F11 matrix-correction: re-arm on guest-blind (active mounts not inherited by rebooted guest — live finding)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017CDMFpFx84pfviCTVuGGhf

internal/guesthook/netreassert.go

@@ -23,6 +23,7 @@ import (
 // netReasserter is the reassert capability (satisfied by *storage.SudoHostOps; faked in tests).
 type netReasserter interface {
 	ReassertNetworkAutomounts(ctx context.Context) []storage.NetReassertResult
+	RearmNetworkAutomount(ctx context.Context, where string) error
 }
 
 // PostStartNetworkReassert re-arms idle NAS automount triggers after vmid started, then verifies
@@ -48,9 +49,21 @@ func postStartNetworkReassert(ctx context.Context, vmid string, ops netReasserte
 		if sees(ctx, vmid, res.Where) {
 			fmt.Fprintf(os.Stderr, "felhom-agent guest-hook: vmid %s post-start — network share %s visible in guest (%s)\n",
 				vmid, res.Name, res.Action)
+			continue
+		}
+		// F11 matrix-correction: the guest is blind even though the pass classified this share
+		// skip-active/rearmed. A freshly-started namespace does NOT inherit an ACTIVE host mount — only
+		// a FRESH trigger event propagates in. Re-arm this specific share and re-verify once.
+		fmt.Fprintf(os.Stderr, "felhom-agent guest-hook: vmid %s post-start — network share %s not visible after reassert (%s) — re-arming\n",
+			vmid, res.Name, res.Action)
+		if err := ops.RearmNetworkAutomount(ctx, res.Where); err != nil {
+			fmt.Fprintf(os.Stderr, "felhom-agent guest-hook: vmid %s post-start — WARNING: re-arm of %s failed: %v\n", vmid, res.Name, err)
+			continue
+		}
+		if sees(ctx, vmid, res.Where) {
+			fmt.Fprintf(os.Stderr, "felhom-agent guest-hook: vmid %s post-start — network share %s visible in guest after re-arm (healed)\n", vmid, res.Name)
 		} else {
-			fmt.Fprintf(os.Stderr, "felhom-agent guest-hook: vmid %s post-start — WARNING: network share %s NOT visible in guest after reassert (%s)\n",
-				vmid, res.Name, res.Action)
+			fmt.Fprintf(os.Stderr, "felhom-agent guest-hook: vmid %s post-start — WARNING: network share %s STILL NOT visible after re-arm\n", vmid, res.Name)
 		}
 	}
 }

internal/guesthook/netreassert_test.go

@@ -8,8 +8,10 @@ import (
 )
 
 type fakeReasserter struct {
-	invoked int
-	results []storage.NetReassertResult
+	invoked  int
+	rearmed  []string
+	rearmErr error
+	results  []storage.NetReassertResult
 }
 
 func (f *fakeReasserter) ReassertNetworkAutomounts(context.Context) []storage.NetReassertResult {
@@ -17,6 +19,11 @@ func (f *fakeReasserter) ReassertNetworkAutomounts(context.Context) []storage.Ne
 	return f.results
 }
 
+func (f *fakeReasserter) RearmNetworkAutomount(_ context.Context, where string) error {
+	f.rearmed = append(f.rearmed, where)
+	return f.rearmErr
+}
+
 // The post-start core must run the reassert pass and verify guest visibility for every share the
 // pass acted on (or found actively mounted) — and never for foreign/errored rows.
 func TestPostStartNetworkReassert_Core(t *testing.T) {
@@ -41,16 +48,41 @@ func TestPostStartNetworkReassert_Core(t *testing.T) {
 	}
 }
 
-// A failed verify must be non-fatal: the core returns normally (the hook exits 0 regardless).
-func TestPostStartNetworkReassert_VerifyFailureNonFatal(t *testing.T) {
+// F11 matrix-correction: a guest that does NOT see a share (even a skip-active one) must trigger a
+// re-arm of that specific share, then a re-verify. Encodes the live 2026-07-12 finding that a rebooted
+// guest inherits neither an idle trigger nor an active mount.
+func TestPostStartNetworkReassert_RearmsWhenGuestBlind(t *testing.T) {
 	ops := &fakeReasserter{results: []storage.NetReassertResult{
-		{Name: "media", Where: "/mnt/felhom-drives/media", Action: storage.NetReassertRearmed},
+		{Name: "media", Where: "/mnt/felhom-drives/media", Action: storage.NetReassertSkipActive},
 	}}
-	// Must not panic or abort; the WARNING goes to stderr (PVE task log).
+	// sees: false the first time (blind), true the second (post-rearm) — the heal path.
+	calls := 0
+	postStartNetworkReassert(context.Background(), "9201", ops, func(context.Context, string, string) bool {
+		calls++
+		return calls >= 2
+	})
+	if len(ops.rearmed) != 1 || ops.rearmed[0] != "/mnt/felhom-drives/media" {
+		t.Fatalf("a blind guest must trigger exactly one re-arm of the share, got %v", ops.rearmed)
+	}
+}
+
+// A failed verify must be non-fatal even if the re-arm also fails: the core returns normally (hook
+// exits 0 regardless).
+func TestPostStartNetworkReassert_VerifyFailureNonFatal(t *testing.T) {
+	ops := &fakeReasserter{
+		rearmErr: context.DeadlineExceeded,
+		results: []storage.NetReassertResult{
+			{Name: "media", Where: "/mnt/felhom-drives/media", Action: storage.NetReassertRearmed},
+		},
+	}
+	// Must not panic or abort; the WARNING goes to stderr (PVE task log). Guest never sees it, re-arm errors.
 	postStartNetworkReassert(context.Background(), "9201", ops, func(context.Context, string, string) bool {
 		return false
 	})
 	if ops.invoked != 1 {
 		t.Fatalf("reassert pass invoked %d times, want 1", ops.invoked)
 	}
+	if len(ops.rearmed) != 1 {
+		t.Fatalf("a blind guest must attempt one re-arm, got %d", len(ops.rearmed))
+	}
 }