feat: debug-log the capability-gate verdict per add + SupportState.String()

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/agentapi/features.go

@@ -35,6 +35,18 @@ const (
 	SupportNo
 )
 
+// String returns the state's wire/template vocabulary: "yes" | "no" | "unknown".
+func (s SupportState) String() string {
+	switch s {
+	case SupportYes:
+		return "yes"
+	case SupportNo:
+		return "no"
+	default:
+		return "unknown"
+	}
+}
+
 // SupportProber is the minimal agent surface a probe needs. *Client satisfies it, and so does the
 // web layer's netAgent seam — tests inject fakes there.
 type SupportProber interface {

controller/internal/web/netstorage_handlers.go

@@ -37,14 +37,7 @@ func (s *Server) netAddSupport() string {
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
 	defer cancel()
-	switch s.netFeatures.Supports(ctx, agent, agentapi.FeatureNetstorageVerify) {
+	return s.netFeatures.Supports(ctx, agent, agentapi.FeatureNetstorageVerify).String()
-	case agentapi.SupportYes:
-		return "yes"
-	case agentapi.SupportNo:
-		return "no"
-	default:
-		return "unknown"
-	}
 }
 
 // networkStorageItem is the UI row: the registered descriptor + live per-share health from the agent.
@@ -121,7 +114,9 @@ func (s *Server) handleNetStorageAdd(w http.ResponseWriter, r *http.Request) {
 	// instead of failing mid-pipeline in `verifying` with a misleading rollback. Runs BEFORE the
 	// single-flight claim (a refused add must not consume the slot). SupportUnknown passes: a down
 	// agent speaks through the existing agent-error paths, never as "too old".
-	if s.netFeatures.Supports(r.Context(), agent, agentapi.FeatureNetstorageVerify) == agentapi.SupportNo {
+	support := s.netFeatures.Supports(r.Context(), agent, agentapi.FeatureNetstorageVerify)
+	s.logger.Printf("[DEBUG] [web] netstorage add %q capability gate: %s=%s", name, agentapi.FeatureNetstorageVerify, support)
+	if support == agentapi.SupportNo {
 		s.logger.Printf("[WARN] [web] netstorage add %q refused: agent predates %s (probe 404)", name, agentapi.FeatureNetstorageVerify)
 		writeDiskJSON(w, http.StatusPreconditionFailed, false, netAddOutdatedMsg, map[string]any{"code": "agent_outdated"})
 		return