fix(skills): Route network-drive faults from windows-ops to net-ops

A drive letter alone doesn't identify the owning skill. "Z: is broken"
could be a failing physical disk (windows-ops) or an SMB/name-resolution
fault (net-ops), and windows-ops' trigger surface had nothing tying
mapped drives, UNC paths, SMB, or NAS to either — so a NAS mount fault
landed on the physical-disk ladder, which only sees local disks and
reports a clean bill of health on a genuinely broken drive.

- Rung 0 of the workflow: Get-SmbMapping / DisplayRoot check, hand off
  before running disk-health.ps1 or drive-dependencies.ps1
- Concrete symptoms in the routing line and the description trigger text
- Failure-mode and cross-reference rows pointing at net-ops'
  scripts/windows/smb-audit.ps1
- health-audit.ps1: one INFO signpost row listing network mappings,
  deliberately undiagnosed

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

skills/windows-ops/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: windows-ops
-description: "Comprehensive Windows workstation operations - diagnose slow boot, identify failing drives, decode BSOD crashes, manage startup apps, audit event logs. Use for: Windows is slow, slow bootup, won't boot, blue screen, BSOD, kernel crash, drive failing, SMART errors, disk errors, Event 41, Event 129, storahci reset, BugCheck, CRITICAL_PROCESS_DIED, crash dump, MEMORY.DMP, minidump, msconfig, services.msc, registry Run keys, StartupApproved, scheduled tasks at logon, slow login, high CPU at boot, Adobe startup, Docker startup, disable startup app, unexplained UAC prompt, what asked for admin, elevation prompt, prefetch forensics, BAM, process attribution, Security 4688."
+description: "Comprehensive Windows workstation operations - diagnose slow boot, identify failing drives, decode BSOD crashes, manage startup apps, audit event logs. Use for: Windows is slow, slow bootup, won't boot, blue screen, BSOD, kernel crash, drive failing, SMART errors, disk errors, Event 41, Event 129, storahci reset, BugCheck, CRITICAL_PROCESS_DIED, crash dump, MEMORY.DMP, minidump, msconfig, services.msc, registry Run keys, StartupApproved, scheduled tasks at logon, slow login, high CPU at boot, Adobe startup, Docker startup, disable startup app, unexplained UAC prompt, what asked for admin, elevation prompt, prefetch forensics, BAM, process attribution, Security 4688. A drive letter alone does not identify the owning skill: mapped network drive, Disconnected mapping, UNC path, SMB, \\\\server\\share, NAS, Synology, net use — hand those to net-ops."
 license: MIT
 allowed-tools: "Read Write Bash"
 metadata:
@@ -53,6 +53,7 @@ The most common diagnostic failure: treating symptoms in isolation. "Slow boot"
 Walk down the layers in order. Each rung has a binary outcome:
 
 ```
+0. Is it even local?  — a "drive" that is a network mapping belongs to net-ops
 1. Hardware errors    — WHEA-Logger events (CPU/RAM/PCIe-level faults)
 2. Storage health     — disk events 7/52/153/154, storahci 129 (controller reset)
 3. Crash record       — Event 41 (Kernel-Power) + BugCheck code + dump files
@@ -66,6 +67,19 @@ The most interesting failures cluster at rung 2 (storage) and rung 5 (startup bl
 
 ## Workflow
 
+### 0. Disambiguate the drive letter first
+
+A user saying "drive Z: is broken" cannot know whether that is a failing physical disk (this skill) or an SMB/name-resolution fault (`net-ops`) — the drive letter looks identical either way. Settle it before running anything else:
+
+```powershell
+Get-SmbMapping                            # network mappings + Status (Connected / Disconnected / Unavailable)
+Get-PSDrive -PSProvider FileSystem | Where-Object DisplayRoot   # non-empty DisplayRoot = UNC-backed
+```
+
+**If the letter appears in either result, it is a network mapping — stop here and hand off to `net-ops` (`scripts/windows/smb-audit.ps1`).** Do not run the physical-disk ladder: `disk-health.ps1` and `drive-dependencies.ps1` only see local disks, so they will report a clean bill of health on a drive that is genuinely broken, which is worse than reporting nothing.
+
+Everything below assumes a local, physically-attached drive.
+
 ### 1. Run the comprehensive audit
 
