felhom-controller/REPORT.md

# REPORT — R-66: the box's own address becomes visible (controller v0.159.0, 2026-07-22)

**Spec:** the R-66 prompt (three XS legs, controller-only, v0.158.1 → v0.159.0).
**Commit:** `7013a5f` on `main` · image `felhom-controller:0.159.0`
(sha256 `5bbc7d62433c464fbbcdbe8ef819636b94075d0cc481631d50471880d99630c5`) · deployed to
**demo-felhom 9201** and **demo-hp 9201** (both now above the 0.156.0 floor; floor untouched).

## 1. The one design decision (spec deviation, recorded)

The spec sketched Leg A's Átjáró as a `/proc/net/route` read and Leg B's DNS as `/etc/resolv.conf`.
**The controller container is bridge-networked** (verified live: `docker inspect` →
`NetworkMode=bridge`; the bootstrap `docker run` has no `--network host`) — so every in-process
answer describes the CONTAINER's netns: routes → the docker bridge gateway (172.x), resolv.conf →
docker's 127.0.0.11 embedded resolver, interfaces → one 172.x eth0. That is exactly the
wrong-kind-of-true trap the codebase already documents on `SambaLANAddress` (S-2: "the classic
wrong answer that already burned the setup wizard").

**Resolution:** every guest-net read goes through the ONE guest-netns door this process has — a
docker-exec into the host-networked `felhom-samba` container (`internal/stacks/guestnet.go`, one
`guestNetExecFn` seam for route/link/addr/resolv.conf reads). Accepted consequence, by the spec's
own S-5 logic ("an address-less row beats a wrong address"): with Megosztás off the door is closed
and the card shows „—" / the dump carries per-item error strings. The spec's §2.1 instruction
("check whether it is SMB-conditional… reuse as-is") anticipated exactly this shape.

## 2. What shipped

- **Leg A** — „Hálózat" card on Beállítások → Rendszer, between „Verzió és frissítés" and „Szerver
  memória" (`settings_system.html`, `systemPageData`): Helyi cím (LAN) via the reused
  `sambaLANAddress`; Hálózati név `\\<SMBServerName>` gated on `smb.Enabled` (the NetBIOS name
  exists only while samba runs); Átjáró via the new `guestGateway`; muted footer („…Távoli
  hibaelhárításnál ezt az oldalt kérjük felolvasni."). No host/Proxmox address, no interface dump.
- **Leg B** — `dump["network"]` in `debugDump`: `interfaces` (name/up/addresses; veth*/docker*/br-*
  plumbing skipped), `default_route` (gateway + source interface), `dns_servers` (guest
  resolv.conf — docker copies the HOST's file into a `network_mode: host` container, so the read
  answers for the box), `lan_address` (the SAME live value Leg A shows, the cross-check anchor).
  Best-effort per item: a failed read yields `"error: …"` in place, dump never aborts.
- **Leg C** — helper text under the Szerver field (`storage_network.html`, naming the »közvetlen
  cím« row on the Megosztás page), plus `netAddMessage`'s `unreachable` case appends „Tipp: a(z)
  »<name>« Windows-hálózati névnek tűnik — használja az eszköz IP-címét." when
  `looksLikeFlatNetworkName(server)` (non-empty ∧ no dot ∧ not `net.ParseIP`-able). Purely
  lexical; no NetBIOS/mDNS anywhere; agent untouched.
- Nothing is stored: no settings.json/app.yaml/hub-report field carries any of these values.

## 3. Tests + red-proofs

`stacks/guestnet_test.go`: pinned pure parsers (default route incl. garbage/IPv6-gw refusals;
interface merge with docker-plumbing filtering; resolv.conf), `GuestGateway` fail-quiet contract,
and the B1 best-effort matrix (scripted per-argv exec fake: healthy / resolv.conf-only failure /
door fully closed). `web/network_card_test.go`: A1 (all rows render), A2 (Hálózati név ABSENT when
sharing off), A3 („—" + „nem állapítható meg", no crash), per-render freshness counter (2 renders ⇒
2 resolves — the anti-memoization gate), B1 web-half (dump shape + in-place error + dump
completeness), C1/C2/C3 + category containment + IPv6/empty lexical edges.

**Red-proof A2** (enabled-gate dropped in `systemPageData`): FAIL —
`Hálózati név row rendered while Megosztás is disabled — a wrong promise`. Restored, green.
**Red-proof C2** (lexical check inverted): FAIL — the hint visibly nagged the IP user:
`hint wrongly present for an IP: "… Tipp: a(z) »192.168.0.50« Windows-hálózati névnek tűnik …"`
(C1/C3 + edge assertions also went red). Restored, green.

Full green gate: `go build ./... && go vet ./... && go test ./...` — clean. All six template gates
(template_id / emoji / native_confirm / offbox_rename / app_row_dedup / mojibake) — OK.

## 4. Live validation (endpoint-level — the exact endpoints the UI invokes; no browser on DooPlex)

**demo-felhom 9201 (sharing ON — the open-door path).** Deploy via the bootstrap flow; `docker ps`
→ `0.159.0 Up (healthy)`; startup log clean (`controller_started (0.159.0)`, hub report pushed).
Authed session against container-IP:8080 + Host header (credentials sourced, never echoed):
- `GET /settings` — the card renders with **real live values**: `192.168.0.104` (the guest's
  actual DHCP lease), gateway `192.168.0.1`, `\\FELHOM`, footer present. ASCII-safe greps per the
  accent-mangling trap.
- `GET /api/debug/dump` → `network` = all four sub-keys:
  `lan_address 192.168.0.104` · `default_route {gateway 192.168.0.1, interface eth0}` ·
  `dns_servers [192.168.0.1]` · `interfaces [lo up 127.0.0.1/8, eth0 up 192.168.0.104/24]` —
  docker plumbing correctly absent.
- `GET /storage/network` — the Szerver helper text present.

**demo-hp 9201 (sharing OFF — the closed-door path, live).** Access via the hub-vaulted G1
break-glass (file→file, env-var use, credential + hub-DB copy **shredded after**; demo-hp remains
key-less). 0.156.0 → 0.159.0, `docker ps` → healthy. Same authed method (customer domain
`felhom.enkisfelhom.hu` — direct container-IP probing 404s without the right Host, worth knowing):
the card renders with „—" rows (×2 „nem állapítható meg"), **no** `\\FELHOM` row — Leg A's A2/A3
behaviors observed in production; the dump's `network` section carries all four keys with in-place
`error: docker exec …` strings for interfaces/route/dns and an empty `lan_address`. The dump
stayed complete.

**Screenshots by description** (rendering is the only untested residual): the card sits between the
version card and the RAM card; three `settings-row` lines — „Helyi cím (LAN)" with a mono address
(or „— nem állapítható meg" muted in `--text-3`), „Hálózati név" with mono `\\FELHOM` (only while
sharing is on), „Átjáró" with the mono gateway — and a muted one-line footer under the grid. On
demo-hp the same card shows two dash-rows and no name row.

## 5. Follow-ups

- **R-64** (Felhom↔Felhom pairing blessed — evidence drill pending) and **R-65** (buddy-box
  replication, post-alpha spike-first) minted in `felhom.eu` ROADMAP; **R-66 marked SHIPPED** there.
- `documentation/controller/network-storage-nas.md` gained the NetBIOS naming-caveat paragraph.
- Operator note: a strict end-to-end UI pass of the card is a manual click-through (no browser on
  DooPlex).