnt/sys_drive on the drives page, or keep it until build B).
3. A build B task file (internal place, partitions, installer; the D3 space check).

Teardown

Machine: the three test boxes stay on 0.317.0 (per-box floors); 9202 back on 0.314.0. Host: helper script removed from demo-hp, felhom-pve, Tester 1's host. Hub: three per-customer floors (to clear after the global floor). Secrets: the scratch password and token files deleted; none in any commit.