docs: REPORT + CONTEXT for the NAS/coupling backlog-clear (hub v0.45.0, DSM spike, Q1c FAIL)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

REPORT.md

@@ -2,26 +2,55 @@
 
 > **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
 
-## NAS verify-before-commit — felhom.eu share (host-install v1.13.0 + feature doc) — 2026-07-11
+## Hub v0.45.0 — floor-UI separation + per-box MinAgent conditional floor (+ DSM spike, Q1c FAIL) — 2026-07-11
 
-Part of the cross-repo task (agent **v0.81.0** + controller **v0.113.0**, both LIVE on the demo;
-full task-wide record incl. red-proofs + the A–E live-validation transcripts:
-`felhom-controller/REPORT.md`). This repo's commit: `27e2fb0`.
+felhom.eu's parts of the NAS/coupling backlog-clear task (composite A–F; agent v0.82.0 +
+controller v0.115.0 shipped in their repos). Commits: hub `bbecf05` + manifest `37222d3` + rules
+`bbecf05`; DSM findings `37e60b4`; Q1c + follow-up `9b95f88`.
 
-- **`scripts/felhom-host-install.sh` v1.13.0** — the agent-user setup adds `felhom-agent` to the
-  **`systemd-journal` group** (idempotent `usermod -aG`): the verify pipeline classifies mount
-  failures from an UNPRIVILEGED `journalctl` read; group membership instead of a sudoers grant.
-  Existing installs: `usermod -aG systemd-journal felhom-agent && systemctl restart felhom-agent`
-  — **applied to the demo host (felhom-pve) during this task's live validation**; Peti's box gets
-  it only when the NAS feature reaches him. Also fixed: the header still said v1.11.0 while
-  `SCRIPT_VERSION` was 1.12.0 (the 1.12.0 bump had no changelog entry either) — both now 1.13.0.
-- **NEW `documentation/controller/network-storage-nas.md`** — the authoritative network-storage
-  feature doc (none existed; the knowledge lived only in the two spike docs): the locked recipes
-  (incl. `retry=0` + its evidence), the verify pipeline, the §8 mount-truth table, the Q4 error
-  taxonomy (with the merged `nfs_export` honesty rule), the protocol-honest NAS-side recipes
-  (SMB plain-user; NFS map-all-users vs full-fidelity `anonuid=<uid+100000>`), Route A caveats
-  incl. the operator-facing "chmod succeeds and persists" nuance, and the open items (Q1c
-  restart-window test, appliance pass).
+### Hub v0.45.0 (Parts C + D — LIVE, GitOps synced Healthy)
 
-No hub/website/manifest changes; nothing to deploy from this repo (the script ships via the Day-0
-supply chain on the operator's publish decision — NOT triggered by this task).
+- **Part C — floor-UI separation + effective-floor source:** the global controller-version floor is
+  its own card with a type-to-confirm dialog that first shows the live blast radius
+  (`GET /configuration/global-floor/impact` → `countBoxesBelowFloor`, honoring per-customer
+  overrides); an effective-floor + source line (`store.ResolveGlobalFloor`) shows the resolved value
+  and WHICH source won (DB `hub_settings` vs env `DEFAULT_MIN_CONTROLLER_VERSION`, both raw values).
+  The Day-0 manifest save provably does not touch the floor (the 9-min-skew incident's root cause,
+  now visible + isolated).
+- **Part D — per-box MinAgent conditional floor:** the artifact manifest gains `MinAgent`; at
+  report-ACK time `store.ResolveManagedFloor(customerID)` HOLDS the controller floor for a box whose
+  `hosts.agent_version` is below (or unknown vs) MinAgent, flags it on the Hosts dashboard
+  (`floor held: agent <v> < MinAgent <w>`), and serves it once the agent qualifies. Mechanises
+  "agent BEFORE controller floor" per box — the manual fleet check is retired (rule 3 updated).
+- **THE one comparator:** `web.compareVersions`'s body → leaf `internal/semver` (web delegates,
+  store reuses; no import cycle, no second comparator).
+- Red-proofs (all: mutate → predicted failure → revert → green): DB-wins precedence; manifest-save-
+  doesn't-touch-floor; impact count with override exclusion; managed-floor hold/serve/uncoupled/
+  unknown-agent + a fleet discriminator + the report-ACK wire test (held box omits the floor).
+- **Deployed:** built 0.45.0 on 180, manifest bumped, ArgoCD hard-refresh + sync → Synced/Healthy,
+  rollout OK, live image `felhom-hub:0.45.0`. Live state: demo agent 0.82.0, Peti 0.81.0, MinAgent
+  unset (uncoupled → no holds, as expected), floor 0.113.0 (DB).
+
+### Part A — DSM spike (findings `documentation/audits/SPIKE-nas-dsm-2026-07-11.md`)
+
+Real DSM 7.2 (virtual-dsm on DooPlex, macvlan .199, driven via claude-in-chrome, torn down + ports
+dead) validated the consumer recipes E2E through the live add pipeline: NFS "Map all users to admin"
+= Route A PASS (hardlink incl.); squash-off = `not_writable` refusal; plain-user SMB PASS **with
+working hardlinks** (Q5 caveat CLOSED for Synology); wrong-password/share classify identically. The
+copy edits landed in controller v0.115.0; QNAP stays a stated caveat (no emulator — nothing
+fabricated).
+
+### Part E — Q1c restart survival: **FAIL** (supervised, operator GO)
+
+`pct reboot 9201` proved a configured NAS automount trigger does NOT survive a guest reboot: the
+autofs trigger does not re-propagate into the guest's fresh namespace (shared→slave only carries
+post-bind mounts), so an in-guest access sees an **empty directory** and does not trigger the host
+mount — the dangerous case for a restarting media app. Apps otherwise recovered healthy. FAIL
+protocol honored (nothing repaired live); root cause + fix (agent `ReassertNetworkMounts` on guest
+reboot) spec'd at `documentation/backlog/FOLLOWUP-nas-automount-guest-reboot-reassert.md`.
+
+### NOT done / open
+
+- The follow-up NAS-reboot-reassert fix (agent) — new task, evidence attached.
+- Held-floor state never fired live (no box below MinAgent, and MinAgent is unset) — test-proven only.
+- QNAP appliance pass (no emulator).