[Starosdev]

Summary

Scrutiny collected filesystem capacity per host, but nothing connected a filesystem to the drive underneath it, so neither the dashboard card nor the device detail page could report free space for a drive. This adds that link and surfaces it on both surfaces, which closes the remaining gap in #470 (self-test history and performance benchmarks already shipped).

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• CI/CD or infrastructure change

Related Issues

Closes #470

Filed separately during review, deliberately not fixed here: #1046 (collectors share an empty default host.id, so unconfigured hosts are treated as one). That collision predates this work and changing host identity needs its own migration story.

Changes Made

Resolving a mount to its drives

• collector/pkg/blockdev walks the kernel holder tree under /sys/class/block from each mount source down to the whole disks beneath it. Partitions, LVM, md and LUKS resolve through the same walk. The walk reads sysfs rather than parsing the source device path on purpose: trimming digits off a partition name is wrong for every device whose name already ends in one (nvme0n1p2, md1p1, mmcblk0p1), and a device-mapper path such as /dev/mapper/vg-root names no disk at all.
• An md hot spare holds none of the array's data, so each member's role is read from md/dev-<name>/state and a spare is skipped. A member whose state cannot be read is kept: over-attributing one drive is a smaller error than hiding a data-carrying drive's filesystems.
• Loop, zram and ram devices are not reported. They are kernel-synthesized rather than drives, so Scrutiny never registers one and a link naming it could match nothing; a snap-based host would otherwise write one such row per snap package.
• The filesystem collector uploads the resolved disk names with each snapshot, as backing_devices on FilesystemCapacity.

Storing and serving the link

• New filesystem_devices table (migration m20261027000000), one row per (filesystem, disk) pair, because the relation is many-to-many: a disk carries several filesystems, and an LVM or md filesystem spans several disks. Links are replaced with the snapshot that owns them, so a moved mount leaves no stale attribution.
• Purging a SMART host now deletes its filesystem capacity, host status and device link rows inside the same transaction as its devices. Left behind, they would attribute the purged host's free space to whichever drive next registered under the same device name and host id.
• GET /api/device/:id/details carries filesystems and filesystem_status; the device summary used by GET /api/summary carries filesystems per device.
• Per-drive reads collapse repeated mounts of one filesystem. A block device holds one filesystem, so two mounts reporting the same source are the same filesystem seen twice: a bind mount carries the underlying device as its source, and btrfs subvolume mounts repeat it. Only sources naming a block device are collapsed, since distinct mounts may legitimately share a source string such as none. The per-host capacity panel still lists every mount, which is the point there.

UI

• The dashboard device card reports a single Free figure only when exactly one filesystem sits on the drive and that filesystem sits on no other drive. Every other case shows a mount count. Shared free space is never divided between drives, because the kernel reports no such split and any division would be invented.
• The device detail page gains a Filesystems panel with per-mount used, free and total bytes, a usage bar carrying progressbar semantics, and a "shared with" note naming the other drives when a filesystem spans more than one. The panel renders only once a host status exists, so a deployment that never enabled the filesystem collector gains no empty card on every drive.
• An unattributed filesystem stays unattributed. The panel explains the possible reasons (a collector older than the backing-device field, a host where sysfs cannot be read, a host id that differs between the filesystem and SMART collectors, or genuinely no mounted filesystem) instead of reporting zero bytes free.
• The details response carries filesystem_collector_reporting, true when the filesystem collector has reported for any host. A per-host status cannot distinguish a collector running under another host id from one that was never enabled, and the two need different answers: the first gets the mismatch named, quoting the drive's host id, and the second gets no panel at all. This matters on the default configuration, where the filesystem collector maps an empty host.id to default and the SMART collector stores it unchanged, so nothing attributes until COLLECTOR_HOST_ID is set for both. The identity collision itself is [BUG] Collectors share an empty default host.id, so unconfigured hosts are treated as one #1046.
• filesystemUsageClass moved to app/shared/filesystem-usage.utils.ts so the dashboard panel and the new detail panel cannot disagree about a filesystem's colour.

Docs

• docs/FILESYSTEM_CAPACITY.md records the attribution model and its limits: Linux-only, md spares skipped, dm-cache and bcache cache devices still attributed the filesystem they front, btrfs multi-device attributed to one disk, repeated mounts collapsed per drive, and filesystem rows purged with their host.
• docs/openapi.yaml documents the new fields. filesystem_status uses allOf because this document is 3.0.3, where sibling keys beside $ref are ignored.

Testing

• I have tested this locally
• I have added/updated tests that prove my fix/feature works
• All existing tests pass

On this head CI has Test Frontend, Lint Backend (Go), Test Backend and every Linux, Windows and FreeBSD build green. See the CI note at the end of this body for the two checks that are not.

Locally: go build ./..., go vet ./webapp/backend/... ./collector/..., and golangci-lint run over every changed Go package are clean, with only findings that predate this branch remaining.

