v0.327.0: CHANGELOG, CONTEXT, REPORT (and the R-1129 correction)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,11 +1,32 @@
-## Unreleased (2026-10-17) — CI workflow: a manual proof that the failure mail can be sent (R-1129); no code change
+## v0.327.0 — FileBrowser is published only after its default login is checked; the install check uses real memory amounts and says what to do (2026-10-17)
 
-`.gitea/workflows/gates.yml` gains a manual `workflow_dispatch` trigger with one input, `force_alarm` (default false), and
-one step that runs ONLY on a dispatch: it prints the length of `RESEND_API_KEY` (never the key) and, with
-`force_alarm=true`, fails on purpose so the existing alarm step sends its real mail; the mail's subject then starts
-„FORCED TEST, not a real failure". A push run is unchanged: the new step is skipped and the subject is the old one. Same
-change in all four repos' workflows. Purpose: prove the failure mail now goes out after the operator set the key
-(every failed run until today ended „ALARM FAILED: RESEND_API_KEY is empty").
+**MinAgent: 0.158.1** — the floor's, carried. Nothing here calls the agent. No golden (`09` §3 decision 250). Task:
+„FileBrowser never on its default password (D11 = A), real memory amounts (D10 = A), CI failure mail (D12), STATUS"
+(felhom.eu `REPORT-filebrowser-memory-ci-2026-10-17.md`).
+
+- **R-1126 (operator decision D11 = A)** — FileBrowser starts OFF `traefik-public`, on its own network
+  `felhom-filebrowser` (the controller joins it), and is put on `traefik-public` — so `files.<domain>` is served — only
+  after this run's default login was checked: refused, or replaced and verified (`stacks/filebrowser_gate.go`; also run
+  right after `web.SyncFileBrowserMounts` re-creates it). The connect targets the checked container's ID (a TOCTOU found
+  by the commit's security review). Why not FileBrowser's own setting: `auth.adminPassword` /
+  `FILEBROWSER_ADMIN_PASSWORD` re-apply at EVERY start (1.5.6 `backend/cmd/user.go:50-57`, from `cmd/root.go:144`) —
+  measured on 9202: a household's own password was replaced at the next restart. Live on 9202 (rc.2): FileBrowser and its
+  data removed; 143 probes through Traefik over 5 minutes, the default login never 200 (404 while unpublished; replaced,
+  then published, 2 s after FileBrowser came back). Every box with this version recreates FileBrowser once (the compose
+  changed) and publishes it after the check. Tests `TestFileBrowserRender_R1126_NotPublicAtStart`,
+  `TestFileBrowserGate_*` (2), each red-proved.
+- **R-1125 (operator decision D10 = A)** — the catalog's 23 `mem_request` values are now measured use (catalog
+  `1af6ea7`). The refusal (`err.stacks.not_enough_memory`) and the install page's memory box
+  (`deploy.nincs_eleg_memoria_foglalas_telepites`) say, in HU and EN, that the memory is held by the installed apps and
+  to remove one or use a machine with more memory. The install page now shows the check's own reading
+  (`stacks.InstallMemory`: guest total, reserve, the installed apps' requests) — it used `/proc`'s host-wide figures and
+  could disagree with the check (9202: page 12,637 MB „needed", check 2,648). Fixtures `deploy_new_blocked` and
+  `deploy_new_memory_blocked` re-captured as `*_r1125` (only that sentence differs); every other fixture byte-identical.
+  Tests `TestR1125_*` (2), each red-proved.
+- **CI workflow (R-1129, no code change):** a manual `workflow_dispatch` with `force_alarm` proves the failure mail
+  (prints only the key's length; a push run is unchanged). **Correction:** the failure mail was never broken — the
+  „ALARM FAILED: RESEND_API_KEY is empty" lines R-1129 cited are the runner printing the step's own source before it
+  runs; those runs' real output was `RESEND-ACCEPTED`.
 
 ## v0.326.0 — FileBrowser's default password is checked at every FileBrowser start; the decoy suite is a gate (2026-10-17)
 

CONTEXT.md

@@ -7,7 +7,13 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-10-17 (v0.326.0 — FileBrowser's default checked every run; the decoy suite is a full-run gate)
+Last updated: 2026-10-17 (v0.327.0 — FileBrowser published only after its check; real memory amounts in the install check)
+
+> **2026-10-17 (afternoon, 2) — v0.327.0.** R-1126 (D11 = A): FileBrowser off `traefik-public` until this run's default
+> login is checked (`stacks/filebrowser_gate.go`, connect by container ID); FileBrowser's own admin-password setting
+> re-applies every start, so it cannot carry ours. R-1125 (D10 = A): catalog requests = measured use; the refusal and the
+> install page say what to do; the page reads `stacks.InstallMemory` like the check. R-1129 was a misreading (CI mail
+> always worked).
 
