v0.327.0: CHANGELOG, CONTEXT, REPORT (and the R-1129 correction)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,28 +1,29 @@
-# REPORT — v0.326.0: FileBrowser's default password checked at every FileBrowser start; the decoy suite is a gate (2026-10-17)
+# REPORT — v0.327.0: FileBrowser published only after its default login is checked; real memory amounts in the install check (2026-10-17)
 
-Brief „Tester 1 back on the live catalog, decoy suites, memory limits, FileBrowser" (Parts 4–5; Part 2's runner
-change). Full report: felhom.eu `REPORT-tester1-limits-filebrowser-2026-10-17.md`. Evidence: felhom.eu
-`documentation/audits/tester1-limits-filebrowser-2026-10-17/`.
+Brief „FileBrowser never on its default password (D11 = A), real memory amounts (D10 = A), CI failure mail, STATUS".
+Full report: felhom.eu `REPORT-filebrowser-memory-ci-2026-10-17.md`. Evidence: felhom.eu
+`documentation/audits/filebrowser-memory-ci-2026-10-17/`.
 
 ## 1. What changed
 
-- **R-977:** `internal/stacks/filebrowser_password.go` — the default-login probe runs once per FileBrowser run (the
-  container's StartedAt), not once per box; a new run gets ~20 s to answer. The household's own password is never
-  touched. Comment „before a claim there is no tunnel" corrected (false).
-- **R-1116:** `scripts/controller_gates.py` row `gate-decoys` (full run, blocking).
+- **R-1126:** `internal/infra/infra.go` (FileBrowser on `felhom-filebrowser`, not `traefik-public`), `internal/stacks/filebrowser_gate.go`
+  (join, check, publish by container ID), `internal/stacks/infra.go` and `internal/web/handlers.go` (call sites).
+- **R-1125:** `err.stacks.not_enough_memory` and `deploy.nincs_eleg_memoria_foglalas_telepites` reworded (HU/EN);
+  `stacks.InstallMemory` shared by the check and the install page.
 
 ## 2. Tests (each red-proved)
 
-`TestFileBrowserAdmin_R977_DefaultBackOnANewRunIsReplaced`, `TestFileBrowserAdmin_R977_NewRunIsWaitedForInTheSameTick`;
-`test_controller_gates.py` pins the new runner row. Full suite green; `controller_gates.py --fast` green.
+`TestFileBrowserRender_R1126_NotPublicAtStart`, `TestFileBrowserGate_PublishedOnlyAfterTheCheck`,
+`TestFileBrowserGate_ConnectsTheCheckedContainerById`, `TestR1125_NotEnoughMemorySaysWhatToDo`,
+`TestR1125_InstallMemoryIsTheChecksReading`. Fixtures: two re-captured as `*_r1125`; every other byte-identical.
 
-## 3. Live (scratch 9202, FileBrowser + its data volume removed, the box brings it back)
+## 3. Live (scratch 9202)
 
-0.324.0: default login 200 for 10 minutes, the box keeps „generated". rc.1: replaced 1 s after the controller start, and
-after a second re-create — but 5 minutes after FileBrowser came back (probed while starting). rc.2: replaced 2 s after
-FileBrowser came back. No page changed: every i18n fixture byte-identical.
+FileBrowser + its data removed: 143 probes through Traefik, the default login never 200. Install of a 150 MB app with
+50 MB free: refused (400) in HU and EN, nothing installed; the page showed the same numbers as the check (2,798 vs 2,698).
 
 ## 4. Observations
 
-1. The FileBrowser window on rc.1 was one base-stack round (5 min), not seconds. NOT-A-FINDING: fixed in rc.2 (same release).
-2. The tunnel runs before the claim, and the claim needs it. FILED: R-1126
+1. FileBrowser's own admin-password setting re-applies at every start (measured). NOT-A-FINDING: why Path 2 was built.
+2. The install page used `/proc`'s host-wide memory, not the check's reading. NOT-A-FINDING: fixed in this release.
+3. A TOCTOU in the first gate (connect by name). NOT-A-FINDING: found by the commit security review, fixed before release.