# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

## NAS-backed CWA deploy RCA — diagnostic audit (no fixes) — 2026-07-11

Deliverable: `documentation/audits/AUDIT-nas-cwa-rca-2026-07-11.md` + CONTEXT.md note. No code
changes anywhere. **Remediation §6 performed on operator GO: demo fully healed** — automount-unit
restart re-planted the guest trigger instantly (fix-1 mechanism live-proven), CWA restarted
healthy on the NAS library (uid-1000 WRITE-OK, WAL recovered, app answers), controller health
`status=ok` at 20:18 CEST.

**Root cause chain (all five hypotheses resolved):**
- The 14:16 nas-media re-add verified **legitimately** — a newly created host automount propagates
  into *running* guests (proven: the in-guest controller triggered the host autofs every 5 min,
  14:18–15:36). H1's real trigger was a **second** `pct reboot 9201` at 15:39:11: a fresh guest
  namespace inherits ext4 submounts but not the autofs trigger → empty root-owned stub since.
- CWA was deployed **correctly** to the NAS (app.yaml `HDD_PATH`, docker binds, and the physical
  library — 5.4 MB incl. metadata.db — all on the DooPlex export). H3 FALSE.
- The UI showing "felhom-usb" is a pure display bug (H4): `deploy.html:567` marks `selected` by
  `IsDefault` only, never the stored HDD_PATH; with no default flagged, the browser shows the
  first option.
- The hub "nem külön meghajtón" WARN was **correct** (H5) — the device-ID check in the controller
  namespace was the only guard that fired. The dashboard NAS badge masked the state because it
  asks the **agent** (host namespace, genuinely healthy).
- CWA has been DOWN since 15:39 (docker restart fails: `mkdir .../userdata: permission denied` on
  the stub) — which also blocked any writes to the system drive. **Zero data loss, zero misplaced.**
- Probe hole (H2) confirmed in code (no fstype/device check, `netprobe.go`) but did not fire here.
- S-D confirmed real: settings.json stores the felhom-usb label CP1250-mangled since 2026-07-08.
- Observability shakedown: capture ring wraps in ~10 min (status-refresh spam) and dies with
  container recreation — rings could not answer H3; host journal + durable artifacts did.

**Fix tasks (audit §5, priority order):** 1) agent ReassertNetworkMounts on guest start
(automount-unit restart mechanism now proven); 2) verify in the consuming namespace (probe fstype
check + deploy-time refusal + NAS badge combines controller-ns view); 3) boot-time app-start
failure alerting; 4) H4 select fix; 5) label repair + writer RCA; 6) ring spam exclusion.