[2026-09-02] eagle: family/documents/vault-sync/2026-09-02-restore-privilege-scope.md family/how-to/arr-stack-taiga.md personal/tech/truenas-nfs4-acl-and-arrmultiuser.md

personal/tech/truenas-nfs4-acl-and-arrmultiuser.md

@@ -50,6 +50,23 @@ Goal: all containers run under ONE uid (950) so transmission→radarr/sonarr→j
 - Simple datasets: recursive POSIX `chown -R 950:950` + `chmod` under root SUFFICE (ACLs were trivial). Use midclt/ACL only when non-trivial ACEs present (check `filesystem.getacl` → `trivial:true`).
 - Bare git repo with `owner@ DENY` on objects → full dacl replacement recursively (perms JSON like above).
 
+### GOTCHA 3 — root dataset traverse (Permission denied despite clean file ACL)
+After chown-ing all leaf dirs/files to 950, if a service still gets `Permission denied` reading `/storage/Movies/...` (or jellyfin FFmpeg exit 243), check the **root of the dataset** `/mnt/RED_2TB/storage` itself. In the restore it stayed `921:921` with `owner@/group@ ALLOW` but `everyone@ EXECUTE=False`. uid 950 (not owner, not in gid-921-group) falls under `everyone@` → **cannot traverse past the root** into the tree, even though every nested ACL is clean. Fix (root):
+```bash
+chown 950:950 /mnt/RED_2TB/storage
+chmod 750 /mnt/RED_2TB/storage    # rwxr-x---: gid 950 = truenas_admin (containers' group) gets r-x traverse
+```
+Kernel needs EXEC (traverse) on EVERY path component. Diagnostic via `setpriv --reuid=950 ... ls` shows `Permission denied` on a dir whose `getacl` looks clean → suspect root/parent traverse. `stat` via root shows clean 770 but uid 950 can't ls.
+
+### GOTCHA 4 — transmission "all torrents No Data Found" after data migration
+If every transmission torrent shows `error 3: No Data Found` right after a container recreate/pool migration:
+- Check: `docker exec -u` fine to read? downloadDir & files present? If files ARE there and readable as uid 950, the error is likely **stale from daemon startup while traverse was blocked** (see GOTCHA 3).
+- `torrent-verify` on a single torrent does NOT clear it. Fix is trivial & non-destructive:
+```bash
+docker restart transmission
+```
+On restart the daemon re-validates → torrents clear (e.g. **254/255 instantly**). Leftover #1 → Verify Local Data in Web UI.
+
 ## Docker network persistency (per-service compose)
 - `docker network connect <net> <container>` is LOST on recreate → declare `<net>` in the service's compose `networks:`.
 - Caddy must co-own a network with its reverse-proxy target. transmission Web UI works because caddy is ALSO in `transmission_default`; radarr↔transmission works because both in `media_net`.