Backup scripts read device/UUID/target from the host config

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/check-templates.sh

@@ -90,6 +90,24 @@ if awk '
     END { exit bad }
 ' deploy.sh; then ok "flagged units are only touched inside their ENABLE_* guard"; else bad "flag gating"; fi
 
+# 7. backup scripts take their settings from the host config and say what is missing
+empty=$(mktemp); trap 'rm -f "$empty"' EXIT
+for pair in "failover/sync-usb-backup.sh:USB_BACKUP_ROOT_PART" "failover/sync-sd-backup.sh:SD_BACKUP_UUID"; do
+    s=${pair%%:*}; v=${pair##*:}
+    if out=$(VANLINK_CONF="$empty" "./$s" 2>&1); then
+        bad "$s should fail when $v is not set"
+    elif echo "$out" | grep -q "$v"; then
+        ok "$s names missing $v"
+    else
+        bad "$s failed but did not mention $v"; echo "$out" | sed 's/^/       /'
+    fi
+done
+if grep -nE '/dev/sda2|10\.42\.[01]\.44|39118305-4927' failover/sync-*-backup.sh; then
+    bad "hardcoded host values remain in the backup scripts"
+else
+    ok "no hardcoded devices/UUIDs/addresses in the backup scripts"
+fi
+
 # 8. ./deploy.sh --diff runs (no root) and lists rendered files
 if out=$(./deploy.sh --diff hosts/van.conf 2>&1) && echo "$out" | grep -qE '^(NEW|CHANGED) '; then
     ok "deploy.sh --diff hosts/van.conf"