controller v0.119.0: storage-health coherence F8 + mapped_uid F4 — docs + CHANGELOG + REPORT + CONTEXT

F8: share row fuses the shipped v0.117 classifier (fuseNetHealth) so it agrees with
the stacks stub badge (one classification, two surfaces). F4: mapped_uid range check
1..65533 at the door. §3 fork = option B (controller-only). Live-validated on 9201.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017CDMFpFx84pfviCTVuGGhf

controller/README.md

@@ -864,6 +864,19 @@ not just those with HDD data. Non-HDD apps can configure destination, method, an
 >   alkalmazás nem a NAS-t látja", `NetworkStubs`) that WINS over the recoverable `unreachable` badge.
 >   The agent pair (v0.84.0 `ReassertNetworkMounts`) re-arms triggers on guest start; this layer is the
 >   detection net beneath it.
+> - **One classification, two surfaces (v0.119.0, CAMPAIGN-3 F8):** the **share row** on the
+>   `/storage/network` page now reads the SAME classifier. Its health used to come only from the agent's
+>   server-level TCP dial (`server:2049/445`), which stays green when a *single* export is `exportfs -u`'d
+>   — so the row showed benign "Készenlét" while the stacks cards showed the stub. `fuseNetHealth`
+>   (`netstorage_handlers.go`) fuses the agent view with `classifyFSPath(Where)`: a new **`stub`** health
+>   (badge "Hibás — az alkalmazások nem a NAS-t látják") overrides idle/ok when the namespace sees local
+>   disk; a whole-server `unreachable` still wins over stub; autofs-healthy / network / `unknown` leave
+>   the agent health intact (never force-mount an idle trigger). The row and the stacks badge derive from
+>   ONE classifier and can never contradict.
+> - **mapped_uid validated at the door (v0.119.0, F8's sibling F4):** `handleNetStorageAdd` range-checks
+>   the container uid/gid (**1..65533**; the guest maps `<uid>`→`<uid>+100000`, so 65534=nobody and a
+>   host-side value like 101000 must not be entered) after the `<=0` default — out of range → a friendly
+>   Hungarian 400, nothing installed (previously a raw `agent_error` from the agent).
 > - **Deploy view truth (v0.117.0, RCA fix 4):** a deployed app's read-only storage select now marks
 >   `selected` by the app's STORED `HDD_PATH` (extra disabled `<path> (nem elérhető)` option when the
 >   stored path left the schedulable list) — `IsDefault` selects only for NEW deploys. Pre-fix the view