 > **2026-10-17 (afternoon) — v0.326.0.** R-977: `EnsureFileBrowserAdminPassword` probes the default login once per
 > FileBrowser RUN (`fbStartedAt`, `fbProbedRun`), with ~20 s for a new run to answer; measured on 9202 before (default 200

REPORT.md

@@ -1,28 +1,29 @@
-# REPORT — v0.326.0: FileBrowser's default password checked at every FileBrowser start; the decoy suite is a gate (2026-10-17)
+# REPORT — v0.327.0: FileBrowser published only after its default login is checked; real memory amounts in the install check (2026-10-17)
 
-Brief „Tester 1 back on the live catalog, decoy suites, memory limits, FileBrowser" (Parts 4–5; Part 2's runner
-change). Full report: felhom.eu `REPORT-tester1-limits-filebrowser-2026-10-17.md`. Evidence: felhom.eu
-`documentation/audits/tester1-limits-filebrowser-2026-10-17/`.
+Brief „FileBrowser never on its default password (D11 = A), real memory amounts (D10 = A), CI failure mail, STATUS".
+Full report: felhom.eu `REPORT-filebrowser-memory-ci-2026-10-17.md`. Evidence: felhom.eu
+`documentation/audits/filebrowser-memory-ci-2026-10-17/`.
 
 ## 1. What changed
 
-- **R-977:** `internal/stacks/filebrowser_password.go` — the default-login probe runs once per FileBrowser run (the
-  container's StartedAt), not once per box; a new run gets ~20 s to answer. The household's own password is never
-  touched. Comment „before a claim there is no tunnel" corrected (false).
-- **R-1116:** `scripts/controller_gates.py` row `gate-decoys` (full run, blocking).
+- **R-1126:** `internal/infra/infra.go` (FileBrowser on `felhom-filebrowser`, not `traefik-public`), `internal/stacks/filebrowser_gate.go`
+  (join, check, publish by container ID), `internal/stacks/infra.go` and `internal/web/handlers.go` (call sites).
+- **R-1125:** `err.stacks.not_enough_memory` and `deploy.nincs_eleg_memoria_foglalas_telepites` reworded (HU/EN);
+  `stacks.InstallMemory` shared by the check and the install page.
 
 ## 2. Tests (each red-proved)
 
-`TestFileBrowserAdmin_R977_DefaultBackOnANewRunIsReplaced`, `TestFileBrowserAdmin_R977_NewRunIsWaitedForInTheSameTick`;
-`test_controller_gates.py` pins the new runner row. Full suite green; `controller_gates.py --fast` green.
+`TestFileBrowserRender_R1126_NotPublicAtStart`, `TestFileBrowserGate_PublishedOnlyAfterTheCheck`,
+`TestFileBrowserGate_ConnectsTheCheckedContainerById`, `TestR1125_NotEnoughMemorySaysWhatToDo`,
+`TestR1125_InstallMemoryIsTheChecksReading`. Fixtures: two re-captured as `*_r1125`; every other byte-identical.
 
-## 3. Live (scratch 9202, FileBrowser + its data volume removed, the box brings it back)
+## 3. Live (scratch 9202)
 
-0.324.0: default login 200 for 10 minutes, the box keeps „generated". rc.1: replaced 1 s after the controller start, and
-after a second re-create — but 5 minutes after FileBrowser came back (probed while starting). rc.2: replaced 2 s after
-FileBrowser came back. No page changed: every i18n fixture byte-identical.
+FileBrowser + its data removed: 143 probes through Traefik, the default login never 200. Install of a 150 MB app with
+50 MB free: refused (400) in HU and EN, nothing installed; the page showed the same numbers as the check (2,798 vs 2,698).
 
 ## 4. Observations
 
-1. The FileBrowser window on rc.1 was one base-stack round (5 min), not seconds. NOT-A-FINDING: fixed in rc.2 (same release).
-2. The tunnel runs before the claim, and the claim needs it. FILED: R-1126
+1. FileBrowser's own admin-password setting re-applies at every start (measured). NOT-A-FINDING: why Path 2 was built.
+2. The install page used `/proc`'s host-wide memory, not the check's reading. NOT-A-FINDING: fixed in this release.
+3. A TOCTOU in the first gate (connect by name). NOT-A-FINDING: found by the commit security review, fixed before release.