Dedicated data disks drill — fresh install + flagless reprovision, real VM
run finished: 2026-10-14T23:30+01:00   host: thebeast
test: bastion/tests/integration/data-disks.test.ts (1 passed, 1164s)
topology: 1 VM, role k8s-worker schema v2, 1000G OS disk + 2x 20G data disks
addressed as /dev/disk/by-id/virtio-LHDRILL7F600711 (longhorn) and
/dev/disk/by-id/virtio-RNDRILL7FD4070C (rancher) — the same by-id contract
thebeast's NVMe serials use.

Proven:
- fresh install: labvg = home/root/srv/swap/var/varlog ONLY (no longhorn,
  no rancher LV); /var/lib/longhorn and /var/lib/rancher are whole-disk xfs
  partitions labelled lab-longhorn / lab-rancher, each verified to sit on
  the disk with the matching serial; lab-schema-v2 tag present; fstab by UUID.
- reprovision with NO dataDisks flags: both disks rediscovered by label,
  remounted --noformat (filesystem UUIDs identical before/after), marker
  files intact in /home /srv /var/lib/longhorn /var/lib/rancher, LV set and
  schema tag unchanged.

=== checkpoints ===
[22:10:40] [dd-worker] creating VM (1000GB disk + 2 data disk(s), role=k8s-worker, schema=v2)
[22:13:02] [dd-worker] queueing install...
[22:15:25] [dd-worker] installing (up to 60 min)...
[22:21:24] [dd-worker] up at 192.168.251.194
[22:21:24] [dd-worker] on-disk LVs: home=8G root=32G srv=16G swap=16G var=48G varlog=16G
[22:21:27] [dd-worker] wrote marker preserve-1792016486955-iu1rih into /home, /srv, /var/lib/longhorn, /var/lib/rancher
[22:21:27] [dd-worker] reprovisioning (role=k8s-worker, schema: whatever is on disk)...
[22:29:58] [dd-worker] back up at 192.168.251.194 after reinstall
[22:29:59] [dd-worker] markers after reinstall: all four mounts carry preserve-1792016486955-iu1rih
[22:29:59] [dd-worker] on-disk LVs: home=8G root=32G srv=16G swap=16G var=48G varlog=16G
✓ k8s-worker with longhorn+rancher disks: install, then flagless reprovision rediscovers both (1161s)

Run notes (cost of learning, so nobody pays it twice):
- the drill machine's bastion imports resolve @lab/shared to dist/ -- run
  `pnpm build` after switching branches or the API answers with the OLD role
  registry ("invalid role: 'k8s-worker'").
- a passphrase-protected default ~/.ssh/id_rsa fails as "SSH not available"
  with a perfectly healthy machine (BatchMode never offers it without an
  agent). Use LAB_TEST_SSH_KEY with a dedicated passphrase-less key.
- run: cd bastion && LAB_TEST_SSH_KEY=~/.ssh/lab-integration_ed25519 \
    sudo -E npx vitest run -c tests/integration/vitest.config.ts tests/integration/data-disks.test.ts