F11 matrix-correction: re-arm on guest-blind (active mounts not inherited by rebooted guest — live finding)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017CDMFpFx84pfviCTVuGGhf

internal/localapi/netreassert.go

@@ -11,6 +11,7 @@ import (
 // NetworkStorageOps interface (and its test fakes) stay unchanged.
 type networkReasserter interface {
 	ReassertNetworkAutomounts(ctx context.Context) []storage.NetReassertResult
+	RearmNetworkAutomount(ctx context.Context, where string) error
 }
 
 // ReassertNetworkMounts is the NAS counterpart of ReassertGuestBinds (RCA
@@ -50,9 +51,26 @@ func (s *Server) ReassertNetworkMounts(ctx context.Context) {
 			}
 			if s.guestAttach.GuestSeesMount(ctx, vmid, res.Where) {
 				s.logger.Debug("netreassert: guest sees network share", "vmid", vmid, "name", res.Name, "where", res.Where)
+				continue
+			}
+			// F11 matrix-correction (2026-07-12): a running guest that does NOT see a share must be
+			// remediated — a fresh namespace inherits neither an idle trigger NOR an active mount; only a
+			// FRESH trigger event propagates in. Re-arm this share and re-verify once (covers guests that
+			// autostarted before the agent).
+			r, ok := s.netStorage.(networkReasserter)
+			if !ok {
+				continue
+			}
+			s.logger.Warn("netreassert: guest does NOT see network share after reassert — re-arming",
+				"vmid", vmid, "name", res.Name, "where", res.Where, "action", res.Action)
+			if err := r.RearmNetworkAutomount(ctx, res.Where); err != nil {
+				s.logger.Warn("netreassert: re-arm failed", "vmid", vmid, "name", res.Name, "err", err)
+				continue
+			}
+			if s.guestAttach.GuestSeesMount(ctx, vmid, res.Where) {
+				s.logger.Info("netreassert: guest sees network share after re-arm (healed)", "vmid", vmid, "name", res.Name, "where", res.Where)
 			} else {
-				s.logger.Warn("netreassert: guest does NOT see network share after reassert",
-					"vmid", vmid, "name", res.Name, "where", res.Where, "action", res.Action)
+				s.logger.Warn("netreassert: guest STILL does not see network share after re-arm", "vmid", vmid, "name", res.Name, "where", res.Where)
 			}
 		}
 	}