v0.326.0: CONTEXT, REPORT

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -7,7 +7,12 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-10-17 (v0.325.0 — burndown 3: limiters, family fingerprints, samba label, path guard, gates in a worktree)
+Last updated: 2026-10-17 (v0.326.0 — FileBrowser's default checked every run; the decoy suite is a full-run gate)
+
+> **2026-10-17 (afternoon) — v0.326.0.** R-977: `EnsureFileBrowserAdminPassword` probes the default login once per
+> FileBrowser RUN (`fbStartedAt`, `fbProbedRun`), with ~20 s for a new run to answer; measured on 9202 before (default 200
+> for 10 min after a re-created volume) and after (replaced in 2 s). The tunnel-before-claim question is the operator's
+> (R-1120). R-1116: `gate-decoys` in the full run (not `--fast`: 22 s, edits real files — R-1122).
 
 > **2026-10-17 (day) — v0.325.0 (burndown 3).** R-1111 `reserveAttempt` is the one limiter body (dashboard sign-in,
 > share password, escrow re-auth). R-1112 `family.json` stores fingerprints; an old file is converted when the

REPORT.md

@@ -1,34 +1,28 @@
-# REPORT — v0.325.0: two more limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree (2026-10-17)
+# REPORT — v0.326.0: FileBrowser's default password checked at every FileBrowser start; the decoy suite is a gate (2026-10-17)
 
-Burndown 3 (Parts 2–5). Full report in plain words: felhom.eu `REPORT-burndown-3-2026-10-17.md`. Evidence: felhom.eu
-`documentation/audits/burndown-3-2026-10-17/`.
+Brief „Tester 1 back on the live catalog, decoy suites, memory limits, FileBrowser" (Parts 4–5; Part 2's runner
+change). Full report: felhom.eu `REPORT-tester1-limits-filebrowser-2026-10-17.md`. Evidence: felhom.eu
+`documentation/audits/tester1-limits-filebrowser-2026-10-17/`.
 
 ## 1. What changed
 
-- **R-1111:** `reserveAttempt` (auth.go) — the share password and the escrow re-auth count a try before the compare.
-- **R-1112:** `family.Fingerprint`; `family.json` holds `fp`; old files converted at load; the store opens at start.
-- **R-1113:** `Store.HouseholdSession` — one household family session, renewed under half-life.
-- **R-1109:** samba compose label `felhom.smb-conf-sha256`.
-- **R-1110:** `TestNoBareDrivePathToPathHelpers`; `GetStackBackupData(nsRoot)`; `appDetailsForPath` through `NamespaceRootFor`.
-- **R-1114:** `scripts/shared_scripts.py`; the runner passes `FELHOM_WORKSPACE`.
+- **R-977:** `internal/stacks/filebrowser_password.go` — the default-login probe runs once per FileBrowser run (the
+  container's StartedAt), not once per box; a new run gets ~20 s to answer. The household's own password is never
+  touched. Comment „before a claim there is no tunnel" corrected (false).
+- **R-1116:** `scripts/controller_gates.py` row `gate-decoys` (full run, blocking).
 
 ## 2. Tests (each red-proved)
 
-`TestR1111_*` (2), `TestR1112_*` (4) + `TestFamily_OldFileThatCannotBeRewrittenIsAnError`, `TestR1113_*`,
-`TestRenderSambaCompose_ConfigHashLabel`, `TestSambaReconcile_SamePathRenameChangesCompose`,
-`TestNoBareDrivePathToPathHelpers`, `test_shared_scripts.py`. Full suite green; `controller_gates.py --fast` green in the
-clone and in a worktree. No page changed: every i18n fixture byte-identical.
+`TestFileBrowserAdmin_R977_DefaultBackOnANewRunIsReplaced`, `TestFileBrowserAdmin_R977_NewRunIsWaitedForInTheSameTick`;
+`test_controller_gates.py` pins the new runner row. Full suite green; `controller_gates.py --fast` green.
 
-## 3. Live (demo-hp 9201, the dashboard's own posts)
+## 3. Live (scratch 9202, FileBrowser + its data volume removed, the box brings it back)
 
-rc.1: samba — share added, renamed (delete + add on the same folder), a second share on the same folder; each read and
-written with `smbclient` from 9202, the old name refused; the label equals the smb.conf hash at every step. rc.1 also
-showed the lazy family-store open (old `family.json` unchanged) → fixed in rc.2: at start „2 session(s) … rewritten as
-fingerprints", file keys `exp, fp, gen, member`. Headless Chrome ×3 through the public address: sign in, `DENY`, POST
-sign-out, MeTube through the family gate; household sessions stayed 2 (no growth).
+0.324.0: default login 200 for 10 minutes, the box keeps „generated". rc.1: replaced 1 s after the controller start, and
+after a second re-create — but 5 minutes after FileBrowser came back (probed while starting). rc.2: replaced 2 s after
+FileBrowser came back. No page changed: every i18n fixture byte-identical.
 
 ## 4. Observations
 
-1. A stacks test wrote `update-journal.json(.tmp)` into its package folder (an empty DataDir); the R-578 source walk in parallel tripped on it once today. NOT-A-FINDING: fixed in this release (`cmdManager` gets its own DataDir; a probe panicking on an empty DataDir ran the whole stacks suite green).
-2. The escrow re-auth answered a wrong password in Hungarian only. NOT-A-FINDING: fixed in this release (`login.msg.wrong_password`, `TestEscrowReauth_WrongPasswordInTheBoxLanguage`, red-proved).
-3. Through the dashboard a rename was already applied before R-1109 (delete and add each change the compose); the label covers a controller update that changes smb.conf alone. NOT-A-FINDING: recorded in the row's close.
+1. The FileBrowser window on rc.1 was one base-stack round (5 min), not seconds. NOT-A-FINDING: fixed in rc.2 (same release).
+2. The tunnel runs before the claim, and the claim needs it. FILED: R-1120