AUDIT §6: remediation PERFORMED — automount restart heals running guest (fix-1 pre-test PASS), CWA healthy, health ok

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -10,8 +10,10 @@
   (docker can't recreate the bind source; perms luckily blocked any system-drive writes; zero data
   loss). UI "felhom-usb" = display bug (deploy.html selects by IsDefault, never stored HDD_PATH);
   hub device-ID WARN was CORRECT and the only guard that fired; NAS badge masks because it asks
-  the agent (host ns). 6 prioritized fix tasks in the audit §5; remediation recipe §6 DEFERRED
-  pending operator GO. Demo left as-found.
+  the agent (host ns). 6 prioritized fix tasks in the audit §5. **Remediation §6 PERFORMED on
+  operator GO (~20:14–20:20 CEST): automount-unit restart re-planted the trigger in the running
+  guest instantly (fix-1 mechanism live-proven), CWA restarted healthy on the NAS library,
+  uid-1000 write OK, controller health back to status=ok at 20:18. Demo fully healed.**
 
 - **2026-07-11 — OBSERVABILITY PASS (hub v0.46.0 LIVE Synced/Healthy; agent v0.83.0 + controller
   v0.116.1 on demo).** Remote pull-only log access to both box components' always-DEBUG capture

REPORT.md

@@ -5,7 +5,10 @@
 ## NAS-backed CWA deploy RCA — diagnostic audit (no fixes) — 2026-07-11
 
 Deliverable: `documentation/audits/AUDIT-nas-cwa-rca-2026-07-11.md` + CONTEXT.md note. No code
-changes anywhere; demo left as-found (remediation §6 operator-gated, deferred).
+changes anywhere. **Remediation §6 performed on operator GO: demo fully healed** — automount-unit
+restart re-planted the guest trigger instantly (fix-1 mechanism live-proven), CWA restarted
+healthy on the NAS library (uid-1000 WRITE-OK, WAL recovered, app answers), controller health
+`status=ok` at 20:18 CEST.
 
 **Root cause chain (all five hypotheses resolved):**
 - The 14:16 nas-media re-add verified **legitimately** — a newly created host automount propagates

documentation/audits/AUDIT-nas-cwa-rca-2026-07-11.md

@@ -213,18 +213,27 @@ system drive. This ordering drives the fix list.
    container recreation discards both ring and docker logs — the host journal and hub bundles are
    the only durable channels.
 
-## 6. Remediation — DEFERRED (operator-gated, operator not in session)
+## 6. Remediation — PERFORMED (operator GO given in-session, executed ~20:14–20:20 CEST)
 
-Demo left as-found. Proposed recipe when GO is given (no rsync needed — nothing is misplaced):
+The proposed recipe ran exactly as written and **doubles as a successful live pre-test of the
+fix-1 mechanism**:
 
-1. `systemctl restart 'mnt-felhom\x2ddrives-nas\x2dmedia.automount'` on the host (guest running).
-2. Verify in-guest: `pct exec 9201 -- grep nas-media /proc/mounts` after an in-guest `ls` of the
-   path (expect autofs, then nfs4), and confirm `RCA`-free export content is visible.
-3. `pct exec 9201 -- docker start calibre-web`; confirm the library loads (SQLite recovers the
-   -wal/-shm on open).
-4. Optionally re-run the uid-1000 write path from inside the CWA container.
+1. `systemctl restart 'mnt-felhom\x2ddrives-nas\x2dmedia.automount'` on the host (guest running)
+   → the autofs trigger appeared in the guest namespace **immediately** (propagation of a fresh
+   host mount into a running guest's slave bind, re-proven).
+2. In-guest `ls` woke the automount; guest AND controller container now show the `nfs4` mount with
+   the export content (`backups/`, `userdata/`, correct uid-1000 mapping).
+3. `docker start calibre-web` → `running`, healthcheck `healthy`; `/calibre-library` shows
+   `metadata.db` + all three author dirs; SQLite WAL recovered cleanly (0-byte wal, shm re-touched).
+4. uid-1000 write probe from inside the CWA container through the NFS: **WRITE-OK**.
+5. App answers over traefik (`Host: books.demo-felhom.eu`): 301→302 login redirect chain, alive.
 
-This doubles as a live pre-test of the fix-1 mechanism.
+No rsync was needed (nothing was misplaced). The controller health WARN (S-B) is expected to clear
+on the next 5-minute monitor cycle now that `IsMountPoint` sees nfs4 ≠ pve-root.
+
+**Fix-1 design note validated live:** restarting the `.automount` unit is a sufficient, cheap,
+data-safe reassert mechanism for running guests; the agent follow-up only needs to invoke it after
+guest starts and post-verify guest visibility.
 
 ---
 *Evidence gathered non-destructively 2026-07-11 ~19:35–19:50 CEST; only artifacts created were the