v0.314.0: a restore puts the setup gate back as it was (R-1057); a test build moves with the floor (R-1053); Prowlarr links itself (R-1058); the box claims Plex by address (R-1060)

MinAgent 0.155.0 (unchanged). Tests red-proved by mutation (A: 10, B: 7, C: 1, C2: 2).

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,5 +1,30 @@
-## Unreleased (2026-10-15, afternoon) — the shared rule file; no code change
+## v0.314.0 — a restore puts the setup gate back as it was; a test build moves with the floor; Prowlarr links itself; the box claims Plex again (R-1057, R-1053, R-1058, R-1060) (2026-10-15)
 
+**MinAgent: 0.155.0** (unchanged — no new agent call). No golden: the first release under `09` §3 decision 250 (the floor
+carries it after the three test boxes). Design: felhom.eu `architecture/09-update-architecture.md` §3 decision 253 (the
+restore rule), `07-backup-architecture.md` (what a per-app backup carries), `15-media-library.md` §6 (the links).
+
+- **R-1057 (P2) — a restored app never comes back open.** The per-app backup's `app.yaml` now carries `setup_gate:`
+  (state and who opened it; `stacks.GateCapture`; an app installed before gates existed is recorded open, as it was).
+  The restore applies it (`stacks.ReadGateAtBackup`, `applyGateAtBackup` in `PersistUnitRedeployConfigGate`): closed at
+  the backup → closed now, the gate file written before anything starts (decision 46 F2), also over an installed app;
+  open at the backup → open (an app re-gated since is opened again); no record (a backup made before 0.314.0) of a
+  removed app → closed, and the gate's loop opens it at once if the app's probe says the setup is done. Never open by
+  default. Measured before: Prowlarr restored from a pre-setup backup answered a stranger 200 (felhom.eu
+  `audits/prowlarr-2026-10-15/box/run3/restore.txt`). Tests `restore_gate_test.go`, `r1057_unit_gate_test.go`; ten
+  mutations each seen failing.
+- **R-1053 — a box on a test build moves with the floor.** `util.ParseVersionPre` reads `X.Y.Z-rc.N` as a pre-release
+  BELOW `X.Y.Z` (semver §11); the floor check uses it for the box's own version only. `ParseVersion` still refuses a
+  suffix, so the household's button never offers a test build (`TestR1053_TheButtonNeverOffersATestBuild`). A version the
+  floor cannot compare is now a WARN, once per (version, floor) — it was a DEBUG line. The floor tests that read the
+  result before the background update could run now wait for it (six tests; one mutation proven).
+- **R-1058 — Prowlarr links itself.** Prowlarr's own start (install, start, restore) runs the media wiring
+  (`linkOnlyApps`, `wiresOnUp` in `internal/stacks/manager.go`); installed after Sonarr/Radarr it no longer waits for
+  „Bekötés most". No marker in the catalog (the marker binds drives; Prowlarr uses none).
+- **R-1060 (P2) — the box claims Plex again.** Every call to Plex (claim, identity, library wiring, sessions) goes to
+  the container's ADDRESS, resolved at each call (`mediawire.PlexURL`): Plex refuses the Host name `plex` as non-local
+  and answered the claim 401 in 0 ms on demo-hp 9201 (felhom.eu `audits/media-build-2026-10-15/G7/G5c`–`G5e`). Tests
+  against a fake Plex that refuses the name, as the real one does.
 - `.claude/rules/unprompted-work.md` §3 item 6: **a controller release needs no golden** — the floor carries it after the
   three test boxes; agent releases still wait for the operator's vouch; the golden is weekly (operator ruling 2026-10-15
   11:26, `09` §3 decision 250; the same morning's „bake first", decision 247, reversed). Same text in all five copies.