New tests:

• collector/pkg/blockdev/backing_test.go builds a fake sysfs and /dev tree (two disks with partitions, an md array across both, an array with a hot spare, an LVM volume, an nvme namespace, a loop device, a mapper symlink) and covers whole disks, partitions, stacked devices, spare skipping, synthetic disks, non-block sources, unknown devices, a missing sysfs root and a cyclic holder tree.
• collector/pkg/filesystem/detect_test.go asserts backing devices reach the snapshot and that a network mount is still reported with no attribution.
• scrutiny_repository_filesystems_test.go covers grouping by drive, duplicate backing devices against the primary key, stale-link removal, source dedupe, and attachFilesystems (per-drive attribution, host isolation, a RAID passthrough device name matching nothing, and summaries left intact when the table is unreadable).
• scrutiny_repository_hosts_test.go asserts a purged host's filesystem rows are gone and an unselected host's survive.
• get_device_details_test.go covers the handler: only this drive's filesystems, no leakage from another host's drive of the same name, repeated mounts collapsed, filesystem_status omitted rather than null when a host never reported, and SMART data still served when the filesystem read fails.
• dashboard-device.component.spec.ts covers the four card cases; detail.component.spec.ts covers the panel's helpers.

Each fix was neutered to confirm its test goes red: the partition-to-disk step, the spare filter, the stale-link delete, the source dedupe, and the purge cleanup.

Checklist

• My code follows the project's code style
• I have performed a self-review of my code
• I have commented my code where necessary (particularly complex areas)
• I have updated the documentation if needed
• My changes generate no new warnings
• No console.log, debug statements, or commented-out code

Additional Notes

Review: required (adds a database migration)

Rollout notes:

• The migration is additive: it creates filesystem_devices and touches no existing table.
• Per-drive attribution needs the filesystem collector, which stays disabled by default in omnibus deployments. Enabling it is unchanged (COLLECTOR_FILESYSTEM_CRON_SCHEDULE, COLLECTOR_FILESYSTEM_RUN_STARTUP), and this PR does not change that default.
• A collector older than this change uploads snapshots with no backing devices. The host capacity panel keeps working and per-drive figures appear once the collector is upgraded, so server and collector may be rolled out in either order.
• Attribution reads sysfs, so it produces results on Linux hosts only.

CI notes, neither caused by this change:

• npm audit under Dependency Audit fails on five undici advisories inside npm's own bundled dependency tree, against a three-entry allowlist in .github/scripts/audit-release-tooling.mjs, which this PR does not touch. It currently fails on other open branches too, but the cause is advisory timing rather than anything branch-specific: develop's last Dependency Audit run passed on 2026-10-25, before these advisories were published.
• Build darwin/amd64 and Build darwin/arm64 were cancelled on an earlier head after 15 minutes with no steps recorded, a macos-latest runner that never picked the job up rather than a build failure. Re-running them passed.
• TestIsMountPointSuitable_RequiresHeadroomAboveTestFile in collector/pkg/performance failed on earlier heads of this branch, being environment-dependent on whether the runner's temp directory is tmpfs. fix(performance): cover the benchmark headroom rule without a filesystem #1040 has since merged and this branch now carries it, so the flake is gone. This PR touches neither that package nor its collector/pkg/mounts dependency.

develop has no required status checks, so none of these gate the merge button; they are recorded so a reviewer does not re-chase them.

[Starosdev]

CI triage at head c7e27c0e: both red checks are unrelated to this PR

Recording this so nobody re-chases them.

Test Backend fails on exactly one test, TestIsMountPointSuitable_RequiresHeadroomAboveTestFile in collector/pkg/performance. The test asserts an "insufficient space" rejection, but the runner's temp directory is tmpfs, so the mount is rejected earlier with "filesystem type is tmpfs (device not mounted as a real filesystem)".

• This PR touches neither collector/pkg/performance nor its dependency collector/pkg/mounts.
• The same single test fails on unrelated branches (feat/494-backblaze-attribution, fix/1015-bucket-paging-offset).
• fix(performance): cover the benchmark headroom rule without a filesystem #1040, "fix(test): skip the mount headroom test when the temp dir is tmpfs", is open against develop for exactly this, and its branch is the only recent CI run that passed.

npm audit (Dependency Audit) fails on undici advisories inside npm's own bundled dependency tree, which no change in this PR affects.

Everything this PR does touch is green on the same run:

Package	Result
collector/pkg/blockdev	ok, 89.4% coverage
collector/pkg/filesystem	ok
webapp/backend/pkg/database	ok, 59.2% coverage

Test Frontend, Lint Backend (Go), and all ten cross-platform builds are green, so the frontend build and Angular specs are verified by CI.

This stays in draft until #1040 merges and a develop merge here turns Test Backend green. The remaining gate after that is an independent review against the then-current head.