test: localapi invisible-share test asserts re-arm + re-verify

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017CDMFpFx84pfviCTVuGGhf

internal/localapi/netreassert_test.go

@@ -79,8 +79,9 @@ func TestReassertNetworkMounts_VerifiesRunningGuestsOnly(t *testing.T) {
 	}
 }
 
-// A guest that does NOT see the share after reassert is a WARN, never an error — the method
-// returns normally (non-fatal proof) and the pass still ran.
+// A guest that does NOT see the share after reassert triggers a re-arm + re-verify (F11
+// matrix-correction), stays non-fatal, and the pass still ran. sees=false throughout → the re-verify
+// also misses, logs STILL-not-visible, never errors.
 func TestReassertNetworkMounts_InvisibleShareNonFatal(t *testing.T) {
 	n := &fakeNetOpsReassert{results: []storage.NetReassertResult{
 		{Name: "media", Where: "/mnt/felhom-drives/media", Action: storage.NetReassertRearmed},
@@ -96,8 +97,9 @@ func TestReassertNetworkMounts_InvisibleShareNonFatal(t *testing.T) {
 
 	srv.ReassertNetworkMounts(context.Background()) // must not panic / abort
 
-	if n.reassertN != 1 || len(ga.seen) != 1 {
-		t.Fatalf("pass must complete despite invisible share: reassert=%d seen=%+v", n.reassertN, ga.seen)
+	// A blind guest must trigger exactly one re-arm, and GuestSeesMount is checked twice (before + after).
+	if n.reassertN != 1 || len(n.rearmed) != 1 || len(ga.seen) != 2 {
+		t.Fatalf("blind guest must re-arm once + re-verify: reassert=%d rearmed=%v seen=%+v", n.reassertN, n.rearmed, ga.seen)
 	}
 }