The media share exists and no workstation can mount it: 445 from Hicks is not a rule #523

erebor/media is shared as media since 2026-09-18 (build-the-nas.md §5), with a dedicated SMB user that can read and write it. Nothing a person sits at can mount it.

Why

The four inbound passes to smaug are what §0.5 wrote and what morpheus enforces: Hicks reaches 443 and 8096, the monitoring host reaches 9100 and 22. SMB is 445, and no rule carries it. So a Hicks workstation that administers TrueNAS and watches Jellyfin gets nothing from \\10.0.40.30\media, and the only devices that can mount the share are the ones already on CasaBonita — televisions and consoles, which do not put films on a NAS. Found on 2026-09-19 by trying, while loading the clip for ADR-0040's transcode test; the clip went in through the console shell with curl instead.

This is not a fault in the share or in ADR-0016. The ADR opened CasaBonita inward on named ports for named consumers, and "a workstation writing to the library" was never named. It is the consumer that was missing from the list, not a rule that was appended wrong.

What it needs

• Decide the path. The obvious one is a fifth Hicks pass, vlan50 net → 10.0.40.30:445, above Block access to CasaBonita on igc0.50 with the same §0.5/§0.6 care — description exact, position verified from morpheus and not the UI. The alternatives are worth a sentence each before that is chosen: a pull from the NAS side (nothing on 40 initiates, so no), or loading over the console and calling the share television-only (honest, and useless for 18 TB).
• If the rule is created: docs/network.md, docs/security.md, build-the-nas.md §0.5's table and stacks/media/README.md's "what is published" table all count the passes, and all four said three long after four existed (#501). Five has to land in all of them in one PR.
• Say what bilbo is then for. Today it is a credential held by televisions; with a workstation rule it is also the account a person types on a laptop, and that may want to be two users.

#446 is adjacent — its ISO store is the same share shape from a different segment — and the two rules should be created in one sitting if both are created.

Refs #413 #446