v0.152.0 + felhom-samba 1.1.0 — mDNS for macOS, and the card stops offering a dead form

Capture on the box disproved the first theory: macOS DOES send a correct NBNS
query for <NAME><20> and nmbd DOES answer it correctly in 140us (flags 0x8580,
RCODE=0, right address) - macOS just never acts on it. NetBIOS there feeds
legacy browsing, not smb:// URL resolution, so the bare name can never work on
a Mac and nmbd was never the broken part.

felhom-samba 1.1.0 adds avahi + dbus, with avahi-daemon.conf and the _smb._tcp
service file templated from FELHOM_SERVER_NAME so a rename re-advertises. Both
daemons are non-fatal on failure - a discovery gap must not become an outage.

v0.151.0's card offered smb://<NAME> for Mac, which is exactly the dead form;
now smb://<NAME>.local. Windows keeps the flat \\<NAME>, which nmbd serves
correctly. Red-proofed both directions.

NOT claimed: Finder-sidebar discovery - published and answering on the wire,
but not observed working on the test Mac. Recorded OPEN.

TestRenderSambaCompose pinned the literal 1.0.0 tag, so an image bump read as a
renderer regression; now derives from SambaImage and asserts non-:latest.

CHANGELOG.md

@@ -1,5 +1,52 @@
 ## Changelog
 
+### v0.152.0 — Megosztás on a Mac: mDNS in the image, and the page stops giving Mac users a dead form (2026-07-20)
+
+Closes **S-3** of `felhom.eu/documentation/audits/DIAG-sharing-2026-07-20.md`, and fixes a copy
+defect v0.151.0 shipped the same day. **Pairs with felhom-samba 1.1.0** — the pin in
+`infra.SambaImage` moves with it, so `Images()` and the golden bake follow automatically.
+
+**The finding that redirected the fix — macOS asks, gets a correct answer, and ignores it.** The
+first theory was that modern macOS no longer does NetBIOS. A packet capture on the box disproved
+that: on a bare `smb://FELHOM` the Mac broadcasts a well-formed NBNS query for `FELHOM<20>` (the
+File Server Service suffix — exactly right for SMB), and nmbd answers in 140 microseconds with a
+textbook positive response — flags `0x8580` (response, authoritative, RCODE=0), ANCOUNT 1, unique
+B-node, the correct address. **macOS never opens a TCP connection.** Sixteen seconds later the same
+Mac connected through `smb://FELHOM.local` on the first try. NetBIOS on macOS feeds legacy browsing,
+not `smb://` URL resolution — so no change on our side can ever make the bare name work there, and
+nmbd is not the thing that was broken. (nmbd answers twice per broadcast, because it holds
+`0.0.0.0:137`, `<ip>:137` and `<bcast>:137` and a broadcast lands on two of them. Standard Samba;
+investigated and dismissed — a duplicated correct answer is still a correct answer.)
+
+**felhom-samba 1.1.0 — avahi + dbus, so the Mac has a mechanism at all.** The image's discovery set
+was Windows-only: nmbd for flat-name resolution, wsdd for Explorer's Network view, and nothing
+whatsoever for Bonjour. It now runs avahi, with `avahi-daemon.conf` and an `_smb._tcp` service file
+**templated from `FELHOM_SERVER_NAME` in the entrypoint** — renaming the server in the UI
+re-advertises under the new name, where a baked name would leave the box answering to something the
+customer can no longer see anywhere. A static service file rather than smbd's own `multicast dns
+register`: it needs no line in `smb.conf` (bind-mounted READ-ONLY, owned by the controller's
+renderer) and it lets us publish `_device-info._tcp` for a sensible Finder icon. Both new daemons
+are non-fatal on failure — sharing over an address must not become an outage because a discovery
+daemon did not come up. Proven live from the operator's Mac before the image was built, then the
+built image smoke-tested with all five daemons up and avahi registered as `<NAME>.local`.
+
+**The page no longer tells Mac users to do the one thing that cannot work.** v0.151.0's connect card
+offered `smb://<NÉV>` for Mac. That is precisely the dead form. It is now `smb://<NÉV>.local`; the
+Windows line stays the flat `\\<NÉV>`, which nmbd serves correctly and which this release must not
+disturb. Red-proofed: reverting the template to the bare name turns
+`TestSharingConnectCard_MacLineIsDotLocalNotBareName` red on both the missing `.local` and the
+present bare form, for two different configured names — and the same test asserts the Windows line
+neither disappears nor wrongly gains `.local`.
+
+**NOT claimed: automatic Finder-sidebar discovery.** The `_smb._tcp` record is published and answers
+browse queries on the wire, but the test Mac's sidebar stayed empty — it had no Network/Bonjour
+section shown at all, which is a Finder Settings toggle rather than something the box controls. This
+is recorded as OPEN in the DIAG, deliberately not as a shipped feature.
+
+`TestRenderSambaCompose` asserted the literal tag `felhom-samba:1.0.0`, so a routine image bump read
+as a renderer regression. It now derives from `SambaImage` and separately asserts what actually
+matters — that the tag is explicit and never `:latest`.
+
 ### v0.151.0 — the Megosztás page stops reloading, and says how to connect (2026-07-20)
 
 Closes **S-1**, **S-2**, **S-5** and the core of **S-4** from