 ```powershell
@@ -254,6 +268,7 @@ Use `scripts/event-search.ps1` for common patterns (events in time window, by pr
 
 | Symptom | First check | Common cause |
 |---------|-------------|--------------|
+| Mapped drive shows `Disconnected` / UNC path unreachable | Is this a network mapping? `Get-SmbMapping` | Hand to `net-ops` — not a local storage fault |
 | Slow boot, used to be fast | `startup-audit.ps1` | Bloat accumulation (Docker, Adobe CC, Electron apps) |
 | Slow boot, getting worse | `disk-health.ps1` | Failing drive — Windows waiting on probe timeouts |
 | Random freezes + hard restarts | `disk-health.ps1` + `crash-triage.ps1` | storahci resets cascading into kernel hang |
@@ -295,7 +310,7 @@ Output follows the claude-mods diagnostic convention:
 
 ## What This Skill Doesn't Cover
 
-- **Network diagnostics** → use `net-ops`
+- **Network diagnostics, including anything storage-shaped that turns out to live on the network** → use `net-ops`. Concretely: a mapped network drive, a mapping stuck `Disconnected` / `Unavailable`, a UNC path (`\\server\share`) that won't open, SMB itself, a NAS or Synology box, `net use` failures, and "access is denied" on a share. A drive letter does not make it local.
 - **Specific application performance profiling** → use `perf-ops`
 - **Source-code-level debugging** → use `debug-ops`
 - **Kernel dump file analysis with WinDbg** — too specialised for this skill; covered by reference doc pointers only
@@ -306,6 +321,7 @@ Output follows the claude-mods diagnostic convention:
 
 | When | Use |
 |------|-----|
+| The failing "drive" is a network mapping / NAS share (SMB, UNC, `Disconnected`) | `net-ops` owns it — `scripts/windows/smb-audit.ps1` for the mapping + SMB/LAN ladder |
 | Need to triage a remote Windows box | `net-ops` reverse-probe pattern adapts directly |
 | Crash is networking-related | Combine with `net-ops` for DNS / VPN driver issues |
 | Multiple machines exhibit same pattern | Run `health-audit.ps1` on each, diff the outputs |

skills/windows-ops/scripts/health-audit.ps1

@@ -237,6 +237,25 @@ try {
     }
 } catch {}
 
+# Network mappings — SIGNPOST ONLY, deliberately not diagnosed here.
+# A drive letter alone doesn't say whether a fault is local storage or SMB,
+# and every check above only sees physically-attached disks. Listing the
+# mappings stops the audit reading as "all drives healthy" when the user's
+# broken Z: is a NAS share this skill never looked at. Diagnosis belongs to
+# net-ops (scripts/windows/smb-audit.ps1) — keep this to ONE row, no verdict.
+try {
+    $mappings = @(Get-SmbMapping -ErrorAction SilentlyContinue)
+    if ($mappings.Count -gt 0) {
+        $shown = ($mappings | Select-Object -First 3 |
+            ForEach-Object { "$($_.LocalPath) -> $($_.RemotePath) ($($_.Status))" }) -join ', '
+        if ($mappings.Count -gt 3) { $shown += ", +$($mappings.Count - 3) more" }
+        $noun = if ($mappings.Count -eq 1) { 'mapping' } else { 'mappings' }
+        Add-Finding -Level info -Category 'network' -Subject 'Network mappings' `
+            -Detail "$($mappings.Count) network $noun`: $shown - not diagnosed here, see net-ops" `
+            -Data @{ count = $mappings.Count }
+    }
+} catch {}
+
 # ─────────────────────────────────────────────────────────────────────
 # Section: Crash history
 # ─────────────────────────────────────────────────────────────────────