spike(R-6): human Explorer leg PASSED (nmbd) + stack torn down, report-clean

Viktor re-tried the double-click after the nmbd fix: Network -> FELHOM-SPIKE ->
spike-share opened, README.txt displayed. Full visible-and-openable one-click UX
works. Spike containers + /tmp scripts removed on guest and DooPlex; ports free;
verified report-clean. Spike COMPLETE.

documentation/audits/SPIKE-lan-discovery-2026-07-18.md

@@ -1,7 +1,7 @@
 # SPIKE — R-6: LAN service discovery from the guest (SSDP · WSD · mDNS · SMB) — 2026-07-18
 
-> **STATUS: COMPLETE (objective legs) — verdict below. One human leg (S4.4 Explorer render) is
-> PENDING Viktor and the samba+wsdd stack is intentionally left live for it.** Empirically maps which
+> **STATUS: COMPLETE — verdict below. All legs incl. the human Explorer leg PASSED; stack torn down,
+> box report-clean (§CLEANUP).** Empirically maps which
 > Docker network mode inside the appliance LXC can send AND receive each LAN discovery protocol on the
 > real household LAN, proves the negative for the default bridge, and stands up a real samba+wsdd
 > stack that a Windows 11 client discovers and mounts. No production code shipped; every live mutation
@@ -146,7 +146,7 @@ Throwaway host-network stack in the guest: `spike-samba` (alpine + `apk add samb
 | 1. WS-Discovery ProbeMatch | scripted Probe (`Types=wsdp:Device`) from the workstation | **PASS** — ProbeMatch from `192.168.0.127`; wsdd logged our exact `MessageID` from `192.168.0.110` |
 | 2. Port 445 reachability | `Test-NetConnection 192.168.0.127 -Port 445` | **PASS** — `TcpTestSucceeded: True` |
 | 3. SMB round-trip | `New-SmbMapping` as `spikeuser` → write `roundtrip.txt` → read back → byte-compare | **PASS** — `BYTE-COMPARE: PASS`; dir listed `README.txt` (24B) + `roundtrip.txt` (28B) |
-| 4. Explorer Network view (human) | Viktor: Explorer → Network | **SPLIT: device VISIBLE (WSD PASS), double-click FAILED `0x80070035`** — see S4b |
+| 4. Explorer Network view (human) | Viktor: Explorer → Network | **SPLIT then RESOLVED: device VISIBLE (WSD PASS); double-click FAILED `0x80070035` with wsdd-only → after the S4b nmbd fix, Viktor's double-click opened `spike-share` and `README.txt` (screenshot) — full one-click UX PASS** |
 
 wsdd log for leg 1:
 ```
@@ -191,6 +191,7 @@ bypasses all name resolution and works — proving the SMB server itself is heal
 | `nbtstat -A 192.168.0.127` | **`FELHOM-SPIKE <00>/<03>/<20> Registered`** |
 | `ping FELHOM-SPIKE` | **`Reply from 192.168.0.127`** — flat name resolves via NetBIOS broadcast |
 | `New-SmbMapping \\FELHOM-SPIKE\spike-share` | **MOUNT BY NAME: OK** — lists the share |
+| Viktor re-tried the **Explorer double-click** | **PASS** — `Network → FELHOM-SPIKE → spike-share` opened; `README.txt` ("hello-from-felhom-spike") displayed. The full visible-and-openable one-click UX now works. |
 
 **Conclusion for R-7:** `wsdd` alone makes the box *visible* but is **not sufficient** for the
 one-click UX — a **flat-name resolver is required** for `\\FELHOM-SPIKE` to open. Options, in order of
@@ -290,16 +291,16 @@ generalizes.
 
 ## CLEANUP
 
-Throwaway containers `spike-hostnet-*`, `spike-bridge-*`, `spike-ssdp-ms` and all guest-netns
-responder processes were `docker rm -f` / `pkill`'d at the end of each leg. **Left live through the
-S4/S4b legs:** `spike-samba` (now with nmbd) + `spike-wsdd` (host-network), share
-`\\FELHOM-SPIKE\spike-share` / `\\192.168.0.127\spike-share`. Teardown one-liner (all objective legs
-done — safe to run any time):
-
+**TORN DOWN — report-clean verified 2026-07-18** (after Viktor's Explorer PASS). All throwaway
+containers (`spike-hostnet-*`, `spike-bridge-*`, `spike-ssdp-ms`, `spike-samba`, `spike-wsdd`) removed
+and every guest-netns responder process killed; `/tmp/spike-*` deleted on both the guest and DooPlex.
+Verified:
 ```
-ssh felhom-pve "pct exec 9201 -- docker rm -f spike-samba spike-wsdd; \
-  pct exec 9201 -- rm -f /tmp/spike-*.py /tmp/spike-*.sh /tmp/spike-*.log"
-ssh kisfenyo@192.168.0.180 "rm -f /tmp/spike-probe.py /tmp/spike-msearch.py"
+pct exec 9201 -- docker ps -a --filter name=spike-   => (none)
+pct exec 9201 -- ls /tmp/spike-*                     => (none)
+pct exec 9201 -- ss -lntu | grep :(445|3702|5357|137|139)  => (free)
+DooPlex ls /tmp/spike-*                              => (none)
 ```
-Then `pct exec 9201 -- docker ps -a | grep spike` must be empty. The demo box is wiped in the
-upcoming rehearsal regardless, but this leaves it report-clean.
+No systemd units, no compose files, no controller-visible stacks were ever created. Note: nmbd bound
+the docker 172.x bridge subnets too during S4b — a production R-7 stack must set
+`interfaces = eth0` + `bind interfaces only = yes`.