docs(truenas): bare-repo ACL durable fix with inheritance (291 dirs, midclt setacl)

personal/tech/truenas-nfs4-acl-and-arrmultiuser.md

@@ -123,6 +123,28 @@ touch /mnt/RED_2TB/storage/git/obsidian-vault.git/objects/80/.wrtest && echo WRI
 ```
 `WRITE OK` → push will succeed. Confirmed: `f9a5c2b..21505ec main -> main`, then a clean `git pull` on Kraken.
 
+### Durable fix with INHERITANCE (2026-09-21, applied — 291 dirs)
+
+The minimal recipe above (add perms to existing `group@` ACE) restores write for *current* dirs, **but the bug returns**: the next push by the root-owned `mcpvault` creates a NEW `objects/XX/` dir whose ACL is inherited from the *parent*, and if the parent's `everyone@`/`group@` lacks `WRITE_DATA` + inherit flags, the new dir is root-owned and read-only again → push fails again.
+
+Working fix = **full dacl replacement** (not per-ACE edit) with **inheritance flags ON**, applied to every dir:
+
+```python
+# perms granted to owner@ AND group@ AND everyone@:
+#   READ_DATA WRITE_DATA APPEND_DATA EXECUTE DELETE_CHILD
+#   READ_ATTRIBUTES WRITE_ATTRIBUTES READ_NAMED_ATTRS WRITE_NAMED_ATTRS
+#   READ_ACL (and WRITE_ACL WRITE_OWNER DELETE for owner@)
+# flags on each ACE:  {"FILE_INHERIT": True, "DIRECTORY_INHERIT": True,
+#                      "NO_PROPAGATE_INHERIT": False, "INHERIT_ONLY": False,
+#                      "INHERITED": False}
+# call:  midclt call filesystem.setacl '<one json with path + dacl + options>'
+#        options = {"recursive": False, "traverse": True, "stripacl": False}
+```
+
+**Result:** 291 dirs processed, 0 failures. Note `filesystem.listdir <BARE STRING>` to enumerate (same convention as `getacl`), and each `setacl` is async — but 291 sequential dirs finished inside one SSH call (~2 min), no `nohup` needed this time.
+
+⚠️ **Caveat — the ACL was replaced, not proven functional yet.** The write-test `touch objects/80/.wrtest` was NOT executed (approval timed out). Verification was indirect: `git push nas main` → `Everything up-to-date`, and `git rev-parse HEAD == git rev-parse nas/main` (`177da1e`). That proves the *current* tree is in sync, **not** that a fresh root-owned object can be written. A real `touch` in `objects/80/` as uid 950 is still the definitive test.
+
 **Vault topology (for future sessions):** one bare repo on TrueNAS is the single hub. Mac pushes/pulls remote **`nas`**; Kraken uses remote **`origin`** — both point at `ssh://truenas_admin@mallexxx.duckdns.org/mnt/RED_2TB/storage/git/obsidian-vault.git`. Mac and Kraken never talk directly. Host `truenas` does **not** resolve as an SSH alias from the Mac — use `truenas_admin@mallexxx.duckdns.org`.
 
 ## Docker network persistency (per-service compose)