AUDIT: NAS/CWA RCA 2026-07-11 — stub after 2nd reboot; deploy correct; display bug; hub WARN correct

Diagnostic only (no fixes). Full evidence + 6 prioritized fix tasks in
documentation/audits/AUDIT-nas-cwa-rca-2026-07-11.md; remediation deferred (operator-gated).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,16 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-11 — NAS/CWA RCA (diagnostic, no fixes):** `documentation/audits/AUDIT-nas-cwa-rca-2026-07-11.md`.
+  The nas-media re-add verified legitimately (new host automounts DO propagate into running
+  guests); a second `pct reboot 9201` at 15:39 severed the trigger → guest-side stub; CWA
+  deployed correctly to the NAS (app.yaml + binds + data all nas-media) but is DOWN since 15:39
+  (docker can't recreate the bind source; perms luckily blocked any system-drive writes; zero data
+  loss). UI "felhom-usb" = display bug (deploy.html selects by IsDefault, never stored HDD_PATH);
+  hub device-ID WARN was CORRECT and the only guard that fired; NAS badge masks because it asks
+  the agent (host ns). 6 prioritized fix tasks in the audit §5; remediation recipe §6 DEFERRED
+  pending operator GO. Demo left as-found.
+
 - **2026-07-11 — OBSERVABILITY PASS (hub v0.46.0 LIVE Synced/Healthy; agent v0.83.0 + controller
   v0.116.1 on demo).** Remote pull-only log access to both box components' always-DEBUG capture
   rings. Hub: `log_bundle_requests`/`log_bundles` store (gzip, newest-3, **72 h TTL** on the 60 s