[2026-09-22] eagle: family/how-to/vault-git-sync.md personal/tech/truenas-nfs4-acl-and-arrmultiuser.md

personal/tech/truenas-nfs4-acl-and-arrmultiuser.md

@@ -1,7 +1,7 @@
 ---
 title: TrueNAS NFS4 ACL repair + cross-container media PUID
 created: 2026-09-02
-updated: 2026-09-21
+updated: 2026-09-22
 type: tech
 namespace: personal
 tags: [truenas, nfs4, acl, midclt, arr, radarr, sonarr, jellyfin, transmission, docker, git]
@@ -17,6 +17,15 @@ related:
 > Hard-won lessons from the 2026-08-31/09-01/09-02 TrueNAS restore-incident remediation. Mirror of skill `truenas-nfs4-acl-and-arrmultiuser`. Detailed incident log: `family/documents/vault-sync/2026-09-02-restore-privilege-scope.md`.
 >
 > **2026-09-21 addendum:** the same class of failure hit the **vault bare-git repo** (`/mnt/RED_2TB/storage/git/obsidian-vault.git`) — `git push` failed with `unable to write file ./objects/XX/…: Permission denied`. Root cause and the working midclt recipe are in the section «Bare git repo: push Permission denied» below.
+>
+> **2026-09-22 addendum (РЕЦИДИВ, закрыт):** дефект вернулся (35 root-каталогов). Починено:
+> **236/236 каталогов `INHERIT` + `WRITE`**, push прошёл end-to-end, поставлен cron-сторож.
+> 🔴 Ключевые уроки: `dacl` **с нуля собрать НЕЛЬЗЯ** (TrueNAS требует `id` в каждой ACE —
+> только read-modify-write); флаги = `{"BASIC":"INHERIT"}`, НЕ булев dict; **`setacl` асинхронный —
+> обязательно ждать job до `SUCCESS`**, иначе ложный провал. Рецепт и 4 питфолла — в секции
+> «Durable fix with INHERITANCE» ниже. Инструменты: `/Users/admin/Developer/vault-tools/`.
+> Хронология расследования: `family/documents/vault-sync/2026-09-21-bare-repo-push-permission-denied.md`.
+
 
 ## Trigger
 Any "permission denied" / file not readable / git `loose object ... corrupt` / empty Jellyfin library on **TrueNAS SCALE** (acltype=nfsv4) after a zfs restore, OR wiring Prowlarr/Radarr/Sonarr/Jellyfin/Transmission so container-written files are readable by other containers.